Inspection Systems

Auditing has been defined as “the structured process of collecting independent information on the efficiency, effectiveness and reliability of the total safety management system and drawing up plans for corrective action” (Successful Health & Safety Management 1991).

The workplace inspection therefore is not only the final stage in setting up a safety management programme but is also a continuing process in its maintenance. It can be conducted only where a properly devised management system for safety has been established. Such a system first envisages a formal policy statement from management setting out its principles for creating a healthy and safe working environment and then establishing the mechanisms and the structures within the organization whereby these principles will be effectively implemented. Management must furthermore be committed to providing adequate resources, both human and financial, to support the system’s mechanisms and structures. Thereafter, there must be detailed planning for safety and health, and the defining of measurable goals. Systems must be devised to ensure that safety and health performance in practice can be measured against established norms and against previous achievements. Only when this structure is in place and is operating can an effective management audit system be applied.

Complete safety and health management systems can be devised, produced and implemented from within the resources of larger enterprises. Additionally, there are a number of safety management control systems which are available from consultants, insurance companies, government agencies, associations and specialist companies. It is a matter for the enterprise to decide whether it should produce its own system or obtain outside services. Both alternatives are capable of producing excellent results if there is a genuine commitment by management to apply them diligently and to make them work. But for their success, they do depend heavily on the quality of the audit system.

Management Inspections

The inspection procedure must be as painstaking and objective as the company’s financial inspection. The inspection must first determine whether the company’s statement of policy on safety and health is properly reflected in the structures and mechanisms created to implement it; if not, then the inspection may recommend that the fundamental policy be reappraised or suggest adjustments or alterations to the existing structures and mechanisms. A similar process must be applied to safety and health planning, to the validity of the goal-setting norms, and to the measurement of performance. The results of any inspection must be considered by the top management of the enterprise, and any correctives must be endorsed and implemented through that authority.

In practice it is undesirable, and often impractical, to undertake a complete inspection of all of a system’s features and their application throughout every department of the enterprise at one time. More usually, the inspection procedure concentrates on one feature of the total safety management system throughout the plant, or alternatively on the application of all the features in one department or even subdepartment. But the objective is to cover all the features in all departments over an agreed period in order to validate the results.

To this extent management inspection should be regarded as a continuous process of vigilance. The need for objectivity is clearly of considerable importance. If inspections are conducted in-house then there must be a standardized inspection procedure; inspections should be undertaken by staff who have been properly trained for this purpose; and those selected as inspectors must not assess the departments in which they normally work, nor should they assess any other work in which they have a personal involvement. Where reliance is placed on consultants this problem is minimized.

Many major companies have adopted this type of system, either devised internally or obtained as a proprietary scheme. When the systems have been carefully followed through from policy statement to inspection, feedback and corrective actions, a substantial reduction in accident rates, which is the prime justification for the procedure, and increased profitability, which is a welcome secondary outcome, should result.

Inspections by Inspectorates

The legal framework which is designed to afford protection to people at work must be properly administered and effectively applied if the purpose of the regulatory legislation is to be achieved. Most countries have therefore adopted the broad model of an inspection service which has the duty of ensuring that safety and health legislation is enforced. Many countries see safety and health issues as part of a complete labour relations package covering industrial relations, wages and holiday agreements, and social benefits. In this model, safety and health inspections are one element of the labour inspector’s duties. A different model also exists in which the state inspectorate is exclusively concerned with safety and health legislation, so that workplace inspections concentrate solely on this aspect. Further variations are evident in the division of the inspection functions between either a national inspectorate or a regional/provincial inspectorate, or indeed, as in Italy and the United Kingdom, for example, as a working combination of both national and regional inspectorates. But whichever model is adopted, the essential function of the inspectorate is to determine compliance with the legislation by a programme of planned inspections and investigations at the workplace.

There can be no effective inspection system unless those who undertake this work are given adequate powers to carry it out. There is much common ground among inspectorates as regards the powers given to them by their legislators. There must always be the right of entry to premises, which is clearly fundamental for inspection. Thereafter there is the legal right to examine relevant documents, registers and reports, to interview members of the workforce either individually or collectively, to have unrestricted access to trade union representatives at the workplace, to take samples of substances or materials at use in the workplace, to take photographs and, if appropriate, to take written statements from people working at the premises.

Additional powers are often provided to enable inspectors to rectify conditions which might be an immediate source of danger or ill health to the workforce. Again there is a wide variety of practices. Where standards are so poor that there is an imminent risk of danger to the workforce, then an inspector may be authorized to serve a legal document on the spot prohibiting the use of the machinery or plant, or stopping the process until the risk has been effectively controlled. For a lower order of risk, inspectors can issue a legal notice formally requiring that measures be taken within a given time to improve standards. These are effective ways of rapidly improving working conditions, and are often a form of enforcement preferable to formal court proceedings, which may be cumbersome and slow in securing remediation.

Legal proceedings have an important place in the hierarchy of enforcement. There is an argument that because court proceedings are simply punitive and do not necessarily result in changing attitudes to safety and health at work, they should therefore be invoked only as a last resort when all other attempts at securing improvements have failed. But this view has to be set against the fact that where legal requirements have been ignored or disregarded, and where people’s safety and health have been significantly put at risk, then the law must be enforced and the courts must decide the issue. There is the further argument that those enterprises which disregard safety and health legislation may thereby enjoy an economic advantage over their competitors, who provide adequate resources to comply with their legal duties. Prosecution of those who persistently disregard their duties is therefore a deterrent to the unscrupulous, and an encouragement to those who try to observe the law.

Every inspection service has to determine the proper balance between providing advice and enforcing the law in the course of inspection work. A special difficulty emerges in connection with the inspection of small enterprises. Local economies, and indeed national economies, are often underpinned by industrial premises each employing fewer than 20 people; in the case of agriculture, the employment figure per unit is very much less. The function of the inspectorate in these cases is to use the workplace inspection to provide information and advice not only on legal requirements, but on practical standards and effective ways of meeting those standards. The technique must be to encourage and stimulate, rather than to immediately enforce the law by punitive action. But even here the balance is a difficult one. People at work are entitled to safety and health standards irrespective of the size of the enterprise, and it would therefore be wholly misguided for an inspection service to ignore or minimize risks and to curtail or even forgo enforcement simply to nurture the existence of the economically fragile small enterprise.

Consistency of Inspections

In the view of the complex nature of their work - with its combined needs for legal, prudential, technical and scientific skills, inspectors do not - indeed should not - adopt a mechanistic approach to inspection. This constraint, combined with a difficult balance between the advisory and enforcement functions, creates yet another concern, that of the consistency of inspection services. Industrialists and trade unions have a right to expect a consistent application of standards, whether technical or legal, by inspectors across the country. In practice this is not always easy to achieve, but it is something for which the enforcing authorities must always strive.

There are ways of achieving an acceptable consistency. First, the inspectorate should be as open as possible in publishing its technical standards and in publicly setting out its enforcement policies. Second, through training, the application of peer review exercises, and internal instructions, it should be able both to recognize a problem and to provide systems to deal with it. Finally, it should ensure that there are procedures for industry, the workforce, the public and the social partners to secure redress if they have a legitimate grievance over inconsistency or other forms of maladministration associated with inspection.

Frequency of Inspections

How frequently should the inspectorates undertake inspections of the workplace? Again there is considerable variation in the way this question may be answered. The International Labour Organization (ILO) holds the view that the minimum requirement should be that every workplace should receive an inspection from the enforcing authorities at least once each year. In practice, few countries manage to produce a programme of work inspection which meets this objective. Indeed, since the major economic depression in the late 1980s some governments have been curtailing inspection services by budget limitations that result in cutbacks in the number of inspectors, or by restrictions on recruiting new staff to replace those who retire.

There are different approaches to determine how frequently inspections should be made. One approach has been purely cyclical. Resources are deployed to provide inspection of all premises on a 2-yearly, or more likely a 4-yearly, basis. But this approach, though possibly having the appearance of equity, treats all premises as the same regardless of size or risk. Yet enterprises are manifestly diverse as regards safety and health conditions, and to the extent that they differ, this system may be regarded as mechanistic and flawed.

A different approach, adopted by some inspectorates, has been to attempt to draw up a programme of work based on hazard; the greater the hazard either to safety or health, the more frequent the inspection. Hence resources are applied by the inspectorate to those places where the potential for harm to the workforce is the greatest. Although this approach has merits, there are still considerable problems associated with it. First, there are difficulties in accurately and objectively assessing hazard and risk. Second, it extends very considerably the intervals between inspections of those premises where hazards and risks are considered to be low. Therefore, extended periods may elapse during which many of the workforce may have to forgo that sense of security and assurance which inspection can provide. Furthermore, the system tends to presume that hazards and risks, once assessed, do not radically change. This is far from being the case, and there is the danger that a low-rated enterprise may change or develop its production in such a way as to increase hazards and risk without the inspectorate’s being aware of the development.

Other approaches include inspections based on facility injury rates which are higher than the national averages for the particular industry, or immediately following a fatal injury or major catastrophe. There are no short and easy answers to the problem of determining the frequency of inspection, but what seems to be happening is that inspection services in many countries are too often significantly under-resourced, with the result that the real protection to the workforce afforded by the service is being progressively eroded.

Inspection Goals

Inspection techniques in the workplace vary according to the size and complexity of the enterprise. In smaller companies, the inspection will be comprehensive and will assess all hazards and the extent to which the risks arising from the hazards have been minimized. The inspection will therefore ensure that the employer is fully aware of safety and health problems and is given practical guidance on how they may be addressed. But even in the smallest enterprise the inspectorate should not give the impression that fault-finding and the application of suitable remedies are the function of the inspectorate and not of the employer. Employers must be encouraged by inspection to control and effectively manage safety and health problems, and they must not abdicate their responsibilities by awaiting an inspection from the enforcement authorities before taking needed action.

In larger companies, the emphasis of inspection is rather different. These companies have the technical and financial resources to deal with safety and health problems. They should devise both effective management systems to resolve the problems, as well as management procedures to check that the systems are working. In these circumstances, the inspection emphasis should therefore be on checking and validating the management control systems found at the workplace. The inspection should therefore not be an exhaustive examination of all items of plant and equipment to determine their safety, but rather to use selected examples to test the effectiveness or otherwise of the management systems for ensuring safety and health at work.

Worker Involvement in Inspections

Whatever the premises, a critical element in any type of inspection is contact with the workforce. In many smaller premises, there may be no formal trade union structure or indeed any workforce organization at all. However, to ensure the objectivity and acceptance of the inspection service, contact with individual workers should be an integral part of the inspection. In larger enterprises, contact should always be made with trade union or other recognized worker representatives. Legislation in some countries (Sweden and the United Kingdom, for example) gives official recognition and powers to trade union safety representatives, including the right to make workplace inspections, to investigate accidents and dangerous occurrences and in some countries (though this is exceptional) to stop plant machinery or the production process if it is imminently dangerous. Much useful information can be gained from these contacts with the workers, which should feature in every inspection, and certainly whenever the inspectorate is conducting an inspection as the result of an accident or a complaint.

Inspection Findings

The final element in an inspection is to review the inspection findings with the most senior member of management on the site. Management has the prime responsibility to comply with legal requirements on safety and health, and therefore no inspection should be complete without management’s being fully aware of the extent to which it has met those duties, and what needs to be done to secure and maintain proper standards. Certainly if any legal notices are issued as a result of an inspection, or if legal proceedings are likely, then senior management must be aware of this state of affairs at the earliest possible stage.

Company Inspections

Company inspections are an important ingredient in maintaining sound standards of safety and health at work. They are appropriate to all enterprises and, in larger companies, may be an element in the management inspection procedure. For smaller companies, it is essential to adopt some form of regular company inspection. Reliance should not be placed on the inspection services provided by the inspectorates of the enforcing authorities. These are usually far too infrequent, and should serve largely as a stimulus to improve or maintain standards, rather than be the primary source for evaluating standards. Company inspections can be undertaken by consultants or by companies who specialize in this work, but the current discussion will concentrate on inspection by the enterprise’s own personnel.

How frequently should company inspections be made? To some degree the answer is dependent on the hazards associated with the work and the complexity of the plant. But even in low-risk premises there should be some form of inspection on a regular (monthly, quarterly, etc.) basis. If the company employs a safety professional, then clearly the organization and the conduct of the inspection must be an important part of this function. The inspection should usually be a team effort involving the safety professional, the departmental manager or foreman, and either a trade union representative or a qualified worker, such as a safety committee member. The inspection should be comprehensive; that is to say, a close examination should be made both of the safety software (for example, systems, procedures and work permits) and the hardware (for example, machinery guarding, fire-fighting equipment, exhaust ventilation and personal protective equipment). Particular attention should be paid to “near misses” - those incidents which do not result in damages or personal injury but which have the imminent potential for serious accidental injuries. There is an expectation that after an accident resulting in absence from work, the inspection team would immediately convene to investigate the circumstances, as a matter outside the normal cycle of inspection. But even during routine workshop inspection the team should also consider the extent of minor accidental injuries which have occurred in the department since the previous inspection.

It is important that company inspections should not seem to be consistently negative. Where faults exist it is important that they be identified and rectified, but it is equally important to commend the maintenance of good standards, to comment positively on tidiness and good housekeeping, and to reinforce by encouragement those who use personal protective equipment provided for their safety. To complete the inspection a formal written report should be made of the significant deficiencies found. Particular attention should be drawn to any shortcomings which have been identified in previous inspections but have not yet been corrected. Where there exists a works safety council, or a joint management-worker safety committee, the inspection report should be featured as a standing item on the council’s agenda. The report on the inspection must be sent to and discussed with the senior management of the enterprise, who should then determine whether action is required and, if so, authorize and support such action.

Even the smallest companies, where there is no safety professional, and where trade unions may not exist, should consider company inspections. Many inspectorates have produced very simple guidelines illustrating the basic concepts of safety and health, their application to a range of industries, and practical ways in which they can be applied in even the smallest enterprises. Many safety associations specifically target small businesses with publications (often free) which provide the basic information to establish safe and healthy working conditions. Armed with this sort of information and with the expenditure of very little time, the proprietor of a small business can establish reasonable standards, and can thus perhaps obviate the sort of accidents which can happen to the workforce in even the smallest business.

Back

Through industrialization, workers became organized in factories as the utilization of energy sources such as the steam engine became possible. As compared to traditional handicraft, mechanized production, with sources of higher energy at its disposal, presented new risks of accidents. As the amount of energy increased, workers were removed from the direct control of these energies. Decisions that affected safety were often made at the management level rather than by those directly exposed to these risks. At this stage of industrialization, the need for safety management became evident.

In the late 1920s, Heinrich formulated the first comprehensive theoretical framework for safety management, which was that safety should be sought through management decisions based on identification and analysis of accident causes. At this point in the development of safety management, accidents were attributed to failures at the worker-machine system level - that is, to unsafe acts and unsafe conditions.

Subsequently, various methodologies were developed for the identification and assessment of accident risks. With MORT (Management Oversight and Risk Tree), the focus shifted to the higher orders of control of accident risks - that is, to the control of conditions at the management level. The initiative to develop MORT was taken in the late 1960s by the US Energy Research and Development Administration, which wanted to improve their safety programmes in order to reduce their losses due to accidents.

The MORT Diagram and Underlying Principles

The intent of MORT was to formulate an ideal safety management system based on a synthesis of the best safety programme elements and safety management techniques then available. As the principles underlying the MORT initiative were applied to the contemporary state of the art in safety management, the largely unstructured safety literature and expertise took on the form of an analytical tree. The first version of the tree was published in 1971. Figure 1 shows the basic elements of the version of the tree that was published by Johnson in 1980. The tree also appears in a modified form in later publications on the subject of the MORT concept (see, for example, Knox and Eicher 1992).

Figure 1. A version of the MORT analytical tree

The MORT Diagram

MORT is used as a practical tool in accident investigations and in evaluations of existing safety programmes. The top event of the tree in figure 1 (Johnson 1980) represents the losses (experienced or potential) due to an accident. Below this top event are three main branches: specific oversights and omissions (S), management oversights and omissions (M) and assumed risks (R). The R-branch consists of assumed risks, which are events and conditions that are known to management and that have been evaluated and accepted at the proper management level. Other events and conditions that are revealed through the evaluations following the S- and M-branches are denoted “less than adequate” (LTA).

The S-branch focuses on the events and conditions of the actual or potential occurrence. (In general, time is shown as one reads from left to right, and the sequence of causes is shown as one reads from bottom to top.) Haddon’s strategies (1980) for the prevention of accidents are key elements in this branch. An event is denoted an accident when a target (a person or object) is exposed to an uncontrolled transfer of energy and sustains damage. In the S-branch of MORT, accidents are prevented through barriers. There are three basic types of barriers: (1) barriers that surround and confine the energy source (the hazard), (2) barriers that protect the target and (3) barriers that separate the hazard and the target physically or in time or space. These different types of barriers are found in the development of the branches below the accidental event. Amelioration relates to the actions taken after the accident to limit the losses.

At the next level of the S-branch, factors are recognized which relate to the different phases of the life cycle of an industrial system. These are the project phase (design and plan), start up (operational readiness) and operation (supervision and maintenance).

The M-branch supports a process in which specific findings from an accident investigation or safety programme evaluation are made more general. Events and conditions of the S-branch thus often have their counterparts in the M-branch. When engaged with the system at the M-branch, the analyst’s thinking is expanded to the total management system. Thus, any recommendations will affect many other possible accident scenarios as well. The most important safety management functions can be found in the M-branch: the setting of policy, implementation and follow-up. These are the same basic elements that we find in the quality assurance principles of the ISO 9000 series published by the International Organization for Standardization (ISO).

When the branches of the MORT diagram are elaborated in detail, there are elements from such different fields as risk analysis, human factors analysis, safety information systems and organizational analysis. In total, about 1,500 basic events are covered by the MORT diagram.

Application of the MORT Diagram

As indicated, the MORT diagram has two immediate uses (Knox and Eicher 1992): (1) to analyse management and organizational factors relative to an accident that has happened and (2) to evaluate or audit a safety programme in relation to a significant accident that has the potential of occurring. The MORT diagram functions as a screening tool in planning the analyses and evaluations. It is also used as a checklist for comparison of actual conditions with the idealized system. In this application, MORT facilitates checking the completeness of the analysis and avoiding personal biases.

At bottom, MORT is made up of a collection of questions. Criteria that guide judgements as to whether specific events and conditions are satisfactory or less than adequate are derived from these questions. In spite of the directive design of the questions, the judgements made by the analyst are partly subjective. It has thus become important to ensure an adequate quality and degree of intersubjectivity among MORT analyses made by different analysts. For example, in the United States, a training programme is available for certification of MORT analysts.

Experiences with MORT

The literature on evaluations of MORT is sparse. Johnson reports significant improvements in the comprehensiveness of accident investigations after the introduction of MORT (Johnson 1980). Deficiencies at the supervisory and management levels were revealed more systematically. Experience has also been gained from evaluations of MORT applications within Finnish industry (Ruuhilehto 1993). Some limitations have been identified in the Finnish studies. MORT does not support the identification of immediate risks due to failures and disturbances. Furthermore, no capability for setting priorities is built into the MORT concept. Consequently, the results of MORT analyses need further evaluation to translate them into remedial actions. Finally, experience shows that MORT is time-consuming and requires expert participation.

Aside from its ability to focus on organizational and management factors, MORT has the further advantage of connecting safety with normal production activities and general management. The application of MORT will thus support general planning and control, and help reduce the frequency of production disturbances as well.

Associated Safety Management Methods and Techniques

With the introduction of the MORT concept in the early 1970s, a development programme started in the United States. The focal point for this programme has been the System Safety Development Center in Idaho Falls. Different MORT-associated methods and techniques in such areas as human factors analysis, safety information systems and safety analysis have resulted from this programme. An early example of a method arising from the MORT development programme is the Operational Readiness Program (Nertney 1975). This programme is introduced during the development of new industrial systems and modifications of existing ones. The aim is to ensure that, from the safety management point of view, the new or modified system is ready at the time of start-up. A condition of operational readiness presupposes that the necessary barriers and controls have been installed in the new system’s hardware, personnel and procedures. Another example of a MORT programme element is the MORT-based root cause analysis (Cornelison 1989). It is used to identify the basic safety management problems of an organization. This is done by relating the specific findings of the MORT analyses to 27 different generic safety management problems.

Although MORT is not intended for use directly in the collection of information during accident investigations and safety audits, in Scandinavia, the MORT questions have served as a basis for the development of a diagnostic tool used for this purpose. It is called the Safety Management and Organization Review Technique, or SMORT (Kjellén and Tinmannsvik 1989). A SMORT analysis advances backwards in steps, starting from the specific situation and ending at the general management level. The starting point (level 1) is an accident sequence or a risk situation. At level 2, the organization, system planning and technical factors related to daily operation are scrutinized. The subsequent levels include design of new systems (level 3) and higher management functions (level 4). Findings on one level are extended to the levels above. For example, results related to the accident sequence and to daily operations are used in the analysis of the company’s organization and routines for project work (level 3). Results at level 3 will not affect safety in existing operations but may be applied to the planning of new systems and modifications. SMORT also differs from MORT in the way findings are identified. At level 1, these are observable events and conditions that deviate from generally accepted norms. When organizational and management factors are brought into the analysis at levels 2 to 4, the findings are identified through value judgements made by an analysis group and verified through a quality control procedure. The aim is to ensure a mutually shared understanding of the organizational problems.

Summary

MORT has been instrumental in developments within safety management since the 1970s. It is possible to track the influence of MORT to such areas as safety research literature, literature on safety management and audit tools, and legislation on self-regulation and internal control. In spite of this impact, its limitations must be carefully considered. MORT and associated methods are normative in the sense that they prescribe how safety management programmes should be organized and executed. The ideal is a well-structured organization with clear and realistic goals and well-defined lines of responsibility and authority. MORT is thus best suited for large and bureaucratic organizations.

Back

This article addresses “machine” hazards, those which are specific to the appurtenances and hardware used in the industrial processes associated with pressure vessels, processing equipment, powerful machines and other intrinsically risky operations. This article does not address worker hazards, which implicate the actions and behaviour of individuals, such as slipping on working surfaces, falling from elevations and hazards from using ordinary tools. This article focuses on machine hazards, which are characteristic of an industrial job environment. Since these hazards threaten anyone present and may even be a threat to neighbours and the external environment, the analysis methods and the means for prevention and control are similar to the methods used to deal with risks to the environment from industrial activities.

Machine Hazards

Good quality hardware is very reliable, and most failures are caused by secondary effects like fire, corrosion, misuse and so on. Nevertheless, hardware may be highlighted in certain accidents, because a failing hardware component is often the most conspicuous or visibly prominent link of the chain of events. Although the term hardware is used in a broad sense, illustrative examples of hardware failures and their immediate “surroundings” in accident causation have been taken from industrial workplaces. Typical candidates for investigation of “machine” hazards include but are not limited to the following:

• pressure vessels and pipes

• motors, engines, turbines and other rotating machines

• chemical and nuclear reactors

• scaffolding, bridges, etc.

• lasers and other energy radiators

• cutting and drilling machinery, etc.

• welding equipment.

Effects of Energy

Hardware hazards can include wrong use, construction errors or frequent overload, and accordingly their analysis and mitigation or prevention can follow rather different directions. However, physical and chemical energy forms that elude human control often exist at the heart of hardware hazards. Therefore, one very general method to identify hardware hazards is to look for the energies that are normally controlled with the actual piece of equipment or machinery, such as a pressure vessel containing ammonia or chlorine. Other methods use the purpose or intended function of the actual hardware as a starting point and then look for the probable effects of malfunctions and failures. For example, a bridge failing to fulfil its primary function will expose subjects on the bridge to the risk of falling down; other effects of the collapse of a bridge will be the secondary ones of falling items, either structural parts of the bridge or objects situated on the bridge. Further down the chain of consequences, there may be derived effects related to functions in other parts of the system that were dependent on the bridge performing its function properly, such as the interruption of emergency response vehicular traffic to another incident.

Besides the concepts of “controlled energy” and “intended function”, dangerous substances must be addressed by asking questions such as, “How could agent X be released from vessels, tanks or pipe systems and how could agent Y be produced?” (either or both may be hazardous). Agent X might be a pressurized gas or a solvent, and agent Y might be an extremely toxic dioxin whose formation is favoured by the “right” temperatures in some chemical processes, or it could be produced by rapid oxidation, as the result of a fire. However, the possible hazards add up to much more than just the risks of dangerous substances. Conditions or influences might exist which allow the presence of a particular item of hardware to lead to harmful consequences to humans.

Industrial Work Environment

Machine hazards also involve load or stress factors that may be dangerous in the long run, such as the following:

• extreme working temperatures

• high intensities of light, noise or other stimuli

• inferior air quality

• extreme job demands or workloads.

These hazards can be recognized and precautions taken because the dangerous conditions are already there. They do not depend on some structural change in the hardware to come about and work a harmful result, or on some special event to effect damage or injury. Long-term hazards also have specific sources in the working environment, but they must be identified and evaluated through observing workers and the jobs, instead of just analysing hardware construction and functions.

Dangerous hardware or machine hazards are usually exceptional and rather seldom found in a sound working environment, but cannot be avoided completely. Several types of uncontrolled energy, such as the following risk agents, can be the immediate consequence of hardware malfunction:

• harmful releases of dangerous gas, liquids, dusts or other substances

• fire and explosion

• high voltages

• falling objects, missiles, etc.

• electric and magnetic fields

• cutting, trapping, etc.

• displacement of oxygen

• nuclear radiation, x rays and laser light

• flooding or drowning

• jets of hot liquid or steam.

Risk Agents

Moving objects. Falling and flying objects, liquid flows and jets of liquid or steam, such as listed, are often the first external consequences of hardware or equipment failure, and they account for a large proportion of accidents.

Chemical substances. Chemical hazards also contribute to worker accidents as well as affecting the environment and the public. The Seveso and Bhopal accidents involved chemical releases which affected numerous members of the public, and many industrial fires and explosions release chemicals and fumes to the atmosphere. Traffic accidents involving gasoline or chemical delivery trucks or other dangerous goods transports, unite two risk agents - moving objects and chemical substances.

Electromagnetic energy. Electric and magnetic fields, x rays and gamma rays are all manifestations of electromagnetism, but are often treated separately as they are encountered under rather different circumstances. However, the dangers of electromagnetism have some general traits: fields and radiation penetrate human bodies instead of just making contact on the application area, and they cannot be sensed directly, although very large intensities cause heating of the affected body parts. Magnetic fields are created by the flow of electric current, and intense magnetic fields are to be found in the vicinity of large electric motors, electric arc welding equipment, electrolysis apparatus, metal works and so forth. Electric fields accompany electric tension, and even the ordinary mains voltages of 200 to 300 volts cause the accumulation of dirt over several years, the visible sign of the field’s existence, an effect also known in connection with high-tension electrical lines, TV picture tubes, computer monitors and so on.

Electromagnetic fields are mostly found rather close to their sources, but electromagnetic radiation is a long-distance traveller, as radar and radio waves exemplify. Electromagnetic radiation is scattered, reflected and damped as it passes through space and meets intervening objects, surfaces, different substances and atmospheres, and the like; its intensity is therefore reduced in several ways.

The general character of the electromagnetic (EM) hazard sources are:

• Instruments are needed to detect the presence of EM fields or EM radiation.

• EM does not leave primary traces in the form of “contamination”.

• Dangerous effects are usually delayed or long-term, but immediate burns are caused in severe cases.

• X rays and gamma rays are damped, but not stopped, by lead and other heavy elements.

• Magnetic fields and x rays are stopped immediately when the source is de-energized or the equipment turned off.

• Electric fields can survive for long periods after turning the generating systems off.

• Gamma rays come from nuclear processes, and these radiation sources cannot be turned off as can many EM sources.

Nuclear radiation. The hazards associated with nuclear radiation are of special concern to workers in nuclear power plants and in plants working with nuclear materials such as fuel manufacturing and the reprocessing, transport and storage of radioactive matter. Nuclear radiation sources are also used in medicine and by some industries for measurement and control. One most common usage is in fire alarms/smoke detectors, which use an alpha-particle emitter like americium to monitor the atmosphere.

Nuclear hazards are principally centred around five factors:

• gamma rays

• neutrons

• beta particles (electrons)

• alpha particles (helium nuclei)

• contamination.

The hazards arise from the radioactive processes in nuclear fission and the decaying of radioactive materials. This sort of radiation is emitted from reactor processes, reactor fuel, reactor moderator material, from the gaseous fission products that may be developed, and from certain construction materials that become activated by exposure to radioactive emissions arising from reactor operation.

Other risk agents. Other classes of risk agents that release or emit energy include:

• UV radiance and laser light

• infrasound

• high-intensity sound

• vibration.

Triggering the Hardware Hazards

Both sudden and gradual shifts from the controlled - or “safe” - condition to one with increased danger can come about through the following circumstances, which can be controlled through appropriate organizational means such as user experience, education, skills, surveillance and equipment testing:

• wear and overloads

• external impact (fire or impact)

• ageing and failure

• wrong supply (energy, raw materials)

• insufficient maintenance and repair

• control or process error

• misuse or misapplication

• hardware breakdown

• barrier malfunction.

Since proper operations cannot reliably compensate for improper design and installation, it is important to consider the entire process, from selection and design through installation, use, maintenance and testing, in order to evaluate the actual state and conditions of the hardware item.

Hazard Case: The Pressurized Gas Tank

Gas can be contained in suitable vessels for storage or transport, like the gas and oxygen cylinders used by welders. Often, gas is handled at high pressure, affording a great increase in the storing capacity, but with higher accident risk. The key accidental phenomenon in pressurized gas storage is the sudden creation of a hole in the tank, with these results:

• the confinement function of the tank ceases

• the confined gas gets immediate access to the surrounding atmosphere.

The development of such an accident depends on these factors:

• the type and amount of gas in the tank

• the situation of the hole in relation to the tank’s contents

• the initial size and subsequent growth rate of the hole

• the temperature and pressure of the gas and the equipment

• the conditions in the immediate environment (sources of ignition, people, etc.).

The tank contents can be released almost immediately or over a period of time, and result in different scenarios, from the burst of free gas from a ruptured tank, to moderate and rather slow releases from small punctures.

The behaviour of various gases in the case of leakage

When developing release calculation models, it is most important to determine the following conditions affecting the system’s potential behaviour:

• the gas phase behind the hole (gaseous or liquid?)

• temperature and wind conditions

• the possible entry of other substances into the system or their possible presence in its surroundings

• barriers and other obstacles.

The exact calculations pertaining to a release process where liquefied gas escapes from a hole as a jet and then evaporates (or alternatively, first becomes a mist of droplets) are difficult. The specification of the later dispersion of the resultant clouds is also a difficult problem. Consideration must be given to the movements and dispersion of gas releases, whether the gas forms visible or invisible clouds and whether the gas rises or stays at ground level.

While hydrogen is a light gas compared to any atmosphere, ammonia gas (NH₃, with a molecular weight of 17.0) will rise in an ordinary air-like, oxygen-nitrogen atmosphere at the same temperature and pressure. Chlorine (Cl₂, with a molecular weight of 70.9) and butane (C₄H₁₀, mol. wt.58) are examples of chemicals whose gas phases are denser than air, even at ambient temperature. Acetylene (C₂H₂, mol. wt. 26.0) has a density of about 0.90g/l, approaching that of air (1.0g/l), which means that in a working environment, leaking welding gas will not have a pronounced tendency to float upwards or to sink downwards; therefore it can mix easily with the atmosphere.

But ammonia released from a pressure vessel as a liquid will at first cool as a consequence of its evaporation, and may then escape via several steps:

• Pressurized, liquid ammonia emanates from the hole in tank as jet or cloud.

• Seas of liquid ammonia can be formed on the nearest surfaces.

• The ammonia evaporates, thereby cooling itself and the near environment.

• Ammonia gas gradually exchanges heat with surroundings and equilibrates with ambient temperatures.

Even a cloud of light gas may not rise immediately from a liquid gas release; it may first form a fog - a cloud of droplets - and stay near the ground. The gas cloud’s movement and gradual mixing/dilution with the surrounding atmosphere depends on weather parameters and on the surrounding environment—enclosed area, open area, houses, traffic, presence of the public, workers and so on.

Tank Failure

Consequences of tank breakdown may involve fire and explosion, asphyxiation, poisoning and choking, as experience shows with gas production and gas handling systems (propane, methane, nitrogen, hydrogen, etc.), with ammonia or chlorine tanks, and with gas welding (using acetylene and oxygen). What actually initiates the formation of a hole in a tank has a strong influence on the hole “behaviour” - which in its turn influences the outflow of gas - and is crucial for the effectiveness of prevention efforts. A pressure vessel is designed and built to withstand certain conditions of use and environmental impact, and for handling a certain gas, or perhaps a choice of gases. The actual capabilities of a tank depend on its shape, materials, welding, protection, use and climate; therefore, evaluation of its adequacy as a container for dangerous gas must consider designer’s specifications, the tank’s history, inspections and tests. Critical areas include the welding seams used on most pressure vessels; the points where appurtenances such as inlets, outlets, supports and instruments are connected to the vessel; the flat ends of cylindrical tanks like railway tanks; and other aspects of even less optimal geometric shapes.

Welding seams are investigated visually, by x rays or by destructive test of samples, as these may reveal local defects, say, in the form of reduced strength that might endanger the overall strength of the vessel, or even be a triggering point for acute tank failure.

Tank strength is affected by the history of tank use - first of all by the normal wearing processes and the scratches and corrosion attacks typical of the particular industry and of the application. Other historical parameters of particular interest include:

• casual overpressure

• extreme heating or cooling (internal or external)

• mechanical impacts

• vibrations and stress

• substances that have been stored in or have passed through the tank

• substances used during cleansing, maintenance and repair.

The construction material - steel plate, aluminium plate, concrete for non-pressurized applications, and so on - can undergo deterioration from these influences in ways that are not always possible to check without overloading or destroying the equipment during testing.

Accident Case: Flixborough

The explosion of a large cloud of cyclohexane in Flixborough (UK) in 1974, which killed 28 persons and caused extensive plant damage, serves as a very instructive case. The triggering event was the breakdown of a temporary pipe serving as a substitute in a reactor unit. The accident was “caused” by a piece of hardware breaking down, but on closer investigation it was revealed that the breakdown followed from overload, and that the temporary construction was in fact inadequate for its intended use. After two months’ service, the pipe was exposed to bending forces due to a slight pressure rise of the 10-bar (10⁶ Pa) cyclohexane content at about 150°C. The two bellows between the pipe and the nearby reactors broke and 30 to 50 tonnes of cyclohexane was released and soon ignited, probably by a furnace some distance from the leak. (See figure 1.) A very readable account of the case is found in Kletz (1988).

Figure 1. Temporary connection between tanks at Flixborough

Hazard Analysis

The methods that have been developed to find the risks that may be relevant to a piece of equipment, to a chemical process or to a certain operation are referred to as “hazard analysis”. These methods ask questions such as: “What may possibly go wrong?” “Could it be serious?” and “What can be done about it?” Different methods of conducting the analyses are often combined to achieve a reasonable coverage, but no such set can do more than guide or assist a clever team of analysts in their determinations. The main difficulties with hazard analysis are as follows:

• availability of relevant data

• limitations of models and calculations

• new and unfamiliar materials, constructions and processes

• system complexity

• limitations on human imagination

• limitations on practical tests.

To produce usable risk evaluations under these circumstances it is important to stringently define the scope and the level of “ambitiousness” appropriate to the analysis at hand; for example, it is clear that one does not need the same sort of information for insurance purposes as for design purposes, or for the planning of protection schemes and the construction of emergency arrangements. Generally speaking, the risk picture must be filled in by mixing empirical techniques (i.e., statistics) with deductive reasoning and a creative imagination.

Different risk evaluation tools - even computer programs for risk analysis—can be very helpful. The hazard and operability study (HAZOP) and the failure mode and effect analysis (FMEA ) are commonly used methods for investigating hazards, especially in the chemical industry. The point of departure for the HAZOP method is the tracing of possible risk scenarios based on a set of guide words; for each scenario one has to identify probable causes and consequences. In the second stage, one tries to find means for reducing the probabilities or mitigating the consequences of those scenarios judged to be unacceptable. A review of the HAZOP method can be found in Charsley (1995). The FMEA method asks a series of “what if” questions for every possible risk component in order to thoroughly determine whatever failure modes may exist and then to identify the effects that they may have on system performance; such an analysis will be illustrated in the demonstration example (for a gas system) presented later in this article.

Fault trees and event trees and the modes of logical analysis proper to accident causation structures and probability reasoning are in no way specific to the analysis of hardware hazards, as they are general tools for system risk evaluations.

Tracing hardware hazards in an industrial plant

To identify possible hazards, information on construction and function can be sought from:

• actual equipment and plant

• substitutes and models

• drawings, electrical diagrams, piping and instrumentation (P/I) diagrams, etc.

• process descriptions

• control schemes

• operation modes and phases

• work orders, change orders, maintenance reports, etc.

By selecting and digesting such information, analysts form a picture of the risk object itself, its functions and its actual use. Where things are not yet constructed - or unavailable for inspection - important observations cannot be made and the evaluation must be based entirely on descriptions, intentions and plans. Such evaluation might seem rather poor, but in fact, most practical risk evaluations are made this way, either in order to seek authoritative approval for applications to undertake new construction, or to compare the relative safety of alternative design solutions. Real life processes will be consulted for the information not shown on the formal diagrams or described verbally by interview, and to verify that the information gathered from these sources is factual and represents actual conditions. These include the following:

• actual practice and culture

• additional failure mechanisms/construction details

• “sneak paths” (see below)

• common error causes

• risks from external sources/missiles

• particular exposures or consequences

• past incidents, accidents and near accidents.

Most of this additional information, especially sneak paths, is detectable only by creative, skilled observers with considerable experience, and some of the information would be almost impossible to trace with maps and diagrams. Sneak paths denote unintended and unforeseen interactions between systems, where the operation of one system affects the condition or operation of another system through other ways than the functional ones. This typically happens where functionally different parts are situated near each other, or (for example) a leaking substance drips on equipment beneath and causes a failure. Another mode of a sneak path’s action may involve the introduction of wrong substances or parts into a system by means of instruments or tools during operation or maintenance: the intended structures and their intended functions are changed through the sneak paths. By common-mode failures one means that certain conditions - like flooding, lightning or power failure - can disturb several systems at once, perhaps leading to unexpectedly large blackouts or accidents. Generally, one tries to avoid sneak-path effects and common-mode failures through proper layouts and introducing distance, insulation and diversity in working operations.

A Hazards Analysis Case: Gas Delivery from a Ship to a Tank

Figure 2 shows a system for delivery of gas from a transport ship to a storage tank. A leak could appear anywhere in this system: ship, transmission line, tank or output line; given the two tank reservoirs, a leak somewhere on the line could remain active for hours.

Figure 2. Transmission line for delivery of liquid gas from ship to storage tank

The most critical components of the system are the following:

• the storage tank

• the pipeline or hose between the tank and the ship

• other hoses, lines, valves and connections

• the safety valve on the storage tank

• the emergency shut-down valves ESD 1 and 2.

A storage tank with a large inventory of liquid gas is put at the top of this list, because it is difficult to stop a leak from a tank on short notice. The second item on the list - the connection to the ship - is critical because leaks in the pipe or hose and loose connections or couplings with worn gaskets, and variations among different ships, could release product. Flexible parts like hoses and bellows are more critical than rigid parts, and require regular maintenance and inspection. Safety devices like the pressure release valve on the top of the tank and the two emergency shut-down valves are critical, since they must be relied upon to reveal latent or developing failures.

Up to this point, the ranking of system components as to their importance with respect to reliability has been of a general nature only. Now, for analytical purposes, attention will be drawn to the particular functions of the system, the chief one of course being the movement of liquefied gas from the ship to the storage tank until the connected ship tank is empty. The overriding hazard is a gas leak, the possible contributory mechanisms being one of more of the following:

• leaking couplings or valves

• tank rupture

• rupture of pipe or hose

• tank breakdown.

Application of the FMEA method

The central idea of the FMEA approach, or “what if” analysis, is to record explicitly, for each component of the system, its failure modes, and for every failure to find the possible consequences to the system and to the environment. For standard components like a tank, pipe, valve, pump, flowmeter and so on, the failure modes follow general patterns. In the case of a valve, for instance, failure modes could include the following conditions:

• The valve cannot close on demand (there is reduced flow through an “open” valve).

• The valve leaks (there is residual flow through a “closed” valve).

• The valve cannot open on demand (the valve position oscillates).

For a pipeline, failure modes would consider items such as:

• a reduced flow

• a leak

• a flow stopped due to blockage

• a break in the line.

The effects of leaks seem obvious, but sometimes the most important effects may not be the first effects: what happens for example, if a valve is stuck in a half-open position? An on-off valve in the delivery line that does not open completely on demand will delay the tank filling process, a non-dangerous consequence. But if the “stuck half-open” condition arises at the same time that a closing demand is made, at a time when the tank is almost full, overfilling might result (unless the emergency shut-down valve is successfully activated). In a properly designed and operated system, the probability of both these valves being stuck simultaneously will be kept rather low.

Plainly a safety valve’s not operating on demand could mean disaster; in fact, one might justifiably state that latent failures are constantly threatening all safety devices. Pressure relief valves, for instance, can be defective due to corrosion, dirt or paint (typically due to bad maintenance), and in the case of liquid gas, such defects in combination with the temperature decrease at a gas leak could produce ice and thereby reduce or perhaps stop the flow of material through a safety valve. If a pressure relief valve does not operate on demand, pressure may build up in a tank or in connected systems of tanks, eventually causing other leaks or tank rupture.

For simplicity, instruments are not shown on figure 2; there will of course be instruments related to pressure, flow and temperature, which are essential parameters for monitoring the system state, relevant signals being transmitted to operator consoles or to a control room for control and monitoring purposes. Furthermore, there will be supply lines other than those intended for materials transport - for electricity, hydraulics and so forth - and extra safety devices. A comprehensive analysis must go through these systems as well and look for the failure modes and effects of these components also. In particular, the detective work on common-mode effects and sneak paths requires one to construct the integral picture of main system components, controls, instruments, supplies, operators, working schedules, maintenance and so on.

Examples of common-mode effects to consider in connection with gas systems are addressed by such questions as these:

• Are activation signals for delivery valves and emergency shut-down valves transmitted on a common line (cable, cabling channels)?

• Do two given valves share the same power line?

• Is maintenance performed by the same person according to a given schedule?

Even an excellently designed system with redundancy and independent power lines can suffer from inferior maintenance, where, for example, a valve and its back-up valve (the emergency shut-down valve in our case) have been left in a wrong state after a test. A prominent common-mode effect with an ammonia-handling system is the leak situation itself: a moderate leak can make all manual operations on plant components rather awkward - and delayed - due to the deployment of the required emergency protection.

Summary

The hardware components are very seldom the guilty parts in accident development; rather, there are root causes to be found in other links of the chain: wrong concepts, bad designs, maintenance errors, operator errors, management errors and so on. Several examples of the specific conditions and acts that may lead to failure development have already been given; a broad collection of such agents would take account of the following:

• collision

• corrosion, etching

• excessive loads

• failing support and aged or worn-out parts

• low-quality welding jobs

• missiles

• missing parts

• overheating or chilling

• vibration

• wrong construction material used.

Controlling the hardware hazards in a working environment requires the review of all possible causes and respect for the conditions that are found to be critical with the actual systems. The implications of this for the organization of risk management programmes are dealt with in other articles, but, as the foregoing list clearly indicates, the monitoring and control of hardware conditions can be necessary all the way back to the choice of concepts and designs for the selected systems and processes.

Back

This article examines the role of human factors in the accident causation process and reviews the various preventive measures (and their effectiveness) by which human error may be controlled, and their application to the accident causation model. Human error is an important contributing cause in at least 90 of all industrial accidents. While purely technical errors and uncontrollable physical circumstances may also contribute to accident causation, human error is the paramount source of failure. The increased sophistication and reliability of machinery means that the proportion of causes of accidents attributed to human error increases as the absolute number of accidents decreases. Human error is also the cause of many of those incidents that, although not resulting in injury or death, nevertheless result in considerable economic damage to a company. As such, it represents a major target for prevention, and it will become increasingly important. For effective safety management systems and risk identification programmes it is important to be able to identify the human component effectively through the use of general failure type analysis.

The Nature of Human Error

Human error can be viewed as the failure to reach a goal in the way that was planned, either from a local or wider perspective, due to unintentional or intentional behaviour. Those planned actions may fail to achieve the desired outcomes for the following four reasons:

1. Unintentional behaviour:

• The actions did not go as planned (slips).

• The action was not executed (lapses).

2. Intentional behaviour:

• The plan itself was inadequate (mistakes).

• There were deviations from the original plan (violations).

Deviations can be divided in three classes: skill-, rule- and knowledge-based errors.

1. At the skill-based level, behaviour is guided by pre-programmed action schemes. The tasks are routine and continuous, and feedback is usually lacking.
2. At the rule-based level, behaviour is guided by general rules. They are simple and can be applied many times in specific situations. The tasks consist of relatively frequent action sequences that start after a choice is made among rules or procedures. The user has a choice: the rules are not automatically activated, but are actively chosen.
3. Knowledge-based behaviour is shown in completely new situations where no rules are available and where creative and analytical thinking is required.

In some situations, the term human limitation would be more appropriate than human error. There also are limits to the ability to foresee the future behaviour of complex systems (Gleick 1987; Casti 1990).

Reason and Embrey’s model, the Generic Error Modelling System (GEMS) (Reason 1990), takes into account the error-correcting mechanisms on the skill-, rule- and knowledge-based levels. A basic assumption of GEMS is that day-to-day behaviour implies routine behaviour. Routine behaviour is checked regularly, but between these feedback loops, behaviour is completely automatic. Since the behaviour is skill-based, the errors are slips. When the feedback shows a deviation from the desired goal, rule-based correction is applied. The problem is diagnosed on the basis of available symptoms, and a correction rule is automatically applied when the situation is diagnosed. When the wrong rule is applied there is a mistake.

When the situation is completely unknown, knowledge-based rules are applied. The symptoms are examined in the light of knowledge about the system and its components. This analysis can lead to a possible solution the implementation of which constitutes a case of knowledge-based behaviour. (It is also possible that the problem cannot be solved in a given way and that further knowledge-based rules have to be applied.) All errors on this level are mistakes. Violations are committed when a certain rule is applied that is known to be inappropriate: the thinking of the worker may be that application of an alternative rule will be less time-consuming or is possibly more suitable for the present, probably exceptional, situation. The more malevolent class of violations involves sabotage, a subject that is not within the scope of this article. When organizations are attempting to eliminate human error, they should take into account whether the errors are on the skill-, rule- or knowledge-based level, as each level requires its own techniques (Groeneweg 1996).

Influencing Human Behaviour: An Overview

A comment often made with regard to a particular accident is, “Maybe the person did not realize it at the time, but if he or she had not acted in a certain way, the accident would not have happened.” Much of accident prevention is aimed at influencing the crucial bit of human behaviour alluded to in this remark. In many safety management systems, the solutions and policies suggested are aimed at directly influencing human behaviour. However, it is very uncommon that organizations assess how effective such methods really are. Psychologists have devoted much thought to how human behaviour can best be influenced. In this respect, the following six ways of exercising control over human error will be set forth, and an evaluation will be performed of the relative effectiveness of these methods in controlling human behaviour on a long-term basis (Wagenaar 1992). (See table 1.)

Table 1. Six ways to induce safe behaviour and assessment of their cost-effectiveness

Do not attempt to induce safe behaviour, but make the system “foolproof”

The first option is to do nothing to influence the behaviour of people but to design the workplace in such a way that whatever the employee does, it will not result in any kind of undesirable outcome. It must be acknowledged that, thanks to the influence of robotics and ergonomics, designers have considerably improved on the user-friendliness of workplace equipment. However, it is almost impossible to anticipate all the different kinds of behaviour that people may evince. Besides, workers often regard so-called foolproof designs as a challenge to “beat the system”. Finally, as designers are human themselves, even very carefully foolproof-designed equipment can have flaws (e.g., Petroski 1992). The additional benefit of this approach relative to existing hazard levels is marginal, and in any event initial design and installation costs may increase exponentially.

Tell those involved what to do

Another option is to instruct all workers about every single activity in order to bring their behaviour fully under the control of management. This will require an extensive and not very practical task inventory and instruction control system. As all behaviour is de-automated it will to a large extent eliminate slips and lapses until the instructions become part of the routine and the effect fades away.

It does not help very much to tell people that what they do is dangerous - most people know that very well - because they will make their own choices concerning risk regardless of attempts to persuade them otherwise. Their motivation to do so will be to make their work easier, to save time, to challenge authority and perhaps to enhance their own career prospects or claim some financial reward. Instructing people is relatively cheap, and most organizations have instruction sessions before the start of a job. But beyond such an instruction system the effectiveness of this approach is assessed to be low.

Reward and punish

Although reward and punishment schedules are powerful and very popular means for controlling human behaviour, they are not without problems. Reward works best only if the recipient perceives the reward to be of value at the time of receipt. Punishing behaviour that is beyond an employee’s control (a slip) will not be effective. For example, it is more cost-effective to improve traffic safety by changing the conditions underlying traffic behaviour than by public campaigns or punishment and reward programmes. Even an increase in the chances of being “caught” will not necessarily change a person’s behaviour, as the opportunities for violating a rule are still there, as is the challenge of successful violation. If the situations in which people work invite this kind of violation, people will automatically choose the undesired behaviour no matter how they are punished or rewarded. The effectiveness of this approach is rated as of medium quality, as it usually is of short-term effectiveness.

Increase motivation and awareness

Sometimes it is believed that people cause accidents because they lack motivation or are unaware of danger. This assumption is false, as studies have shown (e.g., Wagenaar and Groeneweg 1987). Furthermore, even if workers are capable of judging danger accurately, they do not necessarily act accordingly (Kruysse 1993). Accidents happen even to people with the best motivation and the highest degree of safety awareness. There are effective methods for improving motivation and awareness which are discussed below under “Change the environment”. This option is a delicate one: in contrast with the difficulty to further motivate people it is almost too easy to de-motivate employees to the extent that even sabotage is considered.

The effects of motivation enhancement programmes are positive only when coupled with behaviour modification techniques such as employee involvement.

Select trained personnel

The first reaction to an accident is often that those involved must have been incompetent. With hindsight, the accident scenarios appear straightforward and easily preventable to someone sufficiently intelligent and properly trained, but this appearance is a deceptive one: in actual fact the employees involved could not possibly have foreseen the accident. Therefore, better training and selection will not have the desirable effect. A base level of training is however a prerequisite for safe operations. The tendency in some industries to replace experienced personnel with inexperienced and inadequately trained people is to be discouraged, as increasingly complex situations call for rule- and knowledge-based thinking that requires a level of experience that such lower-cost personnel often do not possess.

A negative side-effect of instructing people very well and selecting only the highest-classified people is that behaviour can become automatic and slips occur. Selection is expensive, while the effect is not more than medium.

Change the environment

Most behaviour occurs as a reaction to factors in the working environment: work schedules, plans, and management expectations and demands. A change in the environment results in different behaviour. Before the working environment can be effectively changed, several problems must be solved. First, the environmental factors that cause the unwanted behaviour must be identified. Second, these factors must be controlled. Third, management must allow discussion about their role in creating the adverse working environment.

It is more practical to influence behaviour through creating the proper working environment. The problems that should be solved before this solution can be put into practice are (1) that it must be known which environmental factors cause the unwanted behaviour, (2) that these factors must be controlled and (3) that previous management decisions must be considered (Wagenaar 1992; Groeneweg 1996). All these conditions can indeed be met, as will be argued in the remainder of this article. The effectiveness of behaviour modification can be high, even though a change of environment may be quite costly.

The Accident Causation Model

In order to get more insight into the controllable parts of the accident causation process, an understanding of the possible feedback loops in a safety information system is necessary. In figure 1, the complete structure of a safety information system is presented that can form the basis of managerial control of human error. It is an adapted version of the system presented by Reason et al. (1989).

Figure 1. A safety information system 

Accident investigation

When accidents are investigated, substantial reports are produced and decision-makers receive information about the human error component of the accident. Fortunately, this is becoming more and more obsolete in many companies. It is more effective to analyse the “operational disturbances” that precede the accidents and incidents. If an accident is described as an operational disturbance followed by its consequences, then sliding from the road is an operational disturbance and getting killed because the driver did not wear a safety belt is an accident. Barriers may have been placed between the operational disturbance and the accident, but they failed or were breached or circumvented.

Unsafe act auditing

A wrong act committed by an employee is called a “substandard act” and not an “unsafe act” in this article: the notion of “unsafe” seems to limit the applicability of the term to safety, whereas it can also be applied, for example, to environmental problems. Substandard acts are sometimes recorded, but detailed information as to which slips, mistakes and violations were performed and why they were performed is hardly ever fed back to higher management levels.

Investigating the employee’s state of mind

Before a substandard act is committed, the person involved was in a certain state of mind. If these psychological precursors, like being in a state of haste or feeling sad, could be adequately controlled, people would not find themselves in a state of mind in which they would commit a substandard act. Since these states of mind cannot be effectively controlled, such precursors are regarded as “black box” material (figure 1).

General failure types

The GFT (general failure type) box in figure 1 represents the generating mechanisms of an accident - the causes of substandard acts and situations. Because these substandard acts cannot be controlled directly, it is necessary to change the working environment. The working environment is determined by 11 such mechanisms (table 2). (In the Netherlands the abbreviation GFT already exists in a completely different context, and has to do with ecologically sound waste disposal, and to avoid confusion another term is used: basic risk factors (BRFs) (Roggeveen 1994).)

Table 2. General failure types and their definitions

The GFT box is preceded by a “decision-maker’s” box, as these people determine to a large extent how well a GFT is managed. It is management’s task to control the working environment by managing the 11 GFTs, thereby indirectly controlling the occurrence of human error.

All these GFTs can contribute to accidents in subtle ways by allowing undesirable combinations of situations and actions to come together, by increasing the chance that certain persons will commit substandard acts and by failing to provide the means to interrupt accident sequences already in progress.

There are two GFTs that require some further explanation: maintenance management and defences.

Maintenance management (MM)

Since maintenance management is a combination of factors that can be found in other GFTs, it is not, strictly speaking, a separate GFT: this type of management is not fundamentally different from other management functions. It may be treated as a separate issue because maintenance plays an important role in so many accident scenarios and because most organizations have a separate maintenance function.

Defences (DF)

The category of defences is also not a true GFT, as it is not related to the accident causation process itself. This GFT is related to what happens after an operational disturbance. It does not generate either psychological states of mind or substandard acts by itself. It is a reaction that follows a failure due to the action of one or more GFTs. While it is indeed true that a safety management system should focus on the controllable parts of the accident causation chain before and not after the unwanted incident, nevertheless the notion of defences can be used to describe the perceived effectiveness of safety barriers after a disturbance has occurred and to show how they failed to prevent the actual accident.

Managers need a structure that will enable them to relate identified problems to preventive actions. Measures taken at the levels of safety barriers or substandard acts are still necessary, although these measures can never be completely successful. To trust “last line” barriers is to trust factors that are to a large extent out of management control. Management should not attempt to manage such uncontrollable external devices, but instead must try to make their organizations inherently safer at every level.

Measuring the Level of Control over Human Error

Ascertaining the presence of the GFTs in an organization will enable accident investigators to identify the weak and strong points in the organization. Given such knowledge, one can analyse accidents and eliminate or mitigate their causes and identify the structural weaknesses within a company and fix them before they in fact contribute to an accident.

Accident investigation

The task of an accident analyst is to identify contributing factors and to categorize them. The number of times a contributing factor is identified and categorized in terms of a GFT indicates the extent to which this GFT is present. This is often done by means of a checklist or computer analysis program.

It is possible and desirable to combine profiles from different but similar types of accidents. Conclusions based upon an accumulation of accident investigations in a relatively short time are far more reliable than those drawn from a study in which the accident profile is based upon a single event. An example of such a combined profile is presented in figure 2, which shows data relating to four occurrences of one type of accident.

Figure 2. Profile of an accident type

Some of the GFTs - design, procedures and incompatible goals - score consistently high in all four particular accidents. This means that in each accident, factors have been identified that were related to these GFTs. With respect to the profile of accident 1, design is a problem. Housekeeping, although a major problem area in accident 1, is only a minor problem if more than the first accident is analysed. It is suggested that about ten similar types of accidents be investigated and combined in a profile before far-reaching and possibly expensive corrective measures are taken. This way, the identification of the contributing factors and subsequent categorization of these factors can be done in a very reliable way (Van der Schrier, Groeneweg and van Amerongen 1994).

Identifying the GFTs within an organization pro-actively

It is possible to quantify the presence of GFTs pro-actively, regardless of the occurrence of accidents or incidents. This is done by looking for indicators of the presence of that GFT. The indicator used for this purpose is the answer to a straightforward yes or no question. If answered in the undesired way, it is an indication that something is not functioning properly. An example of an indicator question is: “In the past three months, did you go to a meeting that turned out to be cancelled?” If the employee answers the question in the affirmative, it does not necessarily signify danger, but it is indicative of a deficiency in one of the GFTs—communication. However, if enough questions that test for a given GFT are answered in a way that indicates an undesirable trend, it is a signal to management that it does not have sufficient control of that GFT.

To construct a system safety profile (SSP), 20 questions for each of the 11 GFTs have to be answered. Each GFT is assigned a score ranging from 0 (low level of control) to 100 (high level of control). The score is calculated relative to the industry average in a certain geographical area. An example of this scoring procedure is presented in the box. 

The indicators are pseudo-randomly drawn from a database with a few hundred questions. No two subsequent checklists have questions in common, and questions are drawn in such a way that each aspect of the GFT is covered. Failing hardware could, for instance, be the result of either absent equipment or defective equipment. Both aspects should be covered in the checklist. The answering distributions of all questions are known, and checklists are balanced for equal difficulty.

It is possible to compare scores obtained with different checklists, as well as those obtained for different organizations or departments or the same units over a period of time. Extensive validation tests have been done to ensure that all questions in the database have validity and that they are all indicative of the GFT to be measured. Higher scores indicate a higher level of control - that is, more questions have been answered in the “desired” way. A score of 70 indicates that this organization is ranked among the best 30 (i.e., 100 minus 70) of comparable organizations in this kind of industry. Although a score of 100 does not necessarily mean that this organization has total control over a GFT, it does means that with regard to this GFT the organization is the best in the industry.

An example of an SSP is shown in figure 3. The weak areas of Organization 1, as exemplified by the bars in the chart, are procedures, incompatible goals, and error enforcing conditions, as they score below the industry average as shown by the dark grey area. The scores on housekeeping, hardware and defences are very good in Organization 1. On the surface, this well-equipped and tidy organization with all safety devices in place appears to be a safe place to work. Organization 2 scores exactly at the industry average. There are no major deficiencies, and although the scores on hardware, housekeeping and defences are lower, this company manages (on the average) the human error component in accidents better than Organization 1. According to the accident causation model, Organization 2 is safer than Organization 1, although this would not necessarily be apparent in comparing the organizations in “traditional” audits.

Figure 3. Example of a system safety profile

If these organizations had to decide where to allocate their limited resources, the four areas with below average GFTs would have priority. However, one cannot conclude that, since the other GFT scores are so favourable, resources may be safely withdrawn from their upkeep, since these resources are what have most probably kept them at so high a level in the first place.

Conclusions

This article has touched upon the subject of human error and accident prevention. The overview of the literature regarding control of the human error component in accidents yielded a set of six ways by which one can try to influence behaviour. Only one, restructuring the environment or modifying behaviour in order to reduce the number of situations in which people are liable to commit an error, has a reasonably favourable effect in a well-developed industrial organization where many other attempts have already been made. It will take courage on the part of management to recognize that these adverse situations exist and to mobilize the resources that are needed to effect a change in the company. The other five options do not represent helpful alternatives, as they will have little or no effect and will be quite costly.

“Controlling the controllable” is the key principle supporting the approach presented in this article. The GFTs must be discovered, attacked and eliminated. The 11 GFTs are mechanisms that have proven to be part of the accident causation process. Ten of them are aimed at preventing operational disturbances and one (defences) is aimed at the prevention of the operational disturbance’s turning into an accident. Eliminating the impact of the GFTs has a direct bearing upon the abatement of contributing causes of accidents. The questions in the checklists are aimed at measuring the “health state” of a given GFT, from both a general and a safety point of view. Safety is viewed as an integrated part of normal operations: doing the job the way it should be done. This view is in accordance with the recent “quality oriented” management approaches. The availability of policies, procedures and management tools is not the chief concern of safety management: the question is rather whether these methods are actually used, understood and adhered to.

The approach described in this article concentrates upon systemic factors and the way in which management decisions can be translated into unsafe conditions at the workplace, in contrast to the conventional belief that attention should be directed towards the individual workers who perform unsafe acts, their attitudes, motivations and perceptions of risk.

An indication of the level of control your organization has over the GFT “Communication”

In this box a list of 20 questions is presented. The questions in this list have been answered by employees of more than 250 organizations in Western Europe. These organizations were operating in different fields, ranging from chemical companies to refineries and construction companies. Normally, these questions would be tailor-made for each branch. This list serves as an example only to show how the tool works for one of the GFTs. Only those questions have been selected that have proved to be so “general” that they are applicable in at least  80% of the industries.

In “real life” employees would not only have to answer the questions (anonymously), they would also have to motivate their answers. It is not sufficient to answer “Yes” on, for example, the indicator “Did you have to work in the past 4 weeks with an outdated procedure?” The employee would have to indicate which procedure it was and under which conditions it had to be applied. This motivation serves two goals: it increases the reliability of the answers and it provides management with information it can act upon.

Caution is also necessary when interpreting the percentile score: in a real measurement, each organization would be matched against a representative sample of branch-related organizations for each of the 11 GFTs. The distribution of percentiles is from May 1995, and this distribution does change slightly over time.

How to measure the “level of control”

Answer all 20 indicators with your own situation in mind and beware of the time limits in the questions. Some of the questions might not be applicable for your situation; answer them with “n.a.” It might be impossible for you to answer some questions; answer them with a question mark“?”.

After you have answered all questions, compare your answers with the reference answers. You get a point for each “correctly” answered question.

Add the number of points together. Calculate the percentage of correctly answered questions by dividing the number of points by the number of questions you have answered with either “Yes” or “No”. The “n.a.” and “?” answers are not taken into account. The result is a percentage between 0 and 100.

The measurement can be made more reliable by having more people answering the questions and by averaging their scores over the levels or functions in the organization or comparable departments.

Twenty questions about the GFT “Communication”

Possible answers to the questions: Y = Yes; N = No; n.a.  = not applicable; ?  = don’t know.

1. In the past 4 weeks has the telephone directory provided you with incorrect or insufficient information?
2. In the past 2 weeks has your telephone conversation been interrupted due to a malfunctioning of the telephone system?
3. Have you received mail in the past week that was not relevant to you?
4. Has there been an internal or external audit in the past 9 months of your office paper trail?
5. Was more than 20% of the information you received in the past 4 weeks labelled “urgent”?
6. Did you have to work in the past 4 weeks with a procedure that was difficult to read (e.g., phrasing or language problems)?
7. Have you gone to a meeting in the past 4 weeks that turned out not to be held at all?
8. Has there been a day in the past 4 weeks that you had five or more meetings?
9. Is there a “suggestion box” in your organization?
10. Have you been asked to discuss a matter in the past 3 months that later turned out to be already decided upon?
11. Have you sent any information in the past 4 weeks that was never received?
12. Have you received information in the past 6 months about changes in policies or procedures more than a month after it had been put into effect?
13. Have the minutes of the last three safety meetings been sent to your management?
14. Has “office” management stayed at least 4 hours at the location when making the last site visit?
15. Did you have to work in the past 4 weeks with procedures with conflicting information?
16. Have you received within 3 days feedback on requests for information in the past 4 weeks?
17. Do people in your organization speak different languages or dialects (different mother tongue)?
18. Was more than 80% of the feedback you received (or gave) from management in the past 6 months of a “negative nature”?
19. Are there parts of the location/workplace where it is difficult to understand each other due to extreme noise levels?
20. In the past 4 weeks, have tools and/or equipment been delivered that not had been ordered?

Reference answers:

1 = N; 2 = N; 3 = N; 4 = Y; 5 = N; 6 = N; 7 = N; 8 = N; 9 = N; 10 = N; 11 = N; 12 = N; 13 = Y; 14 = N; 15 = N; 16 = Y; 17 = N; 18 = N; 19 = Y; 20 = N.

Scoring GFT “Communication”

Percent score = (a/b) x 100

where a = no. of questions answered correctly

where b = no. of questions answered “Y” or “N”.

Back