Context drives behavior: work as imagined, work as done and drift

The procedure for a line 3 changeover ran to four pages. It listed 58 steps, from stopping the line through the main control screen to a final walk-round before restart. It said that each conveyor section must be isolated at its disconnect, that a start test must be done 'from the main control screen or the local start station', and that dough must be cleared 'with the line isolated'. It allowed 45 minutes. The plant's lean board showed the changeover target as 25 minutes, and the night shift had averaged 27 minutes for the previous year.

When Elena first saw the two numbers side by side, she asked Luis how a 45-minute procedure was being done in 27. He laughed. 'Nobody does that procedure,' he said. 'We do the changeover.' This lesson is about the gap between those two things, why it exists, how it grows, and what Harrowgate Foods Inc. did about it.

Four versions of the same work

HSE-401 Lesson 8 introduced the distinction between work as imagined and work as done. Safety researcher Steven Shorrock and others have refined it into several varieties, which help explain why managers and workers can describe the same job in very different ways.

• Work as imagined is what people who do not do the job believe happens. It lives in the heads of managers, engineers, auditors and regulators.
• Work as prescribed is what the procedures, standards and training say should happen.
• Work as disclosed is what people say or write about the work, which is shaped by who is asking and what they think the answer should be.
• Work as done is what actually happens, minute by minute, with the real equipment, time, people and conditions of the day.

At Harrowgate Foods Inc., the four versions of a line 3 changeover were all different. Marcus imagined a disciplined 25-minute changeover following the procedure. The procedure prescribed 58 steps in 45 minutes. When asked by auditors, technicians disclosed that they followed the procedure. What they actually did was a smoother, faster sequence that skipped or combined about a dozen steps, used the emergency stop to halt the whole line at once, and cleared dough by hand once the start test showed nothing moving.

Why the gap exists

The gap between imagined and actual work is not mainly a story of rule-breaking. It exists because procedures are written in advance, for typical conditions, by people who are not doing the job, while the work is done in real conditions that vary from day to day. Hollnagel calls the result the efficiency-thoroughness trade-off, or ETTO: people constantly balance doing things thoroughly against doing them efficiently, because they rarely have the time and resources to do both fully.

Several features of the work at Harrowgate Foods Inc. pushed changeovers toward efficiency:

• Targets. The 25-minute target on the lean board was reviewed at every morning meeting, and lines that hit it were praised.
• Time. The day shift started production at 6:30 regardless of when the night shift finished, so overruns were visible and unpopular.
• Tools. Stopping each section through the main control screen meant walking the length of the line twice. The emergency stop halted everything with one press.
• Design. The dough scraper the procedure assumed had been lost years earlier, and the replacement was too short to reach the divider.
• Feedback. Every shortcut that worked without harm made the next one feel safer.

None of these was a decision to accept more risk. Each was a reasonable response to a real pressure. Together they produced a way of working that nobody had designed and nobody in management fully understood.

Local rationality

Dekker and other researchers describe a principle often called local rationality: people do what makes sense to them given their goals, the knowledge they have, and what their attention is focused on at the time. Actions that look foolish in hindsight usually made sense in the moment. The job of anyone trying to understand an event is to reconstruct that moment, not to judge it from outside.

Ben's actions made sense locally. His goal was to finish the changeover safely and on time. His knowledge said that the disconnect named on the placard isolated the divider, and that no movement on a start test meant isolation. His attention was on the stuck dough, the time and the next job he had left unfinished. Within that frame, reaching in was the right thing to do. The frame was wrong because of conditions he could not see.

Context does more than set the scene. It shapes what people pay attention to, what they believe, which goals feel most pressing, and which options seem available. That is why the HOP principle says context drives behavior. To get different behavior reliably, the most effective lever is usually a change in context: the tools, the time, the targets, the information, the layout or the signals leaders send.

Drift

Rasmussen described how work moves within a space bounded by three limits: what is economically acceptable, what workload people will tolerate, and what is safe. Pressure for efficiency pushes work away from the economic boundary, and the desire for less effort pushes it away from the workload boundary. Both push it toward the safety boundary, which is usually invisible until someone crosses it. Dekker later called this process drift into failure.

Drift has some recognizable features:

• It happens in small steps, each of which is a minor and reasonable adjustment.
• Each step is reinforced by success. A shortcut that works becomes the new baseline from which the next shortcut starts.
• It is invisible from inside. The people doing the work see a normal job, done the way it has been done for years.
• It is often invisible from above, because reports and audits describe work as disclosed rather than work as done.
• The boundary is found by crossing it. The first clear sign of drift is often an incident.

HSE-401 Lesson 2 described Diane Vaughan's account of normalization of deviance in the Challenger launch decision, where repeated success with an anomaly turned it into accepted risk. Drift is a broader version of the same process, and it does not require any anomaly to be known. It needs only pressure, adaptation and feedback that says the adaptation worked.

How the line 3 changeover drifted

Tanya and Luis reconstructed the history of the line 3 changeover from old procedures, lean board records and conversations with technicians who had been at the plant for a long time.

No single step was reckless. Each was a sensible response to a real pressure, and each was followed by months or years without harm. By the time of the event, the changeover depended on a start test that the emergency stop could fool and on hand clearing that put a hand within reach of the belt. The margin had gone, and nobody had decided to remove it.

Luis wanted to show managers how success hides drift. He wrote a small simulation in which a team adopts a shortcut whenever the previous ten changeovers went without incident, and each shortcut slightly raises the chance of a serious event.

# How a run of successes hides growing risk (seeded, illustrative)
import random
random.seed(4080)

risk = 0.0002          # chance of a serious event per changeover at the start
shortcuts = 0
quiet = 0
for week in range(1, 261):              # five years, two changeovers per working day
    for _ in range(10):
        if random.random() < risk:
            print(f"serious event in week {week} after {shortcuts} shortcuts, risk {risk:.4f}")
            raise SystemExit
        quiet += 1
        if quiet >= 10:                  # ten quiet changeovers: adopt another small shortcut
            shortcuts += 1
            risk *= 1.01
            quiet = 0
    if week % 52 == 0:
        print(f"year {week // 52}: shortcuts {shortcuts:3d}, risk per changeover {risk:.4f}")
print("no serious event in five years; final risk", round(risk, 4))

year 1: shortcuts  52, risk per changeover 0.0003
year 2: shortcuts 104, risk per changeover 0.0006
year 3: shortcuts 156, risk per changeover 0.0009
year 4: shortcuts 208, risk per changeover 0.0016
serious event in week 257 after 256 shortcuts, risk 0.0026

In the seeded run, the team went almost five years without a serious event while the risk per changeover rose about thirteen times. Each yearly line looked like a success. When the event came, it was the first clear sign that anything had changed. Luis pointed out that the injury rate would have looked fine throughout, and so would the audits, which checked whether the procedure existed and had been signed. Only by looking at work as done could anyone have seen the change.

Seeing work as done

If work as done is the real system, managers need ways to see it. Harrowgate Foods Inc. used several, all of which depended on people feeling safe to show the truth.

• Observation without judgment. Managers watched changeovers with the explicit agreement that nothing they saw would lead to discipline, and that the purpose was to understand the work. Elena called it 'watching to learn, not watching to catch'.
• 'Show me' conversations. Instead of asking 'do you follow the procedure?', which invites work as disclosed, managers asked 'show me how you do this' and 'what makes this hard?'
• Comparing records. Changeover times, permits and maintenance records often revealed that the work could not be following the procedure as written.
• Learning teams, which Lesson 7 covers in detail.
• Asking about adaptations. 'Where do you have to work around something to get the job done?' was one of the most productive questions the project asked.

The observation work at the main plant found gaps between procedure and practice in 23 of the 30 tasks reviewed in the first six months. Most were small and harmless. Six involved critical steps, such as isolation or work at height, and those six went to the top of the improvement list.

Closing the gap

There are two ways to close a gap between imagined and actual work: bring the work back to the procedure, or bring the procedure to the work. HOP does not say one is always right. It says the choice should be made deliberately, with the people who do the job, and with the critical steps protected either way.

For the line 3 changeover, the team did both. Steps that protected against serious harm, such as section isolation and a valid start test, were made easier rather than simply restated: the control system was changed so that a single 'changeover stop' button halted each section in order without the emergency stop, a new long scraper was mounted on the frame, and the start test was moved to a dedicated button that refused to run while any emergency stop was latched. Steps that added nothing, such as a duplicate sign-off, were removed. The target was set by the crew at 35 minutes, achievable with the critical steps intact, and the lean board was changed to show changeovers done without skipping a critical step rather than the fastest time.