Safety Culture in a Complex Mix of Safety Models: Are We Missing the Point?

Safety culture is often considered as being the role given to safety in the trade-offs made within an organization. But what is the scope of these trade-offs? If operational activities at the sharp end are naturally included in the safety culture perimeter, other trade-offs are made that structure operational activities, especially through the development of processes, procedures, organizational structure and policies but also through technological choices. These trade-offs are made within the environment of the organization, and that inevitably induces constraints on the role given to safety, as there are already trade-offs inherited from this environment. Likewise, a variety of safety models exist in this environment, in the sense of assumptions or beliefs as to how safety is ensured or more often is to be ensured. Eventually, each organization combines a mix of safety models, some partly con ﬂ icting with others. To what extent is an organization aware of the complexity of operations and of what it takes to operate safely? Is this also part of its safety culture? To what extent and how can this complexity be addressed? These are some of the questions addressed in the paper.


Introduction
Safety culture as introduced in the early 90s was focused on the importance of the role given to safety compared to other stakes within organizations. Since then, it has been considered a major factor in a safe performance and still receives significant attention in both proactive and reactive safety management. However, it seems that the concept is more commonly used for activities having an obvious and direct impact on operational activities whereas more structuring support functions fall outside of the natural scope of safety culture. Their influence on operational C. Bieder (&) Ecole Nationale de l'Aviation Civile, Toulouse, France e-mail: corinne.bieder@enac.fr activities may be less direct, but is nevertheless significant. Safety culture with its current scope may then become a proxy and prevent a deeper analysis of what actually contributes to safety, especially the high-level decisions sometimes considered rather simplistically as being business decisions only.
Nevertheless, the importance of the role given to safety in trade-offs, whatever the scope of trade-offs considered, may not be the only missing ingredient. Indeed, organizations operate in a context that partly constrains their choices, including the structuring ones, and not only in the role given to safety but also in the way safe performance can be achieved. Eventually, each organization combines a mix of "inherited safety models" throughout its environment, from the authority, its competitors, suppliers… Operating safely or safely enough with this mix of safety models, which are not necessarily consistent with one another, involves not only to give safety an adequate priority but also to navigate the associated complexity.
2 Safety Culture as an Essential Ingredient: The Final Touch or Incorporated All Along?
Safety culture as introduced and defined by the International Atomic Energy Agency (IAEA, 1991), "that assembly of characteristics and attitudes in organizations and individuals which establishes that, as an overriding priority, [nuclear power] safety issues receive attention warranted by their significance", was considered at that time to be the missing ingredient to ensure safety. While other complementary ingredients have been identified since then, following the occurrence of accidents, safety culture often remains an area for improvement on the agenda of many industries. Many definitions have been proposed to try to address the issue, some rather prescriptive, others more descriptive as explained in Chap. 12. If we adopt a descriptive perspective, safety culture can be considered the role or weight given to safety in the trade-offs made within an organization. Yet the scope of the decisions and trade-offs considered is not so obvious. Operational activities at the sharp end are naturally considered within the safety culture perimeter, but what about other activities not directly related to real-time operations such as support functions or high-level managerial decisions? Is safety given sufficient attention in Human Resources policies and decisions or in Procurement policies and decisions? If we refer to the practical definition of culture proposed by Bower (1966), "the way we do things around here", who does "we" refer to, and what "things" are considered? If normative views of safety culture tend to encompass all the employees of an organization as in safety culture surveys such as that of Eurocontrol (Mearns et al., 2009), descriptive views seem to focus on operators and first-line management, leaving out a whole range of employees and trade-offs not directly involved in real-time operations. Yet, some of these trade-offs and resulting decisions are structuring for the organization and its performance, including the safety performance (Amalberti, 2015;Schein, 2010). A merger or acquisition decision or a transformation of the industrial set-up through increased subcontracting, for example, or a decision to buy new technological devices or new information and management tools are decisions that may significantly impact safety. These decisions, often considered business decisions (as if safety had nothing to do with them, and thus with business), seem to fall outside of the "safety culture" scope despite their role on safety.
Likewise, rules and processes already embed some trade-offs between safety and other business objectives. Whether safety is given sufficient attention in these trade-offs that structure the activities of the organization is not naturally or systematically examined. The intuitive scope of safety culture does not include structuring activities not directly related to real-time operations despite their strong remote influence on them, and thus on safety. For example, a significant number of airlines prescribe in their operations manual to put the autopilot on above 500 or 1000 ft and disconnect it when reaching below this threshold again. Although this rule has an obvious efficiency objective-minimizing the fuel burn or optimizing the use of systems, the impact on safety can be debatable, especially if we consider the long-term impacts on pilots' manual flying skills.
Similarly, the safety impact of new types of pilots' contracts (e.g. pay-to-fly) may not have been analyzed as extensively as their economic impact, without prejudging the conclusions.
In many hazardous activities, some of the structuring choices made at some point in time are later analyzed in terms of their consequences on safety. It is the case of the increasing reliance on subcontractors or of mergers, for example. In the nuclear industry, a specific expert investigation was launched by the French Nuclear Safety Authority (ASN) in 2013 to "examine the efficiency of the measures taken by EDF (Electricité de France) to facilitate the priority given to nuclear safety in the interactions between EDF and the sub-contractor" (ASN, 2013) or of some mergers. In the airline industry, the recent merger between two airlines was mentioned in several accident investigation reports as a factor that may have played a role (Commission of Inquiry into the Air Ontario Crash at Dryden, Ontario (Canada), 1992). Interestingly, while these aspects are analyzed after an accident, thus identified a posteriori as having possibly played a role in the accident, they are still considered a priori "business decisions" and made with limited safety considerations, if any. Yet they involve trade-offs made by the organization… Should the concept of safety culture be broadened to include these kinds of structuring trade-offs? Should they be addressed through a different set of concepts and methods? Sociology of organizations certainly includes part of these questions in its scope.
Yet, a remaining question is: would taking safety into account in all these trade-offs solve all the problems?

Is the Solution as Simple as Deciding to Incorporate an Additional Ingredient?
Considering that safety culture in the sense of giving safety sufficient (if not overriding) attention/priority in the trade-offs made by the organization will make all the difference assumes that operating safely is totally in the hands of the organization and that the organization has all the settings to do so. It further assumes that the organization is totally free of its choices and that the problem lies in the lack of internal consistency regarding the attention given to safety. In reality, the situation is complex and the challenges are huge, not only internally but also externally.
Internally, safety models may already vary from one organizational level to the next, one site to another or from one professional culture to another (Carroll, 1998), translating into different approaches to uncertainty management thus to different control mechanisms and eventually requirements (Grote, 2015). An illustration of this variability is the scope of activities that are proceduralized and the philosophy of the rules leaving more or less leeway to those supposed to implement them (Bieder & Bourrier, 2013). Indeed, they reflect the assumptions and beliefs as to what makes operations safe.
In addition, an organization operates in an external environment that not only influences some of its trade-offs but also conveys a mix of perspectives on how safety is to be ensured and ultimately leads to a certain complexity in ensuring safe performance, even if safety is given an appropriate role. A well-known example is the safety regulation(s) the organization has to comply with. Any regulation relies on a safety model in the sense of a set of assumptions or beliefs as to what is needed to ensure safe performance. The regulatory framework thereby imposes a safety model on the organization, constraining some of its choices related to how to ensure safety. This constraint applies whatever the attention given to safety.
Somewhat less obviously, the organization is also constrained by a number of other aspects that include a safety model the organization has very little leeway to negotiate or adapt.
The technological devices used by the organization but not developed in-house also reflect one or more safety model(s). The design of an aircraft or of a control room relies on a number of assumptions as to how safety works (or what is needed to ensure safe operations) that preside over design choices made by the technology designers and manufacturers. These choices are also guided by some assumptions regarding trade-offs between safety and productivity or other business dimensions. A technological device may even reflect several safety models depending on the operational context and conditions. It is the case of degraded modes of automation like in aircraft design for example. The underlying assumptions as to what will ensure that the flight is safe are different, in particular as to the respective roles of the aircraft and the pilots, in normal or degraded modes of automation. The diversity of safety models embodied by the aircraft itself put different requirements on the flight crew depending on the situation. The reality is even more complex. Indeed, the same technological device may integrate several underlying safety model(s) by combining technologies coming from different sources (e.g. suppliers) that themselves reflect trade-offs between safety and other business objectives. For example, a supplier may favor standardization and thereby adopt a generic "one-size-fits-all" underlying safety model in the design choices fitted for this purpose. In the case of aircraft design, a supplier may provide the same system to several aircraft manufacturers with very limited customization, if any. Eventually, the choice of one technology against another is not neutral in terms of the safety model(s) and trade-offs that it implicitly conveys. One can argue that an airline has the freedom to choose the aircraft and partly the aircraft systems suppliers but anyway, the choice is limited and the leeway remains small.
At this level of detail, the contradictions and inconsistencies appear quite obviously. Nevertheless, there is no point hoping to achieve perfect consistency between all these models. These contradictions are not the sign of an inappropriate way of thinking or of failures of organizations but just a manifestation of the complexity of reality (Morin, 2007). There is no point attempting to reduce them all.
Ultimately, whatever the role given to safety in trade-offs, each organization embeds a mix of safety models that are not necessarily consistent, without even being aware of it. This variety of safety models imposes a set of partly conflicting requirements onto employees at all levels, meaning that "operating safely or safely enough" is not just a matter of safety oriented trade-offs but involves a certain complexity to navigate inconsistencies.

Conclusion
Safety culture tends to focus on operations, excluding from its scope trade-offs and decisions that have a structuring and lasting impact on the conditions under which operations take place. Yet, some of these high-level decisions and trade-offs generate inconsistencies "designed" into the organization and its resources that safety culture alone cannot overcome. Could the role given to safety in these higher-level decisions come under an extension of the safety culture concept or is another set of concepts needed from sociology of organizations, management or other disciplines? Whatever the answer, it would most probably contribute to reducing evitable complexity.
However, it is vain to imagine that this complexity, partly due to the coexisting mix of safety models in an organization, can be totally eliminated. An organization operates in an environment that partly constrains its leeway and generates some inconsistencies in the requirements to operate safely or safely enough.
In fact, the situation is even more complex at the macro level. Safety is one aspect among others that needs to be managed by organizations. If the concept of safety culture was introduced to make sure that it was not under-considered/ overlooked compared to others (e.g. productivity, security, financial benefits…), the issue is that of acceptable or globally reasonable trade-offs between the various stakes, rather than protecting a specific one, possibly to the detriment of others, even when this is safety.