This article addresses “machine” hazards, those which are specific to the appurtenances and hardware used in the industrial processes associated with pressure vessels, processing equipment, powerful machines and other intrinsically risky operations. This article does not address worker hazards, which implicate the actions and behaviour of individuals, such as slipping on working surfaces, falling from elevations and hazards from using ordinary tools. This article focuses on machine hazards, which are characteristic of an industrial job environment. Since these hazards threaten anyone present and may even be a threat to neighbours and the external environment, the analysis methods and the means for prevention and control are similar to the methods used to deal with risks to the environment from industrial activities.

Machine Hazards

Good quality hardware is very reliable, and most failures are caused by secondary effects like fire, corrosion, misuse and so on. Nevertheless, hardware may be highlighted in certain accidents, because a failing hardware component is often the most conspicuous or visibly prominent link of the chain of events. Although the term hardware is used in a broad sense, illustrative examples of hardware failures and their immediate “surroundings” in accident causation have been taken from industrial workplaces. Typical candidates for investigation of “machine” hazards include but are not limited to the following:

• pressure vessels and pipes

• motors, engines, turbines and other rotating machines

• chemical and nuclear reactors

• scaffolding, bridges, etc.

• lasers and other energy radiators

• cutting and drilling machinery, etc.

• welding equipment.

Effects of Energy

Hardware hazards can include wrong use, construction errors or frequent overload, and accordingly their analysis and mitigation or prevention can follow rather different directions. However, physical and chemical energy forms that elude human control often exist at the heart of hardware hazards. Therefore, one very general method to identify hardware hazards is to look for the energies that are normally controlled with the actual piece of equipment or machinery, such as a pressure vessel containing ammonia or chlorine. Other methods use the purpose or intended function of the actual hardware as a starting point and then look for the probable effects of malfunctions and failures. For example, a bridge failing to fulfil its primary function will expose subjects on the bridge to the risk of falling down; other effects of the collapse of a bridge will be the secondary ones of falling items, either structural parts of the bridge or objects situated on the bridge. Further down the chain of consequences, there may be derived effects related to functions in other parts of the system that were dependent on the bridge performing its function properly, such as the interruption of emergency response vehicular traffic to another incident.

Besides the concepts of “controlled energy” and “intended function”, dangerous substances must be addressed by asking questions such as, “How could agent X be released from vessels, tanks or pipe systems and how could agent Y be produced?” (either or both may be hazardous). Agent X might be a pressurized gas or a solvent, and agent Y might be an extremely toxic dioxin whose formation is favoured by the “right” temperatures in some chemical processes, or it could be produced by rapid oxidation, as the result of a fire. However, the possible hazards add up to much more than just the risks of dangerous substances. Conditions or influences might exist which allow the presence of a particular item of hardware to lead to harmful consequences to humans.

Industrial Work Environment

Machine hazards also involve load or stress factors that may be dangerous in the long run, such as the following:

• extreme working temperatures

• high intensities of light, noise or other stimuli

• inferior air quality

• extreme job demands or workloads.

These hazards can be recognized and precautions taken because the dangerous conditions are already there. They do not depend on some structural change in the hardware to come about and work a harmful result, or on some special event to effect damage or injury. Long-term hazards also have specific sources in the working environment, but they must be identified and evaluated through observing workers and the jobs, instead of just analysing hardware construction and functions.

Dangerous hardware or machine hazards are usually exceptional and rather seldom found in a sound working environment, but cannot be avoided completely. Several types of uncontrolled energy, such as the following risk agents, can be the immediate consequence of hardware malfunction:

• harmful releases of dangerous gas, liquids, dusts or other substances

• fire and explosion

• high voltages

• falling objects, missiles, etc.

• electric and magnetic fields

• cutting, trapping, etc.

• displacement of oxygen

• nuclear radiation, x rays and laser light

• flooding or drowning

• jets of hot liquid or steam.

Risk Agents

Moving objects. Falling and flying objects, liquid flows and jets of liquid or steam, such as listed, are often the first external consequences of hardware or equipment failure, and they account for a large proportion of accidents.

Chemical substances. Chemical hazards also contribute to worker accidents as well as affecting the environment and the public. The Seveso and Bhopal accidents involved chemical releases which affected numerous members of the public, and many industrial fires and explosions release chemicals and fumes to the atmosphere. Traffic accidents involving gasoline or chemical delivery trucks or other dangerous goods transports, unite two risk agents - moving objects and chemical substances.

Electromagnetic energy. Electric and magnetic fields, x rays and gamma rays are all manifestations of electromagnetism, but are often treated separately as they are encountered under rather different circumstances. However, the dangers of electromagnetism have some general traits: fields and radiation penetrate human bodies instead of just making contact on the application area, and they cannot be sensed directly, although very large intensities cause heating of the affected body parts. Magnetic fields are created by the flow of electric current, and intense magnetic fields are to be found in the vicinity of large electric motors, electric arc welding equipment, electrolysis apparatus, metal works and so forth. Electric fields accompany electric tension, and even the ordinary mains voltages of 200 to 300 volts cause the accumulation of dirt over several years, the visible sign of the field’s existence, an effect also known in connection with high-tension electrical lines, TV picture tubes, computer monitors and so on.

Electromagnetic fields are mostly found rather close to their sources, but electromagnetic radiation is a long-distance traveller, as radar and radio waves exemplify. Electromagnetic radiation is scattered, reflected and damped as it passes through space and meets intervening objects, surfaces, different substances and atmospheres, and the like; its intensity is therefore reduced in several ways.

The general character of the electromagnetic (EM) hazard sources are:

• Instruments are needed to detect the presence of EM fields or EM radiation.

• EM does not leave primary traces in the form of “contamination”.

• Dangerous effects are usually delayed or long-term, but immediate burns are caused in severe cases.

• X rays and gamma rays are damped, but not stopped, by lead and other heavy elements.

• Magnetic fields and x rays are stopped immediately when the source is de-energized or the equipment turned off.

• Electric fields can survive for long periods after turning the generating systems off.

• Gamma rays come from nuclear processes, and these radiation sources cannot be turned off as can many EM sources.

Nuclear radiation. The hazards associated with nuclear radiation are of special concern to workers in nuclear power plants and in plants working with nuclear materials such as fuel manufacturing and the reprocessing, transport and storage of radioactive matter. Nuclear radiation sources are also used in medicine and by some industries for measurement and control. One most common usage is in fire alarms/smoke detectors, which use an alpha-particle emitter like americium to monitor the atmosphere.

Nuclear hazards are principally centred around five factors:

• gamma rays

• neutrons

• beta particles (electrons)

• alpha particles (helium nuclei)

• contamination.

The hazards arise from the radioactive processes in nuclear fission and the decaying of radioactive materials. This sort of radiation is emitted from reactor processes, reactor fuel, reactor moderator material, from the gaseous fission products that may be developed, and from certain construction materials that become activated by exposure to radioactive emissions arising from reactor operation.

Other risk agents. Other classes of risk agents that release or emit energy include:

• UV radiance and laser light

• infrasound

• high-intensity sound

• vibration.

Triggering the Hardware Hazards

Both sudden and gradual shifts from the controlled - or “safe” - condition to one with increased danger can come about through the following circumstances, which can be controlled through appropriate organizational means such as user experience, education, skills, surveillance and equipment testing:

• wear and overloads

• external impact (fire or impact)

• ageing and failure

• wrong supply (energy, raw materials)

• insufficient maintenance and repair

• control or process error

• misuse or misapplication

• hardware breakdown

• barrier malfunction.

Since proper operations cannot reliably compensate for improper design and installation, it is important to consider the entire process, from selection and design through installation, use, maintenance and testing, in order to evaluate the actual state and conditions of the hardware item.

Hazard Case: The Pressurized Gas Tank

Gas can be contained in suitable vessels for storage or transport, like the gas and oxygen cylinders used by welders. Often, gas is handled at high pressure, affording a great increase in the storing capacity, but with higher accident risk. The key accidental phenomenon in pressurized gas storage is the sudden creation of a hole in the tank, with these results:

• the confinement function of the tank ceases

• the confined gas gets immediate access to the surrounding atmosphere.

The development of such an accident depends on these factors:

• the type and amount of gas in the tank

• the situation of the hole in relation to the tank’s contents

• the initial size and subsequent growth rate of the hole

• the temperature and pressure of the gas and the equipment

• the conditions in the immediate environment (sources of ignition, people, etc.).

The tank contents can be released almost immediately or over a period of time, and result in different scenarios, from the burst of free gas from a ruptured tank, to moderate and rather slow releases from small punctures.

The behaviour of various gases in the case of leakage

When developing release calculation models, it is most important to determine the following conditions affecting the system’s potential behaviour:

• the gas phase behind the hole (gaseous or liquid?)

• temperature and wind conditions

• the possible entry of other substances into the system or their possible presence in its surroundings

• barriers and other obstacles.

The exact calculations pertaining to a release process where liquefied gas escapes from a hole as a jet and then evaporates (or alternatively, first becomes a mist of droplets) are difficult. The specification of the later dispersion of the resultant clouds is also a difficult problem. Consideration must be given to the movements and dispersion of gas releases, whether the gas forms visible or invisible clouds and whether the gas rises or stays at ground level.

While hydrogen is a light gas compared to any atmosphere, ammonia gas (NH₃, with a molecular weight of 17.0) will rise in an ordinary air-like, oxygen-nitrogen atmosphere at the same temperature and pressure. Chlorine (Cl₂, with a molecular weight of 70.9) and butane (C₄H₁₀, mol. wt.58) are examples of chemicals whose gas phases are denser than air, even at ambient temperature. Acetylene (C₂H₂, mol. wt. 26.0) has a density of about 0.90g/l, approaching that of air (1.0g/l), which means that in a working environment, leaking welding gas will not have a pronounced tendency to float upwards or to sink downwards; therefore it can mix easily with the atmosphere.

But ammonia released from a pressure vessel as a liquid will at first cool as a consequence of its evaporation, and may then escape via several steps:

• Pressurized, liquid ammonia emanates from the hole in tank as jet or cloud.

• Seas of liquid ammonia can be formed on the nearest surfaces.

• The ammonia evaporates, thereby cooling itself and the near environment.

• Ammonia gas gradually exchanges heat with surroundings and equilibrates with ambient temperatures.

Even a cloud of light gas may not rise immediately from a liquid gas release; it may first form a fog - a cloud of droplets - and stay near the ground. The gas cloud’s movement and gradual mixing/dilution with the surrounding atmosphere depends on weather parameters and on the surrounding environment—enclosed area, open area, houses, traffic, presence of the public, workers and so on.

Tank Failure

Consequences of tank breakdown may involve fire and explosion, asphyxiation, poisoning and choking, as experience shows with gas production and gas handling systems (propane, methane, nitrogen, hydrogen, etc.), with ammonia or chlorine tanks, and with gas welding (using acetylene and oxygen). What actually initiates the formation of a hole in a tank has a strong influence on the hole “behaviour” - which in its turn influences the outflow of gas - and is crucial for the effectiveness of prevention efforts. A pressure vessel is designed and built to withstand certain conditions of use and environmental impact, and for handling a certain gas, or perhaps a choice of gases. The actual capabilities of a tank depend on its shape, materials, welding, protection, use and climate; therefore, evaluation of its adequacy as a container for dangerous gas must consider designer’s specifications, the tank’s history, inspections and tests. Critical areas include the welding seams used on most pressure vessels; the points where appurtenances such as inlets, outlets, supports and instruments are connected to the vessel; the flat ends of cylindrical tanks like railway tanks; and other aspects of even less optimal geometric shapes.

Welding seams are investigated visually, by x rays or by destructive test of samples, as these may reveal local defects, say, in the form of reduced strength that might endanger the overall strength of the vessel, or even be a triggering point for acute tank failure.

Tank strength is affected by the history of tank use - first of all by the normal wearing processes and the scratches and corrosion attacks typical of the particular industry and of the application. Other historical parameters of particular interest include:

• casual overpressure

• extreme heating or cooling (internal or external)

• mechanical impacts

• vibrations and stress

• substances that have been stored in or have passed through the tank

• substances used during cleansing, maintenance and repair.

The construction material - steel plate, aluminium plate, concrete for non-pressurized applications, and so on - can undergo deterioration from these influences in ways that are not always possible to check without overloading or destroying the equipment during testing.

Accident Case: Flixborough

The explosion of a large cloud of cyclohexane in Flixborough (UK) in 1974, which killed 28 persons and caused extensive plant damage, serves as a very instructive case. The triggering event was the breakdown of a temporary pipe serving as a substitute in a reactor unit. The accident was “caused” by a piece of hardware breaking down, but on closer investigation it was revealed that the breakdown followed from overload, and that the temporary construction was in fact inadequate for its intended use. After two months’ service, the pipe was exposed to bending forces due to a slight pressure rise of the 10-bar (10⁶ Pa) cyclohexane content at about 150°C. The two bellows between the pipe and the nearby reactors broke and 30 to 50 tonnes of cyclohexane was released and soon ignited, probably by a furnace some distance from the leak. (See figure 1.) A very readable account of the case is found in Kletz (1988).

Figure 1. Temporary connection between tanks at Flixborough

Hazard Analysis

The methods that have been developed to find the risks that may be relevant to a piece of equipment, to a chemical process or to a certain operation are referred to as “hazard analysis”. These methods ask questions such as: “What may possibly go wrong?” “Could it be serious?” and “What can be done about it?” Different methods of conducting the analyses are often combined to achieve a reasonable coverage, but no such set can do more than guide or assist a clever team of analysts in their determinations. The main difficulties with hazard analysis are as follows:

• availability of relevant data

• limitations of models and calculations

• new and unfamiliar materials, constructions and processes

• system complexity

• limitations on human imagination

• limitations on practical tests.

To produce usable risk evaluations under these circumstances it is important to stringently define the scope and the level of “ambitiousness” appropriate to the analysis at hand; for example, it is clear that one does not need the same sort of information for insurance purposes as for design purposes, or for the planning of protection schemes and the construction of emergency arrangements. Generally speaking, the risk picture must be filled in by mixing empirical techniques (i.e., statistics) with deductive reasoning and a creative imagination.

Different risk evaluation tools - even computer programs for risk analysis—can be very helpful. The hazard and operability study (HAZOP) and the failure mode and effect analysis (FMEA ) are commonly used methods for investigating hazards, especially in the chemical industry. The point of departure for the HAZOP method is the tracing of possible risk scenarios based on a set of guide words; for each scenario one has to identify probable causes and consequences. In the second stage, one tries to find means for reducing the probabilities or mitigating the consequences of those scenarios judged to be unacceptable. A review of the HAZOP method can be found in Charsley (1995). The FMEA method asks a series of “what if” questions for every possible risk component in order to thoroughly determine whatever failure modes may exist and then to identify the effects that they may have on system performance; such an analysis will be illustrated in the demonstration example (for a gas system) presented later in this article.

Fault trees and event trees and the modes of logical analysis proper to accident causation structures and probability reasoning are in no way specific to the analysis of hardware hazards, as they are general tools for system risk evaluations.

Tracing hardware hazards in an industrial plant

To identify possible hazards, information on construction and function can be sought from:

• actual equipment and plant

• substitutes and models

• drawings, electrical diagrams, piping and instrumentation (P/I) diagrams, etc.

• process descriptions

• control schemes

• operation modes and phases

• work orders, change orders, maintenance reports, etc.

By selecting and digesting such information, analysts form a picture of the risk object itself, its functions and its actual use. Where things are not yet constructed - or unavailable for inspection - important observations cannot be made and the evaluation must be based entirely on descriptions, intentions and plans. Such evaluation might seem rather poor, but in fact, most practical risk evaluations are made this way, either in order to seek authoritative approval for applications to undertake new construction, or to compare the relative safety of alternative design solutions. Real life processes will be consulted for the information not shown on the formal diagrams or described verbally by interview, and to verify that the information gathered from these sources is factual and represents actual conditions. These include the following:

• actual practice and culture

• additional failure mechanisms/construction details

• “sneak paths” (see below)

• common error causes

• risks from external sources/missiles

• particular exposures or consequences

• past incidents, accidents and near accidents.

Most of this additional information, especially sneak paths, is detectable only by creative, skilled observers with considerable experience, and some of the information would be almost impossible to trace with maps and diagrams. Sneak paths denote unintended and unforeseen interactions between systems, where the operation of one system affects the condition or operation of another system through other ways than the functional ones. This typically happens where functionally different parts are situated near each other, or (for example) a leaking substance drips on equipment beneath and causes a failure. Another mode of a sneak path’s action may involve the introduction of wrong substances or parts into a system by means of instruments or tools during operation or maintenance: the intended structures and their intended functions are changed through the sneak paths. By common-mode failures one means that certain conditions - like flooding, lightning or power failure - can disturb several systems at once, perhaps leading to unexpectedly large blackouts or accidents. Generally, one tries to avoid sneak-path effects and common-mode failures through proper layouts and introducing distance, insulation and diversity in working operations.

A Hazards Analysis Case: Gas Delivery from a Ship to a Tank

Figure 2 shows a system for delivery of gas from a transport ship to a storage tank. A leak could appear anywhere in this system: ship, transmission line, tank or output line; given the two tank reservoirs, a leak somewhere on the line could remain active for hours.

Figure 2. Transmission line for delivery of liquid gas from ship to storage tank

The most critical components of the system are the following:

• the storage tank

• the pipeline or hose between the tank and the ship

• other hoses, lines, valves and connections

• the safety valve on the storage tank

• the emergency shut-down valves ESD 1 and 2.

A storage tank with a large inventory of liquid gas is put at the top of this list, because it is difficult to stop a leak from a tank on short notice. The second item on the list - the connection to the ship - is critical because leaks in the pipe or hose and loose connections or couplings with worn gaskets, and variations among different ships, could release product. Flexible parts like hoses and bellows are more critical than rigid parts, and require regular maintenance and inspection. Safety devices like the pressure release valve on the top of the tank and the two emergency shut-down valves are critical, since they must be relied upon to reveal latent or developing failures.

Up to this point, the ranking of system components as to their importance with respect to reliability has been of a general nature only. Now, for analytical purposes, attention will be drawn to the particular functions of the system, the chief one of course being the movement of liquefied gas from the ship to the storage tank until the connected ship tank is empty. The overriding hazard is a gas leak, the possible contributory mechanisms being one of more of the following:

• leaking couplings or valves

• tank rupture

• rupture of pipe or hose

• tank breakdown.

Application of the FMEA method

The central idea of the FMEA approach, or “what if” analysis, is to record explicitly, for each component of the system, its failure modes, and for every failure to find the possible consequences to the system and to the environment. For standard components like a tank, pipe, valve, pump, flowmeter and so on, the failure modes follow general patterns. In the case of a valve, for instance, failure modes could include the following conditions:

• The valve cannot close on demand (there is reduced flow through an “open” valve).

• The valve leaks (there is residual flow through a “closed” valve).

• The valve cannot open on demand (the valve position oscillates).

For a pipeline, failure modes would consider items such as:

• a reduced flow

• a leak

• a flow stopped due to blockage

• a break in the line.

The effects of leaks seem obvious, but sometimes the most important effects may not be the first effects: what happens for example, if a valve is stuck in a half-open position? An on-off valve in the delivery line that does not open completely on demand will delay the tank filling process, a non-dangerous consequence. But if the “stuck half-open” condition arises at the same time that a closing demand is made, at a time when the tank is almost full, overfilling might result (unless the emergency shut-down valve is successfully activated). In a properly designed and operated system, the probability of both these valves being stuck simultaneously will be kept rather low.

Plainly a safety valve’s not operating on demand could mean disaster; in fact, one might justifiably state that latent failures are constantly threatening all safety devices. Pressure relief valves, for instance, can be defective due to corrosion, dirt or paint (typically due to bad maintenance), and in the case of liquid gas, such defects in combination with the temperature decrease at a gas leak could produce ice and thereby reduce or perhaps stop the flow of material through a safety valve. If a pressure relief valve does not operate on demand, pressure may build up in a tank or in connected systems of tanks, eventually causing other leaks or tank rupture.

For simplicity, instruments are not shown on figure 2; there will of course be instruments related to pressure, flow and temperature, which are essential parameters for monitoring the system state, relevant signals being transmitted to operator consoles or to a control room for control and monitoring purposes. Furthermore, there will be supply lines other than those intended for materials transport - for electricity, hydraulics and so forth - and extra safety devices. A comprehensive analysis must go through these systems as well and look for the failure modes and effects of these components also. In particular, the detective work on common-mode effects and sneak paths requires one to construct the integral picture of main system components, controls, instruments, supplies, operators, working schedules, maintenance and so on.

Examples of common-mode effects to consider in connection with gas systems are addressed by such questions as these:

• Are activation signals for delivery valves and emergency shut-down valves transmitted on a common line (cable, cabling channels)?

• Do two given valves share the same power line?

• Is maintenance performed by the same person according to a given schedule?

Even an excellently designed system with redundancy and independent power lines can suffer from inferior maintenance, where, for example, a valve and its back-up valve (the emergency shut-down valve in our case) have been left in a wrong state after a test. A prominent common-mode effect with an ammonia-handling system is the leak situation itself: a moderate leak can make all manual operations on plant components rather awkward - and delayed - due to the deployment of the required emergency protection.

Summary

The hardware components are very seldom the guilty parts in accident development; rather, there are root causes to be found in other links of the chain: wrong concepts, bad designs, maintenance errors, operator errors, management errors and so on. Several examples of the specific conditions and acts that may lead to failure development have already been given; a broad collection of such agents would take account of the following:

• collision

• corrosion, etching

• excessive loads

• failing support and aged or worn-out parts

• low-quality welding jobs

• missiles

• missing parts

• overheating or chilling

• vibration

• wrong construction material used.

Controlling the hardware hazards in a working environment requires the review of all possible causes and respect for the conditions that are found to be critical with the actual systems. The implications of this for the organization of risk management programmes are dealt with in other articles, but, as the foregoing list clearly indicates, the monitoring and control of hardware conditions can be necessary all the way back to the choice of concepts and designs for the selected systems and processes.

Back

Through industrialization, workers became organized in factories as the utilization of energy sources such as the steam engine became possible. As compared to traditional handicraft, mechanized production, with sources of higher energy at its disposal, presented new risks of accidents. As the amount of energy increased, workers were removed from the direct control of these energies. Decisions that affected safety were often made at the management level rather than by those directly exposed to these risks. At this stage of industrialization, the need for safety management became evident.

In the late 1920s, Heinrich formulated the first comprehensive theoretical framework for safety management, which was that safety should be sought through management decisions based on identification and analysis of accident causes. At this point in the development of safety management, accidents were attributed to failures at the worker-machine system level - that is, to unsafe acts and unsafe conditions.

Subsequently, various methodologies were developed for the identification and assessment of accident risks. With MORT (Management Oversight and Risk Tree), the focus shifted to the higher orders of control of accident risks - that is, to the control of conditions at the management level. The initiative to develop MORT was taken in the late 1960s by the US Energy Research and Development Administration, which wanted to improve their safety programmes in order to reduce their losses due to accidents.

The MORT Diagram and Underlying Principles

The intent of MORT was to formulate an ideal safety management system based on a synthesis of the best safety programme elements and safety management techniques then available. As the principles underlying the MORT initiative were applied to the contemporary state of the art in safety management, the largely unstructured safety literature and expertise took on the form of an analytical tree. The first version of the tree was published in 1971. Figure 1 shows the basic elements of the version of the tree that was published by Johnson in 1980. The tree also appears in a modified form in later publications on the subject of the MORT concept (see, for example, Knox and Eicher 1992).

Figure 1. A version of the MORT analytical tree

The MORT Diagram

MORT is used as a practical tool in accident investigations and in evaluations of existing safety programmes. The top event of the tree in figure 1 (Johnson 1980) represents the losses (experienced or potential) due to an accident. Below this top event are three main branches: specific oversights and omissions (S), management oversights and omissions (M) and assumed risks (R). The R-branch consists of assumed risks, which are events and conditions that are known to management and that have been evaluated and accepted at the proper management level. Other events and conditions that are revealed through the evaluations following the S- and M-branches are denoted “less than adequate” (LTA).

The S-branch focuses on the events and conditions of the actual or potential occurrence. (In general, time is shown as one reads from left to right, and the sequence of causes is shown as one reads from bottom to top.) Haddon’s strategies (1980) for the prevention of accidents are key elements in this branch. An event is denoted an accident when a target (a person or object) is exposed to an uncontrolled transfer of energy and sustains damage. In the S-branch of MORT, accidents are prevented through barriers. There are three basic types of barriers: (1) barriers that surround and confine the energy source (the hazard), (2) barriers that protect the target and (3) barriers that separate the hazard and the target physically or in time or space. These different types of barriers are found in the development of the branches below the accidental event. Amelioration relates to the actions taken after the accident to limit the losses.

At the next level of the S-branch, factors are recognized which relate to the different phases of the life cycle of an industrial system. These are the project phase (design and plan), start up (operational readiness) and operation (supervision and maintenance).

The M-branch supports a process in which specific findings from an accident investigation or safety programme evaluation are made more general. Events and conditions of the S-branch thus often have their counterparts in the M-branch. When engaged with the system at the M-branch, the analyst’s thinking is expanded to the total management system. Thus, any recommendations will affect many other possible accident scenarios as well. The most important safety management functions can be found in the M-branch: the setting of policy, implementation and follow-up. These are the same basic elements that we find in the quality assurance principles of the ISO 9000 series published by the International Organization for Standardization (ISO).

When the branches of the MORT diagram are elaborated in detail, there are elements from such different fields as risk analysis, human factors analysis, safety information systems and organizational analysis. In total, about 1,500 basic events are covered by the MORT diagram.

Application of the MORT Diagram

As indicated, the MORT diagram has two immediate uses (Knox and Eicher 1992): (1) to analyse management and organizational factors relative to an accident that has happened and (2) to evaluate or audit a safety programme in relation to a significant accident that has the potential of occurring. The MORT diagram functions as a screening tool in planning the analyses and evaluations. It is also used as a checklist for comparison of actual conditions with the idealized system. In this application, MORT facilitates checking the completeness of the analysis and avoiding personal biases.

At bottom, MORT is made up of a collection of questions. Criteria that guide judgements as to whether specific events and conditions are satisfactory or less than adequate are derived from these questions. In spite of the directive design of the questions, the judgements made by the analyst are partly subjective. It has thus become important to ensure an adequate quality and degree of intersubjectivity among MORT analyses made by different analysts. For example, in the United States, a training programme is available for certification of MORT analysts.

Experiences with MORT

The literature on evaluations of MORT is sparse. Johnson reports significant improvements in the comprehensiveness of accident investigations after the introduction of MORT (Johnson 1980). Deficiencies at the supervisory and management levels were revealed more systematically. Experience has also been gained from evaluations of MORT applications within Finnish industry (Ruuhilehto 1993). Some limitations have been identified in the Finnish studies. MORT does not support the identification of immediate risks due to failures and disturbances. Furthermore, no capability for setting priorities is built into the MORT concept. Consequently, the results of MORT analyses need further evaluation to translate them into remedial actions. Finally, experience shows that MORT is time-consuming and requires expert participation.

Aside from its ability to focus on organizational and management factors, MORT has the further advantage of connecting safety with normal production activities and general management. The application of MORT will thus support general planning and control, and help reduce the frequency of production disturbances as well.

Associated Safety Management Methods and Techniques

With the introduction of the MORT concept in the early 1970s, a development programme started in the United States. The focal point for this programme has been the System Safety Development Center in Idaho Falls. Different MORT-associated methods and techniques in such areas as human factors analysis, safety information systems and safety analysis have resulted from this programme. An early example of a method arising from the MORT development programme is the Operational Readiness Program (Nertney 1975). This programme is introduced during the development of new industrial systems and modifications of existing ones. The aim is to ensure that, from the safety management point of view, the new or modified system is ready at the time of start-up. A condition of operational readiness presupposes that the necessary barriers and controls have been installed in the new system’s hardware, personnel and procedures. Another example of a MORT programme element is the MORT-based root cause analysis (Cornelison 1989). It is used to identify the basic safety management problems of an organization. This is done by relating the specific findings of the MORT analyses to 27 different generic safety management problems.

Although MORT is not intended for use directly in the collection of information during accident investigations and safety audits, in Scandinavia, the MORT questions have served as a basis for the development of a diagnostic tool used for this purpose. It is called the Safety Management and Organization Review Technique, or SMORT (Kjellén and Tinmannsvik 1989). A SMORT analysis advances backwards in steps, starting from the specific situation and ending at the general management level. The starting point (level 1) is an accident sequence or a risk situation. At level 2, the organization, system planning and technical factors related to daily operation are scrutinized. The subsequent levels include design of new systems (level 3) and higher management functions (level 4). Findings on one level are extended to the levels above. For example, results related to the accident sequence and to daily operations are used in the analysis of the company’s organization and routines for project work (level 3). Results at level 3 will not affect safety in existing operations but may be applied to the planning of new systems and modifications. SMORT also differs from MORT in the way findings are identified. At level 1, these are observable events and conditions that deviate from generally accepted norms. When organizational and management factors are brought into the analysis at levels 2 to 4, the findings are identified through value judgements made by an analysis group and verified through a quality control procedure. The aim is to ensure a mutually shared understanding of the organizational problems.

Summary

MORT has been instrumental in developments within safety management since the 1970s. It is possible to track the influence of MORT to such areas as safety research literature, literature on safety management and audit tools, and legislation on self-regulation and internal control. In spite of this impact, its limitations must be carefully considered. MORT and associated methods are normative in the sense that they prescribe how safety management programmes should be organized and executed. The ideal is a well-structured organization with clear and realistic goals and well-defined lines of responsibility and authority. MORT is thus best suited for large and bureaucratic organizations.

Back

Inspection Systems

Auditing has been defined as “the structured process of collecting independent information on the efficiency, effectiveness and reliability of the total safety management system and drawing up plans for corrective action” (Successful Health & Safety Management 1991).

The workplace inspection therefore is not only the final stage in setting up a safety management programme but is also a continuing process in its maintenance. It can be conducted only where a properly devised management system for safety has been established. Such a system first envisages a formal policy statement from management setting out its principles for creating a healthy and safe working environment and then establishing the mechanisms and the structures within the organization whereby these principles will be effectively implemented. Management must furthermore be committed to providing adequate resources, both human and financial, to support the system’s mechanisms and structures. Thereafter, there must be detailed planning for safety and health, and the defining of measurable goals. Systems must be devised to ensure that safety and health performance in practice can be measured against established norms and against previous achievements. Only when this structure is in place and is operating can an effective management audit system be applied.

Complete safety and health management systems can be devised, produced and implemented from within the resources of larger enterprises. Additionally, there are a number of safety management control systems which are available from consultants, insurance companies, government agencies, associations and specialist companies. It is a matter for the enterprise to decide whether it should produce its own system or obtain outside services. Both alternatives are capable of producing excellent results if there is a genuine commitment by management to apply them diligently and to make them work. But for their success, they do depend heavily on the quality of the audit system.

Management Inspections

The inspection procedure must be as painstaking and objective as the company’s financial inspection. The inspection must first determine whether the company’s statement of policy on safety and health is properly reflected in the structures and mechanisms created to implement it; if not, then the inspection may recommend that the fundamental policy be reappraised or suggest adjustments or alterations to the existing structures and mechanisms. A similar process must be applied to safety and health planning, to the validity of the goal-setting norms, and to the measurement of performance. The results of any inspection must be considered by the top management of the enterprise, and any correctives must be endorsed and implemented through that authority.

In practice it is undesirable, and often impractical, to undertake a complete inspection of all of a system’s features and their application throughout every department of the enterprise at one time. More usually, the inspection procedure concentrates on one feature of the total safety management system throughout the plant, or alternatively on the application of all the features in one department or even subdepartment. But the objective is to cover all the features in all departments over an agreed period in order to validate the results.

To this extent management inspection should be regarded as a continuous process of vigilance. The need for objectivity is clearly of considerable importance. If inspections are conducted in-house then there must be a standardized inspection procedure; inspections should be undertaken by staff who have been properly trained for this purpose; and those selected as inspectors must not assess the departments in which they normally work, nor should they assess any other work in which they have a personal involvement. Where reliance is placed on consultants this problem is minimized.

Many major companies have adopted this type of system, either devised internally or obtained as a proprietary scheme. When the systems have been carefully followed through from policy statement to inspection, feedback and corrective actions, a substantial reduction in accident rates, which is the prime justification for the procedure, and increased profitability, which is a welcome secondary outcome, should result.

Inspections by Inspectorates

The legal framework which is designed to afford protection to people at work must be properly administered and effectively applied if the purpose of the regulatory legislation is to be achieved. Most countries have therefore adopted the broad model of an inspection service which has the duty of ensuring that safety and health legislation is enforced. Many countries see safety and health issues as part of a complete labour relations package covering industrial relations, wages and holiday agreements, and social benefits. In this model, safety and health inspections are one element of the labour inspector’s duties. A different model also exists in which the state inspectorate is exclusively concerned with safety and health legislation, so that workplace inspections concentrate solely on this aspect. Further variations are evident in the division of the inspection functions between either a national inspectorate or a regional/provincial inspectorate, or indeed, as in Italy and the United Kingdom, for example, as a working combination of both national and regional inspectorates. But whichever model is adopted, the essential function of the inspectorate is to determine compliance with the legislation by a programme of planned inspections and investigations at the workplace.

There can be no effective inspection system unless those who undertake this work are given adequate powers to carry it out. There is much common ground among inspectorates as regards the powers given to them by their legislators. There must always be the right of entry to premises, which is clearly fundamental for inspection. Thereafter there is the legal right to examine relevant documents, registers and reports, to interview members of the workforce either individually or collectively, to have unrestricted access to trade union representatives at the workplace, to take samples of substances or materials at use in the workplace, to take photographs and, if appropriate, to take written statements from people working at the premises.

Additional powers are often provided to enable inspectors to rectify conditions which might be an immediate source of danger or ill health to the workforce. Again there is a wide variety of practices. Where standards are so poor that there is an imminent risk of danger to the workforce, then an inspector may be authorized to serve a legal document on the spot prohibiting the use of the machinery or plant, or stopping the process until the risk has been effectively controlled. For a lower order of risk, inspectors can issue a legal notice formally requiring that measures be taken within a given time to improve standards. These are effective ways of rapidly improving working conditions, and are often a form of enforcement preferable to formal court proceedings, which may be cumbersome and slow in securing remediation.

Legal proceedings have an important place in the hierarchy of enforcement. There is an argument that because court proceedings are simply punitive and do not necessarily result in changing attitudes to safety and health at work, they should therefore be invoked only as a last resort when all other attempts at securing improvements have failed. But this view has to be set against the fact that where legal requirements have been ignored or disregarded, and where people’s safety and health have been significantly put at risk, then the law must be enforced and the courts must decide the issue. There is the further argument that those enterprises which disregard safety and health legislation may thereby enjoy an economic advantage over their competitors, who provide adequate resources to comply with their legal duties. Prosecution of those who persistently disregard their duties is therefore a deterrent to the unscrupulous, and an encouragement to those who try to observe the law.

Every inspection service has to determine the proper balance between providing advice and enforcing the law in the course of inspection work. A special difficulty emerges in connection with the inspection of small enterprises. Local economies, and indeed national economies, are often underpinned by industrial premises each employing fewer than 20 people; in the case of agriculture, the employment figure per unit is very much less. The function of the inspectorate in these cases is to use the workplace inspection to provide information and advice not only on legal requirements, but on practical standards and effective ways of meeting those standards. The technique must be to encourage and stimulate, rather than to immediately enforce the law by punitive action. But even here the balance is a difficult one. People at work are entitled to safety and health standards irrespective of the size of the enterprise, and it would therefore be wholly misguided for an inspection service to ignore or minimize risks and to curtail or even forgo enforcement simply to nurture the existence of the economically fragile small enterprise.

Consistency of Inspections

In the view of the complex nature of their work - with its combined needs for legal, prudential, technical and scientific skills, inspectors do not - indeed should not - adopt a mechanistic approach to inspection. This constraint, combined with a difficult balance between the advisory and enforcement functions, creates yet another concern, that of the consistency of inspection services. Industrialists and trade unions have a right to expect a consistent application of standards, whether technical or legal, by inspectors across the country. In practice this is not always easy to achieve, but it is something for which the enforcing authorities must always strive.

There are ways of achieving an acceptable consistency. First, the inspectorate should be as open as possible in publishing its technical standards and in publicly setting out its enforcement policies. Second, through training, the application of peer review exercises, and internal instructions, it should be able both to recognize a problem and to provide systems to deal with it. Finally, it should ensure that there are procedures for industry, the workforce, the public and the social partners to secure redress if they have a legitimate grievance over inconsistency or other forms of maladministration associated with inspection.

Frequency of Inspections

How frequently should the inspectorates undertake inspections of the workplace? Again there is considerable variation in the way this question may be answered. The International Labour Organization (ILO) holds the view that the minimum requirement should be that every workplace should receive an inspection from the enforcing authorities at least once each year. In practice, few countries manage to produce a programme of work inspection which meets this objective. Indeed, since the major economic depression in the late 1980s some governments have been curtailing inspection services by budget limitations that result in cutbacks in the number of inspectors, or by restrictions on recruiting new staff to replace those who retire.

There are different approaches to determine how frequently inspections should be made. One approach has been purely cyclical. Resources are deployed to provide inspection of all premises on a 2-yearly, or more likely a 4-yearly, basis. But this approach, though possibly having the appearance of equity, treats all premises as the same regardless of size or risk. Yet enterprises are manifestly diverse as regards safety and health conditions, and to the extent that they differ, this system may be regarded as mechanistic and flawed.

A different approach, adopted by some inspectorates, has been to attempt to draw up a programme of work based on hazard; the greater the hazard either to safety or health, the more frequent the inspection. Hence resources are applied by the inspectorate to those places where the potential for harm to the workforce is the greatest. Although this approach has merits, there are still considerable problems associated with it. First, there are difficulties in accurately and objectively assessing hazard and risk. Second, it extends very considerably the intervals between inspections of those premises where hazards and risks are considered to be low. Therefore, extended periods may elapse during which many of the workforce may have to forgo that sense of security and assurance which inspection can provide. Furthermore, the system tends to presume that hazards and risks, once assessed, do not radically change. This is far from being the case, and there is the danger that a low-rated enterprise may change or develop its production in such a way as to increase hazards and risk without the inspectorate’s being aware of the development.

Other approaches include inspections based on facility injury rates which are higher than the national averages for the particular industry, or immediately following a fatal injury or major catastrophe. There are no short and easy answers to the problem of determining the frequency of inspection, but what seems to be happening is that inspection services in many countries are too often significantly under-resourced, with the result that the real protection to the workforce afforded by the service is being progressively eroded.

Inspection Goals

Inspection techniques in the workplace vary according to the size and complexity of the enterprise. In smaller companies, the inspection will be comprehensive and will assess all hazards and the extent to which the risks arising from the hazards have been minimized. The inspection will therefore ensure that the employer is fully aware of safety and health problems and is given practical guidance on how they may be addressed. But even in the smallest enterprise the inspectorate should not give the impression that fault-finding and the application of suitable remedies are the function of the inspectorate and not of the employer. Employers must be encouraged by inspection to control and effectively manage safety and health problems, and they must not abdicate their responsibilities by awaiting an inspection from the enforcement authorities before taking needed action.

In larger companies, the emphasis of inspection is rather different. These companies have the technical and financial resources to deal with safety and health problems. They should devise both effective management systems to resolve the problems, as well as management procedures to check that the systems are working. In these circumstances, the inspection emphasis should therefore be on checking and validating the management control systems found at the workplace. The inspection should therefore not be an exhaustive examination of all items of plant and equipment to determine their safety, but rather to use selected examples to test the effectiveness or otherwise of the management systems for ensuring safety and health at work.

Worker Involvement in Inspections

Whatever the premises, a critical element in any type of inspection is contact with the workforce. In many smaller premises, there may be no formal trade union structure or indeed any workforce organization at all. However, to ensure the objectivity and acceptance of the inspection service, contact with individual workers should be an integral part of the inspection. In larger enterprises, contact should always be made with trade union or other recognized worker representatives. Legislation in some countries (Sweden and the United Kingdom, for example) gives official recognition and powers to trade union safety representatives, including the right to make workplace inspections, to investigate accidents and dangerous occurrences and in some countries (though this is exceptional) to stop plant machinery or the production process if it is imminently dangerous. Much useful information can be gained from these contacts with the workers, which should feature in every inspection, and certainly whenever the inspectorate is conducting an inspection as the result of an accident or a complaint.

Inspection Findings

The final element in an inspection is to review the inspection findings with the most senior member of management on the site. Management has the prime responsibility to comply with legal requirements on safety and health, and therefore no inspection should be complete without management’s being fully aware of the extent to which it has met those duties, and what needs to be done to secure and maintain proper standards. Certainly if any legal notices are issued as a result of an inspection, or if legal proceedings are likely, then senior management must be aware of this state of affairs at the earliest possible stage.

Company Inspections

Company inspections are an important ingredient in maintaining sound standards of safety and health at work. They are appropriate to all enterprises and, in larger companies, may be an element in the management inspection procedure. For smaller companies, it is essential to adopt some form of regular company inspection. Reliance should not be placed on the inspection services provided by the inspectorates of the enforcing authorities. These are usually far too infrequent, and should serve largely as a stimulus to improve or maintain standards, rather than be the primary source for evaluating standards. Company inspections can be undertaken by consultants or by companies who specialize in this work, but the current discussion will concentrate on inspection by the enterprise’s own personnel.

How frequently should company inspections be made? To some degree the answer is dependent on the hazards associated with the work and the complexity of the plant. But even in low-risk premises there should be some form of inspection on a regular (monthly, quarterly, etc.) basis. If the company employs a safety professional, then clearly the organization and the conduct of the inspection must be an important part of this function. The inspection should usually be a team effort involving the safety professional, the departmental manager or foreman, and either a trade union representative or a qualified worker, such as a safety committee member. The inspection should be comprehensive; that is to say, a close examination should be made both of the safety software (for example, systems, procedures and work permits) and the hardware (for example, machinery guarding, fire-fighting equipment, exhaust ventilation and personal protective equipment). Particular attention should be paid to “near misses” - those incidents which do not result in damages or personal injury but which have the imminent potential for serious accidental injuries. There is an expectation that after an accident resulting in absence from work, the inspection team would immediately convene to investigate the circumstances, as a matter outside the normal cycle of inspection. But even during routine workshop inspection the team should also consider the extent of minor accidental injuries which have occurred in the department since the previous inspection.

It is important that company inspections should not seem to be consistently negative. Where faults exist it is important that they be identified and rectified, but it is equally important to commend the maintenance of good standards, to comment positively on tidiness and good housekeeping, and to reinforce by encouragement those who use personal protective equipment provided for their safety. To complete the inspection a formal written report should be made of the significant deficiencies found. Particular attention should be drawn to any shortcomings which have been identified in previous inspections but have not yet been corrected. Where there exists a works safety council, or a joint management-worker safety committee, the inspection report should be featured as a standing item on the council’s agenda. The report on the inspection must be sent to and discussed with the senior management of the enterprise, who should then determine whether action is required and, if so, authorize and support such action.

Even the smallest companies, where there is no safety professional, and where trade unions may not exist, should consider company inspections. Many inspectorates have produced very simple guidelines illustrating the basic concepts of safety and health, their application to a range of industries, and practical ways in which they can be applied in even the smallest enterprises. Many safety associations specifically target small businesses with publications (often free) which provide the basic information to establish safe and healthy working conditions. Armed with this sort of information and with the expenditure of very little time, the proprietor of a small business can establish reasonable standards, and can thus perhaps obviate the sort of accidents which can happen to the workforce in even the smallest business.

Back

It is a paradox that the prevention of work-related accidents did not emerge very early as an absolute necessity, since health and safety is fundamental to work itself. In fact it was not until the beginning of the twentieth century that accidents at work ceased to be considered inevitable and their causation became a subject to be investigated and used as a basis for prevention. However, accident investigation long remained cursory and empirical. Historically, accidents were first conceived of as simple phenomena—that is, as resulting from a single (or principal) cause and a small number of subsidiary causes. It is now recognized that accident investigation, which is aimed at identifying the causes of the phenomenon so as to avert its reoccurrence, depends both on the concept underlying the process of investigation and on the complexity of the situation to which it is applied.

Causes of Accidents

It is indeed true that in the most precarious situations, accidents are often the result of a fairly simple sequence of a few causes that can be rapidly traced to basic technical problems that even a summary analysis can reveal (equipment badly designed, working methods undefined, etc.). On the other hand, the more closely that the material elements of work (machines, installations, the arrangement of the workplace, etc.) conform with the requirements of safe work procedures, standards and regulations, the safer the work situation becomes. The result is that an accident can then occur only when a group of exceptional conditions are present simultaneously—conditions that are becoming ever more numerous. In such cases, the injury or damage appears as the final result of a frequently complex network of causes. This complexity is actually evidence of progress in prevention, and requires appropriate methods of investigation. Table 1 lists the principal concepts of the accident phenomenon, their characteristics and implications for prevention.

Table 1. Principal concepts of the accident phenomenon, their characteristics and the implications for prevention

Nowadays, a work accident is generally viewed as an index (or symptom) of dysfunction in a system consisting of a single production unit, such as a factory, workshop, team or work position. It is the nature of a system that its analysis requires the investigator to examine not only the elements that make up the system but also their relationships with one another and with the work environment. Within the framework of a system, the accident investigation seeks to trace to its origins the sequence of basic dysfunctions that have resulted in the accident and, more generally, the network of antecedents of the undesired event (accident, near accident or incident).

The application of methods of this kind, such as the STEP method (sequentially timed events plotting procedures) and the “tree of causes” method (similar to fault or event trees analyses), allows the accident process to be visualized in the form of an adjusted graph that illustrates the multicausality of the phenomenon. Because these two methods are so similar, it would represent a duplication of effort to describe them both; accordingly, this article concentrates on the tree of causes method and, where applicable, notes its main differences from the STEP method.

Information Useful for the Investigation

The initial phase of the investigation, the gathering of information, must allow the course of the accident to be described in concrete, precise and objective terms. The investigation therefore sets out to ascertain the tangible facts, taking care not to interpret them or to express an opinion about them. These are the antecedents of the accident, of which there are two types:

1. those of an unusual nature (changes or variations) in relation to the “normal” or expected course of the work
2. those of a permanent nature that have played an active part in the occurrence of the accident through the medium of or in combination with the unusual antecedents.

For example, insufficient protection of a machine (a permanent antecedent) can turn out to be a factor in an accident if it allows the operator to take up a position in a dangerous area in order to deal with a particular incident (unusual antecedent).

The information gathering is carried out at the location of the accident itself as soon as possible after its occurrence. It is preferably carried out by persons who know the operation or process and who try to obtain a precise description of the work without limiting themselves to the immediate circumstances of the damage or injury. The investigation is initially effected mainly by means of interviews, if possible with the worker or operator, victims and eyewitnesses, other members of the work team, and the hierarchical supervisors. If appropriate it is completed by means of a technical investigation and the use of outside expertise.

The investigation seeks to identify, in order of priority, the unusual antecedents, and to determine their logical connections. An effort is made at the same time to reveal the permanent antecedents that have allowed the accident to occur. In this way the investigation is able to go back to a stage more remote than the immediate antecedents of the accident. These more remote antecedents may concern individuals, their tasks, the equipment that they use, the environment in which they function and the safety culture. By proceeding in the way just described, it is generally possible to draw up a lengthy list of antecedents, but it will usually be difficult to make immediate use of the data. The interpretation of the data is made possible thanks to a graphic representation of all the antecedents involved in the genesis of the accident—that is, a tree of causes.

Constructing a Tree of Causes

The tree of causes presents all the antecedents that have been gathered which have given rise to the accident, as well as the logical and chronological links that connect them; it is a representation of the network of antecedents that have directly or indirectly caused the injury. The tree of causes is constructed starting from the end-point of the event - that is, the injury or damage—and working backwards toward the cause by systematically asking the following questions for each antecedent that has been gathered:

• By which antecedent X was antecedent Y directly caused?

• Was antecedent X sufficient in itself to give rise to antecedent Y?

• If not, have there been other antecedents (X1, X2  Xn) that were equally necessary in order to give rise directly to antecedent Y?

This set of questions can reveal three types of logical connection, summarized in figure 1, among the antecedents.

Figure 1. Logical links used in the "tree of causes" method

The logical coherence of the tree is checked by asking the following questions for each antecedent:

• If X had not taken place, would Y nevertheless have occurred?

• In order for Y to occur, was X, and only X, necessary?

Moreover, the construction of the tree of causes in itself induces the investigators to pursue the information-gathering, and therefore the investigation, to a point well before the accident occurred. When completed, the tree represents the network of antecedents that have given rise to the injury—they are in fact the accident factors. As an example, the accident summarized below produced the tree of causes shown in figure 2.

Figure 2. Tree of causes of an accident suffered by an apprentice mechanic when remounting an engine in a car

Accident Summary Report: An apprentice mechanic, recently recruited, had to work alone in an emergency. A worn sling was being used to suspend an engine that had to be remounted, and during this operation the sling broke and the engine fell and injured the mechanic’s arm.

Analysis by the STEP Method

According to the STEP method (figure 3), each event is set out graphically so as to show the chronological order of its appearance, keeping one line per “agent” concerned (an agent is the person or thing that determines the course of events constituting the accident process). Each event is described precisely by indicating its beginning, duration, starting and ending place and so on. When there are several plausible hypotheses, the investigator can show them in the network of events by using the logical relationship “or”.

Figure 3. Example of representation possible by the STEP method

Analysis by the Tree of Causes Method

Making use of the tree of causes for the purposes of accident analysis has two objectives:

• making the reoccurrence of the same accident impossible

• averting the occurrence of more or less similar accidents - that is, accidents whose investigation would reveal common factors with the accidents that have already occurred.

Given the logical structure of the tree, the absence of a single antecedent would have prevented the occurrence of the accident. One judicious prevention measure would therefore suffice, in principle, to satisfy the first objective by preventing the reoccurrence of the same accident. The second objective would require that all the factors discovered should be eliminated, but in practice the antecedents are not all of equal importance for the purposes of prevention. It is therefore necessary to draw up a list of antecedents requiring reasonable and realistic preventive action. If this list is long, a choice has to be made. This choice has more chance of being appropriate if it is made within the framework of a debate between the partners concerned in the accident. Moreover, the debate will gain in clarity to the extent that it is possible to assess the cost-effectiveness of each measure proposed.

Effectiveness of Preventive Measures

The effectiveness of a preventive measure can be judged with the help of the following criteria:

The stability of the measure. The effects of a preventive measure must not disappear with time: informing the operators (in particular, reminding them of instructions) is not a very stable measure because its effects are often transient. The same is moreover true of some protective devices when they are easily removable.

The possibility of integrating safety. When a safety measure is added on - that is, when it does not contribute directly to production - it is said that safety is not integrated. Whenever this is so, it is observed that the measure tends to disappear. Generally speaking, any preventive measure entailing an additional cost for the operator should be avoided, whether it is a physiological cost (increasing the physical or nervous load), a psychological cost, a financial cost (in the case of salary or output) or even a simple loss of time.

The non-displacement of the risk. Some preventive measures may have indirect effects that are detrimental to safety. It is therefore always necessary to foresee the possible repercussions of a preventive measure on the system (job, team or workshop) in which it is inserted.

The possibility of general application (the notion of potential accident factor). This criterion reflects the concern that the same preventive action may be applicable to other jobs than the one affected by the accident under investigation. Whenever possible, an effort should be made to go beyond the particular case that has given rise to the investigation, an effort that often requires a reformulation of the problems discovered. The information obtained from an accident may thus lead to preventive action relating to factors that are unknown but present in other work situations where they have not yet given rise to accidents. For this reason they are called “potential accident factors”. This notion opens the way to the early detection of risks, mentioned later.

The effect on root “causes”. As a general rule, the prevention of accident factors near to the point of injury eliminates certain effects of dangerous situations, while prevention acting well upstream of the injury tends to eliminate the dangerous situations themselves. An in-depth investigation of accidents is justified to the extent that the preventive action is equally concerned with the upstream factors.

The time taken for application. The need to act as rapidly as possible after the occurrence of an accident so as to avoid its reoccurrence is often reflected in the application of a simple preventive measure (an instruction, for example), but this does not eliminate the need for other more lasting and more effective action. Every accident must therefore give rise to a series of proposals whose implementation is the subject of follow-up.

The above criteria are intended to give a better appreciation of the quality of preventive action proposed after each accident investigation. However, the final choice is not made solely on this basis, as other considerations, such as economic, cultural or social ones, must also be taken into account. Finally, the measures decided upon must obviously respect the regulations in force.

Accident Factors

The lessons drawn from each accident analysis deserve to be recorded systematically so as to facilitate passing from knowledge to action. Thus figure 4 consists of three columns. In the left-hand column are noted the accident factors requiring preventive measures. Possible preventive action is described in the middle column for each factor decided upon. After the discussion mentioned above, the action selected is recorded in this part of the document.

Figure 4. Lessons drawn from accidents and the use of these lessons

The right-hand column covers the potential accident factors suggested by the factors listed in the left-hand column: it is considered that each accident factor discovered is often only a particular case of a more general factor known as a potential accident factor. The passage from the particular case to the more general case is often made spontaneously. However, each time that an accident factor is expressed in such a fashion that it is not possible to encounter it elsewhere than in the situation in which it has appeared, a more general formulation must be considered. In doing this, it is necessary to avoid two opposite pitfalls so as to utilize the notion of potential accident factor effectively in the early detection of risks arising later. A formulation that is too circumscribed does not permit systematic detection of the factors, whereas one that is too wide makes the notion unworkable and is of no further practical interest. The detection of potential accident factors thus presupposes their being well formulated. This detection can then be carried out in two ways, which are moreover complementary:

1. either by looking for the possible presence of potential factors already known at the level of a job or a wider area (workshop, service)
2. or by looking for jobs where a factor already determined may be observed.

Usefulness, Effectiveness and Limitations of Accident Investigation

Usefulness. As compared to non-systematic investigations, methods of accident investigation based on a systematic concept have numerous advantages, which include the following:

• They allow the causal network of each accident to be defined collectively, from which it is easier to devise new preventive measures and foresee their impact without being limited to the direct causes of the injury.

• They provide those involved in the analysis with a richer and more realistic mental representation of the “accident phenomenon” that permits a global understanding of work situations.

• In-depth accident investigations (especially when they are extended to cover incidents and undesired events) can become a means and appropriate occasion for dialogue between management and operators.

Effectiveness. In order to be effective, accident investigation requires that four conditions are satisfied concurrently:

1. an evident commitment on the part of the top management of the establishment, who must be able to ensure the systematic implementation of such procedures
2. training of the investigators
3. management, supervisors and workers fully informed concerning the aims of the investigation, its principles, the requirements of the method and the results expected
4. real improvements in safety conditions that will encourage those involved in future investigations.

Limitations. Even when carried out very well, accident investigation suffers from a double limitation:

• It remains a procedure for investigating risks a posteriori (in the manner of systems analysis), with the aim of correcting existing situations. It does not therefore dispense with the need for a priori (prospective) investigations, such as the ergonomic investigation of jobs or, for complex systems, safety investigations.

• The usefulness of accident investigations also varies with the safety level of the establishment where they are applied. In particular, when the safety level is high (the accident rate is low or very low), it is evident that serious accidents result from the conjunction of numerous independent random factors that are relatively harmless from the safety viewpoint when considered outside the context under investigation.

Back