Part 3: Implications for Regulatory Oversightof Human and Organisational Factors
Fukushima Daiichi Human and Organisational Factors
Summary 4
1 Introduction 8
1.1 ThetenthanniversaryoftheaccidentattheFukushimaDaiichinuclearpowerplant 8
1.2 TheHOFSectionanditsoversightactivity 8
1.3 Thetopicsinthisreport 11
2 TheFukushimaDaiichiaccidentfromasystemicperspective 12
2.1 Considerationofthesystemicapproach 15
2.2 Conclusionforoversightinrespectoftheconsiderationofthesystemicapproach 17
2.2.1 Oversightofhumanandorganisationalfactorsindueconsiderationofthesystemicapproach 18
2.2.2 Oversighttopicsinthehumanandorganisationalfactorsareaaspart ofaconsiderationofthesystemicapproach 20
3 Theresilientorganisation 24
3.1 Resilience 25
3.2 Safety-IandSafety-II 28
3.3 ThetaskofthesupervisoryauthoritiesinthecontextofresilienceandSafety-II 34
3.3.1 Interimconclusion 38
3.4 ConclusionsfortheHOFSection 39
3.4.1 Basicconsiderations 40
3.4.2 MethodsforSafety-IIoversightinthehumanandorganisationalfactorsarea 42
4 Decision-makinginemergencysituations:influencingfactors 48
4.1 Decision-makingunderuncertainty(situationaleffects) 49
4.2 Individual-relatednegativeeffectsinthedecision-makingprocess 50
4.3 Peoplewhomakegooddecisions 51
4.4 Impactmodelofhumanperformanceunderextremeconditions 53
4.5 Oversightrelatingtothetopicofdecision-making 54
4.6 Conclusion 55
5 Adigressionconcerningresilience:aninputfromcivilaviation 56
5.1 Developmentandtraining:processadaptation,improvisationanddecisions 57
5.2 Fromflightpreparationtofinaldestination:raisingawarenessoftheunexpectedintheday-to-dayroutine 58
5.3 Thefourpotentialsforresilience 60
5.4 Reflection–learningfromthespecialfeaturesofcivilaviation 61
5.5 Reflection–conclusionsfortheoversightoftheHOFSection 61
6 Closingwords 62
7 References 64
8 Endnotes 68
TableofContents
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
SincetheaccidentattheFukushimaDaiichiNuclearPowerPlanton11March2011,theHumanandOrganisationalFactors(HOF)SectionofENSIhascontinuedtoconsiderwhatlessonscanbedrawnfromit.Onthetenthanniversaryoftheaccident,itispublishingareport,derivedfromthefindings,ontheimplicationsforitsregulatoryactivity.
Theaccidentfromasystemicperspective
TheanalysisoftheFukushimaDaiichiaccidenthasshownthatavarietyofinteractinghuman,technicalandorganisationalfactorscontributedtoboththeoriginsandcourseoftheaccident.Theoccurrenceoftheaccidentcannotbeexplainedbysimplelinearcausalrelationships.Likewise,itisnotsufficienttofocusexclusivelyontheHTOsystem(human-technology-organisation)oftheFukushimaDaiichinuclearpowerplant.Rather,theviewmustbeextendedtoincludethecomplexbehaviourandnetworkofthehigher-levelsystemsofvariousactors,includingthesupervisoryauthorities.Therefore,asystemicapproachisneededbothforaccidentanalysisandintheoperationandsupervisionofnuclearinstallations.
Acrucialtoolforapplyingandmonitoringasystemicapproachisaneffectivemanagementsystemthattakesintoaccounttheinteractionbetweenthehuman,technicalandorganisationalcomponentsofthesystem.ThismanagementsystemisstructuredcyclicallybasedontheprincipleofcontinuousimprovementandcoverselementsoftherelevantHTOsystematthework,processandstrategylevelonthebasisofthesystemicapproach.
Oversighttopicstakingintoaccountthesystemicapproach
Initsoversight,theHOFSectionchecksthedegreetowhichthesystemicapproachhasbeentakenintoaccountbythesupervisedorganisationsalongsidetheelementsofthecontinuousimprovementcycleonthebasisofconcreteoversightitemsandpriorities.These
oversightitemsconcerntopicssuchasthepurpose,visionandstrategyofthesystem,thesystembound-ariesandtheexternalcontextofthesystem(atthestrategylevel),theprocessesandactivitiesforeffectiveandsafeoperation(primarilyattheprocesslevel),theHTO-relatedinfluencesforsafety-relatedactivitiesinthedailyworkofthemembersoftheHTOsystemunderconsideration(attheworkinglevel)aswellastheeffectivenessofmeasures(attheprocesslevel)andthecontinuousimprovementofsystemrobustnessandresilience(atthestrategylevel).
Oversighttakingintoaccountthesystemicapproach
Acentralprincipleofoversightisthatthelicenceholders,andconsequentlytheoperatorsofnuclearinstallationsareresponsibleforsafety.Themannerinwhichthesupervisoryauthorityinterpretsandperformsitstaskinpracticeinfluencesthecapacityandwillofthesupervisedpartiestoassumeresponsibility.FortheoversightofcomplexHTOsystemstakingintoaccountthesystemicapproach,notonlyaretheoversightitemsimportant,butthewayinwhichtheoversightitselfisperformedisalsosignificant.
Intheliterature,adistinctionisoftenmadebetweentwobasic«regulatorystyles».A«compliance»-orientedoversightfocusesonspecifiedproceduresandchecksifthesearestrictlycompliedwithbythesupervisedparties.In«performance»-orientedoversight,thesupervisoryauthorityassessestheperformanceofthesupervisedpartiesinrespectofpredefinedcriteria,leavingthewayandmethodofachievingtheobjectiveswithintheremitofthesupervisedparties.ForcomplexHTOsystems,oversightthatisexclusivelycompli-ance-oriented,inparticularforthesupervisionofhumanandorganisationalfactors,isjudgedtobeunsuitableandtohindertheassumptionofrespon-sibilitybythesupervisedorganisations.ComplexHTOsystems,suchasthenuclearinstallationssupervisedbyENSI,thereforerequirearegulatorystrategyandoversightapproachesbasedonthesystemicapproach
Summary
5Summary
thataresuitableforcopingwiththecomplexityandcontext-dependencyofthesesystems,andforstrengthening,oratleastnotimpairing,thesystems’assumptionofresponsibility.Itisnotpossibletomeettheserequirementswitha«standardised»,alwaysinvariableregulatorystrategyandmethodology.Theconceptof«responsiveregulation»representsapossiblewayofdealingwiththedynamicsofcomplexHTOsystemswhereoversightisconcerned.«Respon-siveregulation»referstoaformofoversightwhichisnotbasedonauniformandinvariableregulatoryapproachforallsupervisedorganisations,butratherallowsthesupervisoryauthoritytousedifferentregulatoryapproachesandinterventions,dependingonthecontextandbehaviour,thecultureandthelevelofsafetyofthesupervisedorganisations,enablingittoescalatefromdialogue,convictionandself-regula-tion-basedoversightthroughincreasinglydemandingandprescriptiveinterventionsuptoandincludingwithdrawaloflicencesorprosecution.
Theresilientorganisation
InviewofthehighcomplexityofmodernHTOsystems,organisationsmustaccepttheinsightandfactthat,inspiteofthebestpossiblepreparationforanticipatedevents,theycannotprotectthemselvesagainstallpossible(undesirable)eventualitieswithtechnicalandorganisationalmeansorpreparethemselvesspecificallyforallpossibleeventualities.Theymustexpecttheunexpectedandbeabletodealwithitwhenitoccurs.Inotherwords:They–andtheiremployees–mustberesilient.Theperformanceofanorganisationisresilientwhentheorganisationcanfunctionasrequiredunderbothexpectedandunexpectedconditions.Acentralelementoftheresilienceconceptistheadaptivity(adaptivecapacity)ofthesystemunderconsideration(e.g.ofanorganisation)andthedevelopmentandmaintenanceofthiscapability.Itisnotjustaquestionoftheabilitytorecoverfromhazardsandstrains,butoftheabilitytoachievetherequiredperformanceunderthevarietyofdifferentconditionsandtorespondappropriatelytobothdisturbancesand
opportunities.Thisconceptofresilienceisbasedonanunderstandingofsafety,whichinthesafetysciencesiscalled«Safety-II»,asopposedtothetraditionalunder-standingof«Safety-I».Insimpleterms,Safety-Iimplieslearningfromthingsthatgowrong,withthefocuson«work-as-imagined»,andisaimedatstrengtheningcompliance.Safety-II,ontheotherhand,implieslearningfromthingsthatgorightwithafocuson«work-as-done»,andisaimedatstrengtheningresilience.TheSafety-IIviewonsafetyfocusesonanorganisation’sabilitytoguidetheadaptabilityofpersonnelandsystemsbyunderstandinghowcomplexsystemsareforthemostpartsuccessfulandonlyoccasionallyfail.Safety-IandSafety-IIarenotmutuallyexclusive.Rather,theSafety-IIperspectiveencompassesorextendstheSafety-Iperspective,thusmakingitpossibletodealwithsituationsinwhichtheSafety-Iapproachisnot(anylonger)appropriatebecauseoftheincreasingcomplexityofHTOsystems.
OversightagainstthebackgroundofresilienceandSafety-II
Thesupervisoryauthority,throughitsoversight,influencesthecapacityofthesupervisedorganisationstooperateinaresilientmanner.Itmustthereforedesignitsoversightinsuchawaythatitstrengthens,ordoesnothinder,thedevelopmentofpracticesandculturesinthesupervisedorganisationsaimedatreinforcingtheresilienceandintegrationoftheSafety-IIapproach.Dialoguewiththesupervisedpartiesisacentralelementofanappropriateregulato-rystrategyinthecontextofresilienceandSafety-II.Aspartofitsoversight,itisessentialforthesupervisoryauthoritytounderstandhowthesupervisedorganisa-tionfunctionsonaday-to-daybasisandwhichfactors(includingsituationalandcontext-related)influencethisfunctioning.Oversightmustbecharacterisedbyaninsightintothenormalfunctioningofthesystem.
TheHOFSectionhassetitselftheobjectiveofques-tioningandfurtherdevelopingitsoversightworkinthecontextofSafety-IIandresilience,andofdeveloping
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
regulatoryapproachesandmethodsthatappearsuitableforstrengtheningtheresilienceandtheSafety-IIapproachinthesupervisedorganisations.Forexample,thefocusofoversightactivityinthehumanandorganisationalfactorsareashouldnotbeexclusivelyoncompliance,butalsoonstrengtheningreflectionanddirectresponsibilityofthesupervisedpartiesinthesenseofperformance-orientedoversightaswellasonunderstandingthenormal,everydayfunctioningofthesupervisedorganisationinitssitua-tionalcontext.Therefore,theobjectofoversightshouldincreasinglybe«work-as-done»,thatisthewayinwhichworkisactuallycarriedout,asopposedto«work-as-imagined»,i.e.anidealisedconceptionofhowitshouldbecarriedout.Thisalsomeansthatattentionintheoversightshouldnotonlyfocusonthe«negative»,butalsoonthe«positive»or«normal».SuchSafety-II-orientedoversightinthehumanandorganisa-tionalfactorsareafocusesonmethodsthatpromotedialoguewiththesupervisedpartiesandtheirself-reflection.
Decision-makinginemergencysituations
Decisionsplayacentralroleinsituationswhereresil-ienceisrequired,forexampleinemergencysituationssuchasthoseduringtheaccidentattheFukushimaDaiichinuclearpowerplant.Insuchcircumstances,decisionsmustbemadeunderconditionsofuncertain-ty,timepressureandstressandfrequentlywithoutthenecessaryinformationbeingavailable.Incomplexemergencysituations,decision-makingisinfluencedbysituationalfactorsaswellasfactorsthataffectasinglepersonoranentiregroup.Toolssuchasemergencyprocedureshelptoreducethecomplexityofthesituationbystandardisationandreductionofthescopeofaction.Ontheotherhand,however,theexpansionofthescopeofactionthroughflexibilityandlearningalsohelpsindealingwithcomplexity.Inthisrespect,learningandintegrationofknowledgearefocalpointsandlearningopportunitiesplayanimportantroleineverydayoperations.
Inemergencysituations,inadditiontosituation-relatedinfluences,therearealsoeffectsrelatedtoindividualsthatcaninfluencethedecision-makingabilityofindividualsorgroupsofpeople,suchastheso-calledcognitiveemergencyresponseinindividualsorgroup-thinkwheregroupsofpeopleareconcerned.Suchperson-relatednegativeeffectscanbeprevented,forexamplebytraining.Effectiveself-managementisimportantinpreventingacognitiveemergencyres-ponse.Peoplewithgooddecision-makingskillscommu-nicateeffectivelyandassumeleadershipandresponsi-bility.Forexample,toavoidgroupthink,arationalandbalancedinformationsearchisimportant,andeachgroupmembershouldbeabletoexpresstheirthoughtsandargumentsindependentlyoftheothers.Incomplexsituations,aplannedapproachbasedonclearlydefinedproceduralrequirementsandthehelpofsuitabledecision-makingaids(e.g.checklists)isrecommended.
Insummary,eveninemergencysituations,humanabilitiesandcharacteristicsaswellastechnicalandorganisationalfactorsaffecthumandecision-makingperformanceinawidevarietyofways.Therefore,attentionmustbepaidtoallinfluencingfactors.
DecisionsaresubjecttotheoversightoftheHOFSectioninavarietyofcircumstances.Forexample,theyareconsideredinspecialistdiscussionsorinspections,inwhichformalprocesssequencesarechecked.Decision-makingbehaviourisobservedduringemergencyexercisesorlicencingexamsontheplantsimulatororevaluatedduringeventassessments.
Learningfromotherindustries
Valuableinsightsandapproachesinthehumanandorganisationalfactorsareacanalsobederivedfornuclearsafetyoversightfromthemethodsandexperienceofcivilaviation.
7Summary
Aresilientorganisationstrivestobealertandflexiblesothatitcanadaptatanytimetotheprevailingsituationandisthereforepreparedforunexpectedsituations.
Abriefinsightintotheeducationandtrainingfor,aswellasimplementationintothedailyworkroutine,ofpreparingandcarryingoutaflightbyanairlinecabincrewillustrateshowpreparationfortheunexpectedisperformedonapracticalbasisinanotherindustry.Inadditiontorobusttrainingintheareaofsafety,aircraft-specifictrainingandan«onthejob»introductionperiod,recurrenttrainingandtrainingsequencesalsohelpinexercisesdealingwithconstantlyvaryingsituationsandrequirements.Forexample,thetrainingteacheshowtoimproviseifemergencyequipmentismissingandhowtodealwithnewsituations.Pre-flightcrewbriefingsarealsousedtolearnfromeachcrewmember’sexperienceandtoprepareforanyunexpectedevents.Eachmemberofthecabincrewpaysattentiontounexpectedsituationsbeforetheflight,duringthesafetycheckontheaircraft,passengerboarding,thepreparationfortake-off,duringandaftertheflight,isawareofpossiblesignalsandpreparesthemselvesmentallyforvariousscenarios.Theindustryuseswell-practisedtechniquesandprocedures.
Crewmembers,withtheirimplicitandexplicitknowledge,experience,training,alertness,situationalawareness,flexibilityandcreativity,theirdecisionsandtheinherentscopeofactiontheyneedtoadapttheiractionsandbehaviourareconsideredassafetyfactorspreparedandqualifiedtorespondtounexpectedsituations.
OutlookThisreportisthestartingpointforfurtherreflectionanddevelopmentoftheoversightoftheHOFSectionagainstthebackgroundofthefindingsgleanedfromtheaccidentintheFukushimaDaiichinuclearpowerplantandthecurrentstatusofthesafetysciences.Fromtheidentifiedtopicsandpresentedmethodsandapproachesforfutureoversight,theHOFSectionwilldevelopanactionplanforshort,mediumandlong-termimplementation.
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
The11March2021marksthetenthanniversaryoftheaccidentattheFukushimaDaiichinuclearpowerplantonandtheassociatedmemoriesofthiseventremainattheforefrontofpeoples’minds.ENSIemployeescanstillremembertheimagesandnewsthatarrivedinasteadystreamandthegrowingcertaintythathighlysignificanteventswereplayingoutatFukushimaDaiichi.
Sincetheaccident,theHumanandOrganisationalFactors(HOF)Sectionhasbeenconsideringtheeventsduringtheaccidentaswellasthecausesoftheacci-dent.Itdiscussedtheseinparts1(/11/)and2(/15/)ofthisseriesofreports.Sincethen,ithasalsobeencontinuouslyworkingonthelessonsitcanderiveforits
TheHOFSectionistheorganisationalunitwithinENSI,which,basedontherelevantlegalandofficialregula-tions,monitorscompliancewiththesafety-relevantaspectsoftheinteractionofhuman,technicalandorganisationalfactorsinanuclearinstallationandreviewstheassociatedprojects.Itsremitalsoincludesperiodicallyreviewingand,ifnecessary,revisingtheofficialregulationslaiddowninENSIguidelinesinthecontextofthehumanandorganisationalfactorsofanuclearinstallation.Itisbasedoninternationallyharmo-nisedrequirementsaswellasonthestateoftheartinsafetyresearch.
ownoversight.Althoughitisnowtenyearssincetheaccident,recentfindingshavearisenfromtheexperi-enceofitsownoversightactivitiesandfromtheexperiencesharedbyothersupervisoryauthoritiesacrosstheworldininternationalcommittees,fromwhichtheHOFSectionhasbeenabletodrawconclu-sionsforitsownoversight.
TheHOFSectionofENSIisthereforepublishingathirdreporttomarkthetenthanniversary.Unlikethefirsttworeports,inwhichthemainfocuswasontheanalysis,i.e.theunderstandingoftheaccidentandthecircumstances(/11/,/15/),thisreportdealswiththeimplicationsfortheoversightactivityoftheHOFSectionderivedfromthefindings.
TheHOFSectionofENSIisaninterdisciplinaryteamconsistingofworkandorganisationalpsychologistsaswellasengineers.BothprofessionalgroupsundergofurthertraininginthesubjectareasoftheHOFSectionbothtechnicallyandinrespectofoversightmethods.
1.1 ThetenthanniversaryoftheaccidentattheFukushimaDaiichinuclearpowerplant
1.2 TheHOFSectionanditsoversightactivity
1 Introduction
9Introduction
TheoversightactivityoftheHOFSectionincludesinparticularthefollowingtopics:effectivenessandcontinuousimprovementofthemanagementsystem;suitability,trainingandauthorisationoflicencedpersonnel;inspectionofthereportsofthesupervisedparties;designoforganisationalprocesses,worksystemsandworkequipment,forexampleinthecourseoftechnicalchangestoanuclearinstallation;measurestopromotethesafetyculture,suchas,amongothers,leadership,responsibilityordeci-sion-making;evaluationofeventsinthehumanandorganisationalcontext;configurationoftheorganisa-tionandemployee-relatedaspectsinthecontextoforganisationalchanges.
ThelegalmandateofENSIistoensurecompliancewiththeapplicablestatutoryandofficialregulationsbytheoperatorsofnuclearinstallations(seeArt.72NEA/36/).Theimplementationofthismandateisbasedontheviewthatoversightisnotonlyaboutmonitoringcompliancewiththeregulatoryframeworkbutalsoaboutstrengtheningsafety(/10/,/14/).Itshouldalsobeborneinmindthatinthehumanandorganisationalcontext,theabove-mentionedregulationsareoftenformulatedingeneralandabstractterms1andcannotalwaysbeclearlymeasured.TheseissuesarereflectedinthediverseoversightmethodsusedbytheHOFSection.Thesemethodsarebrieflydescribedbelow.
TheoversightmethodsusedbytheHOFSectioncaninprinciplebedividedintomethodsof«target-actualcomparison»(oversight«inthestrictersense»,see/12/)ormethodsfortriggering(self-)reflectiononsafety(oversight«inthebroadersense»,see/12/).
The«target-actualcomparison»representstheclassic«compliance»approach.ENSIcheckswhethertheinternalspecificationsofthesupervisedpartiesandtheworkcarriedoutaspartofthenuclearinstallation’severydaylifecomplywiththestatutoryrequirements.Thiscategoryofoversightmethodsincludes,inparticular,inspections,themonitoringofreportsofthesupervisedpartiesandtheassessmentofreportableevents(see/13/).With«target-actualcomparison»methods,topicsforwhichclearlymeasurablerequire-mentsexistintheregulatoryframeworkaremonitored.The«triggerfor(self-)reflection»occursingroupdiscus-sionswiththehelpofaspecificfacilitationofthedialoguebyENSI.ENSIconsidersacapabilityfor(self-)reflectionasanindispensableprerequisite,forexample,tolearnfromexperience.Thiscategoryofoversightmethodsincludes,inparticular,specialistdiscussions,inwhichsubjectareaswithabstractandgenerallyformulatedlegalregulationsareexamined.
1| AnexampleofsuchagenerallyformulatedrequirementcanbefoundinArt.5oftheNuclearEnergyActNEA(/36/),wheretheestablishmentofasuitableorganisationisrequiredasaprotectivemeasurefornuclearsafety.However,itisnotspecifiedwhatismeantbya«suitable»organisation.
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
Box1:MethodsusedbytheHOFSectionindiscussionswithsupervisedparties
• Inspections:Inspectionsareusedintarget-ac-tualcomparisonsofoversightitems.TheHOFSectionleadsinspectionsofthemanagementsystem,forexample,andparticipatesintheinspectionsofothersections.Thelatterare,forexample,inspectionsthattakeplaceonsiteattheinstallationandwhoseinspectionobjectsrequiregreaterorganisationandcoordinationoftheparticipatingpersonsbelongingtothesupervisedparties(e.g.performanceofperiodictests,commissioningofmodifiedplantparts).
• Specialist discussion promoting a dialogue on safety culture(see/12/):Bymeansoftheseopenandconstructivespecialistdiscussions,theaimoftheHOFSectionistoinitiateself-reflectiononthepartofthesupervisedpartiesinrespectoftheirsafetyculture.Thediscussionstakeplaceeverythreeyearsandconsistoftwoparts,eachapproxi-matelythreehourslongandseparatedbyaperiodofafewweeks.Inthefirstpartthereisadiscussionaboutasafety-culturerelatedissuespecifiedbytheHOFSection.Inthesecondpart,thereflectioniscontinuedingreaterdepth.ThisdeepeningisbasedonfindingsandhypothesesthattheHOFSectionhasdevelopedfromthefirstpartofthediscussion.
• Exploratory specialist discussion: Thisdiscussionalsoservestotrigger(self-)reflection.ItisconductedbytheHOFSectionaloneortogetherwithtechnicalexpertsfromothersections.Theannouncementletterexplicitlycontainsquestionsthatareintendedtotriggerquestioningandreflectionontheissuestobediscussed.Thesediscussionsusuallylast,dependingonthetopic,oneandahalftothreehoursandarethenclosed.Exploratoryspecialistdiscussionsareconduct-edtodiscussmoresensitivetopicsinthehumanandorganisationalcontext(e.g.ontopicssuchasresourcesandleadership)orquestionsaboutorganisationallearningwiththesupervisedparties.
• Information discussion: Thistypeofspecialistdiscussionisusedtocollectinformation,e.g.afterevents,inthecaseoforganisationalchangesorinthecontextoftechnicalmodernisationprojects.SpecialistinformationgatheringdiscussionsareoftenconductedtounderstandchangesthatmustbeapprovedbyENSIortoobtainthenecessaryknowledgetobeabletoawardapermit.TheHOFSectionalsoconductsanannualspecialistdiscussionwiththeoperatorsofthenuclearpowerplantsoncurrenttopicsandupcomingchangesinthecontextofpersonnelororganisation.
ThisreportdealswithhowtheoversightactivityandmethodsoftheHOFSectionaretobedevelopedfurtheronthebasisofthefindingsfromtheaccidentattheFukushimaDaiichinuclearpowerplantandbasedonrecentdevelopmentsinthesafetysciences.
2| TheoversightactivityoftheHOFSectionisnotonlybasedondiscussions,butalsotoasignificantextentonthedocumentsandotherdataavailableinwriting(e.g.safetyindicators)ofthesupervisedparties.
Box1illustratestheoversightmethodsbasedondiscussionswithexamplesofoversightitemsoftheHOFSection2.
11Introduction
ThenumerouseventanalysesoftheaccidentattheFukushimaDaiichinuclearpowerplantrevealalargenumberofcontributingfactors.Aselectionoftheseissuesiscoveredinthisreport.Inaseriesofwork-shops,theHOFSectionidentifiedthefollowingmaintopics,whichitconsiderstobecentraltoitsoversightactivityandwouldliketodeepeninthecontextofthisreport.
Thesystemicapproachrecognisesthecomplexityofsystemsandconsidersthemtogetherwiththeirinterfacesandinteractionsintheirentirety.Thewholeismorethanthesumoftheindividualcomponents.Theneedtoapplyasystemicapproachtotheopera-tionofnuclearinstallationsandtheiroversightisoneofthekeyfindingsandrecommendationsfromtheanalysesoftheaccidentattheFukushimaDaiichinuclearpowerplant(e.g./31/).Section2ofthisreportdealswiththeFukushimaaccidentfromasystemicperspectiveanditsimplicationsfortheoversightexercisedbytheHOFSection.
InviewofthehighcomplexityofmodernHTOsystems,organisationsmustaccepttheinsightandfactthat,inspiteofthebestpossiblepreparationforanticipatedevents,theycannotprotectthemselvesagainstallpossible(undesirable)eventualitieswithtechnicalandorganisationalmeansorpreparethemselvesspecificallyforallpossibleeventualities.Theymustexpecttheunexpectediandbeabletodealwithitwhenitoccurs.Inotherwords:they–andtheiremployees–mustberesilient.Section3ofthisreportdealswiththeconceptof(organisationalwithadigressiontoindivi-dual)resilienceandtheunderlyingunderstandingofsafety(«Safety-II»).ThesectionfocusesontheimportanceofresilienceandSafety-IItooversight.TheHOFSectionderivesimplicationsforitsownoversightworkfromthis.
TheaccidentattheFukushimaDaiichinuclearpowerplanthasalsoshownthecentralimportanceofappropriatedecision-making.Thisisthesubjectofsection4ofthisreport.
Section5containsadigressioninwhichthetopicsunderconsiderationarediscussedinthecontextofcivilaviation.Itdescribes,usingconcreteandpracticalexamples,howmembersoftheflightcrewpreparethemselvesfortheflightandwhatmethodstheyusesothattheyarealwayspreparedfortheunexpected.
Finally,section6summarisestheimplicationsthattheHOFSectionhasidentifiedforitsoversightanditsintentionsregardingitsimplementation.
Withintheindividualchapters,inadditiontothetheoreticaldiscussionofthetopicsandconcepts,implicationsfortheoversightoftheHOFSectionarederived.Thesearetobeunderstoodaslong-termprojectsoftheHOFSectionandwillbeintroducedgraduallyinfutureoversightworkandcontinuouslydevelopedfurther.Thereportdoesnotinanywayclaimtobecomplete.Rather,itservesasthebasisandstartingpointforthecontinuousdevelopmentofthetopicsandoversightmethodsandthefollowingupoftherelevantliterature.
Thereportisaimedatatechnicallyinterestedaudi-ence.Itsaimistodeepenthetreatmentofthetopicscoveredandtoderiveconclusionsandmethodsdirectlyapplicabletooversight.Inaddition,itisintendedtostimulatetechnicalexchangeswithinterestedparties(e.g.thesupervisedpartiesorspecialistsinthehumanandorganisationalfactorsareainothersupervisoryauthoritiesorinternationalwork-inggroups).Thisiswhy,wherenecessary,thereportalsousesspecialisttermsandconceptsinthefieldofhumanandorganisationalfactors.
1.3 Thetopicsinthisreport
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
TheanalysisoftheFukushimaDaiichiaccidenthasshownthatavarietyofhuman,technicalandorganisa-tionalfactorscontributedtoboththeoriginsandthecourseoftheaccident.Moreover,thesefactorsweremutuallyinteracting.Theverydynamiccourseoftheaccidentandtheextremelycomplexsituationduringtheaccidenthaveshownthattheaccidentcannotbeexplainedbysimplelinearcausalrelationships.Itwouldalsobeanoversimplificationtostatethattheaccidentwascausedsolelybyinsufficienttechnicalprecautionsintheformofinsufficienttsunamiprotectionandalackoftechnicalemergencypreparednessbecausethedeficienciesinthedesignoftheplantwere,inturn,duetodeeperunderlyingreasonsinnon-technicalareas.Therefore,thequestioninconnectionwiththecauseoftheaccidentis,whythedeficitsinthesafetyprecau-tionscouldhavearisenandwhytheyweretoleratedforsolong.ItturnedoutthatthecausesarenotonlytobefoundintheHTOsystem(human-technology-organisa-tion)oftheFukushimaDaiichinuclearpowerplant,butextendfarbeyondthat.
2 TheFukushimaDaiichiaccidentfromasystemicperspective
13 The Fukushima Daiichi accident from a systemic perspective
HTO system “nuclear installation”
Supplier,designer
International level (WANO, IAEA, OECD/NEA, etc.)
ResearchPolitical parties,
NGO’s
Public
Supervisory authority
Others…CustomerMedia
National level
Box2:HTOsystem(human-technology-or-ganisation)anditsbehaviour
AnHTOsystem,suchasanuclearinstallation,isadynamicwholewithavarietyofdifferentfunc-tionsthatarenetworkedandinteractwitheachother.Afunctionreferstooneormoreactivitiestoachieveaspecificobjective(output)asasub-taskforfulfillingthepurposeofthesystem.Here,itdoesnotmatterwhoorwhatperformsthefunctionwithinthesystem:theorganisation,thetechnologyorhumans.InanHTOsystem,functionalactivitiesareinfluencedbyavarietyofhuman,organisational,andtechnicalfactors(seeFigure1).
ThebehaviourofHTOsystemsiscomplexbe-causethefunctionsinteractwitheachotherinaspecific,dynamicrelationshipandinmanyways
(/44/).Interventionsinsuchcomplexsystems(e.g.workonsite)notonlyaffectindividualfunctions,butcancauseavarietyofchangesinneighbouringfunctionsandaffecttheoverallsystem(/44/).Duetothehighdegreeofinter-connectednessanddependenciesandthepossi-blecombinedeffects,itisnolongerpossibletodescribefullyallfunctionswiththeirpropertiesandallpotentialinteractions(/6/,/44/).Small,localdeviationsmayspreadthroughthesysteminadifficulttopredictmanner(non-linearity).Therefore,thepredictabilityofsystembehav-iour(output)andcontrollabilityareparticularlydemandingincomplexsystems(/44/).
Whenwetalkabout«system»,«overallsystem»,etc.inthefollowing,thismeansanHTOsystemunderstoodinthisway.
Figure1:The«nuclearinstallation»HTOsystemanditsexternalstakeholders
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
Externalstakeholders,suchastheparentcompanyTEPCOasthelicenceholder,thesupervisoryauthorities,theJapanesegovernment,politicsandthegeneralpublicinJapanhadadecisiveimpactonthesafetyoftheFukushimaDaiichinuclearpowerplant.Inthissense,thiswasembeddedintheoverallnuclearpowerprogrammeinJapan.Fortheirpart,theseexternalstakeholdersconstantlyinteractedwitheachother.Fortheaccidentanalysis,itwasthereforenecessarytogobeyondtheHTOsystemrepresentedbytheFukushimaDaiichinuclearpowerplantandlookbeyonditforcontributingfactorstothecauseoftheaccident.
FactorscontributingtotheshortcomingsinthesafetyprecautionsoftheFukushimaDaiichinuclearpowerplantincludedfactorsaffectingtheparentTEPCOgroupasthelicenceholder.Forexample,anineffectiveprogrammefortheexploitationofnationalandinterna-tionaloperationalexperiencefeedbackledtoanoverlyslowassessmentandtreatmentofexternalthreatssuchasearthquakesandtsunamis(/31/).
Theaccidentanalysisalsoshowedthatthesupervisoryauthorities,inparticulartheNuclearandIndustrialSafetyAgency(NISA),didnotapproachtheiroversightworkinasufficientlysystemicway.Amongstotherthings,the2015IAEAreport(/31/)stressedthattheagencyfrequentlyconsideredissuesbasedoncompart-mentalisedthinkinganddidnotaddressmattersinasufficientlycomprehensiveandsystemicmanner,i.e.notallaspectsrelevanttosafetywereincluded.Particu-larattentionwaspaidtotechnicalaspects,butlittleattentionwaspaidtooperationalaspectsortohumanandorganisationalfactors.Inaddition,thesupervisoryauthoritieswerenotinclinedtolearnfrominternationalexperienceandshowedatendencytoisolatethem-selves.TheyfrequentlyarguedthatforeignexperienceandapproacheswerenotapplicableinJapan(/31/)ii.
ApplyingthesystemicapproachtotheFukushimaaccidentgivesrisetothefollowingfindings:
• Ontheonehand,thesystemicexaminationoftheaccidentanalysishasenabledidentificationofalargenumberofcontributinghuman,technicalandorganisationalfactors,andtheirmutualinfluenceoneachother.Indoingso,itwasnecessarytogobeyondthelimitsofthe«Fukushi-maDaiichinuclearpowerplant»HTOsystemandtoincludetheexternalcontextofthevariousmutually-influencingstakeholders.
• Ontheotherhand,theanalysisalsoshowedthattheresponsiblemanagerswerenotsufficientlyawareofthesystemicapproachtoassessingandimprovingpowerplantsafetyprecautionsintheperiodpriortotheaccident.ThisisconfirmedbytheIAEAinvestigationreport(/31/).Thisshowedtheimportanceofthecontinuoususeofthesystemicapproachforeffectivesafetyprecautions.Accordingly,oneofthekeyIAEArecommenda-tionsfromtheanalysisoftheaccidentrelatestotheapplicationofasystemicapproachbyallparticipatingactors(/1/)iii.
15 The Fukushima Daiichi accident from a systemic perspective
AnessentialrequirementoftheIAEArulesandregula-tions(/32/)istheneedforaneffectivemanagementsystem.Thisappliestoallphasesofthelifecycleofanuclearinstallation.Inordertoachieveandmaintainaneffectivemanagementsystem,theIAEAregulatoryframeworkandtheENSIguidelineontheorganisationofnuclearinstallations,ENSI-G07(/9/),emphasisetheimportanceoftakingintoaccounttheinteractionbetweenthehuman,technicalandorganisationalsystemcomponents.Managersatalllevelsoftheorganisationarerequiredtoidentifyandconsidertheseinteractionsintermsoftheeffectivenessoftheoverallsystemintheirimplementationofthemanagementsystem.Theresultsofsuchregularcheckingoftheeffectivenessofthemanagementsystemshouldbeusedtobetterunderstandtheoverallsystemanditsmultitudeofinteractions,andtocontinuouslyimprovesafety.Theconsiderationofthesystemicapproachinordertoachieveaneffectivemanagementsystemhasalreadybeenenshrinedinnationalandinternationalrulesandregulationsanditsapplicationinthecontextofcontinuousimprovementcannotbeavoided.
TherequirementsoftheIAEA(/32/)forthesystemicapproachreferredtoareinnosmallpartduetoexperiencegleanedfromtheanalysisoftheFukushimaDaiichiaccident.Thequestionofhowtoapplythesystemicapproachisnoteasytoanswerbecausethenetworkofhuman,technicalandorganisationalfactorsaffectingasystemsuchasanuclearpowerplantleadstocomplexinteractionsoffunctions.Engineeringbackfitsandanincreaseinthevolumeoforganisation-alregulationshaveledtoanincreaseinthenumberoffunctionsandtheirlevelofinterconnectioninnuclearinstallations.Consequently,thesystembehaviourhastendedtobecomemorecomplex,makingitevenmoredifficulttounderstandandpredict.Thismeansthatwhileadoptingthesystemicapproachhasbecomeevenmoreimportant,italsohasbecomemoredifficult.
ThetopicsshowninFigure2introducedinthereporton«HumanandOrganisationalPerformance»oftheWorkingGrouponHumanandOrganisationalFactors(WGHOF)oftheOECD'sNuclearEnergyAgency(NEA)provideassistanceonwhichtopicsneedtobead-dressedfortheapplicationofthesystemicapproachatthestrategic,proceduralandworkinglevel.Dependingonwhichsystemisconsidered,theindividualtopicsfromFigure2needtobedealtwithinmoreorlessdetail.Foratechnicalsafetysystemwhosepurposeistofeedcoolantintothereactorinanemergency,thetopicstobeconsideredareprimarilyattheprocessandworkinglevel,whereastheentirenuclearpowerplantasanHTOsystemwithitspurposeofgeneratingelectricityalsohastodealwithimportanttopicsatthestrategiclevel.Theindividualtopicsareexplainedinmoredetailinsection2.2.2wheretheirrelevanceforoversightisdiscussed.
2.1 Considerationofthesystemicapproach
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
Thesetopicsfollowtheprincipleofcontinuousim-provementofthemanagementsystem(PDCAprinciple«Plan-Do-Check-Act»),onthebasisofwhichtheeffectivenessofthemanagementsystemisalsocheckedandcontinuouslyimproved.Thecyclicalapplicationofthetopicsisofprimeimportancebe-causethisistheonlywaytoguaranteeacontinuouslearningprocessthatensuresprogressinunderstandingandimprovingsystembehaviour.Thisisunavoidablegiventhecomplexityanddynamicsofthesystemdescribedabove.
Anyconsiderationofthetopicsrunsfromthemacroleveltothemesoleveltothemicrolevelandbackagaininacyclicalsequence.Thedetailedviewatthemicroorworklevelisnotlimitedtoaparticularlevelinthehierarchy.Itconcernsallhierarchylevelsinanorganisa-tion,fromthetopmanagementthroughtotheimple-mentinglevel.
ThetopicscanbeappliedtoanyHTOsystemafterthesystemlimitshavebeendefined.Inprinciple,thesesystemlimitscanbefreelyselected.Thelimitsofa
systemrelativetoitsenvironment,i.e.toasurroundingsystem,arenotabsolutelyspecified,butaretobedefineddependingontherespectiveperspectivefromwhichthesystemislookedat.Forexample,aparticulardepartmentofacompanyisasubsystemfromanorganisationalpointofview,whilefromthepointofviewofthedepartment,theorganisationistobeviewedaspartofthesystemenvironment(/44/).Innuclearinstallations,individualprocessesortechnicalsystemscanalsobeconsideredinthisway.However,itshouldbenotedthatanexclusivelyisolatedviewofindividualsubsystemsisnotsufficienttounderstandoverallsystembehaviour,sincethesesubsystemsareinturninterconnectedandinteractwitheachother.Fromasystemstheorypointofview,itthereforemakessensetoincludeallfunctionsthatcontributetotheresult(output)ofthesystembeingconsidered,forexampleintermsofproductivity,innovationorsafety(/59/).Irrespectiveoftheselectedsystemlimits,externalinfluencingfactors,i.e.influencesstemmingfromtherespectivehigher-levelsystem,mustalwaysbeincludedintheconsideration.
Level Topics
Macro(strategic level)
Meso(process level)
Micro (work level)
(4) Interrelations between the processes and activitiesÞÞ Key activities(5) HOF for the key activities
(6) Measure, monitor and control the effectiveness
(8) Involvement of humans at all levels
(2) System boundaries and external context
(1) Purpose, vision and strategy of the system
(3) Processes and activities for an effective and safe operation
(7) Continuous improvement of system robustness and resilienceFigure2:Continuous
improvementcyclebasedonthesystemicapproach
17 The Fukushima Daiichi accident from a systemic perspective
TheaccidentattheFukushimaDaiichinuclearpowerplantoccurredbecausethesafetyandemergencypreparednessforanexternalhazardintheformoftsunamiswasinsufficient.TheoperatorTEPCOwasresponsibleforplantsafety.Nevertheless,theJapanesesupervisoryauthoritieshadtoverifythatTEPCOeffectivelyassumedthisresponsibility.Todoso,theyhadtoassesswhetherthesafetyprecautionsfortheFukushimaDaiichinuclearpowerplantwereinlinewiththeapplicableregulatoryframework.
Asdescribedabove,thecausesoftheaccidentcannotsolelybetracedbacktothelackofassumptionofresponsibilitybytheoperator.Theroleofoversightinthehigher-levelnuclearpowersysteminJapan,therelationshipbetweenoperatorsandsupervisoryauthoritiesandtheunderlyingregulatoryframeworkwerealsocontributingfactors.
Againstthebackgroundofacollectiveassumptionofsufficientrobustnessofthetechnicaldesignoftheplantinthefaceofexternalhazards(see/31/andsection3),thesupervisoryauthoritiesdidnotrecognisethatthereweredeficienciesinthesafetyprecautionsandthereforedidnotaddressthemeffectively.
Thisomissionbythesupervisoryauthoritieswas,ofcourse,facilitatedbyaninadequatenationalregulatoryframework.Atthattime,however,therewerealreadyinternationalrulesandregulationsinplace(/32/)thatrequiredtheoperator’smanagementsystemtobeeffective.ThisimpliesthattherewasaprocessinplaceforcontinuousimprovementwhichincludedanactivesearchforopportunitiesandrisksintheHTOsystem.
AnimportantfindingfromtheIAEAreport(/31/)andtheaccidentreportsoftheJapanesegovernmentisthatthestakeholdersinvolved,inparticularoperators
andsupervisoryauthorities,didnotlookactivelyenoughfordeficienciesinthesafetyprecautionsinthenuclearpowersysteminJapan.
Thislessonfromtheaccidentshouldalsobealong-termguidefortheoperatorsandthesupervisoryauthorityinSwitzerland.Anactiveefforttodiscoverpossiblelatentdeficienciesinsafetyprecautionsrequiresthebasicattitudeofimprovedunderstandingofthesystemunderconsideration,whileatthesametimeacceptingthatthisunderstandingwillneverbecompleteandfinalised,butratherrepresentsacon-tinuouslearningprocessduetothecomplexityanddynamicsoftheHTOsystemsunderconsideration.
InSwitzerland,ENSIpursuesthisobjectivewithitsintegratedoversight.Aprerequisiteforstrengtheningsafety(missiontakenfromENSImissionstatement/10/)includeseffortstocontinuouslyimprovetheunder-standingofthemonitoredHTOsystemsunderchang-ingframeworkandboundaryconditions.ThequestionishowbesttoachievethisinthecontextofoversightactivityandhowtofurtherdevelopoversightsothatthesupervisoryauthoritycontributesaseffectivelyaspossibletothecontinuousimprovementofthesafetyperformanceofthesupervisedHTOsystems.
Inthecontextofthesystemicapproach,thisisontheonehandaboutthetypeofoversightinthehumanandorganisationalfactorsarea(section2.2.1)andontheotherhandaboutthefocusoncertainoversighttopics(section2.2.2).
2.2 Conclusionforoversightinrespectoftheconsiderationofthesystemicapproach
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
Afundamentalprincipleofoversightisthatthelicenceholders,andconsequentlytheoperatorsofnuclearinstallationsareresponsibleforsafety(see.Art.22NEA/36/and/14/).Themannerinwhichthesupervisoryauthorityinterpretsandperformsitstaskinpracticeinfluencesthecapacityandwillofthesupervisedpartiestoassumeresponsibility.Intheworstcase,itcanevenhaveanegativeimpactonthem,forexamplebymaintainingatooprescriptiveregulatorystyle,i.e.byprescribingtothesupervisedpartiesintoomuchdetailwhattheymustdo.Inthiscontext,adistinctionisoftenmadeintheliteraturebetweentwobasic«regulatorystyles»,wherebytheseareusuallynotappliedinoneortheotherpureform,butusuallyoccurinacombinationofbothwithdifferentfocus(/59/):«compliance»-orien-tedoversight(prescriptiveoversight)asopposedto«performance»-orientedoversight(orgoal-orientedoversight,results-orientedoversight).Compliance-or–ientedoversightfocusesonspecifiedregulationsandchecksifthesupervisedpartiesstrictlycomplywiththem.Inperformance-orientedoversight,thesuperviso-ryauthorityassessestheperformanceofthesupervisedpartiesinrespectofpredefinedcriteria,leavingthewayandmethodofachievingtheobjectiveswithintheremitofthesupervisedparties(/59/).Wilpert(/59/)identifiesanumberofpotentialnegativeeffectsof(strict)«compliance»-orientedoversight,suchasasharpincreasein(regulatory)requirements,excessiveinter-ventionbythesupervisoryauthorityintheday-to-dayoperationsofthesupervisedparties,anincreaseinconflictandmistrustintherelationshipbetweenthesupervisoryauthorityandthesupervisedparties,anincreasingdemotivationandatendencytoblindlymeettheregulatoryrequirementsonthepartofthesuper-visedparties,anegativeinfluenceonlearningforallinvolvedpartiesandanincreasingtakingoverofresponsibilitybythesupervisoryauthority.HeconcludesthatincomplexHTOsystemssucharegulatorystyleisunsuitable,especiallyforthesupervisionofhumanand
organisationalfactors.Withintheframeworkofaperformance-orientedoversightapproach,self-assess-mentbythesupervisedorganisationbecomesmoreimportant.Acrucialaspectoftheregulatoryworkisthedialoguebetweenthesupervisoryauthorityandthesupervisedpartiesinordertodefineappropriateperformanceindicators.Wilpertseesacultureofopenandself-criticalcooperationbetweenthepartiesandakindofcommon«managementbyobjectives»asnecessary,whichresultsinasharedlearningprocessforbothsides.
SidneyDekker(/6/)statesthatcomplexsystemscannotbe(exclusively)regulatedbymeansofacompliance-basedapproach.Oversightisconsideredaspartofthe«protectivestructures»inthesystem,thepurposeofwhichistobringdiversityintothesystem.Inspectorsplayademandingroleinthisunderstandingofover-sightandmustbeboth«insiders»and«outsiders».Thismeansthatontheonehand,theymusthavesufficientknowledgeandexperienceofthesystembeingsuper-visedsothattheyknowwhattolookforandareabletodetectweaksignals.Ontheotherhand,iftheyaretoostrongly«insiders»,theywillnolongerbeabletobringdiversityintothesystem,i.e.anexternalviewandthusimpulsesforfurthersafetyimprovements,impulseswhichthesupervisedpartiesthemselvesarepossiblynolongerabletogeneratebecauseoftheirdirectinvolve-ment.AccordingtoDekker,oversightimpliesbeingsensitivetothecharacteristicsofcomplexity,forexampleinterdependencies,interactions,diversityorlearning.Thismeansthatinspectionsofsystempartsmustinparticularlookforpossibleinteractionswithsurroundingpartsofthesystemorothersystems.Itisimportanttolistentodifferentnarratives,i.e.toincludediverseperspectivesfromdifferentactorsfromdifferentpartsofthesystem(/6/).
2.2.1 Oversightofhumanandorganisationalfactorsindueconsiderationofthesystemicapproach
19 The Fukushima Daiichi accident from a systemic perspective
Theexplanationsonoversightinconnectionwiththesystemicapproachincomplexsystemsshowthatitisnotpossibletodefineandapplya«standardised»,alwaysinvariableregulatorystrategyandmethodology.Theconceptof«responsiveregulation»representsapossiblewayofdealingwiththedynamicsofcomplexHTOsystemsinoversight.«Responsiveregulation»referstoakindofoversightwhichdoesnotapplyauniformandunchangingregulatoryapproachforallsupervisedorganisations,butratherusesdifferentregulatoryapproachesandinterventionsbythesupervisoryauthority,dependingonthecontextandbehaviour,cultureandsafetylevelofthesupervised
Figure3:Exampleofaregulatorypyramid(source:QueenslandWorkplaceHealthandSafety(Australia)/63/)
organisations(/2/iv,/24/).Toillustratetheapproachof«responsiveregulation»,aso-calledregulatorypyramid(seeFigure3)isgenerallyused,whichdescribestheescalationlevelsfromoversightbasedondialogue,convictionandself-regulationatthelowestlevels,toincreasinglydemandingandprescriptiveinterventionsuptothewithdrawaloflicencesorprosecution.Theroleofthesupervisoryauthorityortheinspectorsisaccordingly,atthelowestlevel,theopeningofadialoguewiththesupervisedorganisationanditsmotivationtomakecertainchanges.Atthehighestlevels,ithasatitsdisposalpunitiveinstrumentsincludingstrictsanctions(/52/).
SanctionsCourtsanctions
Criminalproceedings
AdministrativesanctionsEnforceableundertaking
InfringementnoticeSeizuree.g.equipment,plant,
workplaceSuspensionofoperationorcancellation
oflicenceorapprovalsandrelateddisciplinaryaction
DirectingcomplianceOrdertosecurecompliance
ProhibitionnoticeDirectiontomakeunsafeelectricalworkelectricallysafe
ElectricalsafetyprotectionnoticeUnsafeequipmentnotice
ElectricalsafetynotificationDangerousgoodsdirective
ImprovementnoticeRiskcontrolplansVerbaldirections
EncouragingandassistingcomplianceIncidentinvestigations
Targetedworkplaceinspections,AuditsTechnicalservices
PreventionprogrammesInformation,guidance,eduction,adviceandrecommendations
Recognitionandawardsprograms
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
Basedontheimprovementcycleconsideringthesystemicapproach(seeFigure2)theHOFSectionhasderivedoversightitemsfromthetopicsmentionedthere,atthemacro,mesoandmicrolevels,whosesupervisionprovidesabetterpictureofwhetherandhowthesupervisedpartiespursueasystemicapproachforensuringaneffectivemanagementsystem(seeFigure4).Aspartofthesupervisoryprocedureex-plainedinsection2.2.1,thegrowingunderstandingofthetopicsandtheHTOsystemshouldalsoincreasethechancesofimprovingthesafetyprecautions.
Thefundamentalacceptancethat,duetothecomplexi-tyanddynamicsoftheHTOsystem,theremayalwaysbeweaknessesinthesafetyprecautionsthatarenotknowntotheoperatorsandthesupervisoryauthorityleadstothefindingthat,inparallelwiththeeffortstoidentifyandaddresstheseweaknesses,itisessentialtoprepareforunexpectedsituations(seesection3).
AtthemacrolevelinFigure4,topic(1)relatestothepurposeandobjectivesofthesystemandthestrategytoachievethem.InrespectofthesupervisionofnuclearpowerplantsinSwitzerland,thespecialrela-tionshipbetweenthelicenceholderandtheplantmanagercanbeidentifiedasakeyoversightitem.Essentially,theresponsibilityforsafety-relateddecisionscannotbetransferredtothirdparties.ThelicenceholderisresponsibleforthesafetyofitsnuclearplantinaccordancewithArt.22oftheNuclearEnergyAct(/36/).AccordingtoArt.30para.4NEO/37/,thelicenceholdermustdesignatetheplantmanagerwhoisresponsibleforthesafeplantoperationincludingthesafety-relateddecisions.Thisresultsinasharedassump-tionofresponsibility,whichintheworstcasecanleadtoaconflictofobjectivesbetweenthelicenceholder,representedbytheExecutiveBoardappointedbythelicenceholder,andtheplantmanager.
AnyuncleardirectionorstrategyresultingfromapossibleconflictsituationcouldhaveanegativeimpactonthepeopleinvolvedinthenuclearinstallationasanHTOsystemandthusunfavourablyinfluencesafety.TheHOFSectionhasbeenlookingatthetopicofsharedresponsibilityaspartofitsoversightforalongtimeandwillcontinuetopursueitinthefuture.
Anotherimportantoversightitematthemacrolevelistopic(2)«Systemboundariesandexternalcontext»inFigure4.TheboundariesoftheHTOsystemunderconsiderationmustbeclearlydefined.
Theexternalcontextoutsidetheboundariesofthesystemofthenuclearinstallationmayhaveaninfluenceonthenuclearinstallation.Thiscantaketheformofpoliticalandeconomicinfluence,forinstance.Anotherexampleisthenegativepublicperceptionofnuclearenergy,whichmayhaveanimpactontheattractivenessofcompaniesinthenuclearenergysectoraspotentialemployers(/50/).Theconsequencescanbelong-termproblemsinrecruitingnewemployees,whichcouldbeexacerbatedbyadeclineintrainingopportunitiesinthefieldofnuclearengineering.Economicpressure,whichcanarisefromfallingearningsonthemarkets,couldbemanifestedintheformofcostreductionprogrammesforoperatorsofnuclearinstallations.Concerningtheoversightofhumanandorganisationalfactors,theexternalcontextinwhichthenuclearinstallationsoperatesmustbecloselymonitoredandsocial,politicalandeconomicchangesneedtobetakenintoaccount.
Atthemesolevel,topics(3)«Establishingprocessesandactivitiesforeffectiveandsafeoperation»and(4)«Identifyinginteractions»areaboutdesigningthenecessaryprocessesandactivitiesfortheeffectiveandsafeoperationoftheHTOsystem.TheprocessesandactivitiesrequiredforanHTOsystemsuchasanuclearinstallationaresoextensivethatacomplexnetworkofinteractionsbetweenthemiscreatedthatcannotbefullyunderstood,especiallyintermsoftheiroveralleffect.However,sinceanoverallunderstandingofthesystemisthemainobjectiveandthebasisforthe
2.2.2 Oversighttopicsinthehumanandorganisationalfactorsareaaspartofaconsiderationofthesystemicapproach
21 The Fukushima Daiichi accident from a systemic perspective
continuousimprovementofthesystem,itisnecessarytocontinuouslylearnfromtheongoingoperatingexperience.Withappropriateawareness,thisiterativelearningprocesscanresultinabetterunderstandingoftheinteractionsbetweenprocessesandactivities.Inaddition,itwillbepossibletoidentifykeyactivitieswithaparticularlyhighdegreeofcross-linkingandwhicharethereforeparticularlyimportantforsystemperformance.
TheHOFSectionhasbeensupervisingtheregula-tion-compliantdesignofmanagementsystemprocess-esformanyyearsandhasidentifiedspecialkey
Level Topics
macro(strategic level)
Meso(process level)
Micro (work level)
(4) Interrelations between the processes and activitiesÞÞ Key activities(5) HOF for the key activities
(6) Measure, monitor and control the effectiveness
(8) Involvement of humans at all levels
(2) System boundaries and external context
(1) Purpose, vision and strategy of the system
(3) Processes and activities for an effective and safe operation
(7) Continuous improvement of system robustness and resilience
Integrated systemassessment
Resilience
Corporate governance
Work-as-done vs. Work-as-imaged
Effectiveness
Employees involvement
External context
processesofinterestforsafety.However,theinterac-tionbetweenprocessesandactivitieshasstillonlybeenaddressedinarudimentaryfashion.Inthisrespect,thismaybeafutureoversightfocusinanefforttomakeprogressinunderstandingimportantinterrelationsbetweenprocessesandactivitiesandgainanevenmorein-depthunderstandingofthesystem.
Figure4:Derivationofoversightitemsfromthecontinuousimprovementcycle
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
TheexperienceoftheHOFSectionsofarshowsthatinterdisciplinarycooperationisanessentialsuccessfactorfortheidentificationofinteractions.Forexample,therehavebeeneventswhereaclosecollaborationbetweenthespecialistsfromdifferentdisciplineswererequiredtoanalysethecausesbothattheoperatorandatENSI.Aregularinterdisciplinaryexchangepromotesthiscooperationandprovidesanopportunitytoidentifyandaddresscross-organisationalinteractions.Infuture,theHOFSectionaimstopromotethisinterdisciplinarycooperationwithintheoperators’organisationsthroughitsoversightandtoachieveanevenmoreintenseinterdisciplinaryexchangewithinitsownorganisation.
Withthekeyactivitiesidentifiedundertopic(4),i.e.activitieswithaparticularlyhighdegreeofinterlinkingandthereforeofparticularimportanceforsystemperformance,itispossibleatthemicroleveltolookmorespecificallyattheinfluencingfactorsinrelationtoeachofthesekeyactivitiesundertopic(5)«Determin-ingHTOinfluencingfactorsforkeyactivities».Fromthesupervisoryauthority’spointofview,thefocushereisalwaysonthesafety-relatedimportanceoftheseactivitiesfortheHTOsystem.Atthislevel,itisnowpossibletocarryoutahuman-centredassessmentoftheactivity,includinganyinfluencingfactorsthatmakethisactivityasuccess.Thisapproachisconcernedwithidentifyinghuman(individualabilities,situationalaware-ness,mentalstate,etc.),technical(human-machineinterface,accessibility,technicalautomation,etc.)andorganisational(workdocuments,schedule,workequipment,etc.)influencingfactors.
Especiallywhenassessingreportableeventscausedbyindividualerrors,theHOFSectiondoesnotprimarilylookforthecausesoftheeventintermsofthepersonwhocommittedtheevent-triggeringerror.Rather,itisamatterofidentifyingfactorsintheorganisationthathavecontributedtoanindividualerrorattheendofachainofactorsthatcouldhave(safety-relevant)consequences.
TheHOFSectionwillbeinformedofsucherrorsifthecorrespondingeventsarereportable.ThesituationisquitedifferentforthemultitudeofdailyactivitiesthataresuccessfullyprocessedintheHTOsystemofthesupervisedpartiesandwherethissuccessismoreoverbasedonthefactthatpeople,becauseoftheirabilitiesandmotivation,areabletorespondproperlytothevagariesthatareconstantlyoccurringinrealityandtomakethenecessaryadjustmentssothattheactivitycanbecarriedoutsuccessfully.AdetailedobservationbythesupervisoryauthorityofdailyactivitiessuccessfullycarriedoutcanprovideimportantinformationonthefunctioningoftheHTOsystemintwoways.Ontheonehand,itisaquestionofrecognisingwhethertherequirementsthathavebeendefinedatthestrategicandprocesslevels(«work-as-imagined»3)areactuallypracticableandapplicableattheworkinglevel.Ontheotherhand,theadaptabilityofpeopleandteamsattheworkinglevelinthesenseofasuccessfulresponsetotheunpredictable,everydayenvironmentalfluctuationsprovidesindicationsastohowwellpeopleandthusthesystemcanrespondtounpredictableevents(«work-as-done»4)(seealsosection3).Thisiswhereitbecomesclearhowimportantanunderstandingofeachindividu-alactorintheHTOsystemisforthepurpose,objectivesandstrategyoftheoverallsystem,sothatperformanceattheworkinglevelcanbeadaptedforthebenefitofthesystemanditssafety.
Thereinforcementofoversightattheworkinglevelappearstobeausefulstepinfurtherdeepeningtheunderstandingofthetwopointsmentionedabove(seealsosection3.4).
3| Theterm«work-as-imagined»referstotheassumptionsorexpectationsofhowworkshouldbecarriedout(see/29/).Thisisdefined,forexample,intheplanningofwork,inproceduresorinprocessesofthemanagementsystem.
4| Theterm«work-as-done»referstothewayinwhichaworkisactuallycarriedoutbytheemployees(see/29/).
23 The Fukushima Daiichi accident from a systemic perspective
Withinthecontinuousimprovementcycle,topic(6)«Effectiveness»isaboutevaluatingtheeffectivenessofsystemperformanceintermsofthestrategicandprocessobjectives.Theassessmentshouldtakeplaceonasmanylayersaspossibleandshouldconsiderbothquantitativeandqualitativemethodsforassessingeffectiveness.
ThequestionoftheeffectivenessofmeasuresisonethattheHOFSectionhasbeenraisingformanyyearsinthecontextoflearningfromeventsinthesupervisednuclearinstallations.Thechallengeistobringtogethermanyfindingsfromoperatingpracticeandtosubjectthemasawholetoanassessmentofeffectivenessattheoverallorganisationallevel.Inthisway,theoperat-ingresultscanbeusedinanaggregatedforminordertocreatethenecessarydecision-makingbasisforfurtherstrategicmanagementbytheseniormanage-ment.Continuous,overallorganisationallearningisonlypossibleifthepotentialforimprovementisderivedfromtheoperatingresultsandtheirassessedeffectivenessatthestrategiclevel,andleadstoareadjustmentoftheobjectivesandstrategyofthesystem.ThisreadjustmentshouldalwaysbearinmindthepurposeoftheHTOsystem.
TheHOFSectionwillcontinuetofocusontheassess-mentoftheeffectivenessofthemeasurestakenbythesupervisedpartiesasabasisforawellworkingcon-tinuousimprovementcycle(/51/).
Topic(7)«Continuousimprovementofsystemrobustnessandresilience»isaimedatthecontinuousimprovementoftheHTOsystem.Onthebasisofthefindingsfromeffectivenesschecks,itmakessensetodevelopthesystemintwodirections.Ontheonehand,thisrelatestoidentifyingpossiblesafetygapsaspartoftheprecautionsandthenclosingthemwithappropriatemeasures.Here,acontinuoussearchforandassessmentofrisksaswellastheresultingoppor-tunitiesrelatingtothesafetyoftheoverallsystemisrequired.Ontheotherhand,aneffortshouldbemadetoimprovethemanagementoftheunexpected.This
resultsfromtheawarenessthat,inspiteofextensivesafetyprecautions,unexpectedconditionsoreventscanalwaysoccur.Thisisespeciallytrueforveryinfrequentcrisissituations.AdetailedconsiderationoftheresilienceoftheHTOsystemandderivedfindingsforoversightisdiscussedinsection3.
Thedriversforthecyclicapplicationofthesystemicapproacharethepeopleinvolvedinsystemperfor-mance.Asustainablelearningprocessisonlycreatediftheparticipantsatalllevelsareinvolvedinthecon-tinuousimprovementprocess(topic(8)).Eachpersonneedstounderstandtheircontributiontotheoverallsystemandshouldbemotivatedtodothistothebestoftheircapabilitiesandtoconstantlyimproveit.
Likewise,adifferentiateddiscussionoftherisksandopportunitiesregardingsystemperformanceshouldalsotakeplace,consideringtheinteractionsbetweentheindividualfunctionsoftheHTOsystem.Againstthisbackground,anongoinginterdisciplinaryex-changeandinterdisciplinarycooperationshouldtakeplacebetweenthepeopleinthesystem.
Thequestionoftheinvolvementofemployeesintheprocessofsystemunderstanding,interdisciplinarycooperationandtheirmotivationtolearnandimprovehasbeenaddressedbytheHOFSectionforalongtimewithintheoversightframework,especiallyinthecontextofsafetyculture.
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
TheanalysisoftheFukushimaDaiichiaccidenthasdemonstratedthat,overthedecades,adeeplyrootedcollectiveassumptionhademergedandwasalsocontinuouslymaintainedamongtheJapanesenuclearindustry,regulatoryauthorities,politicsandsociety,accordingtowhichtheJapanesenuclearpowerplantsweresufficientlyprotectedagainstexternalandinternaleventsduetotheirrobusttechnicaldesignandtheadministrativeandorganisationalmeasurestaken,andthatalargescaleaccidentcouldnotoccur(/31/).Thisdeeplyrootedcollectiveassumptionledtotheactorsnotanticipatingsuchanevent.Asaresult,theplantswereinadequatelydesignedandinsufficientlyorganisa-tionallyprepared.Theeffectsoftheearthquakeandsubsequenttsunamiwavesimpactedontheminanunexpectedmanner.
TheprevailingbasicassumptionthattheJapanesenuclearpowerplantsweresufficientlysafealsoledtotheregulatoryframeworkcontaininginadequatespecificationsforaddressingthetsunamirisk.Thesupervisoryauthority,NISA,wasoftheopinionthat,whereemergencypreparednesswasconcerned,itwasnotnecessarytoanticipateaneventthatwouldcausesuchlargereleasesofradioactivityrequiringprotectivemeasuressincerigoroussafetyrequirementsaswellas
safetyinspectionsandanadequatemanagementofoperationswerealreadyimplementedinJapanv.Accordingly,thesupervisoryauthoritydidnotimple-mentitsregulatoryactivitiesinasufficientlyproactiveandeffectivemanner(seesection2)(/31/).
Ontheotherhand,duringtheaccident,inspiteofextraordinarilydifficultworkingandoperatingcondi-tions,employeeswereabletoimprovisesolutions,thankstotheirtireless,selflessandcourageousefforts,theknowledgeandexperienceofthoseinvolved,andtheirabilitytoimproviseusingthefewavailablere-sourcesandtechnicalsystems.Theemployeeswereabletoadapttheorganisationtothedynamicrequire-mentsofthesituationandpreventtheaccidentfrombecomingevenmoreserious(/17/;seealsothedetaileddescriptionoftheeventsinthefirstdaysaftertheearthquakeandtsunamifromtheperspectiveofthepeopledirectlyinvolvedonsiteinpart2oftheENSIreport/15/).
3 Theresilientorganisation
25 The resilient organisation
3.1 Resilience
TheeventspresentedhererelatingtotheaccidentattheFukushimaDaiichinuclearpowerplant–thenatureoftheresponseofthesiteemployeesaftertheacci-dentoccurred,butalsothelackofanticipationofthepossibilityofsuchaneventandthecorrespondinglyinsufficientpreparationaswellasthelessonslearnedfromit,bothinJapanvandelsewhere–canbecon-sideredfromtheviewpointoftheconceptof«resil-ience»5,vi.Thisconceptisusedinvariousscientificandtechnicaldisciplines(e.g.ecology,psychology,sociolo-gy,medicine,engineering,etc.)(see,forexample/17/,/29/,/61/)andisalsodiscussedinparticularinthesafetysciencesinvarioussectors(e.g.inhealthcare,airtrafficcontrol,etc.(/61/)).Theconceptofresiliencehasalsobeendiscussedinthenuclearindustry,atleastsincetheaccidentatFukushima(e.g./38/,/39/,/47/).OneofthekeyconclusionsdrawnbytheIAEAfromitsanalysisoftheaccidentattheFukushimaDaiichinuclearpowerplantpointstotheneedforresilienceinorganisations,wherebythisabilitymustbedevelopedwellbeforeunexpectedeventsoccur,i.e.,undernormaloperatingconditions.Atthesametime,appropriatemeansmustbemadeavailabletorespondtounexpectedevents(/31/vii).
Therearemanydefinitionsforresilienceinthelitera-ture.Dependingonthefieldofapplication,differentaspectsandlevelsintheoverallsystemareemphasised(see/17/,/43/,/65/).Commontothevariousconceptsisthebasicprinciplethatallorganisedhumanandtechnicalactivitiesaretoacertainextentcharacterisedbyinherentvariability.Suchvariabilityisnecessaryforthesuccessfulfunctioningofsocio-technicalsystems,astheconditionsunderwhichpeopleoperatecon-stantlychangeandpeoplethereforehavetoconstantlyadapttheiractivitiestothesechangesandthecurrentsituation(/56/).Asafurthercommonfeature,resilienceimpliestheactiveuseofdifferentsocio-technicalresources(e.g.skills,knowledge,relationshipsbetweenactors,technicalequipment,values,creativity,etc.)tocopewiththosesituationsthatthreatentheobjectivesthatarecurrentlybeingpursued(/43/).
Acentralelementoftheresilienceconceptisthustheadaptivity(adaptivecapacity)ofthesystemunderconsideration(e.g.ofanorganisation)andthedevel-opmentandmaintenanceofthiscapability.AccordingtoWeickandSutcliffe(/58/),resiliencerequireselastici-tyandrecovery:ina«resilienceepisode»,somethingisneededthatcanstretchandbendwithoutbreaking,andthenatleastpartiallyreturntoitsoriginalform.However,thisdoesnotnecessarilymeanthattheoriginalstateofthesystemmustbecompletelyrestored.Adaptationalsoincludesatransformationofthesystemsothatitcancopewiththeneworchang-ingrequirements(see/65/).Resilientorganisationsarenoterror-free,butneverthelesstheyarenotdisabledbyerrors(seeforexample/58/viii).Toputitanotherway:«resilientsystemsfailgracefully»(/65/,p.18).
Socio-technicalsystemsareoftencomplexandoperateincomplexenvironments(seesection2;seealso,forexample,/28/).Theyarethereforeconfrontedwithuncertaintiesandmustbeabletocopewiththemonaday-to-daybasis.Adistinctionismadebetweentwobasicwaysofdealingwithuncertaintiesintheorganisa-tionalsciences:minimisationofuncertaintiesthroughstandardisationandreductionoftheactors’scopeofactionthroughcentralisedcontrolontheonehand,aswellascompetenthandlingofuncertaintiesthroughflexibility,increasingtheactors’scopeofactionanddecentralisationontheother(/18/,/44/,/49/;seealsosection4ofthisreport).AccordingtoGrote,anorgani-sationorteammustfindasuitablebalancebetweenstabilityandflexibility,dependingontheuncertaintiesandrequirementswithwhichtheymustcopeortowhichtheymustrespond(/19/).Anorganisationmustbeabletoadaptquicklytochangingconditionsandrequirements(/21/).Theabilitytorespondtochangingrequirementsbyadjustingthemodeofoperationisafeatureofresilienceinorganisations.
Resilienceisthesubjectofoneofthefivecriteriaofso-called«HighReliabilityOrganisations»(HRO)(«commitmenttoresilience»/58/).Basedonthe
5| «Resilience»referstotheabilityofpeople,aloneortogether,tocopewitheveryday,minororsignificantsituationsbyadaptingtheirperformancetothecondi-tions.Theperformanceofanorganisationisresilientiftheorganisationcanfunctionasrequiredunderbothexpectedandunexpectedconditions(changes/distur-bances/opportunities)(/29/).
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
understandingofWeick&Sutcliffe(/58/),resilienceisacombinationofkeepingerrorssmall,improvisingemergencysolutionstokeepthesystemfunctioning,andabsorbingchangesinordertopersist.Amongstotherthings,theyconsiderthedevelopmentofanextensiverepertoireofskillsasacentralconditionfortheformationandmaintenanceofresilience,forexamplethroughthepresenceofpersonnelwithdiverseknowledge,experienceandabilities,i.e.thepresenceofdiversitywithintheorganisation.Asaresult,thereisawiderangeofactionsandtheabilitytoimproviseavailableforcopingwithunexpectedsituations.
ErikHollnagel(/29/)differentiatesbetweenfourpoten-tialsorabilitiesthatmustbeavailableinanorganisationforittobeabletofunctionresiliently.Consequently,inHollnagel’sunderstanding,itisnottheorganisationitselfthatisresilient,butratheritsperformanceoritsfunctioning.Thefourpotentialsofresilienceare:
• The potential to RESPOND: «Knowingwhattodo»;theabilitytorespondtoregularorirregularchang-es,disturbancesandopportunitiesbyactivatingpreparedactions,byadaptingthecurrentfunction-ingorbyinventingorcreatingnewwaysofdoingthingsix;
• The potential to MONITOR:«Knowingwhattolookfor»;theabilitytomonitorwhatmayaffectanorganisation’sperformance–positivelyornegative-ly–inthenearfuture(i.e.withinthetimespanofthecurrentoperationorworkprocesses,e.g.thedurationofaflight).Themonitoringmustincludeboththeorganisation’sownperformanceandalsoitsenvironmentx;
• The potential to LEARN:«Knowingwhathashappened»;theabilitytolearnfromexperience,especiallytolearntherightlessonsfromtherightexperiences.Thisincludesboththesmalllearningcircle(singleloop)fromspecificexperiencesandthelargelearningcircle(doubleloop),whichisusedtochangeobjectivesxi;
• The potential to ANTICIPATE: «Knowwhattoexpect»;theabilitytoanticipatefuturedevelop-ments,suchaspotentialdisturbances,newrequirementsorconstraints,newopportunitiesorchangingconditionsxii.
Theconceptofresilienceisoftenassociatedwiththeabilitytorespondtonegative,undesirableeventsorconditions.However,asMacrae&Wiig(/43/)pointout,anintegratedconceptofresilienceshouldalsointegrateapositiveperspectivexiii.Thisaccentuationofthepositiveornormalfunctioningandthedevelop-menttowardamorecomprehensiveunderstandingoftheconceptofresilienceisalsoreflectedintheevolu-tionofthedefinitionofthistermovertime(/29/).Therefore,resilienceisnotjustaquestionoftheabilitytorecoverfromhazardsandstrains,butratheroftheabilitytoachievetherequiredperformanceunderavarietyofdifferentconditionsandtorespondappropri-atelytobothdisturbancesandopportunitiesxiv.
Suchanencompassingconceptofresilienceisbasedonanunderstandingofsafety,whichinthesafetysciencesiscalled«Safety-II»,asopposedtothetradi-tionalunderstandingof«Safety-I»(/28/).
27 The resilient organisation
Box3:Individualresilience
Individualresilienceisnotanoversighttopic.Nevertheless,asasupplementtotheresilienceoforganisations,theconceptofindividualresiliencewillbebrieflyoutlinedhere.
Anappropriaterepresentationforindividualresil-ienceistheLotoseffect.TheLatintermresiliremeans«bounceoff»or«jumpback»andcanbeobservedwithLotosplants(/5/).Resilienceistheabilitytosuccessfullyhandlechallenges,difficultcircumstancesandcrises.Itisnotan«all-or-noth-ing»propertyand,likepersonalitytraits,itis
relativelystable.Nevertheless,resiliencecanbechanged.Therearevariousapproachesforfurtherdevelopingandpromotingpersonalresilience,forexamplethroughmindfulnesstraining(/35/),embodimentexercises(/5/),autogenictraining,meditation,yoga,etc.
Thecharacterstrengthsandvirtuesmentionedinpositivepsychologyformabasisforthefurtherdevelopmentofpersonalresilience(/48/and/23/).Theseare:
Organisationscanbenefitfromresilientemployeesbecauseperformance,ideasandflexiblethinkingcomefromtheemployees.Ifemployeesareresil-ient,itstrengthenstheorganisation(/1/).However,itwouldbefatalforbothsidesifanon-resilientorganisationwaskeptgoingbyresilientemployees.Intheextreme,thiscouldmeanthatemployeeswouldconstantlyhavetofindwaysandmeanstofulfilthecompany’sperformancewithouttheorganisationtakingresponsibilityforfunctioninginfrastructureandprocesses.Itwouldjustbeamatteroftimebeforeemployeesburntout,leavingthecontinuedfunctioningoftheorganisationtootherresilientemployees.
Thepromotionofresiliencewithinanorganisationisanattitudeoftheorganisationandanexpressionofthecorporateculturethatisreflectedonmanylevels.Resilientteamsarecharacterisedbydiversity,awiderangeofknowledgeandideasaswellaswillingnesstoconsideranddrawfromavarietyofresponseoptions.Inaddition,anetworkbasedontrustisneeded(/1/).
Virtues characterstrengths
Wisdomandknowledge Creativity,curiosity,abilitytojudge,loveoflear-ning,perspective
Courage Bravery,perseverance,honesty,drive
Humanity Love,kindness,socialintelligence
Justice Socialresponsibility,fairness,leadership
Moderation Forgiveness,modesty,discretion,self-control
Transcendence Appreciationofbeauty,gratitude,hope,humour,spirituality
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
3.2 Safety-IandSafety-II
Insimpleterms,Safety-Iimplieslearningfromthingsthatgowrongwiththefocuson«work-as-imagined»3(/28/),andisaimedatstrengtheningcompliance.Safety-II,ontheotherhand,implieslearningfromthingsthatgorightwithafocuson«work-as-done»4(/28/),andisaimedatstrengtheningresilience(/41/xv).TheSafety-IIviewonsafetyfocusesonanorganisa-tion’sabilitytomanagetheadaptabilityofpersonnelandsystems(«guidedadaptability»)byunderstandinghowcomplexsystemsareforthemostpartsuccessfulandoccasionallyfail(/49/).
ThefollowingelementsofSafety-IIaredescribedintheliterature(see/28/xvi,/29/,/41/):
• Understanding of safety: Safetyisnotdefinedastheabsenceoferrorsorundesirableevents(Safety-I),butastheabilitytoensurethingsgoright.
• Understanding of safety management: Safetymanagementisaimedatmaintainingtheadaptivecapacitytorespondeffectivelytounexpectedevents.
• The role of people: Peoplearenotseenprimarilyasriskfactors,ratherasaresourcenecessaryforsystemflexibilityandresilience.
• Accident/event investigation:Theaimofeventinvestigationsistounderstandhowthingsnormallygoright,becausethisisthebasisforunderstandingwhytheysometimesgowrong.
• Risk assessment:Theassessmentofrisksisfocussedonunderstandingconditionsunderwhichthevariabilityinperformanceisdifficultorimpossibletomonitorormanage.
BasedonaresiliencemodeldevelopedspecificallybytheFrenchenergycompanyEDFforuseinnuclearpowerplants,Park,Kim,Lee&Kim(/47/)developedamodelofSafety-IIandtesteditusingunexpectedreactortripsatKoreannuclearpowerplants.Themodel,whichisconsideredbytheauthorsasawayofsupplementingthetraditionalprobabilisticanddeter-ministicsafetyassessments,distinguishesfiveelementsofSafety-II:
• Anticipation: Measurespreparedbeforeaneventoccursandwhichareavailable.Elementsofantici-pationareemergencyprocedures,trainingpro-grammes,personnelresources,organisationalandsafetycultureaswellasergonomichuman-technol-ogyinterfacessuchasalarmsystems,displays,operatingelements,supportsystems,etc.Accord-ingly,anticipationisameasureofthereadinessoftheemergencysystemwithregardtoanevent.
• Robustness: Themannerinwhichtheemergencysystemdeterminestheappropriatestrategydepend-ingontheeventandinwhichitimplementstherequiredactivities.Elementsofrobustnessincludesystemresponse,decision-makingandexecution.
• Adaptation:Thewayinwhichtheemergencysystemdevelopsthestrategytomanagetheeventoradapttoit.Elementsofadaptationareverifica-tion(theabilityofthepersonneltoverifywhetherthecurrentstrategies,rulesorproceduresareappropriateforthecurrentconditions)andrecon-figuration(theabilityofthepersonneltoadaptthestrategyorrulesbasedontheevolutionofevents).
• Collective functioning: Theextenttowhichtheplantpersonnelworkasateamtoaccomplishataskorachieveacommonobjective.Elementsofcollectivefunctioningarecommunicationandteamwork.
• Organisational learning: Theprocessbywhichtheorganisationgeneratesnewknowledgeormodifiesexistingknowledge.Theeffectivenessoflearningdependsonwhicheventsandexperiencesareconsideredandhowtheeventsareanalysedandassessed.
29 The resilient organisation
Inhisbachelor’sthesisontheassessmentofthelevelofintegrationofSafety-IIintheoversightpracticeofENSI’sHOFSection(seesection3.3),G.R.Geeser(/16/,p.14ff.)identifiedthefollowingbasiccharacteristicsofSafety-IIfromtheresearchliteratureonSafety-II:
• Proactive: Safety-IIisaproactiveapproach.Itrequiresthecontinuousanticipationofundesirableevents.Itrequiresanunderstandingofhowthesystemunderconsiderationworks,howitsenviron-mentandconditionsdeveloporchangeandhowfunctionsdependoneachotherandinfluenceeachother.
• Just culture: A«justculture»isaprerequisitefortheSafety-IIapproach.Tounderstandthefunction-ingofasystem(«work-as-done»),itmustbepossibletospeakopenlyabout«work-as-done»withoutfearofrecrimination.
• Consideration of the system as a whole: UndertheSafety-IIperspective,asystemisnotdividedintoitsindividualcomponents,butratherconsi-deredasawhole.Theworkflowsandinteractionsinthesystem,itsstructures,barriersandresourcesshouldbeunderstoodascomprehensivelyaspossible.
• Breadth before depth:IncontrasttotheSafety-Iapproach,whereeacheventisconsidereduniqueandtheeventanalysislooksforthespecificcausesoftheevent,eacheventisnotseenasuniqueintheSafety-IIapproach,butasonethat(inasimilarform)hasalreadyhappenedinthepastandcouldhappenagaininthefuture.Therefore,differentpathsthatmayhaveledtotheeventareexamined,differentperspectivesontheeventareconsidered,andpatternsandrelationshipsbetweendifferenteventsarelookedfor.
• Variability and execution adaptations: Variabilityandperformanceadjustmentsareinherentproper-tiesofallsystemsandanintegralpartofday-to-daywork(seesection3.1).Theycanresultinsuccessbutalsoinfailure.Therefore,thevariabili-tiesmustbemonitoredandhandledsothatthey
canbedetectedingoodtimeandcontainediftheywouldresultinthingsgoingwrong,andsupportediftheywouldresultinthingsgoingright.
• Understanding of resources and limitations:Toidentifyandunderstandvariabilityandexecutionadaptations,theavailableresourcesandcon-straintspresentintheworkingcontextmustbeunderstood.
• Involvement of field experts: Tounderstand«work-as-done»inthesystemunderconsideration,fieldexperts,thatisthepeoplecarryingoutthework,mustbeinvolved.Inthisway,itispossibletoobtainarealisticpictureoftheon-siteworkingconditions,andunderstandingoftheoverallsystemisreinforced.
• Focus on positive or normal functioning:Tounderstandsuccessandfailure,dailyworkanditsactualexecutionmustbeunderstood.Thediffer-encesbetween«work-as-done»and«work-as-ima-gined»mustbeunderstood.Thefocusisnotonwhatproblemsexist,butonhowtheyaresolved.
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
Safety-IandSafety-IIarenotmutuallyexclusive.Rather,theSafety-IIperspectiveencompassesorextendstheSafety-Iperspective(seeFigure5)andthusmakesitpossibletodealwithsituationsinwhichtheSafety-Iapproachisnot(anylonger)appropriatebasedontheincreasingcomplexityofHTOsystems(/28/).Thisunderstandingisbasedontherecognitionthatvariabili-tyisinevitableorevennecessary.Theaimofsafetymanagementistoenableorachieveasafevariability(«guidedadaptability»)andnottosuppressvariability(/49/).Provanetal.(/49/)makethedistinctionbetweenSafety-IandSafety-IIclearbymeansofthefollowingcomparison:Safety-Iis«planandconform»,whileSafety-IIorguidedadaptabilityis«planandrevise»xvii.GuidedadaptabilityorSafety-IIisthereforenotaboutthechoicebetweencentralcontrolandadaptation,butaboutsupportingsafeadaptations.Allactors(manag-ers,thoseresponsibleforsafetymanagement,employ-eesatthesharpend6)must(beableto)determine,dependingonthecontext,whenthesafeworkingprocesswillbeachievedbyfollowingstandardisedproceduresorwhenitwillbeachievedbyadaptation(/49/xviii).
SuchanintegratedunderstandingofsafetyissetoutbyworkinggroupDoftheComitéd’orientationsurlesfacteurssociaux,organisationnelsethumains(COFSOH)(/4/),whichwascreatedin2012bytheFrenchnuclearsupervisoryauthorityASN(Autoritédesûreténucléaire),underthedenomination«sécuritéconstruite»,«con-structedsafety».Itpointsoutthenecessaryinterplaybetweenthetwoconceptsof«sécuritéréglée»(«regu-latedsafety»,comparabletotheconceptofSafety-I)and«sécuritégérée»(or«sécuritéadaptive»,i.e.adaptivesafety).Thus,theconceptof«constructedsafety»integratestheapproachesdescribedabovefordealingwithuncertainty(minimisationofuncertaintiesvs.competenthandlingofuncertainties)andthediscussedbalancebetweenflexibilityandstabilityasacentralfeatureofresilienceortheSafety-IIapproachinanorganisation.
Theconceptof«constructedsafety»(/4/)doesnotseesafetyasafixedparameter.Safetyisalwayscon-text-sensitiveandisalways«constructed»anewintheday-to-dayactionsoftheactorsthroughdecisionsandreactionstothesituationsencountered.Itisalwaystheresultofconsiderationsandcompromisesbetweenconflictingobjectivesandchangingconditions.Trade-offsandcompromisesaremadebyallactorsandatalllevelsoftheorganisation.Thisunderstandingcorre-spondstotheassumptionunderlyingtheconceptsofresilienceandSafety-IIofeverysystemhavinganintrinsicvariabilityofperformanceandbehaviouranditscontinuousadaptationtodifferentandchangingrequirements,whichoriginatefromthesystemitselforfromtheoutside.
6| Theexpression«sharpend»referstothoseactivitieswhichorthoseworkerswhointeractdirectlywith(dangerous)processesintheirworkrolesuchaspilots,doctors,op-eratorsetc.Theyarethereforethepeoplewhoworkdirectlyatthetimeandplacewhereaccidents(can)occurandwheremistakeshavedirectconsequences.Incontrasttothemaretheactivitiesandworkersatthe«bluntend»,whoinfluencesafetyindirectly,inthattheyhaveaninfluenceontheconditionsandresourcesoftheemployees«inthefield»,i.e.atthe«sharpend».Theconditionsofthe«sharpend»arethusdeterminedbyactionsanddecisionsofotheremployeesmadeatanearliertimeandinanotherlocation(/26/).
ResilienceFocus of Safety-II:Everyday actions and outcomes:Risks und Opportunities
Focus of Safety-I:Undesirable events
(accidents, nearmisses)
Figure5:Relationshipbetweentheconceptsofresilience,Safety-IandSafety-II(accordingto/28/)
31 The resilient organisation
Inresponsetoforeseeableorunforeseendisturbancesandevents,theconceptof«constructedsafety»doesnotassumeaneither/orapplicationofeither«regulatedsafety»(reactiontothedisturbancebystandardisationandformalisation)or«adaptivesafety»(reactiontothedisturbancebyflexibilityandlearning).Thereactions,actionsanddecisionsoftheactorsarebasedonacom-binationofresourcesofbothapproaches,i.e.bothonspecifiedrules,trainedskillsandpractisedroutinesontheonehand,andontheexpertiseandinitiativeoftheparticipantsandtheirabilitytoinnovate,adaptandreactflexiblyontheother(seeFigure6).
Fromtheabove,itcanbededucedthataresilientperformanceisbasedonapredictable,but,especiallyintheeventofanunpredicted,unexpectedsituation(e.g.asuddeneventsuchastheaccidentatFukushimaoramoreslowlydevelopingcrisissuchastheCOVID-19pandemic)isalwaysbasedonanoptimalcombinationofthedifferentapproaches(standardisation/stability/Safety-Ivs.flexibility/adaptability/Safety-II).Thismeans,ontheonehand,thatprepared,immediatelyaccessibleandpractised(emergency)measures,highcompetenceandlong-termexperienceofemployeesatalllevelsandinallfunctionsinthehandlingofthetechnicalsystemsandworkequipment,in-depthknowledgeoftheplantsandsystemsonthepartofemployees,standardisedorganisationalprocessesandahightechnicalavailabilityoftherelevantsystems,includingimportantinforma-tionaboutthestatusofsystemsandprocessesarenecessary.However,ontheotherhand,theflexibilityof
structuresandprocessesandtheabilityoftheorganisa-tiontoadaptitsfunctioningasnecessarydependingonchangingrequirements,andtheabilityofpersonneltoinnovateandimprovisebothatanindividualbutalsoatcollectivelevelsareessential(seealsotheremarksinsection4of/15/).
Predictable disturbances/
events
Unexpected disturbances/
events
Resources: Rules, automatisms, training,
management
Resources: Human expertise, initiative,
functioning of collectives
Trade-off, agreement, compromise
Constructed safety
Figure6:Conceptof«constructedsafety»basedon/4/
Box4:Leadershipstylestopromoteresilience
TheaccidentattheFukushimaDaiichiandFukushimaDaininuclearpowerplantsfromtheviewpointofleadershipinthefieldThesituationprevailingduringtheaccidentattheFukushimaDaiichinuclearpowerplantrepre-sentedanextremelydemandingsituationforallconcerned,especiallyforthemanagement(seepart2oftheENSIreportseries/15/).Completelywithoutexternalpowersuppliesand,withtheexceptionofunits5and6,withoutfunctioningemergencygenerators,virtuallyallmonitoringinstrumentsinthecontrolroomshadfailed.MostofthesystemsatFukushimaDaiichihadtobeoperated«blindly»fromonemomenttothenext.Theroadswerefloodedanddestroyed,sothatoutsideassistanceandreplacementmaterialscouldnotbeobtainedintimetocoolthenuclear
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
reactorsandrepairthedamage(see/15/).Coremeltdownsand/orexplosionsfollowedinfourreactorunits.Theon-siteemployeeswereexposedtohighdosesofionisingradiationandwereunabletofindoutaboutthecircumstancesofotherfamilymembersduetothefailureofcommunications.
ThesituationattheFukushimaDaininuclearpowerplant,locatedabouttenkilometresfurthersouth,alsoonthecoastofJapanandalsoope-ratedbyTEPCO,wassomewhatbetter(/22/).ElectricalpowerwasstillavailableatFukushimaDaini:apowerlineandanemergencygeneratorwerefunctional.Themonitoringinstrumentsinthecontrolroomwereworking.Nevertheless,excel-lentleadershipaptitudewasnecessarytopreventaworseoutcome.Ultimately,Dainiovercamethetsunamiwaveswithouteithercoremeltdownsorexplosions(/22/).
Theapproachofthesitesuperintendent,NaohiroMasuda,atFukushimaDainihasbeenanalysedinvariousstudies(e.g./22/)andwasdescribedasapositiveexampleofresilientleadership.ParticularlyworthyofhighlightingwasMasuda’swillingnesstoadapthisunderstandingofthesituationandthewaytoproceedinthefaceofnewsetbacksandproblemsiteratively.
Inemergencysituations,itmaynotbepossibletowaitanddecisionsmustbemadequickly(e.g.inthecaseofresuscitationofanunconsciousperson;seealsosection4).However,therearealsoemergencysituationswhereitispossibletodelaydecisions.Todelayinmakingdecisions,evenwheneverybodyaroundisshoutingforthem,isverydifficulttosustainandcreatesanunpleasantfeeling(referredtoinpsychologyas«cognitivedissonance»).Peoplehaveastrongreflextoreduceuncertainties,unpleasantfeelingsandcognitivedissonancesasquicklyaspossibleinordertofeelmorecomfortableagain.Thisurgeissostrong
thatinemergencysituationspeoplemaybecomecarriedawayintheheatofthemomentandmakedecisionstooquickly.However,ifdissonancescanbeheldatbayforaslongaspossible,theresultismoretimetothinktheproblemthrough.SitesuperintendentNaohiroMasudasucceededindoingthisatFukushimaDaini.
Masudahadallemployeesgatheredtogetheronsiteandprocuredawhiteboard.Hepresentedtheavailableinformationonthewhiteboard.Masudadidnotmakeanyoverlyhastydecisions,didnotmakeanydramaticandout-of-touchspeeches,andonlydistributedtheinformationthatwasdemonstrablyproventobereliable.Heinformedtheemployeesaboutthestrainoftheexistinguncertaintyanddoubtsandgavethemtimetobecomeawareoftheextentofthesituation(/22/).
Inthisway,Masudaallowedemployeestoparticipateintheprocessof«sense-making»,inwhichexistinginformationisinterpretedinordertounderstandthemeaningbehindit(see/58/).Masudaandtheemployeesworkedtogethertodevelopanunderstandingoftheactualsituation(/22/).
Masudaandhisemployeescameupagainstalotofunexpectedsetbacksandproblems.Theywerewillingtoquestiontheirknowledgeoftheactualsituationtimeandagain,toreviseanditerativelyadapttothenewobstacles,variancesanddistur-bances.Problembyproblem,theyworkedtheirwaytowarddecoding,understandingandfinallycopingwiththecircumstances(/22/).
Resilientorsituation-adaptiveleadershipGrote(/21/)arguesthatorganisationalresilienceislinkedtothecorecompetenceofbeingabletofunctionindifferentwaysofworkingandtosuccessfullyswitchbackandforthbetweendifferentmodesofworkandmodesofoperation(seealsosection3.1).Withresilientleadership,organisations,managersandteamscanreactinasituation-dependentmannertochangingcircum-stances(variancesanddisturbances)(/40/,/57/).
33 The resilient organisation
Somesituationsmayrequirestability(e.g.operationmustcontinuetobestableandsafe)andflexibility(e.g.acauseorsolutionmustbefound)atonce.Managersareconfrontedwithaso-called«managingparadox»,forexample,whenroutinetasksmusttakeplacesimultane-ouslywithexploratory,innovativetasks(/21/).Groteproposesthatthemanagementstylebeadaptedtothestabilityandflexibilityrequire-mentsofthesituation.Todothis,managersmustbeabletocontinuouslyreviewthestabilityandflexibilityrequirementsposedbythecurrentsituationandmakeadjustmentsasnecessary.Managersmustbeadaptivethemselvesandadapttheirroleandbehaviourtothesituationrequirements(/21/).
Managersshouldhaveawideportfolioofdifferentmanagementstylesavailablefordifferentsituations.Ifthesituationisassociatedwithhighstabilityrequirements,directivespecificationsusingrulesaresuitable.Ifthesituationrequiresahighdegreeofflexibility,forexampleininformallearningandknowledgeexchange,asharedteamleadershipinwhichamanagerbehaveslikeaworkcolleagueofequalstandingisappropriate(/21/)toachievethebestpossibleexchangeinadialogue.Thislowpowerdistancebehaviourcanonlybesuccessful,ifamanagerisawarethattherearesituationsinwhichhierarchicalthinkingcanhindersafety(/21/).
Asanexampleofsituation-adaptiveleadership,Yun,FarajandSims(/64/)showthatinemergen-cymedicalsituations,adirectmanagementstylewassuccessfulincomplexsituationswithlessexperiencedteammembers.Bycontrast,inlesscomplexsituationswithmoreexperiencedteams,asupportive,personality-promoting,participatorymanagementstyle(empowerment)waseffective.
AccordingtoGrote(/21/),therequirementsformanagerstoadapttheirbehaviourtotheneedsofthesituationcanbedescribedasfollows:
1. Managersmustbeable to be adaptive themselves,thatistosay,torecognisethechangesthataretakingplaceandtoadapttheirownrolesandbehaviourtothechang-ingdemandsofstabilityandflexibility.
2. Organisational mechanismsandinstrumentsmustbecreated that support individual and collective adaptivity,forexamplebyensuringthatrulesandstandardsnotonlypromotestability,butalsothatrulesaredefinedtoenableflexibility,forexample,proceduresthatspecifygoalsorprocesses(asopposedtodetailedinstructionsforaction).
3. Thethirdrequirementrelatesto the role of managers in the development of organisa-tional culture.Inadditiontothepromotionofamindfulandinformedculture,whichisusuallyconsideredasabasisforresilience,thefundamentaleffectofcultureasapowerfulstabilisingforce,whichsupportsthecoordina-tionoftheactionsofthemembersoftheorganisationandtheintegrationoftheworkprocessesindecentralisedandflexiblemodesofoperation,shouldalsobeactivelyexploi-ted.Groteenvisagesaculture of interdiscipli-nary appreciation,whichbringstogethertheentireknowledgeoftheorganisationtofindthebestwaytopromotesafetyandtocopewithconflictingdemands,asbeneficialfortheresilienceofanorganisation.
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
Thestrengtheningofresilienceandfurtherdevelop-mentofasafetyunderstandinginthesenseofSafety-IIinorganisationsthatoperatetechnologiesandprocess-eswithahighhazardpotentialsuchasnuclearinstalla-tions,canonlybeachievedwithasystemicapproach(seesection2).Thismeansthattheoverallsysteminwhichtheseorganisationsareembeddedmustenablesuchfurtherdevelopment.Inparticular,thismeansthatthesupervisoryauthoritymustsupportthesupervisedparties’developmentoftheirpracticesandculturestoreinforcetheresilienceandintegrationoftheSafety-IIapproach.Dependingonhowthesupervisoryauthorityexercisesitsoversightandwhatkindofregulatoryphilosophyitpursues,itcanstrengthenorevenhinderthedevelopmentofthepracticesandculturesofthesupervisedparties(see/42/xix).Oversightinstrumentsandpracticesaimed(exclusively)atcontrollingbeha-viourinacentralisedandstandardisedmannerseemtocontradicttheimportanceattributedtolocalinnova-tion,flexibility,adaptability,problemsolving,vigilanceandimprovisationrelatingtoresilience(see/42/xx).Oversight,whichplacesitsprimaryorexclusivefocusoncompliance,canleadtothesupervisedorganisationsfocusingprimarilyoncompliancewithregulatoryrequirementsinordertoavoidregulatorysanctions,attheexpenseofalossoffocusontheactualrisks(see/42/xxi).
Nevertheless,littleresearchhasbeendoneontherelationshipbetweenregulationandresilienceandtheroleofregulation(oversight)inpromotingorobstruct-ingresilienceandSafety-II(see/62/,/42/).Usingtheexampleofhealthcare,LeistikovandBal(/41/),notethatinrecentdecadestherehasbeenashiftfromcompliance-basedoversightto«responsiveandrefle-xive»oversight7.Thesupervisoryauthoritiesarefocus-singlessonregulationsanddocumentation(i.e.on«work-as-imagined»)andmoreonthecontextandinteractionswiththesupervisedparties.Leistikowand
BalseethisdevelopmentasalinktotheSafety-IIapproach.BothinSafety-IIandinacorrespondingoversightapproach,theaimistounderstandsituationsinthecontextoftheirsocialdynamics,i.e.torecognisethemeaningofanobservedsituationinitscontextxxii.Thismeansthatthefocusisprimarilyon«work-as-done».
Leistikovetal.(/41/)derivethefollowingconsequencesforoversightfromconsiderationsonSafety-II:
• Understanding of safety: AssafetyintheSafety-IIapproachisdefinedastheabilitytoensurethatthingsgoright,dialogueisneededbetweenthesupervisedpartiesandthesupervisoryauthoritiesonwhat«right»8meansandhowthesupervisedpartiescandemonstratetheirperformance.Thisislikelytobeachallengeincomparisonwithidentify-ingerrorsanddeviations,sincethemerefactthataprocessissuccessfulinitsfinalresult(objectiveachieved)andno(obvious)errorsandproblemshaveoccurreddoesnotnecessarilymeanthat«thingshavegoneright».Accordingly,thesupervi-soryauthoritycanaskthesupervisedpartiesforexampletoshowwhattheydefineas«right»andwhetherasystemicapproachisused,takingintoaccountdifferentperspectives.Itcanalsoexaminetowhatextentthesupervisedorganisationsachieveaminimumdegreeofthis«right»andhowthisisreflectedintheir«work-as-done».
• Safety management: Asthefocusofsafetyman-agementisnotonrigidrules,butratheronadap-tivecapabilitieswithintheorganisation,thesuper-visedpartiesmustdemonstratethattheyhavethenecessarystructuresandprocessestoeffectivelyrespondtounforeseensituations.Thesupervisoryauthoritycanthereforediscusswiththesupervisedorganisationshowtheyhaveorganisedtheirsafety
7| Seetheexplanationsinsection2.2.1formoreinformationon«responsiveregulation».«Reflexiveregulation»drawsonaregulatoryunderstandingwhichdoesnotbuildonafixedapproach,butisbasedonconstantevaluation(reflection)ofthecurrentcircumstancesandproblems,thesuitabilityofthemethodsusedandtheir(unintended)sideeffectsaswellasonthecorrespondingadaptationandfurtherdevelopmentofthemethodsused(/52/).Thecharacteristicsofreflexiveregulationareitsrecognitionofuncertainty,theparticipationofdifferentactors(e.g.differentauthorities)anditsfocusonlearning.Reflexiveregulationisseenasahigher-leveltheoryofvariousregulatoryapproaches,including«responsiveregulation»(/52/).
8| InconnectionwithconsiderationsonSafety-IIandresilience,«right»means«normal».Itisthereforenotamatterofhighlightingparticularlygoodoroutstand-ingactivities,resultsorevents,butratherofthenormal,successfulfunctioninginday-to-dayoperations,takingintoaccountthedailyvariabilityofbehaviouraswellasofrequirementsandconditions.Therefore,incontrasttotheSafety-Iapproach,thefocusisnotprimarilyonthosesituationsinwhichundesirableresultshaveoccurred,errorshavebeenmadeordisturbanceshaveoccurred,noronthosesituationswhicharejudgedasparticularlypositive,butratheronthosesituationsthatarenormalandinwhichthetaskissuccessfullyperformed.
3.3 ThetaskofthesupervisoryauthoritiesinthecontextofresilienceandSafety-II
35 The resilient organisation
managementinrespectofdealingwithunexpect-edissues,andcheck,withintheframeworkofinspections,theextenttowhichthisisreflectedintheir«work-as-done».Theauthorsarguethatoversightshouldnotbebasedonclassicalquanti-tativeindicatorsorkeyfigures,butratheronaqualitative,narrativediscourse.Forexample,thesupervisedorganisationsmaybeaskedtoproduceannualreports.Therearenoformalrequirementsforthesereports.Thesethenserveasabasisfordiscussionwiththesupervisedorganisationsabouttheirsafetymanagementandasastartingpointforinspectionsoftheactualwork(«work-as-done»)intheeverydayworkofthesupervisedorganisations.
• The role of people: Ifemployeesareexpectedtobearesourceforflexibilityandresilience,theworkdesignmustenableemployeestoassumethisrole.Thisrequires,forexample,afocuson(interdiscipli-nary)cooperation,easyaccessibilitytoseniormanagementforthesafetyconcernsofemployees,jobsatisfaction,etc.Employeesmustbesufficientlyalerttorecognisethingsthataregoingwrong,andbeempoweredtoreportingthemandactingaccordingly.Thetaskofthesupervisoryauthorityinthiscontextistoaskthesupervisedorganisationstoshowhowtheycanensurethatemployeescanfulfiltheirroleasaresource.
• Accident/event investigations: AcombinationofSafety-IandSafety-IIseemsappropriatetotheauthors.Boththeinvestigationofthecausesofanundesiredeventandtheinvestigationofwhythesameprocessthatwentwronginthiscasenormal-lyrunswell,allowgreaterin-depthlearning.Indoingso,forexample,classicalinvestigationmethodscanbecombinedwithaFRAManalysis9(see,forexample/29/).
• Risk assessment: Themonitoringandunderstand-ingofday-to-dayperformancevariabilitiesshouldformpartoftheriskassessmentbythesupervisedparties.Thesupervisoryauthoritymaythereforeencourageororderthedevelopmentanduseofmethodsforrecordingandmonitoringperfor-mancevariabilities.
Insummary,Leistikovetal.(/41/)advocateashiftinthesupervisoryauthority’sfocusawayfromcompli-ancetowardsconsistency.Thereby,thequestionofhowthe«work-as-imagined»presentedbytheman-agementisreflectedintheorganisation’sactualdailyperformance(«work-as-done»)shouldbecentral.Theoversightworkofthesupervisoryauthorityshouldthereforenot(primarily)bebasedonprescriptiveoversightbasedonsafetyindicators,butratheronthesupervisionofthemanagementsystem,withaparticu-larfocusonconsistencybetween«work-as-imagined»and«work-as-done».Theauthorssummarisethisapproachasashiftfromregulatory«oversight»toregulatory«insight»xxiii.
WorkingGroupDoftheComitéd’orientationsurlesfacteurssociaux,organisationnelsethumains(COFSOH)(/4/)presentssimilarconsiderationsinrespectofoversight,buildingontheconceptof«constructedsafety»(seesection3.2).Itcompares«normativeoversight»with«constructiveoversight»,whichiswhatshouldbestrivedforfromtheworkinggroup’spointofview.«Normativeoversight»assessescompliance,basedonaretrospectiveviewandonadefinedstandard.ItisbasedonaSafety-Iviewandprimarilysearchesfordeviationsfromthestandard.Itisbasedonthehypothesisthattheeliminationofdeviationsortheascertainmentofconformitycontrib-utestoguaranteeingsafety.Incontrast,«constructiveoversight»isnotlimitedtotheascertainmentofthe
9| FunctionalResonanceAnalysisMethod(FRAM):TheobjectiveoftheFRAMmethodistoanalysehowsomethingisdone,hasbeendone,orcouldbedone,andtopresentthisgraphically.Thereby,thefunctionsthatdescribetheanalysedactivityareidentifiedandtheinterrelationshipsandinterdependenciespresented.Eachfunctionisdescribedusingthefollowingsixaspectsandthenassociatedwithotherfunctions:Input(I),Output(O),Preconditions(P),Resource(R),Control(C),Time(T).Thisresultsinapresentationofthefunctionsofasystemandtheirdevelopmentinaspecificsituationorcontext,i.e.takingintoaccounttheperformancevariabilities./27/and/30/inparticularcontaindetailedinformationaboutFRAM.
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
conformitywiththerules.Thestandardsandrulesareonlyoneofthepossibleresources(seeFigure6).Theaimoftheinspectorsistoassesstheappropriatenessoftheactionscarriedoutonthebasisofthegeneralobjectivesofthesystemunderconsideration.Thistypeofoversightrequiresintensiveinteractionbetweentheinspectorsandthesupervisedpersons,wherebytheconsiderationofthecontext,theconstructionandthediscussionofthecriteriaareofgreatsignificance.Togethertheyworkoutarepresentationofthepresent(actualsituation)andthepathstothefuture.Indoingso,alearningprocessoccursonbothsides.
Anumberofconditionsmustbemetfor«constructiveoversight»tobesuccessful(/4/).Theinspectorandthesupervisedperson,mustbeawarethattheysharethesameobjective,namelyimprovingsafety.Thisrequiresmutualtrust.Theinspectormusthavegoodknowledgeofthe«field»andtheactualframeworkconditionsofthesupervisedactivities(experience).Thesupervisedpersonmustthemselveshaveapositiveattitudeandnotwantjusttopresenta«goodpicture»ofthem-selves.Theoversightmustthereforebebenevolent(empathic,support-oriented),performedwithintegrity(honest,basedonsharedvalues)and(technicallyandsocially)competent.Itmustbebasedonopendialogue,inwhichmistakescanbeadmittedandthefearofsanctionsremoved.Theoversightisaimedatdevelop-inganunderstandingofthesituation,notjustfindingmistakes.Theinspectorsfocusontheday-to-daybehaviourofthesupervisedpartiestomaintainsafetyandontherealityoftheactivitiesandsituations(«work-as-done»).Thisimpliesamethodologicalapproachintheoversight,whichallowsaccesstothe«reality»ofday-to-daywork.TheCOFSOHworkinggroup(/4/)recommends,forexample,theuseofmentalsimulation(«whatif…?»),discussionswithdifferentactorsanddirectobservation.Italsoencouragesthedevelopmentofnewoversightmethodsthatpromoteimmersioninsituationsandaccesstotheactors.
Wiig,AaseandBal(/60/)advocatethecreationof«reflexivespaces10,xxiv«attheinterfacebetweenthesupervisoryauthorityandthesupervisedorganisationsbasedontrust,dialogue,respectandapsychologicallysafeatmosphere.Inthisrespect,oversightinstruments,e.g.performanceindicatorsoreventassessmentsarenotused(primarily)asameasureofthedegreeofcompliancewithregulatoryrequirements,butratherasavehicleforcreatingreflexivespacesinwhichdiscus-sionsaboutsafetyareconducted.Thevaluesoftheindicatorsortheeventreportsarethereforenotthefocusofthesupervisoryauthorityperse,ratherthereflectionthatistriggeredbythem.Insuchanoversightapproach,thesupervisoryauthorityalsouses«softsignals»fromdifferentsources.Indoingso,itdoesnotintervenedirectlyinresponsetothesignals,rathergathersthemtogether,searchesfortheirsenseandmeaning(«sense-making»)byplacingtheminthecontextofwhatisalreadyknown.Withthefindings(orhypotheses)gainedinthisway,itconfrontsthesuper-visedorganisationandentersintodialoguewithitwithintheframeworkofareflexivespace.Theaimofthisprocedureistoleaveresponsibilityforsafetywiththesupervisedorganisationasfaraspossible,whileatthesametimecheckingitsabilityandwilltoassumeandbearthisresponsibilityforsafety,accordingtothemotto«trust,butassesstrustworthiness»xxv.
Grote(/21/)stressestheneedforthesupervisoryauthorityandthesupervisedorganisationtohavethesameviewastowhetherandtowhatextentdifferentmodesofoperationofanorganisationarelegitimate.Dependingontheregulatoryphilosophyofthesupervi-soryauthority,itmaybedifficulttoachievethiscom-monunderstanding.Forexample,ifthesupervisoryauthoritypredominantlystandsforaprescriptiveregulatoryapproachandaworldviewbasedprimarilyonstandardisationandcentralisation(i.e.Safety-I),itisunlikelytoacceptanorganisationofthesupervisedpartiesbasedonflexible,decentralisedstructuresand
10| Wiigetal.(/60/)consider«reflexivespaces»asphysicalorvirtualplatformsonwhichareflexivedialoguebetweenpeopletakesplace.Thepracticeofreflexivedialogueisseenascentraltolearningprocesses,asitcreatesabridgebetweenimplicitandexplicitknowledge.Reflexivespacescanbringpeopletogethertoreflectoncurrentchallenges,theneedforadjustmentsorotherdemandsindailywork,etc.Theypromoteresponsibilityandfeedback.
37 The resilient organisation
procedures.Therefore,accordingtoGrote,opendialoguebetweenthesupervisoryauthorityandthesupervisedorganisationsisessentialinensuringtheoperationalflexibilityrequiredforaresilientmodeofoperationofanorganisationxxvi.
TheHOFSectionmonitorsthestateofscienceandtechnologyintheareaofhumanandorganisationalfactorsandthesafetysciencesnotonlyforthepurposeofderivingrequirementstobeappliedtothesuper-visedorganisations,butalsostrivestounderstandtheimplicationsofnewconceptsfromthesafetysciencesforitsownregulatoryworkandtoconstantlydevelopitsoversightinstrumentsandpracticesaccordingly.Foranumberofyears,theHOFSectionhasbeenaddress-ingresilienceandtheSafety-IIapproach.Therefore,in2016,itinitiatedaprocessofreflectionontheimplica-tionsoftheSafety-IIapproachforoversightintheHOFareaand,aspartofabachelor’sthesis,carriedoutananalysisofitslevelofconsiderationtothoughtsonSafety-IIinitsoversightpracticeofthetime(/16/).Theanalysisshowedthatoversightmustbemorefocusedon«work-as-done»andthevariabilityintheday-to-dayfunctioningofthesupervisedorganisationthanwasthecaseinearlierpractice.Correspondingdevelop-mentpotentialthereforerelatestoagreaterinvolve-mentofthoseemployeeswhocarryouttheworkatthe«sharpend»andhavethecorrespondingpracticalexperienceandexpertise(so-calledfieldexperts).Sincethesepersonsarespecialistsintheirfieldofactivity,theirinvolvementisindispensableinordertounder-stand«work-as-done»(/16/).
TheanalysisresultedinanumberofrecommendationsforactiontotheHOFSectioninordertointegratetheSafety-IIapproachmorecloselyintoitsoversightactivities:
• Howfieldexpertscanbemoreinvolvedintheregulatoryactivitiesofthesectionshouldconcre-tised.ThisimpliesdirectcontactbetweentheemployeesoftheHOFSectionandtheemployeesatthe«sharpend»,i.e.attheworkplacesonsite,inthenuclearinstallations.Forexample,workobservationscouldbecarriedout.
• OpendialogueontheSafety-IIapproachshouldbeconductedwiththesupervisedparties,e.g.withintheframeworkofspecialistdiscussions.ThisenablesdevelopmentofacommonunderstandingofSafety-IIanditspracticalimplementationinoversight.
• Thefocusinoversightshouldnot(only/primarily)beonthesearchforexistingproblems,butalsoonthequestionofhowproblemsaresuccessfullymanaged.Toachievethis,Geeser(/16/)suggeststhatdiscussionswithfieldexpertsbecarriedout.Ineachcase,twofieldexpertsshouldparticipateintheconversation,asthedialoguebetweenthemcouldprovidemorecomprehensiveinformationandthusalsostrengthenunderstandingofthesystem.Inaddition,thesediscussionsshouldtakeplaceattheworkplaceofthosebeingsurveyedsothattheHOFSectionrepresentativecangainafeel-ingfortheday-to-daywork.
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
TheconsiderationsandapproachesfromtheliteraturethatdealwiththequestionofanappropriateregulatorystrategyinthecontextofresilienceandSafety-II,leadtotheconclusionthatdialoguewiththesupervisedpartiesmustbeacentralelementofoversight.IncontrasttotheSafety-Iapproach,inwhichdeviationsfromapredefinedtargetstatearerelativelyeasytodetectandassess,theSafety-IIapproachrequiresaconsensustobefoundonthetargetstateinrelationtothecontext,i.e.whatcanbeassessedas«right»,takingintoaccounttherespectivecontextfactors.Theremustbecontinuousdiscoursebetweenthesupervisoryauthorityandthesupervisedparties,inwhichtopicssuchastheday-to-day,«normal»functioningofthesupervisedorganisation,theday-to-dayvariabilityofperformanceandbehaviour,thedifferentwaysoffunctioningoftheorganisationsindifferentsituationsandtheirhandlingoftheunexpectedorofuncertaintyareexplicitlyreflectedupon.Foroversight,itisessentialtounderstandhowthesupervisedorganisationfunc-tionsonaday-to-daybasisandwhichfactorsinfluencethisfunctioning.OversightmustbecharacterisedbyInsightinthenormalmodeofoperation,andtheremustbeacommonunderstandingofthismodeofoperation,theframeworkconditions,challengesandsafety-relatedobjectivesbetweenthesupervisoryauthorityandthesupervisedparties.Therefore,thesupervisoryauthoritymustgainaccesstothe«reality»ofday-to-daywork.Animportantfocusofthesupervi-soryauthoritywillthereforebeon«work-as-done»andontheconsistencybetween«work-as-imagined»asdefinedbythesupervisedorganisationand«work-as-done».Consequently,initsoversightactivities,itmustinvolve,notonlytheleaders,theemployeeswhoperformmanagementtasksorspecificsafety-relatedfunctions,etc.(i.e.employeesatthe«bluntend»6),butalsoemployeeswhoperformthework«on-site»,intheplant,intheworkshop,etc.(i.e.«fieldexperts»atthe«sharpend»).Inaddition,itneedsappropriateoversightinstruments,withwhich,ontheonehanditcanmonitorandassessthemodeofoperationofthe
supervisedpartiesand,ontheotherhand,itcanpositivelyinfluencetheirresilienceandSafety-IIap-proach.Thereby,thesupervisoryauthorityitselfneedstobeflexibleandadaptive,i.e.resilient,andtocontinu-allyquestionitsregulatoryinstrumentsandapproaches–inthesenseofreflexiveregulation–andtoadaptthemtothechangingrequirementsandtothesituationoftheindividualsupervisedorganisations.OversightworkagainstthebackgroundofSafety-IIandresilienceisthereforeademandingtaskinwhichthesupervisoryauthorityadoptsadoublequestioningrole,bothinrelationtotheorganisationsitoverseesandinrelationtoitself.Thisrequiresittohaveastrongcapacityforself-reflectioninordertoplaceitsownroleandinflu-enceonthesafetyofthesupervisedpartiesunderconstantself-scrutiny(/31/xxvii).
TheHOFSectionhassetitselftheobjectiveofquestion-inganddevelopingitsoversightworkagainstthebackgroundofSafety-IIandresilience.Thefollowingsectionthereforedrawspracticalconclusionsforthefutureoversightofhumanandorganisationalaspectsandproposesconcreteideasforcommensurateoversightactivitiesorthefurtherdevelopmentofexistingoversightmethods.
3.3.1 Interimconclusion
39 The resilient organisation
ENSI (HOF Section) Supervised parties
Concept resilience/Safety-II
Regulation (ENSI Guidelines, orders, requirements, etc.):• Content of the regulation
(requirements in respect of resilience/Safety-II)
• Form of the regulation (type of formulation of the requirements)
1
Management system/internal specifications/principles in respect of Safety-II-approach for own organisation
3
Oversight
2
Methods, oversightinstruments,action channels
4
(Capability/possibility of the) implementation of the Safety-II approach in the day-to-day routine of the nuclear installation
Assessm
ent
‘work-
as-imagined’
Specifications
Assessment‘work-as-done’ Im
plem
enta
tion
inda
y-to
-day
ope
ratio
n
Impl
emen
tatio
nin
ove
rsig
ht
Effect …… of the oversight
… on the oversight
3.4 ConclusionsfortheHOFSection
Althoughnotexplicitlydiscussedintheliteraturecitedhere,intermsoftheroleofthesupervisoryauthorityinthereinforcementorinfluencingoftheresilienceorSafety-IIapproachofthesupervisedorganisation,adistinctionmustbemadebetweentwo–thoughnotcompletelyindependent–aspectsofregulatoryoversight: regulation,i.e.theformulationofrequire-mentsintheformofguidelines,regulations,decrees,demandsetc.ontheonehand(seequadrant1inFigure7)andontheotherhandtheoversight activityitself(seequadrant2inFigure7).Intermsoftheoversightactivityitself,itisthennecessarytodifferen-tiatebetweenthewayofmonitoringandtheassess-mentofcompliancewiththerequirements(oversightinthe«strictersense»,see/12/;seealsotheorangearrowsinFigure7)andthestrivingtopositivelyinfluencethesafetyandsafetycultureofthesuper-visedpartiesthroughtheexerciseofoversight,forexamplebyaimingtotriggerself-reflectionintheoperatorofanuclearinstallation(oversightinthe«broadersense»11,see/12/)(seetheupperbluearrowinFigure7).Bothaspectsoftheworkofasupervisoryauthorityhaveaneffectontheabilityandpotentialof
thesupervisedorganisationtofunctioninaresilientmanner.Conversely,culture,strategyandpracticeinthefieldofsafetymanagementonthepartofthesupervisedpartieshaveaneffectonthemannerofdoingoversightofthesupervisoryauthority(seethelowerbluearrowinFigure7).Considerationsregardingadesignoftheoversight,whichpositivelyinfluencesoratleastdoesnothindertheresilienceofthesupervisedparties,mustthereforeincludebothaspects(regulationandoversightactivity).However,ENSIprimarilydealswiththeimplicationsoftheseresilienceandSafety-IIconsiderationsfortheregulatoryframework(regula-tion)inthefieldofhumanandorganisationalfactorsaspartofthedraftingofnewguidelinesandtherevisionofexistingones12andarenotthesubjectofthisreport(quadrant1inFigure7).Accordingly,thefocusofthisreportisonthe oversight activityandontheapproachesandmethodsusedinoversightrelatingtoresilienceandSafety-IIconsiderations.
11| Aspresentedin/12/,inENSI’sunderstanding«oversightinthestrictersense»includesmonitoringwhetheralicenceholderperformsitsdutiesandtheninterventionwhenitdoesnot.«Oversightinabroadersense»alsoincludestriggeringoftheself-reflectionofthelicenceholderbythesupervisoryauthority.ENSIhasformulatedthiscomprehensiveunderstandingofitsownroleinitsmissionstatement(/10/).Inadditiontofulfillingitsstatutorymandate(inparticular,GuidingPrinciple1),italsoconsidersthestrengtheningofthesafetycultureandtheself-responsibleactionofthesupervisedpartiesaspartofitstask(GuidingPrinciple2,point3).
12| ThisprimarilyconcernstheguidelinesENSI-G07«TheOrganisationofNuclearinstallations»(/9/)andENSI-B10«BasicTraining,RecurrentTrainingandCon-tinuingEducationofPersonnelinNuclearInstallations»(/8/).
Figure7:OversightinrespectofresilienceandSafety-IIfromdifferentperspectives
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
TheconsiderationsoftheHOFSectiononthe(strength-ened)integrationoftheSafety-IIapproachintoitsfutureoversightarepresentedbelow.Indoingso,itisnottheaimtomakearadicalchangetooversightbyabandoningtheSafety-IapproachandreplacingitwiththeSafety-IIapproach.Rather,itisaquestionofconsideringbothapproachesintheircomplementarityandtakingthemintoaccountinoversightinthehumanandorganisationalfactorsarea.Theideasandmethodsdiscussedbelowarethereforeintendedasasupple-menttotheoversightmethods(notdiscussedhere)thataremorelikelytobeassignedtotheSafety-Iapproach.
Inaccordancewiththeabove-mentioneddistinctionbetweenoversight«inthestrictersense»andoversight«inthebroadersense»,adistinctionismadeherebetweenSafety-IIoversight«inthestrictersense»andSafety-IIoversight«inthebroadersense»(seeFigure8),althoughthedistinctionbetweenthetwotypesofoversightisnotalwaysasharpone.
Inthefirstcase,itisamatterofidentifyingandassess-ingthesafetystatusofthesupervisedorganisationsfromtheSafety-IIpointofview.TheSafety-IIfocusisprimarilyonunderstandingthenormalfunctioningoftheorganisationandthesituationalandcontext-relatedrealityofday-to-daywork(«work-as-done»)aswellasinthecomparisonbetween«work-as-imagined»and«work-as-done».Theaimisto identifyatanearlystagewhenperformancevariabilityandadjustments,whichareanecessarypartofdailyactivity,developintoaproblemandthentointerveneinatimelymannerbeforeinterventionsinlinewithSafety-I(prescriptiveregulatoryordersuptoandincludingsanctions)becomenecessary(«proactivereaction»).
Moreover,itshouldbenotedthateveninthepastquiteafewSafety-IIelementswerealreadyputintopracticeintheareaofhumanandorganisationaloversight.Therefore,thesearenotcompletelynewideasandapproachesthatwill,goingforward,beappliedinoversightfromsomeparticularpointintime.Rather,itismuchmoreaboutasmoothtransitiontowardanintegratedoversightapproachwhichtakesequalaccountofSafety-IandSafety-II.
Thesecondcase,ontheotherhand,isaboutstrength-eningthesafetyofthesupervisedpartiesthroughtheuseofappropriateoversightinstruments,inparticularbystimulatingself-reflectionintheirorganisationsandfosteringtheassumptionofdirectresponsibility(«pro-activeaction»).Thisapproachalsorequirescontinuousself-reflectiononthepartoftheinspectorsintermsoftheimpactoftheiroversightonthepotentialandcapabilityofthesupervisedpartiestoimplementtheSafety-IIapproachintheirorganisation,andonthesuit-abilityofoversightmethodsandcontentdependingonthesafetystatusofthesupervisedparties(seethebluearrowsinFigure7).A«reflexiveoversight»approachisthereforenecessary(seesection3.3).
3.4.1 Basicconsiderations
41 The resilient organisation
Accordingly,theHOFSectionderivesthefollowinghigher-levelrequirementsforitsoversightusingtheSafety-IIapproach:
• Focussingnotsolelyoncompliancewiththerequirementsoftheregulatoryframeworkandtheinternalregulations(evaluation,target-actualcomparison,compliance-orientedoversight),butalsoonstrengtheningreflectionandthedirectresponsibilityofthesupervisedparties(perfor-mance-orientedoversight)(seesection2.2.1)− Strengtheningthedirectresponsibilityofthe
supervisedpartiesbycallingfortheformulationofdevelopmentobjectivesandmeasures
− Holdingthesupervisedpartiesaccountablebyaskingforandprovidingfeedbackontheachievementofobjectivesandtheeffectivenessofmeasures
• Focussingnotonlyondeterminingcompliancewiththerequirementsoftheregulatoryframeworkandinternalregulations,butalsoontheunder-standingofthesysteminitscontext
• Focussingnotexclusively/primarilyonthe«nega-tive»(events,deviations,non-compliancewithproceduresetc.);increasedfocusonthe«positive»orratherthe«normal»− Whatisgoingrightandwhy?− Howdoestheworknormallyfunction?− Howare/haveproblemsbeensolved?(In
contrastto:whichproblemsexist/existed?)
• Focussingnotexclusively/primarilyonthe«speci-fied»(work-as-imagined);morefocusonthe«actual» (work-as-done)− Howisday-to-dayworkactuallycarriedout?− Whichframeworkconditionsdefinethework?− Whichvariabilitiesareapparent?
• Increasedcomparisonof«work-as-imagined»and«work-as-done»byincludingrepresentativesofboththe«bluntend»andthe«sharpend»intheoversight− Towhatextentdothefactspresentedbythe
managementortheemployeesatthe«bluntend»coincidewiththeactualsituationandworkingmethodsoftheemployeesatthe«sharpend»(fieldexperts)?
− Howcananydiscrepanciesbeexplained?Whichconditionsmake«work-as-imagined»moredifficult?
• Reinforcingdialoguewiththesupervisedparties
• IncreasedfocusonthepotentialsofresilienceandSafety-IIamongthesupervisedparties:thepoten-tialtoreact,thepotentialtomonitor,thepotentialtolearn,thepotentialtoanticipate.
Recognise safety and assess:- (Increased) focus on the day-to-day/normal:
Understand how the supervised organisation functions (values & world views, behaviour, framework conditions) by observation of the day-to-day routine («work-as-done»); looking and listening, identifying patterns
- Comparison of «work-as-imagined» and «work-as-done»
- Identify changes (both in the positive and problematic direction), especially if something is «getting out of control»
- Dialogue with the supervised parties
Keep the «big picture» in mind and recognise:- systemic approach- interdisciplinary approach
à «Proactive reaction» : Identify signals and take quick action
Strengthen safety by triggering (self-) reflection among the supervised parties:- Dialogue with the supervised parties- Ask questions- Confront, reflect
… and promotion of self-responsibility:- Selection of suitable oversight approaches, methods and
foundations (suitable level of prescription)- Agree development objectives and measures and hold
supervised parties accountable
Do not weaken safety:- Self-reflection ENSI/HOF Section (oversight culture)- Avoid assuming (too much) responsibility (i.e. avoid
specifying solutions, prescriptive requirements, limitation of the scope of action)
à «Proactive action» : achieve effectà Increase the number of things that go right
Safety-II oversight in the «stricter sense» Safety-II oversight in the «broader sense»
Figure8:OversightwithfocusonSafety-II
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
TheHOFSectionusesdifferenttypesofmethodsinitsoversight,withwhichitpursuesdifferentpurposesanddealswithdifferenttopics(seeSection1.2).Allover-sightmethodscanalsobeusedinaccordancewithSafety-II.WhilesomeofthemarealreadyconceivedasSafety-IImethods(inparticulartheinstrumentsthatareexplicitlyusedtopromoteself-reflection),othersmustormaybedeliberatelyenrichedwithSafety-IIelements(namelythosethatprimarilyservethepurposeofthetarget-actualcomparisonandarethereforegenerallyusedasinstrumentsforcomplianceverificationandthusasSafety-Imethods).
The announcementofthespecificoversightactivitiestothesupervisedpartiesbythesupervisoryauthorityisofparticularimportance.Typically,specialistdiscussionsandinspectionsareinitiatedbyanannouncementletterfromENSI,withwhichthetopicandthereasonfortheannouncedoversightactivityarecommunicated.Thetopicisfrequentlyclarifiedbyspecificquestions,whichENSIwouldlikethesupervisedpartiestoanswer.Thenatureoftheformulationofthesequestionslargelydeterminesthenatureandcontentofthespecialistdiscussionorinspection,becauseitinitiatescorrespond-inginternalpreparationonthepartofthesupervisedorganisation.InthesenseoftheSafety-IIapproach,itisthereforeofkeyimportancetoformulatethetopicsandquestionsinsuchawaythattheyinitiateself-reflectionamongthesupervisedpartiesandstrengthenthedialoguebetweenthesupervisedorganisationandtheHOFSection.
Forthe performance ofspecialistdiscussionsandinspections,theassemblyofoversightteams(consistingofatleasttwomembersofthesectionoronememberoftheHOFSectionandonememberofasectionfromanotherspecialistarea),whohavedifferentback-groundsandexperienceandadoptdifferentstancesisrecommended.Forexample,itmaymakesenseforthespecialistdiscussionorinspectiontobejointlycarriedoutbyanemployeeinthesectionwithin-depthknowledgeoftheorganisationconcerned,dueto(manyyearsof)oversightexperienceintheorganisation
tobesupervised,andanemployeewithappropriateexperienceinanothersupervisedorganisation.Whiletheformercanintegratethefindingsfromtherelevantspecialistdiscussionorinspectionintothebigpictureoftheorganisation,thelattercanbringinnewimpulsesthroughtheir«externalperspective»andatthesametimegaininsightsfortheiroversightroleintheorgani-sationstheyprimarilysupervise(seealsosection5.5).
Amongotherthings,theoversightinstrumentsde-scribedinsection1.2andtheirpossibleuseaspartofaSafety-IIoversightapproachareexaminedbelow.
• Specialist discussion promoting a dialogue on safety culture: Thedialogueonsafetyculture,whichtheHOFSectionhasconductedeverythreeyearssince2005withthesupervisedparties(see/12/),canbeattributedtotheSafety-IIapproach.Itfollowstheprimaryobjectiveoftriggeringaself-reflectionprocessamongthesupervisedparties.Indoingso,itsupportstheHOFSectionindeepen-ingitsunderstandingofthecultureandfunctioningofthesupervisedpartiesandindeterminingthecongruenceofthisunderstandingwiththatofthesupervisedorganisation.Moreover,ithelpstheHOFSectionitselftoreflectonitsoversightanditsimpactonthesafetycultureofthesupervisedpartiesinthatitreceivesfeedbackfromthelatter.− Therefore,withreferencetothesespecialist
discussions,inprinciplethereisnoneedtoadapttheprocess.
− Inthesenseofameta-reflection,thequestionofhowresilienceandSafety-IIare(canbe)implementedandpractisedbythesupervisedpartiesandembodiedintheregulatoryrelation-shipbetweenthemandENSIwouldbeappro-priateasapossibletopicforconductingthedialogue.
− Theinclusionofawiderrangeofpersonnelcategories(i.e.notonlyseniormanagementexecutivesorexpertswhoexplicitlydealwithsafetycultureintheirdailywork)wouldallowallparticipantsandENSItoformamore
3.4.2 MethodsforSafety-IIoversightinthehumanandorganisationalfactorsarea
43 The resilient organisation
comprehensiveanddeeperunderstandingofthefunctioningoftheoverallsystem.Thiscouldbeperformedeitheraspartofonediscussionoraspartofvariousseparatediscussions.
• Exploratory specialist discussion: Likethedialogueonsafetyculture,theexploratoryspecialistdiscus-sionservestostimulatetheself-reflectionofthesupervisedpartiesandusessimilarmethods,althoughheretopicsthatdonotreferencesafetyculturearealsodiscussed.− Theexploratoryspecialistdiscussionissuitable
forconfrontingthesupervisedpartieswiththefindingsandresultsfromthevariousoversightactivities(inspections,specialistdiscussions,statements,permits,etc.)inthehumanandorganisationalfactorsareaandtheindividualobservationscollectedoverayear,which,althoughnotincludedinthesystematicsafetyassessmentofENSI,do,however,intheirentirety,indicatepossiblepatternsortrendsintheday-to-dayfunctioningofthesupervisedorganisations(seealso/12/).ThedatacollectedandevaluatedinthiswaybytheHOFSectionisreportedbacktothesupervisedpartiesintheformofaggregatedfindingsandhypothesesandarethenconsideredjointlywiththem.Thisfeedbackisanopportunityforthesupervisedorganisationtocompareitsself-imagewiththeexternalimageofthesupervisoryauthorityandtoreflectonitsownday-to-dayfunctioning.Ontheotherhand,thediscussionservestodeepentheHOFSection’sunderstandingofthefunctioningofthesupervisedorganisationandfortheconsiderationofitsoversightanditseffect.
− Inadditionto(low-level)deviationsfromanexpectedstateand/orweaksignals,whichcouldpotentiallyindicatedeficiencies,theHOFSection’sobservationsandfindingsshouldalsoincludeexplicitlypositivefindings,whichindicatethesuccessfulfunctioningofthe
organisation.Inaddition,specificattentionshouldbepaidtoperformancevariabilityonaday-to-daybasis,forexample,toprioritisationofworksorchangingpriorities.
− Inthequalitativeevaluationandinterpretationoftheresultsoftheoversightofhumanandorganisationalfactors(e.g.frominspectionsandevents,see/12/and/13/),thefocusshouldnotonlybeondeviationsandtheneedforimprovement.Rather,assessmentsthatmatchexpectations(«normality»)andthosethatexceedexpectation(«goodpractice»)shouldexplicitlybeincludedintheoverallviewaswell.
− Conductingexploratoryspecialistdiscussionsinvolvingfieldexpertsfromthe«sharpend»orgroupsofparticipantswithdiverseback-groundsallowsvaluableinsightsintothefunctioningofthesupervisedorganisationtobeobtained.
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
• Information discussion: Thistypeofspecialistdiscussion,whichisusedtoobtaininformationandfactsaboutactualissues(e.g.relatingtoevents,projectsorpermitsrelatedtoorganisationalortechnicalchanges,etc.),can,dependingonitsalignment,concernbothSafety-IandSafety-IIaspects.Forexample,whendealingwithevents,itcanbeusedprimarilytounderstandwhytheundesirableeventoccurredandwhatcanbedonetopreventtheeventfromreoccurring(Safety-Iapproach).Oritcould(also)beusedtounderstandtheconditionsunderwhichtheworkinwhichtheundesirableeventoccurrednormallyfunctionsandwhyithasnotoccurredpreviously(Safety-IIap-proach).− Informationdiscussionsshouldthereforealsobe
usedtocollectasmuchinformationaspossibleaboutthenormalfunctioningandtheday-to-dayperformanceofworkandtounderstandwhichchangingconditionsandrequirementsinfluencethenormalexecutionofthework.Inaddition,theycanbeusedtomakeacompari-sonbetweentheplannedideal-typicalexecu-tionofthework(«work-as-imagined»)andtheactualexecutioninpractice(«work-as-done»).
− Informationdiscussionsshouldbeconductedwithdifferentpersonnelcategories.Indoingso,theinvolvementofpersonnelfromthe«sharpend»shouldinparticularbeconsidered.
− Informationdiscussionsdonotnecessarilyhavetobeheldinameetingroom,rathercanalsobeheld,atleastinpart,atin-situworkplaces.Thismakesparticularsenseifemployeesfromthe«sharpend»areinvolved.Inaddition,itenablesabetterunderstandingof«work-as-done»andtheconditionsandworkingcircum-stancesinfluencingthework.
− Wheninvolvingemployeesatthe«sharpend»,discussionscanbeheldwithtwoemployeesatthesametime.Theresultingdialoguebetweenthefieldexpertscanalsosupporttheacquisitionofvaluableinsightsinto«work-as-done».
• Inspection: Withinthescopeofaninspection,compliancewiththerequirementsoftheregulatoryframework(laws,regulations,guidelines)ischecked.Inspectionsarecarriedoutwithregardtoitemsunambiguouslyregulatedintheregulatoryframework.Typically,thefocusisondeviationsfromthetargetstatespecifiedintheregulatoryframe-work,wherebytheregulatoryframeworkusuallytakesnoaccountofsituationandcontext-relatedadaptations.Therefore,inspectionsareprimarilyaSafety-Iinstrument.Forexample,theHOFSectioncarriesoutannualinspectionsonthemanagementsystemofthesupervisedparties.Indoingso,itselectsaprocessfromthemanagementsystemandcheckswhetheritmeetstherequirementsoftheregulatoryframework,inparticularthoseofGuidelineENSI-G07«TheOrganisationofNuclearinstallations»(/9/).Italsocarriesoutannualinspec-tionsonthetrainingofpersonnelinnuclearpowerplants,basedontherequirementsofGuidelineENSI-B10,BasicTraining,RecurrentTrainingandContinuingEducationofPersonnelinNuclearInstallations»(/8/).− InthesenseoftheSafety-IIapproach,when
definingthesubjectmatterforinspectionsofthemanagementsystem,infutureitshouldbeconsideredwhetherthesecanbecarriedoutintwoparts.Here,asinthepast,inthefirstpart,atarget-actualcomparisoncouldbecarriedoutbetweentheprocessesandspecificationsinthe
45 The resilient organisation
managementsystemandtherequirementsfromtheregulatoryframework(«work-as-imagined»).Inasecondpart,theimplementationoftheprocessesandspecificationsfromthemanagementsystemcouldbeexaminedasdirectlyaspossibleatthe«sharpend»andwiththeinvolvementoftheexecutingemployees(«work-as-done»)usingactualpracticalexamples.Thefocusshouldbeontheconditionsunderwhichtheworkiscarriedoutandthepersonnel’sadaptationeffortstosuccessfullycarryoutthework,theirapproachtosolvingproblemsthatarise,etc.Participatingemployeesshouldprimarilybeseenasa«resource»andnotas«riskfactors».
− Withintheframeworkofinspectionsonhumanandorganisationalfactors,thescopeistobeextendedbyinvolvingdifferentcategoriesofpersonnelindifferentfunctionsspreadbetweenthe«bluntend»andthe«sharpend»intheinspection.
− Inaddition,differentmethodsshouldbeused,forexampleinterviews,workplaceobservations,plantwalkdowns,etc.Both«work-as-imagined»and«work-as-done»aspectsshouldbetakenintoaccount.
• Event processing: Intheanalysisandevaluationof(reportable)eventswithhumanandorganisationalaspects,thefocusshouldnotonlybeontheundesirableevent(whatwentwrong),ratherthepositiveaspectsshouldalsobetakenintoaccount.Inadditiontotheclarificationofthecausesoftheeventandthedefinitionofmeasurestopreventitsrecurrence(Safety-I),thereasonswhytheaffectedprocessnormallyrunssmoothly(Safety-II)shouldalsobeconsidered.− Whenprocessingthehumanandorganisation-
alaspectsoftheevent,theHOFSection(e.g.inthecontextofinformationdiscussions,seeabove)alsoaskswhichmoreseriousconse-quencescouldbepreventedandhow,andwhichprotectionfactorscontributedtotheascertainedoutcomeoftheevent.
− Withinthescopeofeventprocessing,theeventsshouldnot(only)beconsideredindivid-ually(so-called«singlelooplearning»),butalsointhecontextofotherevents(ifpossiblealsoincludingnon-reportableeventsornearmisses)(«doublelooplearning»).
− Inthecontextoftheireventanalysis,theHOFSectionalsoevaluatethefollow-upactionsinthehumanandorganisationalfactorsareadefinedbythesupervisedpartiesaccordingtoSafety-IIcriteria.
− Shouldtherebeanyrequirementsforactionsinthecontextofeventprocessing,theseshouldbeformulatedinsuchawaythattheystimulateself-reflectionwithinthesupervisedorganisa-tionandstrengthenitsdirectresponsibility.
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
• Safety-II forum across nuclear power plants: TheorganisationofareflectionforuminvolvingallorseveralsupervisedorganisationsontheSafety-IIapproachwouldcontributetostrengtheningdialogueandacommonunderstandingofthesignificanceandimplicationsoftheSafety-IIapproachbetweenthesupervisedpartiesandtheHOFSection.
Inadditiontotheplanningandimplementationofindividualoversightactivitieswiththevariousoversightmethodsdescribedabove,jointlearningfromtheexperiencegainedaspartofoversightwithintheHOFSectionisanimportantpartofaSafety-II-orientedoversight.Withintheframeworkofaperformance-ori-entedoversight(seesection2.2.1),exchangeandjointreflectionontheinsightsandfindingsgainedareessentialfortherequiredunderstandingofthefunc-tioningofthesupervisedorganisationsintheirrespec-tivecurrentcontext,becauseasimpletarget-actualcomparisonbasedonclearcriteria,asisthecasewiththeSafety-Iapproach,isnotpossible.
Inthesenseofcontinuousimprovement-oriented«reflexiveoversight»,the(joint)reflectionontheeffectoftheoversightactivitywithregardtothesafetyandthesafetycultureofthesupervisedpartiesisalsoofgreatimportance.Thecreationof«reflexivespaces»(seesection3.3)isthereforeimportantnotonlyintheinteractionbetweentheHOFSectionandthesuper-visedparties,butalsowithintheSectionitself.
47 The resilient organisation
Box5:Digression:RequirementsforthefacilitationofconversationswithinthecontextofaSafety-IIoversightapproach
DiscussionsplayacentralroleintheworkoftheHOFSection,inparticularintheimplementationofthedescribedmethodsforSafety-IIoversight,whicharetoalargedegreedialogue-based.ThismeansthatemployeesintheHOFSectionmustalsohavespecificskillsinleadingconversations,inadditiontotheirtechnicalcompetencies.
Whenheadinganyspecialistdiscussionaimedatstimulatingtheself-reflectionofthesupervisedparties,employeesintheHOFSectionoftenassumetheroleofa«facilitator».Inthisrole,theyguidethecontentofthediscussions–byspecifyingthetopicofthediscussionbymeansoftheannouncementletterandthequestionsformulatedinit(seesection3.4.2)–andtheycanalso,atleastinpartorincertaintypesofspecialistdiscussions,influencetheprocessofthediscussionandthusitscourse.
AcentralelementinconductingreflectiondiscussionsisaquestioningattitudetobeadoptedbyHOFSectionemployees.Theques-tionsrelatingtoreflectiondiscussionsare
thereforenotprimarilyaimedatthecollectionofinformation.Rather,byaskingquestions,theaimistostimulateacollectivethinkingandlearningprocess.Theformulationofquestionssuitableforthispurposeisthereforeofgreatimportancebothinthepreparationofthediscussionwiththedraftingoftheannouncementletterandalsothroughoutthecourseofthediscussion.
TheexperienceoftheHOFSectionshowsthattherearetwoimportantaspectsofthefacilitationofthediscussionthatmustbeconsideredduringreflectiondiscussionsorthatareanecessarypreconditionforachievinganopendialoguebetweenENSIandthesupervisedparties:1.)theefforttoachievecongruentandauthenticcom-munication,whichmeansthatthecharismaandwordsoftheinterlocutorsmatcheachotherandareperceivedascredible;2.)(active)listening.Inadditiontoattentiveandinterestedlistening,thisincludes,forexample,elementssuchaspara-phrasing,thatis,therepetitionofwhathasbeensaidinanalternativephraseology,thesummaris-ingofwhathasbeensaid,questioningtocheckordeepentheunderstandingofwhathasbeensaid,oralsotoprovidefeedbackonwhathasbeensaid.
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
AftertheearthquakeinJapanin2011andthesubse-quenttidalwavethatfloodedtheFukushimareactorbuildings,thoseinchargehadtomakemanydecisions.Inaframeofuncertainty,timepressureandstressparticularlytheFukushimaDaiichisitesuperintendenthadtobeabletogetalltheinformationherequiredasthebasisforhisdecisions.Withthebenefitofhind-sight,itisnowknownthatlotsofinformationwasincompleteorevenmisleading.Yet,nevertheless,decisionshadtobemade(/15/).
Incomplexemergencysituations,similartothesitua-tionatFukushima,decision-makingisinfluencednotonlybysituationalfactors,butalsobyfactorsthataffectasingleindividualoranentiregroup.Beforetheinfluencingfactorsrelatingtodecidingpersonsareexaminedinmoredetail,theexternalcircumstancesofemergencysituationsarediscussedbelow13.
13| Thetopicofdecision-makingisaveryextensiveandmultifacetedresearchfield(seeforexample/34/).Theexplanationscontainedinthisreportarelimitedtojustasmallpartofit.
Inemergencysituations,theresponsiblepeoplearesometimesforcedtomakedecisions–evenifinforma-tionis,atbest,incomplete.Mistakescanoccurifinformationhastobeprocessedundertimepressureoriftoomuchinformationhastobeprocessed.Thebrainisoverloadedandtriestooptimisebetweeneffortandbenefit.Asaresult,thinkingerrorsoccur.Errorsarisefromtheinteractionbetweenindividualperceptionandsituationalcharacteristics(/3/).
Incomplexemergencysituations,thereisrarelyenoughtimetogatherandverifyallinformation.Theresultisdecision-makingunderuncertainty.
4 Decision-makinginemergency situations:influencingfactors
49Decision-making in emergency situations: influencing factors
Situationsinwhichdifficultdecisionsneedtobemadeundertimepressureareoftenrathercomplex.Suchsituationsoftenconsistofextensiveandnetworkedissuethreadsthatarelinkedtogetherinunclearanddynamicways,undeterminedanduncertainintheirimpact(/7/).Therefore,handlinguncertaintyisanimportantrequirementforpeopleeveninnormalsituations.Withinanorganisation,thisuncertaintymustbeaddressedatdifferentlevels.Incomplexandhighlynetworkedorganisations,asystemofruleshelpsbecausepeopleactinglocallycannotoverseealltheconsequencesoftheiractions(/20/).
Incomplexdecision-makingchallenges,situationalfactorssetadditionalrequirementsonapersonactingordeciding.Theserequirementsincludeskillssuchasanalyticallyregisteringdetails,butnotlosingsightoftheoverallpicture,orchoosingtherightdepthofinformationandtherightextentofinformation.Italsoincludestheabilitytoreacttochangingframeworkconditionsandtoconducttheentiredecision-makingprocessinaself-reflectivemanner(/3/).
Thereareseveralwaystoreducecomplexityandminimisetheassociateduncertainty(seealsosection3.1).Oneoftheseistoreducethescopeofactionbymeansofstandardisation(/44/).Theexecutionofemergencyproceduresisamethodusedinpracticeinwhich,intheeventofdesignfaultsinnuclearinstalla-tions,aflowdiagramisprocessedaccordingtoclear
inputcriteriainordertoeffectivelycombattheeventandregaincontroloftheinstallation.Theseregulationsreducecomplexitywithclearproceduresandclearcriteriaforresponsibilitiesanddecisions.Moreover,theirapplicationispractisedregularlyinexercises.
Anotherwayofdealingwithcomplexityistocopewiththeuncertaintyassociatedwithcomplexityusingflexibil-ityandlearning.Insteadoflimitingthescopeofactiontoimprovesafety,thescopeofactionisincreased.Deviationsinday-to-dayoperationsareperceivedaslearningopportunitiesandtheapplicationofrulesishandledmoreflexibly(/44/).Thispath,whichisbasedonlearningandtheintegrationofknowledge,showshowimportantanopenattitudeandpersonalexperi-encegatheredfromday-to-dayoperationsare.Devia-tionsareperceivedasanopportunitytolearnsome-thingandnotasameanforpointingafingerataguiltyparty.Suchapathrequiresanopenandprejudice-freehandlingoferrorsandnearmisses.
Howthetwoapproachesoflimitingorextendingthescopeofactioninorganisationscanbehandled,wasdiscussedinsection3.
4.1 Decision-makingunderuncertainty (situationaleffects)
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
Evenifinanemergencythesituationalcircumstanceswereoptimalfordecision-making,thereareperson-re-latednegativeeffectsthatcaninfluencethedeci-sion-makingcapabilityofanindividualoragroupofpeople.Therefore,thefocusshouldbeinthefollowingontheindividualsorgroupsofpeoplewhomakedecisions.Relatingtoanindividual,onecauseofanegativeinfluencemaybethecognitiveemergencyresponse(/54/).Acognitiveemergencyresponsecanoccurwhenapersonfeelsthattheircompetenciesareatriskandconsequentlytheyaresubconsciouslyobligedtomaintaintheillusionoftheirownabilitytoact.Becauseofthesubconsciousprocess,itispracticallyimpossibletorecogniseone’sowncognitiveemergencyresponse.
Inanemergencyscenario,thepersoninchargeisrarelycompletelyisolated.Ideally,thepersoninchargeissurroundedbyaneffectiveteam.Thisbegsthequestionofwhetherthecognitiveemergencyresponseofasinglepersoncanbecompensatedforbyagroupdecision.Unfortunately,therearealsoeffectsassociatedwithgroupconfigurationsthatcanhaveanegativeimpactondecision-making.Thedecisionofanindividu-alisnotnecessarilyimprovedifitisreplacedbyagroupdecision.Groupdecisionstoohaveassociatedpotentialnegativeeffects.Forexample,groupthinkaccordingtoJanis(/33/).Groupthinkariseswhenanattempttoachieveagreementdominatesthedecision-makingprocessofagroupoflike-mindedpeoplewithstrong
cohesion,suchthatpeople’sperceptionofrealityisimpaired.Contributingelementstogroupthinkareahighlycohesivegroupofpeopleisolatedfromalterna-tivesourcesofinformation,withtheleaderclearlyfavouringoneparticularsolution.Ingroupdiscussions,theseboundaryconditionscancreatetheillusionofone’sowninvulnerabilityandtherationalisationofone’sownactions.Informationthatappearsinconsist-entorincompleteisdowngradedorignored.Thisprocesstakesplacebothindividually,intheformofself-censorship,aswellasbetweenindividuals,intheformofpressuretoachieveaconsensus.Thefollowingsectionconsiderswhatshouldbetakenintoaccountinordertomakegooddecisions.
4.2 Individual-relatednegativeeffectsinthe decision-makingprocess
51Decision-making in emergency situations: influencing factors
Person-relatednegativeeffectscanbepreventedwithrespecttobothgroupthinkandcognitiveemergencyreaction.Optimallytheycanbeavoidedaltogether.Thisrequiresanattitudethatcanbetrainedandimplementedduringday-to-dayoperations.Peoplewhoarenotsubjecttocognitiveemergencyresponsearecharacterisedbygoodself-management.Theycanwithstanduncertaintyanddonotseetheirowncompetencethreatenedbyadifficultsituation.Theycanmanagetheirownstressreactionswell,evenphysicalreactions,andallocatetheirattentiontodifferentaspects.Moreover,theycanalsohandletheirownfeelings.Ifapersoncombinesallthesecharacter-istics,thentheypossessalevelofself-managementthatissuitableforhandlinganemergencysituation,whichshouldnotleadtoacognitiveemergencyresponse.Peoplewithgooddecision-makingskillscommunicateeffectivelyandassumeleadershipandresponsibility(/25/).Thenegativeeffectsofgroupthinkcanalsobeeliminatedbyarationalandbalancedsearchforinformationwiththeinformationthenusedaccordingly.Moreover,thepersonleadingthegroupshouldnotexpresstheirpreferencesinadvance.Eachmemberofthegroupshouldbeabletoexpresstheirthoughtsandargumentsindependentlyoftheothers14.Itisalsousefultodefineproceduralrequirementsforthedecision-makingprocess(/55/).
14| Inpracticalterms,forexample,leadersofanemergencyresponseteamgathertogethertheopinionsofthevariousteammembersandthenmaketheirdecisions.
15| Resourcesherearedefinedas:personnelresourceswhocangatherinformation;timeresourcestoperformtheinformationsearchandtobeabletocarryoutanassessment/prioritisation;informationsourcesfromwhichtoobtaintherelevantinformation,etc.
16| Crisisexpertise:Knowledgeabouthowfirstresponderorganisations(emergencyservices)functionandact,andhowtheinterfacesaremanaged.
Makinggooddecisionsrequiresresourcesevenduringcalmperiods15and,optimally,agooddealofexperi-ence.Managerswhohavecomethroughcrisesreport-edthattheywerehelpedbycrisisexpertise16,self-managementskillsandexperienceinthecrisissituation(/53/).
Whenmakingdecisionsincomplexsituations(includ-ingemergencysituations),itisadvisabletoproceedasmethodicallyaspossible,evenwhentimepressureseemstodominatethesituation.Tomaintaincontrolofaccidentsinnuclearpowerplants,technicalsystemsstartupautomatically,andthenwell-foundedcheck-listswithdecisiontreesareavailable.Thiswinsvaluabletime.Thetimegainedcanbeusedtostruc-turethedecision-makingprocess(/25/).Structuringelementsaretheformationofobjectives,manage-mentofinformation,modelling,planning,deci-sion-makingandcontrol(seebox6).Afteradecision,self-reflectionshouldbecarriedoutcalmlyandunhurriedlyinordertotriggerlearningprocesses.
4.3 Peoplewhomakegooddecisions
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
Box6:Structuringofthedecision-makingprocessaccordingtoHofinger(/25/):
Unambiguousandclearobjectivesaredrawnupduringobjectivesetting,withpartialandintermediateobjectivesbeingdefined.Contra-dictionsshouldberecognisedandbalanced.Itisimportanttosetprioritiesandbuildconsensuswithinthegroup(N.B.:remainawareoftheeffectsofgroupthink).
Themanagementofinformationincludestodeterminewhatisnotknownyet.Additionalneededinformationisstilltobeobtainedandexcessinformationrejected.Theavailablefactsmustbeevaluatedandcheckshavetobemadetoseewhetherthedepthofdetailoftherequiredinformationissufficient.
Thedevelopmentofacommonunderstandingisimportantforateamtoprovideabasisforaction(modelling).Therefore,itisimportanttocreateanoverview,toobtainaviewoftheinterrelation-shipsandtorecognisecriticalpoints.Assump-tionsaboutcausesandconsequencesmustbemadeandforecastscreated.
17| Inpractice,differentmethodsareusedforstructureddecision-making.Forexample,amongtheoperatorsoftheSwissnuclearpowerplants,themethodFORDEC(Facts–Options–Risks–Decision–Execution–Check),orvariantsthereof,namelyFOORDEC(Facts–Objectives–Options–Risks–Decision–Execution–Check)havebecomeestablishedfordecision-makinginsituationswheretimeisnotthelimitingfactor.
Theserecommendationsforstructuringdecision-makingprocessescanbemoreeasilyimplementedinemergenciesif(complex)decision-makingprocesseshavealsobeenperformedinday-to-daysituationsbasedonthispattern.Inthisway,helpfulroutinescanbedevelopedandunfavourablepatternsidentifiedandeliminated17.
Stepsinthecourseoftimeshouldbepre-definedandthesituationalcharacteristicsconsideredasboundaryconditions(planning).Wherepossible,branchingpointsandalternativeroutesshouldbeplannedinadvance.Possiblefrictionpointsshouldbeconsideredandbuffersplanned.Thedistributionoftaskswithintheteamshouldbedefinedandinterfacesbetweentheactionsofindividualmembersplanned.
Fordecision-makingitisimportanttoesta-blishdeadlinesandpre-definedecision-makingmechanisms.
Timingsandcriteriaforchecksshouldbeesta-blishedandthefour-eyesprincipleshouldbefollowed.Withintheteam,mutualchecksarebothanadvantageandachallenge.
Self-reflectiontakesplaceafteradecision,inpeaceandwithoutanytimepressure.Periodsforreflectionshouldbedefined;mutualcriticismwithintheteamacceptedandsupportshouldbeused.
53Decision-making in emergency situations: influencing factors
TheimpactmodelofhumanperformanceunderextremeconditionsinFigure9exhibitsdiverseinfluenc-ingfactors.Italsoshowsthatchangesinexternalinfluencingfactorscanleadtochangesintheresultofthedecisionandthusinfluenceseffectivedecision-making(/46/).
Theimpactmodelhighlightsfactorsthatinfluencethedecision-makingprocessandactionsunderextremeconditions:
• Humancapabilities(e.g.availabilityofskills,individualandcollectivestressmanagement)
• Provisionofthenecessaryinfrastructure(takingintoaccounthumanfactoraspects):technicalsystems,workaids,tools,procedures,informationetc.)
• Organisationalaspects(responsibilities,roles,cooperationandcoordination,communication,tasksandworkflows,organisationalculture).
Ifattentionispaidtothereinforcingfactors(Figure9showningreen),itbecomesobviousthatpeoplewhomakedecisionscanhavecertainprerequisitesthatcanbepositivelyinfluencedbypersonnelselection,suitablestaffingandtraining(personalandprofessionaldevelopment).Asupportiveorganisationalenviron-mentplaysanequallyimportantrole.Inthisrespect,thereisnosimplerecipeforbecomingagooddeci-sion-maker.Essentialistheinteractionoforganisationalprocessesandthepracticedattitude,whichisreflectedintheorganisationalculture.Thesefactorsallowemployeestodeveloptheirabilitiestomakegooddecisionsinemergencysituations.
4.4 Impactmodelofhumanperformanceunder extremeconditions
• HFE1designforsystems&procedures
1HumanFactorsEngineering
• Limitedtime• Challengedsafetytargets
Human• Competences• Individual&collective
stresshandling
Technology/Infrastructure• Technicalsystem• Workaids/tools• Procedures• Informationaccess• Physicalenvironment
Organisation• Roles&responsibilities• Cooperation&coordination• Communication• Tasks&workorganisation• Organisationalculture
Effectivedecisions&actionsunder
extremeconditions
Goal
Factors(stressing/facilitating)
Reinforcingfactors
Figure9:Impactmodelofhumanperformanceunderextremeconditions(basedon/46/)
• Selection• Staffing• Training
• Dailyexperience(normalconditions)
• Organisationaldesign• Flowdefinition• Management
Leadership
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
Thetopicofdecision-makingisincludedintheover-sightoftheHOFSectioninavarietyofways.Indoingso,thefocusofoversightisprimarilyonthebehaviourofactorsinthe«work-as-done»visibleindifferentcontexts,andontheconditionscreatedandprovidedbytheorganisation,instrumentsandguidelinesforthedecision-makingbytheplayers.Theassessmentofthepersonality-relatedaspectsofsuccessfuldecision-mak-ersaredifficulttomeasuredirectly,thusnotinthefocusofoversight.
Decision-makingandtakingresponsibilitygohandinhand.Responsibilityintheareaofnuclearsafetyliesinthefirstinstancewiththeoperatorofanuclearinstalla-tionandthelicenceholderrespectively(Art.22para.1NEA/36/)(seesection2.2.1).Inthelicenceholder’sorganisation,decisionsarestructurallyanchoredatvariouslevelsoftheorganisationandareimplementedintheprocessorganisation.Decisionsarevisiblyanchoredinprocesssequencesinwhichresponsiblefunctionownersareappointed.GuidelineENSI-G07(/9/)specifiesthelegalrequirements.
Thesupervisoryauthorityreviewstheformalrequire-mentsspecifiedbythelicenceholder’sorganisation.Thisreviewnormallytakesplaceaspartofaninspec-tionofaspecificobject.Referencestodecision-makingprocessescanbefoundindocuments,suchasdeci-sion-makingrecords,reviewsignaturesorthelike.
Inspecialistdiscussions(seesection1.2),theauthorityaddressesspecifictopics,includingdecision-makingprocessesandtheinfluencesthereon.
Inemergencyexercisesobservedbytheauthorities,especiallyinrespectoftheworkoftheemergencyteam,aswellasinthepracticallicencingexamsontheplantsimulator,theobservationofdecision-makingisoneevaluatedcategoryamongstothers.
Inthehumanandorganisationalfactorsarea,permitapplicationsfornuclearinstallationbackfitprojectsrequireaprogrammetotakeaccountofhumanandorganisationalfactors(HOFprogramme).Theprocessstepsdescribedandtheiterativeprocedureinthevariousphasesofbackfitprojectsprovideinformationontheexperiencedprocessofdecision-makingintheday-to-dayprojectroutineofthesupervisedparties.Somethinganchoredinday-to-dayroutinecansubse-quentlybemoreeasilyaccessedunderemergencyconditions.
Whereeventsoccur,thetopicofdecision-makingis,ifnecessary,retrospectivelyanalysedandevaluatedbytheoperatingorganisation.Here,thefeedbackoffindingstotheorganisationisofcentralimportance.Knowledgegainedfromeventsoutsidetheorganisation(evaluationofexternaloperatingexperience)isalsoanimportantsourceofimprovement(/9/).
4.5 Oversightrelatingtothetopicof decision-making
55Decision-making in emergency situations: influencing factors
Thefoundationforgooddecisionscanbelaidwithstructureddecision-makingprocesses,trainingcoursesandanopenattitudetoinformation.Ifextremeemergenciesoccur,purelyorganisationalmeasuresintheformofstandardsandrulesnolongersuffice.Ifextremeemergenciesoccur,decision-makersarecharacterisedbyanawarenessofthemselvesandtheirownlimitssothattheycandealwithitmindfully.Anadditionalnecessaryboundaryconditionisthepossibil-ityofrelyingonateaminwhichmutualtrustprevailsandwhichimplementscleardirectivesinatargetedmannerandreactsflexiblytonewturnsofevents(seealsosection3.1).
Theoversightmustfocusprimarilyontheobservableorinferableexpressionofthesecharacteristicsofeffectivedecision-makinginthemannerofbehaviour,processes,specifications,andproducts.Invariedways,thiswasandisthecaseintheoversightoftheHOFSection.Forthisreason,noadditionalspecificregulatorymeasureshavebeenderived.
4.6 Conclusion
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
Aresilientorganisationstrivesforalertnessandflexibili-tysothatitcanadaptatanytimetotheprevailingsituationandisthereforepreparedforunexpectedsituations.Ontheonehand,thefollowingdigressiononcivilaviationshowshowtheskillsandabilitiesofcabincrewmembersofanairlinearetrainedsothatthecrewispreparedfortheunexpected.Ontheotherhand,raisingofawarenessoftheunexpectedintheday-to-dayroutineisdescribed.
HowErikHollnagel'sfourpotentialsforresilience(/29/,seesection3.1)takeeffectandfromwhichaspectsofcivilaviationsafetymanagementnuclearoversightcanlearn,arepresentedattheendofthisdigressiononresilience.
5 Adigressionconcerningresilience: aninputfromcivilaviation
57A digression concerning resilience: an input from civil aviation
Inthefieldofcivilaviation,theone-monthemergencytrainingincludes,amongotherthings,topicssuchastechnicalandmedicalaspects,emergencyequipment,procedures,evacuationmethodsandcrewresourcemanagementCRM(situationawareness,communica-tion,decision-making,adaptabilityandflexibility,leadershipandassertiveness).Furtherthree-dayaircraft-specifictrainingcourses,atwo-month«on-the-job»inductionperiod,annualtwo-dayrecurrenttrainingcoursesandtraininginthesimulatorcontri-butetopractisingexistingproceduresandovercomingfears,increasingperceptionandpositivelysupportingandstrengtheningcreativityandflexibility.Thesimula-tionsfocusonsituationsthatrequireprocessadapta-tions,improvisationandquickdecision-making.
Anexampleofafirefightingtrainingsequenceillu-strateshowtheseskillsarepractisedincivilaviation.Inatrainingbuilding,varioussituationsaresimulatedwithdifferentsmokesourcesandtypesoffire,whicharefacedbycrewmembersfromdifferentoccupa-tions:sometimesalone,sometimesinpairs,theyhave
toextinguishfiresandlookforandidentifysourcesofsmoke.Dependentonthescenario,thefamiliaremergencyequipmentfromtheaircraftisavailabletosolvethetask.Tobeabletoinstilacapabilityforimprovisation,theemergencyequipmentisonlypartiallyavailableorfunctional.Inthiswayforex-ample,theimproviseduseofuniformjackets,blankets,newspapers,liquids,etc.,ispractisedforthepurposeoffire-fighting.Moreover,intheaircraftsimulator,thecrewmembersarealsoconfrontedwithscenariosinwhich,forexample,smokedevelopsinthecabin–thesituationthenrequiresanemergencylandingwithsubsequentevacuationundercomplicatedconditions.
5.1 Developmentandtraining:processadaptation, improvisationanddecisions
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
Gatheringinformation:Goodflightpreparationbeginswitheachindividualstillathome.Alongsidepreparationsthataffecttheflightitselfandthecrew,informationisobtainedfromtheintranetandInternetaboutthedestination.Thisinformationextendsfromorientationonthepoliticalsituationthroughbehaviourrecommendationsandinfectiousdiseasesanduptoemergencytelephonenumbersontheground.
Exchanging,learningandconsiderationofinformation:A30-minutebriefingtakesplacebeforeeveryflight.Itallowsthecrewtobrieflyintroducethemselves,toassigntasksandpositions,andtoexchangeinformationaboutthepassengers,crewmembersandtheflight.Thereisalsoatopicfordiscussionwithreferencetosafety.
Duringtheroundofintroductions,informationaboutspecialtraining,capabilitiesandacquiredskillsthatmayberelevanttosafetyisalsoexchanged:informationsuchasmembershipofalocalfirebrigade,asecondjobasaparamedic,basicpsychologicaltrainingorspeciallanguageskillsthatarerelevantforcolleaguessothattheyknowwhatskillstheycandrawuponinanunexpectedsituation.
Informationaboutpassengers(suchasdisabilities,animalssuchasguidedogs,childrentravellingalone,peoplewhoarebeingdeportedordeniedentry,flightmarshalswhoareaccompanyingtheflightundercover)helpsthecrewtogetanideaoftherisksandresourcespresentonboardandtodefinetheresponsibilitiesofthecrewmembers.
Informationabouttheareasbeingcrossed,suchaswater,mountains,desertorjungle,makescrewmembersawareofwhattheymightencounterinanintermediateoremergencylanding.
Thesafety-relatedtopicthatisalsodiscussedduringthebriefing,canbespecifictotheupcomingflight,orfocusonanemergencyprocedure,oranexperienceofacrewmember:e.g.theprotectionfactorsidentifiedduringasuccessfulparticipationinanemergencylanding,thereactiontoamedicalincidentorwhatemergencyequipmentisimportantintheeventofditching.Thediscussionofasafety-relevanttopicapplicabletoday-to-dayworkisabeneficiallearningopportunityforthecrewmembersthathaspracticalrelevance.Atthesametime,theacquiredknowledge,proceduresandhandlingofequipmentarerepeated.
Resourcesforsafetychecks:Eachcrewmemberusesachecklisttochecktheirstationtogetherwithitsemergencyequipment:Forexample,doesthemega-phonework?Isthereanaxewithfiregloves?Ifequip-mentismissingormalfunctioning,maintenanceiscontacted.Thesafetycheckgivescrewmembersanoverviewoftheequipmenttheyhaveandwhereitisstoredintheparticularaircrafttype,sothattheycanactquicklyintheeventofanincident.
Screening:Boarding,includingwelcomingpassengersandassistancewithfindingaseatandluggagestorage,isalsoanopportunitytomonitorthebehaviourofpassengers.Intheeventofpeculiarities,anattempttoinitiateadialogueismadeinordertoidentifypossibledifficultiessuchasfearofflight,amedicalproblemorastronginfluenceofalcohol,andtoprovidesupportorhelpifnecessary.
5.2 Fromflightpreparationtofinaldestination:raising awarenessoftheunexpectedintheday-to-dayroutine
59A digression concerning resilience: an input from civil aviation
«Oneminuteofsilence»:Immediatelybeforetake-offandlanding,thecrewmembersreceiveasignfromthecockpitfor«oneminuteofsilence»:Beforethemostdelicatephaseofanyflight,crewmembersruntheproceduresthroughtheirheadsincaseany-thingunusualweretohappen(forexample,intheeventofadifficultabortedtake-offorenginedamage).Herethefollowingconsiderationsarefocussedon:
• IsmyseatpositioncorrectsothatIamprotectedintheeventofanabortedtake-off?
• Whatisthesurroundingarealike?Arewelandingorstartingoverwater?
• Whataretheevacuationordersforditching?
• Whichpassengersnearmecanassistmeifneces-sary?
• Whatisthenameofanycolleaguesinmyvicinity?
• Whatcommandsshouldbeshoutedintothecabinifthedoorsticks?
• WhatemergencyequipmentdoItakewithme?
• Whereareunaccompaniedchildren,passengerswithdisabilities,etc.sitting?
Safetyawarenessandcommunication:Duringtheflight,peculiaritiessuchasstrangeodoursandnoisesaswellasinformationfrompassengersisfollowedupandthecockpitisinformed.Toensurethepilotshaveanideaofthesituationintheaircraftcabin,goodcommunicationwiththecabincrewisveryimportantforsafety.
Safetyawareness,alltimesandeverywhere:Afterlanding,passengersfeeltheurgetoleavetheplaneasquicklyaspossible.However,duetothemanynearmissesandaccidentsthatoccurontheairportground,itisimportantthattheyremainseatedwiththeirseatbeltsfasteneduntiltheparkpositionisreached.Onlywhentheenginesareshutdownandastairwayorthepassengerboardingbridgeisdocked,maypilotsgivetheokaytoopenthedoors.Itisonlyjustpriortothisthatthecabincrewisaskedtodisarmtheevacuationslides.Onceagain,thisprocedurerequiresthefullattentionofthecrew.Openingthedoorspriortotheokayofthepilotscouldhavefatalconsequencesforthegroundpersonnelbecausetheslideswouldstillbearmedandwoulddeploy.Inspiteoftheexertionoftheflightandpossiblefatigue,safetyawarenessisrequiredrightuptotheendoftheflight.
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
Thefourpotentialsforresilience(seesection3.1)canbeexplainedbelowwithexamplesdrawnfromcivilaviation:
• The potential to RESPOND: «Knowingwhattodo»ispractisedintraining,simulationsandimprovisa-tionsandconsolidatedinday-to-daywork;dailybriefingscontributetobeingwellpreparedandfullyaware.
• The potential to MONITOR: «Knowingwhattolookfor»;theflightpreparation,entryintotheairportpremises,briefingroomandfinallytheaircraft–allensurecrewmembersaresensitisedtothesurroundings,events,people,soundsandsmells,theyconsciouslyperceivethemandtakereportedanomaliesseriously.Thissensitisedperceptionispractisedandinternalisedintrainingandinthesimulator.
• The potential to LEARN: «Knowingwhathashappened»;personalexperienceindailywork,theexchangeofpositiveandnegativeexperienceinbriefingsandannualtrainingsessions,inwhichnewfindingsareaddressed,implementedandacquired,aswellas,forexample,experiencesfromotherairlines.Allthisleadstobothsingleanddouble-looplearningandwillbeimplementedintheorganisation.
• The potential to ANTICIPATE: «Knowwhattoexpect»;withthelearnedprocedures,training,simulationsandimprovisations,flightpreparationandknowledgeoftheresourcesandchallengesofthecurrentsituation,asillustratedinthe«oneminuteofsilence»example,aswellasincreasedperceptionofexternalinfluences,crewmembersarepreparedtoreact,decide,actandimprovise.
5.3 Thefourpotentialsforresilience
61A digression concerning resilience: an input from civil aviation
Inadditiontothecooperationbetweenchangingcrewmembers,specialfeaturesofcivilaviationincludethevaryingdailyworkinghours,rotations,workingpositionsanddestinationswithconstantlychangingpassengers–allofwhichdemandahighdegreeofflexibilityandadaptability.Togettoknowtheteam,thecrewmembershaveasinglehalfhourbriefing.Techniquesandproceduresthatsupportsafetyareusedinanintuitivemanner,suchastheuseofthephoneticalphabet,thefour-eyesprinciple,cross-checks,STAR(«Stop–Think–Act–Review»),etc.Anever-changingteammake-upisalsoconducivetoidentifyingpersonalblindspots.Anotherfeaturethatcontributestosafetyisthebriefing,inwhichthecrewmembersexchangeideasaboutnegativeandpositive
TheoversightoftheHOFSectioncouldbenefitfromamorediverseteamcompositioninitsinspectionsandspecialistdiscussions,asisthecaseincivilaviation.Indoingso,itcouldbreakuporenrichanydeadlockedpatternsandpreventblindspots.Itisimportanttocon-tinuetosupportandstrengthentheinvolvementofinspectorsfromothersectionsintheoversightactivitiesoftheHOFSection.Varyinginterdisciplinarycoopera-tionnotonlyextendsthesection’sownhorizon,butalsopromotesanintegratedsystemview,takingintoaccountthesystemicapproach(seesection2.2).
Aswiththebriefingpriortoaflight,anincreasedemphasiscouldbeplacedonpositiveexamplesduringpreparatorydiscussionsandthedebriefingsfollowingthespecialistdiscussionsorinspectionsoftheHOFSection.ThiswouldbeinthecontextoflearningfromexperienceandtheSafety-llapproach(seesection3.2).
examplesfromday-to-daywork,gathernewinsightsandfocusnotonlyonthefactorsthatledtoanevent,butalsoontheprotectionfactors,thatguidedtheeventtowardsapositiveoutcome.Thesemaybetechnical,organisationaland/orhumanfactors.
Crewmembers,withtheirimplicitandexplicitknow-ledge,experience,training,alertness,situationalawareness,flexibilityandcreativity,theirdecisionsandtheinherentscopeofactiontheyneedinordertoadapttheiractionsandbehaviour,areconsideredassafetyfactorspreparedandqualifiedtorespondtounexpectedsituations.
Safety-llaspectscouldalsobeincreasinglyconsideredineventprocessingasisthecaseincivilaviationbriefings.Currently,processingfocusesonthecontri-butingfactorsthatledtoaneventandtheresultingactions.AccordingtoSafety-II,theprotectivefactorsthatpreventedaneventwithmoreseriousconse-quencesmustalsobeexamined,acknowledgedandstrengthened.Theseprotectivefactorscanbeofatechnical,organisationaland/orhumannature(seesection3.4.2).
Exchangeofexperience,andcooperationwiththesupervisoryauthoritiesandinstitutionsofothersafety-relatedindustriesstimulatesachangeofperspective,enableslearningfromtheexperiencesofothers,benefitsbothorganisationsandbooststheirresilience.Consolidationofthisexchangeshouldcontinue.
5.4 Reflection–learningfromthespecial featuresofcivilaviation
5.5 Reflection–conclusionsfortheoversight oftheHOFSection
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
Thisreportrepresentsbothan«output»andan«input»fortheHOFSection.Ontheonehand,itistheconclu-sionofthethree-partseriesofreportsonthehumanandorganisationalfactorsoftheFukushimaDaiichireactoraccident.ItcoverstheinsightsoftheHOFSectionsincetheaccidentinMarch2011andtheexperiencegainedforoversightinthehumanandorganisationalfactorsarea.Ontheotherhand,itisthestartingpointforfurtherreflectionandthedevelop-mentoftheoversightofthesectionagainstthebackgroundoftheseinsightsandthecurrentstateofthesafetysciences.
TheHOFSectionwilldevelopanactionplanfortheshort,mediumandlong-termimplementationofthetopics,methodsandapproachesforfutureoversightpresentedintheindividualsectionsofthereport.
ThederivedimplicationsfortheoversightoftheHOFSectionconcern,ontheonehand,topicsthataredealtwithintheframeworkofoversightandontheotherhand,oversightapproachesandmethodsthataretobeappliedintheoversight.Thesetopics,approachesandmethodsarebasedonthetwobasicconceptsofthesystemicapproachandtheSafetyIIapproachandresilience,whicharethemselvesanchoredandestab-lishedinthesafetysciences.OfficialinvestigationsintotheaccidentattheFukushimaDaiichinuclearpowerplantidentifiedtheseconceptsasthebasisforlessonsandrecommendationsforthefurtherdevelopmentofnuclearsafetyatnuclearinstallationsacrosstheworld.
Astheapproachesandmethodsbasedonthetradition-alSafety-Iapproachhavebeenprovedandestablishedovermanyyears,theyhavenotbeendiscussedinthisreport.Rather,theobjectofthisreportisthelesswell-establishedapproachesandmethodsforoversightbasedontheSafety-IIapproach.
Implicationsfortheapproachtooversightintheareaofhumanandorganisationalfactors
AgainstthebackgroundofthesystemicapproachandtheconceptsofresilienceandSafety-II,anumberofimplicationsfortheregulatoryapproachoftheHOFSectionhavebeenderived.Accordingly,astrongerfocusonperformance-orientedoversight,incontrasttopurelycompliance-orientedoversight,isprovingtobeeffective(seeinparticularsection2.2.1).Thefocusisondialoguebetweenthesupervisoryauthorityandthesupervisedorganisationsandthepromotionofself-reflectionandstrengtheningofdirectresponsibilityamongthesupervisedpartiesthroughappropriateregulatoryactivities.Furthermore,thefocusoftheoversightshouldbeonunderstandingthenormalfunctioningofthesupervisedorganisationandtheday-to-dayexecutionoftheworkandnotexclusivelyonthesearchfornegativeevents,deviationsfromtargetspecificationsandthenotionsofideal-typeworkandprocedures(seeinparticularsections3.3and3.4).
Nonetheless,itisimportanttobearinmindthatitisnotsensibletoapplyastandardisedandeverunchangingoversightstrategy.Thismeansthat,inthesenseofa«responsiveregulation»,differentregulatoryapproachesmustbeapplieddependingonthesituation,context,cultureorsafetyperformanceofasupervisedorganisation.Thesecanescalateoveracontinuumwhichextendsfromoversightbasedondialogue,conviction,andextensivedirectresponsibilityandself-regulationuptoincreasinglydemandingandprescriptiveinterventionsbythesupervisoryauthoritywhichculminateinstrictsanctions(seeinparticularsection2.2.1).
6 Closingwords
63 Closing words
Implicationsfortheoversightmethodology
OversightbasedonthesystemicapproachandSafety-IIrequiresmethodsbasedondialogueandreflection.Therefore,theHOFSectioncheckedwhetherandhowitcouldappropriatelydevelopfurtheritsoversightmethodsbasedondiscussions(seesection3.4.2).Thespecialistdiscussionpromotingadialogueonsafetycultureaswellasexploratoryspecialistdiscussionsshouldbeviewedasprototypediscussion-basedmethodsfortheSafety-IIapproach.Bycontrast,informationdiscussionsandinspectionsmustbeexplicitlysupplementedwithSafety-IIelements.Thisrequires,forexample,theformulationofquestionsanddiscussiontechniques,whicharesuitableforstrength-eningthe(self-)reflectionanddirectresponsibilityofthesupervisedparties.Safety-IIaspectscanalsobeusedtosupplementeventprocessing,forexample,bynotonlyfocusingtheanalysisonthecausesofanadverseevent,butalsohighlightingthefactorsthatpreventedaworsecourseofeventsorthefactorsthatcontributetothenormalsmoothrunningoftheaffectedprocess.Finally,aforumacrosspowerplantscouldstrengthendialogueandexchangebetweenthesupervisoryauthorityandthesupervisedpartiesaswellasbetweenthesupervisedpartiesthemselves.
Learningfromotherindustriesisimportantnotonlyfortheoperatorsofnuclearinstallations,butalsoforthesupervisoryauthorityitself.Forthisreason,thisreportlooksatmethodsforstrengtheningresilienceincivilaviationanddrawsconclusionsfromthemforover-sight,forexample,intermsofstrengtheninginterdisci-plinarycooperationandthesystemicapproachbymakingappropriatearrangementsforoversightteamsorbyorganisingbriefingsanddebriefingsthatpromotelearning(seesection5.4).
Identifiedoversightitemsforoversight
Basedonidentifiedtopicsusedtochecktheapplicationofthesystemicapproachinthecontextofthecontinu-ousimprovementofthemanagementsystem,over-sightitemshavebeenidentified,towhichtheHOFSectionwilldevotespecialattentionortowhichishasalreadydevotedspecialattentioninthepast(seesection2.2.2).Theseregulatoryitemsarelocatedatthestrategy,processorworkingleveloftheHTOsystemsunderconsiderationandrelatetotopicssuchasthepurpose,visionandstrategyofthesystem,thesystemboundariesandtheexternalcontextofthesystem,theprocessesandactivitiesforeffectiveandsafeoperation,theeffectivenessofmeasuresandthecontinuousimprovementofsystemrobustnessandresilience.
Anotheroversightitem,whichisdealtwithwithinthescopeofoversight,relatestodecision-makinginemergencysituations.Decision-makingisalreadythesubjectofnumerousoversightactivitiesoftheHOFSection.Furthertopicsmayarisefromoversightpractice(seesection4.5).
Acatalogueofquestionsisalsotobedrawnupasaworkingtooltosupporttheoversightwork.Thiswillcontainappropriatequestionsforthetopicscoveredinthisreport,butalso,whereapplicable,forotheroversightitemsintheareaofhumanandorganisa-tionalfactors,andwillbedrawnuponduringthepreparationforcorrespondingoversightactivities.
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
[1] Amann,E.G.(2015).Resilienz.Haufe,Freiburg.
[2] Braithwaite,J.(2002).RestorativeJustice&ResponsiveRegulation.Oxford:UniversityPress.
[3] Braun,W.(2010).Die(Psycho-)LogikdesEntscheidens.Fallstricke,StrategienundTechnikenim UmgangmitschwierigenSituationen.VerlagHansHuber,Bern.
[4] Comitéd’orientationsurlesfacteurssociaux,organisationnelsethumains(COFSOH),Groupede travailD(2019).Développerlasécurité(https://www.asn.fr/Informer/Actualites/Developper-la- securite).
[5] Croos-Müller,C.(2015).KRAFT.DerneueWegzuinnererStärke.EinResilienztraining.Kösel-Verlag, München.
[6] Dekker,S.(2011).DriftintoFailure–FromHuntingBrokenComponentstoUnderstandingComplex Systems.BocaRaton:CRCPress.
[7] Dörner,D.(2003)16.Auflage.DieLogikdesMisslingens.StrategischesDenkeninkomplexen Situationen.Reinbek:rororo.
[8] SwissFederalNuclearSafetyInspectorate(ENSI)(2010).GuidelineENSI-B10«Basictraining, recurrentTrainingandContinuingEducationofPersonnelinNuclearInstallations»,issuedOctober 2010.Brugg:ENSI.
[9] SwissFederalNuclearSafetyInspectorate(ENSI)(2013).GuidelineENSI-G07«TheOrganisationof Nuclearinstallations»,issuedJuly2013.Brugg:ENSI.
[10] SwissFederalNuclearSafetyInspectorate(ENSI)(2014).ENSIMissionStatement,February2014, ENSI-AN-8718.Brugg:ENSI(https://intranet.ensi.ch/Direktionsstab/DIREKTION/_layouts/15/ WopiFrame2.aspx?sourcedoc={7be26885-f83f-46b1-b799-9de398e8e18a}&action=default).
[11] EidgenössischesNuklearsicherheitsinspektorat(2015).FukushimaDaiichi,Menschlicheund organisatorischeFaktoren.Teil1:DieEreignissevonFukushimaDaiichiunddieanihrerBewältigung beteiligtenOrganisationen,ENSI-AN-9393.Brugg:ENSI(https://www.ensi.ch/de/dokumente/ fukushima-daiichi-menschliche-und-organisatorische-faktoren-teil-1/).
[12] SwissFederalNuclearSafetyInspectorate(ENSI)(2016a).OversightofSafetyCultureinNuclear Installations,2ndEdition,December2016,ENSIReportonOversightPractice,ENSI-AN-8980. Brugg:ENSI(https://www.ensi.ch/en/documents/oversight-of-safety-culture-in-nuclear- installations/).
[13] SwissFederalNuclearSafetyInspectorate(ENSI)(2021).IntegratedOversight,EditionMay2021, ENSIReportonOversightPractice,ENSI-AN-8968.Brugg:ENSI(https://www.ensi.ch/en/documents/ integrated-oversight/).
7 References
65
[14] SwissFederalNuclearSafetyInspectorate(ENSI)(2016b).OversightCulture.ENSIReporton OversightPractice,ENSI-AN-8707.Brugg:ENSI(https://www.ensi.ch/en/documents/oversight- culture-2015-ensi-report-on-oversight-practice/).
[15] EidgenössischesNuklearsicherheitsinspektorat(2018).FukushimaDaiichi,Menschlicheund organisatorischeFaktoren.Teil2:DerAblaufderEreignisseausSichtderbeteiligtenMenschenvor Ort,ENSI-AN-10426.Brugg:ENSI(https://www.ensi.ch/de/dokumente/fukushima-daiichi- menschliche-und-organisatorische-faktoren-teil-2/).
[16] Geeser,G.R.(2016).StandortbestimmungvonSafety-IIinderAufsichtspraxisderSektion«MEOS» desENSI.BachelorThesis.Bachelorstudiengang,6.Semester,HochschulefürAngewandte Psychologie,FachhochschuleNordwestschweiz,Olten(Vertraulich).
[17] Geoffroy,C.(2019).Larésilienceorganisationnelleencontexteextrême:L’équilibrecentralisation/ décentralisationdanslagestiondel’accidentdeFukushimaDaiichi.Gestionetmanagement. Conservatoirenationaldesartsetmétiers–CNAM,2019.Français.NNT:2019CNAM1245.
[18] Grote,G.(2004).Uncertaintymanagementatthecoreofsystemdesign.AnnualReviewsin Control,28,pp.267–274.
[19] Grote,G.(2009).ManagementofUncertainty–TheoryandApplicationintheDesignofSystems andOrganizations.Springer:London.
[20] Grote,G.(2012).Führung.InBadke-Schaub,P.,Hofinger,G.undLauche,K.(Hrsg.).HumanFactors, PsychologiesicherenHandelnsinRisikobranchen.BerlinHeidelberg:Springer-Verlag.
[21] Grote,G.(2019).LeadershipinResilientOrganizations.In:W.Wiig&B.Fahlbruch(Eds.),Exploring Resilience,SpringerBriefsinSafetyManagement,Chapter8,pp.59–67.
[22] Gulati,R.,Casto,C.&Krontiris,C.(2014),HowtheOtherFukushimaPlantSurvived,Harvard BusinessReview,Reihe:CrisisManagement,FromtheMagazine(July–August2014)(https://hbr. org/2014/07/how-the-other-fukushima-plant-survived).
[23] Harzer,Claudia(2012).Positivepsychologyatwork:theroleofcharacterstrengthsforpositive behaviorandpositiveexperiencesattheworkplace.UniversityofZurich,FacultyofArts.
[24] Healy,J.&Braithwaite,J.(2006).Designingsaferhealthcarethroughresponsiveregulation.The MedicalJournalofAustralia184(10),Supplement,S56–S59.
[25] Hofinger,G.(2013).EntscheideninkomplexenSituationen–AnforderungenundFehler.In Heimann,R.,Strohschneider,S.&Schaub,H.(Hrsg.).Entscheiden in kritischen Situationen: Neue Perspektiven und Erkenntnisse.FrankfurtamMain:VerlagfürPolizeiwissenschaft.
[26] Hollnagel,E.(2004).BarriersandAccidentPrevention.Farnham,UK&Burlington,USA:Ashgate.
[27] Hollnagel,E.(2012).FRAM:TheFunctionalResonanceAnalysisMethod.ModellingComplex Socio-TechnicalSystems.Farnham,UK&Burlington,USA:Ashgate.
[28] Hollnagel,E.(2014).Safety-IandSafety-II.ThePastandFutureofSafetyManagement.Farnham, UK&Burlington,USA:Farnham.
[29] Hollnagel,E.(2018a).Safety-IIinPractice.DevelopingtheResiliencePotentials.London&New York:Routledge.
[30] Hollnagel,E.(2018b).FRAMSYNT.TheFunctionalResonanceAnalysisMethod:https:// functionalresonance.com/onewebmedia/Manual%20ds%201.docx.pdf.
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
[31] InternationalAtomicEnergyAgency(2015).TheFukushimaDaiichiAccident.TechnicalVolume2, Chapter2.6.HumanandOrganizationalFactors,pp.121–147.Vienna:IAEA.
[32] InternationalAtomicEnergyAgency(2016).GSRPART2,LeadershipandManagementforSafety, Vienna:IAEA.
[33] Janis.I.(1972).Victimsofgroupthink.Boston:HoughtonMifflin.
[34] Jungermann,H,Pfister,H.R.&Fischer,K.(2010)(3.Auflage),DiePsychologiederEntscheidung. EineEinführung.Spektrum.
[35] Kabat-Zinn,J.(2011).GesunddurchMeditation.DasvollständigeGrundlagenwerkzuMBSR.O.W. Barth.
[36] NuclearEnergyActof21March2003(NEA),SR732.1(asof:1January2020).
[37] NuclearEnergyOrdinanceof10December2004(NEO),SR732.11.
[38] Kim,J.T.,ParkJ.,KimJ.&SeongP.H.(2018).Developmentofaquantitativeresiliencemodelfor nuclearpowerplants.AnnalsofNuclearEnergy122(2018)175–184.
[39] Kitamura,M.(2014).ResilienceEngineeringforSafetyofNuclearPowerPlantwithAccountability. InC.Nemeth&E.Hollnagel(eds.),BecomingResilient.ResilienceEngineeringinPractice,Volume2. Ashgate:Farnham,UK.
[40] LaPorte,T.R.&Consolini,P.M.(1991).WorkinginPracticeButNotinTheory:TheoreticalChallenges of“High-ReliabilityOrganizations”.JournalofPublicAdministrationandTheory,J-PART,Vol.1, No.1.(Jan.,1991),pp.19–48.
[41] Leistikow,I,&Bal,R.(2020).Resilienceandregulation,anoddcouple?ConsequencesofSafety-II ongovernmentalregulationofhealthcarequality.BMJQualSaf2020;0:1–4.doi:10.1136/ bmjqs-2019-010610.
[42] Macrae,C.(2013).ReconcilingRegulationandResilienceinHealthCare.In:E.Hollnagel,J. Braithwaite&R.L.Wears(Eds.),ResilientHealthCare.Farnham,UK&Burlington,USA:Ashgate.
[43] Macrae,C.&Wiig,S.(2019).Resilience:FromPracticetoTheoryandBackAgain.In:S.Wiig&B. Fahlbruch(Eds.),ExploringResilience,SpringerBriefsinSafetyManagement,Chapter15, pp.121–126.
[44] Manser,T.(2012).Komplexitäthandhaben–Handelnvereinheitlichen–Organisationensicher gestalten.In:P.Badke-Schaub,G.Hofinger&K.Lauche(Hrsg.).HumanFactors–Psychologie sicherenHandelnsinRisikobranchen(2.Aufl.).Berlin,Heidelberg:Springer-Verlag.
[45] NationalDietofJapanFukushimaNuclearAccidentIndependentInvestigationCommission(NAIIC) (2012).TheOfficialReportoftheFukushimaNuclearAccidentIndependentInvestigation Commission,NationalDietofJapan,Tokyo.
[46] NuclearSafetyOECD/NEA/CSNI/R(2015)16,October2015.HumanPerformanceunderextreme conditionswithrespecttoaresilientorganisation.ProceedingsofaCSNIInternationalWorkshop. 24–26February2015,Brugg,Switzerland.
[47] ParkJ.,KimJ.,Lee,S.&Kim,J.(2018).ModelingSafety-IIbasedonunexpectedreactortrips.Annals ofNuclearEnergy115(2018)280–293.
[48] Peterson,C.,&Seligman,M.E.P.(2004).Characterstrengthsandvirtues:Ahandbookand classification.NewYork,NY:OxfordUniversityPress.
67
[49] Provan,D.J.,Woods,D.D.,Dekker,S.W.A.&RaeA.J.(2020).SafetyIIprofessionals:Howresilience engineeringcantransformsafetypractice.ReliabilityEngineeringandSystemSafety195(2020) 106740.
[50] RSKstatement(2016).488thMeetingoftheReactorSafetyCommission(RSK)on3November 2016,Monitoringofknow-howandmotivationlossandsuitablemeasuresforstrengthening motivationandmaintainingknow-howintheGermannuclearenergyindustry(http://www. rskonline.de/sites/default/files/reports/rskepanlage1rsk488homepageenrev.pdf).
[51] RSKrecommendation(2019).512thMeetingoftheReactorSafetyCommission(RSK)on22/23 October2019.Assessingtheeffectivenessofmeasurestopreventrecurrenceofevents(http:// www.rskonline.de/sites/default/files/reports/epanlage1_RSK512_hp_en.pdf).
[52] Rutz,S.(2017).PracticingReflexiveRegulation.Rotterdam:ErasmusUniversity.
[53] Sommerauer,K.&Meier,R.(2015).EinguterKapitänzeigtsichimSturm.Krisenkompetenzfür Führungskräfte.HogrefeVerlag,Bern.
[54] Strohschneider,S.&Weth,R.,v.d.(Hrsg.)(2002).Ja,machnureinenPlan.PannenundFehlschläge –Ursachen,Beispiele,Lösungen.Bern:VerlagHansHuber.
[55] VanAvermaet,E.(2003).SozialerEinflussinKleingruppen.InStroebe,W.,Jonas,K.,&Hewsone, M.(Hrsg.).Sozialpsychologie.BerlinHeidelbergNewYork:Springer-Verlag.
[56] Wäfler,T,Gugerli,R.&Nisoli,G.(2021).IntegratingSafety-IIintoSafetyManagement.Generalized GuidelinesforaSafety-II-basedTool:MeasureEvaluationandEffectivenessAssessment.Mensch- Technik-Organisation,Band50.Zürich:vdfHochschulverlagAGanderETHZürich.
[57] Weick,K.E.(1993).Collapseofsensemakinginorganizations:theMannGulchdisaster.Adm.Sci. Q.38(4),628–652(1993).
[58] Weick,K.E.&Sutcliffe,K.M.(2015).ManagingtheUnexpected–SustainedPerformanceina ComplexWorld,3rdEdition.Hoboken,NewJersey:Wiley.
[59] Wilpert,V.(2008).Regulatorystylesandtheirconsequencesforsafety.SafetyScience46(2008) 371–375.
[60] Wiig,S.,Aase,K.,&R.Bal(2019).ReflexiveSpaces:LeveragingResilienceIntoHealthcare RegulationandManagement.JournalofPatientSafety,January2020.
[61] Wiig,S.&Fahlbruch,B.(eds.)(2019).ExploringResilience.SpringerBriefsinSafetyManagement (https://link.springer.com/content/pdf/10.1007%2F978-3-030-03189-3.pdf).
[62] Wiig,S.&Fahlbruch,B.(2019).ExploringResilience–AnIntroduction.In:S.Wiig&B.Fahlbruch (Eds.),ExploringResilience,SpringerBriefsinSafetyManagement,Chapter1,pp.1–5.
[63] Wood,C.,Ivec,M.,Job,J.&Braithwaite,V.(2010).ApplicationsofResponsiveRegulationTheoryin AustraliaandOverseas.RegulatoryInstitutionsNetwork.
[64] Yun,S.,Faraj,S.,&Sims,H.P.,Jr.(2005).ContingentLeadershipandEffectivenessofTrauma ResuscitationTeams.JournalofAppliedPsychology,90(6),1288–1296.
[65] Zolli,A.&Healy,A.M.(2012).Resilience.London:HeadlinePublishingGroup.
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
i «TheaccidentattheFukushimaDaiichiNPPwasasurpriseoutsidetheboundariesofthebasicassumptionofthekeystakeholders,meaningthestakeholdershadnotbeenabletoimaginethatsuchanaccidentcouldoccur.Fromthis,thelessonlearnedfortheinternationalnuclearcommunityisthatthepossibilityoftheunexpectedneedstobeintegratedintotheexistingworldwideapproachtonuclearsafety»([31],p.146).
ii «NISA’soversightandregulatoryactivitieswereoftenbasedoncompartmentalizedthinking,i.e.itdidnotsufficientlyaddressissuesinabroad,systemicmanner,consideringallaspectsrelevanttosafety(…).Particularemphasiswasplacedontechnicalissues,comparedwithoperationalaspectsandhumanandorganizationalfactors(…)»([31],p.130).«Inaddition,theregulatorybodieswerelessdisposedtolearningfrominternationalexperience(…)showingacleartendencyforisolation(…),frequentlyarguingthatlessonslearnedandapproachesfromothercountrieswerenotapplicabletoJapan»([31],p.130).
iii «Asystemicapproachtosafetyneedstobeimplementedbyallparticipantsandinalltypesofactivitieswithinthenuclearpowerprogrammeandthroughouttheentirelifecycleofnuclearinstallations,includingreviewservicesofferedbyinternationalorganizations.Aswasshownbytheanalysis,inJapan,nuclearinstallations,TEPCOandNISAprimarilyfocusedonthetechnicalaspectsofnuclearsafety.Asystemicapproachtosafetyimpliesthatallstakeholders,besidesthetechnicalfactors,takecomprehensivelyintoaccountthehumanandorganizationalfactors,includingsafetyculture,tobuildresilientcapabilities»([31],p.144).
iv «Thebasicideaofresponsiveregulationisthatgovernmentsshouldberesponsivetotheconductofthosetheyseektoregulateindecidingwhetheramoreorlessinterventionistresponseisneeded»([2],p.29).
v «…withregardtonuclearemergencypreparedness,itwasnotnecessarytoanticipateanaccidentthatwouldreleaseenoughradioactivematerialastoactuallyrequireprotectiveactions,since(theybelieved)rigorousnuclearsafetyregulations,includingsafetyinspectionsandoperationmanagement,wereinplaceinJapan»([45],p.137).
vi «Resilienceisanexpressionofhowpeople,aloneortogether,copewitheverydaysituations–largeorsmall–byadjustingtheirperformancetotheconditions.Anorganisation’sperformanceisresilientifitcanfunctionasrequiredunderexpectedandunexpectedconditionsalike(changes/disturbances/opportunities)»([29],p.14f.).
vii «Resiliencecompetenciesandresourceshavetobedevelopedwellinadvancewithinorganizationstohelppersonneltoquicklyandflexiblyadapttonewsituations,todevelopnewsolutionsforblindspots–inotherwords:toberesilientinunexpectedsituations»([31],p.146).
viii «Thesignatureofahighreliabilityorganization(HRO)isnotthatitiserror-free,butthaterrorsdon’tdisableit»([58],p.95).
ix «Knowingwhattodoorbeingabletorespondtoregularandirregularchanges,disturbancesandopportunitiesbyactivatingpreparedactions,byadjustingthecurrentmodeoffunctioning,orbyinventingorcreatingnewwaysofdoingthings»([29],p.26).
x «Knowingwhattolookfororbeingabletomonitorthatwhichaffectsorcouldaffectanorganisation’sperformanceinthenearterm–positivelyornegatively.(Inpractice,thismeanswithinthetimeframeofongoingoperations,suchasthedurationofaflightorthecurrentsegmentofaprocedure.)Themonitoringmustcoveranorganisation’sownperformanceaswellaswhathappensintheoperatingenvironment»(/29/,p.27).
8 Endnotes
69
xi «Knowingwhathashappenedorbeingabletolearnfromexperience,inparticulartolearntherightlessonsfromtherightexperiences.Thisincludesbothsingle-looplearningfromspecificexperiencesandthedouble-looplearningthatisusedtomodifythegoalsorobjectives.Italsoincludeschangingthevaluesorcriteriausedtotailorworktoasituation»([29],p.27).
xii «Knowingwhattoexpectorbeingabletoanticipatedevelopmentsfurtherintothefuture,suchaspotentialdisruptions,noveldemandsorconstraints,newopportunitiesorchangingoperatingconditions»([29],p.27).
xiii «Anintegrativeframeworkshouldalsoaccommodatethepositive,aswellasthe‘negative’,aspectsofresilience:theprocessesofimprovement,adaptationandinnovationasmuchasthemanagementoftheadverseimpactsandcrisesthatareoftenviewedastheprimetriggerofresilience»([43],p.127).
xiv «Itisnotjustaboutbeingabletorecoverfromthreatsandstresses,butratheraboutbeingabletoperformasneededunderavarietyofconditions–andtorespondappropriatelytobothdisturbancesandopportunities»([29],p.15).
xv «Ingeneral,Safety-IIisaboutlearningfromthingsthatgorightandimprovingresilience,whereSafety-Iisaboutlearningfromthingsthatgowrongandimprovingcompliance»([41],p.1).
xvi ComparisonofthecharacteristicsofSafety-IandSafety-II(/28/,p.147)
Safety-I Safety-II
Definitionofsafety Asfewthingsaspossiblegowrong. Asmanythingsaspossiblegoright.
Safetymanagementprinciple
Reactive,respondwhensomethinghappens,oriscategorisedasanunacceptablerisk.
Proactive,continuouslytryingtoanticipatedevelopmentsandevents.
Explanationofaccidents Accidentsarecausedbyfailuresandmalfunctions.Thepurposeofaninvestigationistoidentifycausesandcontributoryfactors.
Thingsbasicallyhappeninthesameway,regardlessoftheoutcome.Thepurposeofaninvestigationistounderstandhowthingsusuallygorightasabasisforexplaininghowthingsoccasionallygowrong.
Attitudetothehumanfactor
Humansarepredominantlyseenasaliabilityorahazard.
Humansareseenasaresourcenecessaryforsystemflexibilityandresilience.
Roleofperformancevariability
Harmful,shouldbepreventedasfaraspossible. Inevitablebutalsouseful.Shouldbemonitoredandmanaged.
The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3
xvii «Thecentralthemeofcentralizedcontrolis‘planandconform’,whilethecentralthemeofguidedadaptabilityis‘planandrevise’»([49],p.11).
xviii «Managers,safetyprofessionalsandfrontlineworkersneedtodeterminewhen,foragivencontext,thesafecourseofactionistocomplywithstandardizedpractices,andwhenthesafecourseofactionistoadapt»([49],p.11).
xix «Poorlydesignedandimplementedregulationcanthereforedramaticallyreducetheattentionalresources,localauthorityandcapacityforflexibilityonthefrontlineofhealthcareorganisations.Thatis,poorregulationcanreduceorganizationalcapacitiesforresilience»([42],p.116).
xx «Regulatorytechnologiesthataimtosupportcentralizedandstandardizedcontrolofbehaviorappearimmediatelyatoddswiththeemphasisthatmostmodelsofresilienceplaceonlocalinnovations,flexibility,improvisation,adaptability,problemsolving,vigilanceandtrial-and-errorlearning»([42],p.115).
xxi «Withthismuchridingoncompliance,organisationscanbecomeoverlyfocusedonmeetingregulatoryrequirementsmerelytomanagetherisksofregulatorysanctions(…),attheexpenseofactuallymanagingtheunderlyingriskstoqualityandsafetythattheregulationsareintendedtoaddress–socalled‘secondaryriskmanagement’»([42]p.116).
xxii «ButtheconceptsofregulationandSafety-IIareactuallyquitesimilar;bothareaboutmakingsenseofsituationsinthecontextoftheirsocialdynamics»([41],p.2).
xxiii «Onecouldcallthisamovefromregulatoryoversighttoregulatoryinsight»([41],p.4).
xxiv «Weconceptualizereflexivespacesasphysicalorvirtualplatformsinwhichreflexivedialogicalpracticeoccursbetweenpeople.Thereflexivedialogicalpracticeiskeyinlearningprocesses,becauseitbridgestacitandexplicitknowledge.Reflexivespacescanbringpeopletogethertoreflectoncurrentchallenges,adaptations,andneedsindailyworkpractice.Reflexivespacesareforumsinvitingaccountabilityandfeedbackonconcretepracticesandtheeffectstheygenerate.Theyarecollectiveinthesensethattheymobilizeexperiencesofrelevantactorswithinandoutsidehealthcarepractices.Accountabilitywithinsuchspacesisgenerativeinthesensethatitaddstolearningratherthancurbingit»([60],p.2).
xxv «Thegoalofthisapproachistoleavetheresponsibilityforsafetyasmuchaspossiblewiththeorganizationandmanagementitself,whilecheckingthecapabilityandwillingnessoftheorganizationstomanage.‘Trust,butassesstrustworthiness’iskeyandtheestablishedreflexivespacesdependonthesecharacteristicsoftrust,responsibility,andengagementtoleverageresilienceintoregulationandmanagement»([60],p.2).
xxvi «Onlyifanopendialoguebetweenoperatorandregulatorisestablished,cantheoperationalflexibilitywhichliesattheheartofresiliencebeeffectivelyrealized»([21],p.65).
xxvii «Thetaskoftheregulatorybodyishighlydemandingandentailsthedutyofcontinuouslychallengingandquestioningthebasicassumptionheldbytheindustryitregulatesandbyitself.Thisimplieshighdemandsontheregulator’sself-reflectingcapabilitytoputitsownroleanditsimpactonnuclearsafetyandonthecollectiveperceptionofnuclearsafetyunderconstantself-scrutiny»([31],p.144).
71
Impressum
IssuedbyENSISwissFederalNuclearSafetyInspectorateENSIIndustriestrasse19CH-5201BruggPhone+41(0)564608400Fax+41(0)[email protected]
ENSI-AN-11071
Issued byENSISwiss Federal Nuclear Safety Inspectorate ENSIIndustriestrasse 19CH-5201 BruggPhone +41 (0)56 460 84 00Fax +41 (0)56 460 84 [email protected]
ENSI-AN-11071March 2021