John Bernard Taylor Safety Culture

Safety Culture
To my wife Sandra
Safety Culture
Assessing and Changing the

Behaviour of Organisations
John Bernard Taylor

© John Bernard Taylor 2010
All rights reserved. No part of this publication may be reproduced, stored in a retrieval
system or transmi.ed in any form or by any means, electronic, mechanical, photocopying,
recording or otherwise without the prior permission of the publisher.
John Bernard Taylor has asserted his moral right under the Copyright, Designs and Patents
Act, 1988, to be identified as the author of this work.
Gower Applied Business Research

Our programme provides leaders, practitioners, scholars and researchers with thought
provoking, cutting edge books that combine conceptual insights, interdisciplinary rigour and
practical relevance in key areas of business and management.
Published by
Gower Publishing Limited Ashgate Publishing Company
Wey Court East Suite 420
Union Road 101 Cherry Street
Farnham Burlington,
Surrey, GU9 7PT VT 05401-4405
England USA
www.gowerpublishing.com
British Library Cataloguing in Publication Data

Taylor, John Bernard.
Safety culture : assessing and changing the behaviour of
organizations. -- (Psychological and behavioural aspects of
risk)
1. Industrial safety--Evaluation. 2. Organizational
behavior--Evaluation. 3. Safety education, Industrial.
I. Title II. Series
363.1’163-dc22
ISBN: 978-1-4094-0127-8 (hbk)

978-1-4094-0128-5 (ebk) II
Library of Congress Control Number: 2010937247

Contents
List of Figures vii

List of Tables ix
Acknowledgements xi
Preface xiii
1 Organisational Safety-Culture Theory 1

Safety-Culture Theory 1
The Integrated Safety-Culture Paradigm 34
Summary 37
2 Safety-Culture Theory as a Predictive Model 39

Safety-Culture and Event Predictions 39
Summary 127
3 Assessing Organisational Safety Culture 129

The Formal and Informal Safety-Culture Dimensions 129
Characteristics and Attributes 132
An Independent Review – ‘Measuring’ Safety-Culture
Characteristics and Attributes 133
Quantification of Data 147
Independent Safety-Culture Review Process Output 148
Pictorial Output from the Independent Safety-Culture Review
Process 151
A Worked Example of ‘a Safety-Culture Review’ 159
Techniques for Self-Assessment of Safety-Culture 161
Summary 167
4 Changing a Safety-Culture 169

A Way Forward 169
The Psychological Implications of Change 172
Making the Change 175
An Organisation’s Self-Generated Change Programme 176
A Modular Assisted Approach to Change Programme Delivery 181
Change Programme Metrics 185
vi Safety Culture
Leadership for Safety – Soft Skills and Behaviours 185

Making Safety-Culture Change Last 187
Safety Behavioural Observation Techniques 189
Change-Programme Monitoring, Review and Continuous
Improvement 191
Summary 193
5 Epilogue 195
Concluding Remarks 195
Summary 197
Appendix I 199
Appendix II 203
Appendix III 205
Further Reading 209
Index 213
List of Figures
Figure 1.1 Safety-beliefs and espoused values leading to attitudes and

safety-behaviours 4
Figure 1.2 Schematic of safety-culture layers 4
Figure 1.3 A military parade 20
Figure 1.4 The Union Jack 20
Figure 1.5 A barrister’s court wig 21
Figure 1.6 Documents and equipment – artefacts 21
Figure 1.7 The integrated safety-culture paradigm 35
Figure 2.1 VCM reactor vessels layout – plan 62
Figure 2.2 VCM reactor vessels layout – elevation 64
Figure 2.3 ‘Mirror image’ vessels D306 and D310 layout – ground
floor 65
Figure 2.4 The location of Tokaimura (Point ‘A’) 80
Figure 2.5 A chain reaction 82
Figure 2.6 A schematic, the approved process in the Conversion Test
Building 91
Figure 2.7 The unapproved process using the precipitation tank 95
Figure 2.8 The precipitation tank 97
Figure 2.9 A schematic of the operators’ locations during the criticality
event 98
Figure 2.10 A schematic plan of the irradiator facility 111
Figure 3.1 Example – the distribution of attributes for the characteristic
– ‘Safety is a clearly recognised value’ 151
Figure 3.2 Example – the distribution of safety-culture characteristics 154
Figure 3.3(a) A possible distribution of safety-culture characteristics
for a sample of events 156
Figure 3.3(b) A possible distribution of safety-culture characteristics
for a sample of events 158
Figure 4.1 A safety-culture ladder 182
This page has been left blank intentionally
List of Tables
Table 1.1(a) Antecedents and consequences – current behaviour,

middle managers do not frequently carry out behavioural
observations across a sample of all employees 28
Table 1.1(b) Antecedents and consequences – changed behaviour,
middle managers frequently carry out safety behavioural
observations across a sample of all employees 29
Table 2.1 Failures of a safety-management system – dropped load
event 76
Table 3.1 Safety-culture characteristics 132
Table 3.2 Examples of shared organisational safety-beliefs 134
Table 3.3 Examples of shared organisational safety values 135
Table 3.4 Safety-culture characteristic A – ‘Safety is a clearly recognised
value’, attributes, safety-behaviours (informal dimension)
and the documented expectations (formal dimension) 136
Table 3.5 Safety-culture characteristic B – ‘Leadership for safety is
clear’, attributes, safety-behaviours (informal dimension)
Table 3.6 Safety-culture characteristic C – ‘Accountability for safety
is clear’, attributes safety-behaviours (informal dimension)
Table 3.7 Attributes for safety-culture characteristics D and E 145
Table 3.8 Criteria for assessing and scoring the degree of presence
of an attribute 149
Table 3.9 Panoramic irradiator, testing safety-beliefs and observed
behaviours for culture characteristic A 163
Table 4.1 Senior managers’ safety-behaviours 180
Table 4.2 A generative organisation 183
Table 4.3 Maturity model elements and the five safety-culture
characteristics 185
Table 5.1 Ten safety-culture questions 198
Table A3.1 Expected responses to the ten safety-culture questions 205
Psychological and Behavioral
Aspects of Risk Series
Series Editors: Professor Cary L. Cooper and Professor Ronald J. Burke
Risk management is an ongoing concern for modern organizations in terms of

their finance, their people, their assets, their projects and their reputation. The
majority of the processes and systems adopted are very financially oriented
or fundamentally mechanistic; often better suited to codifying and recording
risk, rather than understanding and working with it. Risk is fundamentally a
human construct; how we perceive and manage it is dictated by our attitude,
behavior and the environment or culture within which we work. Organizations
that seek to mitigate, manage, transfer or exploit risk need to understand the
psychological factors that dictate the response and behaviors of their employees,
their high-flyers, their customers and their stakeholders.
This series, edited by two of the most influential writers and researchers
on organizational behavior and human psychology explores the psychological
and behavioral aspects of risk; the factors that:
• define our attitudes and response to risk,

• are important in understanding and managing ‘risk managers’ and
• dictate risky behavior in individuals at all levels.
Titles Currently in the Series Include:
New Directions in Organisational Psychology and Behavioural Medicine

Edited by Alexander-Stamatios Antoniou and Cary Cooper
Risky Business
Psychological, Physical and Financial Costs of High Risk Behavior in Organizations
Edited by Ronald J. Burke and Cary L. Cooper
Crime and Corruption in Organizations

Why It Occurs and What to Do About It
Edited by Ronald J. Burke, Edward C. Tomlinson and Cary L. Cooper
Acknowledgements
Thanks are given to the companies and organisations noted in this text whose
data enables others to learn from their knowledge and research. The narrative,
commentary and interpretation of data are entirely the authors and do not
necessarily represent the views of the sources.
Research information the causes of events and the associated safety-culture

discussion, have been brought together from a variety of technical publications.
These include reports, text books, regulatory guidance and international
agency documentation. As far as is reasonably practicable the original source
of any work has been acknowledged and permission sought to publish. Any
omissions are unintentional. Modifications or interpretation of the original
information to benefit this text is entirely the responsibility of the author.
Thanks are offered to colleagues for their robust comment and critique
at various stages in the development of the text. Further, there have been
numerous discussions with safety and safety-culture specialists nationally
and internationally. Nevertheless, any errors, technical or grammatical, remain
the author’s responsibility. Finally, the book will hopefully assist hard pressed
managers in whose hands we often place our safety as members of their
workforce, members of the public, or visitors to their facilities.
Preface
A hazardous facility is one that if inadequately managed could with an intolerable

frequency, have events causing fatalities or serious workforce injuries. The
public may also be at risk. As a contribution to minimising these risks such
facilities require robustly engineered safety systems, effective documented
safety management systems and a developed organisational safety-culture.
Facility safety is an important commercial risk that has to be managed.

Following an accident, the lack of a ‘good’ safety management system
compounded by a ‘poor’ safety-culture is a charge often laid on organisations.
With research showing that accidents can take up to 30 percentage points
off annual profits and potentially have larger social costs, the commercial
implications can be significant. This has been starkly demonstrated for
example in the railway, the international nuclear and the oil industries. For any
business, an accident brings additional costs. For some, the ultimate cost can
be receivership.
This safety-culture text draws information from many existing sources and
is presented in self-contained chapters.
Chapter 1 introduces one theory of safety-culture – the ‘layered’ generic

model – which is expanded into an integrated safety-culture paradigm. In
Chapter 2, the generic model’s validity and its predictive capability are considered
by testing its tenets against a selection of accidents. Chapter 3 considers if an
organisation’s safety-culture can be ‘measured’ using the integrated paradigm
by assessing safety-culture characteristics, the generic model elements and
behaviour observations. An approach to implementing safety-culture change
is considered in Chapter 4. Finally, the Epilogue summarises some key points
on developing a strong safety-culture and offers some concluding remarks.
J.B. Taylor
1
Organisational Safety-Culture
Theory
Safety-Culture Theory
The concept of safety-culture emerged from the analysis of the 1986 Chernobyl
nuclear power plant accident. Having delivered a severe political and social
shock to Europe it was an imperative that the causes of this event were fully
understood.
Although the initial causes were considered to be engineering design

failings with contributing operational equipment failures, there remained
considerable unease that these immediate causes may not be the root cause.
Because of these misgivings and the severity of the accident, there were moves
towards a standard industrial practice of inquiring more deeply into the root
cause of accidents. This required looking beyond the immediate engineering
and technical failures. The Chernobyl event analysis applied this approach.
Taking investigations beyond engineering failures brings into focus the

performance of ‘the person’ managing, designing, constructing or operating
hazardous facilities. This embraces the psychology of why people behave as
they do in the workplace and how they interface with complex technology. In
addition, the work environment’s social factors that shape people’s beliefs and
attitudes towards safe operations become important.
From the technical inquiries into the Chernobyl incident with a concentration
on the ‘person dimension’, it emerged that inadequate organisational safety-
culture was a possible major contributor to the accident. Retrospectively, it was
also considered a possible contributor towards many historic accidents where
the root cause was not necessarily due to less than optimum engineering design
or equipment failures, but people’s ‘poor’ human performance.
Safety Culture
The inquiries suggested that the designers and operators ‘good’ safety-
beliefs, attitudes and behaviours act as additional accident barriers. The
human performance element, safety-culture, in accident causation cannot be
ignored. Safety culture emerged from the Chernobyl experience as a complex,
psychological, human behavioural phenomenon that needed to be addressed.
Some safety-culture definitions are given in Appendix I.
Evidence suggests that if safety-culture is not understood and managed

then its possible weakness can lead to the failure of the designed engineering
or procedural safety barriers.
Safety-culture theories indicate that different levels of an organisational

hierarchy have different influences on the safety-culture. These levels need to be
differentiated. In this text an organisation is considered as having four levels:
1. executive and senior management
2. middle managers
3. supervisors
4. The workforce teams. (These can be plant designers, the plant

operators, maintenance engineers, technicians and contractors, and
so on, who are assumed to work under a supervisor.)
The employees, or the staff, are the aggregate of the workforce and
management.
There have been many contributors to safety-culture theory with various

models arising, for example Turner 1998, Rasmussen 1997, Reason 1997 and
Leveson 2004. However, to enable a practical understanding of the phenomenon
a culture model attributed to original work by E. Schein in his study of business
culture is introduced. For this text it is termed the ‘generic culture model’ as the
key elements of the model can be considered as universal to most culture types.
A discussion of the model’s components may be helpful.
The work by E. Schein, who examined US business cultures, has generic

elements transferable into the safety discipline. The possibility of transferring
the concept was first proposed by specialists at the International Atomic Energy
Agency (IAEA) and the concept was in due course developed by the Agency
ORGANISATIONal SAFETY-CULTURE THEORY
into a methodology for ‘measuring’ safety-culture in high-hazard industrial

complexes.
The theory suggests that organisational culture arises from shared

beliefs. These beliefs driving an organisation’s collective behaviours are not
always overt but in reality are buried beneath observable supportive layers of
values, attitudes and artefacts. It is suggested that beliefs and hence culture
can only be assessed and interpreted indirectly through observing human
behaviours.
The layered generic model’s culture elements can be summarised as:
• beliefs
• espoused values
• attitudes
• artefacts
• behaviours.
This is shown schematically in Figure 1.1.
As a combination of the elements; beliefs, values, attitudes and artefacts,

the culture manifests itself through behaviours or human performance.
Although behaviours have strong links to the culture elements, the generic
model suggests that an organisation’s shared beliefs in particular mould staff
behaviours. In addition, if a set of shared beliefs and associated behaviours
deliver organisational ‘success’, their validity will be reinforced leading to a
stable and enduring culture.
An alternative presentation is given Figure 1.2. Here organisational

culture is considered to be like onion layers. Within are hidden shared
beliefs. To understand a culture, the elements or the layers have to be peeled
back or more practically, each layer needs to be analysed to reveal the basic
organisational beliefs. Within the context of organisational safety-culture, if
the safety-beliefs cannot be revealed then little can be concluded about an
organisation’s safety-culture or the motivation behind its members’ safety-
behaviours.
Safety Culture
BEHAVIOURS
ATTITUDES
ARTEFACTS
ESPOUSED VALUES
BELIEFS
Figure 1.1 Safety-beliefs and espoused values leading to attitudes and

safety-behaviours
Source: Schein, E. Reproduced by the kind permission of John Wiley & Sons.
behaviours
artefacts
espoused values
basic assumptions
Figure 1.2 Schematic of safety-culture layers

Source: By kind permission of Guldenmund, F. Delft University Holland.
Beliefs
Beliefs are emotions and assumptions that something is true. They can become
deep seated to the extent that a person unconsciously subscribes to them.
Because they are deep seated and fundamental they are usually stable. ‘Good’,
shared safety-beliefs, if unconsciously adopted with associated good safety-
behaviours, can deliver business success. On the other hand, ‘poor’ shared
beliefs can give a perception of business success. Usually this is illusionary as
the associated poor safety-behaviours may eventually lead to a severe event or
the progressive deterioration of the business.
Examples of ‘good’ shared organisational safety-beliefs are:
We believe:
• The safety of staff, contractors and the public is our number one
priority in all circumstances
• Accountability for safety rests at all times with managers
• Responsibility for safety rests with all employees
• In safety vigilance at all times
• Human error is normal and can be expected
• Our engagement in safe behaviours is necessary for safe

operations
• Human errors are a learning opportunity
• People are fallible and will make mistakes
• Legal compliance is a minimum requirement and we strive to do

better
• In a ‘just’ safety-culture and that people do come to work intending

to do a good job.
Safety Culture
Some mature organisations have only one or two founding beliefs with
others arising naturally from these. Beliefs are usually supported by safety-
culture values that are conditions and actions that are held in high esteem by an
organisation because they assist in fulfilling beliefs. As discussed later, values
are regularly espoused or spoken by an organisation.
In general terms, beliefs are not inherent to individuals; they are learnt,
shared and arise from a common experience of organisational ‘survival’.
Although reflected in espoused values, artefacts and personal attitudes, beliefs
become overtly observable through behaviours. Where beliefs are shared and
reinforced with values and artefacts a sense of community and group cohesion
arises.
Safety-beliefs cannot be seen or measured even though they give rise to

behaviours. They can, however, usually be understood indirectly through the
supporting elements, the espoused values, attitudes and artefacts. Even with
these observable elements however, an organisation’s true safety-beliefs may
still remain hidden. The observed organisational elements may be indicating
‘good’ safety-beliefs, but may in reality not be reflecting the true beliefs and be
misleading. This misalignment is usually identified through the observation
of staff’s ‘poor’ safety-behaviours. The behaviours will expose the truth, or
falseness, of espoused values, attitudes and artefacts and hence the truth, or
falseness, of the shared safety-beliefs.
Artefacts, spoken values and attitudes that are supportive of good safety-
beliefs are usually indicative of an organisational commitment to safety
and observable good organisational safety-behaviours should contribute to
confirming that there are good shared safety-beliefs.
One should not overwork the generic model, if indeed it can be considered
truly generic. There are internal organisational feedback loops and external
effects.
Feedback on the viability of beliefs arises from behavioural consequences.

These consequences if not delivering ‘business success’ may lead to belief
change. Positive feedback arises from safety achievements, for example, or
meeting business targets, whilst negative feedback would be an operational
safety incident or plant process shutdown. The quality of feedback can be
influenced by the human social environment. Within an organisational hierarchy
individuals have their own expectations, social needs, their survival needs.
These are fulfilled by various behavioural tactics. These adopted strategies can
support or hinder line managers, peers or their subordinates in shaping the
culture and stabilising beliefs. The employee’s age distribution, experience, the
exercising of perceived organisation status, or the strength of an organisation’s
sub-cultures can influence beliefs and behaviours. An open dialogue culture
is an approach by which an organisation can ensure the human social needs
are managed and the adopted strategies are directed to positively supporting
shared safety-beliefs. Finally, superimposed on the broader feedback loops
is the influence of the senior management through their specific business
requirements, safety expectations, resource control and authority.
External influences such as public pressure, regulatory interventions and

the national culture can modify an organisation’s perception of its success and
the adequacy of its beliefs.
The layered generic model is helpful but perhaps not perfect.
Beliefs as ‘truths’ cover many aspects of human experience. Religions,

politics, various social interactions and family cohesion are based on belief
platforms. This arises from people’s life experiences being evaluated, and over
time influencing the collective sharing of cultural social beliefs. Within an
industrial organisation safety-beliefs of individuals are influenced not only by
general experiences but more specifically by the work environment. This is a
natural extension of concept of learnt beliefs.
An individual’s beliefs are formed from life’s events. They arise, inter alia,
from interactions within the family, through formal education, friendships
and workplace colleagues. An individual’s behaviours are an expression of
accumulated long-term beliefs and supporting values which stabilise and if
delivering ‘success’ become resistant to change.
Individual’s beliefs are reinforced, modified or changed depending upon the

consequences of their personal social behaviours. In this context consequences
arise from interactions with peers and authority figures. If behaviours are
misaligned with the group’s ‘cultural’ norms, the consequences to individuals
may be unwelcome and unpleasant. Within an established culture behavioural
consequences for an individual can be delivered by peers, parents, teachers, a
management hierarchy, a professional society, a government body or ultimately
through a society’s legal code. With adverse consequences, belief change may
be necessary to modify behaviours.
Safety Culture
The converse is true. There can be supportive behavioural consequences,

welcomed by the individual and giving positive belief reinforcement.
A society’s beliefs and behavioural norms historically deliver societal

‘success’ and in the interests of continuity, the norms are enforced by the
group. Understanding and conforming to a society’s accumulated beliefs and
behavioural expectations assists individuals in achieving their goal of ‘survival’
within a group environment. Since group membership has ‘survival’ advantages,
understanding social beliefs and expectations is in an individual’s ‘self interest’.
Within a social group individuals usually maintain their group membership

by sharing common beliefs and aligning with the behavioural norms. If
delivering group success this commonality reinforces the faith in the group’s
beliefs, entrenches the behaviours and brings group culture stability. If, however,
the group behaviours fail to deliver success the beliefs and behaviours may
change.
Situations can arise where group peer pressure is imposed to modify an

individual’s beliefs. This may invoke superficial behaviour. The individual may
conform and reflect changed beliefs whilst their real beliefs remain hidden. If
real beliefs are hidden in possibly a hostile group environment, this can lead to
stress for the individual through internal self-conflict.
If organisational belief change is required individuals develop uncertainty,

confusion and perceived loss of control. Changing long-held beliefs can be
difficult, uncomfortable and is usually resisted. Because of this, organisational
change has to be sympathetically managed.
On occasions, however, safety-belief change needs to be rapid. If too slow,

an organisation may be overtaken by events rapidly deteriorate and go out of
business.
Shared safety-beliefs are fundamental to developing a ‘good’ organisational

safety-culture and it is in generating and embedding beliefs where
management’s influence is most valuable. Since organisations have different
business objectives, have variable management skills and different levels of
safety commitment, beliefs can vary. As previously noted they can extend from
the sound belief that ‘safety will be the organisation’s number one priority’
to a less viable belief that the organisation needs only ‘to just comply with
safety law and no more’. In either case an important feature is that the adopted
safety-beliefs arise at the hierarchy’s highest level, are learnt, impressed upon
the staff and become shared. From these adopted beliefs arise the behaviours
that may enhance organisational safety or, if the beliefs are inappropriate, be
detrimental.
Evidence indicates that the effectiveness of an organisational culture and

its contribution to safety risk minimisation is dependent upon the senior
management’s commitment to organisational safety as a business risk and
encouraging ‘good’ shared safety-beliefs. Senior managers are the organisation’s
safety-culture custodians and shapers.
As an example of management’s role consider a conceptual group of senior

managers accountable for a hazardous industrial chemical complex. Assume their
current safety-belief is one of having minimal compliance with safety law whilst
emphasising the business belief that high chemical production output is the
priority. The success of this strategy is reinforced by the organisation having had
no recent significant safety losses or any regulatory interventions. These ‘positive’
consequences give belief stability that minimal compliance achieves business
success whilst demonstrating management control. The belief in minimalist
compliance is then impressed on the organisation through the senior team’s
spoken values, attitudes, a limited interest in safety issues and possibly minimalist
safety documentation. These behaviours strongly align with the belief.
The belief of a minimalist approach to safety may be incorrect and suggests

the management’s approach to business risks generally could be inappropriate.
There may be insufficient scrutiny of the plant such that with the passing of
time its true safety and technical condition becomes hidden. However, as far
as the management are concerned, everything is fine and their safety-beliefs
become ‘the truth as they see it’.
Through their beliefs the management may have created a climate of limited
care towards staff safety. Many industrial examples can be given. Because of
the belief that safety-performance will be adequate with just legal compliance,
managers begin to pay scant attention to operational safety and overtly focus
on production. In such a postulated situation if management’s organisational
safety-beliefs are not supporting good safety, a condition can arise where the
management’s perception of the safety status of the plant becomes misaligned
with that of the workforce. The workforce is fully aware of the plant’s hazardous
chemicals and places top priority on safety. In this scenario the workforce safety-
beliefs are not aligned with the management’s beliefs. Productivity is essential
10 Safety Culture
but secondary. For the workforce the priority given to chemical handling safety
has become entrenched possibly by experiencing first-hand the consequences
of mismanaging the hazard. In their own self-interest the workforce may have
established ad hoc safety-behaviours for handling the chemical plant. These
become learnt behaviours and possibly independent of any organisational
management system. The behaviours, good or poor, are adopted for ‘survival’
and passed down to each workforce generation. The workforce acts as a sub-
culture. Perversely, the sense of self-preservation and the sub-culture’s imposed
safety rules may be all that keeps the business from a major event.
In this mismanaged environment, an individual’s beliefs may come under

pressure. They may consider it against their self-interest to espouse safety
concerns to peers or seniors. If they do it may be interpreted as having the
potential to interfere with the business priority – production. The behaviour of
questioning or challenging may not be welcomed and possibly result in negative
individual consequences. In this arena it is advantageous for an individual to
follow the management’s safety-beliefs, avoiding a challenge and any adverse
consequences.
In an established organisation the management’s production first belief

may be organisationally shared and a staff norm. For example, bonuses may
be attached to production targets and be an important income supplement. If
an individual’s safety concerns are misaligned with the group’s norms, peer
pressure can be bought to bear. This atmosphere may establish ‘fear culture’.
Here an individual’s true safety-beliefs may remain hidden and because of the
self-interest of remaining in the group, an individual may continue to adopt
the group’s poor safety-beliefs, attitudes and behaviours. This is symptomatic
of the failure of dialogue and communications. With openness inhibited the
opportunities for management to receive real plant-safety information are
reduced. Workforce input to safety discussions is not encouraged and diverse
safety views fail to emerge. A ‘plant is safe’ consensus can emerge reinforcing
the management’s belief that process safety and performance are adequate. The
adopted management beliefs and minimalist safety strategy appear to be sound.
Most will recognise a ‘fear culture’ and the following are possible
consequences from adopting a questioning and challenging behaviour within
such a culture:
• Appearing to be stupid/silly
• Appearing to lack knowledge

ORGANISATIONal SAFETY-CULTURE THEORY 11
• Seemingly incompetent or unprofessional
• Considering others are far more knowledgeable and experienced
• Being seen as weak at a moment of decision
• Letting the team or side down, not being ‘on board’
• Being possibly seen as purposefully obstructive
• The cause of schedule delay or possibly adding cost
• Afraid of losing one’s job
• Afraid of a manager’s personality or authority
• Actually having little faith in one’s assessment of a safety issue
• The ‘new boy’, best to be ‘seen and not heard’
• A fear of not being ‘liked’ or ‘accepted’ by the group.
All these issues are natural human frailties. However, if ‘fear’ exists,
matters of safety importance in facility design, build or operation may pass
unchallenged or be suppressed.
In this hazardous chemical-plant scenario the senior team’s poor safety-

beliefs have had a significant effect on people’s safety-behaviours and the
shaping of the safety-culture. Matters not being discussed openly or a fear
culture existing can lead to a behaviour of hiding degraded safety conditions.
This and the stability of the management’s poor safety-beliefs can suggest a
significant deterioration in risk management.
The converse of this scenario is true. Here there would be a strong senior
management commitment to integrate safety into all business activities.
Through the business strategy and documented processes the senior team focus
on the fundamental belief in the importance of operational safety as a business
risk to be managed. Emerging from this safety-belief will be observable good
safety-behaviours, safety attitudes and an overt commitment by managers to
an open culture. This scenario is a frequently observed good practice in high-
12 Safety Culture
hazard industries and contributes profoundly to such industries being low-risk

enterprises.
Because human performance arises from learnt beliefs, a good safety-culture

cannot simply emerge and be self-sustaining. It has to be encouraged by senior
managers, then sustained with peer discipline and overt management safety
behaviour leadership. The alternative will be an organisation liable to pockets
of safety excellence and areas of safety chaos.
If an organisation is failing to achieve good safety-culture expectations,

a fundamental safety-belief change at senior management level is usually
required. This is then cascaded down the organisation. Any currently held
management beliefs will be stable and change at this level can be threatening,
destabilising and bring uncertainty to senior management. This is perhaps
particularly so for a management where old certainties bring control and
predictability. Bringing about such change takes time, anything up to a year
or more.
On the other hand, although initially threatening an enhanced safety-

culture can give many long term business benefits. If senior management
adopt a strong belief that safety is a business priority organisational safety-
behaviours will usually be good. In addition, the associated business rewards
are, inter alia, low injury statistics, a committed management, high morale and
a commercially effective workforce.
Developing a good safety-culture has wide business benefits. Research

reveals that a good safety-culture is more that just the sum of individuals’
safety-behaviours but that it has an intangible attribute. There is a noticeably
cohesive organisational business ‘spirit’ that develops from safety-behaviours
being integrated into all work activities. As important is the noticeable transfer
to other functions of safety-management system principles giving an integrated
approach to business. The belief in the business importance of safety has at this
stage embedded itself as a part of the organisation’s spirit and identity.
Espoused Values
Previously it was suggested that there is linkage between shared organisational

safety-beliefs and how these beliefs are revealed in observable safety-
behaviours. This linkage is achieved through the elements, espoused safety
values, attitudes and visible artefacts. The organisational strength of these

elements can be indicative of strong shared safety-beliefs.
Espoused or spoken safety values are central principles held by the

organisation’s members and around which decisions are made, tested and actions
occur. Managers and workforce place importance on them as preferred desirable
conditions that assist in fulfilling beliefs. Values enable an organisation’s shared
safety-beliefs to be upheld. For example, if the belief ‘safety is our top priority’
is a conviction this leads to supporting safety values that enable the belief to be
fulfilled. Values gain particular strength when espoused and practiced by the
senior managers within their role of culture shaping.
Safety values are spoken but they can also appear in documents, an intranet
or posted around a facility. In this way they become embedded organisational
artefacts. Safety values like beliefs need to be specifically generated, owned
and shared by an organisation. Developed with senior management, this is an
important cross-organisational activity in which most employees can engage.
The beliefs and values, as an integral part of a management system, would
be periodically reviewed and rejuvenated to meet the changing needs of the
business.
Although values are specific to meet an organisation’s safety needs, the

following are some examples:
We value:
• Our individual attention to safety is a condition of employment
• That everyone is responsible for safety, our own, others’ safety and
the protection of the facility
• That respect is given to all safety views as everyone has the right to
question and report safety issues
• People’s interventions to ensure all potential health and safety

incidents are prevented
• Everyone has the right to challenge on safety issues
• That the organisation strives for an open dialogue culture

14 Safety Culture
• That teamwork to resolve safety matters is strongly supported
• That all events and near misses are reported as we recognise that
even minor injuries or events are important
• Thorough safety training and competence as essential for safe

working
• That we regularly check and report our safety-performance.
These values are considered further in Chapter 3 of the text.
It is noted that the values are typically associated with actions enabling
safety-belief fulfilment and, inter alia, will develop into expected organisational
human performance behaviours.
Shared values that are frequently espoused by management and reinforced

through supporting good safety-behaviour norms will eventually become
engrained within a business. To achieve a stable safety-culture a challenge
for managers is to ensure that, once established, safety values, like beliefs, are
owned, periodically refreshed and regularly communicated.
An issue for the workforce is the interpretation of managers’ espoused values.

On occasions managers’ spoken values can be misleading if the subsequently
observed safety-behaviours are misaligned. For example, if ‘team working’ is an
espoused value yet receives no management recognition or acknowledgement
then a contradiction arises. For the employees the observation is ‘what is said’,
not ‘what is done’. A behaviour that fails to align with the stated safety value
degrades the efficacy of the value.
When stated, values may lead an observer into misunderstanding the real
safety-beliefs and hence the true organisational culture status. Values need to
be analysed with caution and set in the context of the observed employee
behaviours. If there is misalignment between behaviours and the stated
values this may indicate that the deep-seated safety-beliefs are not shared
or fully supported within an organisation. Here, values may be espoused for
a purpose other than a true demonstration of organisational commitment
to safety. They may be to appease a regulator, the public or possibly the
workforce.
The converse is true. Good, shared, owned and understood safety values
will contribute to good safety-behaviours and provide business benefit.
Attitudes
Attitudes can be considered as a state of mind towards a subject or an object.

For example, consider a maintenance team that experiences no negative
feedback from gaining a personal or collective advantage from poor safety-
behaviours. These may be rushing tasks to save time by taking procedural
short-cuts or using unapproved equipment to do the task. With no negative
feedback it may become an embedded team belief, a state of mind, that the
adopted behaviours are condoned by supervisors and managers. No feedback
becomes positive feedback for belief reinforcement leading to a less than
diligent attitude towards maintenance tasks. This lack of diligence, a careless
attitude, can become an accepted group norm and ignoring procedures or
using inappropriate equipment can become an unchallenged part of the team’s
cultural behaviour. This poor behaviour can, if not arrested, pass to new
generations of maintenance workers.
For designers and in operations appropriate safety attitudes are an

important safety-culture element that needs to be trained at all organisational
hierarchy levels. If inappropriate group or individual attitudes occur they are
immediately obvious to other staff members and in a good safety-culture the
attitudes will be challenged.
Some unsafe attitudes that can develop are:
• Past personal performance justifies current and future

performance
• Heroics
• Invulnerability
• The best in the field, we have nothing to learn – arrogance
• Look after ‘our’ group not the organisation
• Eleventh-hour excitement (lose safety focus and become careless

close to task closure)
16 Safety Culture
• Love a crisis; ‘fire-fighting brings out the best in people’
• The facility is inherently – safe nothing can go wrong
• The engineering and systems will always protect us
• Lack of safety unease
• Financial decisions affect only the balance sheet, not safety
• Organisational structural changes have no effect on safety; they just

improve efficiency and competitiveness
• Procedures can occasionally be ignored.
Some attitudes that can contribute to good safe behaviours:
• Safety questioning
• Safety challenging
• Conservative safety attitude to resolving problems
• Unease about safety
• Mindfulness, continual vigilance at all times to identify deviation

from normal operations or practice
• Supportive of team problem-solving
• A concerned attitude for one’s personal and others safety
• A ‘nothing is routine’ on a high-hazard facility
• We can always learn and improve – humility
• There are inherently safe features, not inherently safe plant
• The engineered systems as safety defences are only as good as the

people nurturing them
• Systems can and will degrade
• Cooperative attitude – dialogue culture
• Supportive attitude towards individual team members – dialogue

culture
• Readily open to discuss our safety problems to seek resolution –

dialogue culture.
• For hazardous industries positive attitude expectations are required

to be communicated as a frequent daily diet.
New people, particular young employees, wishing to be accepted by a

group, will quickly adopt the group’s attitudes. This makes them particularly
vulnerable to accidents if individual or group attitudes are misaligned with
good practice. Further, ‘measuring or testing’ attitudes requires to be treated
with caution. Observed attitudes may not be a true reflection of how a
person really feels; true beliefs may be hidden particularly if a ‘fear culture’
has developed. Here, if challenged or questioned on safety, an individual or
group may adopted the ‘expected attitude’ in support of their immediate self-
interest.
Artefacts
The robustness of an organisation’s safety-culture can be indicated by the

presence or absence of artefacts. These contribute to establishing a safety climate
as a reminder to all staff of their shared safety-beliefs, values and behaviours.
Whereas safety-behaviours are considered to be the informal dimension of

safety-culture, artefacts can be the formal, documented and physical reminders
dimension. Artefacts can include aspects of the informal dimension such as
organisational safety activities and rituals. A significant formal artefact is an
organisation’s documented safety-management system with its safety policy
and supporting procedures. This is normally integrated into the business
quality management system.
Artefacts are typically symbols of an organisation’s identity. Some formal

and informal examples are given.
18 Safety Culture
Formal artefacts:
• The organisation’s environment, health and safety mission and

policy statement
• The safety-management system, corporate procedures and

processes
• Safety progress reports and programmes
• Plant design safety cases
• Public, annual safety reports
• Safety guidance pocket books
• Safety posters in the plant
• The company logo
• The company flag
• The safety news bulletin
• Results of questionnaires on safety-culture climate
• Safety awards
• The quality and standardised work attire
• Collated safety-performance data.
Informal artefacts:
• The technical jargon used by an organisation
• Corporate stories about which the organisation has pride
• Company rituals – safety schemes, the annual safety conference

• Partitioned walls and private offices (may show the importance

placed on status and hierarchy that may hinder dialogue)
• Reserved car parking (suggesting the importance of status and

hierarchy)
• People’s posted photographs showing safety merit or achievement
• A well-maintained safety wall board; statistics, posted achievements,

conferences, lectures
• A computer-based safety-culture intranet.
Artefacts can generate pride and give a visual association with the
organisation’s values. As can be regularly seen with familiar brand names, there
is a psychological power in symbols. They assist in developing organisational
‘team spirit’ and group cohesion.
Some everyday examples of artefacts are given in Figures 1.3 and 1.4.
In Figure 1.3, the artefacts are the people’s uniform, the lines of soldiers and
the weapons. These give clarity that there is a cohesive ‘team’. The artefacts also
demonstrate purpose, tradition and learnt common beliefs; they are military.
The uniforms and the ordered ritual suggest a disciplined organisation. To
achieve this, the artefacts reflect a command and control management regime
with a rigid culture of compliance. By adopting a particular command culture
and being a cohesive and obedient body the group appears successful.
In this example the observation of the artefacts suggests some preliminary

understanding of a group’s culture and a hint of the shared beliefs. Artefacts
can, however, mislead. The group may not be a military body but actors
on film location. Observing the artefacts out of context, in deciphering the
organisational safety-beliefs, would have been unhelpful in this case.
An industrial parallel could be an organisation’s safety-management

system. As an important artefact such a system documents the processes
and mandatory procedures required to safely operate high-hazard plants.
Although the system may exist, meets all expectations and is available, it may
not be owned by the senior team, used or kept up to date. A belief structure
could exist where business risk management excludes safety as a priority. An
20 Safety Culture
outcome of this could be plant that is operated, not by complying with the
management system, but by ad hoc local rules, through custom and practice
and with a minimal investment in safety requirements. The artefact suggests
a strong commitment to safety. However, in this case it is a misleading safety-
culture element that is not used as a management tool for lowering safety
risks but produced for other reasons; possibly to pacify legal or regulatory
requirements.
Figure 1.3 A military parade
The flag, Figure 1.4, is readily recognised and is an artefact representing

an ‘organisation’, in this case the United Kingdom. The flag gives identity and
because of the shared national experiences ‘under the flag’ it visually represents
the nation’s values and beliefs.
Figure 1.4 The Union Jack

When a national leader is espousing values and beliefs the address is

normally against the backdrop of the national flag, subliminally reinforcing
the national culture. The relationship between the espoused values, the leader’s
beliefs, the country’s beliefs and the artefact, becomes visually dominant.
Figures 1.5 shows a specific recognisable artefact that is identified with

a particular profession. When seen, it suggests the profession’s purpose and
values.
Figure 1. 5 A barrister’s court wig
Figure 1.6 shows formal documented artefacts that support safety-culture.

Personal protective equipment, its quality and associated procedures are
examples of readily recognised safety artefacts.
Figure 1.6 Documents and equipment – artefacts

22 Safety Culture
Some artefacts are particularly difficult to observe. For example, people’s

corporate knowledge, the ‘war stories’ of safety experiences, are artefacts.
These shared experiences, which are safety lessons to be learnt, are difficult to
capture and can soon be lost.
Apart from an organisation’s safety-management system, artefacts

generally are a low-cost investment and relatively easy to maintain. If there
are only a few artefacts, safety-management becomes difficult as there will be
limited documentation to guide, nourish and support the culture. Artefacts
can be one indicator of a good organisational culture but can occasionally
give misleading signals on culture status. As noted, an organisation can
have excellent documented procedures that are not actually applied. Here
the safety-management system is not owned by the organisation and if not a
valued business artefact it fails as a demonstration of commitment to public
and workforce safety. A paucity of safety artefacts may be indicative of an
organisation’s limited belief in the importance of safety.
Behaviours
By establishing good safety-beliefs, safety-management becomes a matter of

influencing and directing good safety-behaviours. These are the most visible
expression of safety-culture.
Culture has generally been described as deep, broad, and stable. Also, having
a large psychological and social element it is not a superficial phenomenon.
Further, culture stability infers development over time, with its robustness
tested against many internal and external factors. Because of this, detailed
behaviours at each hierarchical level in an organisation cannot be generically
prescribed as they emerge from the shared beliefs, become tacit rules and lead
to good safety behavioural awareness. Detailed behavioural sets emerge from
within an organisation on a platform of safety-beliefs that meet the business
needs.
Chapter 3 develops the concept of expected role behaviour, but only

within the framework of a safety-culture review process example. They are
not prescriptive or universal; for example, safety-behaviours for designers will
not be the same as for plant operators, although there will be some common
elements. To present generic safety role-behaviours can only be guidance.
However, experience suggests that there are some overarching common
behaviours at various hierarchical levels that assist in promoting good
safety-culture. These generate further supporting detailed behavioural

subsets which when shared within an organisation form an integrated safety
awareness. It is emphasised the overarching behaviours noted are samples
and organisations need to generate, encourage and implement their required
safety-behavioural expectations.
Executives and senior managers:
• Give visible leadership and commitment to safety
• Communicate, espouse and implement agreed organisational

safety-beliefs and values within a dialogue culture
• Challenge and question on safety issues at all times
• Have a positive attitude to safety
• Exercise a transformational and mentoring management style
• Actively delegate safety responsibility within their framework of

safety accountability
• Generate trust and openness
• Personally commit to and exercise good (physical) safety-

behaviours.
Middle managers:
• Give visible leadership and commitment to safety

safety-beliefs and values within a dialogue culture
• Challenge and question on safety issues at all times
• Have a positive attitude to safety
• Are periodically actively engaged in facility safety interactions

24 Safety Culture
• Demonstrate safety is a business priority in operations
• Actively generate trust and openness within facilities
• Have a humanistic management practice
• Personally commit to and exercise good (physical) safety-

behaviours.
Supervisors:
• Demonstrate safety leadership
• Have a positive attitude to safety issues at all times
• Challenge and question on safety issues
• Support the teams’ safety decisions
• Motivate teams for safety improvements
• Develop trust within teams

safety-beliefs and values
• Promote an open safety dialogue culture
• Promote a learning culture
• Be seen to personally display good (physical) safety-behaviours.
Workforce:
• Are actively involved in safety initiatives
• Demonstrate autonomy through questioning and challenging on

safety issues
• Show risk perception and risk aversion with safety demonstrably

the first priority
• Actively promote a cohesive team spirit
• Self-motivated to be compliant with systems

safety-beliefs and values.
There are two essential factors that are fundamental to safety behaviour
implementation. First, antecedents have to be in place to enable individuals to
implement agreed role safety-behaviours and second, there has to be feedback
regarding the adequacy of implementation. These two factors can on occasions
be neglected and safety-beliefs remain unfulfilled and safety values not upheld.
An antecedent is an event or circumstance that exists before another event or

behaviour occurs. An example is where a driver sees a vehicle speed restriction
sign. The sign, the antecedent, triggers the reducing speed behaviour. Whether
the antecedent is acted upon and the appropriate behaviour adopted usually
depends upon the driver’s belief system. If compliance has become a deep-
seated belief the behaviour will be automatic. Antecedents are conditions that
act as enablers, providing the opportunities for agreed behaviours to occur.
As an operational example, consider a situation that whenever events are

reported to the ‘new’ supervisor the consequences to the worker are blame
and discipline. The antecedent now influencing the reporting behaviour is
the changed management climate. This climate may bring about an undesired
behaviour of not reporting events. The consequences for the worker are positive,
immediate and welcomed. The worker is not blamed. However, the antecedent
and the positive consequences are not supportive of a good safety-culture.
Progressive degradation of the plant, the physical processes or obsolete safety
procedures may occur.
Antecedents and consequences to achieve good safety-behaviours are a

managerial accountability and require discussion, training, understanding and
agreement. They are the bridge between the philosophy of safety-beliefs and the
manifestation of the beliefs as human performance. Antecedents and consequences
are a management tool that influences the quality of human performance and the
organisational commitment needed to drive a good culture.
During informal management or peer observations, if agreed safety-

behaviours are being applied then the positive feedback of praise and
26 Safety Culture
appreciation needs to be given. Such feedback can be manager-to-worker, peer-

to-peer or in an open culture, worker-to-manager. When feedback is purposeful,
frequent and welcomed by the individual this promotes a reinforcing climate.
If an individual’s safety-behaviours are not as expected, then adverse

corrective feedback is required. This needs to be immediate, purposeful and
frequent. Delivered in a constructive mentoring style and with skill, feedback
should focus on supporting individuals to learn from errors and enhance future
safety-performance.
Mentoring feedback given immediately has a more positive impact than

feedback left until sometime later. Feedback, if delivered skilfully at the moment
of observation, reinforces safety-beliefs and values and is more influential when
given to individuals.
In the speeding example, if the sign had a speed camera attached the
consequences for inappropriate behaviour could be early, certain and most
unwelcome. The camera suggests modified behaviour is important to the
local community who value enforcing reduced speed in the interests of safety.
Conversely with no camera present the consequences to a driver of failing to
comply become uncertain and distant. As there are essentially no consequences,
the sign – the antecedent – will be regularly ignored if safety is not a driver’s
priority.
In an operational environment, when consequence feedback is delivered

from the authority of the management structure, it helps shape the culture.
With these interventions, managers are seen to be purposefully supporting the
organisationally agreed values and safety-beliefs.
If adverse consequence feedback is given this should not lead to conflict.

Feedback needs to be immediate, delivered well and in a cooperative spirit. In
a good culture the individuals are trained to receive comment on misalignment
and through training be aware of the expected safety-behaviours. If handled
with good interpersonal skills, feedback will be recognised by all parties as a
helpful learning opportunity.
Non-aligned behaviour may not necessarily be within the control of the

individual. If deviations are identified appropriate action to eliminate the root
cause is required. This cause may lie with training, poor equipment or lack
of management diligence. As a culture matures, effective feedback dialogue

should reveal such weaknesses and promote continuous improvement.
It is not necessarily workforce members who deviate from agreed safety-

behaviours. Supervisors, managers, senior managers and executives can
deviate from their agreed role behaviours. With such events open mindedness
to receive constructive feedback is required. If, however, the hierarchy levels
are not open to mentoring from seniors, peers or subordinates then there is a
fundamental difficulty within the culture. If not addressed, it will inhibit the
effectiveness of a dialogue culture.
If non-positive feedback leads to disruptive conflict this is a safety-culture

learning opportunity in itself, requiring ‘time out’ to seek and eliminate the
root cause.
Giving or receiving behavioural feedback can be an emotional experience.

To deliver feedback requires the embedding of appropriate interpersonal skills
at all levels. In particular, skill is required for people to be able both deliver and
receive feedback.
An example of the importance of antecedents and consequences on safety-

behaviours is given in Tables 1.1 (a)/(b). Here, a need has been identified
by a senior management team to encourage middle managers ‘to do safety
behavioural observations within operational plant’. The observations are to
become integrated into the middle managers’ role and the observations of staff
behaviours can be made at any hierarchical level.
It is postulated that a change in middle managers’ behaviours is required

to support the organisational belief that ‘safety is the top priority’. In addition
it has been agreed with the middle managers that more on plant visits will
enhance safety dialogue at various levels of employees. This will be an
opportunity to continue to promote the safety values and contribute to fulfilling
the organisational safety-belief.
The senior managers are taking action to change middle managers’ current
poor safety behaviour of ‘avoiding behavioural observations’ to the positive
safety behaviour of ‘carrying out regular observations across a sample of all
employees’.
28 Safety Culture
Table 1.1(a) Antecedents and consequences – current behaviour,

middle managers do not frequently carry out behavioural
observations across a sample of all employees
Current behaviour Antecedents Consequences

Managers do not carry out a. Managers are not monitored a. Managers can avoid
safety behavioural observations by senior managers to deliver taking the time out to
and discuss safety across a observations carry out observation – an
sample of employees b. There are no negative early, welcomed, positive,
consequences from senior consequence
Note: The antecedents and managers for continuing the b. Can stay in the office and do
consequences columns can be current behaviour more ‘important’ production
read separately c. Managers are unsure, or tasks – an early, welcomed,
uncomfortable with ‘one-to- positive, consequence
one’ discussions with various c. Senior managers are pleased
employee levels to see attention being given
d. Managers are not trained in to production issues – an
observation techniques early, welcomed, positive,
e. Managers have no time to consequence
carryout observations, they are d. Always around (not on
‘too busy’ on other tasks plant) when a senior manager
f. Managers anticipate that needs comment or advice
all behavioural safety matters – an early, welcomed positive,
affecting employees are dealt consequence
with by the employees line e. The middle managers are
management seen by others to be avoiding
their safety responsibilities
– this is a distant, negative
consequence, but possibly an
accepted norm by all managers
(and other employees)
f. Middle managers, because
of the pressure of other tasks
from senior managers, have no
time to meet other employees
and do safety observations– an
early, welcomed, positive,
consequence
g. Managers receive no feed
back on safety from other
employees; receive no safety
actions to address or matters to
follow up – an early, welcomed,
positive, consequences
h. Managers are perceived
by other employees as not
committed to safety – a
distant negative consequence,
However, failure of middle
managers to do observation is
possibly an accepted norm
Table 1.1 (b) Antecedents and consequences – changed behaviour,

middle managers frequently carry out safety behavioural
observations across a sample of all employees
Behaviour change required Revised antecedents Revised consequences

Managers frequently carry out a. Senior managers establish a a. Managers cannot avoid any
safety behavioural observations schedule of safety observations negative safety feedback from
across a sample of all to be implemented by their line the employees – a ‘long-term,’
employees and engage in safety middle-managers positive, consequence but a
dialogue b. Senior managers positively short-term, early and negative
monitors the observation consequence
Note: Antecedents column schedule for compliance b. Senior managers give
and consequences can be read c. The schedule is physically positive feedback to individual
separately displayed in the workplace managers for implementing
d. The requirement for the observation schedule – an
managers to do observations is early, positive consequence
within their job description c. Managers will be perceived
e. Time to do the task is by staff as committed to
allocated for middle managers safety – an early, positive
by the senior managers consequence
f. The importance to the d. Individual managers not
business and culture of seen to be downloading safety
observations is within the responsibilities-an early,
managers training portfolio positive consequence
and the value is frequently e. Time purposefully made
espoused by the senior line in the manager’s diary to do
managers observations and to meet
g. Managers receive employees to discuss safety
interpersonal, soft-skill training. – an early, welcomed, positive
h. The completion of the consequence
behavioural observational f. Positive peer comment
schedule is an aspect of a if observations take place
middle manager’s annual –an early, welcomed, positive
performance review consequence
i. Feedback from observations g Demonstrates personal
with safety issues or concerns achievement through
is to be documented and completing the schedule
discussed at the senior – positive consequence
managers’ meetings h. Assist other senior
j. To assist the middle managers/ middle managers /
managers, a system is in place supervisors in identifying safety
to deal with any employee issues – an early and positive
safety issues raised with them consequence
during the observations j. Completed safety
k. There is some group observations, contributes
peer pressure, collective to each middle manager’s
responsibility, to carry though annual career review – positive
the schedule consequence (when completed
to the satisfaction of the senior
line manager)
30 Safety Culture
In Table 1.1(a) the current consequences of avoiding visiting the plant arise
early and are not distant. The consequences of this inaction are welcomed by
the middle managers. Because the current antecedents are not enablers and
the visit-avoidance consequences are broadly beneficial, both these factors
contribute to ensuring that the middle managers stay off the plant; the middle
managers avoid doing observations.
Any proposed change in middle managers’ behaviours will bring them

uncertainty and the change may possibly be resisted. A senior management
accountability is the setting, discussing and agreeing the behavioural
antecedents and consequences. Once agreed, effective antecedents will reduce
managers’ uncertainty, address resistance motivators and promote behavioural
change.
Table 1.1(b) is for the same scenario but presents the senior managers’
agreed antecedents and the consequences to bring behavioural change.
That is, a change to where middle managers ‘frequently carrying out safety
behavioural observations’. To change behaviours the middle managers need
senior management leadership through upholding the antecedents and
consequences.
In Table 1.1(b), the senior managers have assessed the original antecedents
and consequences of Table 1.1(a), and changed them quite distinctly. Through
this revision the middle manager is now enabled to carry out the changed
behavioural expectation.
The consequences, Table 1.1(b), for engaging in observations are positive,

early and certain. If the middle manager does not fulfil the observations
task the consequences have now changed from early, positive and certain to
being ‘early, negative, and certain’. This assumes the senior line managers are
diligently delivering consequences where appropriate.
Table 1.1(b) could imply that there is an element of pressure from senior
managers on middle managers. This will not be the case. The proposed change
strategy and the change method will have been agreed such that:
• The importance of safety behavioural observations and safety

dialogue will be agreed with middle managers
• Senior managers show leadership, commitment and support to

assist the middle managers make the change
• Middle managers and as necessary senior management are given

training in soft-skills interactions
• Managers receive safety observations training
• Senior managers ensure defined working time is made available

for middle managers to do on plant observations and the task is not
down-graded to being ‘an extra’
• Senior managers agree to provide positive feedback for the middle

managers early and often
• Corrective mentoring feedback from peers and senior line manager

is agreed by middle managers.
With the antecedents and consequences in place the desire to do safety

observations should become a valued activity.
If the changed behaviours remain in place and middle managers regularly

engage in plant safety observations there will have been a profound culture
change. Frequent observations and dialogue will have become a good safety-
behavioural norm. It may now appear unusual behaviour if managers are not
frequently seen on plant.
In the industrial environment most actions assigned by managers succeed.

The antecedent enablers and consequences are in place. There are occasions,
however, when the antecedents are not correct or not in place. This can lead
to tasks not being fulfilled, poor-quality product, stress on the individual and
conflict between the worker and managers.
It is suggested that incorrect antecedents and consequences that are

contrary to good safety-beliefs reinforce poor safety-behaviours. Chapter 2
indicates several events where managers agreed to the use of unapproved
procedures for operating parts of hazardous processes. Here additional
antecedents took precedence over those placed for good safety human
performance. These were, for example, production pressures, implementing
unapproved procedures and the interference with safety systems that gained
the tacit agreement of managers. The consequences to individuals of the
resulting poor safety-behaviours were early, positive and welcomed. That is
they could deliver high production.
32 Safety Culture
Some of the antecedents directly encouraged behaviours detrimental to the

operators’ safety. Challenge to the antecedents was probably not welcomed as
this may have interfered with the production schedule. The consequence to a
challenger may have been early, negative and not welcomed. In one event the
behaviours adopted were fatal for several workers and were within seconds of
being fatal in another event.
Safety-Culture Elements Overview
To give an overview of the linkage between the safety-culture elements of safety-

beliefs, values, attitudes artefacts and behaviours a hypothetical example may
be helpful.
A senior manager who believes in a primary commitment to safety and

regularly espouses this belief is taken as the example. Through observation of
the manager’s safety-behaviours and attitude consideration can be given as to
demonstrate whether safety is a deep-seated belief.
The senior manger’s behaviours could be:
• Safety matters are always placed on the manager’s meeting agenda;

a behavioural action
• Safety is the first item on the agenda and receives as much attention
as other business agenda items
• The manager actively engages in the annual formal review of the

safety-management system
• The senior manager is regularly engaged in safety audits, safety

reviews, behavioural observations and plant walkabouts, discusses
directly with his managers, supervisors and workforce the safety
issues of tasks in hand.
The manager’s general attitude may be one of:
• Genuine interest and concern for individual’s safety, displayed

through the manager’s body-language and comments in
discussions
• Carefully applies status and hierarchy to mentor, lead and guide if

falling plant safety-standards are observed
• Has a cooperative, inviting and open attitude at meetings promoting

safety discussion and challenge
• Accepts with grace and welcomes personal challenges on safety

issues or behaviours
• A genuine sense of urgency and action displayed in addressing

identified safety hazards
• Ready to apply a questioning attitude towards the status quo on

process and personal safety
• A charismatic leader.
These behaviours and attitudes appear to an observer as consistent with the

manager’s espoused safety values. The senior manager’s attitudes supported
by his human performance probably reflect a true belief in the importance of
safety.
There can be alternative, less enlightened scenarios. For example, procedures

may be in place to ensure a tested approach is used for hazard identification
in design or plant operation. The espoused value is ‘that procedures will
always be complied with’. Under real schedule pressures managers may,
however, abandon the procedure and make personal judgements with regards
to what they believe are significant hazards. This condoned non-compliance
will be observed by others. This is a signal to all of an environment with no
consequences for procedure violation. This behaviour is misaligned with the
belief in ‘safety as a priority’ and the value ‘procedures will always be complied
with’. Trust within the organisation is now under threat as ‘what is said’ is not
‘what is done’.
Many examples have arisen, in design, operational tasks and maintenance

activities, of condoned procedure violation behaviour (see Chapter 2). If
it occurs and conformance discipline is not reasserted by managers or peer
pressure, non-compliance can become an accepted cultural norm. Permitted
degradation has caused many fatalities, personnel injury with severe financial
implications. On occasions there have been billion-dollar losses. The numerous
34 Safety Culture
examples available indicate that irrespective of the integrity and quality of the
engineering or procedural protective systems, they are only as effective as the
people ‘minding’ them.
For high-hazard facilities, when condoning the by-passing of formalised

safety procedures, the management and the workforce are gambling. They
abandon any espoused organisational safety values. Time and schedule have
taken precedence, with managers now taking the risk that their intuitive
knowledge of hazard assessment is as good as the collective team-knowledge
originally required to produce the safe working procedure. The manager’s
judgement is that the possibility is small of his underestimating the hazard
consequences. On many occasion the judgement is correct and this reinforces
the belief in the acceptability of non-compliance. However, if the culture is
not strong enough to challenge a lack of compliance, today’s breach becomes
tomorrow’s accepted working norm.
Research shows that individuals are generally quite poor at estimating risk
with a tendency to underestimate. On a hazardous facility if non-compliance
persists, serious incidents will occur at an unacceptable frequency.
The Integrated Safety-Culture Paradigm
There were caveats placed on the concept of the layered generic model due
to the socio-technical complexity of culture. However, the generic nature
raises opportunities for how a safety-culture can be observed, ‘measured’ or
reviewed. Originating from Edgar Schein’s business culture studies, a strength
of the model is in the universality of the elements of beliefs, values, artefacts,
attitudes and the shaped behaviours. It is suggested that for most cultures – for
example, political, religious, tribal or company – some or all of the elements
will be identifiable. These culture elements emerge consistently as essential
vehicles to achieve a compelling visions, organisational goals and business
success.
It is evident that not all cultures are the same and are observably different
even though they have the generic model elements. Culture differences emerge
because different social or industrial grouping develop distinctive characteristics
and whose attributes demand certain behaviours to fulfil the founding beliefs and
deliver business success. The characteristics, inter alia, tend to emerge subliminally
from the rationalising of how to effectively achieve goals. They are influenced
by and influence the generic element that act as the visible manifestations of
the organisation’s cultural characteristics. The presence of the organisational
characteristics and their attributes can be elicited from consideration of an
organisation’s generic elements. These elements act as the vehicles to display the
characteristics and hence the culture. Starting with shared beliefs, Figure 1.7
indicates the linkage. This concept forms an integrated safety-culture paradigm.
Subliminal or overt
Safety culture characteristics and

Unconsciously held attributes Visible deliverable
Shared safety Safety vision and

beliefs to deliver business-safety success
the safety vision
Elicited or Visible
Generic culture model elements a
-Values
Internal and External -Artefacts a: Safety beliefs may be
Influences -Attitudes documented as artefacts
- Behaviours (but not necessarily
upheld)
Figure 1.7 The integrated safety-culture paradigm

Source: Reproduced with the kind permission of the IAEA.
An organisation, through its characteristics and supporting attributes

establishes expectations of conduct which are codified in the visible generic
elements. The code is experienced by all through the expected organisational
behaviours required to deliver the business-safety success.
The development of organisational characteristics and supporting attributes

can be a long and iterative exercise as an organisation assesses various procedural
and behavioural strategies to efficiently achieve business goals. Organisational
characteristics emerge subliminally from this trial end error eventually
coalescing around an effective set. Research suggests that organisations with
similar business goals and a similar vision tend towards common culture
characteristics. For example, it would be expected that regulatory organisations
which have similar belief structures and goals would develop similar common
culture characteristics. These would manifest themselves in the generic culture
elements. Regulatory bodies tend to have a distinctive common ‘type’ of culture.
Similarly, commercially competitive airline companies have common culture
36 Safety Culture
characteristics as they are driven generally by the same business beliefs and
goals. These beliefs are, perhaps, maximising profits, customer care and public
safety, and so on. These common beliefs generate common delivery culture
characteristics. General experience suggests airlines broadly have the same
common culture ‘type’. Again, this will be visible or can be elicited through the
generic culture elements model. An airline culture due to its specific cultural
characteristics is quite distinctive from a regulatory culture. In both cases the
generic model elements will be in place – beliefs, values, artefacts and attitudes
– but the delivery of different beliefs for business ‘success’ generates dissimilar
culture characteristics. In addition, the resulting, inter alia, organisational staff
behaviours displayed will be culturally shaped and different. This will emerge
as an integrated safety-culture paradigm Figure 1.7.
Building upon this paradigm, it is suggested that for high-hazard industries

managing broadly similar safety risks, there is a common set of safety-culture
characteristics. These have been consistently elicited and observed in such
industries and are considered to be good practice expectations and predicate
good organisational safety-culture. There is broad consensus on the safety-
culture characteristics although there may be additions and some variations
presented from differing literature sources. Nevertheless, the broadly supported
core set are:
• Safety is a clearly recognised value
• Leadership for safety is clear
• Accountability for safety is clear
• Safety is integrated into all activities
• Safety is learning-driven.
(Text reproduced with the kind permission of the International Atomic Energy Agency)
Within a high-hazard organisation a robust safety-culture would have good

practice safety characteristics which would be explicit or could be elicited from
review of the generic elements; values, artefacts, attitudes and behaviours.
The safety characteristics and hence the safety-culture is under the influence
of various pressures over time. In a mature safety-culture that delivers for the
business safety success, the characteristics will however be stable and as noted
the generic elements will remain ‘universal’.
Because of the safety characteristic stability in high-hazard industry, the

suggested integrated safety-culture paradigm Figure 1.7 can be used as a
platform to review organisational culture. The presence of safety characteristics
can be elicited though the interrogations of generic elements values, artefacts,
attitudes and behaviours using a review process. If a viable culture exists,
each safety characteristic will be represented in all the generic elements. A
review will contribute to holistically defining the strengths and gaps in the
integrity of the characteristics and supporting attributes. With this analysis the
shared organisational safety-beliefs which generate the characteristics can be
determined, giving some insight into the status of the safety-culture.
The review concept, safety characteristics, supporting attributes and

expected behaviours are considered further in Chapter 3.
Summary
A culture generic model was introduced as a layered concept. Beliefs, it is

suggested, motivate behaviours, whilst the beliefs themselves remain hidden.
They can only be revealed through observation of people’s behaviours. The
bridge between the behaviours and the beliefs consists of supporting culture
elements and can be summarised as:
• Beliefs
• Espoused Values
• Attitudes
• Artefacts
• Behaviours.
A principle adopted from the generic model is that a safety-culture arises

from shared internalised beliefs about the importance of organisational safety.
It is suggested that safety-behaviours will reflect these shared safety-beliefs.
The model is introduced as being broadly generic to most cultures. The

factors that distinguish cultures are organisational cultural characteristics
and supporting attributes that reflect different beliefs, business visions and
38 Safety Culture
organisational goals. It is suggested, however, that organisations with common

goals coalesce towards common culture characteristics. For high-hazard
industries, it is suggested that a set of common characteristics are consistently
observed. These with associated attributes can be elicited from interrogation
of the generic model elements: values, artefacts, attitudes and behavioural
observations. The common safety-characteristics are good practice expectation
and the attributes supporting the characteristics would be expected to deliver
good practice staff behaviours. This structure is introduced as the integrated
safety-culture paradigm.
Safety-beliefs cannot be measured and may be hidden. To understand

beliefs they have to be systematically revealed by, inter alia, observing a variety
of behaviours and aligning those with good practice expectations associated
with the common characteristics. The safety-culture paradigm is a possible
route to review or ‘measure’ safety-beliefs and address the integrity of an
organisational safety-culture.
Research and experience shows that senior management shape a strong

organisational safety-culture. Senior managers cannot create a culture but can
provide the vision, discipline and personal example to promote a good safety-
culture. They can subliminally or overtly generate the culture characteristics,
supporting attributes and behaviours within the concept of an integrated safety-
culture paradigm. All organisations have a safety-culture. Whether the safety-
culture effectively delivers business safety success depends upon management
leadership.
In hazardous industries, safety is a major business risk that has to be

managed and achieving a strong culture has significant business benefits.
Starting from a poor culture, the journey may appear an expensive option but
the alternative can be severe business damage or, in the long term, no business
at all.
For a good safety-culture the whole organisation needs to be committed

to shared safety-beliefs, values and support good safety-culture behavioural
expectations. Naturally, all employees cannot be engaged. Some will remain
sceptical, some will engage then disengage. It would be naïve to suggest ‘all’
will be committed at all times. However, with senior management support,
a compelling safety-culture vision and the engagement of the majority, this
will be sufficient to enable cultural strength to develop and counter sceptical
forces.
2
Safety-Culture Theory as a
Predictive Model
Safety-Culture and Event Predictions
Chapter 1 introduced a generic safety-culture model linking shared

organisational safety-beliefs to observable safety-behaviours. To be practical,
however, a theory has to be applicable to real events, offering a predictive
capability. If some or all of the safety-culture elements are present and staff
behaviours observable, the model may be able to predict an organisation’s
shared safety-beliefs. From an understanding of these beliefs, an insight into
the strength of organisation’s safety-culture may emerge.
When observing poor safety-behaviours, the model should be sufficiently

predictive to suggest that the organisation is moving towards an intolerable
level of accident risk. Alternatively, with good safety-behaviours, this, inter
alia, may be indicative of an organisation with a low accident-risk.
The safety-culture model was introduced in Chapter 1 as a layered concept.

Safety beliefs, it was suggested, motivate safety-behaviours whilst the beliefs
themselves remain hidden. They can only be revealed through observation
of people’s safety-behaviours. The bridge between the behaviours and the
beliefs consists of supporting safety-culture elements and can be summarised
as:
• beliefs
• espoused values
• attitudes
40 Safety Culture
• artefacts
• behaviours.
If the generic model has a predictive capability, applying it retrospectively

to historical incidents may be a useful to test. It may give sufficient signals
to predict the known outcome of the incidents or show that a failing safety-
culture was moving the organisation into a high-risk position.
To test this, some events are considered. The first two occurred before the
concept of safety-culture emerged pre-1986. The events are:
• the Titanic (1912)
• Bhopal (1984)
• a poly vinyl chemical plant (2004)
• a dropped load event (2004)
• the Tokaimura criticality event (1999)
• a panoramic wet-source irradiator event (2004).
Titanic
The loss of this White Star Liner is well documented as arising from a glancing
blow with a 200,000 tonne iceberg. This occurred at 23.40 on the 14 April 1912
in a calm Atlantic Ocean. Five starboard ‘watertight’ hull compartments were
damaged. Within three hours the ship had slid bow-first under the sea. There
was a loss of nearly 1,500 lives with 705 survivors.
At a British Board of Trade inquiry the Titanic’s owners, the captain, officers
and crew were exonerated. It was recorded that they were operating Titanic at the
time of the incident in accordance with the marine custom and practice of 1912.
It is noteworthy that the ship’s captain, with a long and distinguished

service at sea, was served by experienced officers. Nevertheless, for such a
collision to occur in a calm sea with a well-engineered modern ship requires
poor human performance. In the case of Captain Smith and his officers who
safety-culture theory as a predictive model 41
were the management, it can be suggested that their poor safety-culture and
associated safety-behaviours caused the ship to founder. It is proposed that
these behaviours arose from inappropriate shared safety-beliefs, leading to a
progressive deterioration in conservative decision-making increasing the risk
of an accident. A key issue perhaps is whether the behaviours and degradation
in the managers’ culture occurred over an extended time or was a collective
aberration due to the ‘excitement’ of the ship’s maiden voyage. This remains a
point of speculation. Yet it should be a matter of some unease if a culture can
decline so rapidly and deliver such fatal consequences.
It is useful to apply the generic safety-culture model to the officers’

behaviours to determine if the behaviours can be linked to shared poor safety-
beliefs. With a linkage confirmed, the inevitable outcome (the ship sinking)
may be predictable even if uncertain.
Within a maritime authority-structure some caution is needed with the

concept of shared beliefs. The crew follow orders and the concept of shared
organisational safety-beliefs may not hold. However, even though the captain
is not required to consult his officers, this group were collectively responsible
for making the decisions on the ship’s performance, direction and safety: they
were the ship’s managers.
As noted, the captain may or may not consult with his officers about
operational decisions as ultimately he has total authority. His orders have to
be obeyed, irrespective of subordinates’ beliefs or values. However, the record
gives no evidence as to whether the captain failed to consult his officers on
operational decisions on the April voyage. Similarly, there is no record of any
challenge by the officers to any of the captain’s perverse decisions leading to
the eventual sinking of the ship. This gives a strong suggestion that there were
shared beliefs at this hierarchical level regarding the ship’s management and its
safety in the iceberg field.
The Titanic on her maiden voyage to New York from Cherbourg was ‘state-
of-the-art’ marine engineering for 1912. She was double-hulled with watertight
compartments as protection from severe damage or sinking in the event of a
collision. With a unique three-propeller shaft the ship could achieve a speed of
almost 25 knots.
Some days into the voyage and before the fateful collision, Captain Smith
had received radio messages indicating that there were icebergs in the North
42 Safety Culture
Atlantic on the latitude his ship was steaming. As a precautionary measure

he moved the ship onto a more southerly latitude. This was the one exception
when Smith appeared to implement a precautionary decision regarding the
ship’s safety and the ice-pack hazard. Icebergs could still be expected on this
more southerly latitude, even if an unusual occurrence. This was confirmed
during the day by radio messages from local shipping to the Titanic’s radio
operator.
On the new course, Captain Smith maintained the ship’s speed at 21.5
knots. At 46,000 tonnes the ship’s momentum now presented a significant
challenge if rapid speed reduction or an urgent change of course was required.
This behaviour to maintain high speed seems unusual, as the captain and his
officers were aware of the possible iceberg hazard at this latitude.
A further poor safety-behaviour was the failure by the bridge officers to

demand a continuous flow of information from the radio operator to enable
monitoring of iceberg movements. On the evening of 14 April, although not
fully reported to the bridge, local shipping messages regarding the hazard
continued to be received by the radio operator. This information appears not
to have concerned the radio operator or the bridge officers who offered no
query about delays or gaps in receiving information. Warning messages were
transmitted throughout the evening from the SS Amerika and SS Mesaba. Mesaba
eventually sent a most important message indicating icebergs in the path of
Titanic. This message was not delivered by the radio operator to the bridge
officers as the signal was not marked as urgent. Later, following a further
warning of icebergs in the path of Titanic from the SS California the Titanic’s
radio operator appears to have been annoyed. The signalling interruptions were
interfering with his sending messages from the Titanic to shore. Eventually the
radio operator requested in strong terms for the SS California to stop sending
iceberg reports as he was busy sending first-class passenger radio messages.
This was a service for which the radio operator was paid by the passengers.
This behaviour by the radio officer and the lack of questioning by the officers
on watch were inconsistent with a deep concern for the ship’s safety. After this
late night exchange the SS California shut down its radio transmitter. Titanic was
now alone and out of radio contact with a ship that was only a distance of two
hours sailing. The loss of radio contact with this specific ship proved to be fatal,
as the Titanic sank over a period of 2 hours and 40 minutes.
The captain of the SS California had made a conservative safety decision. He

had stopped his ship in the iceberg field awaiting daylight before proceeding.
The ships were at a ‘visual’ distance apart. Shortly after midnight, the watch on
California saw flares and rockets from Titanic. Unknown to the watch, Titanic
was sinking. The periodic lighting of the sky was interpreted as celebration
fireworks for rockets in 1912 carried no emergency significance and were
ignored. On California the radio, an essential safety instrument, was now
unmanned whilst the Titanic was urgently transmitting SOS messages (and
CQD signals, come quick danger, which pre-dated SOS).
Before retiring for the night, Captain Smith had posted an observation
watch. This is some evidence that there remained a distant concern in his
mind regarding the iceberg warnings. Instructions were given to keep a look
out for ‘growlers’. These were small icebergs typically a few metres in length,
depth and height. Being particularly difficult to see, if a ‘growler’ was struck
by the ship travelling at speed, experience suggested there could be local hull
or propeller damage. Although she did have the novelty of three propellers
and damaging all three was probably remote, such an event could potentially
have stranded the ship in mid-Atlantic. It seems odd behaviour, however, to be
wary of striking small, even tiny, icebergs compared with the huge size of the
icebergs on Titanic’s latitude.
The officers may have split the observation tasks. The bridge officers would
keep a watch for large icebergs whilst the on deck the watch crew would look
out for small growlers. However, even with this instruction to look out for
‘growlers’, binoculars were not issued to the posted deck watch. The glasses
were locked in a cupboard and the key had been taken by an officer changing
ships in England before Titanic sailed for Cherbourg. Why the cupboard was
not forced open to equip the seamen is unclear. The captain appeared to be
content that a seaman’s direct vision was sufficient to identify any hazard in
the ship’s path. At this point, the seamen on watch were the only protection the
ship had whilst it steamed at full speed into an iceberg field. This lack of action
to properly equip a watch for its safety task is inappropriate behaviour. The
captain then retired to his bunk for the night.
On the night of 14 April in 1912 the ocean was very calm. There was no moon.
One of the local ships had earlier radioed a signal indicating the observation
of ‘blue’ icebergs. These are almost completely clear walls of ice with no snow
cover and, on dark nights, difficult to see. The ocean being calm, there would
be no waves crashing against the ice wall to give additional visual and possible
audible warning. Such icebergs were virtually invisible, particularly on a
moonless night.
44 Safety Culture
The Titanic was now in a hazardous position. It was steaming at almost

full speed with human observation as the only defence against a collision
possibly with a reported ‘blue’ iceberg. These decisions, including a reluctance
to slow or stop the ship, were being driven by antecedents. There were several
antecedents that may have affected the captain’s safety behaviour.
First, for the maiden voyage the owner of the White Star shipping line was
on board, as was the ship’s architect. Clearly, good performance was expected of
crew and officers. The expected good performance may have been to achieve a
fast crossing to New York. There were rumours of an attempt to achieve a faster
crossing than the Titanic’s sister ship Olympic. There was also some suggestion
that if the ship could be pushed towards her maximum speed the crossing from
Europe to New York could be reduced by several days and a record achieved.
However, there were already ships at sea that could achieve over 26 knots and it
was unrealistic that Titanic could achieve this. The attempt at a record is taken as
speculation and probably not a belief that significantly influenced the decision
to maintain a high speed. To make a fast crossing would have been a significant
coup. Technically Titanic could probably cross faster than SS Olympic as the calm
sailing conditions were ideal. It would be an excellent advertisement for the
ship and good for the business in the competitive transport market of the time.
In addition (although speculatively) it would be an impressive demonstration
of performance and seamanship before the ship’s owner. Although strongly
denied by the owner Bruce Ismay it is believed some ‘pressure’ was placed on
the captain to attempt a fast crossing. A speedy crossing on the ship’s maiden
voyage would indeed be ‘good for business’.
A further antecedent were the weather conditions. These were ideal for a
smooth fast crossing. It was a calm clear night and although there had been
numerous iceberg warnings, none had been seen by the crew, officers or
reported by any passengers.
An element of complacency may have entered into the euphoria of

the ship’s maiden crossing. This is reflected in the officers appearing not to
learn from, take cognisance of or have unease about other local ships’ hazard
warnings. Because the officers had not seen any icebergs on the voyage so far,
they may collectively have believed the icebergs were few and would move off
the ship’s route before the Titanic reached the point of their original sightings.
More convincing perhaps was that the officers possibly strongly believed that
the bridge watch officers and the crew would be quite capable of sighting
such huge obstructions long before ship was in danger of collision. This was
particularly so as it was a clear, calm, cold night. However, the fact that there
was no moon was a crucial element overlooked by the officers and the captain.
The deep belief that they would sight any icebergs before a point of danger
may also have influenced the officers’ lack of urgency about receiving iceberg
warnings from the radio operator.
It has been suggested in many papers that the belief held by the captain
and all his officers was that the ship was unsinkable. This was possibly true
and could be an antecedent to poor safety-behaviours. However, even this
lofty belief would not encourage the behaviour of taking the ship at high speed
into hazardous ice-pack waters. It was not the intent to actually hit an iceberg
whether the ship was unsinkable or not.
Captain Smith was fully aware of the ship-building technology of the age
and when discussing the very latest designed ship, the SS Adriata, he made the
public statement, ‘that he (Smith) could not conceive of any disaster that could
make the ship founder’. He later carried this view onto the Titanic believing
that because of its unique features and the excellence of modern marine design,
the ship was unsinkable.
This belief was held by the ship’s owner Bruce Ismay. His belief that the loss
of the ship was impossible led to a modification of the first-class passenger’s
promenade deck. To enable the modification but against the wishes of the
designers, several lifeboat housings were removed from the deck structure.
When the sinking occurred too few lifeboats (and the poor emergency procedure)
contributed to the large loss of life. The origin of this perverse design decision
was a fundamental belief that the ship was unsinkable. The designers under
pressure compromised passenger safety on the basis of an unfounded belief
in the integrity of the ship in all types of collision. The first-class passengers’
luxury and convenience became the priority before passenger safety.
Neither the ship designers nor the company ever publicly claimed the ship
was unsinkable. The phrase used was that they had arrived at a point that
was ‘as far as possible to design a ship to be unsinkable’. The designers were
aware, however, that the bow compartments on the Titanic were not watertight.
Because of connecting corridors and the bulkhead sealing design, if more than
four compartments were ruptured then the ship would be lost.
As suggested previously, the fact that it was strongly believed that the ship
was unsinkable would not necessarily lead to the behaviour of maintaining
46 Safety Culture
high speed. Even if the ship did not sink following an iceberg collision the
implications for the maiden voyage would have been dramatic. The belief that
the ship was unsinkable was possibly a minor influence on the operational
decisions.
Noting the antecedents, there are shared beliefs overriding safety that were
driving the captain and officers towards perverse safety-behaviours.
The captain’s decisions appeared to go unchallenged. Although aware of the

hazards there is no evidence of attempts by the officers to discuss or negotiate a
speed reduction from 21.5 knots. The limited flow of radio messages reaching
the bridge officers and the poorly equipped watch appears to have caused
no alarm. For the captain this lack of challenge may have been a positive,
welcomed, feedback consequence for his behaviours and reinforced the faith
in his decisions.
At 11.40 p.m. a seaman on watch, in the crow’s nest, saw an iceberg 500
metres ahead of the Titanic. With binoculars it is estimated the seaman would
have seen the iceberg over a thousand metres away. The officers, who had not
seen the iceberg from the bridge, even though it was relatively close to the ship,
rapidly responded by reversing the engines at 21.5 knots and attempted to turn
the ship to port. Her momentum continued to carry her forwards. Thirty-seven
seconds after the sighting, the ship’s starboard bow struck the iceberg a glancing
blow. Five compartments were opened up to seawater ingress by the collision.
The architect, Thomas Andrew, was on board. On learning of the extent of the
damage, witnesses suggest that he informed the captain of the time it would
take for the ship to sink. He was correct almost to within minutes and died on
the ship. The ship began to sink at the bow. By 2.20 a.m. on the morning of 15
April the ship had disappeared with a loss of 1,500 lives.
It is suggested that the safety behaviour of the officers and captain

demonstrated a poor safety-culture and contributed to the loss of the ship.
Although operating a sophisticated piece of equipment in a high-hazard
environment, the management were not making conservative safety decisions.
Irrespective of the quality of the ship’s engineering or the robustness of any
maritime procedures, their poor safety-behaviours significantly increased
the risk of an incident. There was no defence in depth to protect the ship.
Steaming a ship at 21.5 knots with a pair of seaman’s eyes as the only ‘safety
mechanism’ against an iceberg collision can be only regarded as reckless
safety behaviour.
If the safety-culture model is applied it is suggested the beliefs influencing

the captain and his officers’ behaviours were based on the belief that:
• the owners want them to make a fast crossing
• they could make a fast crossing
• a fast crossing would be good for the business
• the sea conditions were ideal for a such a crossing
• strongly, that on such a calm night large icebergs would be sighted

from the bridge well before the possibility of a collision; they had
the experience
• they would not see ‘growlers’ from the bridge but the posted watch
crew would see them
• they must impress the owners (speculative)
• they believe the ship is unsinkable (possible minor influence).
It is suggested that these beliefs influenced the poor safety-behaviours of

the ships management.
Regarding safety equipment, little can be said. However, a conservative

decision regarding the ship’s speed was not prompted by recognising that there
were no binoculars (a safety artefact) available for the iceberg watch. The use of
the ship’s siren as safety equipment for echo-finding on a dark moonless night
appeared to receive no consideration. The lifeboat-launching equipment was
found in earlier commissioning trials to be generally inadequate. However, the
captain took no action to remedy this before the ship put to sea.
Little can be said about the formal culture dimension, that is, the safety
procedures and processes. Ships in 1912 were undoubtedly handled more by
the skill of the officers and crew than by procedure. However, the sea trials
for commissioning the ship were rushed and incomplete. Part of the trial was
the testing of the emergency procedures. The lifeboat emergency drill ended
in chaos, for the crew were unable to follow the lifeboat-launching procedure
and the lifeboat launch-equipment was inadequate. No re-drilling, retraining
48 Safety Culture
or changes to the procedures occurred before Titanic sailed. Any urgent

requirement during the voyage to implement the emergency procedure was at
this stage left to chance.
The ship sailed with a fire in one of its coal bunkers. The procedural response
would have been for the captain to return to port and have the fire dealt with, as
his own crew were having difficulty bringing it under control. Irrespective of any
fire emergency procedures or the need for a conservative safety decision, the ship
put to sea with the bunker on fire. A company ‘Flag Ship’ on its maiden voyage
with its owner on board, returning to port with a hold ablaze would perhaps
not have made good news. Whether this public-relations point influenced the
poor safety decision to proceed to sea, with this uncontrolled hazard on board,
is, however, speculation. The fire was eventually brought under control but was
still a smouldering menace even on the night of the collision.
There was possibly a construction safety issue that caused the rapid loss
of the ship. Recent research suggests that a decision was made to go from a
high-quality foundry material specification for metal-plate rivets to a reduced
specification. Due to foundry capacity being limited there was a shortage of
plate rivets being delivered to time during the build (about 3 million rivets were
used on the ship). The changed specification enabled additional, less modern
foundries to produce rivets. The reduced specification introduced more slag and
inclusions into the metal, reducing a rivet’s capability to take shear forces across
the head. When the collision occurred it is postulated that the plate rivets failed
in rapid succession under the shear forces. Rivets failed as if the metal was being
unzipped due to these impact forces and from the immediate local high forces
caused by the failing adjacent rivets. The rivets failed in their primary task of
holding the ships hull plates together. There has been much speculation as to
whether this materials substitution did actually occur. However, if it did it is a
keen example of a materials change taking place without consideration of the full
safety implications of such a decision on a high-hazard, low-risk plant.
An independent safety-culture review of the Titanic as an organisation

would have revealed the inappropriate safety-behaviours of the ‘senior
management team’. Modest questioning and challenging, in an open
cooperative environment, would have revealed the deep-seated shared belief
and confirmed why the poor behaviours were occurring. It would be revealed
that the poor culture was manifesting itself as poor safety-performance due
to the ill-founded, deep-seated shared belief that the ship was safe because
it could be protected from a collision by the visual capability of the crew and
officers. The poor safety-behaviours increased significantly the risk of collision

and cost 1,500 lives, with the loss of a major asset, the ship.
Beliefs
Noted previously above.
Espoused values
• The speed of the crossing was valued
• First-class passenger comfort was valued
• The designer’s ability was valued, respected and not challenged
• The officers’ risk judgement was valued
• The officers’ experience and observation capability was valued.
Attitude
Safety complacency:
• risk denial
• ignoring the gravity of other ships’ signals
• a belief in their own ability to judge risk
• no conservative decision-making condoned
• the bunker fire is not a safety problem.
Artefacts
Procedures ignored:
• emergency drill inadequate: procedure

50 Safety Culture
• full sea-trials of the ship (commissioning the plant) cut short:

procedure
• inadequate emergency safety training for the crew: procedure
• safety ‘look out’ binoculars not available
• insufficient lifeboats
• radio not considered as a fundamental safety-system artefact
• siren as an emergency echo horn not used.
Resulting behaviours
Steaming a 46,000 tonne ship at speed into an iceberg field.
Bhopal
Madhya Pradesh State is located in the very centre of India. Bhopal is its capital
city and the Bhopal Chemical Plant was located in the city.
The 1984 accident at this plant is perhaps an extreme example of poor safety-
culture. Although the owners argued that the accident was due to sabotage,
the India safety authority’s official report disagreed. In addition, if the plant’s
engineered safety provisions had not been allowed to deteriorate even if
sabotaged, they should have been sufficient to mitigate some of the accident’s
consequences. Bhopal would be virtually unknown outside Madhya Pradesh if
the plant had been in good working order. Unfortunately, this is not the case.
The reported consequences from the plant accident were 2,500 members of
the public killed and 250,000 seriously injured. Some of the injuries persisted
over decades.
By applying the generic safety-culture model to the circumstances of the

event, it may be possible to determine if it will qualitatively predict a raised
plant-accident risk. In the case of the Bhopal event, the safety-behaviours of the
local corporate body, the operators and the site managers require examination.
From this, the shared organisational beliefs driving the behaviours may emerge.
A qualitative judgement is then needed as to whether these shared safety-beliefs
were the root cause of the plant’s safety systems being permitted to deteriorate
and the risk of an accident rising beyond what is reasonably tolerable.
The Bhopal plant opened in 1968 and was producing carbamate pesticides
(carbaryl). An intermediate, highly toxic chemical product was methyl
isocyanate which is a significant hazard for operators and the public. The public
was particularly at risk, as close to the site boundary an unofficial ‘shanty town’
had been permitted to arise and expand.
The process chemicals used were chlorine, carbon monoxide, phosgene,

mono methyl amine, chloroform as a solvent, with the methyl isocyanate
(MIC) being the intermediate product. The MIC was stored in tanks then taken
back into the process as required, to react with alpha-naphthol, producing the
pesticide carbaryl.
In addition to the methyl isocyanate, chlorine and phosgene are well-

known chemical hazards. The MIC, however, is particularly hazardous yet was
stored on site in quantities well in excess of day-to-day process requirements.
This chemical is:
• toxic
• highly reactive with water (and with acids and alkaline)
• unstable (will readily burn in air)
• volatile
• reactions with liquids are usually exothermic
• its vapour, at 6 per cent in air, is explosive
• the flash point is –18°C
• boils at 39°C.
This list of hazardous properties is not exhaustive.
By any measure methyl isocyanate is a hazardous chemical requiring good

safety-management. Because MIC reacts violently when warm, the storage
52 Safety Culture
tanks at Bhopal had refrigeration units. Noting the flash point of MIC, these
units were safety equipment and used to ensure that the stored material
remained at a low temperature. This and other important engineered safety
features deteriorated over time.
In December 1984 approximately 0.5 to 1 tonne of water ‘inadvertently’

entered a methyl isocyanate storage tank (number 610). Over a two-hour period
an exothermic reaction took place increasing the tank’s internal pressure. Four
hours into the event, the methyl isocyante temperature had reached 200°C. At
this point a relief valve opened and a pressure-relief bursting-disc breached,
releasing approximately 25 tonnes of methyl isocyante into the air. A vapour
cloud rolled over the shanty town, resulting in immediate deaths and delayed
deaths. There were a large number of acute ill-health effects, including serious
skin, lung damage and breathing trauma. Many of the effects were chronic and
have persisted for many years, in some cases decades.
The immediate causes of the event were mechanical failures. However, it

is rare for sudden mechanical failures to occur in a professionally designed,
moderately well-engineered facility and for the failures to deliver such serious
consequences. There is normally designed defence in depth against high-
consequence events.
In considering plant failure, a key issue is, inter alia, to identify the root
cause. If acute mechanical failure is a low-probability event on chemical
plants then the quality of the human performance, the safety-behaviours,
requires consideration. This extends from the various managerial levels to the
operator.
From an engineering perspective, the official report identified many failures

as major factors in the accident. These included:
• the fundamental, self-imposed hazard of storing large volumes of

MIC on site
• there being inadequate engineering and instrument equipment

maintenance; and
• a lack of the post-accident emergency arrangements.

With regards to storage, there were two main MIC storage tanks, with a
back-up tank. Each was capable of holding 65 tonne of material. However, as
little as 10 kg was required for a process batch. No attempt had been made
in design or operation to reduce this hazard. The magnitude of this hazard
was not appreciated by the site management. After the accident, inventories in
plants worldwide were reduced by at least 75 per cent.
The official report showed, by its systematic examination of the plant and
its processes, that routes existed into the MIC tanks, and water could enter if
there was mal-operation in plant flushing, cleaning and maintenance. Neither
during the plant design process nor during operational reviews was the plant
subjected to a systematic hazard and operability study. Such a study, even
rudimentary, would have revealed these routes and steps could have been
taken to eliminate them.
The report indicated that the accident was initiated by the flushing through
of a scrubber-vent line with a water wash. Valves linking the vent line to tank
no. 610 (the tank that failed) were not seating correctly. Alternatively they
were not closed before the flushing process was started. This was due to poor
maintenance, equipment failure or they had been left open due to a procedure
failure. Further, blanking plates to isolate the wash line from the tanks were not
in place due to inadequate procedure or supervision.
MIC, as noted, is very volatile and was kept at a low temperature using
refrigeration units. Even though the vessel contained tonnes of MIC, the
refrigeration units on tank 610 had been shut down for maintenance. This
refrigeration equipment was an engineered safety feature for defence in depth
against the MIC overheating and becoming an uncontrolled hazard. There
were no substitution arrangements in place or attempts made to move the MIC
to an alternative refrigerated tank. The refrigeration unit was shut down, with
no substitution arrangements, with the knowledge of line management. This
was an endorsed procedure violation.
It was established in the official report that due to poor maintenance the
instrumentation on the complex was known by the operators to be unreliable.
During plant operation instruments were ignored due to their unreliability.
This was accepted by the management. Degradation of maintenance standards
and the ignoring of instrumentation readings became an accepted behavioural
norm. Poor instrument performance was worked around by the operators who
used judgement, guess work, and experience to keep the facility operational.
54 Safety Culture
When the water entered tank no. 610, via the faulty valve, a slow exothermic
reaction occurred with the MIC. The tank’s temperature and pressure began to
rise. Because of instrument unreliability and such changes not being expected,
the plant operators ignored the instrumentation showing increased temperature
and pressure. However, on this occasion the instrumentation was working
correctly. As the event progressed, a high-level temperature-alarm on the tank,
which had been set too high after previous inadequate maintenance, did not
signal at the design set point. This alarm maintenance failure occurred due to
a breach of procedure and poor supervision. Even though it was a key safety
instrument, the alarm was not tested and signed off after maintenance as being
suitable for service. The consequence of this was that when the instrument did
eventually signal alarm, the tank temperature and pressure were outside the
tank’s designed safe operating envelope.
The tank was also fitted with a relief valve, designed to fail at 3 × 10+5 Pascal
(3 bars) pressure. However, on reaching this pressure the valve did not open.
This was due to poor maintenance or corrosion. At a considerably higher
pressure than the design intent, the valve did eventually release and a two-
phase liquid-vapour mix flowed to a caustic scrubber.
The scrubber, an additional level of protection, was designed to prevent

any uncontrolled release of MIC gases. Normally, if any MIC gas residuals
emerged out of the scrubber they were destroyed by burning in a flare stack
before discharging to atmosphere. On the day of the event the caustic scrubber
was unavailable. It had been disconnected for repair and was awaiting a spare
part. There were no substitution arrangements. During the accident, the MIC
was not scrubbed or burnt in the flare as it discharged from tank 610.
The stack flare was the final line of defence against methyl isocyanate being
discharged directly to atmosphere. It was designated as a 24-hour flare because
of its importance to safety. It was inoperable during the accident. Due to poor
maintenance, pipe corrosion had been identified in the flare’s system. The flare
was shut down several months prior to the accident occurring. There were no
substitution arrangements.
The faults and failures outlined are only some of the safety issues identified
in several Bhopal post-accident reports. Others include failure to follow line-
washing procedures, insufficient gas masks on site, undeclared modifications to
the plant, lack of an emergency plan or its exercise, and a lack of understanding
of the plant hazards by some managers and operators.
Although there had been several serious accidents since operations began
in 1964, the management appeared not to act effectively to improve the plant.
Audits and reviews did occur but constructive action to reduce risks did not arise.
Identified safety problems prompted the worker’s trade unions to challenge
the facility management on safety-performance. For example, one operator had
been killed (1984) by phosgene gas and there were numerous conventional and
chemical injuries annually. There was a failure of the organisation to learn from
these events and act in the interests of worker and public safety.
Employees were regularly moved from the plant to other sites. By 1983, a
30 per cent reduction in the level of experienced staff had occurred. With the
exception of the unions, this had not been challenged within the company as to
the operational safety implications.
In addition, the senior staff and the site manager were regularly changed
which promoted a general lack of commitment to the plant’s safety. There was
also a loss of senior skills with an associated loss of corporate memory about
the hazardous nature of the materials being processed.
Although this event took place before the concept of safety-culture emerged,
a safety-culture review would have concluded that the culture was in such a
poor state that the facility was a high safety risk. All the expected safety-culture
characteristics both qualitatively and quantitatively were weak. The Bhopal
organisation by 1984 could be defined as a pathological organisation – that
is, one attempting to succeed financially with the absolute minimum of legal
safety compliance.
The safety-culture model would suggest that a ‘commitment to safety as

the top priority’ was not a deep-seated shared safety-belief either on the site or
corporately. Arising from economic pressures the shared beliefs were possibly
‘plant safety is not a business priority’, ‘the facility must be made profitable’,
‘cut the costs of production’ and that ‘production is more important than
safety’.
The Bhopal plant was licensed to produce 5,000 tonnes of pesticide per
year. There had been a continuous decline from the start of the eighties, such
that by 1983 the site was only producing 1,650 tonnes with sales as low as 1,500
tonnes per year. The plant was facing competition from synthetic pesticides
and making no profit. The commercial pressure was to cut financial losses.
56 Safety Culture
Corporate decisions were made to achieve this by major structural changes in

the site’s management and its workforce.
To reduce operating costs, technically experienced staffs were moved from

the plant to other facilities. A systematic safety assessment was not carried out of
the personnel structural change decisions, before they were implemented. The
drain on process and equipment knowledge had potentially severe implications
for the Bhopal plant’s safety. Further, maintenance tasks were a variable cost
and had to be reduced. To meet this, plant maintenance was neglected. This
promoted a progressive decline in the capability and availability of the plant’s
safety defences.
Because of the deep-seated corporate beliefs of ‘production before safety’

and ‘cut production costs’, the following behaviours arose:
• Removal of experienced engineers and managers to reduce costs,

but the safety implications were not assessed
• Operations and maintenance staff were reduced by half over a few

years to reduce costs
• Deviation from procedure became a socially accepted norm by the

management and workers
• Poor standards of maintenance and operation were accepted by

plant managers
• Ignoring instrumentation, due to its unreliability, was practised by

the workforce
• Due to declining knowledge staff lost the ability to understand the

process risks
• Poor safety training and skills due to declining safety resources and
cost cutting
• Operators were under stress, with staff cuts, inadequate training,

low skill-level
• There was possibly a ‘fear culture’, as staff cuts were causing

uncertainty in the workforce
• With the exception of the trade union, no challenge and questioning

of poor safety standards and behaviours were made by the
workforce or managers (possibly a ‘fear culture’ developing)
• Cost reduction processes were implemented without managers

applying an effective safety-management of change procedure
• There was no effective learning from accidents; previous fatalities

were accepted with no real plant or processes improvements
targeted
• MIC plant operators had no experience of working with hazardous

materials; inadequate skill and training, loss of experienced plant
and process knowledge
• There was no effective emergency procedure nor regular training

or exercising of a procedure.
These behaviours were reinforced in two respects. The adopted behaviours

delivered ‘successes’ for the organisation in reducing costs with no major
public accidents (other than worker fatalities and injuries, which were accepted
as a norm). The second factor was weak regulation. This was ineffective and
contributed to reinforcing the organisation’s belief in production before plant
safety.
This accident was not bad luck, nor exceptionally bad design (although
it could have been significantly improved). Using the generic safety-culture
model, it is suggested that the site employees’ safety-behaviours were influenced
directly by the corporate beliefs that over time shaped a poor organisational
safety-culture. The consequences of this were 2,500 deaths and 250,000 long
term injuries, one of the worst chemical plant accidents in history.
Beliefs
Production before safety:
• The plant has to become profitable

58 Safety Culture
• Cutting production costs is a priority
• Safety equipment degradation is acceptable
• Operating without safety systems substitution is acceptable.
Espoused values
• Any reduction in costs is valued
• Removing staff to cut costs is valued
• Delaying maintenance to reduce costs is valued.
Attitude
• Safety complacency
• Hazard denial
• Accidents an accepted norm
• Poor standards of maintenance and operations an accepted as a

norm
• Ignoring instrument readings an accepted norm
• Unreliable instruments an accepted norm
• Cavalier ‘we can operate the plant by judgement, experience and

guessing.’
Artefacts
• Procedures were inadequate and ignored
• Inadequate procedure training

• No emergency documentation that was trained and implemented
• The safety-management system not used to assist safe operations.
• A dysfunctional corporate body making financial decisions in

isolation
• Safety mismanagement of the facility at every level
• The integrity of plant safety systems permitted to degrade
• No safety challenge or questioning in the workforce or management

hierarchy (except for the trades union officials)
• Incorrect operator judgements made to compensate for perceived

ineffective instruments
• Dismantling and removing safety equipment (for example, flare

stack, refrigeration units) without substitution
• Continuing to operate the plant in an unsafe state.
A Plastics Chemical Plant Explosion
Used in the manufacture of poly vinyl chloride, vinyl chloride monomer (VCM)
is a hazardous material. To prevent accidents, where the consequences could
affect operators, the public, or the environment, VCM needs to be managed
with care.
VCM is volatile liquid at room temperature and rapidly vaporises. It is

flammable and explodes if mixed in air at 3.6 per cent to 33 per cent by volume.
Static electricity is sufficient to ignite the vapour.
The vapour is a significant health hazard, with the normal means of entry
to the body being by inhalation. It is a heavier than air, colourless gas that is
not readily detected by human senses. Due to its hazardous nature, the short-
term exposure limit (15 minutes) is set at 5 parts per million (ppm) by volume
in air with a normal operational exposure limit of 1ppm. It affects the nervous
60 Safety Culture
system, and brief exposure to significant concentrations can cause dizziness

and narcotic sensations. Repeated exposure can damage the kidneys and the
liver. It is a known carcinogenic, particularly with regards to the liver.
VCM burns at temperatures over 400°C producing hydrogen chloride and

phosgene. At lower temperatures dioxins can be formed.
A ‘Plastics Plant’ in Illinois, USA, processing VCM exploded in April 2004,

killing five workers and injuring another three. The initial 30-metre-high
fireball became a smouldering black cloud above the burning plant. Four local
towns were evacuated and a no-fly zone was imposed. To deal with the blaze,
300 firefighters were drafted in. It took three days to gain control of the fire.
The explosion caused severe local plant damage but, fortunately, did not set
off a chain reaction around the whole site. If it had, there would have been a
catastrophe of huge proportions totally destroying the plant and endangering
many more workers. From such an event professional opinion suggests smoke,
particulate fall out and blast debris would have extended up to 10 kilometres
from the site.
This event was initiated by human error. However, if the organisational

shared beliefs before the event can be revealed and tested against the safety-
culture generic model, it may herald the possibility of an accident of significant
consequence.
The analysis starts with two alternative safety-beliefs that may have been
held by the corporate and site managers. The beliefs appear to be mutually
exclusive.
The first belief arises in an artefact, the corporation’s guiding principles

(2004).
‘We are committed to the health and safety of our employees and the
communities in which we operate. Through the joint efforts of every employee
we shall keep our environment clean and our workplace free of health and
safety hazards for ourselves and for our communities and for our future
generations.’
These are good principles. If truly believed and shared by all staff, from the
board members down to the sites workforce, this is a good platform to build a
safety-management strategy.
There is no documented evidence of any alternative beliefs. However, as

noted in Chapter 1, alternative deep-seated beliefs may not always be consciously
articulated or even acknowledged but they do influence behaviours. The test
for the generic model is to consider the safety-behaviours leading to this event
and determine if the model suggests that the corporation’s espoused safety-
beliefs fit with the behavioural observations.
To understand the background, the corporation at the time of the incident

employed some 80,000 people worldwide and had annual revenue of $37
billion. In addition to the Illiopolis plant there were three other chemical plants,
in Delaware, Louisiana and Texas. The annual revenues from these facilities
were $2 billion. The assets of the corporation were put at about $60 billion.
The Illiopolis plant involved in the 2004 explosion was constructed and
then operated from 1965 by its original designers. In 2001 the plant was sold to
the PVC plant’s corporate owners. One of the first acts of the new owners was to
reorganise the management structure and reduce staff. This was a high-hazard
facility yet, as far as is known, these changes were carried out with no formal
assessment of the safety implications on operations by using a management of
change procedure.
Prior to the reorganisation, the plant was originally divided into local areas
and each area had a highly skilled and respected group leader. This person was
readily available on plant. The leaders had the knowledge and ability to respond
quickly to chemical process issues or plant problems being experienced by the
workforce. The group-leader post was eliminated in the 2001 structural changes
and a single supervisor put in charge of all the plant without the area divisions.
The result of this was that in an emergency or when a worker required advice,
the supervisor might not be available.
Importantly, in the changed arrangements the supervisor could authorise

the removal of interlocks on the plant but, unlike the previous regime, there
was now no need to actually witness the override. This lack of presence by the
supervisor may have been one contributor in this fatal event.
The plant had 18 reactor vessels 8 m high and approximately 4.5 m diameter.
They were arranged in the pattern shown in Figure 2.1. Although they formed
‘mirror images’ of each other the vessels were clearly numbered 301 to 318 as
indicated in Figure 2.2.
62 Safety Culture
Figure 2.1 VCM reactor vessels layout – plan

Source: U.S. Chemical Safety and Hazard Investigation Board.
The making of PVC at the plant was relatively straightforward. A reactor

was filled with liquid VCM, plus water and other reagents. This mixture was
held for several hours at pressure of around ~1 × 10+6 Pascal (~10bar) and a
temperature 50°C. When ready the PVC product was discharged via a ‘bottom
valve’ at the vessel base. The liquid passed through connecting pipework to a
stripper tank where any residuals were removed. The product was then piped
downstream for further processing. All 18 vessels could be operated at any one
time.
Following a PVC transfer to the stripper tank the empty reactor vessel,
with its bottom valve and associated drain valve closed, was manually water-
washed using a water-blast unit to remove any residual products.
There were six persons on a shift including a ‘Poly Operator’ and a ‘Blaster
Operator’. The poly operator was located on the top floor of the tank house
(Figure 2.2). This operator controlled the flow input, the pressure and the
temperature of the reactor vessels. Important to this event was that the only
instrumentation showing the status of any vessel was at the poly operator’s
control panel.
The blaster operator had two main roles. On completion of a cycle the first
task was to transfer PVC product from the reactor to the stripper tank. The
second task was then to open the top of the empty reactor vessel, attach a blaster
unit and wash out the vessel with water. The blaster unit was manually handled
at the top-floor level of the tank house (Figure 2.2). The blaster operator, on
completing the vessel washing, would go to the ground floor, open the vessel’s
‘bottom valve’ and then the vessel’s ‘drain valve’. This was achieved by using a
valve switch-panel local to the base of a reactor vessel. The vessel water flushing
then discharged from the cleaned vessel, through the open air, into a ground-
floor drain. The valve arrangement is shown in Figure 2.3.
For any vessel, its bottom valve and the drain valve were air-interlocked.
This was to prevent a vessel-bottom valve being opened if the drain valve was
open when a vessel was full of VCM/PVC mixture.
The drain valve was free to be manually opened or closed at any time. The
interlock mechanism was on the vessel’s bottom valve. However, the vessel-bottom
valve interlock could be overridden in an emergency to enable a vessel’s content
to be transferred. This was done by a procedure and required a supervisor’s
authorisation. Before doing an override it was expected that the drain valve would
be closed by the operator as part of the emergency procedure. Override was then
achieved by attaching an emergency airline to the vessel’s bottom-valve interlock
mechanism. This opened the vessel bottom-valve and with the drain valve firmly
locked an emergency piped transfer to an empty vessel could take place.
On the ground floor the blaster operator had access to a valve control-
switch panel. One panel served two adjacent reactor vessels and enabled each
vessel’s valves to be manually activated. The operational status of the reactors
was not displayed on the panels. They had no instrumentation status readings.
The blaster operator lacked information on whether vessels were empty, at
pressure, at temperature, full of VCM or containing only washing water. The
operator could only obtain this information by returning to the top floor of the
tank house and asking the poly operator. There were no telephones or intercom
systems.
Figure 2.2 VCM reactor vessels layout – elevation
Valve Switch
Panel Drain Valve Vessel Bottom
Valve
Figure 2.3 ‘Mirror image’ vessels D306 and D310 layout – ground floor
Source: U.S. Chemical Safety and Hazard Investigation Board, modified by the author
for this text.
On the night of the incident, April 2004, the blaster operator was water
washing reactor vessel 306. All other vessels were full of VCM and reagents,
producing PVC. The blaster operator, on the top floor, had attached the water
blaster to vessel 306. After a short break, he was returning to the ground floor
where, instead of going to the valve switch-panel at vessel 306 to switch the
valve to drain the vessel, he went, in error, to the control panel for vessel 310.
This vessel was full of VCM.
The vessel’s mirror image layout appears to have confused the operator
(Figures 2.2 and 2.3). At the 310 switch-panel the operator opened the drain valve
on 310 so that he could drain the water he knew was in vessel 306. The operator
then attempted to open the vessel-bottom valve using the panel switch. It was,
correctly, interlocked (as the operational vessel 310 was under pressure and at
temperature; these conditions had activated the vessel-bottom valve interlock).
The accident investigators surmise that the operator could not understand
why the vessel-bottom valve was locked; it should not have been since, in the
operator’s mind, he was ‘at vessel 306’. Without questioning his own actions,
analysing the problem or seeking advice, the blaster operator decided against
procedure to override the vessel 310 bottom valve interlock. This was done by
taking the emergency valve-interlock bypass air-supply line that was readily
available, attaching it to the vessel-bottom valve (which the operator believed
was vessel 306), injecting air and overriding the 310 interlock.
66 Safety Culture
The 310 vessel-bottom valve opened and several tonnes of VCM began
to discharge through this valve and the previously open drain valve. The
discharge overwhelmed the ground floor drain and VCM spread rapidly across
the ground-floor surface.
The VCM liquid rose locally to 0.3 m deep and was rapidly vaporising.
Within five minutes it ignited, possibly by static electricity. The explosion and
fire killed four people immediately (one died some days later) and seriously
injured three other workers. Local communities were evacuated to avoid the
consequences of noxious gases and smoke. Several hundred firefighters took
several days to bring the fire under control. The assets were lost and the plant
is unlikely to reopen.
PVC manufacturing facilities are highly hazardous. Before this event

there had been several major incidents, nationally and internationally,
causing death, injury and loss of assets. Also, the same action of opening
the wrong valve had occurred at the Illiopolis plant one month before this
fatal incident. Here an operator opened a valve and discharged liquid to
an incorrect vessel. There were no operator or public consequences. In this
case also, operating procedures were broken. (One month following the fatal
incident at Illiopolis, the Delaware facility had a similar repeat but non-fatal
valve event.)
The US Chemical Safety and Hazards Investigation Board, who investigated

the April 2004 Illiopolis fire and explosion made, inter alia, the following
findings:
(The notes in italics are the author’s comments and not Chemical Safety Board
information.)
• The original designers and plant operators did not implement the
1992 Process Hazard Analysis recommendations that suggested
revision to hardware for the reactor bottom valve interlock bypass
to reduce the potential for deliberate or accidental misuse.
(Analysis of risks from the bottom valve system and overriding had been
recognised as a possibility. Neither original owners nor the ‘Plastics Plant’
corrected this issue. The safety-management system was not upgraded nor
were physical improvements made to the plant to reduce the risk.)
• When it bought PVC plant the ‘corporation’ implemented a new

organisational structure and reduced staffing. The Illiopolis plant
did not analyse the safety impact of the change.
(People at senior level in the organisation made decisions on manning-

structure and manning-level changes for the Illiopolis plant in 2001. These
changes were not assessed by a management of change procedure to examine
the safety implication. Large areas of the plant were placed under a single
supervisor. This put additional workload onto the supervisor, who was not
always immediately available to advise the worker. The staffing restructuring
consequences may have influenced the decision of the operator who opened
interlocked bottom valve, as he may not have been able to seek advice and
hence, took a chance, to save time.)
• In February 2004, an operator inadvertently transferred the

contents of an operational reactor resulting in a VCM release to the
atmosphere. Although the Illiopolis managers recommended that
the system be redesigned to prevent inadvertent reactor transfer,
the redesign was not completed.
(Before the Illiopolis event, there had been numerous incidents with VCM/
PVC internationally in Japan, Europe and the USA. There had been loss of life,
serious injury and asset loss. A similar incident had occurred at the corporation’s
Baton Rouge plant, USA, in April 2004. Here, there had been a failure to follow
procedure yet no action was taken to modify any of the facilities. The safety
behaviour of breaking procedure appeared to have become an accepted social
norm. There was no discipline applied by management. The antecedent to such
behaviour appeared to be management condoning breaches of procedure with
no unwelcomed consequences for individuals doing the breach … Additionally,
the management at corporate and site level appeared not to learn from past
events, this being a significant safety-management failure.)
• Neither the original plant owners nor the ‘corporation’ analysed the
reactor cleaning-procedure to identify hazards and recommend
safeguards to prevent personnel from draining the wrong reactor
during cleaning.
(A comprehensive hazard and operability study against reasonable safety

criteria would have identified improvements for the engineered defence-
in-depth. Against modern standards there was inadequate protection on
68 Safety Culture
the facility and it was all too easy to override the interlock system with the
emergency air hose. There was also lack of rigour regarding the application of
the interlock override procedure. Staff restructuring may have contributed to
this lack of rigour.)
• Operators on the lower level (the location of the vessel valves) had
no means (indication or communication) to determine the operating
status (of any of the vessels) from the lower level.
(The operator had only the vessel numbering and his memory to guide him
in the draining task. The instruments at the lower level only indicated valve
positions and facilitated valve movement. The blaster operator, on the ground
floor plant level, had no equipment to telephone or radio the poly operator to
determine the status of vessels. This was poor design. Improvements in the
process instrumentation to give vessel status information on the bottom-floor
control panels had not been pursued by the ‘Plastics Plant’s’ management.
(Further, the use of a radio or telephone to determine plant status, as a means
of safety protection, is a weak safety defence on a high-hazard facility.)
Maintained and functioning instrumentation, engineered defence-in-depth,
applied procedures, good training and a design tolerant to operator error
are improvements that could have been sought by managers. If an operator
becomes distracted, the mirror-image layout of the vessels may itself become
a hazard. Further, if the operator becomes absolutely convinced he is at vessel
306 the confusion becomes compounded by noting that the bottom valve is
locked off when ‘he knows he should be able to be open it’. Training to stop,
think, question and challenge ‘the abnormal’ would have come into play if it
had been ingrained into the operators by managers.)
• Even though operators were not authorised to use the reactor

bottom-valve interlock bypass, they had uncontrolled access to the
bypass option and the bypass could be used without detection.
(Previous incidents had occurred due to the ease of access to the vessel-
bottom valve interlock override. Failure to follow procedure had no
consequences to individuals and there was no means of a third party detecting
an interlock bypass. It was also easy to connect the emergency air to the bottom
valve as the normal and emergency valve air connections were common fittings.
This bypass was known to occur by the management. Some of the antecedents
for the operator were therefore:
• Ease of use of the emergency air line to bypass the interlock
• Saving time
• Possible difficulty in checking with the supervisor (who may not

always be in the area due to increased workload)
• Abuse of the valve bypass system not detectable
• No consequences from management following previous bypassing

of interlocks.
With an operator confused by the mirror-image plant layout, no

instrumentation to assist him, possibly a real belief that he was at the right
vessel (306) and with the ease of access to the valve bypass option, the scene
was set to take a chance and inadvertently drain vessel 310. There may also have
been a strong belief by the operator that the valve was stuck or that the panel
was malfunctioning and this was why the bottom valve would not open.)
• The Illiopolis plant had no written procedure to ensure that

safeguards were sufficient to control the risk of a given hazard.
(The documented safety-management system in the Illiopolis facility

appeared to be weak and ignoring procedure seemed to have become an
accepted norm by staff. However, for a forward-looking organisation,
procedures as part of the safety-management system must support operational
safety. Reliance on procedures for safety defence, however, could have been
reduced by seeking improvement in the engineering, safety mechanisms and
safety-related equipment to ensure they remain the first line of defence against
hazards. The plant needed to be tolerant to human error as people do make
mistakes. Procedures can be a line of defence but are not normally the only
defence or necessarily a good line of safety defence. If there is no option but to
use procedures as the first line of defence, then their diligent application must
become a management priority.)
• The Illiopolis plant had vague and conflicting procedures for

responding to a large VCM release.
(There is evidence that the emergency procedure was not understood in the
plant. More importantly the emergency procedure had not been exercised for
70 Safety Culture
10 years. When the event occurred, instead of immediately evacuating the area
on hearing the incident alarm, operators attempted to stop the leak of VCM by
by using the upper-level control-panel equipment. The operators on the upper
level were fatalities in the explosion.)
• The ‘Plant’ relied on written procedures to control a hazard with

potentially catastrophic consequences.
(Although a weak safety defence, the plant relied upon written procedure.
However, due to lack of discipline contributing to a poor safety-culture, the
procedures were not a reliable safeguard. Procedure violation did occur, was
condoned and was undetectable. With no consequences for violations this
relaxed attitude towards working with procedures had possibly become a
socially accepted norm.)
In applying the generic safety-culture model to the Illiopolis event it

is necessary to consider if the safety-beliefs of the organisation are revealed
through observed safety-behaviours.
The corporate guiding safety principle is noted below and this is a

good platform. However, the behaviours observed did not match these
principles which are the espoused safety-beliefs. The safety-culture model
would suggest that there were other organisational beliefs at play causing
inappropriate safety-behaviours of managers and other staff leading up to
the event.
Beliefs
a) (Documented corporate safety principle). ‘We are committed to the

health and safety of our employees and the communities in which
we operate. Through the joint efforts of every employee we shall
keep our environment clean and our workplace free of health and
safety hazards for ourselves and for our communities and for our
future generations.’ Or,
b) ‘The top priority is production not safety.’ (Although, there is no

documented evidence this was the case.) Or,
c) ‘We know exactly what we are doing with this plant.’ (A belief
arising from over confidence, familiarity or complacency.)
Espoused values
The espoused public value appeared to support the belief (a) above. That is,
safety of the public and employees was valued There is no evidence of other
values from inquiry reports.
Attitudes
There appear to be attitudes of:
• Complacency by the corporate and site management
• Acceptance of bypassing procedure to get the job done
• A non-questioning attitude regarding the safety of the physical

process
• No challenge on individuals for breaking procedure and no

questioning when faced with an unexpected problem (for example,
bottom valve shut and interlocked on vessel 310)
• Senior corporate managers’ attitudes and beliefs that they were

capable of making sensible structural changes to increase business
efficiency (the lack of robust change analysis may have been a
contributory factor in the incident)
• Boredom due to routine operations (boredom can prevent operators

from thinking about the tasks in hand and could be a contributing
factor).
Artefacts
An important artefact, of a strong organisational safety-culture, is a documented

safety-management system. This appeared to be weak in several respects in
the Illiopolis plant and appeared not to be regularly reviewed, updated or
rigorously applied.
• The corporate documented safety principles were a good artefact

but appeared not to be owned or shared within the organisation.
72 Safety Culture
From the incident investigations there appears to have been poor human
performance – poor safety-behaviours, that is, poor safety-culture in the
‘Plastics Plant’s’ organisation:
• Implementing structural change without a management of change

protocol
• Procedure violation behaviour carried out on the Illiopolis and

other plants
• Managers and supervisors appearing not to act to correct procedure

violations
• Lack of effort to improve process safety
• Override of the interlock occurred without seeking advice and

appearing to have happened without analysis of the situation.
possibly based on the beliefs of; saving time, keeping production
going, fully understanding the valve fault (a stuck valve),
understanding there were no consequences for valve overrides,
valve overrides were not detectable
• Emergency procedures not exercised for many years.
There were also design errors suggesting a poor safety-culture during the
design process. There was a failure to take action during operation of the plant
to remove hazards identified due to poor design. For example, there was a high
potential for the direct discharge of VCM to the plant floor. There had been
several ‘near misses’ with this event on other plants and it had been identified
in studies as a high frequency event. The hazard could have been engineered
out of the plant.
These behaviours suggest that the true, owned and implemented belief of
the organisation was not belief (a) noted above. There was some other overriding
belief imposed by the corporate body, possibly (b) or a local issue such as (c).
Either of these beliefs shaped a less than adequate safety-culture contributing
to the fatal incident and major asset loss.
Finally, two additional points are worthy of note. As indicated, the operation
of this facility may have been monotonous. Filling vessels, cleaning vessels,
refilling vessels, cleaning vessels day after day, may lead to complacency and
boredom. On high-hazard plant, managers need to be ready to cycle staff
around jobs to ensure boredom does not lead to loss of concentration. Second,
the Illiopolis plant was a large local employer. There had been job reductions.
This may have introduced an element of fear into the organisation. Workers
may have wanted to show their efficiency and even enhance the throughput
capability of the plant to ensure its future. As such, operational short-cuts may
have been considered on occasions by all staff as acceptable to maintain plant
throughput. There is, however, little evidence of this. Nevertheless, perceived
commercial pressures could lead operators to take chances and managers to
ignore procedural violations.
A dropped load event
The location of this fatal event was a construction site. The fatality was a
‘banksman’ guiding a crane driver’s ‘blind lift’ operations. Following the
incident the offending construction company was prosecuted and heavily
fined in a court of law.
The operation involved lifting timber shuttering units onto an apartment

block roof. The shuttering was to hold in place freshly poured concrete as
required by civil engineering works. The units were typically 10 m2, 150 mm
thick and each weighed about a tonne. The shuttering units were lifted by a
crane from a lay-down area. This area, located at the front of the apartment
block, was relatively small and congested. Identified as the only location for the
crane, it was positioned at the rear of the apartments. Lifts from the lay-down
area were tens of metres high onto the building roof. These were ‘blind lifts’ for
the driver, who was guided by a banksman positioned local to the lay-down
area. Communication was by radio. It is assumed the banksman was trained
for the task and both workers trained in radio communications.
In the congested lay-down area, a procedural ‘personnel exclusion zone’

was in place and to be observed when shuttering units were being lifted.
During one of the lifts, an error was made and a shutter unit collided
with the apartment building at the ninth floor level. The shutter snagged on
a concrete building structural slab. The impact was of sufficient force for the
74 Safety Culture
shutter to split. The two halves fell from the crane rigging. The banksman who
was inside ‘the personnel exclusion zone’ was struck and instantly killed.
For such an operation some possible hazards are:
• The act of doing a ‘blind lift’ using a banksman as an observer and

guide for the driver is inherently hazardous
• The crane driver and the banksman may be ‘loan workers’ requiring
additional safety training and precautions
• There is the possibility of rigging failure
• There is the possibility of the load not being properly rigged
• There is the possibility of the load being snagged or striking the

apartments block, becoming unstable and falling
• Lifting or stopping too quickly potentially putting strain onto the

load rigging
• There may be lack of control of the load; swinging/swaying
• There may be insufficient distance margin between the load being

lifted and obstacles, buildings, overhead cables, communication
dishes, aerials
• There is the possibility of crane brake drum failure and a runaway

load
• There may be external hazards, adverse weather conditions, for

example high wind, lightening strike
• The crane operator might collapse with loss of control
• There might be a failure of communications between driver and

banksman
• There is the need to ensuring an exclusion zone area is sufficiently

large for all load drop eventualities.
From the human performance dimension, contributors to hazards could be

as follows (the list is not exhaustive):
• The banksman making a human error and misdirecting the crane
• The possibility of the driver or, the banks man, misunderstanding

radio communications and the crane driver making an error
• The crane driver just being absent-minded and making an error
• Distraction of the driver or the banksman
• Inadequate training of the crane driver or the banks man for such
lifts
• Inadequate risk assessment for the task
• Overconfidence from familiarity causing an underestimation of the

risks by the driver or banks man
• Inadequate personal assessment of immediate risks, a lack of unease
• The banksman entering purposefully or by error into the personnel

exclusion zone.
Some of the failures in the safety-management process presented in the

court are given Table 2.1.
If the generic model is to be applied, the company’s safety-beliefs need to

be understood. From the information presented in court it would appear that
safety was not the top priority for this operation. Nevertheless, it is difficult to
say that this was a purposeful act and reckless with a management in the sole
pursuit of profits. It may have been just plain managerial ignorance of safety
technology, managerial incompetence in general with a failure to understand
legal requirements.
Nevertheless, this was not the first time the organisation had used a crane
driver and banksman combination. If so, there was perhaps persistent ignorance
of the law. However, there may have been a firmly held belief that the company,
the driver and the banksman actually knew what they were doing and fully
76 Safety Culture
Table 2.1 Failures of a safety-management system – dropped load event
Safety management The construction site event – the court’s

view
A competent person plans the lifting operation Only a generic and not specific risk assessment
with the associated risk assessment and written was available. The risk assessment was judged
permits to work (identifying generic and to be inadequate and inappropriate for the
specific hazards during the operation). task. (It was unclear whether the assessment
had been made available, read and understood
by the personnel involved.)
Lifts should be adequately supervised at all The lift appears not to have been supervised by
times by an experienced manager. an experienced manager. The banksman was
possibly a ‘loan worker’.
Lifts should be carried out in a safe manner Due to an inadequate risk assessment or
which includes contingency for incidents. experienced managerial supervision, the
banksman appeared to have been within the
‘personnel crane lift exclusion zone’ when the
event occurred.
During planning, it was unclear whether
alternative lift options had been considered.
The application of the ‘as low as reasonably
practicable’ principle to the risks was not
demonstrated, that is, an examination of
alternatives to a ‘blind lift’ was not recorded.
Learning from experience should be used. The high risk to operators of injury or fatality in
the construction industry is annually reported
and documented by statutory safety bodies.
This appears not to have been assessed by the
employer. (Lifts are notoriously dangerous if
inadequately executed.)
Operator training essential. It was unclear as to the level of training given to

the crane driver, undertaking the ‘blind lift’.
It was unclear as to the level of training given to
personnel on the construction site, in general,
with regards to the hazards of lifting loads in a
physically confined environment.
The training of the banksman to carry out his
task, including the reasoning behind establishing
the personnel exclusion zone, were not clear.
Training of all site personnel on the hazards Such measures appear not to have been taken.
they face on specific sites they are working.
understood the risks. This may account for the inadequate risk assessment,
Table 2.1. A comprehensive assessment may have been considered unnecessary
as the lifts were considered a ‘straightforward’ task, possibly considered routine.
The safety-belief that ‘they knew everything they needed to know about the
task’, would reduce the inclination to go through the ‘bureaucracy’ of a risk

assessment for this specific lifting operation.
If we apply some possible safety-beliefs to the organisation, the behaviours

that occurred follow through:
Belief
The beliefs may have been:
• Completing the task to time and cost is the priority, not safety
• ‘We (the organisation) believe we know what we are doing’
• ‘We (the organisation) believe we require no detailed risk

assessment’
• ‘We (the individuals) believe we know what we are doing’
• ‘We believe we are familiar with and understand all crane

operations.’
Espoused values
The values are not known. However, they may have been:
• ‘We know what we are doing we value our knowledge’
• We value getting the job done with minimal bureaucracy’
• ‘We value our competence and have little to learn from others’
• A conservative approach, lifting tasks planning, analysis,

documentation, training and evaluation may not have been valued.
Attitude
There is some evidence of a company attitude of:
• ‘We have done enough’; that is, a poor generic lift assessment was
in place
78 Safety Culture
• A poor attitude towards learning; lifting operations are historically

hazardous
• The banksman may have had an attitude (speculative) that he

understood the risks and could take chances (that is go into the
exclusion zone against procedure)
• A ‘get on with the job’ attitude
• People should look after their own safety.
(It cannot be dismissed that a simple error of concentration placed the

banksman inside the exclusion zone, when the drop occurred. This risk could
have been reduced if a manager had been supervising the task, adequate
procedures used, a risk assessment in place and training given.)
Artefacts
There would appear to be:
• A poorly documented safety-management system
• Apparently inadequate risk assessments; the specific ‘blind lift’ task

not adequately risk-assessed
• no documented mandatory supervising manager present and made

essential by an effective procedure
• No formal documented requirement for learning from experience.
It is unclear if the safety-management system was owned by managers and

workers as means of delivering safety for the organisation
• A lifting supervising manager is not present
• The lack of senior supervision appears not to have been

challenged
• The crane driver accepts the concept and carries out ‘blind lifts’,
possibly an accepted norm
• There is no evidence of time spent examining alternative means of

handling the shutter units – application of the legal requirement to
reduce risks to as low as reasonably practical
• The banksman accepts and participates in ‘blind lifts’
• The lack of a specific risk assessment is not questioned or challenged

at management or worker level
• The banksman breaks (possibly) procedures, with the deep rooted

belief he understands the risks and enters the personnel exclusion
zone; this may have been accepted norm behaviour for these
operations
• No challenge (no supervisory manager), no self-challenge, prevents

the banksman moving into the exclusion zone. (It could also have
been a momentary lapse. However, the court did not accept this.)
The behaviours of the organisation’s management and the quality of the

formal management system suggests that they did not have as a safety-belief
the need to have operational safety as an integral part of business decision
making. This was not necessarily recklessness but was a lack of duty of care and
managerial incompetence. In addition, complacency is suggested, stemming
from the shared belief that ‘getting the job done’ was the priority. Probably
arising from ignorance and failure to learn from others, there also appears to be
a management shared belief that ‘we know what we are doing’. These beliefs it
is suggested may have prompted the behavioural approach.
For various breaches of health and safety law, the company in question was
heavily fined by the court.
A Criticality Event
Tokaimura is a village located approximately 120 kilometres north-east of

Tokyo (Figure 2.4). Located close to the village was a commercial nuclear fuel
manufacturing site. The Tokaimura site operated under the constraints of a
nuclear licence enforced by the national regulator.
80 Safety Culture
Figure 2.4 The location of Tokaimura (Point ‘A’)
The primary role of the site’s plant was to convert uranium hexafluoride
into uranium dioxide fuel for use in Japan’s commercial nuclear power stations.
Once every few years the site’s Conversion Test Building processed purified
triuranium octoxide (U3O8) powder with nitric acid to form uranyl nitrate
solution. The solution was to be used off-site in the manufacture of fuel for
the experimental fast-breeder reactor Joyo. On the 30 September 1999 three
operators were seriously irradiated with neutron and gamma ionising radiation
whilst working on the Joyo triuranium octoxide process. Two received fatal
radiation doses. The third, the supervisor, survived following a period of
prolonged hospitalisation.
Using the generic safety-culture model it is suggested that it may

demonstrate that the operators were injured, two fatally, by a poor organisational
safety-culture on the plant and that this arose from inappropriate, shared,
organisational safety-beliefs.
Uranium occurs at between 0.5 to 20 weight percent, as a natural element,

in pitchblende. Existing naturally as triuranium octoxide (U3O8), it has two
isotopes, uranium 235 (at 0.7 per cent by weight) and uranium 238 (at 99.3 per
cent).
The neutron is a tiny particle which forms with protons the structure of
almost every atomic nucleus (the exception being hydrogen which has a single
proton as its nucleus). Uranium isotopes are ‘large heavy’ nuclei and if struck
by a neutron the uranium will split, or fission, into two lighter elements. The
fission process generates energy. This energy is released mainly as the kinetic
energy of the two lighter fission product fragments and as energy associated
with the neutron and gamma radiation emitted in the fission process. (Gamma
radiation is similar to X-rays but of shorter wave length and is more penetrating
through matter).
If the neutrons emitted in one fission strike other local uranium nuclei,
further splitting can occur, resulting with the right conditions, in a chain
reaction of multiple fissions. Such an uncontrolled, unintentional, reaction is
termed a criticality event (Figure 2.5). (Criticality events are not an explosive-
type chain reaction.)
The intense ionising radiation is the major criticality hazard for operators
(and possibly members of the local public). The high energy neutron emission
is the more biologically damaging radiation component in such events. If a
plant is not adequately designed or managed, a criticality event may occur
with fissile materials that are solids, powders or in solutions. Criticality events
take fractions of a second to occur with instantaneous exposure to radiation of
local operators. A criticality can end just as quickly due, inter alia, to the local
dispersion of the uranium material changing its geometrical shape, preventing
further excess fissions and stopping the chain reaction. However, this is not
always the case. There can be multiple bursts of radiation from an oscillating
criticality. Here the material disassembles after the first event, only to reform
sometime later into a critical mass with a favourable geometry and trigger
another criticality. Eventually further material dispersion or some intervention
stops the oscillations.
During a criticality event the intensity of the radiation falls rapidly the
further away a person is from the event; the fall off is one over the square of the
distance. Because of this, it is unusual for there to be life-threatening radiation
exposure of persons outside the immediate location of the event, typically a
few tens of metres away.
82 Safety Culture
Figure 2.5 A chain reaction
Uranium 235 readily fissions with slow (low energy) neutrons, referred to
as thermal neutrons. This concept is exploited in thermal power reactors. Also,
the material used in these reactors is uranium dioxide (UO2) manufactured
from processing U3O8. However, for technical reasons the uranium 235 isotope
in the natural oxide state has to be enriched. Typically, for light water thermal
nuclear reactors, in common use, this would be a 5 per cent by weight U235
enrichment. Enriched uranium was used in the Joyo fast reactor, but at a much
higher level, 18.8 per cent U235 enriched.
In the design of facilities handling fissile material, an important hazard

to address and manage is the possibility of an uncontrolled criticality. This is
particularly so where enriched uranium is being processed. Extensive safety
assessments, engineering analysis, the highest-quality engineered equipment,
robust operational procedures, and extensive operator training give significant
defence in depth against criticality events. The intensity of this design and
build effort, with a firm nuclear safety focus, is to protect the operator and
the local public from the occurrence of a criticality. It is not usually to protect
operators from the radiation. The adopted design safety strategy is to ensure
the risk of criticality is as low as is reasonably practical. That is, the possible
occurrence is extremely remote; typically about one event in a million years
per plant is adopted as a safety target. This is generally judged by the public
to be an ‘insignificant’ and ‘tolerable’ risk. Fuel facilities worldwide are very
safe in operation due to exemplary design, engineering, diligent operation and
demanding safety targets.
Uranium spontaneously fissions naturally at a low, insignificant, level.

Arising from this there is always a small population of fast neutrons within a
uranium mass or solution. These neutrons are available, if the conditions are
just right, to initiate an uncontrolled chain reaction. A key design feature is to
ensure that in uranium fuel plants this natural inherent neutron population
and the quantity of uranium material in a process are purposefully managed.
An applied design practice is to ensure there is leakage of spontaneous

fission neutrons from the system (this is not hazardous to the operators or the
local public due to the incredibly small number of neutrons in a system from
spontaneous fission). This is referred to as safe geometry design and forms one
component of the facilities’ defence in depth.
A further safety defence is to restrict the mass of uranium material that can
be placed in various vessels and tanks. If there is insufficient material below a
critical mass nature itself, the physics, will not allow a criticality to occur. This
is uranium mass control. The higher the enrichment of U235 in a process the
lower the permitted mass. On a facility the mass constraint is set at several
times below the critical mass using detailed analysis by highly trained criticality
specialist assessors. Mass constraints become documented requirements for the
operational safety case and procedures.
An additional defence is that plant designers ensure ‘leaking’ neutrons

leave the system and cannot bounce back into a uranium mass. This neutron
‘bounce back’ is known simply as reflection. When fast neutrons from fission
are reflected they can also slow down. Alternatively, they can undergo multiple
collisions in hydrogenous material and be slowed down, then be reflected
back onto a system. The multiple collisions process is termed moderation. Fast
fission neutrons are not too good at causing U235 fission. However, if they are
slowed down in a moderator such as water they are then more likely to cause
a further fission. Hence the removal of all hydrogenous materials that are not
part of the designed chemical processes is an essential safety feature. When
neutrons leave a geometrically designed safe system hydrogenous materials
84 Safety Culture
local to vessels have been studiously designed out, reducing the possibility of
neutron reflection or multi-collision moderation.
The design strategy, engineering, instrumentation, training and operational

procedures, are detailed precautions taken on nuclear fuel manufacturing
facilities to reduce to insignificant levels the risk of a criticality.
In an uncontrolled criticality event up to 1018 fissions can occur, that is 1018 (1

million, million, million) uranium atoms will split or fission. There are around
1022 atoms in every centimetre cubed of solid material. If a criticality does occur
it is only in a tiny fraction of the material present. Nevertheless, the events are
instantaneous and the radiation dose from the fission of this ‘small’ number of
nuclei can be fatal to people local (a few metres) from the event. For example,
on average 2.5 × 1018 fast neutrons are generated in a criticality chain reaction.
Many are absorbed in the system, others go onto further fission, but many
isotropically burst from the system and potentially into the operators’ working
area. The major biological safety consequence to workers is the exposure to the
fast neutron and gamma radiation.
Criticality can be a once-off instantaneous event. This disrupts the ‘critical

mass’ geometry, dispersing the uranium material stopping the event. However,
as previously noted, under some conditions, particularly with an uncontrolled,
inadequately managed, uranium solution, an event can become an oscillating
criticality. At the moment of criticality sufficient heat may be generated to
agitate the solution or cause local boiling. This disassembles the critical mass
geometry. When the solution cools, a critical mass can reassemble and trigger
a further criticality. This can carry on as a series of events, with a pulse of
neutron and gamma radiation from each. Such a series may be over minutes
but typically they extend over several hours. Since an oscillating criticality
is always a possibility (even if, by design, extremely remote), particularly
with solutions, criticality detection alarms, evacuation routes and emergency
procedure in nuclear facilities are essential to protect operators and minimise
exposure to multiple bursts of radiation. On hearing a criticality alarm the only
response for personnel is immediate evacuation to purposely allocated safe
emergency assembly points.
The design of process equipment and procedures for safe plant operations,
in any high-hazard industry no matter what the level of excellence, are only as
robust as the people that use and maintain them. In support of any plant design
and safety-management system there has to be a good organisational safety-
culture. On nuclear facilities, a strong nuclear and radiological safety-culture

has to extend from the most senior management down through the hierarchy.
The organisation has to have the fundamental belief that nuclear safety, at all
times, is the top priority above all else. Operational fuel plants do have very low
criticality risks. The assumption has to be made, however, during the design
and safety analysis, that when a plant is operational the management system,
safety procedures and safety case will be owned by the senior management,
understood and implemented with diligence. Further, there has to be a basic
assumption that the plant will be operated as the designers intended, as directed
by approved procedures and as documented in the safety case for the facility.
If these assumptions fail in practice due to a decline in safety-culture, even for
plants studiously designed to be tolerant to human errors, the consequences
can be fatal for the operator and terminal for a business. This decline in safety-
culture happened at the Tokaimura plant.
The criticality accident occurred in the Conversion Test Building which is

one of several nuclear plants on the site. Adjacent to the building were public
roads, one being 80 m away. There were private residences 110 m away giving
the potential, if an incident occurred, for exposure not only of the operators but
also local members of the public.
A key factor leading to the event was that the Tokaimura site management
had been under economic pressure for several years following electricity
deregulation within Japan. They were facing intense competition in the fuel
market requiring cost reductions and improved efficiency. Restructuring of the
organisation had been carried out resulting in around one-third of the staff
losing their jobs. This restructuring occurred without due regard to the safety
implications of removing staff from facilities. Any such safety implications
would have been revealed by the application of a management of change
procedure implemented through a robust documented management system.
The restructuring introduced large changes in working conditions and

increased the number of tasks on those workforce members who kept their
jobs. It increased the workload on individuals, introduced shift working and
job rotation. These changes resulted in an experienced worker, used to handling
Joyo fuel solution preparation, leaving the company on health grounds. This
process experience was allowed to leave the organisation.
The drive for efficiency caused the site management to become focused on
product quality, the cleanliness of process equipment (for a quality product), and
86 Safety Culture
to be very observant regarding enforcing good conventional safety. Whether this

was altruistic or identified as a means of avoiding added costs from personnel
accidents, lost production and the need to replace workers, is debatable. The
‘concern’ for conventional safety is at odds with a management that:
• readily misled the regulator regarding plant nuclear safety
• had for a facility an official nuclear safety case and unofficial safety
amendments
• condoned operational procedure violations
• adopted working procedures that had been developed but not

authorised by the regulator
• inadequately trained its operators in nuclear safety
• had a safety committee that recognised violations of operational

nuclear safety process boundaries and accepted them as not
hazardous
• had neither criticality emergency instrumentation nor an emergency

response procedure
• had no criticality emergency evacuation training for staff working

in the facility.
The work crew’s task in the Conversion Test Building on 29 September

1999 was relatively straight forwards. It was to mix triuranium octoxide (U3O8)
powder at 18.8 per cent U235 enrichment, with nitric acid to form uranyl nitrate
solution. This task would require, when implementing the approved chemical
procedure, the use of the building’s engineered pipes, pumps and vessels all
designed to ensure criticality safety. At the end of the process the solution was
to be transferred from the final vessel which was one of two buffer storage
vessels into specifically designed small-diameter shipping containers or flasks.
These flasks, which were themselves designed as geometrically safe, were then
to be taken off site to enable further processing of the nitrate into Joyo fuel.
Natural uranium, enriched to 18.8 per cent by weight U235, is hazardous

and particularly so in the presence of solutions such as nitric acid, which has
a major water component, a neutron moderator. The Conversion Test Building

equipment ensured by design and following the approved procedure that
producing 18.8 per cent uranium nitrate solution was safe. The equipment had
limited uranium mass batch size, had safe geometry vessels by design (good
neutron leakage from any spontaneous fission neutrons), and there were no
local uncontrolled reflectors. Regulatory approved procedures were in place
for using the equipment.
Even with this level of design, engineering and procedures in place, such
an infrequent, hazardous operation to produce Joyo, enriched nitrate solution,
should, if following good safety-management practice, have been subjected,
inter alia, to:
• specific safety analysis
• development of a specific safety case
• a chemical plant procedures review and update
• independent review of all documentation
• consideration of the proposed task and the supporting safety case

by an independent nuclear safety committee
• in due course the safety documentation approved by the licensee’s

senior management
• generation of appropriate permits to work
• crew training and testing for knowledge and suitability for the
task
• regulator–licensee discussion at appropriate hold points.
Implementation of procedures would then have been subjected to audit

and observation. The task would have been concluded with a safety report on
matters arising and lessons learnt. None of the above minimal steps were taken
prior to this infrequent Joyo uranium solution process being started.
88 Safety Culture
Such rigour should have been mandated through the site’s safety-
management system.
The work crew handling the Joyo task were significantly disadvantaged.
First, they were in another team’s building. The usual building team had
other tasks to complete in the building. This put some pressure on the Joyo
task crew to move their uranium nitrate solution production forwards quickly.
In addition, the Joyo work had been delayed for several hours. This was of
concern to the crew as they were expected to have nitrate solution samples
available for quality control analysis on the first day of the task. The crew also
wished to complete the campaign as soon as possible. They considered the task
as an additional burden on top of a high workload from routine missions. The
crew believed there was a need to accelerate the chemical process and make up
time to meet these various pressures.
Another disadvantage for the crew was that the last Joyo campaign, some
years before, was known to have taken several days. This seemed excessive to
the crew and time had to be recovered. Further, none of the crew had worked
on this previous campaign and they had no experience of the Joyo task process.
They routinely worked on automated facilities elsewhere on site producing
5 per cent U235-enriched material. They therefore had a mindset regarding
equipment use. It was automated and so tended to ‘look after’ the operator
regarding errors and contributed to ensuring safety. The plants were tolerant
to human error. The Joyo uranium nitrate solution process in the Conversion
Test Building was essentially ‘hands on’. The Conversion Test Building process
equipment was not automated, it had to be worked. This was novel for the
crew.
The crew’s supervisor had himself only recently had experience on plant
handling intermediate enriched material which was typically 18.8 per cent
U235 enrichment. The other crew members had no experience of working with
such material.
None of the crew had been trained in criticality safety other than to be aware
not to exceed a given batch mass of triuranium octoxide. The crew, however,
believed this was for quality control. They were unaware that it was a criticality
hazard control which if exceeded had serious safety consequences for them.
The management considered that the concept of criticality was too complex
to be part of operator training. They simply did not have this knowledge. The
crew had no concept of the dangers of accumulating uranium mass in batches
of solution. There was no understanding of criticality consequences and there

was no training given to emphasise the importance of criticality accident
prevention. Formal training on the task, equipment and the process detail was
neglected. The supervisor and the crew did, however, understand in general
the building’s equipment and chemical process.
Finally, because of the pressure on time the team did not read the official
procedure. It was difficult to understand. Nevertheless, the official, regulatory
approved, procedure was not followed anyway in the Conversion Building.
The equipment was operated by what had become custom and practice. In
summary, the crew were neither suitably qualified nor experienced to carry
out the task they had been directed to do. They themselves were ignorant of
this point.
With this background, the crew started the Joyo task. Although handling
hazardous materials, the task for the team was relatively straight forwards. This
was to mix 16.6 kg uranium as triuranium octoxide powder enriched to 18.8 per
cent by weight uranium 235 with a specific volume of nitric acid. This was to
be done in seven batches each with a criticality mass control of 2.4 kg U. They
were to ensure a homogeneous mix which was a product quality issue. Batches
would be transferred to a batch storage column. After a satisfactory clearance
of the samples by the laboratories the nitrate solution was to be drained from
the final buffer storage column into the shipping containers.
Each batch mixed was not to exceed 2.4 kg U which the criticality mass
control limit. It is not possible for this mass of material under the worst
geometrical arrangement, a sphere, that is fully water-reflected to go critical.
The equipment to be used was safe with this mass limitation. Further,
the Conversion Building equipment had been specifically designed to be
geometrically safe, up to the site licensed limit of 20 per cent enriched material.
That is, pipes and vessels were geometrically designed such that spontaneous
fission neutrons could leak from the system. The plant was design to protect
the operators; through mass control, through being geometrically safe by
design, with neutron reflection eliminated and with the operators supported
by approved operational procedures.
The Conversion Test Building was a relatively small building about 15

metres square. It was part experimental laboratory and part industrial facility. It
was considered ‘ideal’ for ad hoc tasks. Operations in such a building, because
of their novel and infrequent nature, should be under good safety-management
90 Safety Culture
control. Scrutiny should be mandated for each task through the management
system with independent oversight. This was not the case at Tokaimura.
The Conversion Test Building equipment that should have been used with
the regulatory approved procedure, to generate the Joyo nitrate solution, is
shown in Figure 2.6. The equipment in the figure has been reduced in content
for clarity. The process was to begin with the handling of the 18.8 per cent
U235 enriched triuranium octoxide powder. With appropriate radiological
protection against inhalation of uranium, the powder was to be measured as
single 2.4 kg U batches (the criticality mass control) and placed in the dissolver
tank. This was then to be followed by the addition of a measured amount of
nitric acid. The batch of solution then moved slowly though several columns.
There were solvent extraction columns, followed by stripping columns. These
columns were normally used for other uranium oxide purification tasks but
were ideal, by design, for ensuring a satisfactory quality mixing of the Joyo
product. The enriched uranyl nitrate was eventually pumped to one of two
buffer storage columns for further mixing by air sparge. This overall process
formed a single batch of 18.8 per cent enriched uranyl nitrate solution of
density 370 kg/m3. The design of the storage buffer columns was such that each
could accommodate three batches. A geometrically safe transport flask was
then positioned beneath the vessel. The uranium nitrate, when at the accepted
quality, was manually drained off into the transport flasks and eventually taken
off site. Several transport flasks would need to be filled.
An engineering difficulty with the buffer columns was that due to the
confined space, it was difficult to place the flask under vessel and enable
drainage. It could be done, but it was a time-consuming exercise.
This approved process was to be repeated until the whole 16.8 kg U of

powder was mixed making seven batches all together.
All the process vessels were designed as tall columns with small diameters.
This ensured they were geometrically safe against criticality up to 20 per cent
U235 enriched. This was the envelope of the site licence. Although the equipment
had other functions for purifying uranium oxides, it was designed for safety
and could be used for the relatively straight forward task of producing 18.8
per cent enriched uranyl nitrate. Column contents agitation systems and the
pumping sequences gave good homogenisation of the nitrate solution product.
These were safe mass conditions and the process carried through safe geometry
vessels.
Solvent extraction
Dissolution column
tank Extraction stripping Buffer
column column
U3O8 HNO3
Powder (nitric acid)
material
UO2(NO3)2
solution
Figure 2.6 A schematic, the approved process in the Conversion Test
Building
Source: U.S. Nuclear Regulatory Commission, modified by the author for this text.
In the building, as part of the equipment, there was an additional vessel. This
was a large diameter precipitation tank. It was for use on other Conversion Test
Building processes and was not part of the approved procedure for generating
the Joyo product.
The documented safety case for the use of the facilities equipment had
been approved many years earlier by the regulatory authority. However, if
the approved procedures were applied and the equipment used to process
16.8 kg U of triuranium octoxide powder, it would take several days. This was
a time frame commensurate with other Joyo campaigns. However, it did not
align with the requirement for more effective and efficient production.
Unfortunately, to improve efficiency the crew used neither the approved

procedure nor the approved equipment.
Several years earlier the company management, due to economic pressures,

recognised the need to reduce manufacturing time, reduce production costs
and lower labour costs in plant operations.
One of the first steps towards improving the efficiency of oxide work in the
Conversion Test Building was to change the approved procedure for uranium
92 Safety Culture
oxide and nitric acid mixing. It was agreed by managers and initially carried
by ‘word of mouth’ that the dissolver tank mixing stage could be bypassed
and the uranium powder mixed with nitric acid in a 10-litre stainless-steel
bucket placed on the building floor. The solution could then be poured into the
dissolver tank ready for pumping forwards into the remainder of the process.
This would reduce a 90-minute dissolver tank batch mixing task to about 20
minutes. The approach was applied over time, saving considerable operational
time for various types of oxide mixing tasks.
The concept was approved (condoned) by the manufacturing department

and the quality department management. However, the safety department
was never consulted. Further, the site’s safety committee was aware of this
informal modification, recognised the violation of procedures but did not
regard the violation as dangerous as the criticality mass limits were always
clearly identified. (The interface between the safety committee and the safety
department management remains unclear.)
There was no independent nuclear safety committee to give a view.
What became common practice, the by-passing of the dissolver tank powder
mixing step, was put into an informal procedure and printed for use on all
mixing tasks in the building. It was adopted over several years. This violation
of the process safety case was management-condoned. The regulator was not
informed and the change never approved. (This, of course, brings into question
the effectiveness of the site’s internal or external procedures for auditing.)
A criticality incident did not occur following this change. The various
task criticality mass controls imposed on material handling in the building
continued to be followed by the operators. The approved equipment used after
any mixing operation in a bucket was geometrically safe.
The Joyo task crew were aware of the dissolver tank bypass practice.
A year or so later, following the ‘success’ of the dissolver tank powder

mixing bypass, a further unauthorised process procedure change was made.
It was considered by managers unnecessarily time-consuming on some

uranyl nitrate solution tasks to take the solution from the stainless-steel bucket
and pour it already mixed into the dissolver tank. From this point it then took a
considerable time to reach a buffer storage column. To reach these vessels, the
nitrate solution had to pass through the solvent extraction columns, stripping
columns, and through pumps and pipe work (Figure 2.6).
A decision was made to take the solution from the stainless-steel bucket,
in small aliquots using the glass beaker, and pour it directly into the buffer
storage columns. This bypassed all the engineered equipment except the buffer
storage columns. It was judged that sufficient additional product mixing could
be achieved in the buffer columns using the vessels’ air sparge systems. With
experience in implementing this second process change, the sampled solutions
appeared to be homogeneous, be of good quality and going directly into the
buffer storage columns saved up to three hours on a nitrate batch run. This was
a significant increase in productivity meeting the site management’s drive for
efficiencies.
This column bypass and direct solution discharge into the buffer columns
became part of the informal procedure that was already bypassing the
dissolver tank. The safety case was not changed. Again an independent nuclear
safety committee was not engaged nor the regulator informed. The site safety
committee was aware and condoned this additional violation. Although the
change was adopted over several years for uranium powder mixing tasks, a
criticality event did not occur. The operators continued to comply with the safe
mass instruction in the informal procedures for mixing uranium and nitric acid
material in the bucket. The buffer columns remained by design, criticality safe
up to 20 per cent U235 enriched material.
At this point, and developed over several years, there were several internally
known, management condoned, safety case violations:
• mixing radioactive uranium material in an open stainless-steel

bucket where there was an opportunity for inhalation by the crew
members
• adopting ad hoc acid handling methods
• bypassing the dissolver tank uranium powder and acid mixing

equipment
• bypassing the mixing columns
• pouring uranyl nitrate solution directly into the buffer storage

columns
94 Safety Culture
• adopting unapproved procedures
• ignoring the approved process procedure.
The crew carrying out the Joyo task on 29 September 1999 were aware of all
these bypass options. They were documented in the informal building procedure
used for the Joyo task. They were used on other tasks in the Conversion Test
Building and the procedure was easy to understand and easy to implement.
(The plant engineering was such that the bypasses were relatively easy to
implement. This is a design safety issue but outside the scope of this text.)
On the fatal days of 29 and 30 September the Joyo task crew added a final
contravention to the approved operating procedure, causing a major criticality
event. The engineered equipment and procedural defence in depth, put in
place to reduce the risk of a criticality event for the operators, the public and
the asset, were finally and completely defeated by the crew.
Following custom and practice, the nitrosyl mixing was to be done using the
unapproved process route and bypassing the plant except the buffer columns.
However, before starting the task the crew had been considering additional
ways to save more time in the task. This proved to be fatal.
To the crew it seemed to be time wasting to mix 2.4 kg U batches in the

bucket then pour them into a buffer storage column. The vessel had to be
drained to a transport flask then the mixing and pouring task repeated. Also, as
noted, it was quite difficult to drain the solution from a buffer storage column
into the transport flasks due to the inadequacy of engineered attaching system
located beneath each column. The crew decided before starting the task that
instead of using the buffer columns they would use the precipitation tank in
the building. This was ‘ideal’. The tank had a large diameter and volume, could
take all the batches and had a mixer paddle. It had an easily removable access
port at the top (an engineering design safety issue) and there was easy access
to the base fittings for connecting transport flasks (a common fittings design
safety issue). The use of this tank was discussed ahead of the task with the
quality department management. The management, concerned only about the
product quality, was content that if the precipitation tank was carefully cleaned
its use would be a satisfactory for mixing the powder and nitric acid. The quality
department managers had no expertise in criticality. They did, however, have a
mental model, that if the a 2.4 kg U batch size was used for the mass control and
the uranium remained in solution there would be no safety implications. As far
as is known, only the task crew and the quality department where involved
in this decision to use the precipitation tank in the revised Joyo process. The
intent was now to bypass in its totality all the building’s engineered equipment
including the geometrically safe buffer storage columns. Each 2.4 kg U nitrate
batch mixed in the stainless-steel bucket, one after the other, would all be
poured into the precipitation tank.
Figure 2.7 The unapproved process using the precipitation tank

Source: Los Alamos National Laboratories.
The revised unapproved process route is given in Figure 2.7. The

precipitation tank would eventually hold 16.8 kg U in acid solution. No safety
analysis was considered for this additional modification to the process and
the decision to use the tank was a direct violation of the regulatory approved
safety case for the Conversion Test Building equipment. The decision to use
this precipitation tank would reduce a three-hour mixing task to 30 minutes.
At this point it is important to note that the critical mass of U3O8 in a spherical
geometry and fully water reflected (leaking neutrons bounce back into the
system) is about 6.5 kg U. This is a sphere approximately of 100 millimetres
diameter. One stainless-steel bucket contains 2.4 kg U in solution. In the worst
geometry and fully water reflected the sphere would be about 75 millimetres in
diameter; 2.4 kg U is sub-critical even with optimum reflection that is, totally
surrounded by water. As more batches are accumulated and the total mass
of uranium is accumulating, how and where the batches are stored before
discharge to the transport flasks becomes very important. The buffer storage
columns were acceptable as they were geometrically safe. However, the crew
making the additional procedure violation intended to use the unsafe geometry
precipitation tank for the final mixing and storage of the full 16.8 kg U enriched
mass of uranium, this is just over two and a half critical masses. This decision
was taken with a total lack of criticality safety knowledge.
96 Safety Culture
To be geometrically safe the buffer storage columns (and other vessels in

the approved system) had been designed to be 0.17 m diameter (and 2.2 m
high). They were tall and thin. The small diameter ensured neutron leakage
from the system. However, the precipitation tank was 0.45 m diameter and
approximately 0.6 m in depth (Figure 2.8). It had a dished base and a liquid
capacity of around 100 litres. Because the precipitation tank was used for other
chemical processes that generated heat, it was surrounded by a 0.025 m thick
water cooling jacket. This tank was not geometrically safe for 18.8 per cent
enriched material and had by default a neutron reflector around it, the water
jacket.
On 29 September 2009, the crew commenced their Joyo task by obtaining

a 10-litre stainless-steel bucket and a 5-litre glass small, aliquot, transfer vessel
(similar to the type used in a chemical laboratory). To avoid any product
contamination the equipment was cleaned, since quality was a priority for the
organisation. Ignoring all the available mixing equipment, the dissolution tank,
downstream mixing columns and the buffer storage columns, the operators
carefully measured out into the bucket the first batch of 2.4 kg of U3O8 powder,
18.8 per cent by weight enriched with U235. At this point there is a highly
hazardous material in a domestic bucket. (Handling uranium powder in this
way has serious inhalation health, radiological and contamination implications,
but these will not be pursued.)
A small quantity of pure water was carefully measured, added to the powder
and mixed to a smooth paste. This was followed by the careful measuring of
6.5 litres of nitric acid into the bucket and the contents manually stirred. By this
means one batch of 2.4 kg U material was made into an initial mix of uranium
18.8 per cent enriched uranium uranyl nitrate solution. This was poured, using
the funnel to avoid spillage, into the precipitation tank. Following further
mixing with the vessels mechanically driven paddles, the next batch of bucket
solution was added.
The first batch took about one hour to produce and the task was to make
up 16.8 kg U in total. This would require seven batches to be prepared and then
one after the other poured into the precipitation tank for additional mixing.
This task would go through the afternoon and into the next day.
By the end of the days shift on 29 September 1999, four batches, or 9.6 kg
U, of U3O8 had been made and the solution poured into the precipitation tank.
Noting that the critical mass, in a worst geometry and fully reflected, is about
6.5 kg U, the mass from four batches was outside the safe operating envelope
of the facilities safety case. However, there was no criticality event. The
uranium was dispersed in the solution and not in its worst geometrical shape
arrangement. The crew finished the day’s work after the fourth batch, switched
off the mixer paddle and went home. Switching off the paddle is considered as
a possible physical contributor to the eventual criticality event.
Figure 2.8 The precipitation tank

Source: Los Alamos National laboratory.
During the following morning, the crew continued working by mixing the
remaining three nitrate solution batches in the stainless-steel bucket and doing
transfers to the precipitation tank. At 10.35 a.m. the seventh and final batch was
poured into the precipitation tank. It now contained 16.8 kg U (over two and
a half critical masses) of U3O8. With the pouring into the vessel of the seventh
batch, a criticality event occurred (Figure 2.5). It instantaneously delivered
98 Safety Culture
huge doses of neutron and gamma radiation to operators ‘A’ and ‘B’ local to
the vessel (Figure 2.9). The supervisor ‘C’, who was about four metres distance
away, received a much lower radiation dose.
Figure 2.9 A schematic of the operators’ locations during the criticality

event
Source: The International Atomic Energy Agency.
The operator ‘A’, holding the funnel, received a fatal dose of neutron
and gamma radiation and died 82 days later. Operator ‘B’ pouring the liquid
received a lower but fatal radiation dose and died 210 days later. The supervisor
‘C’ received a lower but very significant radiation dose and survived. However,
he is likely to receive continuing medical attention and observation for many
years.
The physical causes of the criticality are associated with the unsafe geometry
of the precipitation tank, excess uranium mass and neutron reflection by the
vessel’s water jacket. When the operators switched off the tank’s mixing paddle
and left the material to stand over the night of 29th and early morning of 30th
September, it is believed that solid uranium nitrate precipitated or crystallised
out of solution. This formed a mass geometry conducive to a criticality in
the domed base of the vessel. Adding more uranium to the vessel from the
seventh batch contributed to the formation of a critical mass. The vessel was
also geometrically unsafe. There was limited neutron leakage from the system
and this was further aggravated by any naturally occurring spontaneous
fission neutrons being reflecting back into the system from the water in the
cooling jacket. Neutrons from any initiated fissions were also reflected back
into the solution causing, under the right uranium mass conditions, the full
development of a chain reaction, the criticality.
This particular criticality event became an oscillating criticality lasting over

20 hours. The oscillations were caused by the initial critical mass being disperse
due to local liquid boiling at the point of criticality. When cooling occurred over
several hours the critical mass reassembled, in the bottom dome of the vessel,
and another criticality then occurred. The oscillations were eventually brought
under control by the emergency services and off site specialists disrupting the
reactions in the precipitation tank.
From the initial criticality not only were the task crew and some employees
local to the plant irradiated, but also public residents adjacent to the site.
These were low-dose exposures but above what would be accumulated in the
same period of exposure from background radiation, (long-term health effects
would not be expected). People up to 10 km from the plant were advised, by
the authorities, to remain indoors as it was unclear whether fission products
(Figure 2.5), had become airborne. (This may appear in retrospect to be an over
reaction. However, at the time it was a sound, conservative decision in the face
of uncertainty.)
Because the Conversion Building had no criticality detection

instrumentation, the Tokaimura site management were unaware a criticality
had occurred. The assumption was that the plant was designed to be safe against
criticality and required no alarms. It appears this status was not periodically
reviewed. The event was initially recorded on instruments at a research
laboratory some 2 km away as a spike in radiation. Clearly it was evident to
the Tokaimura management something had gone dramatically wrong as they
were dealing with delirious people from the building, and higher than normal
gamma dose rates were being recorded outside the plant.
There was no trained emergency procedure in place to deal with the event
and the criticality was eventually brought under control by the local fire service
and drafted in specialists and experts. Some service personnel where exposed
100 Safety Culture
to radiation above normal background but not considered to be a long-term

health hazard.
This accident appears to be straight forwards operator error. Poor safety-

behaviours by the operators caused two fatalities and the exposure of others
to higher than normal radiation levels. There was nothing fundamentally
wrong with the approved equipment design (although there could have been
significant improvements, but this is not in the scope of this text). Although it
could have been significantly improved to modern standards there was some
engineered defence in depth. This, however, is academic, as the engineered
equipment, except for the precipitation tank, was not used at all. On the other
hand it may not have been operator error. The operators ‘A’ and ‘B’, who had
no management function, may have carried out their tasks to the best of their
ability, with no training and within the cultural environment in which they had
to work. The culpability of the supervisor ‘C’ in a management role is perhaps
another issue.
The application of the generic model, Chapter 1 of this text, may demonstrate
that it was inappropriate shared organisational safety-beliefs that shaped
manager’s behaviours. These beliefs were cascaded to the plant operators,
becoming fundamental to the event occurring. The operators were, it may be
suggested, the victims of a poor management safety-culture.
In assessing the beliefs and behaviours it is necessary to consider perhaps

Japanese culture. There is a culture of deference in Japan to people who are
senior or older. Here deference is very much a sign of respect for people with
knowledge and authority who culturally are recognised as having, inter alia,
a nurturing role for others. This is considered to be a positive cultural trait
in Japan. Deference is a feature of life in general and carries over into the
workplace. This may influence an individual’s willingness to question and
challenge if they feel unsure about a senior persons decisions. Further, the
company was under economic pressure. Major restructuring had occurred
and people had lost their jobs. For a small town community this is serious.
The possibility that the site operated a ‘fear culture’, even if not overt, has
to be considered. This could have been a contributor to inhibiting safety
challenges in addition to the concept of deference acting as an inhibitor.
Economic pressures, deference and a fear culture could contribute to shaping
the organisational and individual beliefs, many of which were detrimental to
nuclear safety.
The safety-culture generic model suggests that shared beliefs and values
of an organisation are shaped by the senior management. The culture is
cascaded by other layers of management to the workforce. The safety-beliefs
of the workforce will be influenced by this shaping. They can, in addition, be
modified if a local workforce has a strong subculture. The Joyo task crew had
possibly developed a strong subculture and generated group safety-beliefs that
exacerbated the situation.
There are therefore two groups to consider: the management and the
workforce.
It is worth considering what should be the overarching safety-belief of any

licensed nuclear site organisation. This is broadly embedded in the definition
of safety-culture in Appendix I. Under all situations, from facility design,
commissioning, operation and decommissioning of a high-hazard nuclear
facility, nuclear and radiological safety has to be the top priority. In essence, if
the business cannot achieve this then the licence should be withdrawn and the
site no longer permitted to operate, irrespective of the businesses and economic
implications.
From the evidence accumulated by many Tokaimura event inquiries,

the shared, deep–seated organisational beliefs promulgated by the senior
management did not have nuclear safety as the top priority. Analyses of the
accident in various sources suggest:
Beliefs (managers)
• Production and efficiency and profit were the top priority
• Quality of the product was essential
• Responding to the customer was essential irrespective of timescale

demands being in conflict with nuclear safety
• There was a strong belief that the workforce were not capable of
being trained in criticality safety
• There was a belief that the workforce need not be engaged in safety
decisions
102 Safety Culture
• There was a belief that it was acceptable to break the legal requirement
to inform the regulator of significant changes to plant or process
• It was believed that violating regulatory approved safety and

process procedures (legal documents) was acceptable
• There was a belief at all management levels that they had the correct
model of criticality, that is, mass control is all that is required
• All the Conversion Test Building equipment was believed to be

inherently safe by mass control
• There was a belief (speculative) that the regulator, if informed

on safety modifications, could inhibit business efficiency and
productivity.
Espoused values
Although somewhat speculative, it can be inferred that the espoused values

reinforced the beliefs. Some values were probably:
• Emphasis at senior meetings on productivity and efficiency as a

value
• Emphasis verbally placed on the importance and value of quality
• Minimal emphasis on nuclear and radiological safety (speculative);

not valued as a priority
• The organisational restructuring valued for business survival
• Tasks carried out to identify and reduce time in production to

improve efficiency, irrespective of the safety implications, being
valued
• Delays to assess safety in changed operations was possibly not

verbally encouraged nor valued
• Challenge was probably not valued; verbally and through body

language the workforce was made aware of this
• The safety committee espousing its acceptance of procedural

violations in the Conversion Test Building, and challenge to such
decisions probably not appreciated nor valued at committee, which
may possibly have had ‘group think’
• A ‘grape vine’ of information as to the acceptance of bypassing the

plant in the Conversion Test Building as this behaviour improved
efficiency and was behaviour-management valued
• The importance of nuclear and radiological safety was not

communicated by management directly or through training, as a
highly value feature of good business
• Attention to industrial safety valued to the point that it was

institutionalised.
Attitudes
There is some speculation on the management’s attitude towards nuclear and

radiological safety. This has not been documented but attitudes were possibly:
• Complacent or non-questioning by managers in their understanding

of criticality safety
• Of contentment arising from the use, for many years and familiarity
with, the site’s plant and their processes
• Of not responding readily to, or responding negatively to, safety

challenges
• Convinced and dismissive of safety issues, as they saw the

Conversion Building as inherently safe
• Dismissive to the regulator (speculative)
• Dismissive of the capabilities of the workforce in learning technical

issues
• A dominating management (speculative), reinforcing a ‘fear’

culture and stifling dissent towards production taking precedence
over safety
104 Safety Culture
• Reckless in permitting novel/infrequent tasks with fissile nuclear

materials to be carried out with unapproved procedures (this attitude
was not constrained by an effective safety-management system)
• Arrogant in having what they thought was the correct model for all
criticality scenarios (this attitude was demonstrated in particular by
the safety committee).
Artefacts
• The site had a weak safety management system
• The written approved procedures were ignored
• Ad hoc written procedures emerged and were circulated
• Written procedures appeared to be inadequately audited
• A robust management of change procedure was not applied during

restructuring
• There was inadequate procedure for infrequent ‘novel’ chemical

processes
• There were inadequate procedures for independent analysis of

infrequent novel processes
• The management system did not appear to be systematically

reviewed by senior management to determine if, as a management
team, they were controlling risks and managing safety.
Resulting behaviours (managers)
The business beliefs of the senior managers were cascaded down the
organisation. The belief was that production and quality are the priority in
the interests of business survival. This overwhelmed any founding beliefs in
nuclear and radiological safety. There was a lack of rigour and discipline in
human behaviours and lack of robustness in the documented risk management
structure. The beliefs were supported by the line management, the safety
committee and supported at the workforce level. This poor culture expressed
itself through management behaviours, the consequences of which exposed an

untrained workforce to significant risk.
At Tokaimura there were inappropriate beliefs, values and behaviours.

This, it is suggested, shaped a poor safety-culture and working environment.
Using the generic model of safety-culture, the observed behaviours of
managers arose from shared deep-seated beliefs and assumptions. These
were orientated towards profitability and business survival. There had been
a loss of questioning attitude and a loss in the belief that nuclear safety is the
top priority in operations. The change of belief and behaviours developed
over several years. The changes achieved ‘success’ for the business, became
behavioural norms, were reinforced by espoused values and were embedded
in the informal artefacts, the unapproved procedures.
The behaviours of the senior managers and managers generally can be

observed to be:
• Management-imposed pressure on the organisation to improve

productivity and efficiency without assessing the nuclear safety
implications of reducing the numbers of workers, stress effects of
shift working and loss of process experience
• An overt disregard of physically improving or systematically

addressing nuclear and radiological safety for novel processes
• Openly permitting violations of the safety case and the safety-

management procedures
• A failure to intervene by senior management to stop and discourage

procedural violations
• Not investing time, effort and resources in adequate training
• A failure to invest in the analysis of plant-engineering modifications

to ensure violations could not occur
• Not analysing or investing in emergency preparedness or equipment
• Purposely acting to ignore or bypass the fundamental requirements

of a regulator
106 Safety Culture
• Purposefully misleading the regulator
• Implementing unapproved documentation
• Possibly (speculation) encouraging a ‘fear culture’ by threats and

‘examples’.
These behaviours eventually resulted in the Tokaimura accident. There was

the unnecessary loss of two lives, the exposure to radiation of numerous other
workers, members of the public and of the external emergency services.
All the antecedents were in place, due to poor organisational safety-

behaviours, for a criticality event to eventually manifest itself.
In the Tokaimura event, there is a need to consider the culture of the Joyo
task crew. They were the people who made the final violation causing the
criticality event. A judgement has to be made as to whether this behaviour
was reckless or arising from the organisations and their own shared beliefs in
attempting to do a ‘good job’.
Beliefs (the task crew)
Mass control was a quality issue for each batch of material produced (it was not
recognised as a criticality control, of this they had no knowledge):
• Placing batches of solutions together was not considered a hazard
• They did not need to know about criticality; this was an issue
addressed by others on their behalf (for example through the
written chemical process procedures)
• Completing the Joyo task quickly would show efficiency and enable
them to return to their routine missions
• They believed hold-ups in starting the task where a serious problem

(as solutions samples were needed quickly for the laboratories to
assess nitrate product quality)
• They believed they had to look for additional time savings because
of the supervisor’s pressure on task time
• Believed the use of the (geometrically safe) buffer storage

columns was inefficient and the process throughput time could be
improved
• Believed the modified unapproved procedures were the ‘Company

Procedures’ that were to be followed
• Firmly believed the use of the precipitation tank would solve many
problems, save time, show improved efficiency, meet the time
pressures, give good homogeneity of product (using the mixer paddle
mechanism), and enable efficient filling of the transport flasks
• Had a deep-seated belief (speculative) that their jobs were in

jeopardy if they failed to generally demonstrate good performance
– a fear culture
• Strongly believed they had knowledge and understanding of what

they were doing by following the unauthorised procedure
• Supported (speculative) the senior management’s efficiency drive

to protect the business
• Believed plant cleanliness was essential for product quality.
Espoused values
These are not known other than perhaps indirectly. They:
• Did have concerns about time delays and (valued) the need to
reduce the Joyo task time
• Valued any options to reduce the tasks timeframe. They possibly

espoused these values as a self-supporting, self-reinforcing subgroup
• Possibly valued saving time on the Joyo task so as to return the

Conversion Test Building to the building’s usual operators. This
was possibly espoused within the group, reinforcing the value
• Possibly overtly espoused support for the senior management’s

need for efficiency in tasks (the consequence of a fear culture,
speculative)
108 Safety Culture
• Did not value the Joyo task as they saw it as additional work on an
already full work-load
• Valued returning to their normal routine missions quickly as they had

completion timescales (efficiency pressure, fear culture perhaps).
Attitudes
• Urgency, a need to move forwards quickly with the task
• Confidence that they knew the safety issues associated with the
task
• Possibly feeling collectively ‘pleased’ at having suggested using the

precipitation tank to save additional task time.
Artefacts
• Formal procedure ignored
• Informal procedure used
• Appeared to be no artefacts available in the facility visually

indicating to operators the need for precautions against radiological
or nuclear hazards from misuse of plant
• Failure to give training artefacts to the crew – booklets, posters,

information on criticality hazards
• No specific precautionary warnings on the precipitation tank

regarding over-batching and possible criticality hazards due to its
unsafe geometry.
Resulting behaviours of the crew
• Did not read the approved procedure for producing uranyl nitrate
solution
• (possibly unknowingly) violated the formal, approved operating

procedure by adopting the precipitation tank for uranyl nitrate
mixing and storage
• Applied, without challenge, the previously adopted informal

procedure for mixing the solution in a bucket (as directed) in
violation of the formal approved procedure
• Paid close attention to quality through cleanliness of equipment

and carefully measuring the material to the required mass control
(believed procedure to be a quality control matter)
• Made every effort to be efficient and save time
• With management approval completely bypassed all the safe

geometry equipment for safely producing 18.8 per cent U235
enriched uranyl nitrate solution.
The shared organisational beliefs, and the beliefs and values of the crew
expressed through behaviours, were major factors in the criticality event
occurring. The crew never appeared to challenge the use of the unapproved
procedure, or stop as a group to think about the implications of using the
precipitation tank. However, in mitigation, their own poor safety-culture was
shaped and constrained by the management culture and imposed working
environment. Finally, they were not trained for the task they had to do. This,
and their lack of knowledge of criticality, were antecedents over which they
had no control.
A Panoramic Wet Source Irradiator Event
In 2004 an event occurred in a gamma irradiator facility in Puerto Rico. Two

operators were about to enter an irradiator room where unshielded gamma-
radiation-emitting radioactive isotopes were housed. The radiation field, even
at tens of metres distance from the isotope sources, was intense. The operators
accessed an adjacent area and were moving towards the irradiator room. They
were a few steps away from entering the intense field when they were saved
by just good luck. If they had entered the field they would have received,
within seconds, lethal doses of ionising radiation. To be saved from a lethal
radiation dose by ‘good luck’, when the facility had engineered-operator-
protection and procedures, could be indicative of a facility whose staff had a
poor organisational safety-culture.
(Gamma radiation is electromagnetic waves, similar to X-rays, but with a

shorter wavelength. Gamma is far more penetrating into matter than X-rays.)
110 Safety Culture
The safety-culture generic model can be adopted to consider the staff’s

safety-behaviours leading up to the incident and speculate if shared safety-
beliefs influenced these behaviours. The cause of the event may have been
an unfortunate human error. Alternatively, the model may suggest the event
occurred due to a degradation of the organisational safety-culture. For a high
hazard facility, the belief that the protection of all employees from high radiation
fields is the top priority may have been replaced by other beliefs. This belief
change may have modified employees’ safety-behaviours into such reckless
state that the resulting human-performance almost had fatal consequences.
The irradiator facility’s gamma sources were cobalt-60 (cobalt-60 is a

manufactured radioactive isotope of naturally occurring cobalt). They were
physically small and held in thin-walled steel containers approximately
420 mm long and 12.7 mm in diameter. The containers were sealed and
because of their shape are termed ‘pencil’ sources. Two relatively small racks
held a total of around 70 pencils. When the irradiator was operational the racks
simultaneously moved vertically up and down gantry rails. The two racks
were referred to generically as ‘the rack’. The radioactive sources emit intense
isotropic radiation giving panoramic gamma radiation exposure to any items
placed before the irradiator. The radiation intensity was such that if a person
was exposed to the sources they could receive within seconds a fatal radiation
dose. Although irradiator facilities are high-hazard they are designed to be very
low-risk for the operators. They are straightforward to operate and relatively
easy to design and engineer. Because of the high gamma radiation from the
unshielded sources, the irradiation room was surrounded by thick concrete
shield walls and roof. This was to protect the operators from radiation as they
move around the control room and other plant areas outside the irradiation
room. Due to the exceptionally high gamma field there was no access to the
irradiator room when it was operation. When access was required this was
through heavy steel shield doors. These doors were closed and locked during
irradiator operations. They were made from relatively thick steel that acts as
gamma ray shielding. These facilities are designed with other safety features
including computer controls, instrumentation and automatic door interlocks.
The task of irradiating products is usually automated.
When not in operation there was safe storage location for the source rack.
This was a 3 m long by 2 m wide, 6 m deep water pool. The water acted as a
gamma shield when the sources rack was located on the pool floor. With the
rack at the bottom of the pool, the gamma radiation dose rates in the irradiator
room were negligible, enabling access for maintenance task.
The Puerto Rico irradiator was owned by an American Health Care

Company which had significant international prestige and capability. The
gamma irradiator process was used to sterilise medical equipment prior to
shipping to customers. The plant was under the authority of the USA regulators
and was licensed.
A schematic plan of the Puerto Rico facility is shown in Figure 2.10.
Figure 2.10 A schematic plan of the irradiator facility

Source: U.S. Nuclear Regulatory Commission, modified by the author for this text.
Gamma radiation sterilization of products was a simple process. In the

loading bay a hanging carrier conveyer was manually loaded with medical
products. The loading (and unloading) bay was located near the interim area
(Figure 2.10). With the conveyer loaded the programmable logic computer
(PLC) was activated and the automated irradiation process commenced. The
PLC system analysed instrumentation data to ensure that before the source
racks were lifted from the pool and unshielded, all the access doors to the
interim area and the maze door to the irradiator room were locked. Checks and
procedure were applied to ensure no personnel were trapped in the facility.
112 Safety Culture
There were emergency override buttons and internal lock overrides inside the
facility should somebody find themselves inadvertently locked in the plant.
Having completed the preliminary checks the PLC would open the
interim area entry barrier door and the loaded conveyer belt would take the
medical equipment products around the interim area and into the irradiator
room. Once the product was in the room, and with the assurance that all the
access doors were interlocked, the PLC would raise the sources rack. The rack
emerged vertically from the pool into the irradiator room. At this process stage
the rack was located unshielded above the pool surface. The medical products
were panoramically exposed to high levels of intense gamma radiation for an
assigned time. On completion of the task the PLC automatically returned the
source rack to its storage position at the bottom of the pool providing six metres
of water-shielding.
After checking that the various rack position limit switches were signalling the
correct data and being assured that the source rack was safely in the pool and
shielded, the PLC released the interim area exit barrier door lock. The sterilised
product was conveyed through the interim area and into the unloading area
where the product was removed manually from the conveyer and made ready
for shipping off site to clients. The cycle was then complete and all access door
locks released.
This is a simple and effective system but because of the intense gamma
radiation it is hazardous. However, such facilities are engineered with defences
to protect the operators and minimise radiological safety risks.
The Puerto Rico facility has several safety features. The building’s irradiator
room and interim area had a combined length of about 24 m and the rooms were
about 14 m wide. To protect the operators outside these rooms from the gamma
radiation the plant walls and roof were over 2 m thick reinforced concrete. This
ensured gamma dose rates outside the rooms, in the operating areas, were
within design criteria when the product was being irradiated. The doors into
the facility were steel, typically 150 mm thick; this attenuated any radiation
scattering down the maze or into the interim area from the unshielded sources
when raised from the pool in the irradiator room.
The primary role of the six-metre-deep safe storage pool was to water
shield the rack when it was located on the pool floor. With the sources in this
location the irradiator room gamma dose rates were negligible and operators
and maintenance teams could safely access to the maze, the irradiator room
and the interim area.
If the rack was lifted to the surface of the pool the sources were by design
unshielded so they could do the task of irradiating the medical products. The
sources were highly radioactive and could deliver a massive lethal gamma
radiation to a human being within seconds. With such facilities the protection
of the operator from high-radiation fields has to be the primary focus at all
times in design and operation. The operator has to be prevented from entering
the interim area and the irradiator room when the unshielded rack is present.
To prevent access during irradiator operation, the door interlock system, the
instrumentation and the procedures have to function as designed at all times.
The Puerto Rico plant had engineered ‘defence in depth’ equipment to protect
against inadvertent entry into the irradiator room during normal operations.
The plant had a control room adjacent to the maze entrance (Figure 2.10).
This housed the PLC for controlling the product irradiation processes. The PLC
was fitted with various safety instruments and warning lights.
The PLC automatically initiated door interlocks and initiated the product
conveyor movements. It also automatically raised and lowered the rack from
the pool. As an additional safety defence the sources rack lifting system had
been designed such that if there was any identified fault on the rack position
limit switches, located on the gantry rails, the rack would automatically fail-
safe and be driven down to the pool floor as a precaution. The limit switches
were termed the ‘rack up’ and a ‘rack down’ limit switch. These informed the
PLC of the location of the rack, whether shielded at the bottom of the pool or
raised and unshielded in the irradiator room. The automatic lowering of the
rack under switch fault conditions was a designed ‘inherently safe’ feature of
the rack’s operation. The PLC could interrogate the switch data information
and any failure of switches to close or to open or, if they contradicted the PLC’s
expectations, the rack descended to the safe position on the pool floor. The
managers and operators were fully aware of this safety feature.
The plant was fitted inside the irradiator room with gamma ray detector
heads called the L110 probe which was a set of Geiger counters. The electronics
for interpreting the L110 device signals where in a unit located on the wall
in the control room. This was referred to as the L118 monitor. If the source
was unshielded in the irradiator room the gamma detector heads sent a read
out signal and an audible alarm to the L118 unit. Unfortunately in the design
114 Safety Culture
concept, if the irradiator source was unshielded the L110 detectors could
overload and potentially damage the electronics of the L118 unit. To protect
the L118, when the source was unshielded, the L110 gamma detector was
electronically disengaged from the L118. There was therefore no permanent
irradiator room gamma radiation level information for the operators when the
source was unshielded above the pool. The read out information and audible
warning could however, be activated by a switch located on the L118 unit. The
L110 data could also be accessed and the electronics re-engaged by a switch on
the PLC console panel. This would then give a reading of the gamma levels in
the irradiator room. Due to inadequate training, some operators on the plant
believed that with the sources unshielded the L118 was never functional and
they did not understand that the L118 could be interrogated from the PLC
console or by the switch associated with the L118 unit. The L118 was thought to
only come into action when the racks were shielded. That is, by pressing a test
button on the L118 it would indicate there was no gamma radiation field. This
was a null signal decision system. If the L118 was giving a null signal the maze
interlocked door could then be opened. This system appeared to be of poor
design, inadequate as a positive gamma detection information system and not
fully understood by all the operators.
As a further safeguard the rack gantry was fitted with a ‘source travel
alarm’. This alarm indicated rack movement and positioning. If the rack was
at the bottom of the pool with the bottom switch closed this alarm stopped.
There was also a ‘rack fault indicator’ which warned if the PLC was receiving
a rack limit switch contradiction. This was a warning to the operators that the
rack may not be in its shielded position at the bottom of the pool. A ‘rack fault
indicator’ arose when the PLC interrogated the behaviour of the source rack and
determined whether it was shielded. When shielded the PLC should receive a
rack ‘down switch’ closure signal. Alternatively, if the rack is unshielded, that
is out of the pool, the PLC receives a closed signal from the ‘up switch’ with
the ‘down switch’ now signalling open. Any fault or contradiction between the
signals, for example both switches open yet one should be closed, then the rack
automatically fails safe and is driven down to the storage pool floor.
For the door interlocks to be released the gantry bottom switch has to be
closed and the top switch open. This was one of several indications to the
operators that the source is in the pool and shielded.
In the event of a stuck rack there was a ‘stuck rack’ approved emergency
recovery procedure to be implemented. A signal at the control panel from the
‘source travel alarm’ (that is, the rack is not moving but is somewhere between
the two switches) plus a signal from the ‘rack fault indicator’ would initiate the
emergency procedure.
The final safeguard was that that before the PLC could initiate the irradiation
processes all access doors were interlocked. This was initiated by the L118 unit
identifying high gamma radiation then, as noted above, it disengaged from
the monitor L110. With the interlocks in place the maze door could only be
physically opened from inside the maze. This was not the case for the interim
room exit barrier door. Its interlocks could be bypassed and the door opened
from the loading bay even if the irradiator was unshielded above the pool.
If entry was made to the irradiator room, operators had available hand-held
gamma-detector monitoring equipment. The use of pocket gamma dosimeters
was mandatory for entry.
The plant procedures generally were ad hoc and not within an integrated
management systems. Manufacturing had separate operational and auditing
procedures from the safety procedures. The safety procedures were not
independently audited nor was there any scrutiny of the plant’s safety-
performance. The radiation safety officer (RSO) was responsible for designing
the safety enhancement programme and safety survey monitoring but there
was no independent oversight of either of these tasks.
The plant did have safety procedures in which the operators were initially
trained. However, refreshers were inadequate as re-qualification courses for safe
plant operations. The safety-performance of staff was not annually reviewed.
Emergency procedures were exercised. However, the same scenario was
repeated every year. There were several different plant emergency possibilities
but these were not exercised. Although perhaps speculative, it would appear
that the minimum documentation was produced and the emergency exercises
done only to meet licensing requirements. Inquiries after the event strongly
suggest that the safety documentation was of poor quality. A robust safety-
management system was not embraced by the management as an important
tool contributing to risk management.
During irradiator operations the radiation safety officer or an assistant

RSO was in attendance. The RSO had 20 years experience with the facility. An
operations supervisor was normally on duty and the supervisors had many
years of service. With maintenance personnel, operators, senior managers and
116 Safety Culture
the plant manager, there was a team of about 25 people on each shift. The plant
operated three shifts with a shift handover period. The facility operated seven
days a week as there was a production schedule to meet which was managed
by the manufacturing director.
The Puerto Rico irradiator facility came into operation in 1983. It had been
plagued for many years with source rack position switch problems. Matters
became worse in 2001 when the plant’s original relay control console was
replaced by a computer-based PLC system. There were repeated problems
with the PLC along with wiring, cables and switches. Over a two-year period
there had been many recorded switch repairs. All repairs to the ‘up’ and ‘down’
switches required the irradiator to be closed down, the sources rack to be
shielded in the pool and personnel access made into the irradiator room.
If the PLC identified rack switch faults, the ‘rack stuck’ emergency procedure
was implemented. This arose because the door interlocks remained in place
and entry to the plant was not possible. To gain entry required bypassing
the safety systems. As part of the procedure and before entry was permitted
various external radiation monitoring surveys were carried out. Checking the
rack rope housings for the extent of rope run and interrogating the control
panel was carried out. The L118 radiation readings were checked using the
test button to test if the L118 was engaged as this would indicate low gamma
radiation in the irradiation room. Finally entry would be authorised by the
RSO or assistant RSO. Access was then achieved by over riding the barrier
door interlocks (Figure 2.10). This was permitted by the approved emergency
procedure. Pocket dose-metres were issued to maintenance staff and controlled
entry was made holding radiation monitors as an additional precaution.
Experience showed that after using the procedure the radiation dose rates
were always found to be low from the external surveys and on entry. The
‘inherently safe’ design feature initiated when a switch fault was detected by
the PLC always sent the source rack down to its shielded safe location at the
bottom of the pool.
Many years of operation with the procedure caused complacency. If the

control panels indicated a rack fault problem the operators ‘knew’ it was a
switch problem because they were regularly failing. Further, they ‘knew’ that
the rack travel system would fail-safe and the rack would ‘always’ be shielded
in the pool. The approved emergency procedure was time-consuming and
even after its implementation the rack was always found ‘as expected’ to be
at the bottom of the safe pool. The radiation dose rates in the interim area
and the irradiator room were ‘always’ found to be negligible under fault
conditions.
Due to the number of faults occurring, access time to the irradiator room
had to be reduced and to the use of the emergency procedure avoided. To
achieve this aim an unapproved undocumented ‘trouble shooting’ procedure
was introduced. This was applied over many years up to the incident in 2004.
It was introduced by the plant management but not approved by the regulator
and it was not part of the formal safety-management system. To implement the
‘trouble shooting’ procedure authorisation had to be obtained from the RSO or
the assistant RSO.
The ‘trouble shooting’ procedure did reduce access times but to achieve
this, managers were party to and condoned the breaking of procedure, the
plant licence conditions and the law.
Using the unapproved procedure required disengaging the PLC by

removing fuses and overriding the interim area exit barrier door interlock,
opening the door and gaining access into the facility. After passing across the
irradiator room the maze door could be opened from the inside. This enabled
tools and equipment to be taken into the irradiator room through the maze to
fix operational problems.
There had developed a deep-seated shared belief that if the doors were
locked by the PLC under fault conditions and could not be opened then this was
always a switch problem. The belief emerged that the access doors remained
locked because the PLC interpreted the various switch position fault signals as
a contradiction. Further, there was the strong shared belief that the source rack
‘always’ went down into safe pool storage under fault conditions. That is, the
plant was believed to be inherently safe. Due to the strength of this belief the
radiation fields were not always checked using the L118 monitor test button
before entry.
These beliefs overwhelmed the decision-making processes of the managers

and operators and defeated the approved emergency procedure which was
ignored when faults occurred.
The event, which was almost fatal for two operators, occurred on 21 April
2004.The night shift had handed over to the day shift and indicated they had
118 Safety Culture
been having problems with the sources rack ‘up switch’ throughout the night.
The schedule had been delayed due to the rack going to safe storage at the base
of the pool and halting the process. Entries had been made to the irradiator
room in attempts to fix the switch. When the day team took over the irradiator
room was safe and the facility accessible via the maze door.
The morning shift made various attempts to repair the ‘up switch’. The
switch located on the rack gantry guide rails, was in a difficult position (design
issue) being located close to the irradiator room ceiling. In the first intervention
tools and a ladder were taken into the room to address the problem. The ladder
was placed across the pool and leaned against a wall enabling access to the
switch. On task completion the tools and ladder were removed back into the
control room area. An attempt was made to re-start the irradiator; this failed
and entry was again made. The tools and ladder were brought back into the
irradiator room.
Several further attempts were made to fix the switch and restart the plant.
At 10.45 a.m. the management agreed to stop attempting the switch repair
and to replace it. Entry was again made and by 11.30 a.m. the replacement was
complete. The personnel and maintenance equipment was removed from the
room and an irradiator start-up made. This time, the first steps of the sequence
initiated and the doors automatically interlocked. The new switch then failed
again and the procedure automatically stopped.
The PLC received a switch fault signal and interpreted it as designed, that
the ‘up switch’ was closed and that the source may be unshielded, that is, out of
the pool. As usual the operators ‘knew’ this was incorrect; the problem would
be the switch and the rack would have failed-safe and be shielded. The group’s
mental model was that the rack with its inherently safe design feature would
be on the pool floor and not hazardous. Without investigating further or testing
the L118 gamma radiation monitor the maintenance team requested the use of
the ‘trouble shooting’ procedure to bypass the exit barrier door interlocks and
gains access. They would then open the maze door which remained interlocked
from inside the maze and again take in the equipment for another repair. The
use of the informal procedure was granted by the assistant RSO. The fuses
were removed from the PLC, the exit barrier door interlock bypassed and
entry made. As always the source had gone into the deep pool as expected. The
irradiator room was traversed and the maze door was then opened. The tools
and ladder were again brought into the irradiator.
The ‘up switch’ was examined and repairs made. The operators left the
irradiator room, took out the tools but forgot the ladder. This remained over
the pool. There was no procedure for checking equipment into or out of the
high-hazard irradiator room.
In the control room attempts were made to restart the PLC control panel.
The PLC had an hour or so earlier been interfered with to gain access to the
irradiator room. The PLC failed to operate correctly and a technician was called
out to bring it back on line.
With the PLC fixed the plant was restarted at 12.50 p.m. The sequence
started and the access doors’ interlocks came into place. As required by the
irradiation process the sources rack emerged from the pool into the irradiator
room. The ‘up switch’ failed again. As its fail-safe design intended the source
rack began to descend automatically into the pool for safe storage.
However, the rack struck the ladder and jammed. The radioactive cobalt-60
pencil sources were above the pool’s water surface. As the design intended, intense
gamma radiation irradiated the room and high levels of scattered radiation was
irradiating the interim area (Figure 2.10). The operators were unaware of this.
A request was again made to use the ‘trouble shooting’ procedure for entry
into the irradiator room to fix what was believed to be the switch problem. This
request was granted by the duty assistant RSO.
On this occasion the PLC was sending additional signals to the operators:
• The ‘rack fault’ indicator was illuminated suggesting that both the
‘up switch’ and ‘down switch’ were open. This can happen if there
is a down switch fault or if the rack is actually not at the bottom of
the pool and the bottom switch is not closed.
• The ‘source travel’ alarm was sounding which suggested the

PLC was not sure where the rack was. This was because of the
contradiction in the switching signals noted above; the ‘rack fault’
indicator was signalling that both switches were open and the rack
was somewhere in between.
When both these signals arise it is mandatory for the managers to implement
the approved ‘stuck rack’ emergency procedure. However, the signals did not
120 Safety Culture
match the group’s mental model and their belief that the rack would be on the
pool floor and safely shielded. Because of this belief the PLC signals and the
approved emergency procedure were ignored.
If it had been applied the emergency procedure would have prompted

the need for gamma ray surveys external to the facility, around the doors
and any instrument penetrations. This would detect any low-dose levels of
local scattered radiation coming from the intense field in the irradiator room.
Further, the L118 test switch or the control panel could have been used to re-
engage the L110 gamma monitors. This would have shown that there were
high radiation fields in the room and that the source rack was unshielded; the
operators however, were not aware of this panel function. There were further
diverse system checks required by the procedure.
Because the operators and managers had a model of what was wrong and
believed fully in the inherent safety features of the plant they accepted plant
entry under these conditions as ‘routine’. Without the true knowledge of the
situation and with the irradiator room under intense irradiation, the PLC fuses
were removed and the exit barrier door interlock was bypassed.
Two operators were ready to enter the facility. One was not issued with
the mandatory pocket dosimeter which was against procedure. There was no
radiation survey carried out at the barrier door before entry, but the leading
operator did pick up a hand-held dose meter as he entered. This act saved both
men’s lives.
The operators entered the interim area and unknown to them gamma dose
rates were extremely high from radiation scattering out of the irradiator room
(Figure 2.10). By a stroke of luck the lead operator put his hand-held radiation
meter on the floor to remove some debris obstructing their entry path to the
irradiator room. He noticed the huge dose rate measurements on the monitor
and immediately ordered a retreat to the loading bay and closed the steel
barrier door behind them.
With the unshielded radiation source rack jammed against the ladder the
operators would have been fatally injured, within seconds, if they had entered
the irradiator room or lingered for longer in the interim area.
For about 50 per cent of an exposed population, an instantaneous dose of

about 5 Gy would be fatal (a unit of radiation is a Gy, the ‘gray’, named after
Louis Harold Gray). An acute dose, a little higher than this, is fatal for all. In
the interim room the dose rate was approximately 150 Gy per hour and in the
irradiation room it was on average about 1,000 Gy per hour. These are huge dose
rates. The leading operator with the monitor received approximately 45 mGy and
the other almost 30 mGy (this latter dose was estimated by radiation specialists
as this operator was not wearing the mandatory pocket dose-meter and his
actual received dose was not known). These acute doses were delivered in about
10 seconds from scattered radiation, near to the barrier door and at a distance of
over 15 metres from the sources rack. Any further steps would have proved fatal.
The doses received are typically 20 times normal annual background radiation
doses. The operators were saved by good luck and the exposures are unlikely to
have long-term health effects, although there is a possibility of a slight increase in
long-term cancer risk. If they had entered the irradiator room in direct line with
the unshielded cobalt-60 isotope sources, they would have received a fatal dose
of radiation within about 20 to 30 seconds.
The evidence from this event indicates that it was good luck that saved
these operator’s lives. There was engineered protection and instrumentation,
although both could have been significantly better. Even though the safety-
management system structure, review and auditing were poor, there were
emergency procedures to follow.
It is suggested that these operators came close to a fatality due to poor safety-
culture within the facility arising from people with long service being complacent
and over-confident that they knew exactly how the plant operated and the
solutions to its ills. If the generic safety-culture model is applied it may perhaps be
confirmed that complacency and over-confidence were a significant factor.
Beliefs of the managers and workforce
• Had deep-seated and shared belief in the plant being inherently

safe (that is, the isotope sources rack would always automatically
fail-safe, go down to the base of pool and be water shielded)
• Believed getting the plant back into operation was a priority when
running a production schedule
• Profoundly believed, by experience and many breakdowns, that

they fully understood all the signals from the PLC control panel
122 Safety Culture
• The employees believed their shared mental model was always

correct and they knew where the source rack was, irrespective of
what the PLC was indicating
• They strongly believed that the doors always remained locked, in a

fault condition, because of the way the PLC was configured to react
and not because of gamma radiation being present in the irradiator
room
• Believed the L118 instrument was dysfunctional in high-gamma

fields and only worked in low-gamma fields giving a null
reading; that is, no source present. This was an incorrect belief and
understanding
• They believed it was acceptable to interfere with safety systems

even though this was illegal
• It was acceptable to have and implement informal procedures that

were not approved by the regulator
• Management believed in minimal safety documentation
• They believed in meeting only the regulator’s minimal safety

requirements
• They believed that exercising emergencies was not important (done

as a regulatory requirement)
• They believed (speculative) that they were under schedule pressure

to bring the plant on line as quickly as possible.
Espoused values
This has to be somewhat speculative but there are indicators that:
• Bringing the plant back on line quickly was valued
• Using the approved emergency procedure was not valued as it was

time consuming
• Using an unapproved procedure was valued as it saved time
• The documented safety-management system was not valued as

a contribution to controlling safety risks. The documentation
was not comprehensive, or correctly implemented by the
management
• Having the knowledge to override the PLC and the ability to

override the interlocks on the barrier doors was valued
• Challenge and questioning on safety matters was probably not

valued, (speculative, but there could have been group peer pressure
and stress within the shift group preventing any challenges)
• The long safety experience of the RSO and the plant supervisors
was possibly valued.
Attitudes
This is speculative but there are very strong indicators that there was:
• An attitude of complacency amongst the managers and the

workforce, ‘we know what we are doing’, ‘we know what the PLC
control panel is telling us … and it is wrong’
• An attitude of ‘make do and mend’ as problems were dealt with in

isolation and the root causes not found and addressed
• A lack of discipline imposed by the management when breakdowns

occurred
• A ‘can do’ attitude
• No unease when key safety signals were being generated by the

PLC
• A ‘group think’ attitude across all levels of the hierarchy
• An attitude of ‘We know the procedure and can go it alone’

124 Safety Culture
• An inappropriate attitude to the importance of emergency

exercises
• No need to understand or review the context in which the approved

emergency procedure was meant to be applied; multiple fault
scenarios not appreciated
• No value to emergency procedures and exercises.
The management and operators did believe that they were dealing with
a hazardous facility. They would have been aware of the consequences of
exposure to the sources and strongly believed that exposure had to be avoided.
Nevertheless, these beliefs became overwhelmed by the inherent safety features
of the plant and the belief in their own knowledge and capability. This, with
other pressures, changed the staff’s safety-behaviours.
The attitude of the plant employees may have been shaped by complacency
arising from managers having been on the plant too long. They appeared to
no longer ‘recognise it as a high hazard facility’ but as a production plant
having repeat problems that needed to be fixed. Plant familiarity over many
years could have created complacency. There may also have been a high level
of boredom both at management level (20 years of service on the same small
facility, for example) and also boredom at the workforce level (facing the same
problems time and again without them ever being finally resolved).
Artefacts
The documented safety-management system was not robust, owned, or

properly used. It appeared to be in place to meet regulatory requirements:
• There was a documented approved emergency procedure (part of

the safety-management system) but this was ignored in practice
• There was no systematic independent documented reporting,

through the management system, of the plant’s annual safety-
performance
• There was a documented safety improvement programme but it

was not robust and believed to be in place only to meet regulatory
requirements
• There were no comprehensive audit reports on the implementation

of the safety-management system
• The plant was instrumented for safety but the instrumentation was
not assisting the operators. (PLC signals did not match the group’s
‘experience and reality’ and were ignored or reinterpreted to fit
the group’s mental model.)
The beliefs, values and poor artefacts, it is suggested, produced the following
behaviours leading to the radiation exposure event:
• An unapproved procedure was devised and used
• Using an unapproved procedure became the ‘normal’ behavioural

response to switch faults
• The approved emergency procedure was ignored
• The safety interlock on the exit barrier door was regularly physically
bypassed
• The PLC was physically disengaged to enable bypassing of the

door interlocks
• Signals from the PLC that did not fit the group’s beliefs on the status
of the source rack were ignored or reinterpreted
• The PLC was used only as a means of driving the process and not
as a safety information and control system
• There was a behaviour of fixing problems and not solving

problems
• There was no review of incidents and inadequate safety audits to

searching for procedure violations
• There was no root cause analysis of safety problems

126 Safety Culture
• There were inadequate or no radiological surveys under fault

conditions
• Managers initiated, condoned and were party to breaking

procedure
• Managers condoned the interference with safety devises
• ‘Group think’ behaviour resulted in no challenge or questioning of

actions
• Time and effort was not invested in good training, effective re-
qualification of operators, nor in emergency exercises.
The shared belief and values identified from this event were shaped and
encouraged by management. The workforce appeared to share the beliefs. The
opportunity of the workforce to challenge on safety issues is not reported and it
is unclear if a management ‘fear culture’ existed. The workforce may have just
accepted the knowledge, experience and leadership of the management.
The mental model of the functioning of the sources rack under switch
fault conditions had become entrenched, agreed and shared. The signals from
the PLC that the rack could be unshielded and hazardous were dismissed.
Experience over many interventions had shown that the rack always failed-safe
and was always shielded below the pool water. This behaviour of dismissing
the PLC data became a norm. The PLC was no longer contributing to safety
but was being used only to drive the conveyer and irradiation process. Any
deviation from the mental picture of the racks position (for example, the rack
actually being jammed and unshielded) caused the operators to go into denial
and apply their norms.
In particular, the founding operational belief that the protection of the

operator at all times from high-radiation fields is a priority under all conditions
probably remained. However, it appears to have been modified by a deep-
seated belief in inherent plant safety and the staff’s belief that this fulfilled the
priority belief. The designers had built the automatic ‘fail-safe’ conditions as
only one safety feature. It was evident that during the plant design, there were
several fault scenarios identified where the sources could become stuck above
the pool. From these scenarios, the designed ‘defence in depth’ safety features
and emergency procedure were put in place to protect the operator and assist
in fault diagnosis.
Although the safety-management system was poor and the engineering

and instrumentation could have been significantly improved, it was not these
features that failed. If the correct emergency procedure had been applied
the fault, a stuck sources rack, would have been discovered without facility
entry. It is suggested that it was the collapse of the safety-culture arising from
developing the wrong beliefs and values that almost caused two fatalities.
Summary
Chapter 1 introduced the theory of the ‘generic model’ of safety-culture. A

challenge was placed in Chapter 2 that for the model to be practical it should
have a predictive capability. That is, if fundamental organisational safety-beliefs,
shaped by the senior management, are a driving force behind safety-culture
then they should be observable, inter alia, through staff’s safety-behaviours
and the viability of the formal culture dimension. By applying the theory to
past accidents, a link between safety-behaviours and safety-beliefs should be
observable. Further, if the model is predictive the shared safety-beliefs should
be indicating a good, intermediate or poor safety-culture. In the latter case an
organisation may be moving towards an intolerable risk of an incident.
From the few example events given in Chapter 2:
• Titanic
• Bhopal
• ‘plastics plant’ explosion
• dropped load accident
• the criticality event
• the panoramic wet source irradiator event
it is suggested that there is a link between safety-beliefs and behaviour. Although

only a few in number, the examples show to some degree that with a limited
128 Safety Culture
belief in safety, poor safety-behaviours and an inadequate safety-management

system, the risk of a plant accident may increase. It is suggested that the link
between behaviours and safety-beliefs is a reality, giving some support to the
generic model.
In identifying an organisation’s shared safety-beliefs, safety-culture

reviewers may find the organisation has a less than adequate safety-culture.
However, with a few exceptions it is probably true to say that corporate bodies
and managers in these situations are not being reckless. They are not necessarily
purposefully putting business financial success ahead of safety. They may in
many cases lack technical safety knowledge, good safety guidance and third-
party overviews. When accidents do occur they can most likely be accused of
‘sins of omission’ regarding safety. Experience suggests and it is self-evident that
no organisation actually intends to deliberately maim employees but, because
of poor safety-culture, they do. A key factor regularly missed by the ‘guiding
mind’ of high-hazard organisations is that the major risk to the company’s
profitability is not how effective and efficient the organisation is but how safe,
effective and efficient the organisation is. Unfortunately there appears to be a
repetitive amnesia on this issue that costs lives, limbs and assets.
Finally, it is suggested that the safety-culture generic model is predictive.

Observing safety-behaviours may give an indication of the true nature of an
organisation’s shared safety-beliefs, its safety-culture status and the level of
safety risk from a facility or site. This is taken further in Chapter 3.
Building on the generic model, Chapter 3 indicates one possible approach

to ‘measuring’ safety-culture. With the approach, it may be possible to identify
shared organisational safety-beliefs, safety-culture strengths and possible gaps.
There may then be an opportunity for managers to intervene.
3
Assessing Organisational Safety
Culture
The Formal and Informal Safety-Culture Dimensions
In Chapter 1 the relationship between the elements of a layered generic

culture model was introduced and developed into an holistic integrated
safety-culture paradigm (Figure 1.7). Based upon the proposal that there is
linkage between shared organisational safety-beliefs and safety-behaviours,
Chapter 2 tested the proposal with some safety events. Although recognised
as a small sample, the reported events suggest that shared safety-beliefs can
significantly influence employees’ safety-behaviours. The indication is that
if safety-beliefs are poor this will be reflected in poor human performance,
possibly causing deterioration in engineered safety defences and management
safety procedures. This outcome can move a facility’s accident risk towards
an intolerable level.
If the Chapter 2 analysis is valid and the safety-beliefs and observable

behaviours link is upheld there may be an opportunity to ‘measure’ safety-
culture. To influence safety-culture it is suggested managers need awareness
at various times of their organisation’s culture compared to good practice. If an
organisation is unsure of its position on its safety-culture journey or where the
journey should be going, then designing an enhancement or a culture change
strategy is virtually impossible.
To measure safety-culture directly is not possible, for it emerges from deep-

seated organisational or individual beliefs. These cannot be measured. However,
research suggests that a good culture has a set of common characteristics. These
common safety-culture characteristics can be reviewed to indirectly ‘measure’
the organisational safety-culture. This can be a combined quantitative and
qualitative assessment.
130 Safety Culture
The review method introduced in this chapter indicates, inter alia, an

approach that considers an organisation’s formal safety-culture dimension.
In the generic culture model this dimension consists of an organisation’s
documented systems and physical safety attributes, the artefacts. The method
also considers the informal dimension of culture – the behavioural, human
performance and attitudes aspect. Considering the integrated safety-culture
paradigm (Figure 1.7), the two-dimensional approach facilitated through the
generic culture model elements can be used to assess the strength of the safety-
culture characteristics. This assessment peels back the culture layers to gain
some understanding of the organisational safety-beliefs and the robustness of
the safety-culture.
In a safety-culture assessment, reviewers are looking for strengths against

good practice safety-characteristics and identifying, inter alia, behavioural
gaps that may need to be filled. There is no right and wrong safety-culture
and a review is not about a good or bad safety-culture. There are good safety-
culture expectations for high-hazard industries and these are a worthy target;
however, not all standards will be relevant to all businesses in all specific
operating environments. For example, there are differences in detail in various
industrial businesses’ goals, safety requirements, and different staff, local and
national psychologies to address. There will also be varying levels of culture
maturity. However, to ensure the principles are presented, emphasis is placed
in this text on the concept of a strong or poor culture. Nevertheless the practical
caveat noted above needs to be added.
The method is primarily qualitative but a quantitative element can be

applied. The quantitative aspect is an issue of debate within some quarters.
Although the concept of formal (artefacts) and informal (behaviours) culture
dimensions is broadly accepted, some practitioners have reservations
regarding the validity of any quantification of these dimensions as a
safety-culture ‘measure’. For example, the concept of determining a single
organisational safety-culture index, from the integration of observed safety-
culture characteristics can only at best provide a crude indicator. This is
true, as it is not currently possible to assess the importance-weighting
of characteristics. The method introduced recognises this and makes no
attempt at promoting a single index. However, the quantitative approach is
introduced (by the author) as one possible component of a methodology to
assess the strength of culture characteristics and attributes. It is argued to be
valid, useful and moderately accurate, even if not perfect.
assessing organisational saefty culture 131
The review approach outlined is referred to as the safety-culture review

process. The process was originally developed by the IAEA (International
Atomic Energy Agency) and has robust supporting research.
A safety-culture review has, inter alia, the objectives of:
• understanding the organisational safety-beliefs, the basic safety

assumptions, and
• determining if the safety-beliefs are widely shared within the

organisation.
Although safety-culture is a complex socio-technical concept, the linear

culture model integrated within the safety-culture paradigm (Figure 1.7),
suggests that an organisation’s shared safety-beliefs and values can be revealed.
The review process is constructed around this concept and is just one means of
‘measuring’ culture.
The generic elements, beliefs, values, attitudes and artefacts influence

people’s behaviour. As noted previously, high-hazard industries with
good organisational safety-cultures have a common set of safety-culture
characteristics and each characteristic has several ‘good practice’ attributes
which are implemented through expected good safety-behaviours. The
development of good practice safety-culture characteristics and attributes
will be overtly demonstrable within or can be elicited from examination of the
generic culture elements, values, artefacts, attitudes and staff behaviours By
reviewing the strength of the characteristics and observing behaviours against
good practice expectations, the strength of the organisational beliefs can be
revealed to confirm the status of its culture. The degree of presence and quality
of the generic elements demonstrates the strength of the characteristics and
the degree of influence the shared safety-beliefs have within an organisation
(Figure 1.7).
By reviewing the formal dimension the artefacts, the level of presence of

the common, expected, safety-culture characteristics in an organisation can be
considered. Similarly, the informal dimension’s support for the characteristics
can be generated by listening to the espoused values, observing displayed
attitudes and observing safety-culture role behaviours. If there is a high
level of overt support for the elements (values, artefacts, attitudes etc.) in the
two dimensions this will be indicative that the expected good safety-culture
132 Safety Culture
characteristics and attributes are in place. If the support is weak in the two
dimensions this may demonstrate that the expected safety characteristics are
not developed or are organisationally weak.
A benchmark of safety-culture characteristics is required.
Characteristics and Attributes
For high-hazard low-risk industries there are broadly agreed good safety-
culture practice characteristics. If found to be in place, they may suggest a
strong organisational safety-culture that is meeting the ethos, the safety beliefs,
expressed in the definition:
Safety culture is that assembly of characteristics and attitudes in an

organisation and individuals which establishes that, as an overarching
priority, plant safety issues receive the attention warranted by their
significance.
It is suggested that the common characteristics form a benchmark set that

is broadly consistent across various international sources (Table 3.1). (There
are inevitably some variations across the sources arising from the complexity
of the topic and due to the emphasis placed by researchers on different
characteristics.)
Table 3.1 Safety-culture characteristics
A Safety is a clearly recognised value
B Leadership for safety is clear
C Accountability for safety is clear
D Safety is integrated into all activities
E Safety is learning-driven
Source: Reproduced by the kind permission of the IAEA, modified by the author for
this text.
To ‘measure’ the strength of a safety-culture against the characteristics there

are qualities associated with each safety-culture characteristic. These qualities
are the safety attributes.
The attributes (for example, Table 3.4) are factors expected to be present
for a good practice safety-culture characteristic to be displayed within an
organisation (Table 3.1). An objective of an organisational safety-culture
review is to assess if observed staff behaviours have been established by the
presence of the attributes and hence support the existence of the good practice
characteristic. If, inter alia, the expected good safety-culture behaviours are
observed, then the supporting attributes will be present and the majority of
common characteristics established. This infers that ‘good’ shared safety-
beliefs and values have been adopted, promoting the required safety-
behaviours. On the other hand, if the characteristics and attributes are weak
this will be reflected in the values, artefacts, attitudes and behaviours. This
may reveal organisational beliefs and values which may not be supportive of
a good safety-culture.
An Independent Review – ‘Measuring’ Safety-Culture

Characteristics and Attributes
Each of the five safety-culture characteristics (Table 3.1) has typically six to eight
attributes. As may be expected for a complex multi-dimensional concept there
is some variation across the literature. Nevertheless, there is broad consensus
on the majority of attributes and when established in an organisation the
expected supporting safety-behaviours and documented systems should be
present. It is assumed the attributes noted in Table 3.4 could apply to a high-
hazard facility but not necessarily to a design organisation. Although some are
generic, a design organisation’s safety-culture attributes, for example, will not
all be the same as those for organisations physically operating chemical plant,
nuclear power stations or a railway. The safety-culture characteristics, however,
will be common. The linkage between attributes, behaviours, documented
expectations and the characteristics, attributes and behavioural expectations to
support the characteristics are shown in Table 3.4.
Examples of organisational safety-beliefs are in Table 3.2. A similar set would

need to be generated, owned, shared and espoused within any organisation.
Beliefs, in their detail, will be different for different organisations (although for
high-hazard industries some consistency would be expected). Supporting the
beliefs are safety values (for example, Table 3.3). An organisation would hold
these in high esteem and pay particular attention to them. (A business needs to
determine the beliefs and values it requires and they may not necessarily be as
many as 10 as identified in the Tables 3.2 and 3.3.)
134 Safety Culture
Table 3.2 Examples of shared organisational safety-beliefs
We believe:
1. The safety of staff, our contractors and the public is our number one priority in all
circumstances.
2. Accountability for safety rests at all times with managers.
3. A responsibility for safety rests with all employees.
4. In safety, vigilance is needed at all times.
5. Human error is normal and can be expected.
6. Our engagement in safe behaviours is necessary for safe operations.
7. Human errors are a learning opportunity.
8. People are fallible and will make mistakes.
9. In a culture of legal compliance as our minimum requirement.
10. In a ‘just’ safety-culture and that people do come to work intending to do a good job.
Source: Reproduced with the kind permission of the IAEA.
Table 3.4 links the beliefs and values to the characteristics through the
supporting expected behaviours. If in a review the observed staff safety-
behaviours are not as expected and not supporting the attributes then
this suggests the stated safety-beliefs and values are not being upheld. If
this is identified in a review then the focus comes upon identifying the real
organisational beliefs causing the non-aligned safety-behaviours. Further, an
observed disconnect between the documented expectations, the formal culture
dimension and observed behaviours may suggest that the safety-management
system is weak, not owned or not used by the organisation.
The strength of a particular safety-culture characteristic would be judged

by assessing the degree of presence of the characteristic’s attributes. This would
be addressing typically the features identified in Table 3.4. Using this approach
the safety-culture characteristics’ strengths and weaknesses can be revealed
within the generic models elements, the formal (artefacts) and the informal
(safety-behaviours, etc.). When characteristics are identified as strong this
would contribute to confirming that the espoused good safety-beliefs and values
are a reality. If the characteristics are weak this would reveal an inconsistency
with espoused safety-beliefs and values. By assessing the presence of all the
characteristics in the two dimensions, the informal and formal, a review should
establish the integrated organisational safety-culture status.
The contents of Tables 3.4, 3.5 and 3.6 form the components of a review
process for three of the five characteristics. In a full review, similar tables of
attributes and behaviours would be developed for the remaining characteristics
D – ‘Safety is integrated into all activities’ – and E – ‘Safety is learning-driven’.
Their expected attributes for a high-hazard organisation are show in Table 3.7.
Table 3.3 Examples of shared organisational safety values
We value:
1. Our individual attention to safety is a condition of employment.
2. That everyone is responsible for safety, our own, others’ safety and the protection of the
facility.
3. That respect is given to all safety views as everyone has the right to question and report safety
issues.
4. People’s interventions to ensure all potential health and safety incidents are prevented.
5. Everyone has the right to challenge on safety issues.
6. That the organisation strives for an open dialogue culture.
7. That teamwork to resolve safety matters is strongly supported.
8. That all events and near misses are reported as we recognise that even minor injuries or
events are important.
9. Thorough safety training and competence as essential for safe working.
10. That we regularly check and report our safety objectives performance.
Considering ‘Safety as learning-driven’, this characteristic has attributes

with expected behaviours to promote and deliver organisational ‘learning’.
These behaviours would possibly be around; learning from external industry
incidents, internal event reporting, competence learning, skills enhancement,
the implementation of a ‘just’ culture and internal and external technical
safety dialogue. In a review, the support for the learning attributes would
be considered, inter alia, through staff behaviours associated with learning
and through the safety-management system’s support for ensuring learning
behaviours are carried through.
Carried out as a sampling process and fully engaging an organisation a

safety-culture review method is usually applied by a third party. This gives the
advantage of it being independent, unbiased and applied by specialists in the
field. These factors are particularly important if a review is the first of a kind
for a high-hazard organisation.
Using the Safety-culture Review Process model the presence of the

characteristics can be assessed by sampling various organisational functions at
each hierarchical level. Using typically Table 3.4 guidance, significant amounts
of data are generated. With up to six specialist reviewers assessing the five
safety-culture characteristics this gives a robust information set.
The gathering of such extensive data requires the adoption of various

approaches in a review. Data collection is wider than observing good safety-
culture behaviours. This is important but has to be integrated with assessing
Table 3.4 Safety-culture characteristic A – ‘Safety is a clearly recognised value’, attributes, safety-behaviours
(informal dimension) and the documented expectations (formal dimension)
Safety-culture Supporting Expected safety behaviour to support Documented expectations to support the The safety-beliefs The safety values
characteristic attributes the attributes and the characteristic attributes and the characteristic being supported by being supported
the presence of the by the presence of
characteristic the characteristic
(Ref. Table 3.2) (Ref. Table 3.3)
Characteristic A A/1 Safety is given – Safety procedures are complied with – Documented health and safety policy exists 1,2 1,2
‘Safety is a clearly a high priority at all – In the face of uncertainty conservative safety – Meeting-minutes demonstrate safety before
recognised value’ levels decisions are demonstrated at all levels production
– Decisions made show safety was/is – Meeting-minutes indicate conservative
considered above production decision making
– There is evidence of a proactive approach to – Safety resources are defined in the annual
resolving problems financial budget
– Safety has a high profile in the organisations
annual report
Characteristic A A/2 Safety values – Safety booklets are prepared (as a route to – Organisational shared safety-beliefs are 1,2,3,4,5 1,2,6
‘Safety is a clearly are communicated sharing beliefs and values) documented and displayed
recognised value’ – Safety posters are displayed and updated – Organisational shared safety values are
– Safety news letter is made available documented and displayed
– Safety intranet is made available – Safety communications procedures are in
– Regular management safety place and used
communications, including emphasis on – A variety of communication routes are
beliefs and values available, resourced and used
– Safety is proactively given high priority in
internal documents, verbal communications
and decision making
Table 3.4 Continued
Characteristic A A/3 Safety – Giving and accepting behavioural challenge – Safety-culture behavioural requirements for All 1,2,3,4,5,6,8
‘Safety is a clearly conscious is a norm each hierarchical level are documented
recognised value’ behaviour is – Questioning peers and seniors on safety is – A blame tolerant, ‘just’ culture policy exists
accepted by an accepted norm with appropriate supporting documentation
all within the – Reporting events and near misses is – An events and near-miss reporting system is
organisation rigorously carried out in place
– There is proactive searching in operations – There is a procedure for analysing with
for technical faults and human error trending and feedback on reported events
– Positive feedback is given for ‘good’ safety- – A learning-from-experience procedure is in
behaviours place
– Reporting of events is seen as an act for – Soft-skills training is in place for all employee
learning by managers and workforce levels to enhance interpersonal skills
– Safety and safety-culture observations are
carried out by all and across all the hierarchy
– A ‘just’ culture process is applied by all
managers
Characteristic A A/4 Acceptance – Safety is on all business agendas – Business-meeting minutes demonstrate 1,2 1,2
‘Safety is a clearly that safety and – Safety and production are integrated in safety with production is agenda item
recognised value’ production go hand discussion at local plant level (tool box talks) – Documented guidance exists for conducting
in hand –Safety beliefs and values are regularly local tool box talks
referred to at meetings as ‘touch stones’ and – Guidance that is used for managers to
safety guides for the organisation manage production and safety conflicts
– Safety procedures are never bypassed to – Procedures emphasise safety as a
achieve production goals prerequisite for effective business production
– The safety of people, plant and process are in high-hazard industries
integrated into all production objectives and – Procedures exist that integrate safety
planning considerations considerations into production planning and
scheduling
– The consequences to individuals for safety
procedures bypassing, at any hierarchical level,
are available, trained and understood within
the concept of a ‘just’ culture policy
Table 3.4 Concluded
Characteristic A A/5 Resources are a – Long-term safety resource requirements – Annual business-planning meeting 1,2,6,8,9 1,2
‘Safety is a clearly priority for safety are discussed at annual business-planning documentation identifies safety resources
recognised value’ meetings – Artefacts, for example personal protective
– Resources are made available for equipment equipment, are of good quality
to be maintained or replaced (equipment not – Documentation does not suggest excessive
permitted to degrade) breakdown of safety equipment due to allowed
– Suitably qualified and experienced people degradation
are identified to competently operate facilities – Safety skill requirements and task skill
and at management levels requirements are documented with training
– A management of change procedure is used strategies, recruitment strategies etc.
for structural changes in staffing at any level – A documented and used (register)
management of change procedure exists
– Safety training is resourced and functioning
Characteristic A A/6 There are – Teamwork to resolve safety issues is strongly – Training is implemented on team working and 1,2,3,4,5,6,8 1,2,3,4,5,6,8,9
‘Safety is a clearly interactions encouraged by all employees interpersonal skills requirements at all levels
recognised value’ at all levels of – Managers actively apply processes to –Guidance is available on dealing with safety
management and obtain feedback from all employees on safety feedback and tool box talk feedback
workforce matters – Feedback questionnaires exist, intranet
– Local ‘tool box talks’ address safety by options are available for feedback, and a fast-
dialogue before tasks; current task safety risks track feedback process is available
and past safety experiences are addressed The systems are used, reviewed and feedback
(this would include in depth discussion of any acted upon through a Learning from Experience
expectations from the task risk assessments) procedure
– Senior managers have organisation
safety briefs relating safety matters to the
organisational safety-beliefs and values
Source: Characteristics and attributes (only) reproduced by kind permission of the IAEA, (attributes modified by the author for this text).
Table 3.5 Safety-culture characteristic B – ‘Leadership for safety is clear’, attributes, safety-behaviours (informal
dimension) and the documented expectations (formal dimension)
Safety- Supporting Expected safety behaviour to support the attributes and Documented expectations to support The safety-beliefs The safety values
culture attributes the characteristic the attributes and the characteristic being supported being supported
characteristic by the presence of by the presence of
the characteristic the characteristic
Characteristic B B/1 Senior – Managers behave as safety role models, set examples, mentor – Interpersonal skills and ‘soft skill’ 1,2,3,4 1,2,3,6
‘Leadership for managers, through their behaviours for example challenge and question. training is in place for managers at all
safety is clear’ middle – Managers refer to and use at all opportunities the organisational levels and is refreshed through procedure
managers and safety-beliefs and values and are seen to ‘own’ them requirements
supervisors – Managers do not ignore unsafe behaviours in others at any level – Managers are issued, or have to hand,
are clearly and will skilfully give constructive feedback documented the agreed organisational
committed to – Managers do (or have) overtly put safety before production by beliefs and values
safety their actions or decisions
Characteristic B B/2 Visible – A manager introduces all employee safety-training – Training procedures identify the role of 1,2,4,5,6,7,8 1,2, 3, 9,10
‘Leadership for leadership is – Managers have stopped, or will stop, work tasks in the interests senior managers in employee training
safety is clear’ shown of safety – Emergency exercise procedures are
– Lead emergency exercises available and the role of senior officers
– Demonstrably follow all procedures (e.g., using the correct explained
personal protective equipment, follow facility access, egress – Guidance is in place for managers and
procedures) other employees to enable tasks to be
– Overtly praise and support observed ‘good’ safety-behaviours halted in the interests of safety
– Managers expect their own occasional misaligned safety- – Schedules exist for every manager to
behaviours to be challenged and questioned walk the facilities and discuss safety. As
– Managers have scheduled facility (or office) walks to observe appropriate written guidance is available
and discuss safety and safety-culture – A summary of reports on facility walks,
– Managers are engaged in a schedule of safety behavioural observations and safety issues arising are
observations; observations being at all levels of the hierarchy taken as a CEO senior managers’ meeting
– All members of staff engage in behavioural observations across agenda item
all levels promoting a dialogue culture
– Managers periodically lead mixed employee teams to resolve
safety issues
Table 3.5 Continued
Characteristic B B/3 Managers – Managers frequently and overtly encourage team solutions by – Training in team skills is available and 3,4,5,8 3,6,7,9,10
‘Leadership for seek the making time available implemented
safety is clear’ involvement of – Actively engage in safety discussion with staff to gain feedback – Facilitation training for managers and
all employees before a safety decision is made others is available and implemented
in improving – Managers will frequently and overtly delegate responsibility (but – Technical safety training with refresher
safety not accountability) for resolving safety issues to suitably qualified courses are carried out and recorded
and experienced teams – Evidence of team safety solutions and
– Managers encourage professionalism regarding safety by reports are available
encouraging additional training, safety skills improvement and – Appropriate routes are available
soft-skills practices amongst reporting staff and used for ‘suggestions’ on safety
– Encourages overtly open dialogue on safety matters improvements
– Encourages employees to search for and feedback possible
safety improvements
– Openly challenges employees on their accepted safety status
quo
Characteristic B B/4 Managers – Actively listen to employees’ concerns and comments on safety – The organisation has a documented 2,5,7,8 3,6
‘Leadership for strive for open – Always purposefully encourage safety feedback at meetings and safety-issues communications policy
safety is clear’ communications plant visits – There are scheduled senior managers
and build trust – Always fulfil promises/actions with feedback on safety issues safety-communication briefs
raised by staff – Managers are trained in the
– Through practised charismatic leadership purposefully build a organisation’s communications
trusting working environment expectations
– Has an ‘open door’ policy on safety matters – people can raise – Managers are trained as appropriate in
immediate concerns without hindrance communications skill, handling conflict and
– Managers apply procedure to address and satisfactorily close dealing with employee safety concerns
out safety issues (by team engagement where possible) – To facilitate trust in the organisation
there is a ‘just’ working policy that is
known, understood and used
– A learning from experience procedure
with close out is available and used
Table 3.5 Concluded
Characteristic B B/5 Managers – A minimum safety manning levels document is produced – Plant’s minimum manning levels are 1,2,5,8 9
‘Leadership for ensure by managers and implemented for normal and emergency documented and periodically reviewed
safety is clear’ sufficient, operations through procedure
competent – Skill and manning levels for specific tasks are addressed through – Task analysis documents/risk
individuals task analysis on high-hazard tasks and are carried out within an assessments are in place and reviewed by
appropriate (legal requirement) risk assessment procedure
– Managers have and use processes to ensure safety training of – The organisation has a stress policy that
individuals taken with refresher as appropriate. This is also carried is evidently used
out to meet the requirements of reducing risks on specific tasks – A management of change procedure is in
– Infrequent, unique and unusual tasks are always addressed by place and evidently used to consider the
managers, through procedure, to ensure adequate trained and implications on safety of changes at any
experienced skills and manning levels are available for the tasks level in the hierarchy
– Managers implement a stress-policy to ensure employees are
fit for tasks
– Managers always use a management of change procedure
to examine the safety implications of structural change. This is
applied to all structural changes of personnel
Characteristic B B/6 Managers – Managers have proactive and reactive safety-performance – Reactive and proactive key performance 1,2,3 6,10
‘Leadership for set performance indicators indicators are documented and monitored
safety is clear’ targets and – Managers implement a behavioural safety programme within a – Training, resources and time is made
monitor. mature environment available to implement a behavioural
– Give constructive feedback as frequently as necessary on the safety programme (if the organisation is
required safety-performance of staff mature)
– Frequently examine local safety data for safety degradation – Resources and time are committed
trends or deviations from the norm to examining trends and root causes
– Senior managers annually engage actively in a full review of of deviations. A reporting route to
the safety-management system to seek assurance it is delivering management for findings is available and
organisational safety-management and to consider improvements used
to the system – Procedures are in place to audit the
– Overtly support as a learning opportunity all safety system safety a management system There are
audits; mentors and encourages others in this support documented audit reports, actions and
prompt close out of actions is evident
– Procedures are in place to enable
‘independent’ safety inspection to be
carried out by experienced managers
Table 3.6 Safety-culture characteristic C – ‘Accountability for safety is clear’, attributes safety-behaviours (informal
dimension) and the documented expectations (formal dimension)
Safety-culture Supporting Expected safety behaviour to support the Documented expectations to support the The safety- The safety
characteristic attributes attributes and the characteristic attributes and the characteristic beliefs being values being
supported by the supported by the
presence of the presence of the
characteristic characteristic
Characteristic C C/1 An – There are scheduled meetings between management – A regulatory, management meetings schedule 2,3 6
‘Accountability appropriate and regulators exists and is implemented
for safety is relationship – The expectations of regulators are discussed agreed – Regulatory meetings are minuted, action
clear’ exists with and always implemented recorded and closure monitored
regulators – Relationships with regulators are overtly professional – The role of the regulator is within the training
as expressed through procedures, attitudes and regime
espoused values. There is a constructive and – Procedures exist to formalise the interactions
cooperative attitude towards regulators with regulators
Characteristic C C/2 Roles and – Individuals know understand and act within defined – Job descriptions with safety accountabilities and 2,3,4,5 2,8
‘Accountability responsibilities safety responsibilities responsibilities exist
for safety is for safety are – Individuals are aware of their line of contact if a safety There is clear linkage between the management of
clear’ defined and issue needs resolving and is outside their accountability change procedure and job roles and responsibilities
understood – All staff overtly demonstrate, in their attitude and – Job descriptions and safety responsibilities are
behaviours, that they are responsible for their own and discussed with employees, are understood and
others’ safety kept under review
– Clear organograms for employees seeking safety
advice and addressing safety issues exist and are
kept under review
Table 3.6 Continued
Characteristic C C/3 Regulations – Compliance is overtly accepted norm of behaviour – A safety-management system (integral to the 1,2,3,4,5,7,8,9 1,2,3,5,10
‘Accountability and procedures – Deviation from procedures by individuals or groups is business management system) exists, is owned by
for safety is are complied always challenged by peers and seniors the senior management and is used to manage
clear’ with – Compliance with the law is overtly expressed as a safety risks
minimum – The management system is audited for
– There is clear use of personal protective equipment as compliance, inadequacies and to seek
required by procedure improvement. Audit outcomes are reported to
– Work will be stopped at any hierarchical level (where management There is evidence of a management
safe to do so) if the use of a procedure appears to be response to reports
unsafe or inappropriate – There is no significant (months) overdue actions
– Interventions to halt tasks in the interests of safety from audits
are welcomed and treated as a leaning opportunity – Legal compliance is documented as a minimum
irrespective of the outcome expectation of the organisation – typically
– Staff welcome procedural audits as a mechanism to identified in the company safety policy
improve procedures to help them do there jobs and
support compliance
Characteristic C C/4 Interfaces – Staff behave with an understanding of the safety – Procedures exist to safely manage interfaces 2,3,5,8 1,2,6,7,10
‘Accountability are effectively interfaces between facilities and internal safety services – A contractor safety induction course is available
for safety is managed – The staff reflect understanding and authority at safety and used
clear’ interfaces with contractors or off-site suppliers – Information on the shared organisational
– Staff understand that they are responsible for the safety-beliefs, values, behaviours and safety
safety of others event reporting routes are available and used by
– All contractors have an assigned interface staff contractors
member to address safety issues
– All contractors undertake induction safety before
working on site
– All contractors overtly understand that they are
bound by the beliefs, values and safety standards of the
organisation
– The accountability for contractors’ safety and the
safety of their work is clearly assigned
Table 3.6 Concluded
Characteristic C C/5 Root cause – An inadvertent non-compliance is considered within a – A non-attributing (if required) reporting process 2,5,6,7,8,10 2,4,5,6,8,10
‘Accountability analysis is ‘just’ culture as a learning opportunity is available and evidently used
for safety is applied to non – All observed and self-non-compliances are reported in – Training is given in root-cause analysis to
clear’ compliance and a trusting, ‘just’ culture identified persons, and root-cause analysis is used
other safety – Managers overtly apply a measured response to non- on events
events compliance (people do make mistakes) – A Learning from Experience process is in place to
– Misaligned safety behaviour at any level is challenged ensure the out come of analysis is acted upon and
– Root cause analysis is used where appropriate to is communicated into the organisation.
ensure problems are solved and not repeated – A ‘just’ culture policy exists
Characteristic C C/6 Staff – A safety improvement programme is implemented by – A safety improvement programme is in place 2,4,5,7,8 2,7,8,9
‘Accountability are actively managers – The programme is identified at senior level as
for safety is involved – Managers encourage staff to be involved in the being owned, monitored and annually reviewed
clear’ in safety programme through team work solutions – There is an ‘award’ scheme for effective team
improvements – Praise and reward is given specifically for safety team working
with managers effort from various levels of management – Training on team working and interpersonal skills
– Safety improvement team tasks span across human is in place and used
performance, procedures, physical processes and plant
Table 3.7 Attributes for safety-culture characteristics D and E
Safety-culture Characteristic Attributes

D Safety is integrated into all activities D/1 Attention is paid to housekeeping and material
conditions as a reflection of a commitment to
excellence
D/2 A process is in place to ensure there is
independent safety overview of operations (for
example, inter alia, an independent safety committee,
inspection, reviews)
D/3 The quality of all safety documentation and
quality processes is good, with specific attention to
procedures being user friendly
D/4 Factors effecting work motivation, job satisfaction,
working conditions are considered by managers
D/5 A rigorous approach to safety problem-solving
is applied with conservative decisions in the face of
uncertainty
D/6 Safety margins from designers and imposed by
operations are carefully observed and equipment
carefully maintained to ensure margins are not
challenged
E. Safety is learning driven E/1 The organisation creates a continuous learning

environment
E/2 Individuals are kept well informed to avoid
repeating mistakes
E/3 Fundamental cause of events are pursued and
understood
E/4 The organisation has procedure to identify and
address latent safety weaknesses in the organisation
E/5 Systematic training is given on communications
and interpersonal skills to promote a dialogue learning
safety-culture
E/6 There is systematic development and
encouragement to develop individual’s safety and
technical competences
Source: Reproduced by kind permission of the IAEA, (attributes modified by the author for this
text).
artefacts, considering the management system, listening to values being

expressed and noting employees’ attitudes.
The data to determine the ‘degree of presence’ of the characteristics are

gathered through, inter alia, a series of staff events and communications.
These events are facilitated and lead by the review team as open, trusting and
cooperative exercises.
146 Safety Culture
They can include:
• interviewing board members
• interviews with the CEO or general manager
• interviewing a sample of senior managers, managers and

supervisors
• interviews with staff industrial-relations representatives
• discussions with health and safety representatives
• mixed employee groups and functional forums
• questionnaires
• one-to-one workforce interview sessions
• on-plant observations
• as appropriate, interviews with relevant regulators.
Considering the four hierarchical levels of senior managers, middle

managers, supervisors and workforce, a review will identify a safety
characteristic’s expectations are not fulfilled uniformly for each person or each
level. Complexity arises from the level of culture maturity, the management
style and differences in emphasis by different hierarchies regarding safety-
beliefs, attitudes and behaviours. For example, the safety-behaviours expected
of the senior managers will differ from those of middle managers which, in turn,
will differ from those of supervisors. The groups have different backgrounds
and histories and cope with different organisational pressures. They have
specific business roles and because of this contribute differently in shaping the
organisation’s safety-culture.
For example, thinking long-term, the senior group are engaged in future
corporate policy and strategy. Middle managers are engaged in carrying out
the policy with a medium term horizon, whilst the supervisors, spend much
of their time on the day-to-day issues of direct safety importance to their work
teams. The focus for supervisors will tend to be on immediate task safety,
mentoring, implementation and management system compliance. Senior

managers, on the other hand, may be searching for organisational strategies
for cross-functional safety-culture enhancement, a communications strategy
to encourage its implementation or be engaged in interpreting cross-company
safety-data trends. To compound the complexity there may be sub-cultures of
varying strengths. Such cultures can be inhibitors to sharing organisational
beliefs and values, but if identified and managed they can be an organisational
strength.
With the review focus remaining on the identification of shared safety-

beliefs and values, the review team accumulates, debates and analyses the data.
This enables a consensus to be reached on the strength of attributes and the
associated safety-culture characteristics. Much of the consensus at this stage is
around qualitative analysis.
Quantification, if introduced into the analysis, can be useful. However,

it has to be treated with caution and the ‘error bands’ for such an approach
appreciated.
Quantification of Data
The strength of the presence of attributes can be assessed, in broad categories

as ‘high, medium or low’, or a more sophisticated numerical scoring criteria
can be used, a sample given in Table 3.8; when used in practice the criteria are
more extensive. However, the attribute and characteristic scoring boundaries
are not exact and the specialist technical judgement of experienced reviewers
is a key factor in reaching a consensus. Experience suggests team consensus
scores can be reached.
The numerical criteria form the safety-culture quantitative-analysis

component. Scores can be applied to attributes and characteristics for the
informal and the formal dimensions. In a review the quality and accuracy of the
judgements made by the reviewers for both the qualitative and the quantitative
component need consideration. The two components are complimentary and
would be expected to cross-check by eventually drawing the same conclusion
on a characteristic’s strength or weakness. In addition, conclusions are
rigorously tested within the review team’s process through self-challenge and
a questioning approach to review data. As appropriate, other independent
checking tools can be applied.
148 Safety Culture
There is some debate regarding whether it is at all useful to assign numerical

values to essentially behavioural and psychological attributes. Some practitioners
believe the approach is a useful discipline and generates additional auditable
evidence for the safety-culture review team’s conclusions. A review team’s
examination for the presence of safety-culture characteristics and supporting
attributes using the scoring approach forms the quantitative platform of the
independent safety-culture review process. The data are generated from
questionnaires, interviews, forums, observed human performance and the
organisation’s expressed safety-beliefs and values. These data are collated,
examined and scored Table 3.8, for each attribute. The qualitative contribution
is a data assessment, inter alia, by a review physiologist. This combination of
qualitative and quantitative assessment can be a significant strength of the
process. The two components being complementary give an overall balanced
assessment of the cultural dimensions.
During data assembly organisational shared safety-beliefs and values

may have been documented and supplied to the reviewers. From these key
documents the organisation has established its safety policy and shaped its
culture safety-behaviours. The review tests amongst other things whether the
beliefs are being upheld. The review will independently achieve this objective
of revealing the organisational beliefs and values. They may align or be
misaligned with the documented artefacts.
When investigating for the presence of attributes the reviewers generate

questions which search out practical and auditable evidence of attributes.
Reviews, being evidence based also requires that safety-behaviours are
observable. Similarly any complementary safety-management system has to be
available and evidently used in practice.
Independent Safety-Culture Review Process Output
The review output can be qualitative and quantitative with both contributing to
understanding an organisation’s shared safety-beliefs and values. In addressing
this, use is made of the collated quantitative formal and informal review data.
Emphasis is placed on the point that this is only one contribution to the review
team’s essential internal debates. Too much emphasis on the quantitative
dimension has to be avoided as the numerical results have to be qualified and
aligned with the conclusions suggested by the qualitative analysis. This analysis
by a team’s review psychologist and the technical specialists is essential for
Table 3.8 Criteria for assessing and scoring the degree of presence of an
attribute
Safety-culture High (7–9) Medium (4–6) Low (1–3)

dimension
Formal safety- The attribute is There is only partial The attribute is not
culture dimension reflected in the evidence of the seen in the system
(documented management system. existence of the or only in a limited
expectations) A process is in place to attribute in the ineffective way.
detect, challenge and management system. Deviations from the
correct any deviation Deviations from the system are not tracked
from the formal system do occur on to determine their
system. occasions. These are root causes.
not always tracked and
the cause of deviations
not assessed.
Informal safety-culture The attribute is There is some The understanding

dimension (safety- understood and understanding of of the attribute as
culture behaviours) internalised by the need for the contributing to safety
managers and attribute. It is not fully is weak or doesn’t
workforce as essential internalised and not exist. The attribute is
to safety. It arises from necessarily arising not internalised. There
safety-beliefs. It is a from safety-beliefs. are negative attitudes,
normal behaviour for Deviation, that is and/or disruptive
the organisation. Any known to be against informal behaviour.
deviation from the the management There are deviations
norm is considered system, is tolerated. from the required
by staff to be against The deviation may behaviours that are
the tacit attitudes not be recognised supported as a tacit
and values of the as against the tacit behaviour norm. There
staff. Deviation will be behaviours of the is resistance by the
challenged. staff. There is some ‘informal dimension’
evidence of negative to the formal
attitudes towards system.
safety requirements
and initiatives.
Source: Reproduced by kind permission of the IAEA, modified by the author for this
text.
understanding the context of the numerical data and achieving consensus on

the organisation’s real shared safety-beliefs.
The real beliefs may emerge from a review as different from the organisation’s
espoused beliefs, employees’ attitudes or what is reflected in the artefacts. The
integrity of the qualitative and quantitative information is therefore essential
for it fundamentally assists an organisation to examine its real beliefs. This
150 Safety Culture
in turn enables a foundation to be laid, if necessary, for belief change in the

interests of improved safety.
Taking this further, for a ‘poor’ organisational culture the analysis may
show a dislocated set of safety-beliefs at the different organisational levels. On
the other hand, with a good organisational safety-culture there should be no
dislocation, but an aligned set of safety-beliefs throughout the organisation.
These beliefs will be expressed through supporting artefacts, espoused values
and consistent ‘good’ safety-behaviours, the latter demonstrating that good
safety-culture characteristics have been embraced and embedded.
Some practitioners consider the generating of quantified data to be

unhelpful as it can distract reviewers from the psychological issues around
culture. It may also diminish in favour of a numerical solution the standing of
the reviewers experienced, technical and specialist qualitative judgement.
These are reasonable observations. However, if a review is under experienced

leadership it is suggested that such distractions need not materialise. As
noted, if a team purposely avoids being focused on the numerical data alone
but recognises it is just an additional ‘tool’ then a quantitative approach does
promote another perspective. The numerical data are useful, but is only one
source of information. Safety culture being a socio-technical construct cannot
be reduced to nor have mathematical accuracy.
For a specific attribute the reviewers’ numerical data can be derived from
different sources and may show sharp discrepancies. A value of the quantitative
approach is that scoring discrepancies are a source of additional information.
Extreme separations in numerical scores for a particular attribute need to be
justified. The justification to peers of attribute scores is one aspect of driving
review quality. Discrepancies in data are not ignored nor manipulated. When
compared with the overall organisational mean data they may show a particular
cultural characteristic fracture within a department or hierarchy level. The
influence of perceived fracture on the culture locally or on the organisation
generally may be significant and require further consideration.
The numerical data also enable the emergence of a ‘pictorial view’. However,
too much focus on the pictorial data has to be avoided. A pictorial is only a
‘snapshot’ in time and it is the understanding of the beliefs (the psychology of
basic safety assumptions) behind the picture that is important. Nevertheless,
pictorials are useful if considered with qualitative assessment to give context,
balance and perspective.
Pictorial Output from the Independent Safety-Culture Review

Process
An example of a safety-culture characteristic the pictorial is given in Figure 3.1.

This is expressed in two dimensions, the formal and informal.
9
D Lack of management A Strong safety culture
attention to artefacts
8
7 A/1
A/2
A/3
Attributes
SC Dimension
5
A/5
4
Informal
A/4
3 A/6
C Poor safety culture B Possible alienation -

2 management and staff
1
1 2 3 4 5 6 7 8 9
Formal SC Dimension
Figure 3.1 Example – the distribution of attributes for the characteristic
– ‘Safety is a clearly recognised value’
this text.
The reviewers’ median score for an attribute of a characteristic can fall into
any of four sectors: A, B, C, or D. Scores in Sector A indicate a potentially strong
safety-culture where as Sector C suggests there are significant gaps in attributes
giving a weak culture. The vertical axis on the graph shows the scoring for the
informal dimension, for example the behavioural element. The horizontal axis
indicates the formal dimension which is typically the robustness of the safety-
management system.
An attribute’s median score arising in Sector A (Figure 3.1) would indicate

strength in that attribute. If all the attributes emerge in Sector A this suggests an
overall strong characteristic suggesting good shared safety-beliefs around that
152 Safety Culture
specific characteristic. For example, if ‘Safety is a clearly recognised value’ were

a strong characteristic, all the attributes would appear in Sector A of Figure
3.1. However, these conclusions would need to be supported through the
psychological assessment in the context of the wider data set and the culture
report dialogue.
If attributes appear in Sector B there is a poor informal safety-culture. That

is, there will probably be poor attitudes, poor espoused values and poor safety-
behaviours. However, there appear to be ‘good’ processes and procedures in
the formal culture dimension. Unfortunately they are probably being ignored,
having been generated not to assist the organisation but for the regulator or
as a minimum legal requirement. The procedures may not be owned or used
by the organisation. If procedures are not being implemented this leads to a
lack of safety discipline promoting poor safety-behaviours. There may possibly
be alienation between the management and staff. The management may have
documented expectations, but the workforce is not implementing them.
Sector B data also suggest there is the possibility of conflicting messages;

a ‘good’ safety-management system and other artefacts are in place, but there
is apparent management and workforce disinterest in safety. This may seem
contradictory. However, there may have been recent changes in the organisation
and a priority focus put onto product quality, efficiency and effectiveness.
For example, the organisation may have come under some external, strong,
threatening commercial pressures. Alternatively, Sector B attributes may suggest
the organisation has started a safety-culture decline because of a change in
management who have brought in a new set of ‘poor’ safety-beliefs and values.
The current ‘good’ management system remains in place, but poor behaviours
are being overly impressed upon the workforce by the changed management.
The converse of this may happen. The appearance of a new management

team into an undisciplined organisation may consider their priority is to improve
safety through good procedures and processes. These are then to be enforced
later, through a management command-and-control approach. The workforce,
however, may not be up to speed with the new vision and are not yet applying
the new systems. They could be confused, uncertain and resistant, or await
training. As such, there may be alienation between the workforce and the new
management. This is potentially an elevated risk-situation for employee safety.
All of the attribute scores may appear low down in Sector C. If located here
it suggests that there is no workforce or management commitment to good
practice safety-culture, attributes or characteristics. The formal and informal

dimensions of safety-culture are below expectations or non-existent. Safety-
culture beliefs when assessed will be limited, diverse, poor or inappropriate for
good safety-performance.
Sector D attributes imply a workforce and management committed to

the informal dimension, good safety-behaviours. However, there is little
evidence of support for a documented system. Since the informal dimension
is usually under the control of management, it may indicate that they are not
inclined to have documented procedures. Such conclusions would require to
be investigated by reviewers for stronger evidence. The workforce, however,
because of the suggested strong safety-behaviours indicated in Sector D, appear
to be committed to safety (vertical axis). They may in their own interest have
set up informal local rules in order to keep safe.
Sector D results usually require considerable debate in order to assess the

psychology of the organisational behaviours and determine if there are sub-
cultures in conflict with the safety-beliefs of the senior management. There are
several possible conflicting signals. The management appears to be engaged
in safety but is not developing an effective safety-management system. On the
other hand, there is a workforce also engaging in risk management through good
safety-behaviours, but with a limited documented system to assist. This may
lead to strong organisational sub-cultures with local ‘procedures and processes’
generated locally to lower accident risks. With rules not being common, shared
or coordinated a situation can arise where the management and the workforce
may have quite separate understanding of the organisation’s true safety-beliefs.
This may be reflected in significantly different safety-behaviours and in some
cases, a different understanding of the real safety status of the plant.
The pictorial approach gives at a glance a broad picture of the organisational

culture, but it needs to be used in conjunction with the safety-culture review
report. Further, concentrating attention only on the attributes falling outside
the ‘strong safety-culture’ Sector A requires to be avoided. Strengths, identified
(Sector A) are important and need to be understood. The supporting safety-
behaviours require revealing, studying, reinforcing, celebrating and duplicating
elsewhere.
By collating the attributes data, an overall picture of all safety-culture

characteristics can be produced (Figure 3.2).
154 Safety Culture
9 D Lack of management A Strong safety

attention to artefacts culture
8
7 A
Informal SC Dimension
6 E C B
5
D
4
3
C Poor safety culture B Possible alienation -
2 management and staff
1
1 2 3 4 5 6 7 8 9
Formal SC Dimension
Figure 3.2 Example – the distribution of safety-culture characteristics
this text.
The characteristics A, B and C appear as strong contributors to organisational

culture. However, the positions of characteristics D and E suggest study is
required by the organisation to understand where the safety-beliefs, behaviours
or documentation, needs to be enhanced to move these characteristics towards
Sector A.
As emphasised, the pictorial is only one relatively minor contribution to

interpreting organisational safety-culture status. It needs to be supported by the
review report that gives the wider narrative as to why a characteristic appears
within a particular sector. This report dialogue should justify, with evidence,
the characteristics’ strengths. Similarly, characteristics falling outside Sector A
and potentially weaker will also have supportive discussion and indicators of
possible routes to enhancement. Understanding the real safety-beliefs, through
the analysis behind strengths and shortfalls is essential in influencing the
development of a safety-culture change and enhancement strategy.
Reflecting back on the accident examples in Chapter 2, Titanic, Bhopal, the

plastics plant explosion, the dropped load event, the criticality event and the
panoramic wet source irradiator, it may be possible to place these events within
the context of Figure 3.2. That is, to consider into which Sector the five safety-
culture characteristics for each event may fall.
There are caveats. There are no detailed safety-culture event reviews.

Assessing in detail the safety-culture attributes is difficult. There are only
published inquiry reports or the outcome of legal proceedings. Also, the
original events may be a cultural ‘snapshot’ when one-off failures of judgement
or behaviour occurred. Alternatively, they may be the result of endemic safety-
culture failure arising from poor safety-beliefs. These beliefs may have been
shared for a significant period of time because they have brought ‘business-
safety success’. These are matters of conjecture, and a detailed review would be
needed to fully establish the facts. As these are historic events this is difficult.
However, noting the caveats, some judgement can be applied to the published
information around the human behaviours prior to the events to broadly
determine the ‘quality’ of informal safety-culture. Some speculation on the state
of the safety-management system, the formal dimension, is perhaps needed
but a bold guess can be made.
With Titanic, there appeared to be weak safety leadership. Safety was not a
recognised value. Because of the organisational belief in the officer’s capability
to assess safety risks in adverse sailing conditions the ship’s safety became less
of a priority than the business objective of a fast Atlantic crossing. Safety was
not integrated into the officers’ behaviours. For example, there appeared to be
no challenge or questioning of the captain’s decisions regarding the ship’s speed
through an iceberg field. There was no rigorous pursuit of the radio operator
for iceberg sightings information or particular concern about having no
binoculars for issue to the ‘iceberg watch crew’. This resulted in the only safety
related equipment to protect the ship being the crew’s eyes. The management
were clearly not learning from other ships’ observations as the radio messages
warning of iceberg sightings were ignored. Nor were they falling back on
their own collective maritime experience of the risk of operating ships in
iceberg fields. Compounding the failure to make conservative safety decisions
regarding excessive speed, the fundamental mistake by the management was
not understanding that on a moonless night ‘blue’ icebergs cannot be seen.
Considering these points the informal safety-culture, the behaviours, would
appear to be scoring low on Figure 3.3(a).
For the safety-management system little can be said as this is not fully
revealed in the documented evidence of the event. The emergency training
156 Safety Culture
aspect and parts of the ship’s commissioning appeared to be poor. There was no
attempt at retraining on essential safety procedures when they had failed. This
was particularly noted after the chaos around the application of the emergency
evacuation procedure and the inability to follow the lifeboat launch procedure.
Also, one may suggest (speculative) that with a fire in a ship’s bunker and the
ship close to port, the written procedure would have advised putting into dock
and having the matter effectively dealt with.
There appeared to be no instructions, procedures, or rules regarding a ship’s

navigation in the presence of ice-pack hazards (for this eventuality reliance
appears, in 1912, to be placed upon the seamanship, experience and skill of the
officers. This experience, culturally, failed). Hence, being generous, the formal
culture, the supporting documentation, would probably score as a medium-to-
low on Figure 3.3(a).
Bringing together the formal and informal safety-culture ‘scores’ suggests

the Titanic’s officers safety-culture was poor. The evidence suggests the majority
of characteristics and supporting attributes would result in a score well within
9 A Strong Safety
D Lack of management
attention to artefacts Culture
8
7
5
Dropped
Titanic load event
4
Plastics facility
3 Bhopal
2 C Poor Safety Culture B Possible alienation -

management and staff
1
1 2 3 4 5 6 7 8 9
Formal SC Dimension
Figure 3.3(a) A possible distribution of safety-culture characteristics for a
sample of events
Sector ‘C’, Figure 3.3(a). The caveats are noted. This was a single event, a
‘snapshot’ in time. However, the stable ‘safety’ belief of complete confidence in
the officers understanding of the risks, poor commissioning behaviours, lack
of attention to emergency procedures, (possibly the concept of an unsinkable
ship) and a bunker fire, suggests this was perhaps historically a poor culture,
an accident waiting to happen.
A rudimentary consideration of the Bhopal incident would put the

‘organisational culture’ well down to the left hand corner of Sector ‘C’. All the
safety-culture characteristics would, if examined, fail to emerge.
With the plastics facility explosion, the organisational safety-culture

characteristics scores may be between Sectors ‘B’ and ‘C’ suggesting a
management with an espoused commitment to safety and a workforce not
particularly alert to the hazards. For some of the safety-culture characteristics,
the associated attributes’ behavioural expectations may score well whilst others
would be relatively poor. For example, there was a safety-management system
which is a positive contributor. It appeared, however, not to support good
culture in application. The procedures were also not systematically enforced.
Breaches appeared to have become an accepted norm. In summary, the formal
structure was there in some form, but the informal safety-behaviours of failing
to implement the system appears to have been poor.
The dropped load incident is difficult to judge as more information

would be required. On the evidence, the safety-management system was
relatively poor; it existed but may have lacked rigour. It may have been present
because it helps the organisation legally but may not have been owned by the
management. Additionally, the workers were as individuals lone workers.
The level of training for the task, management supervision and specific risk
assessment for this particular lone-working environment is unclear. Because
of the lone-working status the assessment should have been of high quality.
It is suggested that this incident would give most of the organisational safety-
culture characteristics a modest score locating the event centrally but with a
Sector C bias.
The criticality event arose due to a systematic abuse of the approved

procedures. There was a safety-management system in place and it may have
been of reasonable quality; this is not reported. However, in the Conversion
Test Building the system was ignored. The organisation’s beliefs had changed
from the imperative of nuclear safety being the top priority at all times, to
158 Safety Culture
production being the priority. The safety-culture it is suggested lies somewhere

between Sector C and B in Figure 3.3(b) with a significant bias to C, a poor
culture.
9 A Strong Safety
D Lack of management
attention to artefacts Culture
8
7
3
C Irradiator Criticality
2 event. event. B Possible alienation -
management and staff
1
1 2 3 4 5 6 7 8 9
Formal SC Dimension
Figure 3.3(b) A possible distribution of safety-culture characteristics for a

sample of events
In the panoramic wet source irradiator safety event there was knowledge
by the operators and the management that procedures were being ignored
and replaced by the unapproved ‘trouble shooting’ procedure. This was not
documented and the procedure detail was carried by word of mouth. The safety-
management system generally, the formal culture dimension, was poor and not
applied. Safety behaviours were systematically poor, such as disengaging the
PLC fuses to disable its functions, ignoring alarms, ignoring instruments and
actually bypassing the interlocked safety doors. In Figure 3.3(b) the irradiator
team’s culture resides, it is suggested, firmly in Sector C.
Figures 3.3(a) and 3.3(b) are speculative. However, if rigorous data are
generated from a culture review, the organisational culture can be revealed,
with the pictorial as one (and only one), helpful contributor to the overall
understanding of the organisations’ culture status.
A Worked Example of ‘a Safety-Culture Review’
This exercise is applied to the panoramic wet source irradiator. There are
caveats on the quality of the official reported information and the exercise is
for illustrative purposes. The event, where two operators were within seconds
of receiving a lethal dose of gamma ionising radiation, was the result of a
degraded safety-culture. The management shaped the culture by, inter alia,
promoting and condoning poor safety practices. These went unchallenged by
the operators.
The exercise takes the reported employees’ identified safety-behaviours

and tests if they are supportive of an organisation demonstrating good safety-
culture characteristics. The safety-beliefs of the organisation are unknown.
However, it can be argued that for a strong safety-culture in a high-hazard
facility, the beliefs in Table 3.2 are a reasonable set and the safety values Table
3.3, can be used to assess any inconsistencies observed in the employees’
reported behaviours.
To demonstrate the principle, the safety-culture characteristic ‘Safety is a

clearly recognised value’ has been considered (Table 3.4). The exercise could be
extended to other characteristics.
In an independent review process there would be considerably more in-

depth, detailed and wide-scoping investigation into examining the facility
culture. This is a caveat, plus the current exercise has the benefit of hindsight.
Nevertheless, if a safety-culture review had been carried out pre-event, the
same safety conclusions would probably have been reached regarding the
shared safety-beliefs and values.
Table 3.9 considers the relationship between the observed behaviours

and the ‘good’ safety-beliefs and ‘good’ values. There is a complete mismatch
between the expectations arising from the beliefs and values and the observed
behaviours. This suggests that the beliefs and values, Tables 3.2 and 3.3, are
not shared in the organisation. In addition, but speculative due to inadequate
inquiry report information, the safety-management system does not appear to
support the application of good behaviours.
Although this exercise has used only limited information (and hindsight)
it can be broadly concluded, by linking the behaviours to the organisational
beliefs, that the employees’ safety-culture was poor. If the remaining four
160 Safety Culture
safety-culture characteristics were included in the exercise, the result would

probably be strengthened still further:
‘Leadership for safety is clear’
‘Accountability for safety is clear’
‘Safety is integrated into all activities’, and
‘Safety is learning drive’
It is suggested that the organisation had different shared safety-beliefs from

those presented in Table 3.2. These different beliefs pushed the organisation
into a degraded poor safety-culture. Chapter 2 proposes that these beliefs were,
inter alia:
• a belief in an inherently safe facility, and
• a belief that that the plant had to be brought back on line quickly
due the production schedule.
This short exercise reveals substantial gaps in management and workforce

safety-behaviours. The employees’ adopted behaviours and the safety-
management system are failing to deliver the expected ‘good’ safety-culture
attributes. If the attributes are not being established in an organisation, safety-
behaviours will be below standard and the culture characteristics weak. As
demonstrated by the observed poor safety-behaviours, the proposed ‘good’
safety-beliefs (Table 3.2) were not upheld. The event reports suggest poor
safety-beliefs and resulting behaviours were practised over several years in the
facility. They became stable beliefs, internalised, accepted norms resulting in
recklessness that was a precursor to the radiation exposure event.
If in a review the quantitative approach was applied (Table 3.8) the formal
culture in the panoramic irradiator facility would probably have scored a low
numerical value. Similarly, the informal dimension where behaviours are
recognised as reckless would generate a low score. This numerical evaluation
(which in a review is one and only one part of the assessment) is reflected in the
positioning of the irradiator event in Sector C as a poor organisational safety-
culture (Figure 3.3(b)).
Finally it may be argued that the behaviours would not have been displayed
in a safety-culture review. The behaviours could have been ‘hidden’. This may
be so. However, the various tools used by reviewers would have revealed
fundamental weaknesses in the culture. Understanding the plant’s operations
and examining documents would undoubtedly reveal an unusual approach
to gaining entry to the irradiator under emergency conditions. There would
have been a review team conclusion that good safety-culture beliefs were being
overridden. With further inquiry, the real shared beliefs of the organisation
would then eventually have been revealed.
Techniques for Self-Assessment of Safety-Culture
The safety-culture review is usually most effective if carried out by an

independent third-party specialist team. As indicated previously, this is in-
depth, across all functions and engages the organisational hierarchy. It confirms
or identifies the safety-beliefs and values driving an organisation’s risk
management capability and gives an understanding of its safety-performance.
This degree of understanding is particularly useful for a ‘first’ safety-culture
review in a high-hazard organisation. Importantly, third-party involvement
avoids any possible compromises or, hierarchical pressures that may arise from
an internally staffed review.
Following the detailed review with its formal executive report, the
organisation has to develop a strategy. What is required is the closure of any
identified safety-culture gaps, a periodic self-assessment to monitor progress
and a plan for continued enhancement.
It is unusual to change a complete organisational culture and probably

undesirable to attempt such an exercise. Most organisations have strengths
in many of their safety-culture attributes and hence their characteristics, with
demonstrably good supporting safety-behaviours. To improve the organisation
safety-culture, change may only be needed locally in some functions or at
some hierarchical levels. The way forward is the development of a manageable
change programme to address gaps that may pose a particular threat to risk
management.
As a contribution to the programme, the output from the initial independent

review is essential to identify gaps in safety-beliefs, values and behaviours.
Similarly the safety-management system may require a review. These changes
162 Safety Culture
can be addressed with commercially available tools. Being implemented by the

organisation’s management and workforce, the tools can give solution ownership
and promote ongoing integration of safety-culture into the business.
Some commercial tools are based on the concept that an organisation’s

culture can be visualised as located on a safety-culture ‘maturity ladder’. The
position for an organisation ‘on the ladder’ ranges from a poor safety-culture
– ‘pathological’ – through to a ‘generative’ safety-culture (Appendix II). A
generative culture suggests a strong culture and aligns with strengths in all of
the five safety-culture characteristics suggested in Chapters 1 and 3.
Each stage on the ladder has a set of safety-culture elements that if present in
an organisation can locate the organisation on its way along the ladder towards
achieving a strong culture, a generative safety-culture. Relating this back to
the five safety-culture characteristics (Figure 3.2), Sector A can be considered
to be a generative culture whilst Sector C may suggest a pathological culture.
Further, due to the quantitative aspect of the five characteristics, the results,
‘measured’ by the initial independent safety-culture review, can be translated
across to the maturity ladder levels.
The ladder approach offers one opportunity in a culture-change process

for a management team to promote the strong vision of attaining a generative
safety-culture. If an organisation is already at that elevated position the vision
would possibly be to ensure the organisation remains there.
The developed tools are available as documented modules for workshop

application. Using the organisation’s internal resource, implementation can
address the following:
• self-assessment of safety-culture
• close safety-culture gaps by a systematic workshop team effort,

and
• engage all levels of the organisation.
The self-assessment module enables an organisation to periodically assess

where it is on its enhancement journey. These assessments can be carried
out locally within a facility, for a particular hierarchical level or, across the
organisation.
Table 3.9 Panoramic irradiator, testing safety-beliefs and observed behaviours for culture characteristic A
Safety-culture Supporting Expected safety behaviour to support Documented expectations to The safety-beliefs being supported by the The safety values being
characteristic attributes the attributes and the characteristic support the attributes and presence of the characteristic supported by the presence
X = safety behaviour not evident on the characteristic (Ref. Table 3.2) of the characteristic
the plant (Ref. Table 3.3)
NT = not tested (data not available)
Characteristic A/1 Safety is – Safety procedures are complied with X – Documented health and safety – ‘The safety of staff, our contractors and – ‘Our individual attention
A ‘Safety given a high – In the face of uncertainty conservative policy exists NT the public is our number one priority in all to safety is a condition of
is a clearly priority at all safety decisions are demonstrated at all – Meeting minutes demonstrate circumstances’– this belief was not observed in employment’. – this value
recognised levels levels X safety before production NT the employees behaviours appeared not to exist
value’ – Decisions made show safety was/is – Meeting minutes indicate – ‘Accountability for safety rests at all times – ‘Everyone is responsible for
considered above production X conservative decision-making NT with managers’ safety, our own, others safety
– There is evidence of a proactive approach – Safety resources are defined in ‘Safety vigilance at all times’ and the protection of the
to resolving problems … X the annual financial budget NT ‘Absolute safety does not exist’ – these beliefs facility’ … this value was not
– Safety has a high profile in the were not reflected in behaviours. Managers applied. Safety was secondary
organisations annual report NT abandoned their accountability and with the to getting the plant back on
operators lacked vigilance line. Overriding the PLC and
bypassing the interlocks on the
doors showed lack of concern
for personal or others safety
Characteristic A/2 Safety – Safety booklets are prepared (as a route – Organisational shared safety- – ‘The safety of staff, our contractors and There was no evidence that at
A ‘Safety values are to sharing beliefs and values) NT beliefs are documented and the public is our number one priority in all any point over several years of
is a clearly communicated – Safety posters are displayed and updated) displayed NT circumstances’ interventions that safety-beliefs
recognised NT – Organisational shared safety ‘Accountability for safety rests at all times with and values were referred to or
value’ – Safety newsletter is made available) NT values are documented and managers’ enforced
– Safety intranet is made available) NT displayed … NT ‘In safety vigilance at all times’ – these beliefs
– Regular management safety – Safety communications were not upheld in communications. There
communications, including emphasis on procedures are in place and was verbal communications on the need to
beliefs and values X used NT use the ‘trouble shooting’ procedure. The
– Safety is proactively given high priority in – A variety of communication procedure was not documented. Managers
internal documents, verbal communications routes are available, resourced in their communications condoned the use of
and decision making X and used … NT the procedures with no reference to the safety
implications
– ‘legal compliance is our minimum
requirement’ – there appeared to be a culture
of non-compliance on the facility. The approved
procedure was ignored and unapproved
procedures used, Interfering with safety
equipment was against procedure, licensing
and illegal
Table 3.9 Continued
Characteristic A/3 Safety – Giving and accepting behavioural – Safety-culture behavioural – ‘The safety of staff, our contractors and – ‘Our individual attention
A ‘Safety conscious challenge is a norm X requirements for each the public is our number one priority in to safety is a condition of
is a clearly behaviour is – Questioning peers and seniors on safety is hierarchical level are all circumstances’ – belief not displayed in employment’ – this value was
recognised accepted by an accepted norm X documented NT behaviours not upheld
value’ all within the – Reporting events and near misses is – A blame tolerant, ‘just’ culture – ‘Accountability for safety rests at all times – ‘That everyone is responsible
organisation rigorously carried out X policy exists with appropriate with managers’ – belief not displayed in for safety, our own, others
– There is proactive searching in operations supporting documentation NT behaviours safety and the protection of
for technical faults and human error X – An events and near miss – ‘safety vigilance at all times’– belief not met, the facility’ – this value was
– Positive feedback is given for ‘good’ reporting system is in place X employees appeared, through their behaviours, not upheld. Reckless behaviour
safety-behaviours NT – There is a procedure for disengaged from the safety risks they faced. endangered individuals and
– Reporting of events is seen as an act for analysing with trending and – ‘Absolute safety does not exist’ – this was not others
learning by managers and workforce X feedback on reported events NT an upheld belief. The plant was believed to be – ‘People’s interventions to
– Safety and safety-culture observations – A learning from experience inherently safe ensure all potential health
are carried out by all and across all the procedure is in place NT – ‘Human error is normal and can be expected’ and safety incidents are
hierarchy NT – Soft-skills training is in place for – not upheld, they did not believe they prevented’– this value was not
– A ‘just’ culture process is applied by all all employee levels to enhance could make a mistake due to inherent safety upheld. There is no evidence
managers X interpersonal skills NT and complete familiarity with the facilities of any intervention to stop bad
operation practice
– ‘Our engagement in safe behaviours is – ‘Everyone has the right to
necessary for safe operations’ – not an belief challenge on safety issues’
of the group – value not upheld as there were
– ‘Human errors are a learning opportunity’ no reported challenges to bad
– there were persistent violation as opposed to practice
errors, there was no learning – ‘ all events and near misses
– ‘legal compliance is our minimum are reported as we recognise
requirement’ – not a shared belief in the that there are no minor injuries’
organisation – value not recognised by the
employees. Did not recognise
breaking procedure as ‘an event’
– ‘Thorough safety training
and competence essential for
safe working’– training not
valued, minimum appears to
have been done for regulatory
requirements
Table 3.9 Continued
Characteristic A/4 – Safety is on all business agendas NT – Business meeting minutes – ‘The safety of staff, our contractors and – ‘Our individual attention
A ‘Safety Acceptance – Safety and production are integrated in demonstrate safety with the public is our number one priority in all to safety is a condition of
is a clearly that safety and discussion at local plant level (tool box talks production are agenda items NT circumstances’– this belief was not reflected in employment’. this value
recognised production go – Safety beliefs and values are regularly – Documented guidance exists the employees behaviours appeared not to exist
value’ hand in hand referred to at meetings as ‘touchstones’ for conducting local tool box – ‘Accountability for safety rests at all times – ‘Everyone is responsible for
and safety guides for the organisation X talks NT with managers’ safety, our own, others safety
– Safety procedures are never bypassed to – Guidance that is used for ‘Safety vigilance at all times’ and the protection of the
achieve production goals X managers to manage production ‘Absolute safety does not exist’ – these beliefs facility’ … this value was not
– The safety of people, plant and process and safety conflicts X were not reflected in behaviours. Managers applied. Safety was secondary
are integrated into all production objectives – Procedures emphasis safety abandoned their accountability and with the to getting the plant t back on
and planning considerations X as a prerequisite for effective operators lacked vigilance line. Overriding the PLC and
business production in high- It appeared not to be a belief that ‘safety and bypassing the interlocks on the
hazard industries X production go ‘hand in hand’ ’. The primary
doors showed lack of concern
– Procedures exist that focus was to bring the plant back into operation for personal or others safety
integrate safety considerations quickly with the overwhelming belief that the
into production planning and facility was inherently safe at all times
scheduling X
– The consequences to
individuals for safety procedures
bypassing, at any hierarchical
level, are available, trained and
understood within the concept
of a ‘just’ culture policy X
Table 3.9 Concluded
Characteristic A/5 Resources – Long term safety resource requirements – Annual business planning – ‘The safety of staff, our contractors and – ‘Thorough safety training and
A ‘Safety are a priority are discussed at annual business planning meeting documentation the public is our number one priority in all competence essential for safe
is a clearly for safety meetings NT identifies safety resources NT circumstances’ – training resources, emergency working’ – this value was not
recognised – Resources are made available for – Artefacts, for example personal exercises, re qualification of operators, were upheld
value’ equipment to be maintained or replaced protective equipment, are of inadequate. This belief could not be upheld with
(equipment not permitted to degrade) X good quality NT this low resource commitment
– Suitably qualified and experienced people – Documentation does not – ‘Accountability for safety rests at all times
are identified to competently operate suggest excessive breakdown of with managers’ – managers appeared not to
facilities and at management levels X safety equipment due to allowed fulfil their accountability for adequate training
– A management of change procedure is degradation X and retraining for operations on a high-hazard
used for structural changes in staffing at – Safety skill requirements facility. Similarly they were content to solve
any level NT and task skill requirements problems as they arose and allowed inadequate
are documented with training equipment (switches) to fail and be repaired
strategies, recruitment strategies repeatedly instead of supplying resources for
etc. X replacements
– A documented and used – ‘Believe in a ‘just’ safety-culture, for people
(register) management of change do come to work to do a good job’ – ironically
procedure exists NT the managers and operators may have thought
– Safety training is resourced and they were doing a ‘good’ job keeping the plant
functioning X operational
Characteristic A/6 There are – Teamwork to resolve safety issues is – Training is implemented on – ‘The safety of staff, our contractors and – ‘That everyone is responsible
A ‘Safety interactions strongly encouraged by all employees NT team working and interpersonal the public is our number one priority in all for safety, our own, others safety
is a clearly at all levels of – Managers actively apply processes to skills requirements at all levels circumstances’ and the protection of the facility’
recognised management obtain feedback from all employees on NT – ‘Accountability for safety rests at all times – ‘That the organisation strives
value’ and workforce safety matters X – Guidance is available on with managers’ for an open dialogue culture’
– Local ‘tool box talks’ address safety in dealing with safety feedback and – ‘Believe in safety vigilance at all times’ – ‘That all events and near misses
dialogue before tasks; current task safety tool box talk expectations NT – ‘Absolute safety does not exist’ are reported as we recognise that
risks and past safety experiences addressed – Feedback questionnaires exist, – ‘Our engagement in safe behaviours is there are no minor injuries’.
(would include in depth discussion of any intranet options are available for necessary for safe operations’ None of these values appear
expectations from risk assessments) X feedback, a fast-track feedback – ‘Believe in a culture of legal compliance is our to have been upheld The
– Senior managers frequently have cross- process is available NT minimum requirement’ opportunities for interaction
organisation safety briefs relating safety The systems are used reviewed –None of these beliefs were upheld. Unacceptable between hierarchical levels did
matters arising to the organisational safety- and feedback acted upon safety-behaviours, against operational procedures not appear to focus on safety
beliefs and values X through a Learning from and regulatory expectations, had developed over issues but upon the means of
Experience procedure X several years and such behaviours had become a putting the plant back into
deep seated norm operation.
Summary
Methods are available to ‘measure’ safety-culture indirectly. One approach is

to apply an independent safety-culture review process developed in Chapter 3.
This is an extensive, in-depth, assessment across a whole organisation.
A review is a sampling process of all organisational functions and

hierarchy levels. It brings together the informal (safety-behaviours) and formal
(documented expectations) safety-culture dimensions. With this collated data,
the review can establish an understanding of the shared organisational safety-
beliefs and how they drive the organisation’s safety-behaviours.
It is possible to use the gathered data in a pictorial form giving an overview

of an organisation’s safety-culture. The safety-culture report gives context to
the findings, recording the organisation’s current safety-beliefs and culture
strengths. Where appropriate the report will give guidance on the need to
resolve identified weaknesses.
On completion of a review a total organisational culture change would not

be expected, desirable or achievable. Most organisations have distinctive safety-
culture strengths as well as possible areas for improvement. The latter would
be a focus for improvement options. An independent review is a first step and
if the culture is identified as requiring enhancement the task is to consider the
benefits and possible approaches. This is considered in Chapter 4.
4
Changing a Safety-Culture
A Way Forward
The status of an organisation’s culture can be demonstrated by the application of

an independent safety-culture review. Once reported, senior management have
choices to make on possible safety-culture changes. Addressing organisational
safety-performance goals is a prerequisite to making such choices.
The compelling safety-culture vision is an essential first step in establishing

what an organisation wants to achieve for the business from its safety-
performance. Being the platform for the management of safety risks, the vision
needs to practically contribute to helping the organisation and its senior team
in achieving the overall business-safety objectives. This overt demonstration of
the contribution of safety-performance can be in terms of its:
• contribution to increased profitability
• lowering costs
• increasing the efficiency of personnel
• increasing the effectiveness of resource-use
• maintaining the business’s public reputation
• upholding the corporate image
• maintaining the customer- and contractor-reputation relationships
• helping to manage a business risk for a viable long-term

enterprise.
170 safety culture
Without an overt business contribution, health and safety-performance

activity can become detached from the organisation and fail to become accepted
as a fundamental business requirement. This has implications for health and
safety’s financial visibility in the business, its perceived importance and the
expected commitment to safety-performance by the organisation. These are
factors that influence the status of an organisation’s safety-culture.
A business strategy will arise from the compelling safety vision. This is a
long-term action plan to achieve the safety goals and monitor performance in
meeting the business’s defined safety objectives. An aspect of this strategy could
be, where appropriate, a safety-culture-change programme. However, if there
are a lack of safety goals, a strategy can not develop. ‘If you don’t know where
you are going, it doesn’t matter which direction you take’ (Lewis Carroll).
The vision, cascading into achievable safety-performance goals will

demonstrate safety’s tangible and essential contribution to the business success.
The link of the compelling safety vision, the goals to the overall business risk
management objectives needs to be robust. If the specific safety goals are not
achieved the cost to the business will be overt and demanding attention. If they
are achieved, the financial and other resulting business benefits will cement
the essential nature of safety-performance into the annual business portfolio of
continuous improvement.
For moral and legal imperatives to achieve tolerable and as low as reasonably
practicable safety risks, all organisations require a compelling safety-culture
vision. Inappropriate safety-performance is, amongst others, a business risk to
be diligently managed in the interests of business success. Safety goals need to
be financially assessed for their business contribution and become an essential
component of any senior team’s business financial portfolio.
Most world-class safety-performance organisations have identified the

potentially huge costs to business of inappropriate safety-performance. World-
class organisations do have a compelling safety vision that is documented,
known by all, displayed and cascades into personal action. Here, safety-
performance is a financial matter and becomes integrated into business
monitoring. If necessary, senior interventions promptly occur to eliminate
diverging safety-risks.
On identifying the safety goals within the business strategy an organisation

can use the output from a safety-culture review to inform the strategy. If, inter
changing a safety-culture 171
alia, a goal is to have a strong culture, then the evidence on the characteristics,
attributes and behaviours that need to change will be in the review. Tasks
required to move toward the organisation’s safety goals will be evident.
Even when reported data indicate there are safety-culture gaps, one choice
is to do nothing, just soldier on. Here the goal is unclear. The status quo on
past safety-performance is to be upheld. This is negative, as it is a ‘no change’
option. A safety-culture review by its nature engages the entire workforce to a
greater or lesser extent. A ‘no change’ choice may lead to a rapid deterioration
in morale as this stance may confirm to the employees that their safety is not
high on the management’s agenda. An already poor safety-performance may
continue to decline.
An alternative management choice is to act by setting up a viable safety-

culture-change programme aimed at achieving a compelling vision of a strong
culture. The vision needs to be agreed and adopted by all in the organisation.
Since a total organisational culture-change is unlikely, the focus comes upon
local safety-culture gaps and upon identified strengths. The strengths have to
understood and reinforced whilst effort is placed on closing the gaps.
Even if a robust safety-culture is reported, choices are still required. The

compelling vision may now be around maintaining what could be a world
class safety-performance organisation. The challenge here is as demanding as
for a poor safety-culture, it being to maintain this strong position over time. A
feature of a strong culture is the safety-management system integrating safety-
culture into the business. This promotes the independence of culture from
individuals or personalities. That is, the culture, supported by the system and
owned and shared by all employees, has developed into something larger than
the sum of the individual cultures. Having achieved this, the culture should
be able to withstand personnel or structural changes at any level. This general
robustness has been demonstrated within several organisations internationally
following structural change. Nevertheless, as noted, cultures can also decline if
not embraced and supported during corporate changes.
If an independent culture review reports a poor culture scenario it is

suggested that most of the safety-culture characteristics and associated
attributes would appear in Sector C (Figure 3.2). In this position, which would
be unusual, significant safety-culture change is required as safety risks may be
close to intolerable. This poor culture scenario is the assumption made in this
Chapter, for practical illustrative purposes.
172 safety culture
Before considering approaches to culture-change, it is suggested that an

important management task is to recognise and address the psychological
implications on individuals of safety-culture change. If neglected, this
can have detrimental effects on change progression and the quality of its
success.
The Psychological Implications of Change
Chapter 1 suggests that culture evolves through trial and error, building
and learning a set of shared organisational beliefs and basic assumptions.
These can become so deep-seated as to be unconscious and unchallenged. If
the organisation continues to succeed in its objectives its shared beliefs are
seen as having contributed to the survival and security of the group. Being
psychologically satisfying, success reinforces the validity and stability of the
beliefs. In addition shared beliefs confirm individual group belonging. It is
difficult to change established attitudes and behaviours that are founded on
such strongly held stable beliefs even if they have ceased to deliver for the
business in changed circumstances. In a status quo environment, the group’s
beliefs give predictability to the outturns of any actions and this reduces group
uncertainty. This stability and predictability will be disrupted by change and
is resisted. In this case, to enable change individuals and groups have to be
convinced that a change from the present culture’s status quo will increase
group success or improve security and stability in turbulent times.
There are everyday examples where group uncertainty is reduced through

common beliefs and behaviours – for example, social groups, sports teams, close
village communities, religious groups, political groups, members of the plant
maintenance team, the information technology group, the senior management
team. Group belief stability can be so great that in the face of alternative beliefs,
with the potential for improve group success, they will be resisted. Collective
denial may emerge establishing a view that there are no meaningful alternative
beliefs to those held by the group. This denial and resistance arise from
experience or observation that change may bring unpleasant uncertainty.
Because of this propensity to resist change, organisations require assessment

as to whether it is collectively ready to accept cultural change. If the outcome
suggests change will be resisted and the current status quo will not be readily
surrendered, then managers will need to engage in a change philosophy
communication.
When safety-culture change occurs individuals have to unlearn their current

safety-beliefs and values whilst learning new ones. This also requires learning
new safety-behaviours. The uncertainty generated can be psychologically
uncomfortable, create anxiety and is compounded by most people having
previously experienced unpleasant anxiety arising from uncertainty. Change
can be considered as destabilising, introduce unpredictability and be a personal
threat to a current ‘life style’. To reduce the level of anxiety the compelling vision
of a better future has to be effectively communicated. The future condition has to
be ‘seen’ as potentially far more successful for individuals than the present. An
unsuccessful communication will be replaced by rumour. The anxiety generated
by the rumour of change may be so great that resistance may emerge before
proposals are formally suggested and fail against the ‘old’ culture’s stability.
Anxiety arises from fears of:
• loss of personal identity, that is, role change
• group restructuring, with the possible loss of group membership,

perceived loss of employment
• temporary incompetence as new safety-beliefs, values and

behaviours have to be learnt alongside peers and subordinates
• adverse consequences if one appears incompetent during the

change and learning process
• loss of personal power and authority secured by the ‘old ways’ of

doing business.
These fears are understandable and recognised as arising in many social

change events. Fears and anxiety need to be managed.
Resistance to change arising from fears may be dynamic through disruption

and non-cooperation. It can also be subtle and corrosive through individuals
or sub-groups espousing ‘unofficial beliefs and values’ that reflect upon the
advantages of the current status quo compared with the anxious uncertainty
of change.
For a change programme to gain employee support, management

needs, inter alia, to make the change environment safe psychologically. The
174 safety culture
environment has to be secure in three phases of change: recognition of the need

to change, rejuvenation and resolution.
Recognition of the Need for Safety-Culture Change
The managers collectively, in dialogue with the employees, identify the need for
change. Recognition can arise from an independent safety-culture review or a
self-assessment promoted by a CEO, a regulatory intervention or as directed by
the company shareholders. Change may arise due to a variety of circumstances,
for example frequent accidents causing continuing business losses, or public
and media attention promoting a demand for a specific high hazard industry
to adopt a new approach to improve safety-performance.
Rejuvenation of the Safety-Culture
Having recognised the need for change, the organisation engages in a

journey of rejuvenation. The staff generally will need to align with the new
vision by changing their collective and individual safety-culture behaviours.
Psychological anxiety amongst individuals will arise as the ‘old ways’ become
threatened. If the anxiety is not recognised and managed any initial enthusiasm
for change may degenerate into resistance. It is in the rejuvenation period, the
centre of the change, where psychological safety has to be assured. Some factors
to be managed are:
• The provision of the compelling safety-culture vision demonstrating

that a transition from the current culture to a different culture will
bring ‘more business success’
• All employees (which should include the executives and senior

manages) to be given formal training on the new safety-beliefs,
safety values, expected role specific safety-behaviours
• Engage all employees with safety-culture training in an interactive,

open, non-threatening environment
• Attempt to ‘use tomorrow’ the changes ‘learnt today’
• In team working (as well as at the individual level) people are

encouraged to apply new cultural ways; in a group environment
people (even at the most senior level) will not feel alienated if
mistakes are made, are mentored and then the team moves on
• Driven by the new beliefs the implementation of revised safety-

behaviours can be encouraged by role models; these role models
are normally the organisation’s leaders: managers, supervisors,
employee representatives or particularly committed workforce
individuals who step forward from conviction and understanding
• A ‘business safety-culture change group’ can be considered; this

can be a forum which acts as a custodian of the programme and
where the workforce, managers and supervisors can question and
challenge the programme’s efficiency and effectiveness. However,
caution is needed to ensure the group is not perceived to ‘take over’
or be responsible for safety-culture change; accountability for the
change rests with the senior management of the organisation
• For senior managers to establish agreed antecedents, enablers and

consequences (positive and mentoring) for changing safety-culture
behaviours.
During safety-culture change, the above factors if implemented may help

to reduce psychological anxiety. The key contribution is senior management
engagement, through charismatic, authoritative, leadership within a ‘just’
culture. Practical, safety-culture change activities in a mixed hierarchy groups
need to be encouraged as it sends a powerful message that the organisational
value of collective team work effort is being adopted. As well as easing
communications, team effort strengthens bonds, confirms everybody is ‘in
the same boat’ and indicates that success depends on a total organisational
effort.
Resolution
At this stage, the organisation has resolved to internalise its new learning.
This manifests itself-in new safety-culture behaviours becoming ‘natural’
performance within the organisation. If demonstrably delivering the compelling
safety vision the new culture will become stable.
Making the Change
For most high hazard organisations a culture review identifies strengths

in safety-culture characteristics. From the review analysis the culture
176 safety culture
characteristics and attributes will tend to cluster around the centre of the
pictorial (Figure 3.2), usually showing a tendency towards Sector A. If there are
significant difficulties with an organisation’s culture, most characteristics will
appear well down in Sector C. For Sector A attributes a change programme can
be developed to understand their behavioural strengths and look to transfer
them to improve any weaker attributes. With a Sector C position, there may be
a need for a more radical intervention.
Depending upon an organisation’s position on the spectrum, the intensity

of a change programme and the steps applied are a matter of management
choice. Within a dialogue culture the programme requires discussion,
agreement and support through a collective commitment to change. Tools
are commercially available to assist in the various tasks to generate safety-
culture change. These are briefly introduced. Their application, inter alia,
can be helpful, but safety-culture is a complex phenomenon involving
the psychology of people, charismatic management leadership and other
essential soft behavioural skills. Success is not guaranteed. However,
there are encouraging examples of change programme success with safety
changes becoming integrated into the business leading to a continuous safety
improvement environment.
To discuss change programme options the premise is that an organisation

has been identified as having a poor culture (Figure 3.2 Sector C). In the
recognition phase, senior management generate in consultation the safety-
culture vision and the change programme. There are many published papers
that can be called upon describing techniques for cultural change. In this text
two approaches are considered:
1. an organisation’s self-generated and managed change programme
2. a modular assisted approach to programme delivery.
An Organisation’s Self-Generated Change Programme
This approach focuses on organisational ownership and facilitation of the change

programme development and its delivery. The programme development and
implementation is driven by common good practice management tools, with
emphasis on achieving enhanced human behaviours and interpersonal skills.
The programme approach may be integrated into a management system and

include:
• a safety-culture change policy and strategy
• establishing the delivery organisation
• planning to deliver and implement change identified in the

independent review report
• monitoring safety-culture change progress
• reviewing the change programme and
• auditing (as appropriate).
This is a standard safety-management system approach. The change

programme is integrated into an organisation’s quality management system
which implements and monitors the change through fit-for-purpose processes.
(The modular assisted approach discussed later draws on commercially
changed module process tools to possibly assist in programme delivery.)
The change programme has to have the leadership of the senior management
team as this is where resources are controlled, direction is given and the culture
is shaped. A dynamic commitment is suggested, where overt action is taken,
the programme’s performance is regularly communicated and management
engagement is experienced by all employees. If effective safety-culture
leadership and commitment emerges and is integrated into the management
systems, a sound investment will have been made.
With the full commitment of the senior management team a change

programme needs to be developed either for local changes or something more
radical. The assumption for this chapter is that significant organisational
change is attempted (this would be unusual, but is adopted in this text to enable
discussion of principles).
The programme needs to be implemented, as far as is reasonably practicable,

using cross-functional, cross-hierarchy workshops to build a dialogue culture
and adhere to the value of team working for problem resolution. The approach
to constructing a specific change programme is organisational dependent.
178 safety culture
This could be facilitated through an internal working party, a safety-culture

change committee, or an externally facilitated event. This is an organisational
decision for an organisation has to own, drive and deliver its programme and
be committed at every hierarchical level.
It is beneficial to avoid too much change in a short period by pacing the

programme. If possible advantage can be taken of a few ‘quick wins’ with early
valued added delivery, followed by a progressive and timely resolution of other
change tasks. The programme’s content will be derived, inter alia, from the
findings of the independent review. Typically, having established safety goals
and the vision it is necessary to agree good organisationally shared safety-
culture beliefs and values. This is a fundamental step in a change programme. If
the beliefs are already considered acceptable and shared across the organisation,
then they may only require a collective review, be refreshed and communicated.
Poor shared safety-beliefs and values (locally or across functions) will inhibit
bringing safety-performance success and inhibit the delivery of improved risk
management. Gaps in safety-culture characteristics and attributes will reveal
this paucity. The employees’ safety-behaviours revealed as culture gaps and
misalignment with good safety-beliefs will need attention. Where documented
processes, artefacts and employee attitudes are not supporting a strong culture,
the change programme addresses these inhibitors. With any programme
setbacks will occur for individuals, groups and possibly the organisation
collectively. However, it is helpful in a psychologically safe environment if
setbacks are taken as ‘time out’ learning opportunities.
Some key steps in generating a culture-change programme are given below.

They are not necessarily comprehensive and some may not be appropriate for
all organisations. Nevertheless they form a foundation:
• Establish senior management, line management, supervisor and

the workforce commitment to change as an integrated team effort
• Managers establish psychological ease to reduce anxiety
• Establish a compelling safety vision, fully understanding the

organisational safety-culture behavioural goals
• Review or develop organisational shared safety-beliefs and values

to achieve the safety vision
• Using the independent safety-culture review data, assess the

reported status of the organisational safety-culture characteristics
(Table 3.1)
• Determine where behavioural change is needed
• Programme the behavioural changes needed with a practical

strategy for delivering the change. All employees including
management are to be engaged; for example:
Executive and senior management
Middle managers
Supervisors
Work force.
• Where behavioural change is identified, senior managers,

managers, supervisors and the workforce require to be engaged in
the assessment of antecedents and agree (positive and mentoring)
consequences for agreed behaviours. This is an essential contributor
to the success of a change programme (Table 1.1 (a) and (b) ). It is

expected that some behaviour change will be generic. However,

some will be specific. Because of their organisational role, the
safety-behaviours of senior managers will differ from those of
the supervisors, which will again be different, in detail, from the
middle manager and workforce (Table 4.1)
• Assess from the independent review output data the gaps in the
safety-management system that are not supporting the revised or
reviewed beliefs and values. Changes to the system, implemented
by procedure, can be programmed
• Establish reactive and proactive key performance indicators
• Implement a progress monitoring strategy
• Implement senior management’s progress review of the change

strategy
180 safety culture
• Have a safety-culture change feedback mechanism and infrastructure

accessible to employees
• Establish a culture-change performance communications process.
Table 4.1 Senior managers’ safety-behaviours
Hierarchy group Required safety-behaviours (examples only)

Senior Overarching (examples):
Management. – Give visible leadership and commitment to safety
– Communicate, espouse and implement agreed organisational safety-beliefs
and values within a dialogue culture
– Challenge and question on safety issues at all times
– Have a positive attitude to safety
– Exercise a transformational and mentoring management-style
– Actively delegate safety responsibility within their framework of safety
accountability
– Generate trust and openness
– Personally commit to and exercise good (physical) safety-behaviours
Specific behaviours (example):
– ‘Walk the talk’, be seen on the ‘shop floor’
– Overt personal safety-behaviours aligned with safety-beliefs
– Regularly discuss safety at all levels
– Always challenge poor safety-behaviours at any level
– Commit and monitor safety resource requirements
– Generate enabling antecedents and consequences for subordinates
– Safety is given priority and integrated into all business processes
– Take part in joint ‘walkabouts’, audits, safety reviews
– Do safety behaviour observations
– Encourage team solutions to safety problems
– Own the safety improvement programmes
– Senior managers purposely build trust in the organisational belief that safety
is the priority
– Senior managers develop a ‘just’ culture
– Recognise and reward good health and safety-performance
– Recognise and reward ‘good’ safety and safety-culture behaviours from teams
– Train people to look for good and ‘bad’ safety news
– Pursue a dialogue culture to identify and resolve safety issues
– Welcome all news in order to remain informed
– Personally and frequently hold safety meetings to achieve ‘dialogue’ whilst
avoiding ‘telling people’
– Senior managers are a demonstrably good listener
– Openly treat human errors as learning opportunities within a ‘just’ culture policy
Safety-culture change needs to be a collective effort and soft-skills training at

all levels is a key supporting factor. Solving problems identified by an independent
safety-culture review will require cross-functional workshops. The exercising of
soft skills will become integral to such activities to progressively improve the
effectiveness and efficiency of the programme delivery.
The independent safety-culture review output data based on the generic

culture model and integrated with the five safety-culture characteristics can be
assessed, managed and monitored into a change programme. The programme
can then be implemented and facilitated using the organisation’s own workshop
and training methods. This is a flexible approach enabling the organisation to
take ownership of the change process. The execution of a change programme
may take from one to two years. At the end of this period consideration can be
given to repeating the independent review or implementing self-assessment.
A Modular Assisted Approach to Change Programme Delivery
The safety-culture ‘Maturity Model’ (reproduced with the kind permission of

Shell International Exploration and Production Hearts and Minds Programme;
for further information visit www.energyinst.org.uk/heartsandminds.
Programme available from The Energy Institute.) is derived from specific
academic research and dialogue within the petrochemical industry and has
certain fixed parameters. In the model the organisational safety-beliefs and
values are presented as a given minimum set. In addition, the ‘compelling
safety vision’ is achieving a ‘Generative Culture’ (Appendix II). This systematic
approach has arisen from the particular safety focus and business needs
within petrochemical facilities. Organisation’s can demonstrate achieving
the ‘compelling safety vision’ by having established a set of safety-culture
characteristics (defined as ‘elements’ in the maturity model) and the associated
attributes (defined as ‘dimensions’ in the model).
For an organisation to meet the model’s safety-beliefs and the vision there
is a set of minimum behavioural expectations associated with each attribute
(the dimensions) and hence the associated characteristics (the elements) These
behaviours have to be achieved by an organisation, a site or plant in order
to meet the compelling vision. The model has a range of possible behaviour
profiles across five maturity states and by an organisation testing its current
behaviours profile it can determine how far it is from achieving the safety
vision of a generative culture.
The Maturity Model Safety Vision Beliefs and Values
The maturity model applies the concept that organisations can be considered
to be in one of five culture states. These form a safety-culture maturity ladder.
The culture states are:
182 safety culture
• Pathological
• Reactive
• Calculative
• Proactive
• Generative. (Text reproduced with the kind permission of Shell

International Exploration and Production.)
Definitions are given in Appendix II and the ladder is shown schematically

in Figure 4.1.
GENERATIVE
HSE is how we do business
round here
ed
PROACTIVE
m
or
inf
We work on problems that we

s�ll ﬁnd
ly
ing
as
ity
cre
bil
CALCULATIVE
In
ta
un
We have systems in place to

co
manage all hazards

Ac
nd
a
st
REACTIVE
ru
gT
Safety is important, we do a lot

sin
every �me we have an accident

a
re
Inc
PATHOLOGICAL
Who cares as long as
we’re not caught
Figure 4.1 A safety-culture ladder

Source: Hearts and Minds Programme, available from The Energy Institute,
reproduced with the kind permission of Shell International Exploration and
Production. For further information visit www.energyinst.org.uk/heartsandminds
Pathological is essentially a poor safety-culture and can be considered as

Sector C culture in Figure 3.1. A strong safety-culture as suggested by Sector A
can be considered as a generative culture.
For organisations using the maturity model concept, the safety vision (the
compelling vision) is to achieve a generative culture. To reach this level all employees
need to display a particular safety-behaviours profile. The behaviours expectations
have arisen from extensive research into the safety human performance needs
of high-hazard, low-risk chemical facilities. It is assumed in the model that the
safety management system is well designed. The model addresses the maturity of
behaviours not the maturity of the safety management system.
The combined beliefs and values for an organisation with a generative

culture are given in Table 4.2.
Table 4.2 A generative organisation
Low profile
Low accident rate – but there is always bad luck
Active involvement and accountability for all
Workforce initiative in health safety environment and operations
Short and effective feedback line
Procedures under constant scrutiny
Training, cross-training and more training
Benchmarking against others, inside and out
Obsessive planning – variety creates mindfulness
Willing to try new ideas, but accept the risk of failure
Chronic unease
The Maturity Model and Safety-Culture Change
The model can be implemented through a series of commercially available

workshop modules to enable a safety-culture-change programme to progress
toward its safety vision. The modules can be applied to close behavioural gaps
and using a culture self-assessment tool to periodically monitor safety-culture
change progress.
184 safety culture
The self-assessment module gives an understanding of where the

organisation is located on the maturity ladder; that is, pathological, generative
or somewhere in between. With this information, the module with the pre-
defined minimum set of expected behaviours described or each of maturity
level gives an indication of the safety behaviour change to be achieved to move
to the next stage on the maturity ladder.
To meet each level’s cultural requirements the behavioural and management

systems’ changes that need to be embedded forms the content of successive
change programme phases. Specific topic workshop modules are then used
to address the content and attempt each phase of change. This is a repeated
cycle triggered by a periodic self-assessment to test the organisation’s progress
toward its compelling safety vision. This is a systematic process giving a
consistency of application, organisational ownership and over time develops
organisational skills in module delivery.
The safety-culture self-assessment module has an advantage that it can be

facilitated with a mixed hierarchical and functional group or it can be taken
by single hierarchy level, function, a single plant or some combination. Being
used at any stage in the change journey, the self-assessment module identifies
as noted, where the organisation, a group, or function is on the maturity ladder.
This gives a pictorial of progress toward the generative culture.
It is suggested by the author that the use of self-assessment is most advantageous

in organisations which are relatively mature in their culture, have satisfactory to
good safety-performance and overtly operate a ‘just’ culture. The management
has to be cooperative on all safety issues and not autocratic. If these conditions are
not applicable to an organisation and it has a less than mature culture a tailored
independent safety-culture review may be the more constructive intervention.
Here, the independence factor is important for immature organisations that need
to ‘unpack’ their deepest safety-beliefs, assumptions and values.
There is sufficient synergy between the independent safety-culture review

five characteristics (Table 3.1) and the maturity model’s characteristics (with
supporting attributes), for an organisation to be positioned on the maturity
ladder, for example poor culture – pathological, strong culture – generative
(Table 4.3). With an organisation having developed a first-phase programme
from an independent safety-culture review the maturity model module could
be effectively used to implement this programme phase. (However, the one
dimensional aspect of the maturity model, addressing only behaviours, needs
accomodation in relation to the two dimensions (formal and informal) of the

independent review approach.)
The maturity model modules are commercially available and with the
option to use the modules repeatedly in workshops for safety-culture issues-
resolution, they form a long-term investment. The modules can be applied by
an organisation’s internal resources and the standardised modular concept
introduces systematic rigour with continuity of application. Through workshop
application the modules can engage all employees in a change programme
gaining commitment through a team approach.
Table 4.3 Maturity model elements and the five safety-culture

characteristics
Maturity model characteristics The five safety-culture characteristics

1. Leadership and commitment 1. Safety is a clearly recognised value
2. Policy and strategic objectives (mm 1, 2, 3)
3. Organisation, responsibilities, resources 2. Leadership for safety is clear
standards and documentation (mm 1, 2, 3)
4. Hazards and effects management 3. Accountability for safety is clear
5. Planning and procedures (mm 1, 3)
6. Implementation and monitoring 4. Safety is integrated into all activities
7. Audit (mm 3, 4, 5, 6)
8. Review 5. Safety is learning-driven
(mm 6, 7, 8)
[mm = maturity model characteristic number]
Source: Maturity model elements, Hearts and Minds Programme, available from The
Energy Institute, reproduced with the kind permission of Shell International Exploration and
Production. For further information visit www.energyinst.org.uk/heratsandminds
Change Programme Metrics
The metrics should be such that changes in their quantitative values can be
measured and frequently reported within the organisation. Metrics need to be
representative of change and be a manageable number. It is suggested they
demonstrate change progress, regression or herald stagnation. Progress can be
celebrated whilst regression or stagnation are opportunities to take stock of the
change programme’s content, its focus and implementation strategy.
Leadership for Safety – Soft Skills and Behaviours
During the design and operation of hazardous facilities, considerable effort

is expended on the plant’s engineering to reduce the risk of fatalities, injuries
186 safety culture
and the environmental impact from malfunctions. This risk reduction has been
historically strengthened by the adoption of procedures within a formal safety-
management system. As noted (Chapter 1) the aftermath of the Chernobyl
accident caused considerable focus on the importance of the organisational
safety-culture and the human performance of individuals. It became clear
through research into human organisational performance that engineering and
safety systems are essential but not sufficient. That is, organisational safety-
culture forms an essential contributor to risk reduction. Examples proposed
(Chapter 2) demonstrate that if an organisation’s culture is poor the engineering
and procedural systems can degrade, resulting in increasing accident risks. This
is irrespective of their initial high quality or the designers’ intent to provide
defence in depth to protect operators and the public.
It is suggested that executives and senior managers shape the organisational

safety-culture through their stated organisational safety behaviour expectations,
espoused safety-beliefs and safety values. These features become embedded
within a disciplined environment of plant operations or design. The senior
management assist the shaping further, by demonstrating personal ‘good’
safety-behaviours. Middle managers and supervisors are equally important
in cascading these expectations throughout their area of influence. For this
to be successful, attention needs to be paid to the organisation’s soft-skills
training. For example, two distinguishing features of a good culture are a
dialogue culture and a ‘just’ culture. This implies the essential nature of having
a communicative organisation. To encourage and shape culture, the executive
and senior management need to be technically competent in their specialist
fields. However, there is also a need, as managers, to implement charismatic
leadership. For some managers this comes naturally. It is suggested that for
the majority this is a learnt skill. Leadership, inter alia, includes a variety of
communications skills; listening, mentoring, facilitating observational skills,
with the ability to empathise with subordinates workplace concerns or
anxieties. Many managers in industrial hierarchies believe they have soft skills.
Research demonstrates the opposite. That is, most managers make progress in a
hierarchy because they are technically skilled and not necessarily because they
are competent managers. For managers to shape a strong safety-culture through
their leadership the importance of soft skills cannot be over-emphasised.
The need for these skills is not restricted to managers. Culture-change is a

cross-organisational team effort where workforce members will regularly be
‘leaders’. This may for example be momentarily, during a safety meeting, or
more substantially when they take a role as a task team member. In a dialogue
culture the need to communicate on safety issues becomes a feature of doing

business. This is particularly so if challenge and questioning are required
for observed misaligned safety-behaviours. Similarly, there will be a need to
accept challenge for the occasional personal misaligned safety or safety-culture
behaviour. There is also the contribution to dialogue of verbally giving and
taking praise. In these cases the skill is to give challenge and receive challenge,
in a non-threatening, supportive and informed manner.
Tools are commercially available dealing explicitly with safety leadership.

If these skills are neglected, evidence suggests a change programme will take
longer than anticipated to implement, be possibly fractious and of reduced
quality. Soft-skills training also assists in alleviating change anxiety.
To achieve the correct behaviours the required antecedents, enablers and

consequences (positive and mentoring) (Table 1.1 (a) ) require to be put in

place by management. This is a management leadership task. The workforce

cannot influence too greatly the setting of antecedents. As an example, if an
organisation has a safety value ‘we value that team work, to resolve safety
matters, is strongly supported’ (Table 3.3) the expected behaviour from
managers and supervisors is that they openly encourage team work. An
antecedent is that ‘time’ is made available when required to enable teams to be
brought together. Supporting this antecedent are the additional management
and workforce cultural behaviours of monitoring, questioning, challenge and
mentoring, which discourage individuals from ‘going it alone’ if they identify
safety problems that need resolution.
Making Safety-Culture Change Last
A series of actions arise at the start of a safety-culture change journey to

form the change programme. These may be from the independent third-
party safety-culture review report or a culture self-assessment. Some of the
possible change requirements have already been discussed: safety-beliefs,
safety values, leadership skills, soft skills and the establishing of new safety-
behaviours. Many of the requirements will be in the informal safety-culture
dimension but some attention may be required for the artefacts, the formal
safety-culture. To implement a safety-culture change in both dimensions and
for it to become stable, regression to previous poor safety-behaviours needs
to be avoided. Some enabling factors have been discussed but are worthy of
reiteration.
188 safety culture
Enabling contributions in the informal dimension:
• All senior managers have to be committed to the change programme,

(a ‘heart and soul’ issue)
• Senior managers have to be committed to leadership in safety, and

train if necessary to achieve this
• Involvement of the workforce and management in the safety-

culture-change programme; including planning, implementation,
monitoring and programme review
• An open involvement of the workforce in safety decisions
• The removal, by managers, of psychological anxiety, generating a

‘safe environment’ to test change requirements, to succeed, to fail, to
question safety, to challenge and to contribute by removing barriers
to change. This openness contributes to generating a ‘no fear’ and
a dialogue culture.
Enabling contributions in the formal dimension:
• The change programme is effective if integrated into the management

system
• Safety-culture requirements, behaviours and expectations to be

integrated into relevant management system procedures and
processes
• Integrate into the management system the safety-culture tools that

can be regularly brought into use to support long-term continuous
improvement
• Enabling the involvement of all staff through the documenting and

implementing of a ‘just’ culture policy
• Develop a change progress communications strategy
• Develop and document antecedents and consequences.

Safety Behavioural Observation Techniques
A distinction is required between two applications of behavioural monitoring

techniques. The first is the use of behavioural safety observation techniques
within the operational environment where physical tasks and processes are
carried out. The application is essentially a practical exercise. Basically, agreed
methods of carrying out hazardous tasks to minimise risks are generated and
the methods trained. Employees are trained to do observations on peers, seniors
or subordinates, assessing against a checklist if a task is being performed to an
agreed menu. The checklists are used to consider safe and unsafe acts and, as
appropriate for example, observe the use of personal protective equipment.
Feedback is given on performance during the observation. The implementation
of the technique is supported by refresher training, infrastructure for
observations, data collection, analysis, a reporting processes and a mechanism
to trigger improvements if deviations are observed. Good practice is also
communicated and celebrated. Observational techniques can be a significant
financial investment yet an important contributor to risk management.
The second application of observational techniques is associated within

safety-culture by monitoring ‘role behaviours’. For example, leadership
behaviours are role behaviours as are mentoring, challenging, questioning,
and so on. For a safety-culture-change programme the ‘role behaviours’
require to be monitored for implementation and embedding. This is a slightly
different concept from observing a person working on a hazardous task in an
operational environment. For role observations, the executive, senior managers,
managers, supervisors and the operational workforce will have agreed their
safety ‘role behaviours’. These may be documented or just the way things are
done, the norm. In addition there will be the necessary antecedents with agreed
consequences established by the management and workforce. Observational
techniques are then applied using the agreed role behaviours as a benchmark.
Comparison with plant-task observations suggests that role-dependent

behaviours are in some respects more challenging to monitor and involve
observations:
• in an office environment
• generally when moving about a hazardous site
• at formal internal meetings

190 safety culture
• at ad hoc discussions with designers
• in meetings with regulators and
• when challenging peers or seniors on safety issues.
The conclusions of role behavioural observations are based, on occasions,

on judgement. There may be some misunderstandings now and again, as role
observations are often carried out in a dynamic, often complex, interpersonal
arena, for example questioning, challenging or, safety-behaviours in a meeting
environment. However, role observations need to be done and be effective.
Hierarchical role safety-behaviours are agreed within the organisation as

expectations that are fundamental to the organisation achieving the change from
a poor culture to a new safety-culture vision. Observations are implemented to
assist in delivering the philosophy of establishing, owning and maintaining good
safety-beliefs and values. Monitoring will require upwards and downwards
challenging, mentoring, praising and questioning, and the requirement for
good inter-personal skills to achieve this at all levels becomes an essential
prerequisite. Safety role behavioural observations are not restricted to observing
the operational workforce. Observations are required throughout the hierarchy
and in due course go beyond the change journey into continuous improvement.
To satisfactorily ‘complete’ the safety-culture change programme, the

behavioural monitoring strategy has to be effective. Research suggests that if it
is inadequate the benefits to the business of moving from a poor to a strong or
generative culture will remain ephemeral. Essentially, behavioural monitoring
if ineffective suggests limited attention has been given to the antecedents
and consequences of good and poor behaviours. Further, safety behavioural
discipline may not have been promoted by managers and the sharing of new
safety-culture beliefs becomes debatable.
It is recognised that role behaviour observation techniques, as with on-plant

safety behaviour observations, are not a panacea for achieving a good safety-
culture. They are just one tool in a collection of change initiatives to move a
culture forward. If mishandled for example, introduced into an immature
culture that may be a fear culture, then application will prove to be ineffective.
In such situations, there is the possibility that observation tools can be used to
exclusively focus on workforce behaviours. This is misguided. Research suggests
that for most accidents the worker is the last actor introducing an active error into
a string of previously established latent errors. The latent error line starts in many
cases with inappropriate management decisions compounded by inappropriate
safety-beliefs, policy, procedures, supervision, training or facility design. When
mishandled, managers may use observational behavioural safety techniques
as a quick fix to problems whilst the root cause, possibly poor management or
inadequate equipment design, is ignored. This fix can be the assigning of incident
causes to the workforce. If, for example, blame is a frequent consequence of
events reporting, a fear culture may emerge. A response of blaming the worker
can alleviate managers from fulfilling the responsibility of seeking the root cause
of events. Investigations can be time-consuming. A quick fix may perhaps avoid
having to address the costly need for plant or procedure improvements, or seek
improvements in management capability. The rush to ‘blame’ is always a potential
short term ‘solution’. However, evidence suggests that if frequently exercised
it sets the scene for repeat events. In such an environment the application of
behavioural safety techniques is a chronic waste of resources, achieving little in
the support of culture improvement.
Role behaviour observational techniques are required to be applied to

executives and all other layers of management. As indicated, many accidents
have arisen from managerial latent errors. As such, significant added value can
be had by role safety behaviour observations to ensure implementation of agreed
safety behavioural expectations at the highest organisational levels. If there is a
failure to implement good safety-behaviours here a change programme is liable
to lose the support of the general workforce. Observational techniques applied
at all levels are a mechanism to implement, encourage and embed good safety
behaviour and gain continuing employee support for change. Well-designed
behavioural observation programmes can assist in maintaining the profile of
safety-culture expectations, promoting universally ‘good’ safety attitudes and
reinforcing expected human performance.
There are several well-tested commercial behavioural observational

techniques packages available. These can be tailored to specific needs.
These systems are a useful contribution to culture-change initiatives and for
supporting continuous improvement activities.
Change-Programme Monitoring, Review and Continuous

Improvement
Integral to a change programme is progress monitoring. It is essential to have

monitoring tools for assessing change progress, giving management oversight
192 safety culture
and maintaining staff motivation. Monitoring has to be regular with both good
news and setbacks discussed openly contributing to a dialogue culture. As part
of the monitoring process the following tools can be brought to bear:
• Use the change programmes metrics, reactive and proactive, to

measure progress and setbacks
• Implement a cross-company, inclusive, communications strategy
• Frequently communicate progress
• Communications should be led by senior managers
• Use, periodically, safety-culture climate questionnaires with results

feedback
• Carry out periodic self-assessment safety-culture reviews
• Use self-assessment data to visually display on boards, intranet sites

and organisational publications, the progress along the maturity
ladder (Figure 4.1) or the five characteristics pictorial (Figure 3.1)
• Identify and report on the achieved organisational business benefits

accruing from the safety-culture change journey.
Owned at senior management level, a change programme management

review is normally formalised as an annual exercise and triggered and formalised
in a management system procedure. Culture-change progress data is collated
and the review exercise assesses if the programme is delivering the expected
agreed safety-culture goals. As senior managers have access to resources and
finance, they can authorise and direct programme changes. A key indicator for
management review would be to assess if revised safety-beliefs and values are
shared, stabilising and becoming rooted in the business.
If at some stage the organisation’s specific compelling culture vision has

been demonstrably achieved, there is the opportunity to revise the totality
of the strategy. When stabilised, the changed culture should begin to deliver
improvements in safety-performance, morale and the business. At this point
the organisation may be positioned to celebrate its achievements and move into
a phase of continuous safety improvement.
Summary
Having completed an independent safety-culture review and identified the need

for change it is necessary to determine the steps needed to gain a generative or
strong culture. Chapter 4 suggests that organisations in a weak culture position
have an option of gaining the attributes of a generative, pluralist, dialogue
culture, or some other culture-change vision, appropriate to their business. If
an initial independent review suggests the organisation is some way from the
vision then various steps can be taken, commencing with a reassessment of
the organisation’s fundamental safety-beliefs and values. This would form an
initial component of a safety-culture-change programme.
The change programme can be designed to integrate into an organisation’s

safety-management system, carrying the programme systematically forward
from the founding change policy decision, through implementation, to monitoring
and review of its effectiveness. Regular management communications within the
organisation on progress to celebrate achievements and to give encouragement
are required. When a strong safety-culture, a generative culture is achieved, it
will be recognised through success criteria. At this point it may be opportune
to move to a continuous improvement framework.
5
Epilogue
Concluding Remarks
It is suggested that good safety-beliefs, values, behaviours and supportive soft

skills are needed to develop a strong organisational safety-culture or sustain
an already good culture. In this text, a theme has been the important role of
management in this development by promoting and shaping organisational
safety-culture. The requirement on the workforce is to respond positively,
within a ‘just’ culture, recognising that safety-performance excellence is a key
organisational requirement in high-hazard businesses. Due to the various
characteristics and attributes of safety-culture, summarising the management’s
role can be difficult, but it is perhaps useful to focus on just a few aspects.
In a strong organisational culture, management displays some of the

following leadership features:
• a non-autocratic, open and listening management style
• overt commitment to safety, health and environment protection
• a documented safety-management system, monitored for its use

and effectiveness in delivering safety
• encouraging staff involvement in safety-strategy decisions
• good internal safety communications (dialogue) between management

and the workforce that is driven and pursued by the management
• ensuring a process is in place for the reporting and analysis of all

internal and external safety events, recognising that all safety events
are a learning opportunity
196 safety culture
• ensuring that overt artefacts are in place to encourage the staff

towards safe working behaviours
• ensuring a ‘good’ working environment both physical and

managerial
• a platform of good behavioural antecedents and enablers, supported

by the management, that encourage expected safety-behaviours
• agreeing with the workforce and peers the consequences for good
and poor safety-behaviours
• visibly overseeing a stable self-sustaining safety-culture within

which safety discipline is upheld as everybody’s responsibility and
is an accepted norm
• frequently challenging any perceived safety status quo
• establishing a policy of a ‘just’ culture.
In contrast, without management leadership, trust, good communications,

dialogue and the active involvement of all staff, a good safety-culture cannot
mature.
A ‘blame culture’ with autocratic and intolerant management that is hostile

to feedback, can lead to a self-reinforcing belief emerging that ‘the organisation
has no safety problems’. In this environment the organisation’s safety-
performance may be relying on luck and not management.
Evidence from the field suggests the root cause of many high-hazard
industry accidents arises from manager’s lack of technical understanding of
the risks their workforce have to manage. This is usually compounded by a
lack of leadership in safety-culture. Management can very rarely be considered
to be reckless regarding safety. However, it is suggested they can suffer from
omissions by not recognising or acting upon available evidence such as poor
organisational safety-performance.
There are some situations where management has to be autocratic,

particularly where a team has taken over a poor safety-culture environment.
In such situations, management control has to be the dominant strategy to halt
epilogue 197
a decline. This may require draconian standards and expectations put in place
and enforced. Such management expectations will be directed at changing a
poor safety climate. However, the long-term aim has to be moving the total staff
complement from automaton compliance towards safety involvement by ‘thinking
safety’ at all times and having interdependence. In a state of interdependence,
attention to health, safety and the environment becomes a natural way to work
at every organisational level. When a state of interdependence is achieved the
organisation is possibly a generative dialogue culture, a strong safety-culture.
The senior management presence nevertheless has to continue to be felt ensuring
the safety messages and beliefs are sustained.
Ten Top Questions
It is often proposed that there could be 10 ‘most important’ questions for senior
managers, so as to draw upon their views, beliefs, opinions and attitudes
about organisational safety-culture. It is further conjectured that from the
spontaneous responses to the questions in a one-to-one interview a broad
understanding of the organisational culture can be deduced as this group is
so influential in shaping the culture. By understanding both the action taken
to support culture and possible inaction, the question responses may establish
preliminary indicators about the strength or weakness of a culture that can be
confirmed during an independent assessment or a self-assessment.
The approach is not new and a little technically crude, nevertheless a set
of considered questions asked spontaneously at least raises the immediate
awareness of culture. It may have merit as a personal exercise to give
preliminary comfort or concern about an organisation’s culture well ahead of
an independent review. Table 5.1 indicates 10 possible questions and the task
in presenting them to senior mangers is to capture immediate thoughts about
an organisation’s safety-culture.
The author has given a view on possible responses indicating strong

cultural overtones (Appendix III). There are judgements to be made and the
noted outturn is open to challenge and question.
Summary
Achieving a good safety-culture is not a formidable task and has significant

business benefits. Studies demonstrate that the most profitable organisations
198 safety culture
Table 5.1 Ten safety-culture questions
Questions Questions
1. Do you agree the primary accountability for 6. What actions do you periodically take
safety on this establishment rests with the so that you understand the safety-
regulator? culture status of this facility against good
2. Is there a documented displayed health and international practice?
safety policy signed by the CEO? 7. How in the last month have you
3. Is there a published set of safety-culture demonstrated to the organisation your
expectations that are placed on all personal commitment to a strong safety-
employees? culture?
4. What actions do you personally take to 8. Is safety a standing agenda item at every
ensure people understand the safety monthly senior managers meeting?
policy and the safety-culture behavioural 9. Do you agree annually to commit resources
expectations? to safety improvement programmes?
5. How many scheduled times per month do 10. By what means do you test that the safety-
you discuss safety and formally observe management system is assisting you in
safety-culture behaviours on this facility? managing safety risks on this facility?
do not idly lose assets through the neglect of safety. In hazardous industries
safety is a major business risk to be managed. Starting from a poor culture,
the journey of improvement may be perceived as an expensive option. The
alternative can be severe business damage or, in the long term, no business at
all. Once a strong culture has been achieved the cost is minimal to sustain the
position as safety becomes ‘just the way we do things around here … when
nobody is actually watching’.
It has been recognised that it may take some time to establish a strong safety-
culture against world-class performance criteria. However, if an organisation
structurally changes and inappropriate safety expectations and beliefs emerge
from an autocratic management, an established strong culture can be reversed.
An organisation can revert to poor human performance and become a high-risk
enterprise in a matter of months.
Finally, it is reiterated that no executives or managers set out to injure

their employees and no employees actually go to work to injure themselves.
Yet injuries, fatalities, damage to assets, increasing insurance costs and loss of
businesses still occur. It is not just bad luck, nor necessarily poor technology
or inadequate engineering. In most cases it is matter of a ‘good’ or ‘poor’
organisational safety-culture.
Appendix I
Definitions
Definitions of Safety Culture
a) Safety culture is that assembly of characteristics and attitudes

in organisations and individuals which establishes that, as an
overarching priority, safety plant issues receive the attention
warranted by their significance.
b) An organisation’s values and behaviours modelled by leaders and

internalised by its members, that serve to make (nuclear) safety the
overriding priority.
c) The safety-culture in an organisation is the product of individual

and group values, attitudes, perceptions, competencies, and patterns
of behaviour that determine the commitment to and the style and
proficiency of, an organisation’s health and safety management.
Organisations with a positive safety-culture are founded on mutual
trust, by shared perceptions of the importance of safety and by
confidence in the efficiency of preventative measures.
d) Safety Culture – where people question the old assumptions and

share better ideas.
e) Culture is a pattern of basic assumptions – invented, discovered or

developed by a given group as it learns to cope with its problems of
external adaptation (how to survive) and internal integration (how
to stay together) – which have evolved over time and are handed
down from one generation to the next.
f) The pattern of organisational behaviours derived from the beliefs,

values and attitudes which management and staff share and which
serve to make safety the overriding priority.
200 safety culture
• Antecedents: With regards to safety, antecedents can be considered

to be the factors that establish an environment that contributes
to modifying or reinforcing individual’s behaviours.
• Artefacts: Are recognised symbols of an organisation’s identity,

its values and intent. With regards to safety, these can be the
documented safety management systems, safety booklets,
safety posters, the Company magazine, displayed safety
awards or, the standardisation of work clothing.
• Attitude: This is a form of behaviour (it can be physical,

linguistic and visual). Attitude stems from beliefs and can be
inherent to a person but generally arises from life’s experiences.
(Attitudes can be copied and mimicked in self-interest. They
may not always stem from personal beliefs.)
• Behaviours: Considered to be the way people conducts

themselves through their physical actions or interactions
with others. This is important to safety as it is suggested
that safety-behaviours are influenced by safety beliefs or
basic assumptions. People’s behaviours can be modified by
changing their beliefs (by logic and persuasion).
• Behavioural Consequences: They are the organisations agreed

consequences for aligned (positive consequences) or non-
aligned safety-behaviours (mentoring consequences).
• Beliefs: Can be defined as the acceptance by an individual,

as a deep seated emotion and assumptions, that something
is true. Beliefs are deep seated to the extent that a person
unconsciously subscribes to them and in many situations
unconsciously behaves to support them. Beliefs are usually
very stable. People are not born with beliefs; they are learnt
and influenced by life’s experience in bringing success or
undesirable consequences. Beliefs can be impressed upon a
person by an external agency.
• Consequence: This is the result of energy dissipation from an

unmanaged hazard. For the human being, the consequence
could be a fatality or injury.
appendix i 201
• Employees or staff: Considered to be the aggregate of all the

workforce and all levels of management.
• Hazard: This is a physical object or an event that could cause

harm to an individual person, the environment or assets,
for example property. The term hazard is often confused
with risk, which is a different concept, being a combination
of the hazard manifesting itself as a consequence with some
frequency of occurrence.
• ‘Just’ culture: Where it is an organisational belief that

‘people will make mistakes and errors’ in a just culture
mistakes and errors are treated as a safety-lessons-learning
opportunity. Mistakes are not considered as an opportunity
for ‘blaming’ staff. This is not the same concept as the
response to premeditated, flagrant, intentional disregard for
safety procedures and processes or purposeful interference
with engineered safety systems without authority. These are
Management/Human Resources discipline issues.
• Leadership: A leader is someone who can influence the thoughts,

beliefs, attitudes and behaviours of others. (Research, and
experience in the field, shows that leaders, particularly at
senior level because of their influence, are of significant
importance to developing, shaping and maintaining an
organisational safety-culture.)
• Management: Within this text three levels of management are

considered to be:
‒ Corporate or senior management which includes the CEO
and executive
‒ Middle managers
‒ Supervisors: these, for example, could be first-line managers
or team leaders.
• Risk: Is the probability that a hazard will manifest itself as a

consequence. Risk is not the same as hazard and they are not
interchangeable terms. Mathematically, risk is the product
of a hazard probability of causing harm (or on occasions
expressed as a time-averaged frequency of occurrence)
multiplied by the consequence. The evaluation of risk can be
202 safety culture
numerical (for example in radiological protection analysis).

Risk is more usually a qualitative phenomenon.
• Safety: Is defined as freedom from the consequences of an

unmanaged hazard. In reality, absolute safety does not exist.
There is no state of zero risk and ‘total’ safety.
• Values: These are preferred, desirable conditions or states.

Values are states that will, or do, assist in fulfilling beliefs.
They are the conditions and actions that an organisation holds
in high esteem. As such, the staff give them high priority and
attention. Espoused values can be an expression of beliefs
through people’s spoken words. They can also arise in written
artefacts, for example, the company environment, health and
safety policy. (Espoused values may not however, always
reflect ‘true’ beliefs.)
• Workforce: People who are assumed to work under a supervisor

– plant designers, operators, maintenance engineers,
technicians and contractors, etc.
Appendix II
Safety Culture Types
A Generative Safety Culture
A generative safety culture is a high reliability, low-risk organisation. Safety

is integrated fully into all business functions risk portfolios. The organisation
has ‘general unease’ regarding safety and is ever watchful and mindful at all
staff levels. There is a very high degree of team working high-level of safety-
focused dialogue throughout the organisation. It values dialogue and being a
team working organisation. There is safety training and more safety training.
Short and effective feedback systems and procedures affecting plant safety are
under constant scrutiny.
Fundamental to achieving a strong safety-culture and generative culture is

an organisation which has a high standard of communication between all levels
and a high degree of individual safety involvement. Key performance indicators
for safety play a central role in annual reviews for all in the organisation. An
open, ‘just culture’ is valued and encouraged by managers. Team working
(dialogue) to resolve safety issues and gain improvement is encouraged to gain
high individual involvement. Individuals accept responsibility for their safety
and that of others.
Reactive
Safety starts to be taken seriously, but only after incidents is there any action.
Calculative
Safety is treated very seriously. There are management systems and much data
collection.
Proactive
People try to avoid accidents and start to take a more bottom-up approach.
204 safety culture
A Pathological Safety Culture
In such organisations there are few safety rules. There is little or no management
commitment to either safety or leadership in setting safety standards. The
workforce is expected to look after itself regarding keeping safe. It is a belief
that accidents are part of doing the job. Safety is not taken as a serious business
risk and there is little awareness of safety technology. The organisation aims for
the absolute legal minimum regarding safety law.
Appendix III
Ten Top Questions Responses
Table A3.1 Expected responses to the ten safety-culture questions
Question Good practice shared Good practice shared Expected responses for
safety culture beliefs safety culture values a ‘good’ safety culture
being tested being tested
1. Do you agree that the – Accountability for safety – Our individual attention The accountability
primary accountability rests at all times with to safety is a condition of rests with the Board
for safety on this managers employment. through the CEO. For
establishment rests with – The safety of staff, our organisations that are
the regulator? contractors and the public issued with a legal licence
is our number one priority to operate high-hazard
in all circumstances. plants, emphasis on the
specific accountabilities
of the licensee would be
expected.
2. Is there a documented Accountability for safety – Our individual attention A positive response would
displayed health and rests at all times with to safety is a condition of be anticipated here with
safety policy signed by managers employment the health and safety
the CEO? – The safety of contractors – That everyone is policy being displayed
and the public is our responsible for safety, to the reviewer. The
number one priority in all our own, others safety reviewer would listen
circumstances and the protection of the for information on the
– Our engagement in safe facility. management annual
behaviours is necessary review of the policy and
for safe operations as appropriate the steps
– We believe in a culture taken so that it remains
of legal compliance is our relevant to the business.
minimum requirement.
3. Is there a published set – Belief in safety vigilance – Our individual attention The reviewer should
of organisational shared at all times to safety is a condition of anticipate reference to an
beliefs, values and safety- – Absolute safety does employment intranet site, distributed
culture expectations not exist – That respect is given booklets and possibly a
that are placed on all – Human error is normal to all safety views as periodic poster campaign.
employees? and can be expected everyone has the right to Particular emphasis will
– Our engagement in safe question and report safety be placed on all managers
behaviours is necessary issues carrying and frequently
for safe operations – People’s interventions to referencing back to the
– People are fallible and ensure all potential health organisation’s beliefs,
will make mistakes and safety incidents are values and safety culture
– We believe in a culture prevented expectation. Safety
of legal compliance is our – Everyone has the right behavioural expectations
minimum requirement. to challenge on safety need to be explained as
issues. having been derived and
agreed for all levels, from
the senior management to
the workforce.
206 safety culture
Table A3.1 Continued
4. What actions do you – The safety of staff, our – Our individual attention The reviewer should
personally take to ensure contractors and the public to safety is a condition of anticipate reference
people understand the is our number one priority employment would be made to the
safety policy, beliefs, in all circumstances – We value thorough integration of the safety
values and the safety – Accountability for safety safety training and culture programme into
culture behavioural rests at all times with competence as essential the safety management
expectations? managers for safe working system. Emphasis
– We believe in safety – That everyone is would be expected on
vigilance at all times responsible for safety: the senior managers’
– We believe a culture of our own, others’ safety communications
legal compliance is our and the protection of the strategies. Evidence
minimum requirement. facility. could be presented of a
monitoring strategy.
5. How many scheduled – The safety of staff, our – Our individual attention A schedule, integrated
times per month do you contractors and the public to safety is a condition of into the management
discuss safety and observe is our number one priority employment system, would be
safety-culture behaviours in all circumstances – Teamwork to resolve expected. Reference to
on this facility? – Accountability for safety safety matters is strongly a strategy and schedule
rests at all times with supported for visiting offices
managers. – That respect is given and operational plant
to all safety views as should be tabled with
everyone has the right to implementation evidence.
question and report safety
issues.
6. What actions do you – Accountability for safety – Our individual attention Required action should be
periodically take so that rests at all times with to safety is a condition of demonstrated as a part of
you understand the managers. employment the management system.
safety culture status of – That we regularly check Evidence of a periodic
this facility against good and report our safety self-assessment of the
international practice? objectives performance. whole organisation or a
part of the organisation
as the company strategy
requires.
7. How, in the last month, – The safety of staff, our – That the organisation Possibilities: behavioural
have you demonstrated contractors and the public strives for an open observations, managers
to the organisation your is our number one priority dialogue culture take part in safety walk-
personal commitment to a in all circumstances – Our individual attention about reviews, carry
strong safety-culture? – Accountability for safety to safety is a condition of out cross-organisation
rests at all times with employment presentations, have
managers – That everyone is stopped production due
– We believe in safety responsible for safety: to a safety issue taking
vigilance at all times our own, others’ safety priority, opened several
– Absolute safety does and the protection of the safety-training sessions,
not exist. facility. etc.
8. Is safety a standing – The safety of staff, our – That we regularly check Agendas presented as
agenda item at every contractors and the public and report our safety evidence. Minutes made
monthly senior managers is our number one priority objectives performance available where possible.
meeting? in all circumstances – That all events and near
– Accountability for safety misses are reported as we
rests at all times with recognise that there are
managers. no minor injuries.
appendix iii 207
Table A3.1 Concluded
9. Do you agree annually – Accountability for safety – Our individual attention Documented evidence
to commit resources rests at all times with to safety is a condition of of a safety-management
to safety improvement managers employment system review and the
programmes? – We believe a culture of – We value thorough publication of a safety
legal compliance is our safety training and improvements budget
minimum requirement competence as essential would be expected:
– Absolute safety does for safe working minutes of meetings,
not exist. – That everyone is evidence in the budget.
responsible for safety:
our own, others’ safety
and the protection of the
facility.
10. By what means do – Accountability for safety We value that we Evidence of a formal
you test that the safety- rests at all times with regularly check and report safety-management
management system is managers. our safety objectives system annual review
assisting you in managing performance. would be expected. The
safety risks on this facility? review would typically
be procedure driven
and include safety
reactive and proactive
key performance
indicator outturns,
audit report findings,
independent review
findings, behavioural
safety findings, trends.
The review should be
presented as an open
dialogue on positive safety
matters and areas judged
to need improvement. A
particular strength would
be if the management
system review was
chaired by the CEO. As
a minimum it would be
chaired and attended
by senior managers. A
formal report on the
review and actions arising
for the organisation in
general and the safety
management system in
particular would be made
available for the CEO. This
would link to the annual
safety improvement
plan and business risk
reduction plan.
Further Reading
Advisory Committee on the Safety of Nuclear Installations. 1993. ACSNI

Human Factors Study Group. Third Report: Organising for Safety. Published
by Her Majesty’s Stationery Office.
Cox, S. and Cox, T. 1996. Safety Systems and People. Published by Butterworth
– Heinemann Ltd.
E&P Forum. 1994. Guidelines for the Development and Application of Health, Safety
and Environmental Management Systems. Report No. 6.36/210. Published by
The Oil and Gas Industry Exploration and Production Forum (E&P Forum),
London, UK.
Fidderman, H. Health and Safety Bulletin. 2003. The Influence of Managers.
Bulletin No. 317.
Gehman, H.W. Jnr. et al. 2003. Columbia Accident Investigation Board. Published
by the National Aeronautics and Space Administration and the Government
Printing Office, Washington D.C.
Guldenmund, F.W. 2000. The Nature of Safety Culture: A Review of Theory
and Research. Safety Science 34(2000), 215–57. Published by Elsevier Science
Ltd.
Health and Safety Executive. 1999. Development of a Business Excellence Model of
Safety Culture. Published by Her Majesty’s Stationery Office.
Health and Safety Commission. 1999. Directors’ Responsibilities for Health and
Safety. Report INDG 343 02/02 C700. Published by Her Majesty’s Stationery
Office.
Health and Safety Executive 2002. Strategies to Promote Safe Behaviours as Part of
a Health and Safety Management System. Prepared by the Kiel Centre. Research
Report 430/2002.
Health and Safety Executive 2003. The Role of Management Leadership in
Determining Workplace Safety Outcomes. Research Report 044. University of
Aberdeen. Published by Her Majesty’s Stationery Office.
Health and Safety Executive. 2005. A Review of Safety Culture and Safety Climate
Literature for the Development of the Safety Culture Inspection Tool. Research
Report 367. Her Majesty’s Railways Inspectorate. Published by Her Majesty’s
Stationery Office.
210 Safety Culture
Hudson, P.T.W and Willekes, F.C. 2000. The Hearts and Minds Project in an
Operating Company: Developing Tools to Measure Cultural Factors. Society of
Petroleum Engineers, SPE 61228. SPE International Conference.
International Atomic Energy Agency. Developing Safety Culture in Nuclear
Activities. Safety Series Report No. 11.
International Atomic Energy Agency. 2002. Key Practical Issues in Strengthening
Safety Culture. Report by the International Safety Advisory Group 15.
International Atomic Energy Agency. 2002. Safety Culture in Nuclear Installations.
International Atomic Energy Agency TECDOC-1329.
International Atomic Energy Agency. 2006. Application of the Management System
for Facilities and Activities Safety Guide GS-G-3.1.
International Atomic Energy Agency. 2007. Lessons Learned from the JCO
Criticality Accident Tokaimura.
Kennedy, R. and Kirwan, B. 1995. Safety Culture in Nuclear Installation. The Failure
Mechanism of Safety Culture. International Topical Meeting, International
Atomic Energy Agency, Vienna.
Kletz, T. 1990. Plant Design for Safety a User Friendly Approach. Published by
Hemisphere Publishing Corporation.
Kletz, T. 1994. Learning From Accidents. Published by Butterworth – Heinemann
Ltd.
Komai, J.L. et al. 1992. The Role of Performance Antecedents and Consequences
in Work Motivation. Journal of Applied Psychology, 67(3), 334–340.
Leveson, N. 2004. A New Accident Model for Engineering Safe Systems. Safety
Science, 42, 237–70.
Los Alamos National Laboratory. 2000. A Review of Criticality Accidents 2000
Revision. LA 13638 Approved for public release, distribution unlimited.
Manuele, F.A. and Christensen, W.C. 1999. Safety Through Design. Published by
the National Safety Council, and NSC Press Product (USA).
Marsh, T. 1996. University of Manchester Institute of Technology (UK).
Developing a Training and Communications Strategy for a Positive Safety Culture.
Health and Safety Management Conference, London.
Parker, D. Lawrie, M. and Hudson, P. 2006. A Framework for Understanding the
Development of Organisational Safety Culture. Safety Science, 44, 551–62.
Rasmussen, J. 1997. Risk Management in a Dynamic Society: a Modeling
Problem. Safety Science, 27(2/3), 183–213.
Reason, J. 2007. Human Error. Cambridge University Press.
Schein, E.H. 2004. Organizational Culture and Leadership. Third Edition. Josey-
Bass.
Shell International Exploration and Production. Heart and Minds. For information
visit www.energyinst.org.uk/heartsandminds.
further reading 211
Taylor, R.H. 2002. Improving Health and Safety Performance – Achieving

‘Breakthrough’. Invited Paper to the Institution of Structural Engineers,
January 2002. Published by The Structural Engineer 23–7.
Taylor, R.H. and Rycraft, H.S. 2004. Learning From and Preventing Major Accidents.
Proceedings of IBC Workshop on Effective Safety Management, London,
UK.
The Institution of Nuclear Power Operations. 2006. Human Performance
Reference Manual. INPO 06–003.
Transport Canada, Civil Aviation. 2006. ‘What is a Safety Management System?’
Technical paper, TP 13739. Published by the Canadian Civil Aviation.
Turner, B.A. 1995. Safety Culture and its Context. Procedures of the International
Topical Meeting on Safety Culture in Nuclear Installations, America Nuclear
Society, Vienna, 321–9.
U.S. Chemical Safety and Hazard Investigation Board. March 2007. Investigation
Report Vinyl Chloride Monomer Explosion. Report No. 2004–10-IL.
U.S. Nuclear Regulatory Commission. Region 1. Inspection Report No.
03019882/2004003 Approved 19 May 2004. (Author’s note: Panoramic wet
source irradiator inspection).
U.S. Nuclear Regulatory Commission. NRC Review of the Tokai Mura Criticality
Accident.
Index
A see also events

antecedents 25, 27–32, 44–46, 78, 109,
179–180, 187, 190, 196 C
see also definitions chain reaction 60, 81–84, 99
artefacts 3–6, 13, 17–19, 21–22, 34–40, challenge (culture) 10, 13–14, 23–24,
49, 71, 78, 104–105, 108, 152, 33, 41, 46, 55, 59, 68, 79, 123,
154, 187, 196, 200, 202 135, 187
see also definitions change programme 170, 172–193
attitudes 1, 11–12, 17, 32–39, 71, 108, characteristics 34–38, 55, 129–135,
123, 130–133 138, 141, 144–145, 147–148,
see also definitions 1150, 153–162, 171, 175–176,
attributes 34–38, 130–148, 151–153, 178–181, 184–185, 292, 195,
155–157, 160, 163–166, 171, 193, 199
195 Chernobyl 1, 2, 186
see also definitions communications 10, 136–147, 163,
186, 193, 206
B see also dialogue culture
beliefs 1, 3–14, 17, 19–26, 31, 34–41, commitment 6–14, 22–32, 55, 145,
46–47, 49, 56–57, 61, 70–75, 166, 176–180, 199–206
77, 100–106, 109, 121, 125–134, criticality
136–143, 148–157, 159–167, Tokaimura 40, 79–109, 158
171–175, 180–184, 193, 195, 199, Oscillating 81–99
200–202, 205–207 consequences (behavioural) 6–8
behaviours 2–17, 22–27, 30–31, 45–50, see also behaviours
52, 56–59, 61, 70, 72, 77–79, 100, continuous improvement 27, 170,
104, 104–110, 124–136, 139, 142, 188–193
158–167, 171–191, 195–196, 199, culture see safety culture
200–201
behavioural observations 27–30, 32, D
38, 61, 139, 190, 206 defence in depth 46–53, 67, 82, 94,
Bhopal 50, 52, 55–57, 127, 154, 156, 157 100, 126, 186
214 Safety Culture
dialogue culture 7, 13, 17, 23–24, 27, Hearts and Minds 181–185, 204
135, 76–177, 180, 186, 188, 193, human-performance 1, 25
197
I
E informal dimension 17, 136, 151
employees 2, 15 ,23 inherent safety 120,124
Energy Institute UK 181, 183, 185, 204 International Atomic Energy
enrichment 82–86 Authority 2
espoused values 3 irradiator 40, 109
see also values and definitions isotopes 81, 109
events
Bhopal 30, 40 J
dropped load event 30, 40 ‘just’ safety culture 5, 134–135, 180,
poly vinyl chloride plant event 188, 201
40, 59
Titanic 40 L
Tokaimura 40, 79 leadership 22–23, 30, 36, 132,
wet source irradiator event 40, 201
109 see also safety culture shaping
executives 23, 174, 191
see also expectations, and safety M
culture shaping managers 2
expectations 6, 17, 23, 134, 136, 163, see also safety culture shaping and
167, 188, 298 expectations
see also behaviours maturity ladder 162, 181, 184,
192
F see also Energy Institute UK
fear culture 10, 57, 103, 106, 108, 126, methyl isocyanate (MIC) 51
191
fission 81–99 N
formal dimension 131, 136, 151, 188 natural uranium 79
neutrons 79
G norms 7–8, 10, 14, 105, 126, 160
gamma rays 80–99, 109–122 nuclear criticality 79
grays 120
group think 103, 123, 126 O
observational techniques 189, 191
H
hazard 3, 201–202 P
see also risk and definitions poly vinyl chloride (PVC) 61
index 215
Q maturity model 181, 183–185

questioning (attitude) 10, 16, 24, 33, ‘measuring’ 3, 17, 128, 131, 133
42, 48, 57, 59, 71, 103, 105, 123, pathological 55, 162, 182–184, 204
126, 147, 155, 187, 189, 190 ‘poor’ 3, 8, 48, 104, 130, 157–158,
see also attitudes 171, 176, 184, 190, 198
proactive 182, 192
R reactive 182
radiation self assessment 161–162, 174, 181,
radiation dose 109 183–184, 187, 192, 197, 206
shielding 109 shaping 7, 11, 13, 100–101, 146,
units 109 186, 195, 197, 201
risk 201–202 ‘strong’ 38, 71, 85, 132, 151, 152,
see also hazard and definitions 154, 158, 186, 193, 195, 198
Schein, E., 2
S Scoring 147–151, 157
safety see also formal dimension and
behavioural expectations 8, 23, informal dimension
38, 133, 157, 181, 191, 205–206 senior managers 2
definition 2, 182, 199 see also expectations and safety
management systems 115, 177, culture shaping
184, 200, 203 shared beliefs 3, 5, 19, 22, 41, 46, 55,
safety culture 60, 101, 106, 167, 172, 205
blame 191, 137, 164, 191, 196 Shell International Exploration and
calculative 182, 203 Production 181–183, 185, 204
change 6–8, 12, 27, 29, 30–31, 129, soft skills 31, 137, 140, 164, 180,
161–162, 167, 172–183, 186, 189, 185–187, 195
190–193 sterilisation 109
see also change programme sub-culture 7, 10, 95, 147, 153, 173
definitions 2, 182, 199 supervisors 2
dimensions see also expectations
see formal dimension and
informal dimension T
elements 2–3, 12, 32, 34–39, 129, Titanic 40
131, 134, 162, 188 Tokaimura 79
see also beliefs, values, artefacts, triuranium octoxide 94, 100, 102–105
behaviours
generative 195 U
independent review 133, 159, 161, uranyl nitrate 80, 86, 90, 92–93, 96,
167, 177–181, 193, 197, 207 108, 109
linear model 131 uranium oxide 90
216 Safety Culture
V W
values 3–8, 14–15, 17–27, 32–39, 49, wet source irradiator 40, 109
58, 71, 77, 102, 107, 122, 134– workforce 2
152, 161, 163–166, 174, 181, 195,
199, 202, 205–207
vinyl chloride monomer (VCM) 59

John Bernard Taylor Safety Culture

Transféré par

Informations du document

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

John Bernard Taylor Safety Culture

Transféré par

Droits d'auteur :

Formats disponibles

Safety Culture

Assessing and Changing the

John Bernard Taylor

Gower Applied Business Research

British Library Cataloguing in Publication Data

ISBN: 978-1-4094-0127-8 (hbk)

Library of Congress Control Number: 2010937247

List of Figures vii

1 Organisational Safety-Culture Theory 1

2 Safety-Culture Theory as a Predictive Model 39

3 Assessing Organisational Safety Culture 129

4 Changing a Safety-Culture 169

Leadership for Safety – Soft Skills and Behaviours 185

Figure 1.1 Safety-beliefs and espoused values leading to attitudes and

Table 1.1(a) Antecedents and consequences – current behaviour,

Risk management is an ongoing concern for modern organizations in terms of

• define our attitudes and response to risk,

Titles Currently in the Series Include:

New Directions in Organisational Psychology and Behavioural Medicine

Crime and Corruption in Organizations

Research information the causes of events and the associated safety-culture

A hazardous facility is one that if inadequately managed could with an intolerable

Facility safety is an important commercial risk that has to be managed.

Chapter 1 introduces one theory of safety-culture – the ‘layered’ generic

Although the initial causes were considered to be engineering design

Taking investigations beyond engineering failures brings into focus the

Evidence suggests that if safety-culture is not understood and managed

Safety-culture theories indicate that different levels of an organisational

1. executive and senior management

4. The workforce teams. (These can be plant designers, the plant

There have been many contributors to safety-culture theory with various

The work by E. Schein, who examined US business cultures, has generic

into a methodology for ‘measuring’ safety-culture in high-hazard industrial

The theory suggests that organisational culture arises from shared

The layered generic model’s culture elements can be summarised as:

This is shown schematically in Figure 1.1.

As a combination of the elements; beliefs, values, attitudes and artefacts,

An alternative presentation is given Figure 1.2. Here organisational

Figure 1.1 Safety-beliefs and espoused values leading to attitudes and

Figure 1.2 Schematic of safety-culture layers

Examples of ‘good’ shared organisational safety-beliefs are:

• Accountability for safety rests at all times with managers

• Responsibility for safety rests with all employees

• In safety vigilance at all times

• Human error is normal and can be expected

• Our engagement in safe behaviours is necessary for safe

• Human errors are a learning opportunity

• People are fallible and will make mistakes

• Legal compliance is a minimum requirement and we strive to do

• In a ‘just’ safety-culture and that people do come to work intending

Safety-beliefs cannot be seen or measured even though they give rise to

Feedback on the viability of beliefs arises from behavioural consequences.

External influences such as public pressure, regulatory interventions and

The layered generic model is helpful but perhaps not perfect.

Beliefs as ‘truths’ cover many aspects of human experience. Religions,

Individual’s beliefs are reinforced, modified or changed depending upon the

The converse is true. There can be supportive behavioural consequences,

A society’s beliefs and behavioural norms historically deliver societal

Within a social group individuals usually maintain their group membership

Situations can arise where group peer pressure is imposed to modify an

If organisational belief change is required individuals develop uncertainty,

On occasions, however, safety-belief change needs to be rapid. If too slow,

Shared safety-beliefs are fundamental to developing a ‘good’ organisational

Evidence indicates that the effectiveness of an organisational culture and

List of Figures vii

1 Organisational Safety-Culture Theory 1

2 Safety-Culture Theory as a Predictive Model 39

3 Assessing Organisational Safety Culture 129

4 Changing a Safety-Culture 169

Leadership for Safety – Soft Skills and Behaviours 185