Accident Prevention

 INTRODUCTION
 CONCEPTS OF ACCIDENT ANALYSIS
 THEORY OF ACCIDENT CAUSES
 HUMAN FACTORS IN ACCIDENT MODELLING
 ACCIDENT MODELS: RISK HOMEOSTASIS
 ACCIDENT MODELLING
 ACCIDENT SEQUENCE MODELS
 ACCIDENT DEVIATION MODELS
 MAIM: THE MERSEYSIDE ACCIDENT INFORMATION MODEL
 PRINCIPLES OF PREVENTION: THE PUBLIC HEALTH APPROACH TO
REDUCING INJURIES IN THE WORKPLACE
 THEORETICAL PRINCIPLES OF JOB SAFETY
 PRINCIPLES OF PREVENTION: SAFETY INFORMATION
 WORK-RELATED ACCIDENT COSTS
 REFERENCES
 OTHER RELEVANT READINGS

INTRODUCTION
Jorma Saari

According to International Labour Office statistics, 120 million occupational accidents occur
annually at workplaces worldwide. Of these, 210,000 are fatal accidents. Every day, more than
500 men or women do not come home because they were killed by accidents at work. These are
dramatic numbers which draw fairly little public attention. Considering the fact that accidents
take a considerable economic toll from nations, companies and individuals, accidents do not get
much publicity.

Fortunately there are people working with a sense of purpose, often behind the scenes, towards
understanding and managing safety and accident prevention better, and their efforts have not
been wasted. Our understanding of accident prevention and safety is on a far higher level than
ever before. Many world-class researchers and safety practitioners share this new knowledge
with us through their articles in this Encyclopaedia. During the past twenty decades, knowledge
about accidents has evolved considerably. We have left behind the simplistic model of dividing
behaviour and conditions into two categories: safe or unsafe. The rigid belief that any activity
can be placed into either category has been put aside as more sophisticated systemic models have
been developed and proven effective in managing safety.

The important observation is that two safe conditions which by themselves are safe, may not be
safe together. Workers are the connecting link, as their behaviour changes according to the
environment and their physical surroundings. As an example, power saws caused many accidents
when they came into use in the 1960s due to a hazard known as “kickback”, which takes the
operator by surprise when the chain-saw blades hit a branch, knot or harder point in wood.
Kickback killed and injured hundreds of people before a guard was invented to protect the
operator. When Sweden implemented regulations requiring the kickback guard, the number of
power saw injuries went down from 2,600 in 1971 to 1,700 in 1972. This was a major
breakthrough in power saw accident prevention.

Every user of power saws knows from personal experience that this noisy, vibrating and
obviously sharp cutting tool appears to be very dangerous to use, and the beginner operator is
very cautious. However, after hours of experience operators lose their sense of any hazard and
start handling the saw less carefully. The kickback guard may produce a similar effect. Operators
who know kickback is possible try to avoid it. When operators know that there is a mechanical
device preventing the saw from hurting them in event of kickback, they become less cautious. In
another forestry industry chain-saw example, studies have shown that leg protection makes
workers less careful and they expose themselves more often to kickbacks, because they believe
they are protected.

Despite the fact that kickback protection has helped prevent injuries, the mechanism is not
straightforward. Even if these protective arrangements have been successful, in the final analysis
their effects do not have a linear relationship with safety. Two safe conditions, kickback guard
and leg protection, do not double the safety. The normal arithmetic of one plus one equals two (1
+ 1 = 2), does not apply in this case, as one plus one makes less than two. Fortunately, one plus
one (1 + 1) makes more than zero in some cases. In other cases, however, the sum may even be
negative.

These are phenomena which safety practitioners have started to understand better than before.
The simple division of behaviours and conditions into safe and unsafe does not lead very far
toward prevention. The credit for progress has to be given to systems management. After
understanding that humans, their tasks, their equipment and the environment make up a dynamic
system, we have made considerable progress towards more effective accident prevention. The
following examples demonstrate the dynamic nature of people and work. If one component is
changed, the others do not remain the same, and the ultimate safety effect is hard to estimate in
advance.

In aviation and in other highly engineered and automated systems, we have seen that increased
automation may not necessarily result in improved safety. For example, operators may not get
enough practice to maintain their skills in a highly automated system. When they then are
required to intervene, they may not have the necessary competence or ability.

Some paper manufacturers have indicated that younger employees do not understand the
functions of a paper machine as well as the older employees. The older employees have operated
non-automated machines, and they have seen how these work. The new automated machines are
operated from control rooms through computer keyboards and screens. The operators do not
know the exact location of each component of the machines they operate. Therefore they may
bring a component into a state which, for example, causes a hazard to the maintenance people in
the vicinity. A technical improvement in the machinery or controls without simultaneous
improvement in operators’ skills, knowledge and values may not result in improved safety.

Accident prevention has been traditionally based on learning from accidents and near accidents
(near misses). By investigating every incident, we learn about causes and can take actions
towards mitigating or removing the causes. The problem is that we have not been able to
develop, in the absence of sufficiently good theories, investigation methods which would bring
up all the relevant factors for prevention. An investigation may give a fairly good picture about
the causes. However, this picture is usually relevant only for the specific case investigated. There
may be conditions and factors which contributed to the accident whose connections the
investigators do not recognize or understand. Generalizing from one accident to other situations
bears a degree of risk.

The good news is that we have made considerable progress in the area of predictive safety
management. A number of techniques have been developed and have become routine for
industrial safety and risk analysis. These techniques allow us to study industrial production
plants systematically for the identification of potential hazards and to institute appropriate action
before anything happens.

The chemical and petrochemical industries have shown leadership in this area worldwide. As a
result of major catastrophes, such as Bhopal and Chernobyl, the use of the new predictive
techniques has increased. Remarkable progress has been made since the mid-1970s in the area of
safety. Many governments have also been leaders in making safety analysis mandatory. Sweden,
Finland, Japan and the Federal Republic of Germany have all reduced fatal occupational
accidents by 60 to 70% during this time. Many other countries show similar progress. Now, the
challenge is to transfer our knowledge from research into practical applications and further
improve our preventive efforts.

One of the new steps in safety management is the notion of safety culture. It may be a difficult
concept, since culture is not a visible entity. It is an abstract concept prevailing within an
organization or society. There are no direct ways of adjusting it. Safety culture is, however, a
crucial concept for understanding the possibilities of prevention. One of the goals of this edition
is to explore this new concept.

This new edition of the Encyclopaedia provides a comprehensive review of accident prevention
theories and models in order to develop better design and more effective preventive strategies. It
is possible to prevent occupational accidents. We do not need to tolerate this unnecessary toll to
our well-being and economy.

CONCEPTS OF ACCIDENT ANALYSIS

Kirsten Jørgensen

The purpose of this article is to provide a guide for calculating the magnitude of the accident
problem; it is not a description of the magnitude itself. In dealing with occupational accidents,
the magnitude of the problem can be estimated in different ways, depending on one’s need to
estimate how big the problem has been or how big it will be in the future. (Some people may say
that this distinction is an unnecessary one, since knowledge of the current extent of the problem
will serve to indicate what is to be expected in the future.) The magnitude of the problem as well
as its types differs from country to country, from industry to industry and from workplace to
workplace.

An accident may be described as a result of a chain of events in which something has gone
wrong, resulting in an undesired conclusion. It has been shown that human intervention may
prevent the injury or damage to which such a chain of events would otherwise lead. However,
given the fact of human intervention, the potential exists for far more dangerous possible chains
of events than those actually leading to injury or damage. These possibilities must be considered
in assessing the full extent of workplace risk. Assuming that events that might lead to injury or
damage occur because of factors in the workplace, one is led to conclude that the magnitude of
the problem has to be determined on the basis of the existence and frequency of such factors.

When dealing with accidents in the workplace, one can estimate the magnitude of the problem
retrospectively by comparing the number of accidents (incidence rate) with the severity of the
accidents (lost work days). However, if one wants to estimate the magnitude of the problem
prospectively, it is done by evaluating the presence of risk factors in the workplace—that is,
factors that might lead to accidents.

A sufficiently complete and accurate view of the state of affairs with respect to workplace
accidents can be gained by means of a comprehensive reporting and record-keeping system.
Analyses of well-prepared accident reports can give a picture of the basic relationships essential
to understanding the causes of the accidents. In order to estimate the magnitude of the problem in
detail, a determination of risk factors is essential. Knowledge of the relevant risk factors can be
obtained by analysing the detailed information provided with each accident record as to where
workers and operators were located when the accident occurred, what they were doing or
handling, by what means, what damages or injuries occurred and other particulars surrounding
the accident.
Risk

Risk measurement must be made on the basis of information regarding the number and
seriousness of injuries that have occurred in the past, yielding a retrospective measurement. The
risk of injury to individuals may be described by two types of data:

· Measurement of risk provides a calculated frequency of injuries and a measurement of the

seriousness of the injury. This could be described as the number of lost work day cases (or
fatalities) per number of workers (e.g., in Denmark, the risk of dying in an occupational accident
is 3 fatalities per 100,000 employees).

· Type of risk or element of danger assessment provides not only an indication of the exposure
sources and other harmful factors which may cause an accident, but also an indication of the
circumstances leading to injury or damage. Work performed at a height, for example, will
involve a risk of falling, with serious injury as a possible result. Similarly, work with cutting
tools involves a risk of cuts from contact with sharp components, and work with noisy machines
for a long period of time may result in hearing damage.

There exists a good deal of common-sense knowledge on many types of risks. For example, if
you work at a height, you may fall; if it is slippery underfoot, then you may slip; and if there are
sharp objects nearby, you may cut yourself. Many types of risk, not apparent to common sense,
may be overlooked. With regard to these, the worker must be informed of the risk (e.g., that
noise causes hearing damage, that some solvents cause brain damage and that certain chemicals
cause acute poisoning by inhalation). Our knowledge of types of risk, from the most to the least
conspicuous, whether gained through everyday experience or through research efforts, is based
on past events. However, it is one thing to know what has happened, and another to assess what
will happen in the future. It should be noted that the very knowledge of the exposure sources and
other potentially harmful factors which may cause damage or injury in connection with tasks of
various sorts, as well as knowledge of the factors that can either heighten or reduce those risk
factors that influence risk measurement, can provide a basis for recognition of the risk.

Factors Determining Risk

The factors which are of greatest relevance in determining risk are:

· factors which determine the presence or absence (or potential) of risks of any sort

· factors which either increase or minimize the probability of these risks resulting in accidents
or injuries

· factors affecting the seriousness of accidents associated with these risks.

To clarify the first point, it is necessary to identify the causes of the accident—namely, exposure
sources and other harmful factors; the two latter points constitute the factors which influence the
measurement of risk.
The primary factors in the working environment which are the direct causes of harm, either by
way of occupational diseases or occupational accidents, are as follows:

Exposure sources and occupational disorders

The concept of injuries due to exposure sources is often linked to the concept of disease (or
disorder) because a disease can be viewed as caused by exposure to one or several agents over a
short (acute exposure) or long (chronic exposure) period of time. Chronic exposure agents are
usually not directly harmful, but take effect rather after a relatively constant and extended period
of exposure, whereas acute exposures are almost instantaneously harmful. The intensity,
harmfulness and period of action is of importance to the development of the injury, which may
often be a matter of a combination of the effects of several different agents. This fact makes it
difficult to point out and determine the exposure sources because (among other reasons)
monocausal correlations between specific disorders and specific exposure sources are almost
never found.

Examples of exposure sources which may result in an injury in the form of a disease-like
condition are:

· chemical exposures (solvents, cleaning agents, degreasing agents, etc.)

· physical exposures (noise, radiation, heat, cold, inadequate lighting, lack of oxygen, etc.)

· physiological exposures (heavy loads, bad work postures or repetitive work)

· biological exposures (viruses, bacteria, flour, animal blood or leather, etc.)

· psychological exposures (work in isolation, threat of violence, changing working hours,

unusual job demands, etc.).

Harmful factors and occupational accidents

The concept of harmful factors (not including exposure sources) is linked to occupational
accidents, because this is where damages occur and workers are exposed to the type of actions
that cause instant injury. This type of action is easily identified because the damage or injury is
recognized immediately when it occurs. The difficulty attached to this type of injury is the
unexpected contact with the harmful factor.

Examples of harmful factors which may result in persons being injured by an accident are often
linked to different energy forms, sources or activity, such as the following:

· energy that involves cutting, dividing or planing, usually in connection with such types of
sharp objects as knives, saws and edged tools

· energy that involves pressing and compressing, usually in connection with different shaping
means such as presses and clamping tools
· the conversion of kinetic energy into potential energy—for example, when something hits or
falls against a worker

· the conversion of potential energy in a person into kinetic energy, such as occurs in falls from
one level to another

· heat and cold, electricity, sound, light, radiation and vibration

· toxic and corrosive substances

· energy exposing the body to excessive stress in such actions, for example, as the moving of
heavy loads or twisting of the body

· mental and psychological stresses such as the threat of violence.

Controlling Exposures

Exposure sources or other harmful factors are to a great extent governed by the nature of the
processes, technologies, products and equipment to be found in the workplace, but may also be
governed by the way in which the work is organized. From the point of view of measurable risk,
it should be recognized that control of the probability of exposures and the seriousness of injuries
to workers often depends on the following three factors:

· Elimination/substitution safety measures. Workplace hazards in the form of exposure sources

or other harmful factors may be eliminated or mitigated by substitution (e.g., a less harmful
chemical may replace a toxic chemical in a process). It should be noted that this is not totally
possible, as exposure sources and other harmful factors will always be present in human
surroundings (not least with respect to human working conditions).

· Technical safety measures. These measures, often called engineering controls, consist of
separating persons from harmful factors by encapsulating the harmful elements, or installing
barriers between workers and the factors which may cause injury. Examples of these measures
include, but are not limited to, automation, remote control, use of ancillary equipment and
machine protection (guarding).

· Organizational safety measures. Organizational safety measures, also known as

administrative controls, include separating persons from harmful factors either by means of
special working methods or by separation in time or space. Examples of these controls include,
but are not limited to, reduced exposure time, preventive maintenance programmes,
encapsulating the individual workers with personal protective equipment, and expedient
organization of work.

Controlling Human Conduct

It is often not possible to isolate all hazards using the above control measures. It is commonly
supposed that accident prevention analysis ends here because it is believed that the workers will
then be able to take care of themselves by acting “according to the rules”. This means that safety
and risk will at some point depend on factors which control human conduct—namely, whether
the individual person has the knowledge, the skills, the opportunity and the will to act so as to
ensure safety in the workplace. The following illustrates the role of these factors.

· Knowledge. Workers must first be aware of the types of risk, potential hazards and elements
of danger that may be found in the workplace. This usually requires education, training and job
experience. The risks also need to be identified, analysed, recorded and described in a readily
understandable manner so that workers know when they are in a specific risk situation and what
consequences are liable to follow from their actions.

· The opportunity to act. It must be possible for the workers to act safely. It is necessary for
workers to be able to make use of the available technical and organizational—as well as physical
and psychological—opportunities for action. Positive support of the safety programme must be
forthcoming from management, supervisors and the surroundings, including concern about risk
taking, designing and following working methods with safety in view, safe use of the proper
tools, clearly defining tasks, establishing and following safe procedures, and providing clear
instructions on how equipment and materials are to be safely handled.

· The will to act safely. Technical and organizational factors are important with respect to
workers’ readiness to behave in ways that will ensure workplace safety, but social and cultural
factors are at least equally important. Risks will arise if, for example, safe conduct is difficult or
time-consuming, or if it is not desired by management or colleagues, or is not appreciated by
them. Management must be clearly interested in safety, taking steps to prioritize it and displaying
a positive attitude towards the need for safe conduct.

Information on the causes of accidents serves the following purposes:

· It can demonstrate where something is wrong and what needs to be changed.

· It indicates the types of harmful factors that cause accidents (or near accidents) and also
describes the situations that result in damage and injuries.

· It identifies and describes the underlying circumstances that determine the presence of
potential hazards and risky situations and that will result in optimum safety by their being altered
or eliminated.

Information of a general sort can be obtained by a thorough analysis of the damage or injuries
and the circumstances under which they occurred. Information obtained from other similar
accidents may point out more general factors of importance, thus disclosing less immediately
visible causal relationships. However, as very detailed and specific information can be obtained
by analysing an individual accident, this information may help uncover the specific
circumstances which should be addressed. Often, analysis of the individual accident will provide
information which it is not possible to obtain from the general analysis, whereas the general
analysis may point out factors which the specific analysis does not elucidate. Data from both of
these kinds of analyses are important to help disclose obvious and direct causal relations at the
individual level.

Analysis of Individual Accidents

Analysis of individual accidents has two primary purposes:

First, it can be used to determine the cause of an accident and the specific work factors that
contributed to it. Following analysis, one can assess the extent to which the risk has been
recognized. One may also decide upon technical and organizational safety measures and the
degree to which more job experience might have diminished the risk. Furthermore, a clearer
view is gained of the possible actions that might have been taken to avoid the risk, and the
motivation that a worker must have to take these actions.

Second, one can gain knowledge which may be used for analyses of many similar accidents at
both the enterprise level and at more comprehensive (e.g., organization-wide or national) levels.
In this connection, it is important to assemble information such as the following:

· the identity of the workplace and the work itself (that is, information relating to the sector or
the trade in which the workplace is positioned), and the work processes and the technology that
characterize the work

· the nature and the seriousness of the accident

· factors causing the accident, such as exposure sources, the way in which the accident
occurred and the specific working situation causing the accident

· general conditions at the workplace and the working situation (comprising the factors
mentioned in the foregoing paragraph).

Types of Analyses

There are five primary types of analyses of accidents, each having a distinct purpose:

· Analyses and identification of where and which types of accidents occur. The goal is to
determine the incidence of the injuries, as associated, for example, with sectors, trade groups,
enterprises, work processes and types of technology.

· Analyses with respect to monitoring developments in the incidence of accidents. The purpose
is to be warned of changes, both positive and negative. Measuring the effect of preventive
initiatives may be the result of such analyses, and increases in new types of accidents within a
specified area will constitute warning of new risk elements.

· Analyses to prioritize initiatives that call for high degrees of risk measurement, which in turn
involve calculating the frequency and seriousness of accidents. The goal is to establish a basis for
prioritization to determine where it is more important to carry out preventive measures than
elsewhere.

· Analyses to determine how the accidents occurred and, especially, to establish both direct
and underlying causes. This information is then applied to the selection, elaboration and
implementation of concrete corrective action and preventive initiatives.

· Analyses for elucidation of special areas which have otherwise attracted attention (a sort of
rediscovery or control analyses). Examples include analyses of incidences of a special injury risk
or the discovery of a hitherto unrecognized risk identified in the course of examining an already
known risk.

These types of analyses can be carried out at several different levels, ranging from the individual
enterprise to the national level. Analyses at several levels will be necessary for preventive
measures. Analyses involving general accident incident rates, monitoring, warning and
prioritization will be carried out chiefly at higher levels, whereas analyses describing direct and
underlying accident causes will be conducted at lower levels. The results of the analyses will
accordingly be more specific at the individual level and more general at the higher level.

Phases of the Analysis

Irrespective of the level from which an analysis starts, it will usually have the following phases:

· identification of where the accidents occur at the general level selected

· specification of where the accidents occur at a more specific level within the general level

· determination of goals in view of the incidence (or frequency) and seriousness of the
accidents

· description of exposure sources or other harmful factors—that is, the direct causes of damage
and injury

· examination of the underlying causal relation and causal development.

Examples of different levels of analysis are given in figure 56.1 .

Figure 56.1 Different levels of accident analysis

Summary

Identification of accidents nationwide may provide knowledge of the sectors, trade groups,
technologies and working processes within which damages and injuries occur. The goal is solely
to identify where the accidents occurred. Measurement of accidents by frequency and
seriousness partly establishes where something is wrong in particular and partly indicates where
the risk has changed.

The type of workplace risk is established by descriptions of the types of accidents that take place
and the way in which they arise within the individual workplace areas. In this way, knowledge is
obtained of the exposure sources and other harmful factors present in the workplace in the event
that preventive measures—attention to safety conditions, awareness of risk, providing
opportunity for action and the appeal to the workers’ will—have proved insufficient to avert the
accident.

Identification, measurement and description of accidents together provide the basis for what is to
be done and who is to do it in order to reduce the risk. If, for example, specific exposure sources
can be linked to specific technologies, it will help determine what special safety measures are
necessary to control the risk. This information may also be used to influence manufacturers and
suppliers associated with the technology in question. If it can be demonstrated that frequent and
very serious accidents occur in connection with specific processes, the attempt may be made to
adjust the nature of the equipment, machinery, operations or work procedures that are associated
with these processes. Unfortunately, a typical feature of such initiatives and adjustments is that
an almost unambiguous monocausal correlation between accidents and causes is required, and
this is available for only a few cases.

Analyses of accidents within an enterprise may also be carried out from a general to a more
specific level. However, the problem often is to assemble a sufficiently extensive database. If
accident injury data covering a number of years are gathered at an enterprise (including
information regarding minor injuries and near accidents), it will be possible to establish a useful
database even at this level. The overall analysis of the enterprise will show whether there are
special problems in specific sections of the enterprise, or in connection with specific tasks or
with the use of specific types of technology. The detailed analysis will then show what is wrong
and thus lead to an evaluation of preventive measures.

If workers’ conduct within a sector, trade group or enterprise, or the conduct of an individual is
to be influenced, knowledge regarding many accidents is required in order to increase workers’
awareness. At the same time, information must be made available about the factors which
increase the probability of accidents and about known possibilities of action that may minimize
the risk of damage or injury. At this point, safety becomes a matter of motivating those
responsible for people’s conduct at the level of a given sector, an industrial organization, a trade
organization, the employer or the employee.

THEORY OF ACCIDENT CAUSES

Abdul Raouf

Accidents are defined as unplanned occurrences which result in injuries, fatalities, loss of
production or damage to property and assets. Preventing accidents is extremely difficult in the
absence of an understanding of the causes of accidents. Many attempts have been made to
develop a prediction theory of accident causation, but so far none has been universally accepted.
Researchers from different fields of science and engineering have been trying to develop a theory
of accident causation which will help to identify, isolate and ultimately remove the factors that
contribute to or cause accidents. In this article, a brief outline of various accident causation
theories is presented, followed by a structure of accidents.

Accident Causation Theories

The domino theory

According to W.H. Heinrich (1931), who developed the so-called domino theory, 88% of all
accidents are caused by unsafe acts of people, 10% by unsafe actions and 2% by “acts of God”.
He proposed a “five-factor accident sequence” in which each factor would actuate the next step
in the manner of toppling dominoes lined up in a row. The sequence of accident factors is as
follows:
1. ancestry and social environment

2. worker fault

3. unsafe act together with mechanical and physical hazard

4. accident

5. damage or injury.

In the same way that the removal of a single domino in the row would interrupt the sequence of
toppling, Heinrich suggested that removal of one of the factors would prevent the accident and
resultant injury; with the key domino to be removed from the sequence being number 3.
Although Heinrich provided no data for his theory, it nonetheless represents a useful point to
start discussion and a foundation for future research.

Multiple causation theory

Multiple causation theory is an outgrowth of the domino theory, but it postulates that for a single
accident there may be many contributory factors, causes and sub-causes, and that certain
combinations of these give rise to accidents. According to this theory, the contributory factors
can be grouped into the following two categories:

Behavioural. This category includes factors pertaining to the worker, such as improper attitude,
lack of knowledge, lack of skills and inadequate physical and mental condition.

Environmental. This category includes improper guarding of other hazardous work elements and
degradation of equipment through use and unsafe procedures.

The major contribution of this theory is to bring out the fact that rarely, if ever, is an accident the
result of a single cause or act.

The pure chance theory

According to the pure chance theory, every one of any given set of workers has an equal chance
of being involved in an accident. It further implies that there is no single discernible pattern of
events that leads to an accident. In this theory, all accidents are treated as corresponding to
Heinrich’s acts of God, and it is held that there exist no interventions to prevent them.

Biased liability theory

Biased liability theory is based on the view that once a worker is involved in an accident, the
chances of the same worker becoming involved in future accidents are either increased or
decreased as compared to the rest of workers. This theory contributes very little, if anything at
all, towards developing preventive actions for avoiding accidents.
Accident proneness theory

Accident proneness theory maintains that within a given set of workers, there exists a subset of
workers who are more liable to be involved in accidents. Researchers have not been able to
prove this theory conclusively because most of the research work has been poorly conducted and
most of the findings are contradictory and inconclusive. This theory is not generally accepted. It
is felt that if indeed this theory is supported by any empirical evidence at all, it probably accounts
for only a very low proportion of accidents without any statistical significance.

The energy transfer theory

Those who accept the energy transfer theory put forward the claim that a worker incurs injury or
equipment suffers damage through a change of energy, and that for every change of energy there
is a source, a path and a receiver. This theory is useful for determining injury causation and
evaluating energy hazards and control methodology. Strategies can be developed which are either
preventive, limiting or ameliorating with respect to the energy transfer.

Control of energy transfer at the source can be achieved by the following means:

· elimination of the source

· changes made to the design or specification of elements of the work station

· preventive maintenance.

The path of energy transfer can be modified by:

· enclosure of the path

· installation of barriers

· installation of absorbers

· positioning of isolators.

The receiver of energy transfer can be assisted by adopting the following measures:

· limitation of exposure

· use of personal protective equipment.

The “symptoms versus causes” theory

The “symptoms versus causes” theory is not so much a theory as an admonition to be heeded if
accident causation is to be understood. Usually, when investigating accidents, we tend to fasten
upon the obvious causes of the accident to the neglect of the root causes. Unsafe acts and unsafe
conditions are the symptoms—the proximate causes—and not the root causes of the accident.

Structure of Accidents

The belief that accidents are caused and can be prevented makes it imperative for us to study
those factors which are likely to favour the occurrence of accidents. By studying such factors, the
root causes of accidents can be isolated and necessary steps can be taken to prevent the
recurrence of the accidents. These root causes of accidents can be grouped as “immediate” and
“contributing”. The immediate causes are unsafe acts of the worker and unsafe working
conditions. The contributing causes could be management-related factors, the environment and
the physical and mental condition of the worker. A combination of causes must converge in order
to result in an accident.

Figure 56.2 shows the structure of accidents, including the details of immediate causes,
contributing causes, types of accidents and results of accidents. This accounting is not exhaustive
by any means. However, an understanding of the “cause and effect” relation of the accident-
causing factors is required before continuous improvement of safety processes can be
undertaken.

Figure 56.2 Structure of accidents

Summary

Accident causation is very complex and must be understood adequately in order to improve
accident prevention. Since safety lacks a theoretical base, it cannot be regarded as being a
science yet. This fact should not discourage us, as most of the scientific disciplines—
mathematics, statistics and so on—passed through a similarly tentative phase at one time or the
other. Accident causation study holds great promise for those who are interested in developing
the pertinent theory. At present, theories of accident causation are conceptual in nature and, as
such, are of limited use in preventing and controlling accidents. With such a diversity of theories,
it will not be difficult to understand that there does not exist one single theory that is considered
right or correct and is universally accepted. These theories are nonetheless necessary, but not
sufficient, for developing a frame of reference for understanding accident occurrences.

HUMAN FACTORS IN ACCIDENT MODELLING

Anne-Marie Feyer and Ann M. Williamson

Human factors are a major component of the causes of accidents in the workplace. Estimates of
the actual extent of the involvement vary markedly, but a study in the early 1980s of the causes
of all work-related fatalities occurring in Australia over three years revealed that behavioural
factors were involved in more than 90% of fatal accidents. In view of data like these, it is
important to have an understanding of the role of human factors in accidents. Traditional models
of accident causation placed superficial emphasis on human factors. Where human factors were
included, they were depicted as linked to error occurring in the immediate sequence of events
leading to the accident. A better understanding of how, why and when human factors become
involved in accidents enhances our ability to make predictions about the role of human factors
and helps to prevent accidents. A number of models have been put forward that attempt to
describe the part that human factors play in accidents.

Accident Causation Models

Recent models have extended the role of human factors beyond the immediate causal events
leading to the accident. Models now tend to include additional factors in the wider circumstances
of the accident. Figure 56.3 shows details of such an approach: For example, human factors,
such as work practices and supervision, can be included both as error in the event sequence
leading immediately to the accident and as pre-existing human factors contributing to the
accident event sequence. The two main components (contributing factors and event sequences)
of this human factors model should be envisaged as occurring on a notional time line on which
the order—contributing factors followed by a sequence of errors—is fixed, but the time base on
which they occur is not. Both of these components are essential parts of accident causation.

Figure 56.3 Model of accident causation

The Nature of Error

An essential component of accident prevention, therefore, is gaining an understanding of the

nature, timing and causes of error. One of the important and unique characteristics of error,
distinguishing it from other factors involved in accidents, is that error is a normal part of
behaviour. Error plays a fundamental role in learning new skills and behaviours and in
maintaining those behaviours. Through testing the boundaries of interactions with the
environment, and consequently making errors, humans learn just what the boundaries are. This is
essential not only for learning a new skill but also for updating and maintaining ones they have
already learned. The degree to which humans test the boundaries of their skills is related to the
level of risk that they are prepared to accept.

It seems that errors are a constant feature of all behaviour. Studies show also that they occur in
the causes of approximately two-thirds of work-related fatal accidents. It is essential therefore to
develop some ideas about the form they are likely to take, and when and why they might occur.
While there are many aspects of human error that are not yet understood, our current level of
understanding allows some predictions to be made about error types. Knowledge of these types
of error will, it is to be hoped, guide our efforts to prevent error or at least to modify the adverse
consequences of error.

One of the most important features of the nature of error is that it is not a unitary phenomenon.
Even though traditional accident analysis often treats error as if it were a singular entity which
cannot be dissected further, there are a number of ways that errors can occur. Errors differ
depending on the information-processing function being challenged. For example, errors can
take the form of false sensations due to poor or degraded stimulation of the sensory organs,
attentional failures due to the demands of prolonged or very complex stimulation from the
environment, various types of memory lapses, errors of judgement and reasoning errors. All of
these types of errors are distinguishable in terms of the context or task characteristics in which
they occur. They signify breakdown in different information-processing functions and
consequently would require different approaches to overcoming each of them.

Different types of error can also be distinguished with respect to skilled and unskilled behaviour.
Training is often said to be a solution to problems of human error since skilled behaviour means
that the required sequence of actions can be performed without conscious, constant attention and
feedback, requiring only intermittent conscious checking to ensure that the behaviour is on track.
The advantages of skilled behaviour are that once triggered, it requires little effort from the
operator. It allows other activities to be undertaken at the same time (for instance, one can drive
an automobile and talk at the same time) and allows the operator to plan for future aspects of the
task. Furthermore, skilled behaviour is usually predictable. Unfortunately, while greater skill
reduces the likelihood of many types of error, it increases the likelihood of others. Errors during
skilled behaviour occur as absent-minded or unintended actions or lapses and are distinct from
the mistakes which occur during unskilled behaviour. Skill-based errors tend to be associated
with switching in the nature of attentional control of the task. They can occur during the
conscious checking mode or they may be due to conclusion of similar patterns of skilled
behaviour.

A second characteristic of errors is that they are not novel or random. Error forms are limited.
They take similar forms in all types of functions. For example, “place losing” errors occur in
speech and perceptual tasks as well as in knowledge-related or problem-solving tasks. Similarly,
the timing and location of error in the accident causation sequence does not appear to be random.
An important characteristic of information processing is that it is expressed in the same way
regardless of the setting. This means that the error forms that occur in everyday life in the
kitchen, for example, occur in the same manner in the most high-risk industries. The
consequences of these errors, however, are very different and are determined by the setting in
which the error occurs, rather than by the nature of the error itself.

Models of Human Error

In the categorization of error and the development of models of human error, it is important to
take all aspects of error into account to the extent possible. The resulting categorization,
however, needs to be usable in practice. This is possibly the biggest constraint. What can be done
in developing a theory of accident causation can be very difficult to apply in practice. In
attempting to analyse the causes of an accident, or to predict the role of human factors in a
process, it is not possible to understand all aspects of human information processing which
contributed or might contribute. It may never be possible, for example, to know the role of
intention before an accident occurred. Even afterwards, the very fact that the accident had
occurred can change a person’s recall of the events surrounding it. The error categorizations that
have been most successful to date therefore focus on the nature of the behaviour that was
performed at the time the error occurred. This allows error analysis to be relatively objective and
as reproducible as possible.
These categorizations of error distinguish between those occurring during skilled behaviour
(slips, lapses or unintended acts) and those occurring during unskilled or problem-solving
behaviour (mistakes).

Slips or skill-based errors are defined as unintended errors occurring when the behaviour is a
highly practised routine or automatic in nature.

Mistakes have been further categorized into two types:

· rule-based errors, which occur when the behaviour requires the application of rules

· knowledge-based errors, which occur during problem solving when the person has no skill or
rule to apply.

This means that knowledge-based errors occur through lack of expertise, rule-based errors
through the failure to apply the expertise appropriately, and skill-based errors through a
disruption of the execution of the programme of actions, usually due to changes in attentional
level (Rasmussen 1982).

Application of these categories in a population study of work-related fatal accidents showed that
they could be used reliably. The results showed that skill-based errors occurred most frequently
overall and that occurrences of the three error types were distributed differently across the event
sequence. Skill-based errors, for example, occurred most commonly as the last event
immediately before the accident (79% of fatalities). Since, at this point, there is little time for
recovery, their consequences may be more severe. Mistakes, on the other hand, appear to be
distributed earlier in the accident sequence.

Human Factors in the Wider Circumstances of Accidents

Elaboration of the involvement of human factors other than human error in the circumstances
immediately surrounding the accident represents a major advance in understanding accident
genesis. While there is no question that error is present in most accident sequences, human
factors are also involved in a broader sense, taking the form, for example, of standard operating
work procedures and the influences that determine the nature and acceptability of work
procedures, including the earliest decisions of management. Clearly, flawed work procedures and
decisions are related to error since they involve errors of judgement and reasoning. However,
flawed work procedures are distinguished by the characteristic that the errors of judgement and
reasoning have been permitted to become standard ways of operating, since, having no
immediate consequences, they do not make their presence urgently felt. They are, nevertheless,
recognizable as unsafe work systems with fundamental vulnerabilities that provide the
circumstances which may later, unintentionally, interact with human action and lead directly to
accidents.

In this context, the term human factors covers a wide range of elements involved in the
interaction between individuals and their working environment. Some of these are direct and
observable aspects of the ways in which work systems function that do not have immediate
adverse consequences. Design, use and maintenance of equipment, the provision, use and
maintenance of personal protective and other safety equipment and standard operating
procedures originating from management or workers, or both, are all examples of such ongoing
practices.

These observable aspects of human factors in system functioning are to a large extent
manifestations of the overall organizational setting, a human element even more removed from
direct involvement in accidents. Characteristics of organizations have been collectively termed
organizational culture or climate. These terms have been used to refer to the set of goals and
beliefs an individual holds and the impact of the organization’s goals and beliefs on those of the
individual. Ultimately, the collective or norm values, reflecting the characteristics of the
organization, are likely to be influential determinants of attitude and motivation for safe
behaviour at all levels. The level of risk tolerated in a work setting, for example, is determined
by such values. Thus, the culture of any organization, clearly reflected in its work system and the
standard operating procedures of its workers, is a crucial aspect of the role of human factors in
accident causation.

The conventional view of accidents as a number of things suddenly going wrong at the time and
the place of the accident, concentrates attention on the overt measurable event at the time of the
accident. In fact, errors occur in a context which itself may allow the unsafe act or error to have
its consequences. In order to reveal accident causes that originate in pre-existing conditions in
work systems, we need to take into account all of the various ways in which the human element
can contribute to accidents.This is perhaps the most important consequence of taking a broad
view of the role of human factors in accident causation. Flawed decisions and practices in work
systems, while not having an immediate impact, act to create the setting conducive to operator
error—or to the error’s having consequences—at the time of the accident.

Traditionally, organizational aspects of accidents have been the most neglected aspect of accident
analysis design and data collection. Because of their distant relationship in time from the
occurrence of the accident, the causal link between accidents and organizational factors has often
not been obvious. Recent conceptualizations have specifically structured analysis and data
collection systems in such a way as to incorporate the organizational components of accidents.
According to Feyer and Williamson (1991), who used one of the first systems designed to
specifically include the organizational contribution to accidents, a considerable proportion of all
occupational fatalities in Australia (42.0%) involved pre-existing and ongoing unsafe work
practices as a causal factor. Waganaar, Hudson and Reason (1990), using a similar theoretical
framework in which the organizational contribution to accidents was recognized, argued that
organizational and managerial factors constitute latent failures in work systems that are
analogous to resident pathogens in biological systems. Organizational flaws interact with
triggering events and circumstances in the immediate circumstances surrounding accidents much
as resident pathogens in the body combine with triggering agents such as toxic factors to bring
about disease.

The central notion in these frameworks is that organizational and managerial flaws are present
long before the onset of the accident sequence. That is, they are factors which have a latent or
delayed-action effect. Thus, to understand how accidents occur, how people contribute to them
and why they behave the way that they do, it is necessary to ensure that analysis does not begin
and end with the circumstances that most directly and immediately lead to harm.

The Role of Human Factors in Accidents and Accident Prevention

In acknowledging the potential aetiological significance of the wider circumstances surrounding

the accident, the model best describing accident causation has to take into account the relative
timing of elements and how they relate to each other.

First, causal factors vary in terms of their causal importance, and also in terms of their temporal
importance. Furthermore, these two dimensions can vary independently; that is, causes can be
important because they occur very close in time to the accident and therefore they reveal
something about the time of the accident, or they can be important because they are a prime
cause underlying the accident, or both. By examining both the temporal and causal importance of
factors involved in the wider circumstances as well as the immediate circumstances of the
accident, analysis focuses on why the accident happened, rather than just describing how it
happened.

Second, accidents are generally agreed to be multicausal. Human, technical and environmental
components in the work system can interact in critical ways. Traditionally, accident analysis
frameworks have been limited in terms of the range of categories defined. This, in turn, limits the
nature of the information obtained and so limits the range of options highlighted for preventive
action. When the wider circumstances of the accident are taken into consideration, the model has
to deal with an even more extensive range of factors. Human factors are likely to interact with
other human factors and also with non-human factors. The patterns of occurrences, co-
occurrences and inter-relationships of the wide range of possible different elements within the
causal network provides the most complete and therefore most informative picture of accident
genesis.

Third, these two considerations, the nature of the event and the nature of its contribution to the
accident, interact. Although multiple causes are always present, they are not equivalent in role.
Accurate knowledge of the role of factors is the essential key to understanding why an accident
happens and how to prevent it from recurring. For example, immediate environmental causes of
accidents may have their impact because of earlier behavioural factors in the form of standard
operating procedures. Similarly, pre-existing aspects of work systems may provide the context in
which routine errors committed during skill-based behaviour can precipitate an accident with
harmful consequences. Normally these routine errors would have benign consequences. Effective
prevention would be best served if it were targeted towards the latent underlying causes, rather
than the immediately precipitating factors. This level of understanding of the causal network and
how it influences outcome is possible only if all types of factors are included for consideration,
their relative timing is examined and their relative importance is determined.

Despite the potential for an almost infinite variety in the ways that human action can directly
contribute to accidents, relatively few patterns of causal pathways account for the majority of
accident causation. In particular, the range of underlying latent conditions which set the scene for
later human and other factors to have their effect are limited predominantly to a small number of
aspects of work systems. Feyer and Williamson (1991) reported that only four patterns of factors
accounted for the causes of approximately two-thirds of all occupational fatalities in Australia
over a 3-year period. Not surprisingly, almost all of these involved human factors at some point.

Summary

The nature of human involvement varies as to type and timing and as to its importance in terms
of causing the accident (Williamson and Feyer 1990). Most commonly, human factors in the
form of a limited range of pre-existing, flawed work systems create the underlying prime causes
of the fatal accidents. These combine with later lapses during skilled performance or with
hazards in environmental conditions to precipitate the accident. These patterns illustrate the
layered role typical of the involvement of human factors in accident genesis. To be of use in
preventive strategy formulation, however, the challenge is not to simply describe the various
ways in which the human element is involved but rather to identify where and how it may be
possible to intervene most effectively. This is possible only if the model used has the capacity to
describe accurately and comprehensively the complex network of interrelated factors involved in
accident causation, including the nature of the factors, their relative timing and their relative
importance.

ACCIDENT MODELS: RISK HOMEOSTASIS

Gerald J.S. Wilde

Give me a ladder that is twice as stable, and I will climb it twice as high. But give me a cause for
caution, and I’ll be twice as shy. Consider the following scenario: A cigarette is invented that
causes half the frequency of smoking-related deaths per cigarette smoked as compared to
present-day cigarettes, but in all other ways it is indistinguishable. Does this constitute progress?
When the new cigarette replaces the current one, given that there is no change in people’s desire
to be healthy (and that this is the only factor inhibiting smoking), smokers will respond by
smoking twice as much. Thus, although the death rate per cigarette smoked is cut in half, the
death risk due to smoking remains the same per smoker. But this is not the only repercussion: the
availability of the “safer” cigarette leads fewer people to stop smoking than presently is the case
and seduces more current non-smokers to yield to the temptation to smoke. As a consequence,
the smoking-related death rate in the population increases. However, as people are willing to take
no more risks with their health and lives than they see fit in exchange for the satisfaction of other
desires, they will cut down on other, less appealing, unsafe or unhealthy habits. The end result is
that the lifestyle-dependent death rate remains essentially the same.

The above scenario illustrates the following basic premises of risk homeostasis theory (RHT)
(Wilde 1988; 1994):

The first is the notion that people have a target level of risk—that is, the level of risk they accept,
tolerate, prefer, desire or choose. The target level of risk depends on perceived benefits and
disadvantages of safe and unsafe behaviour alternatives, and it determines the degree to which
they will expose themselves to safety and health hazards.
The second premise is that the actual frequency of lifestyle-dependent death, disease and injury
is maintained over time through a closed-loop, self-regulating control process. Thus, fluctuations
in the degree of caution people apply in their behaviour determine the ups and downs in the loss
to their health and safety. Moreover, the ups and downs in the amount of actual lifestyle-
dependent loss determine the fluctuations in the amount of caution people exercise in their
behaviour.

Finally, the third premise holds that the level of loss to life and health, in so far as this is due to
human behaviour, can be decreased through interventions that are effective in reducing the level
of risk people are willing to take—that is, not through measures of the “safe cigarette” variety or
other such efforts towards a “technological fix” of the problem, but by means of programmes
that enhance people’s desire to be alive and healthy.

The Risk Homeostasis Theory of Accident Causation and Prevention

Among the many psychological contributions to the literature on occupational accidents and
disease, traffic accidents and lifestyle-dependent ill health, only a relatively few deal with
motivational factors in the causation and the prevention of these problems. Most of the
publications deal with variables such as permanent or semi-permanent traits (e.g., gender,
personality or experience), transient states (fatigue, blood-alcohol level), information overload or
underload (stress or boredom ), training and skills, environmental factors and workstation
ergonomics. It may be reasoned, however, that all variables other than motivational ones (i.e.,
those impinging upon the target level of risk) merely have a marginal influence upon the
frequency of accidents per operator-hour of task execution. Some, though, may well have a
favourable effect upon the accident rate per unit of productivity or per unit distance of mobility.

When applied, for instance, to road traffic, RHT posits that the traffic accident rate per time unit
of road-user exposure is the output of a closed-loop control process in which the target level of
risk operates as the unique controlling variable. Thus, in contrast with temporary fluctuations,
time-averaged accident risk is viewed as independent of factors such as the physical features of
the vehicle and road environment and of operator skills. Instead, it ultimately depends on the
level of accident risk accepted by the road-user population in exchange for the perceived benefits
received from motor-vehicle mobility in general (like driving a lot), and from specific risky acts
associated with that mobility in particular (like driving well in excess of the average speed).

Thus, it is reasoned that at any moment of time, vehicle operators, equipped with their perceptual
skills, perceive a certain level of accident risk and they compare this with the amount of accident
risk they are willing to accept. The level of the latter is determined by the pattern of trade-offs
between expected costs and benefits associated with the available alternatives for action. Thus,
the target level of risk is that level of risk at which the overall utility of manner and amount of
mobility is thought to maximize. The expected costs and benefits are a function of economic,
cultural and person-related variables, and their long-term, short-term and momentary
fluctuations. These control the target level of risk at any specific moment of time.

Whenever road users perceive a discrepancy between target risk and experienced risk in one
direction or the other, they will attempt to restore the balance through some behavioural
adjustment. Whether the balance is achieved or not depends upon the individual’s decision-
making and psychomotor skills. However, any action taken carries a certain likelihood of
accident risk. The sum total of all actions taken by the road users in a jurisdiction in a given time
period (like 1 year), produce the frequency and severity of the traffic accidents in that
jurisdiction. It is hypothesized that this accident rate has an influence (through feedback) upon
the level of accident risk perceived by the survivors and thus upon their subsequent actions and
subsequent accidents, and so forth. Thus, as long as the target level of risk remains unchanged,
accident toll and behavioural caution determine each other in a circular causal chain.

The Risk Homeostatic Process

This homeostatic process, in which the accident rate is both consequence and cause of changes in
operator behaviour, is modelled in figure 56.4 . The self-correcting nature of the homeostatic
mechanism can be recognized in the closed loop that runs from box e to box b, to box c, to box d,
and then back to box e. It may take some time for people to become aware of a change in the
accident rate (the feedback may be delayed, and this is symbolized by f). Note that box a is
located outside the closed loop, meaning that interventions that lower that target level of risk can
bring about a lasting reduction in the accident rate (box e).

Figure 56.4 Homeostatic model relating changes in accident loss to changes in operator
behaviour and vice versa, with the target level of risk as the controlling variable
The process described herein can be further and quite clearly explained by another example of
homeostatic regulation: the thermostatic control of the temperature in a house. The set
temperature (comparable to box a) on the thermostat is at any point in time being compared with
the actual temperature (box b). Whenever there is a difference between the two, there is a need
for adjustment (box c), which triggers an adjustment action (i.e., the provision of colder or
warmer air, box d). As a result, the air that is distributed through the house becomes colder (via
air conditioning) or warmer (via heating—box e), as desired. After some time (symbolized by f)
the air at the new temperature reaches the point set on the thermostat and gives rise to a new
temperature reading, which is compared with the set-point temperature (box a), and so on.

The house temperature will show major fluctuations if the thermometer is not very sensitive. The
same thing will happen when the adjustment action is slow to set in, either due to inertia of the
switching mechanism or to a limited capacity of the heating/cooling system. Note, however, that
these deficiencies will not alter the time-averaged temperature in the house. Note too that the
desired temperature (analogous to box a in figure 56.4) is the only factor outside the closed loop.
Resetting the thermostat to a new target temperature will produce durable changes in the time-
averaged temperature. Just as a person chooses a target level of risk on the basis of the perceived
benefits and costs of safe and risky behaviour alternatives, so is the target temperature selected in
consideration of the pattern of expected costs and benefits of higher or lower temperatures (e.g.,
energy expenditures and physical comfort). A lasting discrepancy between target risk and actual
risk can occur only in the case of consistent over- or under-estimation of risk, just as a
thermometer that produces a temperature reading that is consistently too high or too low will
cause real temperature to deviate systematically from target temperature.

Evidence in Support of the Model

It may be deduced from the model described above that the introduction of any accident
countermeasure that does not alter the target level of risk is followed by road users making an
estimate of its intrinsic effect upon safety—that is, the change in accident rate that would occur if
operator behaviour did not change in response to the new countermeasure. This estimate will
enter into the comparison between perceived and accepted level of risk and thus influence
subsequent adjustment behaviour. If the initial estimates are incorrect on average, a disturbance
in the accident rate will occur, but only temporarily, because of the correcting effect due to the
feedback process.

This phenomenon has been discussed in an OECD report. The greater opportunity for safety and
the increased level of skill may not be utilized for greater safety, but instead for improved
performance: “Behavioural adaptations of road users which may occur following the
introduction of safety measures in the transport system are of particular concern to road
authorities, regulatory bodies and motor vehicle manufacturers particularly in cases where such
adaptations may decrease the expected safety benefit” (OECD 1990). This report mentions
numerous examples, as follows:

Taxicabs in Germany equipped with anti-lock brake systems were not involved in fewer
accidents than taxis without these brakes, and they were driven in a more careless manner.
Increases in lane width of two-lane highways in New South Wales in Australia have been found
to be associated with higher driving speeds: a speed increase by 3.2 km/h for every 30 cm
additional lane width. This was found for passenger cars, while truck speed increased by about 2
km/h for every 30 cm in lane width. A US study dealing with the effects of lane-width reduction
found that drivers familiar with the road reduced their speed by 4.6 km/h and those unfamiliar by
6.7 km/h. In Ontario it was found that speeds decreased by about 1.7 km/h for each 30 cm of
reduction in lane width. Roads in Texas with paved shoulders as compared to unpaved shoulders
were driven at speeds at least 10% higher. Drivers have generally been found to move at a higher
speed when driving at night on roads with clearly painted edge markings.

Recently, a Finnish study investigated the effect of installing reflector posts along highways with
an 80 km/h speed limit. Randomly selected road sections which totalled 548 km were equipped
with these posts and compared with 586 km that were not. The installation of reflector posts
increased speed in darkness. There was not even the slightest indication that it reduced the
accident rate per km driven on these roads; if anything, the opposite happened (Kallberg 1992).

Numerous other examples could be mentioned. Seat-belt-wearing legislation has not been seen to
reduce traffic fatality rates (Adams 1985). Habitual non-users of seat-belts who were made to
buckle up, increased their moving speed and decreased their following distance (Janssen 1994).
Following the change-over from left- to right-hand traffic in Sweden and Iceland, there were
initially major reductions in the occurrence of serious accidents, but their rates returned to the
pre-existing trend when road users found out that the roads had not become as dangerous as they
thought at first (Wilde 1982). There have been major reductions in the accident rate per km
driven in the course of this century, but the traffic accident rate per head of population has not
shown a downward trend (when account is taken of periods of high unemployment in which the
target level of accident risk is reduced; Wilde 1991).

Motivation for Accident Prevention

Interestingly, most of the evidence for the phenomena that are postulated by RHT comes from
the area of road traffic, while the prospects this theory holds for accident prevention have largely
been confirmed in occupational settings. In principle, there are four ways in which workers and
drivers may be motivated to lower their target level of risk:

· Reduce the expected benefits of risky behaviour alternatives.

· Increase the expected costs of risky behaviour alternatives.

· Increase the expected benefits of safe behaviour alternatives.

· Decrease the expected costs of safe behaviour alternatives.

While some of these approaches have been found to be more effective than others, the notion that
safety may be enhanced by acting upon motivation has a long history, as is obvious from the
universal presence of punitive law.

Punishment

Although enforcement of punitive law is one of society’s traditional attempts at motivating

people towards safety, the evidence for its effectiveness has not been forthcoming. It suffers from
several other problems as well, some of which have been identified in the context of
organizational psychology (Arnold 1989).
First is the “self-fulfilling prophecy” effect of attribution. For example, labelling people with
undesirable characteristics may stimulate individuals to behave as if they had these
characteristics. Treat people as if they were irresponsible and eventually some will behave as if
they were.

Second, the emphasis is on process controls; i.e., on specific behaviours such as using a piece of
safety equipment or obeying the speed limit, instead of focusing on the end result, which is
safety. Process controls are cumbersome to design and implement, and they can never totally
encompass all undesirable specific behaviours of all people at all times.

Third, punishment brings negative side-effects. Punishment creates a dysfunctional

organizational climate, marked by resentment, uncooperativeness, antagonism and even
sabotage. As a result, the very behaviour that was to be prevented may in fact be stimulated.

Encouragement

In contrast to punishment, incentive programmes have the effect for which they are intended, as
well as the positive side-effect of creating a favourable social climate (Steers and Porter 1991).
The effectiveness of incentives and recognition programmes in enhancing safety has been clearly
established. In a recent review of over 120 published evaluations of different types of
occupational accident prevention, incentives and recognition were generally found more
effective towards safety than engineering improvements, personnel selection and other types of
intervention which included disciplinary action, special licensing, and exercise and stress-
reduction programmes (Guastello 1991).

Behavioural Adaptation

According to risk homeostasis theory, the accident rate per person-hour of task performance or
the annual accident rate per head of population do not primarily depend upon a person’s ability to
be safe, nor upon the opportunity to be safe, but instead upon that person’s desire to be safe.
Thus, it is reasoned that, although education and engineering may provide the ability or the
opportunity for greater safety, these approaches to accident prevention will fail to reduce the
accident rate per hour, because they do not reduce the amount of risk people are willing to take.
The response to these interventions, therefore, will usually take the form of some behavioural
adjustment in which the potential safety advantage is in fact consumed as an addition to
performance in terms of greater productivity, more mobility and/or higher speed of mobility.

This can be explained as the consequence of a homeostatic control process in which the degree
of behavioural caution determines the accident rate and the accident rate determines the extent of
caution in operator behaviour. In this closed-loop process, the target level of risk is the only
independent variable that ultimately explains the accident rate. The target level of risk depends
on the person’s perception of the advantages and disadvantages of various action alternatives. To
maintain that safety is its own reward is to ignore the fact that people knowingly take risks for
various contingencies that are open to modification.
Therefore, of all accident countermeasures that are currently available, those that enhance
people’s motivation towards safety seem to be the most promising. Furthermore, of all
countermeasures that affect people’s motivation towards safety, those that reward people for
accident-free performance seem to be the most effective. According to McAfee and Winn’s
literature review: “The major finding was that every study, without exception, found that
incentives or feedback enhanced safety and/or reduced accidents in the workplace, at least in the
short term. Few literature reviews find such consistent results” (1989).

Summary

Of all possible schemes that reward people for accident-free performance, some promise better
results than others because they contain the elements that appear to enhance motivation towards
safety. Examples of empirical evidence for the risk-homeostatic process have been selected from
the larger information base (Wilde 1994), while the ingredients for effective incentive
programming have been discussed in greater detail in Chapter 60.16. The under-reporting of
accidents has been mentioned as the only identified negative side-effect of incentive schemes.
This phenomenon, however, is limited to minor accidents. It may be possible to conceal a broken
finger; it is more difficult to hide a corpse.

ACCIDENT MODELLING
Andrew R. Hale

Humans play important roles in most of the processes leading up to accidents and in the majority
of measures aimed at accident prevention. Therefore, it is vital that models of the accident
process should provide clear guidance about the links between human actions and accidents.
Only then will it be possible to carry out systematic accident investigation in order to understand
these links and to make predictions about the effect of changes in the design and layout of
workplaces, in the training, selection and motivation of workers and managers, and in the
organization of work and management safety systems.

Early Modelling

Up until the 1960s, modelling human and organizational factors in accidents had been rather
unsophisticated. These models had not differentiated human elements relevant to accidents
beyond rough subdivisions such as skills, personality factors, motivational factors and fatigue.
Accidents were seen as undifferentiated problems for which undifferentiated solutions were
sought (as doctors two centuries ago sought to cure many then undifferentiated diseases by
bleeding the patient).

Reviews of accident research literature that were published by Surry (1969) and by Hale and
Hale (1972) were among the first attempts to go deeper and offer a basis for classifying accidents
into types reflecting differentiated aetiologies, which were themselves linked to failures in
different aspects of the man-technology-environment relationships. In both of these reviews, the
authors drew upon the accumulating insights of cognitive psychology in order to develop models
presenting people as information processors, responding to their environment and its hazards by
trying to perceive and control the risks that are present. Accidents were considered in these
models as failures of different parts of this process of control that occur when one or more of the
control steps does not perform satisfactorily. The emphasis was also shifted in these models away
from blaming the individual for failures or errors, and towards focusing on the mismatch
between the behavioural demands of the task or system and the possibilities inherent in the way
behaviour is generated and organized.

Human Behaviour

Later developments of these models by Hale and Glendon (1987) linked them to the work of
Rasmussen and Reason (Reason 1990), which classified human behaviour into three levels of
processing:

· automatic, largely unconscious responses to routine situations (skill-based behaviour)

· matching learned rules to a correct diagnosis of the prevailing situation (rule-based

behaviour)

conscious and time-consuming problem solving in novel situations (knowledge-based

behaviour).

The typical failures of control differ from one level of behaviour to another, as do the types of
accidents and the appropriate safety measures used to control them. The Hale and Glendon
model, updated with more recent insights, is depicted in figure 56.5 . It is made up of a number
of building blocks which will be explained successively in order to arrive at the full model.

Figure 56.5 Individual problem solving in the face of danger

Link to deviation models

The starting point of the Hale and Glendon model is the way in which danger evolves in any
workplace or system. Danger is considered to be always present, but kept under control by a
large number of accident-prevention measures linked to hardware (e.g., the design of equipment
and safeguards), people (e.g., skilled operators), procedures (e.g., preventive maintenance) and
organization (e.g., allocation of responsibility for critical safety tasks). Provided that all relevant
dangers and potential hazards have been foreseen and the preventive measures for them have
been properly designed and chosen, no damage will occur. Only if a deviation from this desired,
normal state takes place can the accident process start. (These deviation models are dealt with in
detail in “Accident deviation models”.)

The task of the people in the system is to assure proper functioning of the accident-prevention
measures so as to avert deviations, by using the correct procedures for each eventuality, handling
safety equipment with care, and undertaking the necessary checks and adjustments. People also
have the task of detecting and correcting many of the deviations which may occur and of
adapting the system and its preventive measures to new demands, new dangers and new insights.
All these actions are modelled in the Hale and Glendon model as detection and control tasks
related to a danger.

Problem solving

The Hale and Glendon model conceptualizes the role of human action in controlling danger as a
problem-solving task. The steps in such a task can be described generically as in figure 56.6 .

Figure 56.6 Problem-solving cycle

This task is a goal-seeking process, driven by the standards set in step one in figure 56.6 . These
are the standards of safety which workers set for themselves, or which are set by employers,
manufacturers or legislators. The model has the advantage that it can be applied not only to
individual workers faced with imminent or future danger, but also to groups of workers,
departments or organizations aiming to control both existing danger from a process or industry
and future danger from new technology or products at the design stage. Hence safety
management systems can be modelled in a consistent way with human behaviour, allowing the
designer or evaluator of safety management to take an appropriately focused or a wide view of
the interlocking tasks of different levels of an organization (Hale et al. 1994).

Applying these steps to individual behaviour in the face of danger we obtain figure 56.7 . Some
examples of each step can clarify the task of the individual. Some degree of danger, as stated
above, is assumed to be present all the time in all situations. The question is whether an
individual worker responds to that danger. This will depend partly on how insistent the danger
signals are and partly on the worker’s own consciousness of danger and standards of acceptable
level of risk. When a piece of machinery unexpectedly glows red hot, or a fork-lift truck
approaches at high speed, or smoke starts seeping from under the door, individual workers skip
immediately to considering the need for action, or even to deciding what they or someone else
can do.

Figure 56.7 Behaviour in the face of danger

These situations of imminent danger are rare in most industries, and it is normally desirable to
activate workers to control danger when it is much less imminent. For example, workers should
recognize slight wear on the machine guard and report it, and realize that a certain noise level
will make them deaf if they are continuously exposed to it for some years. Designers should
anticipate that a novice worker could be liable to use their proposed new product in a way that
could be dangerous.

To do this, all persons responsible for safety must first consider the possibility that danger is or
will be present. Consideration of danger is partly a matter of personality and partly of
experience. It can also be encouraged by training and guaranteed by making it an explicit part of
tasks and procedures at the design and execution phases of a process, where it may be confirmed
and encouraged by colleagues and superiors. Secondly, workers and supervisors must know how
to anticipate and recognize the signs of danger. To ensure the appropriate quality of alertness,
they must accustom themselves to recognize potential accident scenarios—that is, indications
and sets of indications that could lead to loss of control and so to damage. This is partly a
question of understanding webs of cause and effect, such as how a process can get out of control,
how noise damages hearing or how and when a trench can collapse.

Just as important is an attitude of creative mistrust. This involves considering that tools,
machines and systems can be misused, go wrong, or show properties and interactions outside
their designers’ intentions. It applies “Murphy’s Law” (whatever can go wrong will go wrong)
creatively, by anticipating possible failures and affording the opportunity of eliminating or
controlling them. Such an attitude, together with knowledge and understanding, also helps at the
next step—that is, in really believing that some sort of danger is sufficiently likely or serious to
warrant action.

Labelling something as dangerous enough to need action is again partly a matter of personality;
for instance, it may have to do with how pessimistic a person may be about technology. More
importantly, it is very strongly influenced by the kind of experience that will prompt workers to
ask themselves such questions as, “Has it gone wrong in the past?” or “Has it worked for years
with the same level of risk with no accidents?” The results of research on risk perception and on
attempts to influence it by risk communication or feedback on accident and incident experience
are given in more detail in other articles.

Even if the need for some action is realized, workers may take no action for many reasons: they
do not, for example, think it is their place to interfere with someone else’s work; they do not
know what to do; they see the situation as unchangeable (“it is just part of working in this
industry”); or they fear reprisal for reporting a potential problem. Beliefs and knowledge about
cause and effect and about the attribution of responsibility for accidents and accident prevention
are important here. For example, supervisors who consider that accidents are largely caused by
careless and accident-prone workers will not see any need for action on their own part, except
perhaps to eliminate those workers from their section. Effective communications to mobilize and
coordinate the people who can and should take action are also vital at this step.

The remaining steps are concerned with the knowledge of what to do to control the danger, and
the skills needed to take appropriate action. This knowledge is acquired by training and
experience, but good design can help greatly by making it obvious how to achieve a certain
result so as to avert danger or to protect one’s self from it—for instance, by means of an
emergency stop or shutdown, or an avoiding action. Good information resources such as
operations manuals or computer support systems can help supervisors and workers to gain access
to knowledge not available to them in the course of day-to-day activity. Finally, skill and practice
determine whether the required response action can be carried out accurately enough and with
the right timing to make it successful. A difficult paradox arises in this connection: the more alert
and prepared that people are, and the more reliable the hardware is, the less frequently the
emergency procedures will be needed and the harder it will be to sustain the level of skill needed
to carry them out when they are called upon.

Links with behaviour based on skill, rules and knowledge

The final element in the Hale and Glendon model, which turns figure 56.7 into figure 56.5, is the
addition of the link to the work of Reason and Rasmussen. This work emphasized that behaviour
can be evinced at three different levels of conscious control—skill-based, rule-based and
knowledge-based—which implicate different aspects of human functioning and are subject to
different types and degrees of disturbance or error on account of external signals or internal
processing failures.

Skill-based. The skill-based level is highly reliable, but subject to lapses and slips when
disturbed, or when another, similar routine captures control. This level is particularly relevant to
the kind of routine behaviour that involves automatic responses to known signals indicating
danger, either imminent or more remote. The responses are known and practised routines, such
as keeping our fingers clear of a grinding wheel while sharpening a chisel, steering a car to keep
it on the road, or ducking to avoid a flying object coming at us. The responses are so automatic
that workers may not even be aware that they are actively controlling danger with them.

Rule-based. The rule-based level is concerned with choosing from a range of known routines or
rules the one which is appropriate to the situation—for example, choosing which sequence to
initiate in order to close down a reactor which would otherwise become overpressurized,
selecting the correct safety goggles to work with acids (as opposed to those for working with
dusts ), or deciding, as a manager, to carry out a full safety review for a new plant rather than a
short informal check. Errors here are often related to insufficient time spent matching the choice
to the real situation, to relying on expectation rather than observation to understand the situation,
or to being misled by outside information into making a wrong diagnosis. In the Hale and
Glendon model, behaviour at this level is particularly relevant to detecting hazards and choosing
correct procedures in familiar situations.

Knowledge-based. The knowledge-based level is engaged only when no pre-existing plans or

procedures exist for coping with a developing situation. This is particularly true of the
recognition of new hazards at the design stage, of detecting unsuspected problems during safety
inspections or of coping with unforeseen emergencies. This level is predominant in the steps at
the top of figure 56.5. It is the least predictable and least reliable mode of operation, but also the
mode where no machine or computer can replace a human in detecting potential danger and in
recovering from deviations.
Putting all the elements together results in figure 56.5, which provides a framework for both
classifying where failures occurred in human behaviour in a past accident and analysing what
can be done to optimize human behaviour in controlling danger in a given situation or task in
advance of any accidents.

ACCIDENT SEQUENCE MODELS

Ragnar Andersson

This article covers a group of accident models that all share the same basic design. The interplay
between human, machine and environment, and the development of this interplay into potential
hazards, dangers, damages and injuries, is envisaged by means of a sequence of questions
derived and listed in a logical order. This sequence is then applied in a similar manner at
different levels of analysis through the use of models. The first of these models was presented by
Surry (1969). A few years later, a modified version was presented by the Swedish Work
Environment Fund (1983) and received the fund’s sobriquet, WEF. A Swedish research team then
evaluated the WEF model and suggested some further developments resulting in a third model.

These models are herein described one by one, with comments on the reasons for the changes
and developments undertaken. Finally, a tentative synthesis of the three models is proposed.
Thus, a total of four models, with considerable similarities, are presented and discussed.
Although this may seem confusing, it illustrates the fact that there is no model that is universally
accepted as “The Model”. Among other things, there is an obvious conflict between simplicity
and completeness with regard to accident models.

Surry’s Model

In 1969, Jean Surry published the book Industrial Accident Research—A Human Engineering
Appraisal. This book contains a review of models and approaches predominantly applied in
accident research. Surry grouped the theoretical and conceptual frameworks she identified into
five different categories: (1) chain-of-multiple-events models, (2) epidemiological models, (3)
energy-exchange models, (4) behaviour models, and (5) systems models. She concluded that
none of these models is incompatible with any of the others; each simply stresses different
aspects. This inspired her to combine the various frameworks into one comprehensive and
general model. She made it clear, though, that her model should be regarded as provisional,
without any pretensions of finality.

In Surry’s view, an accident can be described by a series of questions, forming a sequential

hierarchy of levels, where the answers to each question determine whether an event turns out as
an accident or not. Surry’s model (see figure 56.8) reflects the principles of human information
processing, and is based upon the notion of an accident as a deviation from an intended process.
It has three principal stages, linked by two similar cycles.

Figure 56.8 Surry’s model

The first stage views human beings in their total environment, including all relevant
environmental and human parameters. The potential injury agent is also described at this stage. It
is assumed that, through the actions (or non-actions) of the individual, dangers grow out of such
an environment. For the purpose of analysis a “danger-build-up” cycle is constituted by the first
sequence of questions. If there are negative responses to any of these questions, the danger in
question will become imminent.

The second sequence of questions, the “danger-release cycle”, links the level of danger to
possible alternative outcomes when the danger is triggered. It should be noted that by following
different routes through the model, it is possible to distinguish between deliberate (or
consciously accepted) dangers and unintentional negative outcomes. The differences between
“accident-like” unsafe acts, mishaps (and so on) and completed accidents are also clarified by the
model.

The WEF Model

In 1973, a committee set up by the Swedish Work Environment Fund to review the state of
occupational accident research in Sweden launched a “new” model and promoted it as a
universal tool that should be employed for all research in this field. It was announced as a
synthesis of existing behavioural, epidemiological and systems models, and was also said to
encompass all relevant aspects of prevention. Reference was made to Surry, among others, but
without mention of the fact that the proposed model was almost identical to hers. Only a few
changes had been made, all for the purpose of improvement.

As often occurs when scientific models and perspectives are recommended by central agencies
and authorities, the model is subsequently adopted in only a few projects. Nevertheless, the
report issued by the WEF contributed to a rapidly rising interest in modelling and theory
development among Swedish and Scandinavian accident researchers, and several new accident
models emerged within a short period.

The point of departure in the WEF model (in contrast to Surry’s “man and environment” level)
lies in the concept of danger, here limited to “objective danger” as opposed to the subjective
perception of danger. Objective danger is defined as an integral part of a given system, and is
basically determined by the amount of resources available for investment in safety. Increasing a
system’s tolerance to human variability is mentioned as a way of reducing danger.

When an individual comes into contact with a certain system and its dangers, a process begins.
Due to system features and individual behaviour, a risk situation may arise. What is most
important (as regards the properties of systems) according to the authors, is how dangers are
indicated through various kinds of signals. Risk imminence is determined depending on the
individual’s perception, understanding and actions in relation to these signals.

The next sequence in the process, which is in principle identical to Surry’s, is directly related to
the event and whether it will lead to injury or not. If the danger is released, can it be, in fact,
observed? Is it perceived by the individual in question and is he or she able to avoid injury or
damage? Answers to such questions explain the kind and degree of harmful outcomes that
emanate from the critical period.

The WEF model (figure 56.9) was seen as having four advantages:

· It makes clear that safe working conditions presuppose the taking of action at the earliest
possible stage.

· It illustrates the importance of working with disturbances and near-accidents, as well as those
accidents that lead to damage or injury. Actual outcome is of less importance in a preventive
perspective.

· It describes the principles of human information processing.

· It provides for self-correcting safety systems by means of the feedback of results from
studied incidents.

Figure 56.9 The WEF model

Evaluation and Further Development

By the time the WEF report was issued, an epidemiological study on occupational accidents was
under way in the city of Malmö, Sweden. The study was based on a modified version of the so-
called Haddon Matrix, which cross-tabulates variables along two dimensions: time in terms of
pre-accident, accident and post-accident phases; and the epidemiological trichotomy of host,
agent (or vehicle/vector) and environment. Although such a model provides a good basis for data
collection, it was found by the research team to be insufficient to understand and explain the
causal mechanisms underlying accident and injury phenomena. The WEF model appeared to
represent a new approach, and was therefore received with great interest. It was decided to
conduct an immediate evaluation of the model by testing it on a random selection of 60 actual
cases of occupational accidents that had been previously thoroughly investigated and
documented by the Malmö group as a part of its ongoing study.

The results of the evaluation were summarized in four points:

· The model is not the comprehensive tool it was expected to be. Instead, it should be regarded
primarily as a behavioural model. The “danger” is given, and the analysis focuses on the
individual’s behaviour in relation to that danger. Consequently, preventive options derived from
such analysis are oriented to human factors rather than to equipment or environment. The
“danger” as such is hardly questioned within the framework of the model.

· The model does not take due consideration of technical or organizational constraints in the
work process. It creates an illusion of free choice between dangerous and safe alternatives. Some
dangers were actually found to be unavoidable by the individual worker, although they were
clearly avoidable by management. Hence, it becomes irrelevant and misleading to ask whether
people know how to avoid (and choose to avoid) something which is not really avoidable unless
they decide to quit their job.

· The model provides no insight into the important issue of why the dangerous activity was
necessary to begin with, and why it was performed by the specific individual. Sometimes
dangerous tasks can be made unnecessary; and sometimes they can be performed by other, more
appropriate persons with greater skills.

· The analysis is restricted to a single person, but many accidents occur in interaction between
two or more persons. However, it was suggested that this deficiency could be overcome by
combining the results of parallel analyses, each made from the perspective of one of the different
individuals involved.

Based on these remarks, the model was further developed by the research group in Malmö. The
most important innovation was the addition of a third sequence of questions to complement the
other two. This sequence was designed to analyse and explain the existence and nature of
“danger” as an inherent feature of a human-machine system. General principles from systems
theory and control technology were applied.
Moreover, the work process, thus understood in terms of human-machine-environment
interaction, should also be seen in the light of its organizational and structural contexts at both
company and societal levels. The need to take personal characteristics and motives for the actual
activity into consideration, as well as for the individual to carry out that activity, was also
indicated. (See figure 56.10.)

Figure 56.10 The WEF model developed by introduction of a new first sequence
Summary

In reconsidering these early models today, more than twenty years later, against the background
of progress made concerning theories and models in accident research, they still seem
surprisingly up-to-date and competitive.

The basic underlying assumption of the models—that accidents, as well as their causes, should
be seen as deviations from intended processes—is still a dominant perspective (see, inter alia,
Benner 1975; Kjellén and Larsson 1981).

The models make a clear distinction between the concept of injury as a health outcome and the
concept of accident as a preceding occurrence. Moreover, they demonstrate that an accident is
not just an “event”, but rather a process which can be analysed as a series of steps (Andersson
1991).

Many subsequent models have been designed as a number of “boxes”, organized in temporal or
hierarchical order, and indicating various temporal phases or levels of analysis. Examples of
these include the ISA model (Andersson and Lagerlöf 1983), the deviation model (Kjellén and
Larsson 1981) and the so-called Finnish model (Tuominen and Saari 1982). Such levels of
analysis are also clearly central to the models described here. But the sequence models also
propose a theoretical instrument for analysing the mechanisms which link these levels together.
Important contributions in this respect have been made by authors such as Hale and Glendon
(1987) from a human factors perspective, and Benner (1975) from a systems point of view.

As clearly emerges when comparing these models, Surry did not give a key position to the
concept of danger, as is done in the WEF model. Her starting point was the human-environment
interaction, reflecting a broader approach similar to that suggested by the Malmö group. On the
other hand, like the WEF committee, she did not refer to any further levels of analysis beyond
the worker and environment, such as organizational or societal levels. Further, the comments
from the Malmö study cited here in relation to the WEF model also seem relevant to Surry’s
model.

A modern synthesis of the three models presented above might include fewer details on human
information processing and more information on “upstream” conditions (further back in the
casual “flow”) at organizational and societal levels. Key elements in a sequence of questions
designed to address the relationship between the organizational and human-machine levels might
be derived from modern principles of safety management, involving quality assurance
methodologies (internal control and so on). Similarly, a sequence of questions for the connection
between societal and organizational levels might involve modern principles of systems-oriented
supervision and auditing. A tentative comprehensive model, based on Surry’s original design and
including these additional elements, is outlined in figure 56.11 .

Figure 56.11 Tentative comprehensive model on accident causation (based on Surry 1969
and descendants)
ACCIDENT DEVIATION MODELS
Urban Kjellén

An occupational accident may be regarded as an abnormal or unwanted effect of the processes in

an industrial system, or something which does not work as planned. Unwanted effects other than
personal injury are also possible, such as material damage, accidental release of pollution to the
environment, time delay or reduced product quality. The deviation model is rooted in systems
theory. When applying the deviation model, accidents are analysed in terms of deviations.

Deviations

The definition of deviations in relation to specified requirements coincides with the definition of
nonconformities in the International Organization for Standardization’s ISO 9000 series of
standards on quality management (ISO 1994). The value of a systems variable is classified as a
deviation when it falls outside a norm. Systems variables are measurable characteristics of a
system, and they can assume different values.

Norms

There are four different types of norms. These relate to: (1) specified requirements, (2) what has
been planned, (3) what is normal or usual and (4) what is accepted. Each type of norm is
characterized by the way it has been established and its degree of formalization.

Safety regulations, rules and procedures are examples of specified requirements. A typical
example of a deviation from a specified requirement is a “human error”, which is defined as a
transgression of a rule. The norms that relate to what is “normal or usual” and what is “accepted”
are less formalized. They are typically applied in industrial settings, where the planning is
oriented to outcome and the execution of the work is left to the discretion of the operators. An
example of a deviation from an “accepted” norm is an “incidental factor”, which is an unusual
event that may (or may not) result in an accident (Leplat 1978). A further example is an “unsafe
act”, which traditionally was defined as a personal action violating a commonly accepted safe
procedure (ANSI 1962).

Systems Variables

In the application of the deviation model, the set or range of values of systems variables is
divided into two classes, namely, normal and deviation. The distinction between normal and
deviation may be problematic. Differences of opinion about what is normal may arise, for
example, among workers, supervisors, management and systems designers. Another problem
relates to the lack of norms in work situations which have not been encountered before
(Rasmussen, Duncan and Leplat 1987). These differences of opinion and the lack of norms may
in themselves contribute to an increased risk.

The Time Dimension

Time is a basic dimension in the deviation model. An accident is analysed as a process rather
than as a single event or a chain of causal factors. The process develops through consecutive
phases, so that there is a transition from normal conditions in the industrial system to abnormal
conditions or a state of lack of control. Subsequently, a loss of control of energies in the system
occurs and the damage or injury develops. Figure 56.12 shows an example of the analysis of an
accident based on a model developed by the Occupational Accident Research Unit (OARU) in
Stockholm, in relation to these transitions.

Figure 56.12 Analysis of an accident at a construction site on the basis of the OARU model

Focus on Accident Control

Each accident model has a unique focus, which is linked to an accident-prevention strategy. The
deviation model puts the focus on the initial phase of the accident sequence, which is
characterized by the state of abnormal conditions or lack of control. Accident prevention is
accomplished through feedback where established information systems for production planning
and control and safety management are used. The aim is to conduct a smooth operation with as
few disturbances and improvisations as possible, so as to not increase the risk of accidents.

A distinction is made between corrective and preventive actions. Correction of deviations

coincides with the first order of feedback in Van Court Hare’s hierarchy of feedback, and does
not result in any organizational learning from the accident experiences (Hare 1967). Preventive
actions are accomplished through higher orders of feedback that involve learning. An example of
a preventive action is the development of new work instructions based on commonly shared
norms about safe work routines. In general, there are three different aims of preventive actions:
(1) to reduce the probability of deviations, (2) to reduce the consequences of deviations and (3)
to reduce the time from the occurrence of deviations to their identification and correction.

To illustrate the characteristics of the deviation model, a comparison is made with the energy
model (Haddon 1980) which directs the focus of accident prevention on the later phases of the
accident process—that is, the loss of control of energies and subsequent harm. Accident
prevention is typically accomplished through limitation or control of energies in the system or by
interposing barriers between the energies and the victim.

Taxonomies of Deviations

There are different taxonomies for the classification of deviations. These have been developed to
simplify the collection, processing and feedback of data on deviations. Table 56.1 presents an
overview.

Table 56.1 Examples of taxonomies for the classification of deviations

Theory or model and variable Classes

Process model
Duration Event/act, condition
Phase of the accident sequence Initial phase, concluding phase, injury phase
Systems theory
Subject-object (Act of) person, mechanical/physical condition
Systems ergonomics Individual, task, equipment, environment
Industrial engineering Materials, labour power, information, technical,
human, intersecting/parallel activities, stationary
guards, personal protective equipment
Human errors
Human actions Omission, commission, extraneous act, sequential
error, time error
Energy model
Type of energy Thermal, radiation, mechanical, electrical, chemical
Type of energy control system Technical, human
Consequences
Type of loss No significant time loss, degraded output quality,
equipment damage, material loss, environmental
pollution, personal injury
Extent of loss Negligible, marginal, critical, catastrophic

Source: Kjellén 1984.

A classical taxonomy of deviations is the distinction between “unsafe act of persons” and “unsafe
mechanical/physical conditions” (ANSI 1962). This taxonomy combines a classification with
respect to duration and the subject-object split. The OARU model is based on an industrial
engineering systems view (Kjellén and Hovden 1993) wherein each class of deviations is related
to a typical system for production control. It follows, for example, that deviations related to work
materials are controlled through material control, and technical deviations are controlled through
inspection and maintenance routines. Stationary guards are typically controlled through safety
inspections. Deviations that describe the loss of control of energies are characterized by the type
of energy involved (Haddon 1980). A distinction is also made between failures in human and
technical systems for the control of energies (Kjellén and Hovden 1993).

The Validity of the Deviation Concept

No general relationships exist between deviations and the risk of injury. Research results suggest,
however, that some types of deviations are associated with an increased risk of accidents in
certain industrial systems (Kjellén 1984). These include defective equipment, production
disturbances, irregular workload and tools used for unusual purposes. The type and amount of
energy that is involved in the uncontrolled energy flow are fairly good predictors of the
consequences.

Application of the Deviation Model

Data on deviations are collected in safety inspections, safety sampling, near-accident reporting
and accident investigations. (See figure 56.13.)

Figure 56.13 The coverage of different tools for use in safety practice
For example, Safety sampling is a method for the control of deviations from safety rules through
performance feedback to the workers. Positive effects of safety sampling on safe performance, as
measured by the risk of accidents, have been reported (Saari 1992).

The deviation model has been applied in the development of tools for use in accident
investigations. In the incidental factors analysis method, deviations of the accident sequence are
identified and arranged in a logical tree structure (Leplat 1978). The OARU model has been the
basis for the design of accident investigation forms and checklists and for the structuring of the
accident investigation procedure. Evaluation research shows that these methods support a
comprehensive and reliable charting and evaluation of deviations (see Kjellén and Hovden 1993
for a review). The deviation model has also inspired the development of methods for risk
analysis.

Deviation analysis is a risk analysis method and encompasses three steps: (1) the summarizing of
systems functions and operator activities and their division into subsections, (2) the examination
of each activity to identify possible deviations and to assess the potential consequences of each
deviation and (3) the development of remedies (Harms-Ringdahl 1993). The accident process is
modelled as illustrated by figure 56.12, and the risk analysis covers all three phases. Checklists
similar to those applied in accident investigations are used. It is possible to integrate this method
with design tasks; it is further effective in identifying needs for remedial actions.

Summary

Deviation models focus on the early part of the accident process, where there are disturbances in
the operation. Prevention is accomplished through feedback control in order to achieve a smooth
operation with few disturbances and improvisations that may result in accidents.

MAIM: THE MERSEYSIDE ACCIDENT INFORMATION

MODEL
Harry S. Shannon and John Davies

Generally speaking, the term accident is used to denote events resulting in undesired or
unplanned physical injury or damage; an accident model is a conceptual scheme applied to the
analysis of such events. (Some models may explicitly declare that “near accidents”—sometimes
known as “near misses”—are covered by the model; however, the distinction is not important to
this article.) Models of accidents can serve different purposes. First, they may provide a
conceptual understanding of how accidents occur. Second, models may be used to record and
store information on accidents. Third, they may provide a mechanism for investigating accidents.
These three aims are not entirely distinct, but form a useful means of categorization.

This article describes MAIM, the Merseyside Accident Information Model, which is most
naturally adapted to the second purpose—recording and storing accident information. Following
an outline of the rationale for MAIM, some early studies evaluating the model are described. The
article ends with recent progress with MAIM, including the use of “intelligent software” to
collect and analyse information on injury accidents.

Early Accident Modelling

In Heinrich’s model (1931), the causal sequence leading to an accident was likened to a sequence
of five falling dominoes, each of the first four being necessary before the final event could occur.
In a precursor to MAIM, Manning (1971) concluded that “the basic requirements of an
accidental injury are the presence of a host [a worker, for example] and an environmental object
which contributes to the accident. The host or the object or both move in relation to each other.”
Kjellén and Larsson (1981) developed their own model, which posited two levels: the accident
sequence and the underlying, determining factors. In a later paper, Kjellén and Hovden (1993)
described subsequent progress in the context of other literature and noted the need for “efficient
use of existing information from routine accident and near accident reports by means of a
powerful information retrieval system”. This has been achieved for MAIM.

Rationale for MAIM

There appears to be a substantial consensus that useful information on accidents should not
merely concentrate on the immediate circumstances of the damage or injury, but should also
include an understanding of the preceding chain of events and factors causing the accident
sequence to occur. Some early classification systems failed to achieve this. Understanding
objects, movements (of people or objects) and events were commonly mixed and successive
events were not distinguished.

A simple example illustrates the problem. A worker slips on a patch of oil, falls and strikes his or
her head on a machine and suffers a concussion. We can easily distinguish the (immediate) cause
of the accident (slipping on oil) and the cause of the injury (hitting the head on the machine).
Some classification systems, however, include the categories “falls of persons” and “striking
against objects”. The accident could be allocated to either of these, although neither describes
even the immediate cause of the accident (slipping on oil) or causal factors (such as how did the
oil get on the floor).

Essentially, the problem is that just one factor is considered in a multifactorial situation. An
accident does not always consist of a single event; there may be many. These points formed the
basis for the development of MAIM by Derek Manning, an occupational physician.

Description of MAIM

The centrepiece of the accident is the first unforeseen (undesired or unplanned) event involving
the damaged equipment or injured person (figure 56.14). This will not always be the first event
in the accident process described as a preceding event. In the example above, the slip counts as
the first unforeseen event of the accident. (Given the presence of oil patches on the floor, it is not
unforeseen that someone will slip on one and fall, but the person walking does not foresee this.)

Figure 56.14 The MAIM Accident Model

The behaviour of the equipment or person is described by the general activity at the time and a
more specific description of the type of corporal movement when the first event occurred.
Objects involved are described, and for those related to events, characteristics of objects include
position, movement and condition. On occasion, a second object which inter-relates with the first
object may be involved (for example, striking a chisel with a hammer).
As noted above, there may be more than one event and the second event may also have an object
(perhaps different) involved in it. Additionally, the equipment or person may make an additional
corporal movement, such as throwing out a hand to prevent or break a fall. These can be included
in the model. A third fourth or later event may occur before the sequence finally leads to an
injury. The model can be expanded in all directions by recording factors related to each
component. For example, branches from activities and corporal movements would record
psychological factors, medications or physical limitations of a worker.

In general, separate events may be easily distinguished intuitively, but a stricter definition is
useful: an event is an unexpected change, or lack of change, in the energy state of the situation.
(The term energy includes both kinetic and potential energy.) The first event is always
unexpected. Subsequent events may be expected, even inevitable, after the first event, but are
always unexpected before the accident. An example of unexpected lack of change of energy is
when a hammer being swung misses the nail at which it is aimed. The example of a worker who
slips on a patch of oil, falls and hits his or her head provides an illustration. The first event is
“foot slipped”—instead of remaining still, the foot acquires kinetic energy. The second event is
“fell”, when further kinetic energy is acquired. This energy is absorbed by the collision of the
worker’s head with the machine when the injury occurs and the sequence ends. This can be
“plotted” onto the model as follows:

1. 1st event: foot slipped on oil.

2. 2nd event: person fell.

3. 3rd event: head struck against machine.

Experience with MAIM

An earlier version of the MAIM model was used in a study of all 2,428 reported accidents in
1973 in a gearbox manufacturing plant on the grounds of an automobile company. (See Shannon
1978 for further details.) The operations included cutting and grinding of gears, heat treatment
and gearbox assembly. The cutting process produced sharp metal splinters and shavings, and oil
was used as a coolant. Purpose-designed forms were used to collect information. Each accident
was plotted independently onto the model by two people and discrepancies were resolved by
discussion. For each accident, the components were given numerical codes, so the data could be
stored on a computer and analyses performed. The following outlines some basic results and
presents an examination made what was learned specifically from the use of the model.

The accident rate was substantially reduced (by nearly 40%), apparently as a result of the study
being conducted. The researchers learned that because of the additional questioning that the
study called for (and the consequent time involved) many employees “could not be bothered” to
report minor injuries. Several items of evidence confirmed this:

1. The rate rose again in 1975 after the study ended.

2. The rate of lost-time injuries was unaffected.

3. Visits to the medical centre for non-industrial complaints were unaffected.

4. Accident rates on the rest of the grounds were unaffected.

Thus the reduced rate did indeed appear to be an artefact of reporting.

Another interesting finding was that there were 217 injuries (8%) for which the workers involved
could not be certain how or when they occurred. This was discovered because workers were
explicitly asked if they were sure of what happened. Typically, the injuries involved were cuts or
splinters, relatively common given the nature of work at this plant.

Of the remaining accidents, nearly half (1,102) consisted of just one event. Two- and three-event
accidents were successively less common, and 58 accidents involved four or more events. There
was a marked increase in the proportion of accidents resulting in lost time with an increase in the
number of events. One possible explanation is that there was an increase in kinetic energy with
each event, so that with more events, there was more energy to dissipate when the worker and the
object involved collided.

Further examination of differences between lost-time and non-lost-time accidents found very
marked differences in the distributions for separate components of the model. For example, when
the first event was “person slipped”, nearly a quarter of the accidents resulted in lost time; but for
“body punctured by”, only 1% did so. For combinations of components, such differences were
accentuated. For example, with respect to the final events and related objects, none of the 132
accidents in which the casualty was “punctured by” or “splintered” resulted in lost time, but
when the final event was “strained/sprained” with “no object involved”, 40% of the injuries
caused lost time.

These results contradicted the view that the severity of injury is largely a matter of luck and
prevention of all types of accidents would lead to a reduction of serious injuries. This means that
analysing all accidents and attempting to prevent the most common types would not necessarily
have an effect on those causing serious injuries.

A sub-study was conducted to assess the usefulness of information in the model. Several
potential uses of accident data were identified:

· to measure safety performance—the extent to which accidents in a plant, or area of a plant,

continue to occur over time

· to identify causes

· to identify errors (in the broadest meaning of the term)

· to check on control—that is, to see whether safety measures taken to prevent some type(s) of
accident are indeed effective
· to provide a basis of expertise, as knowledge of a wide range of accident situations and
circumstances might help provide accident prevention advice.

Three safety officers (practitioners) rated the usefulness of the verbal descriptions and the plotted
models for a series of accidents. Each rated at least 75 accidents on a scale from 0 (no useful
information) to 5 (perfectly adequate for use). For the majority of accidents, the ratings were
identical—that is, no information was lost in the transfer from the written descriptions to the
model. Where there was a loss of information it was mostly just one point on the 0 to 5 scale—
that is, only a small loss.

The information available, though, was rarely “perfectly adequate”. This was partly because the
safety officers were used to conducting detailed on-the-spot investigations, something not done
in this study because all reported accidents, both minor and more serious ones, were included. It
should be remembered, however, that the information plotted onto the models was taken directly
from written descriptions. Since relatively little information was lost, this suggested the
possibility of excluding the intermediate step. The more widespread use of personal computers
and availability of improved software make automated data collection possible—and allow
checklists to be used by way of insuring that all relevant information is obtained. A program has
been written for this purpose and has undergone some initial testing.

MAIM Intelligent Software

The MAIM model was used by Troup, Davies and Manning (1988) to investigate accidents
causing back injuries. A database was created on an IBM PC by coding results from patient
interviews conducted by an interviewer who was experienced with the MAIM model. The
analysis of interviews to obtain the MAIM description (figure 56.14) was done by the
interviewer and it was only at this stage that the data were entered into the database. While the
method was quite satisfactory, there were potential problems in making the method generally
accessible. In particular, two areas of expertise were required—interviewing skills and the
familiarity with the analysis needed to form the MAIM description of the accident.

Software was developed by Davies and Manning (1994a) to conduct a patient interview and
produce a database of accidents using the MAIM model. The purpose of the software was to
provide two areas of expertise—the interview and the analysis to form the MAIM event
structure. The MAIM software is, in effect, an intelligent “front end” to a database, and by 1991
it was sufficiently developed to be tested in a clinical environment. The MAIM software was
designed to interact with the patient by means of “menus”—the patient selects options from lists
which require only the use of cursor keys and the “Enter” key. The choice of an item from the list
of options affected to some extent the path through the interview and also had the effect of
recording information at the appropriate part of the MAIM description of the accident. This
method of data collection eliminated the need for spelling and typing skills and also gave a
repeatable and consistent interview.

The event structure of the MAIM model uses verbs and objects to form simple sentences. Verbs
in events can be associated with different accident scenarios, and this property of the model
forms the basis for the construction of a set of linked questions that form an interview. Questions
are presented in such a way that at any stage only simple choices are needed, effectively breaking
the complex account of the accident into a set of simple descriptions. Once an event verb has
been identified, associated nouns can be found by locating the objects to form a sentence giving
the full detail of the description of the particular event. It is clear that this strategy requires the
use of an extensive dictionary of objects which can be searched quickly and efficiently.

The Home Accident Surveillance System (HASS) (Department of Trade and Industry 1987)
monitors objects involved in accidents, and the list of objects used by HASS was used as the
basis of an object dictionary for the MAIM software and was extended to include objects found
in the workplace. Objects can be grouped into classes, and with this structure a hierarchical menu
system can be defined—classes of objects form layers that correspond to menu lists. Thus a
linked list of associated objects can be used to locate individual items. As an example, the object
hammer could be found by selecting, in order: (1) tools, (2) hand tools and (3) hammer from
three successive menu lists. A given object could potentially be classified into several different
groups—for example, a knife could be associated with kitchen items, tools or sharp objects. This
observation was used to create redundant links in the object dictionary, allowing many different
paths to find the required object. The object dictionary currently has a vocabulary of about 2,000
entries covering work and leisure environments.

The MAIM interview also collects information on activities at the time of the accident, corporal
movements, the location of the accident, contributory factors, injuries and disability. All of these
elements can occur more than once in an accident, and this is reflected in the structure of the
underlying relational database which was used to record the accident.

At the end of the interview, several sentences describing events in the accident will have been
recorded and the patient is asked to put them in the correct order. In addition, the patient is asked
to link injuries with the recorded events. A summary of the information collected is then
presented on the screen of the computer for information.

An example of an accident summary as seen by the patient is shown in figure 56.15. This
accident has been superimposed on the MAIM diagram in figure 56.15 . Details relating to
factors and the location of the accident have been omitted.

Figure 56.15 Accident summary as recorded by patient interview

The first unforeseen or unintended event (first event) involving the injured person is usually the
first event in the accident sequence. For example, when a person slips and falls, the slip is
normally the first event in the accident sequence. If, on the other hand, a person is injured by a
machine because another person operates the machine before the victim is standing clear, the
first event involving the victim is “trapped by machine” but the first event in the accident
sequence is “other person operated machine prematurely”. In the MAIM software, the first event
in the accident sequence is recorded and it may arise either from the first event involving the
injured person or as a preceding event (figure 56.14). Theoretically, this way of viewing matters
may be unsatisfactory, but from the accident prevention point of view, it identifies the beginning
of the accident sequence, which can then be targeted to prevent similar accidents in the future.
(The term action of deviation is used by some authorities to describe the beginning of the
accident sequence, but it is not yet clear if this is always synonymous with the first event in the
accident.)

When the MAIM software was first used in a clinical setting it was clear that there were
problems in correctly appraising some types of “underfoot” accidents. The MAIM model
identifies the first unforeseen event as the starting point of the accident sequence. Consider two
similar accidents, one in which a worker intentionally steps onto an object which then breaks,
and a second accident in which a worker unintentionally steps onto an object which breaks. In
the first accident stepping on the object is a body movement and the first unforeseen event is the
object breaking. In the second accident stepping on the object is the first unforeseen event in the
accident. The resolution of these two scenarios is to ask, “Did you accidentally step on
something?” This demonstrates how important the correct design of the interview is in obtaining
accurate data. The analysis of these two accidents allows recommendations on accident
prevention as follows; the first accident could have been prevented by making the patient aware
that the object would break. The second accident could have been prevented by making the
patient aware that the object was an underfoot hazard.

The MAIM software has been tested successfully in three clinical settings, including a 1-year
project in the Accident and Emergency Department of the Royal Liverpool University Hospital.
Patient interviews took between 5 and 15 minutes, and on average two patients were interviewed
per hour. In all, 2,500 accidents were recorded. Work on publications based on these data is in
progress.

PRINCIPLES OF PREVENTION: THE PUBLIC HEALTH

APPROACH TO REDUCING INJURIES IN THE
WORKPLACE
Gordon S. Smith and Mark A. Veazie

A public health approach to occupational injury prevention is based on the assumption that injury
is a health problem, and as such can either be prevented or its consequences mitigated
(Occupational Injury Prevention Panel 1992; Smith and Falk 1987; Waller 1985). When a worker
falls from a scaffold, the tissue damage, internal haemorrhage, shock and death that follow are,
by definition, a disease process—and also by definition a concern for public health professionals.
Just as malaria is defined as a disease whose causal agent is a specific protozoan, injuries are a
family of diseases caused by exposure to a particular form of energy (kinetic, electrical, thermal,
radiation or chemical) (National Committee for Injury Prevention and Control 1989). Drowning,
asphyxiation and poisoning are also considered injuries because they represent a relatively rapid
departure from the body’s structural or functional norm, as does acute trauma.

As a health problem, injuries are the leading cause of premature death (i.e., before age 65) in
most countries (Smith and Falk 1987; Baker et al. 1992; Smith and Barss 1991). In the United
States, for example, injury is the third leading cause of death following cardiovascular disease
and cancer, the leading cause of hospitalization under the age of 45, and an imposed economic
burden of 158 billion dollars in direct and indirect costs in 1985 (Rice et al. 1989). One out of
three nonfatal injuries and one out of six fatal injuries to working-aged persons in the United
States occur on the job (Baker et al. 1992). Similar patterns apply in most of the developed world
(Smith and Barss 1991). In middle- and low-income countries, a rapid and relatively unregulated
pace of industrialization may result in a nearly global pandemic of occupational injuries.

Public Health Models for Injury Control

The traditional practice of workplace safety usually focuses on minimizing risks and losses
within a single company. Public health practitioners engaged in occupational injury control are
interested not only in individual worksites but also in improving the health status of populations
in geographic areas that may be exposed to the hazards associated with multiple industries and
occupations. Some events such as workplace fatalities may be rare at individual plants, but by
studying all fatalities in a community, risk patterns and prevention policy may become evident.

Most models of public health practice are based on three elements: (1) assessment, (2)
development of prevention strategies, and (3) evaluation. Public health practice is usually
multidisciplinary and founded on the applied science of epidemiology. Epidemiology is the study
of the distribution and determinants of diseases and injuries in a population. The three main
applications of epidemiology are surveillance, aetiological research and evaluation.

Surveillance is “the ongoing and systematic collection, analysis and interpretation of health data
in the process of describing and monitoring a health event. This information is used for planning,
implementing and evaluating public health interventions and programs” (CDC 1988).

Aetiological research tests hypotheses regarding the determinants of disease and injuries through
the use of controlled, usually observational, studies.

Evaluation in both applied social sciences and epidemiology is “a process that attempts to
determine as systematically and objectively as possible the relevance, effectiveness and impact
of activities in light of their objectives” (Last 1988). Epidemiological evaluation usually entails
the use of controlled study designs to measure the effects of an intervention on the occurrence of
health-related events in a population.

The basic model of public health practice is described by a cycle of epidemiological surveillance,
research on causes, interventions (targeted to high-risk populations and specific to severe health
conditions), and epidemiological evaluation. Important modifications of this model include
community-oriented primary care (Tollman 1991), community-based health education and health
promotion (Green and Kreuter 1991), community health development (Steckler et al. 1993),
participatory action research (Hugentobler, Israel and Schurman 1992) and other forms of
community-oriented public health practice that rely on greater participation of communities and
labour—as opposed to government officials and industrial management—to define problems,
develop solutions and evaluate their effectiveness. Family farming, fishing and hunting, self-
employed work, many small business operations and work in the informal economy are all
primarily influenced by family and community systems and occur outside the context of an
industrial management system. Community-oriented public health practice is a particularly
viable approach to occupational injury prevention in these populations.

Outcomes of Interest

The public health approach to workplace safety moves from the concept of accident prevention
to a broader approach to injury control where the primary outcomes of interest are both the
occurrence and severity of injury. Injury is by definition physical damage due to the transfer of
energy. A transfer of mechanical energy can cause trauma, as in the case of a fall or automobile
crash. Thermal, chemical, electrical or radiation energy can cause burns and other injuries
(Robertson 1992). Not only is the occurrence of injury of interest to public health practitioners,
but so is the severity and long-term outcome of injury. Injury severity can be measured in several
dimensions, including anatomical (the amount and nature of tissue damage in various regions of
the body), physiological (how close to death the patient is, based on vital signs), disability,
impairment of quality of life, and indirect and direct costs. Of considerable importance to injury
epidemiologists is anatomical severity, often measured by the Abbreviated Injury Score and the
Injury Severity Scale (MacKenzie, Steinwachs and Shankar 1989). These measures can predict
survival and are a useful indicator of the energy transferred in severe events, but are not sensitive
enough to discriminate between severity levels among the relatively less severe, but much more
frequent occupational injuries such as sprains and strains.

Among the least useful, but most common measures of severity is days lost from work following
injury. From an epidemiological point of view, lost work days are often difficult to interpret
because they are a function of some unknown combination of disability, demands of the job,
availability of alternative light work, workplace policies such as sick leave, disability
qualification criteria and individual differences in pain tolerance, the propensity to work with
pain, and possibly the same factors that motivate attendance. More work is needed to develop
and validate more interpretable occupational injury severity measures, particularly anatomical
scales, disability scales and measures of impairment in the various dimensions of quality of life.

Unlike traditional safety practice, the public health community is not restricted to an interest in
unintentional (“accidental”) injuries and the events that cause them. Through looking at the
individual causes of fatalities in the workplace, it was found, for example, that in the United
States, homicide (an intentional injury) is the leading cause of death at work among women and
the third leading cause among men (Baker et al. 1992; Jenkins et al. 1993). Such fatalities are
very rare events in individual workplaces and thus their importance is often overlooked, as is the
fact that motor vehicle injuries are the single leading cause of fatal injuries on the job (figure
56.16). Based on these surveillance data, injuries and death due to violence in the workplace and
to motor vehicle crashes are priorities in the public health approach to occupational injury
prevention in the United States.

Figure 56.16 Leading causes of occupational injury death, United States 1980-1989

Assessment in Public Health

Assessment in public health is a multidisciplinary effort which involves surveillance, aetiological

research, and community and organizational needs assessment. The purpose of injury
surveillance is to identify high-risk populations, to identify injuries with significant public health
impact, to detect and monitor trends and to generate hypotheses. Surveillance programmes can
collect data on injury fatalities, non-fatal injuries, incidents with injury potential, and exposure to
hazards. Data sources for occupational injury surveillance include health care providers
(hospitals and physicians), death certificates, medical examiner/coroner reports, employer-based
reporting to departments of labour or health, workers’ compensation agencies, periodic surveys
of employers or households, and individual corporate records. Many of these reports and records
are required by law but often offer incomplete information due to a lack of coverage of all
workers, incentives to under-report, and a poor level of specificity in injury details.

In-depth investigations of individual incidents employ a variety of approaches which permit the
use of expert judgement to draw conclusions about what caused the event and how it could have
been prevented (Ferry 1988). Preventive action is often taken based on the findings from a single
incident. Rate-based surveillance, on the other hand, has a broader significance than the
individual incident. Indeed, some information from traditional accident investigations can have
little epidemiological interpretation when aggregated into statistics. Accident investigation in the
tradition of Heinrich (1959), for example, often produces statistics indicating that in excess of
80% of industrial injuries are caused solely by unsafe acts. From an epidemiological point of
view, such statistics are difficult to interpret except as a survey of value judgements, and are
rarely included in rate-based surveillance. Many other risk factors such as shift work, work
stress, poorly designed work environments and so on, are often not included in investigation
forms and thus are not considered in examining statistics on injury causes.

One of the primary purposes of surveillance is to identify high-risk groups in order to target
further investigation and prevention. Injuries, like infectious and chronic diseases, have distinct
patterns of risk that vary by age, sex, race, geographic region, industry and occupation (Baker et
al. 1992). In the United States during the 1980s, for example, surveillance by the National
Institute for Occupational Safety and Health (NIOSH) revealed the following high-risk groups
for occupational injury fatality: males; elderly workers; blacks; workers in rural Western states;
transportation and materials moving occupations; farming, forestry and fishing occupations; and
labourers (Jenkins et al. 1993). Another important aspect of surveillance is to identify the types
of injury that occur with the greatest frequency and severity, such as the leading external causes
of work-related injury fatality in the United States (see figure 56.16). At an individual company
level, problems such as homicide and motor vehicle fatalities are rare events and thus are seldom
addressed by many traditional safety programmes. However, national surveillance data identified
these among the three leading causes of occupational injury fatalities. Assessing the impact of
non-fatal injuries requires the use of severity measures in order to make meaningful
interpretations. For example, back injuries are a common cause of lost days of work, but an
infrequent cause of hospitalization for work-related injuries.

Surveillance data alone do not represent a complete assessment in the public health tradition.
Particularly in community-oriented public health practice, needs assessment and community
diagnosis using surveys, focus groups and other techniques are important steps to assess what
problems workers or communities perceive are important, what are the prevalent attitudes,
intentions and barriers regarding the adoption of prevention measures, and how an organization
or community really functions. A community-based agricultural safety programme, for example,
might need to identify whether or not farmers perceive that tractor rollovers are a critical
problem, what barriers such as financial or time constraints may prevent the installation of
rollover protective structures, and through whom an intervention strategy should be implemented
(e.g., trade association, youth organization, organization of farm wives). In addition to a
diagnosis of the community, organizational needs assessment identifies an organization’s
capacity, workload and constraints to implement fully any already existing prevention
programmes such as the enforcement activities of a governmental department of labour (or
health) or the safety department of a large corporation.

Investigating the aetiology or causation of loss incidents and injuries is another step in the public
health approach to occupational injury control. Such studies of occupational disease have been
the mainstay of developing disease-control programmes in the workplace. Aetiological research
involves the application of epidemiology to identify risk factors for injury. It also involves
applied social sciences to identify the determinants of organizational and individual behaviours
that lead to unsafe conditions. Epidemiological research seeks to identify modifiable risk factors
through the use of controlled, usually observational study designs such as the case-control study,
the cohort study, the panel study and the cross-sectional study. As with epidemiological studies
of other acute health events (e.g., asthma attacks, sudden cardiac arrests), aetiological research
on injuries is challenged by the need to study either rare or recurrent events that are highly
influenced by situational exposures that occur immediately before the event (e.g., distraction by
impact noise) and by social and behavioural constructs that are difficult to measure (e.g., safety
climate, job strain) (Veazie et al. 1994). Only recently have epidemiological and statistical
methods been developed to accommodate the study of these types of health events.

Epidemiological studies that focus on the occurrence of injury are expensive and are not always
needed. It does not require a controlled epidemiological study to document the impact of a lack
of machine guarding on amputations due to a particular machine; a series of case investigations
would suffice. Similarly, if an easily measurable individual behaviour such as failing to use a
seat-belt is already a known risk factor, then studies focusing on the determinants of the
behaviour and how to improve usage rates, are more useful than studying the injury. However,
controlled epidemiological studies of injury and injury severity are needed to provide an
understanding of a variety of causal mechanisms that are responsible for decrements in the
performance of humans or technology that are difficult to measure. The effect of noise exposure
or shift work, for example, on the risk and severity of injury is unlikely to be quantified by case
investigations or by studies of easy-to-measure behaviours.

A recent review of studies on risk factors of occupational injuries revealed that age, job title,
physical attributes or impairments and experience in the job or task were the most commonly
studied human variables (Veazie et al. 1994). Shift work and scheduling were the most
commonly studied job content variables. The work environment was the least studied. Most
environment factors related to design features or recognized material hazards. Some studies
examined factors in the organization and social environment. A few studies evaluated physical
stressors such as heat and noise exposure as risk factors for injury. Many of these studies were of
poor methodological quality, and few were replicated in different populations. Thus, little is
known about risk factors for injury at work, except for the most obvious immediate causes.
Future research may benefit by examining the impact on injury rates of risk factors predicted by
theory in human factors, ergonomics, occupational stress and organizational behaviour. These
may include design and scheduling of tasks and jobs, psychosocial factors (e.g., worker control,
social support, psychological demands), and organizational structure and change (e.g.,
continuous quality improvement and management commitment to safety).

The public health approach also integrates injury epidemiology with the applied behavioural
sciences (particularly health promotion, health behaviour and health policy research) to identify
the modifiable, environmental reasons for unsafe worker behaviour and, most important, for
behaviours on the part of employers and managers that lead to the creation and persistence of
hazards. In the large organizational setting, this effort must involve research in organizational
behaviour and industrial psychology. Thus, the assessment phase in the public health approach
involves epidemiological surveillance, in-depth investigations, community and organizational
needs assessment, and aetiological research based on the application of epidemiology and
applied behavioural sciences.

Prevention Strategies
A number of principles guide the selection and implementation of prevention measures in a
public health approach to injury control. These include:

(1) The importance of basing prevention measures on prior assessment and evaluation. The first
principle acknowledges the importance of selecting interventions that are targeted to have a high
impact on community health status and are likely to be successfully implemented. Thus,
interventions selected on the basis of a thorough assessment phase, rather than merely common
sense, are more likely to be effective. Interventions that have been demonstrated as effective in
the past are even more promising. Unfortunately, very few occupational injury interventions have
been scientifically evaluated (Goldenhar and Schulte 1994).

(2) The relative importance of control measures that automatically protect the worker. The
second principle emphasizes the continuum between active and passive protection. Active
protection is that which requires constant repetitive individual action; passive protection offers
relatively automatic protection. For example, seat-belts require individual action to initiate
protection each time someone gets into a vehicle. An air bag, on the other hand, bestows
protection on a vehicle occupant without any initiating action—it automatically protects that
person. Active interventions require modifying and sustaining individual behaviour change,
which has been the least successful of injury prevention strategies to date. This principle is
similar to the traditional hierarchy of controls in occupational safety which emphasizes the
importance of engineering controls over administrative controls, personal protective equipment
and training.

(3) The importance of behaviour modification rather than education. The third principle
recognizes the importance of behaviour modification and that not all hazards can be engineered
out of the environment at the manufacturing stage. Modification of the behaviour of employers,
managers and employees is central, not only to the installation and maintenance of passive
protection, but to most other occupational injury control strategies as well. Another important
aspect of this principle is that classroom instruction, posters, pamphlets and other forms of
education that merely seek to increase knowledge, usually have little effect on behaviour when
used alone. Most health behaviour theories applied in health promotion focus on a variety of
factors that motivate behaviour change other than awareness of a physical hazard or safe
behaviour. The Health Belief Model, for example, emphasizes that self-protective behaviour is
most influenced by the perception of risk, the perception of severity and the perception of the
benefits and barriers associated with taking protective action (Green and Kreuter 1991).

While credible educational messages may alter some of these perceptions, sometimes the best
way to alter these perceptions is to change the physical and social environment. A potentially
effective approach to behaviour modification is to redesign equipment and the physical
environment to make safe behaviour easier, quicker, and more comfortable or socially desirable
than unsafe behaviour. If the layout of machine shop equipment is designed to make walking
through hazardous zones difficult and unnecessary, then this unsafe behaviour will be reduced.
Similarly, if hard hats are designed to be comfortable and to enhance the social image of the
construction worker, they may be used more often.
The social environment can also be modified to change behaviour. For example, legislation and
enforcement is another far-reaching strategy in injury prevention that changes behaviour and
extends beyond education alone. Seat-belt laws and laws requiring the use of infant safety seats,
for example, have dramatically reduced motor vehicle fatalities in the United States. The effect
of legislation and enforcement on occupational safety, however, is less well-described. One
notable exception is the documented clear, dramatic decline in US mine fatalities that followed
the implementation of the Federal Coal Mine Health and Safety Act of 1969 (figure 56.17). The
resources and administrative authority devoted to mine safety enforcement is, however, much
greater than that available to most other agencies (Weeks 1991).

Figure 56.17 The effects of coal mining regulations on underground coal mining mortality
rates, United States 1950-1990

Well-designed occupational safety training often involves modifying the social environment by
including a role modelling process, incentives, and feedback on safety performance (Johnston,
Cattledge and Collins 1994). Another form of training, labour education, represents an altered
social environment (Wallerstein and Baker 1994). It empowers workers to recognize hazards and
to modify the behaviour of their employers so as to reduce those hazards. While education alone
is not usually sufficient, it is usually a necessary component of any injury prevention programme
(Gielen 1992). Educating employers and employees is a necessary part of the implementation of
a specific injury prevention programme. Educating legislators, policy makers, health care
providers and others is also important to initiating and sustaining community-wide injury
prevention efforts. Indeed, interventions most likely to succeed in the field use a multifaceted
approach which combines environmental modifications with policy changes and education
(National Committee for Injury Prevention and Control 1989).
(4) Systematic consideration of all available options, including those that reduce not only injury
occurrence but the severity and long-term consequences of injuries. The fourth principle is that
the process of choosing interventions should systematically consider a wide range of options.
The choice of countermeasures should not be determined by the relative importance of the causal
factors or by their earliness in the sequence of events; rather priority must be given to those
which most effectively reduce injury. A useful scheme for systematically considering injury
control options was proposed by Haddon (1972). The Haddon Matrix reveals that interventions
targeted at humans, the vehicles which can transfer damaging energy (e.g., cars, machinery), or
the physical or psychosocial environment may operate to control injury in the pre-event, event or
post-event phases. Table 56.2 shows the application of the Haddon Matrix to the problem of
preventing motor vehicle injuries, which are the leading cause of occupational injury fatalities in
many countries.

Table 56.2 The Haddon Matrix applied to motor vehicle injuries

Phases Factors
Human Vehicles and equipment Environment
Pre-event Educate public in the use Safe brakes and tires Improved road design;
of seat-belts and child restrict alcohol
restraints advertising and
availability at gas
stations
Event Prevention of Air bags and a Breakaway utility poles
osteoporosis to decrease crashworthy vehicle and crash barriers
likelihood of fracture design
Post-event Treatment of haemophilia Safe design of fuel tank Adequate emergency
and other conditions that to prevent rupture and medical care and
result in impaired healing fire rehabilitation

Source: National Committee for Injury Prevention and Control 1989.

Traditional occupational safety interventions most often operate in the pre-event phase to prevent
the initiation of an incident with potential to cause injury (i.e., an accident). Event phase
interventions such as building cars to be more crashworthy or using safety lanyards while
working at elevations, do not prevent accidents, but minimize the probability and severity of
injury. After the event is over—the cars in a crash have stopped moving or the worker has
stopped falling—post-event interventions such as first aid and prompt transport to appropriate
surgical care seek to minimize the health consequences of injury (i.e., the probability of death or
long-term disability).

In the public health approach, it is important to avoid getting locked into one phase of the matrix.
Just as injury is multifactorial in causation, prevention strategies should address as many phases
and aspects of injury as possible (but not necessarily all). The Haddon Matrix, for example,
emphasizes that injury control is not limited to preventing accidents. In fact, many of our most
effective control strategies do not prevent accidents or even injuries, but can considerably reduce
their severity. Seat-belts and air bags in cars, safety helmets, fall protection in construction,
rollover protective structures in agriculture, and emergency eyewash fountains in the laboratory
are but a few examples of event-phase strategies that do nothing to prevent an accident from
occurring. Instead, they reduce the severity of injury after the accident has been initiated. Even
after the anatomical damage has been done, much can be done to reduce the risk of death and
long-term disability. In the United States, it has been estimated that many major trauma deaths
could be prevented by systems that minimize the time delay between injury and definitive
surgical care. This broader framework is called injury control and goes far beyond traditional
accident prevention. A commonly used phrase to illustrate this point is “Injuries are not an
accident”. They can be predicted and their impact on society controlled.

Another useful scheme often used for systematically considering injury control options is
Haddon’s Ten Countermeasure Strategies (Haddon 1973). Table 56.3 shows how these strategies
can be applied to controlling injury from falls in construction. As shown, not all strategies will be
applicable for specific problems.

Table 56.3 Haddon’s Ten Countermeasure Strategies applied to injuries due to falls in construction

Countermeasure Intervention (and relevant notes)

Prevent the creation of the hazard.
Reduce the amount of the hazard brought
into being.
Prevent the release of the hazard.
Modify the rate of release of the hazard
from its sources.
Separate the hazard from the worker by
time and space.
Separate the hazard from the worker by
physical barriers.
Modify basic qualities of the hazard.
Make worker as injury resistant as possible. Require, e.g., safety helmets.
Begin to counter damage done by the
hazard.
Do not construct buildings—generally not a
practical option, to be sure.
Lower the height of construction project to
below fatal levels—usually not practical, but
may be possible in some work zones.
Install non-slip walking surfaces on roofs and
other heights.
Use safety lanyards. Use safety nets.
Do not schedule unnecessary foot traffic near
fall hazards until the hazards are abated.
Install guardrails on elevated surfaces.
Remove sharp or protruding projections on
the ground surface where workers can fall—
practical only for very low heights.
Apply first aid.
Stabilize, treat and rehabilitate worker. Develop a regionalized trauma system;
provide for effective rehabilitation and
retraining.

Evaluation in Public Health

Evaluation in both applied social sciences and epidemiology is “a process that attempts to
determine as systematically and objectively as possible the relevance, effectiveness and impact
of activities in light of their objectives” (Last 1988). Evaluation is an essential component of
public health practice. It occurs at two levels. The first level relies on surveillance systems to
determine whether or not entire communities have met their disease and injury reduction
objectives, without attempting to determine what caused the observed changes. Federal, state and
local government agencies in the United States, for example, have set objectives for the year
2000. One of these objectives is to reduce work-related injures resulting in medical treatment,
lost time from work, or restricted work activity to no more than 6 cases per 100 full-time workers
per year. Progress in meeting these objectives will be monitored with the national surveillance
systems in place.

The second level of evaluation focuses on determining the effectiveness of policies, programmes
and specific interventions. Ideally, this requires the application of controlled experimental or
quasi-experimental study designs. Mohr and Clemmer (1989), for example, conducted a time
series study of injury rates in those mobile off-shore oil rigs that opted to implement a new
technology to assist workers in connecting drill pipes, compared with rates in those rigs that did
not have the new technology. Although injury rates were going down over the period of the
installation of the new equipment, the authors were able to attribute a decrease of 6 injuries per
100 workers per year to the new safety equipment and to demonstrate that the savings from
injury prevention resulted in a full recovery of the initial capital and installation costs within 5.7
years. Unfortunately, this type of scientific evaluation of programmes and interventions in
occupational health and safety is rare and often methodologically flawed (Goldenhar and Schulte
1994).

Summary

The above-mentioned programme demonstrates well the various components in the public health
approach to reducing injuries in the workplace. Assessing the injury problem and establishing an
ongoing surveillance system was an essential part of this and earlier studies of injuries on oil rigs
that were conducted by these authors. The subsequent development of a simple engineering
prevention strategy was then followed by a rigorous evaluation strategy which included an
evaluation of cost savings. Such studies have been the mainstay of the public health approach to
the prevention of other occupational diseases. In the future, the integration of occupational injury
prevention into the assessment, intervention and evaluation phases of public health practice has
the potential to be an important step toward more effective protection and promotion of health in
communities.

THEORETICAL PRINCIPLES OF JOB SAFETY

Reinald Skiba

This presentation covers the theoretical principles of job safety and the general principles for
accident prevention. The presentation does not cover work-related illnesses, which, although
related, are different in many respects.

Theory of Job Safety

Job safety involves the interrelationship between people and work; materials, equipment and
machinery; the environment; and economic considerations such as productivity. Ideally, work
should be healthful, not harmful and not unreasonably difficult. For economic reasons, as high a
level of productivity as possible must be achieved.

Job safety should start in the planning stage and continue through the various phases of
production. Accordingly, requirements for job safety must be asserted before work begins and be
implemented throughout the work cycle, so that the results can be appraised for purposes of
feedback, among other reasons. The responsibility of supervision toward maintaining the health
and safety of those employed in the production process should also be considered during
planning. In the manufacturing process, people and objects interact. (The term object is used in
the broader sense as expressed in the customary designation “people-(machine)-environment
system”. This includes not only technical instruments of work, machines and materials, but all
surrounding items such as floors, stairs, electrical current, gas, dusts, atmosphere and so on.)

Worker-Job Relationships

The following three possible relationships within the manufacturing process indicate how
personal injury incidents (especially accidents) and harmful working conditions are unintended
effects of combining people and the objective working environment for the purpose of
production.

1. The relationship between the worker and the objective working environment is optimal.
This means well-being, job safety and labour-saving methods for the employees as well as the
reliability of the objective parts of the system, like machines. It also means no defects, accidents,
incidents, near misses (potential incidents) or injuries. The result is improved productivity.

2. The worker and the objective working environment are incompatible. This may be because
the person is unqualified, equipment or materials are not correct for the job or the operation is
poorly organized. Accordingly, the worker is unintentionally overworked or underutilized.
Objective parts of the system, like machines, may become unreliable. This creates unsafe
conditions and hazards with the potential for near misses (near accidents) and minor incidents
resulting in delays in production flow and declining output.

3. The relationship between the worker and the objective working environment is completely
interrupted and a disruption results, causing damage, personal injury or both, thereby preventing
output. This relationship is specifically concerned with the question of job safety in the sense of
avoiding accidents.
Principles of Workplace Safety

Because it is apparent that questions of accident prevention can be solved not in isolation, but
only in the context of their relationship with production and the working environment, the
following principles for accident prevention can be derived:

1. Accident prevention must be built into production planning with the goal of avoiding
disruptions.

2. The ultimate goal is to achieve a production flow that is as unhindered as possible. This
results not only in reliability and the elimination of defects, but also in the workers’ well-being,
labour-saving methods and job safety.

Some of the practices commonly used in the workplace to achieve job safety and which are
necessary for disruption-free production include, but are not limited to the following:

· Workers and supervisors must be informed and aware of the dangers and potential hazards
(e.g., through education).

· Workers must be motivated to function safely (behaviour modification).

· Workers must be able to function safely. This is accomplished through certification

procedures, training and education.

· The personal working environment should be safe and healthy through the use of
administrative or engineering controls, substitution of less hazardous materials or conditions, or
by the use of personal protective equipment.

· Equipment, machinery and objects must function safely for their intended use, with operating
controls designed to human capabilities.

· Provisions should be made for appropriate emergency response in order to limit the
consequences of accidents, incidents and injuries.

The following principles are important in understanding how accident prevention concepts relate
to disruption-free production:

1. Accident prevention is sometimes considered a social burden instead of a major part of

disruption prevention. Disruption prevention is a better motivator than accident prevention,
because improved production is expected to result from disruption prevention.

2. Measures to ensure workplace safety must be integrated into the measures used to ensure
disruption-free production. For example, the instructions on hazards must be an integral part of
the general directions governing the flow of production at the workplace.

Accident Theory
An accident (including those that entail injuries) is a sudden and unwanted event, caused by an
outside influence, that causes harm to people and results from the interaction of people and
objects.

Often the use of the term accident in the workplace is linked with personal injury. Damage to a
machine is often referred to as a disruption or damage, but not an accident. Damage to the
environment is often called an incident. Accidents, incidents and disruptions which do not result
in injury or damage are known as “near accidents” or “near misses”. So while it may be
considered appropriate to refer to accidents as cases of injury to workers and to define the terms
incident, disruption and damage separately as they apply to objects and the environment, in the
context of this article they will all be referred to as accidents.

The conceptual model for the term accident indicates that workplace accidents occur from
workers and objects interacting with each other through the release of energy. The cause of an
accident can lie in the characteristics of the injured worker (e.g., not capable of performing the
work safely) or of the object (e.g., unsafe or unsuitable equipment). The cause can also be
another worker (providing erroneous information), supervisor (receiving incomplete job
instructions) or trainer (receiving incomplete or incorrect training). The following can be derived
for accident prevention:

Assuming that workers as well as their objective environments can be carriers of hazards or
dangers, accident prevention would basically consist of eliminating the hazards or dangers, or
impeding the consequences by keeping the carriers apart or by minimizing the effects of the
energy.

Potential Hazards and Risks

Although a hazard or danger may exist in an object, if the worker and the object are so separate
from one another that they cannot come into contact, no accident is possible. For example, if the
object has a potential hazard (e.g., a suspended load is moved by a crane), this potential hazard
cannot cause an injury so long as there are no people in the effective area of the suspended load.
It is only when a worker comes into the area of the crane’s suspended load that an actual hazard
or danger to this worker is posed, because an interaction between the worker and the object is
possible. It should be noted that objects can also endanger other objects, such as vehicles parked
under the crane’s load. Risk, defined as a means of quantifying the hazard, is the product of the
anticipated frequency of the damage and the anticipated scope of the damage. Accident risk is
correspondingly the product of the anticipated frequency of accidents (relative accident
frequency) and anticipated accident severity. Relative accident frequency is the number of
accidents per risk-time (accidents per 1 million hours or injuries per work year). The seriousness
of the accident can be shown quantitatively with the lost time (e.g., lost work days), class of
injury (minor accident or first aid case, reportable injury, lost-time compensation case and fatal
accident), type of injury, and cost of injury. This risk data should be recorded empirically and in
terms of a theoretical prognosis.

The risks of accidents are different in various workplaces, under various conditions. For
example, the risks involved in drilling for oil, using the same workers and identical equipment,
differ widely depending on the geography (drilling on land or off shore) and the climate (Arctic
exploration or deserts). The level of accident risk depends on:

· the anticipated frequency of error of the worker and the technology (number per 1 million
hours, etc.)

· the probability of the errors resulting in accidents (accident: error = 1:x)

· the probability of the seriousness level of the accident.

The acceptance of accident risks also varies widely. High accident risk appears to be acceptable
in road traffic whereas a zero base tolerance is expected in the field of nuclear energy. For
purposes of accident prevention, it therefore follows that the driving force is the smallest
possible acceptance of accident risk.

Causes of Accidents

The occurrence of an accident requires classification on a scale from cause to effect. Three levels
must be differentiated:

· the level of the causes of possible and actual accidents

· the level of the accident’s origins

· the level of the accident’s consequences in the form of personal and material damages.

Cause is the reason for the accident. Almost every accident has multiple causes such as
hazardous conditions, combinations of factors, courses of events, omissions and so on. For
example, causes of an accident involving a burst boiler may include one or a combination of the
following reasons: faulty materials in the boiler wall, inadequate training to ensure safe
operation, failure of a pressure relief device, or violation of an operating procedure such as
overheating. Without one or more of these deficiencies, an accident may not have happened.
Other conditions, which are not causal to the accident, should be separated. In the case of the
burst boiler, these would include conditions such as information about the time, the ambient
temperature and the size of the boiler room.

It is important to differentiate the factors associated with the production process from the
accident causes linked to workers (conduct of the immediate operator), the organization (safe
work procedures or policies) and technical accident causes (environmental changes and object
failures). However, in the final analysis, every accident results from faulty conduct of people,
because people are always at the end of the causal chain. For example, if faulty material is
determined to be the cause of a boiler bursting, then improper conduct existed either on the part
of the builder, manufacturer, tester, installer or owner (e.g., corrosion due to inadequate
maintenance). Strictly speaking, there is no such thing as a “technical failure” or technical
accident cause. The technology is only the intermediate link to the consequences of the improper
conduct. Nevertheless, the normal division of causes into behavioural, technical and
organizational is useful, because this points toward which group of people behaved improperly
and also helps select the appropriate corrective measures.

As previously stated, most accidents are the result of a combination of causes.

For example, a person slips on an oil spot in a dark, unlighted passageway and hits the sharp
edge of a replacement part that is lying there, resulting in a head injury. The immediate causes of
the accident are inadequate lighting in the passageway, unsafe floor (oil spot), inadequately skid-
free shoe soles, not wearing head protection, and the replacement part not in its proper place. The
accident could not have happened if the combination of causes had been eliminated or the causal
chain had been broken. Successful accident prevention therefore consists of recognizing the
causal chain that leads to an accident and breaking it, so that the accident can no longer occur.

Effect of Strains and Demands

Mechanization and automation of production processes have advanced considerably in recent

years. It may appear that the causes of many accidents have shifted from human error to those
related to the maintenance of and interface with automated processes. However, these positive
consequences of technology are counterposed to other, negative ones, particularly the increase in
psychological strains and corresponding ergonomic physical demands on workers in automated
plants due to the increased attention and responsibility required for overseeing the automated
operations process, impersonal working environment and monotony of work. These strains and
corresponding demands increase the occurrence of accidents and can be harmful to health.

1. Strains are effects on workers which originate in the workplace, such as environmental
strains (temperature, heat, humidity, light, noise and air pollution), or they can be static or
dynamic strains originating directly from the work process (lifting, climbing, chemical exposure
and so on). Strain levels can be physically measured (noise, force, atmospheric exposures and so
on), whereas strain factors are physically unmeasurable influences (fatigue, mental stress, plant
worker/management relationships and so on).

2. Demands on workers are dependent on the type and degree of the strain as well as differing
individual capability to withstand the strain. Effects of demands show up physically and
psychologically in the human body. The effects of the demands can be desirable or undesirable,
depending on the type and degree. Undesirable effects, such as physical and psychological
exhaustion, work aggravations, illness, lack of coordination and concentration, and unsafe
behaviour cause increased risk of accident.

For purposes of accident prevention, it follows that workers, based on their individual
competencies, capabilities and willingness, should be able to physically and psychologically
work safely provided that there are no outside factors such as unsuitable equipment, poor
environment or unsatisfactory work conditions. Safety may be improved by organizing the work
process to include appropriate stimuli such as planned job changes, expansion of work and tasks,
and work enrichment.

Near Accidents (Near Misses)

A large part of production loss results from disruptions in the form of near misses (near
accidents), which are the basis of occurrences of accidents. Not every disruption affects work
safety. Near accidents (near misses) are those occurrences or incidents in which no injury or
damage resulted, but if injury or damage had occurred, they would be classified as accidents. For
example, a machine that unexpectedly stops running without damage to the equipment or work is
considered to be a near accident. Additionally, the disruption may cause another near accident if
the machine suddenly starts up again while a worker is inside trying to determine the cause of the
stoppage, but the worker is not injured.

Accident Pyramid

Accidents are relatively rare occurrences, and usually the more serious the accident, the more
rare the occurrence. Near accidents form the bottom, or base, of the accident pyramid, whereas
fatal accidents stand at the top. If lost time is used as a criterion for the seriousness of accidents,
we find a relatively high degree of correspondence with the accident pyramid. (There may be a
slight deviation as a result of the reporting requirements of different countries, companies and
jurisdictions.)

The accident pyramid can be very different for individual types or classifications of accidents.
For example, accidents involving electricity are disproportionately serious. When accidents are
classified by occupation, we see that certain types of work activities suffer disproportionately
more serious accidents. In both cases the accident pyramid is top-heavy due to the relatively high
proportion of serious and fatal accidents.

From the accident pyramid, it follows for purposes of accident prevention that:

1. Accident prevention begins with avoiding near accidents (near misses).

2. Eliminating minor accidents usually has a positive effect on eliminating serious accidents.

Accident Prevention

The different paths of accident prevention for ensuring workplace safety are as follows:

1. Eliminate the hazard or danger so that injury or damage is no longer possible.

2. Provide for separation between the worker (or equipment) and the hazard (equal to
elimination of the hazard). The danger remains, but an injury (or damage) is not possible since
we make sure that the natural zones of influence of workers (equipment) and object (hazard or
danger) do not intersect.

3. Provide shielding, such as fireproofing, protective clothing and respirators to minimize the
hazard. The hazard still exists, but the possibility of an injury or damage is reduced by
minimizing the chances of the hazard having an effect by shielding the danger.
4. Adapt to the hazard by providing measures such as warning systems, monitoring equipment,
information about dangers, motivation for safe behaviour, training and education.

Summary

In 1914, Max Planck (German physicist, 1858–1947) said: “In every science the highest
watchword is the task of seeking order and continuity from the abundance of individual
experiences and individual facts, in order, by filling the gaps, to integrate them into a coherent
view.” This principle also applies to the complex scientific and practical questions of job safety
because they not only interface with many different disciplines, but also are themselves
multifaceted. While it is difficult, for this reason, to systematize the many problems involved
with job safety, it is necessary to properly organize the individual questions according to
significance and context, and to pose effective options for improving job safety.

PRINCIPLES OF PREVENTION: SAFETY

INFORMATION
Mark R. Lehto and James M. Miller

Sources of Safety Information

Manufacturers and employers throughout the world provide a vast amount of safety information
to workers, both to encourage safe behaviour and to discourage unsafe behaviour. These sources
of safety information include, among others, regulations, codes and standards, industry practices,
training courses, Material Safety Data Sheets (MSDSs), written procedures, safety signs, product
labels and instruction manuals. Information provided by each of these sources varies in its
behavioural objectives, intended audience, content, level of detail, format and mode of
presentation. Each source may also design its information so as to be relevant to the different
stages of task performance within a potential accident sequence.

Four Stages of the Accident Sequence

The behavioural objectives of particular sources of safety information correspond or “map”

naturally to the four different stages of the accident sequence (table 56.4).

Table 56.4 Objectives and example sources of safety information mapped to the accident sequence

Task stage in accident sequence

Prior to task Routine task performance Abnormal task conditio
Objectives Educate and persuade worker of the Instruct or remind worker to Alert worker of abnorm
(Behavioural) nature and level of risk, precautions, follow safe procedures or conditions. Specify nee
remedial measures and emergency take precautions. actions.
procedures.
Example Training manuals, videos or Instruction manuals, job Warning signals: visua
sources programmes, hazard communication performance aids, checklists, auditory, or olfactory.
programmes, material safety data sheets, written procedures, warning Temporary tags, signs,
safety propaganda, safety feedback signs and labels or lock-outs

First stage. At the first stage in the accident sequence, sources of information provided prior to
the task, such as safety training materials, hazard communication programmes and various forms
of safety programme materials (including safety posters and campaigns) are used to educate
workers about risks and persuade them to behave safely. Methods of education and persuasion
(behaviour modification) attempt not only to reduce errors by improving worker knowledge and
skills but also to reduce intentional violations of safety rules by changing unsafe attitudes.
Inexperienced workers are often the target audience at this stage, and therefore the safety
information is much more detailed in content than at the other stages. It must be emphasized that
a well-trained and motivated workforce is a prerequisite for safety information to be effective at
the three following stages of the accident sequence.

Second stage. At the second stage in the accident sequence, sources such as written procedures,
checklists, instructions, warning signs and product labels can provide critical safety information
during routine task performance. This information usually consists of brief statements which
either instruct less skilled workers or remind skilled workers to take necessary precautions.
Following this approach can help prevent workers from omitting either precautions or other
critical steps in a task. Statements providing such information are often embedded at the
appropriate stage within step-by-step instructions describing how to perform a task. Warning
signs at appropriate locations can play a similar role: for example, a warning sign located at the
entrance to a workplace might state that safety hard hats must be worn inside.

Third stage. At the third stage in the accident sequence, highly conspicuous and easily perceived
sources of safety information alert workers of abnormal or unusually hazardous conditions.
Examples include warning signals, safety markings, tags, signs, barriers or lock-outs. Warning
signals can be visual (flashing lights, movements, etc.), auditory (buzzers, horns, tones, etc.),
olfactory (odours), tactile (vibrations) or kinaesthetic. Certain warning signals are inherent to
products when they are in hazardous states (e.g., the odour released upon opening a container of
acetone). Others are designed into machinery or work environments (e.g., the back-up signal on a
fork-lift truck). Safety markings refer to methods of non-verbally identifying or highlighting
potentially hazardous elements of the environment (e.g., by painting step edges yellow or
emergency stops red). Safety tags, barriers, signs or lock-outs are placed at points of hazard and
are often used to prevent workers from entering areas or activating equipment during
maintenance, repair or other abnormal conditions.

Fourth stage. At the fourth stage in the accident sequence, the focus is on expediting worker
performance of emergency procedures at the time an accident is occurring, or on the performance
of remedial measures shortly after the accident. Safety information signs and markings
conspicuously indicate facts critical to adequate performance of emergency procedures (e.g., the
locations of exits, fire extinguishers, first aid stations, emergency showers, eyewash stations or
emergency releases). Product safety labels and MSDSs may specify remedial and emergency
procedures to be followed.
However, if safety information is to be effective at any stage in the accident sequence, it must
first be noticed and understood, and if the information has been previously learned, it must also
be remembered. Then the worker must both decide to comply with the provided message and be
physically able to do so. Successfully attaining each of these steps for effectiveness can be
difficult; however, guidelines describing how to design safety information are of some
assistance.

Design Guidelines and Requirements

Standards-making organizations, regulatory agencies and the courts through their decisions have
traditionally both instituted guidelines and imposed requirements regarding when and how safety
information is to be provided. More recently, there has been a trend towards developing
guidelines based on scientific research concerning the factors which influence the effectiveness
of safety information.

Legal requirements

In most industrialized countries, government regulations require that certain forms of safety
information be provided to workers. For example, in the United States, the Environmental
Protection Agency (EPA) has developed several labelling requirements for toxic chemicals. The
Department of Transportation (DOT) makes specific provisions regarding the labelling of
hazardous materials in transport. The Occupational Safety and Health Administration (OSHA)
has promulgated a hazard communication standard that applies to workplaces where toxic or
hazardous materials are in use, which requires training, container labelling, MSDSs and other
forms of warnings.

In the United States, the failure to warn also can be grounds for litigation holding manufacturers,
employers and others liable for injuries incurred by workers. In establishing liability, the Theory
of Negligence takes into consideration whether the failure to provide adequate warning is judged
to be unreasonable conduct based on (1) the foreseeability of the danger by the manufacturer, (2)
the reasonableness of the assumption that a user would realize the danger and (3) the degree of
care that the manufacturer took to inform the user of the danger. The Theory of Strict Liability
requires only that the failure to warn caused the injury or loss.

Voluntary standards

A large set of existing standards provide voluntary recommendations regarding the use and
design of safety information. These standards have been developed by multilateral groups and
agencies, such as the United Nations, the European Economic Community (EEC’s
EURONORM), the International Organization for Standardization (ISO) and the International
Electrotechnical Commission (IEC); and by national groups, such as the American National
Standards Institute (ANSI), the British Standards Institute, the Canadian Standards Association,
the German Institute for Normalization (DIN) and the Japanese Industrial Standards Committee.

Among consensus standards, those developed by ANSI in the United States are of special
significance. Since the mid-1980s, five new ANSI standards focusing on safety signs and labels
have been developed and one significant standard has been revised. The new standards are: (1)
ANSI Z535.1, Safety Color Code, (2) ANSI Z535.2, Environmental and Facility Safety Signs,
(3) ANSI Z535.3, Criteria for Safety Symbols, (4) ANSI Z535.4, Product Safety Signs and
Labels, and (5) ANSI Z535.5, Accident Prevention Tags. The recently revised standard is ANSI
Z129.1–1988, Hazardous Industrial Chemicals—Precautionary Labeling. Furthermore, ANSI has
published the Guide for Developing Product Information.

Design specifications

Design specifications can be found in consensus and governmental safety standards specifying
how to design the following:

1. Material Safety Data Sheets (MSDSs). The OSHA hazard communication standard specifies
that employers must have a MSDS in the workplace for each hazardous chemical used. The
standard requires that each sheet be written in English, list its date of preparation and provide the
scientific and common names of the hazardous chemical mentioned. It also requires the MSDS
to describe (1) physical and chemical characteristics of the hazardous chemical, (2) physical
hazards, including potential for fire, explosion and reactivity, (3) health hazards, including signs
and symptoms of exposure, and health conditions potentially aggravated by the chemical, (4) the
primary route of entry, (5) the OSHA permissible exposure limit, the ACGIH threshold limit
value or other recommended limits, (6) carcinogenic properties, (7) generally applicable
precautions, (8) generally applicable control measures, (9) emergency and first aid procedures
and (10) the name, address and telephone number of a party able to provide, if necessary,
additional information on the hazardous chemical and emergency procedures.

2. Instructional labels and manuals. Few consensus standards currently specify how to design
instructional labels and manuals. This situation is, however, quickly changing. The ANSI Guide
for Developing User Product Information was published in 1990, and several other consensus
organizations are working on draft documents. Without an overly scientific foundation, the ANSI
Consumer Interest Council, which is responsible for the above guidelines, has provided a
reasonable outline to manufacturers regarding what to consider in producing instruction/operator
manuals. They have included sections entitled: “Organizational Elements”, “Illustrations”,
“Instructions”, “Warnings”, “Standards”, “How to Use Language”, and “An Instructions
Development Checklist”. While the guideline is brief, the document represents a useful initial
effort in this area.

3. Safety symbols. Numerous standards throughout the world contain provisions regarding
safety symbols. Among such standards, the ANSI Z535.3 standard, Criteria for Safety Symbols,
is particularly relevant for industrial users. The standard presents a significant set of selected
symbols shown in previous studies to be well understood by workers in the United States.
Perhaps more importantly, the standard also specifies methods for designing and evaluating
safety symbols. Important provisions include the requirement that (1) new symbols must be
correctly identified during testing by at least 85% of 50 or more representative subjects, (2)
symbols which don’t meet the above criteria should be used only when equivalent printed verbal
messages are also provided and (3) employers and product manufacturers should train workers
and users regarding the intended meaning of the symbols. The standard also makes new symbols
developed under these guidelines eligible to be considered for inclusion in future revisions of the
standard.

4. Warning signs, labels and tags. ANSI and other standards provide very specific
recommendations regarding the design of warning signs, labels and tags. These include, among
other factors, particular signal words and text, colour coding schemes, typography, symbols,
arrangement and hazard identification (table 56.5). Among the most popular signal words
recommended are: DANGER, to indicate the highest level of hazard; WARNING, to represent an
intermediate hazard; and CAUTION, to indicate the lowest level of hazard. Colour coding
methods are to be used to consistently associate colours with particular levels of hazard. For
example, red is used in all of the standards in table 56.5 to represent DANGER, the highest level
of hazard. Explicit recommendations regarding typography are given in nearly all the systems.
The most general commonality between the systems is the recommended use of sans-serif
typefaces. Varied recommendations are given regarding the use of symbols and pictographs. The
FMC and the Westinghouse systems advocate the use of symbols to define the hazard and to
convey the level of hazard (FMC 1985; Westinghouse 1981). Other standards recommend
symbols only as a supplement to words. Another area of substantial variation, shown in table
56.4 , pertains to the recommended label arrangements. The proposed arrangements generally
include elements discussed above and specify the image (graphic content or colour), the
background (shape, colour); the enclosure (shape, colour) and the surround (shape, colour).
Many of the systems also precisely describe the arrangement of the written text and provide
guidance regarding methods of hazard identification.

Table 56.5 Summary of recommendations within selected warning systems

System Signal words Colour coding Typography Symbols

ANSI Z129.1 Danger Not specified Not specified Skull-and-cro
Hazardous Industrial Warning supplement t
Chemicals: Caution Acceptable s
Precautionary Labeling Poison 3 other haza
(1988) optional words for
“delayed” hazards
ANSI Z535.2 Danger Red Sans serif, upper case, Symbols and
Environmental and Warning Orange acceptable typefaces, letter per ANSI Z5
Facility Safety Signs Caution Yellow heights
(1993) Notice Blue
(general safety) Green
(arrows) as above; black
and white
otherwise per
ANSI Z535.1
ANSI Z535.4 Product Danger Red Sans serif, upper case, Symbols and
Safety Signs and Warning Orange suggested typefaces, letter per ANSI Z5
Labels (1993) Caution Yellow heights SAE J284 sa
 per ANSI Z535.1 symbol

NEMA Guidelines: Danger Red Not specified Electric shoc

NEMA 260 (1982) Warning Red

SAE J115 Safety Danger Red Sans serif typeface, upper Layout to acc
Signs (1979) Warning Yellow case symbols; spe
Caution Yellow symbols/ pic
prescribed
ISO Standard: ISO None. 3 kinds of labels: Message panel is added Symbols and
R557 (1967); ISO Red below if necessary
3864 (1984) Stop/prohibition Blue
Mandatory action Yellow
Warning
OSHA 1910.145 Danger Red Readable at 5 feet or as Biological ha
Specification for Warning (tags only) Yellow required by task symbol. Majo
Accident Prevention Caution Yellow can be suppl
Signs and Tags (1985) Biological Hazard, Fluorescent pictograph (
BIOHAZARD, or Orange/orange-red Slow-moving
symbol (SAE J943)
(safety instruction)
(slow-moving vehicle) Green
Fluorescent
yellow-orange and
dark red per ANSI
Z535.1
OSHA 1910.1200 Per applicable In English
(Chemical) Hazard requirements of EPA,
Communication (1985) FDA, BATF, and
CPSC; not otherwise
specified.
Westinghouse Danger Red Helvetica bold and regular Symbols and
Handbook (1981); Warning Orange weights, upper/lower case
FMC Guidelines Caution Yellow
(1985) Notice Blue

Source: Adapted from Lehto and Miller 1986; Lehto and Clark 1990.

Certain standards may also specify the content and wording of warning signs or labels in some
detail. For example, ANSI Z129.1 specifies that chemical warning labels must include (1)
identification of the chemical product or its hazardous component(s), (2) a signal word, (3) a
statement of hazard(s), (4) precautionary measures, (5) instructions in case of contact or
exposure, (6) antidotes, (7) notes to physicians, (8) instructions in case of fire and spill or leak
and (9) instructions for container handling and storage. This standard also specifies a general
format for chemical labels that incorporate these items. The standard also provides extensive and
specific recommended wordings for particular messages.

Cognitive guidelines

Design specifications, such as those discussed above, can be useful to developers of safety
information. However, many products and situations are not directly addressed by standards or
regulations. Certain design specifications may not be scientifically proven, and, in extreme cases,
conforming with standards and regulations may actually reduce the effectiveness of safety
information. To ensure effectiveness, developers of safety information consequently may need to
go beyond safety standards. Recognizing this issue, the International Ergonomics Association
(IEA) and International Foundation for Industrial Ergonomics and Safety Research (IFIESR)
recently supported an effort to develop guidelines for warning signs and labels (Lehto 1992)
which reflect published and unpublished studies on effectiveness and have implications
regarding the design of nearly all forms of safety information. Six of these guidelines, presented
in slightly modified form, are as follows.

1. Match sources of safety information to the level of performance at which critical errors
occur for a given population. In specifying what and how safety information is to be provided,
this guideline emphasizes the need to focus attention on (1) critical errors that can cause
significant damage and (2) the level of worker performance at the time the error is made. This
objective often can be attained if sources of safety information are matched to behavioural
objectives consistently with the mapping shown in table 56.4 and discussed earlier.

2. Integrate safety information into the task and hazard-related context. Safety information
should be provided in a way that makes it likely to be noticed at the time it is most relevant,
which almost always is the moment when action needs to be taken. Recent research has
confirmed that this principle is true for both the placement of safety messages within instructions
and the placement of safety information sources (such as warning signs) in the physical
environment. One study showed that people were much more likely to notice and comply with
safety precautions when they were included as a step within instructions, rather than separated
from instructional text as a separate warning section. It is interesting to observe that many safety
standards conversely recommend or require that precautionary and warning information be
placed in a separate section.

3. Be selective. Providing excessive amounts of safety information increases the time and
effort required to find what is relevant to the emergent need. Sources of safety information
should consequently focus on providing relevant information which does not exceed what is
needed for the immediate purpose. Training programmes should provide the most detailed
information. Instruction manuals, MSDSs and other reference sources should be more detailed
than warning signs, labels or signals.
4. Keep the cost of compliance within a reasonable level. A substantial number of studies have
indicated that people become less likely to follow safety precautions when doing so is perceived
to involve a significant “cost of compliance”. Safety information should therefore be provided in
a way that minimizes the difficulty of complying with its message. Occasionally this goal can be
attained by providing the information at a time and location when complying is convenient.

5. Make symbols and text as concrete as possible. Research has shown that people are better
able to understand concrete, rather than abstract, words and symbols used within safety
information. Skill and experience, however, play a major role in determining the value of
concreteness. It is not unusual for highly skilled workers to both prefer and better understand
abstract terminology.

6. Simplify the syntax and grammar of text and combinations of symbols. Writing text that
poor readers, or even adequate readers, can comprehend is not an easy task. Numerous
guidelines have been developed in attempts to alleviate such problems. Some basic principles are
(1) use words and symbols understood by the target audience, (2) use consistent terminology, (3)
use short, simple sentences constructed in the standard subject-verb-object form, (4) avoid
negations and complex conditional sentences, (5) use the active rather than passive voice, (6)
avoid using complex pictographs to describe actions and (7) avoid combining multiple meanings
in a single figure.

Satisfying these guidelines requires consideration of a substantial number of detailed issues as

addressed in the next section.

Developing Safety Information

The development of safety information meant to accompany products, such as safety warnings,
labels and instructions, often requires extensive investigations and development activities
involving considerable resources and time. Ideally, such activities (1) coordinate the
development of product information with design of the product itself, (2) analyse product
features which affect user expectations and behaviours, (3) identify the hazards associated with
use and likely misuse of the product, (4) research user perceptions and expectations regarding
product function and hazard characteristics and (5) evaluate product information using methods
and criteria consistent with the goals of each component of product information. Activities
accomplishing these objectives can be grouped into several levels. While in-house product
designers are able to accomplish many of the tasks designated, some of these tasks involve the
application of methodologies most familiar to professionals with backgrounds in human factors
engineering, safety engineering, document design and the communication sciences. Tasks falling
within these levels are summarized as follows and are shown in figure 56.18 :

Figure 56.18 A model for designing and evaluating product information

Level 0: Product design status

Level 0 is both the starting point for initiating a product information project, and the point at
which feedback regarding design alternatives will be received and new iterations at the basic
model level will be forwarded. At the initiation of a product information project, the researcher
begins with a particular design. The design can be in the concept or prototype stage or as
currently being sold and used. A major reason for designating a Level 0 is the recognition that the
development of product information must be managed. Such projects require formal budgets,
resources, planning, and accountability. The largest benefits to be gained from a systematic
product information design are achieved when the product is in the pre-production concept or
prototype state. However, applying the methodology to existing products and product
information is quite appropriate and extremely valuable.

Level 1: Product type investigations

At least seven tasks should be performed at this stage: (1) document characteristics of the
existing product (e.g., parts, operation, assembly and packaging), (2) investigate the design
features and accompanying information for similar or competitive products, (3) collect data on
accidents for both this product and similar or competitive products, (4) identify human factors
and safety research addressing this type of product, (5) identify applicable standards and
regulations, (6) analyse government and commercial media attention to this type of product
(including recall information) and (7) research the litigation history for this and similar products.

Level 2: Product use and user group research

At least seven tasks should be performed at this stage: (1) determine appropriate methods for use
of product (including assembly, installation, use and maintenance), (2) identify existing and
potential product user groups, (3) research consumer use, misuse, and knowledge of product or
similar products, (4) research user perceptions of product hazards, (5) identify hazards associated
with intended use(s) and foreseeable misuse(s) of product, (6) analyse cognitive and behavioural
demands during product use and (7) identify likely user errors, their consequences and potential
remedies.

After completing the analyses in Levels 1 and 2, product design changes should be considered
before proceeding further. In the traditional safety engineering sense, this could be called
“engineering the hazard out of the product”. Some modifications may be for the health of the
consumer, and some for the benefit of the company as it attempts to produce a marketing
success.

Level 3: Information design criteria and prototypes

In Level 3 at least nine tasks are performed: (1) determine from the standards and requirements
applying to the particular product which if any of those requirements impose design or
performance criteria on this part of the information design, (2) determine those types of tasks for
which information is to be provided to users (e.g., operation, assembly, maintenance and
disposal), (3) for each type of task information, determine messages to be conveyed to user, (4)
determine the mode of communication appropriate for each message (e.g., text, symbols, signals
or product features), (5) determine temporal and spatial location of individual messages, (6)
develop desired features of information based on messages, modes and placements developed in
previous steps, (7) develop prototypes of individual components of product information system
(e.g., manuals, labels, warnings, tags, advertisements, packaging and signs), (8) verify that there
is consistency across the various types of information (e.g., manuals, advertisements, tags and
packaging) and (9) verify that products with other brand names or similar existing products from
the same company have consistent information.

After having proceeded through Levels 1, 2 and 3, the researcher will have developed the format
and content of information expected to be appropriate. At this point, the researcher may want to
provide initial recommendations regarding the redesign of any existing product information
before moving on to Level 4.

Level 4: Evaluation and revision

In Level 4 at least six tasks are performed: (1) define evaluation parameters for each prototype
component of the product information system, (2) develop an evaluation plan for each prototype
component of the product information system, (3) select representative users, installers and so
on, to participate in evaluation, (4) execute the evaluation plan, (5) modify product information
prototypes and/or the design of the product based on the results obtained during evaluation
(several iterations are likely to be necessary) and (6) specify the final text and artwork layout.

Level 5: Publication

Level 5, the actual publication of the information, is reviewed, approved and accomplished as
specified. The purpose at this level is to confirm that specifications for designs, including
designated logical groupings of material, location and quality of illustrations, and special
communication features have been precisely followed, and have not been unintentionally
modified by the printer. While the publication activity is usually not under the control of the
person developing the information designs, we have found it necessary to verify that such
designs are precisely followed, the reason being that printers have been known to take great
liberties in manipulating design layout.

Level 6: Post-sale evaluations

The last level of the model deals with the post-sale evaluations, a final check to ensure that the
information is indeed fulfilling the goals it was designed to achieve. The information designer as
well as the manufacturer gains an opportunity for valuable and educational feedback from this
process. Examples of post-sale evaluations include (1) feedback from customer satisfaction
programmes, (2) potential summarization of data from warranty fulfilments and warranty
response cards, (3) gathering of information from accident investigations involving the same or
similar products, (4) monitoring of consensus standards and regulatory activities and (5)
monitoring of safety recalls and media attention to similar products.

WORK-RELATED ACCIDENT COSTS

Diego Andreoni

Workers who are the victims of work-related accidents suffer from material consequences, which
include expenses and loss of earnings, and from intangible consequences, including pain and
suffering, both of which may be of short or long duration. These consequences include:

· doctor’s fees, cost of ambulance or other transport, hospital charges or fees for home nursing,
payments made to persons who gave assistance, cost of artificial limbs and so on

· the immediate loss of earnings during absence from work (unless insured or compensated)

· loss of future earnings if the injury is permanently disabling, long term or precludes the
victim’s normal advancement in his or her career or occupation
· permanent afflictions resulting from the accident, such as mutilation, lameness, loss of
vision, ugly scars or disfigurement, mental changes and so on, which may reduce life expectancy
and give rise to physical or psychological suffering, or to further expenses arising from the
victim’s need to find a new occupation or interests

· subsequent economic difficulties with the family budget if other members of the family have
to either go to work to replace lost income or give up their employment in order to look after the
victim. There may also be additional loss of income if the victim was engaged in private work
outside normal working hours and is no longer able to perform it.

· anxiety for the rest of the family and detriment to their future, especially in the case of
children.

Workers who become victims of accidents frequently receive compensation or allowances both
in cash and in kind. Although these do not affect the intangible consequences of the accident
(except in exceptional circumstances), they constitute a more or less important part of the
material consequences, inasmuch as they affect the income which will take the place of the
salary. There is no doubt that part of the overall costs of an accident must, except in very
favourable circumstances, be borne directly by the victims.

Considering the national economy as a whole, it must be admitted that the interdependence of all
its members is such that the consequences of an accident affecting one individual will have an
adverse effect on the general standard of living, and may include the following:

· an increase in the price of manufactured products, since the direct and indirect expenses and
losses resulting from an accident may result in an increase in the cost of making the product

· a decrease in the gross national product as a result of the adverse effects of accidents on
people, equipment, facilities and materials; these effects will vary according to the availability in
each country of workers, capital and material resources

· additional expenses incurred to cover the cost of compensating accident victims and pay
increased insurance premiums, and the amount necessary to provide safety measures required to
prevent similar occurrences.

One of the functions of society is that it must protect the health and income of its members. It
meets these obligations through the creation of social security institutions, health programmes
(some governments provide free or low-cost medical care to their constituents), injury
compensation insurance and safety systems (including legislation, inspection, assistance,
research and so on), the administrative costs of which are a charge on society.

The level of compensation benefits and the amount of resources devoted to accident prevention
by governments are limited for two reasons: because they depend (1) on the value placed on
human life and suffering, which varies from one country to another and from one era to another;
and (2) on the funds available and the priorities allocated for other services provided for the
protection of the public.
As a result of all this, a considerable amount of capital is no longer available for productive
investment. Nevertheless, the money devoted to preventive action does provide considerable
economic benefits, to the extent that there is a reduction in the total number of accidents and
their cost. Much of the effort devoted to the prevention of accidents, such as the incorporation of
higher safety standards into machinery and equipment and the general education of the
population before working age, are equally useful both inside and outside the workplace. This is
of increasing importance because the number and cost of accidents occurring at home, on the
road and in other non-work-related activities of modern life continues to grow. The total cost of
accidents may be said to be the sum of the cost of prevention and the cost of the resultant
changes. It would not seem unreasonable to recognize that the cost to society of the changes
which could result from the implementation of a preventive measure may exceed the actual cost
of the measure many times over. The necessary financial resources are drawn from the
economically active section of the population, such as workers, employers and other taxpayers
through systems which work either on the basis of contributions to the institutions that provide
the benefits, or through taxes collected by the state and other public authorities, or by both
systems. At the level of the undertaking the cost of accidents includes expenses and losses, which
are made up of the following:

· expenses incurred while setting up the system of work and the related equipment and
machinery with a view to ensuring safety in the production process. Estimation of these expenses
is difficult because it is not possible to draw a line between the safety of the process itself and
that of the workers. Major sums are involved which are entirely expended before production
commences and are included in general or special costs to be amortized over a period of years.

· expenses incurred during production, which in turn include: (1) fixed charges related to
accident prevention, notably for medical, safety and educational services and for arrangements
for the workers’ participation in the safety programme; (2) fixed charges for accident insurance,
plus variable charges in schemes where premiums are based on the number of accidents; (3)
varying charges for activities related to accident prevention (these depend largely on accident
frequency and severity, and include the cost of training and information activities, safety
campaigns, safety programmes and research, and workers’ participation in these activities); (4)
costs arising from personal injuries (These include the cost of medical care, transport, grants to
accident victims and their families, administrative and legal consequences of accidents, salaries
paid to injured persons during their absence from work and to other workers during interruptions
to work after an accident and during subsequent inquiries and investigations, and so on.); (5)
costs arising from material damage and loss which need not be accompanied by personal injury.
In fact, the most typical and expensive material damage in certain branches of industry arises in
circumstances other than those which result in personal injury; attention should be concentrated
upon the few points in common between the techniques of material damage control and those
required for the prevention of personal injury.

· losses arising out of a fall in production or from the costs of introducing special counter-
measures, both of which may be very expensive.

In addition to affecting the place where the accident occurred, successive losses may occur at
other points in the plant or in associated plants; apart from economic losses which result from
work stoppages due to accidents or injuries, account must be taken of the losses resulting when
the workers stop work or come out on strike during industrial disputes concerning serious,
collective or repeated accidents.

The total value of these costs and losses are by no means the same for every undertaking. The
most obvious differences depend on the particular hazards associated with each branch of
industry or type of occupation and on the extent to which appropriate safety precautions are
applied. Rather than trying to place a value on the initial costs incurred while incorporating
accident prevention measures into the system at the earliest stages, many authors have tried to
work out the consequential costs. Among these may be cited: Heinrich, who proposed that costs
be divided into “direct costs” (particularly insurance) and “indirect costs” (expenses incurred by
the manufacturer); Simonds, who proposed dividing the costs into insured costs and non-insured
costs; Wallach, who proposed a division under the different headings used for analysing
production costs, viz. labour, machinery, maintenance and time expenses; and Compes, who
defined the costs as either general costs or individual costs. In all of these examples (with the
exception of Wallach), two groups of costs are described which, although differently defined,
have many points in common.

In view of the difficulty of estimating overall costs, attempts have been made to arrive at a
suitable value for this figure by expressing the indirect cost (uninsured or individual costs) as a
multiple of the direct cost (insured or general costs). Heinrich was the first to attempt to obtain a
value for this figure and proposed that the indirect costs amounted to four times the direct costs
—that is, that the total cost amounts to five times the direct cost. This estimation is valid for the
group of undertakings studied by Heinrich, but is not valid for other groups and is even less valid
when applied to individual factories. In a number of industries in various industrialized countries
this value has been found to be of the order of 1 to 7 (4 ± 75%) but individual studies have
shown that this figure can be considerably higher (up to 20 times) and may even vary over a
period of time for the same undertaking.

There is no doubt that money spent incorporating accident prevention measures into the system
during the initial stages of a manufacturing project will be offset by the reduction of losses and
expenses that would otherwise have been incurred. This saving is not, however, subject to any
particular law or fixed proportion, and will vary from case to case. It may be found that a small
expenditure results in very substantial savings, whereas in another case a much greater
expenditure results in very little apparent gain. In making calculations of this kind, allowance
should always be made for the time factor, which works in two ways: current expenses may be
reduced by amortizing the initial cost over several years, and the probability of an accident
occurring, however rare it may be, will increase with the passage of time.

In any given industry, where permitted by societal factors, there may be no financial incentive to
reduce accidents in view of the fact that their cost is added to the production cost and is thus
passed on to the consumer. This is a different matter, however, when considered from the point
of view of an individual undertaking. There may be a great incentive for an undertaking to take
steps to avoid the serious economic effects of accidents involving key personnel or essential
equipment. This is particularly so in the case of small plants which do not have a reserve of
qualified staff, or those engaged in certain specialized activities, as well as in large, complex
facilities, such as in the process industry, where the costs of replacement could surpass the
capacity to raise capital. There may also be cases where a larger undertaking can be more
competitive and thus increase its profits by taking steps to reduce accidents. Furthermore, no
undertaking can afford to overlook the financial advantages that stem from maintaining good
relations with workers and their trade unions.

As a final point, when passing from the abstract concept of an undertaking to the concrete reality
of those who occupy senior positions in the business (i.e., the employer or the senior
management), there is a personal incentive which is not only financial and which stems from the
desire or the need to further their own career and to avoid the penalties, legal and otherwise,
which may befall them in the case of certain types of accident. The cost of occupational
accidents, therefore, has repercussions on both the national economy and that of each individual
member of the population: there is thus an overall and an individual incentive for everybody to
play a part in reducing this cost.

REFERENCES
Adams, JGU. 1985. Risk and Freedom; The Record of Read Safety Regulation. London:
Transport Publishing Projects.

American National Standards Institute (ANSI). 1962. Method of Recording and Measuring Work
Injury Experience. ANSI Z-16.2. New York: ANSI.

—. 1978. American National Standard Manual on Uniform Traffic Control Devices for Streets
and Highways. ANSI D6.1. New York: ANSI.

—. 1988. Hazardous Industrial Chemicals—Precautionary Labeling. ANSI Z129.1. New York:

ANSI.

—. 1993. Safety Color Code. ANSI Z535.1. New York: ANSI.

—. 1993. Environmental and Facility Safety Signs. ANSI Z535.2. New York: ANSI.

—. 1993. Criteria for Safety Symbols. ANSI Z535.3. New York: ANSI.

—. 1993. Product Safety Signs and Labels. ANSI Z535.4. New York: ANSI.

—. 1993. Accident Prevention Tags. ANSI Z535.5. New York: ANSI.

Andersson, R. 1991. The role of accidentology in occupational accident research. Arbete och
halsa. 1991. Solna, Sweden. Thesis.

Andersson, R and E Lagerlöf. 1983. Accident data in the new Swedish information system on
occupational injuries. Ergonomics 26.
Arnold, HJ. 1989. Sanctions and rewards: Organizational perspectives. In Sanctions and Rewards
in the Legal System: A Multidisciplinary Approach. Toronto: University of Toronto Press.

Baker, SP, B O’Neil, MJ Ginsburg, and G Li. 1992. Injury Fact Book. New York: Oxford
University Press.

Benner, L. 1975. Accident investigations—multilinear sequencing methods. J Saf Res 7.

Centers for Disease Control and Prevention (CDC). 1988. Guidelines for evaluating surveillance
systems. Morb Mortal Weekly Rep 37(S-5):1–18.

Davies, JC and DP Manning. 1994a. MAIM: the concept and construction of intelligent software.
Saf Sci 17:207–218.

—. 1994b. Data collected by MAIM intelligent software: The first fifty accidents. Saf Sci
17:219-226.

Department of Trade and Industry. 1987. Leisure Accident Surveillance System (LASS): Home
and Leisure Accident Research 1986 Data. 11th Annual Report of the Home Accident
Surveillance System. London: Department of Trade and Industry.

Ferry, TS. 1988. Modern Accident Investigation and Analysis. New York: Wiley.

Feyer, A-M and AM Williamson. 1991. An accident classification system for use in preventive
strategies. Scand J Work Environ Health 17:302–311.

FMC. 1985. Product Safety Sign and Label System. Santa Clara, California: FMC Corporation.

Gielen, AC. 1992. Health education and injury control: Integrating approaches. Health Educ Q
19(2):203–218.

Goldenhar, LM and PA Schulte. 1994. Intervention research in occupational health and safety. J
Occup Med 36(7):763–775.

Green, LW and MW Kreuter. 1991. Health Promotion Planning: An Educational and

Environmental Approach. Mountainview, CA: Mayfield Publishing Company.

Guastello, SJ. 1991. The Comparative Effectiveness of Occupational Accident Reduction

Programs. Paper presented at the International Symposium Alcohol Related Accidents and
Injuries. Yverdon-les-Bains, Switzerland, Dec. 2-5.

Haddon, WJ. 1972. A logical framework for categorizing highway safety phenomena and
activity. J Trauma 12:193–207.

—. 1973. Energy damage and the 10 countermeasure strategies. J Trauma 13:321–331.

—. 1980. The basic strategies for reducing damage from hazards of all kinds. Hazard Prevention
September/October:8–12.

Hale, AR and AI Glendon. 1987. Individual Behaviour in the Face of Danger. Amsterdam:
Elsevier.

Hale, AR and M Hale. 1972. Review of the Industrial Accident Research Literature. Research
paper No. l, Committee on Safety & Health. London: HMSO.

Hale, AR, B Heming, J Carthey and B Kirwan. 1994. Extension of the Model of Behaviour in the
Control of Danger. Vol. 3: Extended Model Description. Sheffield: Health and Safety Executive
project HF/GNSR/28.

Hare, VC. 1967. System Analysis: A Diagnostic Approach. New York: Harcourt Brace World.

Harms-Ringdahl, L. 1993. Safety Analysis. Principles and Practice in Occupational Safety. Vol.
289. Amsterdam: Elsevier.

Heinrich, HW. 1931. Industrial Accident Prevention. New York: McGraw-Hill.

—. 1959. Industrial Accident Prevention: A Scientific Approach. New York: McGraw-Hill Book
Company.

Hugentobler, MK, BA Israel, and SJ Schurman. 1992. An action research approach to workplace
health: Intergrating methods. Health Educ Q 19(1):55–76.

International Organization for Standardization (ISO). 1967. Symbols, Dimensions, and Layout
for Safety Signs. ISO R557. Geneva: ISO.

—. 1984. Safety Signs and Colors. ISO 3864. Geneva: ISO.

—. 1991. Industrial Automation Systems—Safety of Integrated Manufacturing Systems—Basic

Requirements (CD 11161). TC 184/WG 4. Geneva: ISO.

—. 1994. Quality Management and Quality Assurance Vocabulary. ISO/DIS 8402. Paris:
Association française de normalisation.

Janssen, W. 1994. Seat-belt wearing and driving behavior: An instrumented-vehicle study.

Accident analysis and prevention. Accident Anal. Prev. 26: 249-261.

Jenkins, EL, SM Kisner, D Fosbroke, LA Layne, MA Stout, DN Castillo, PM Cutlip, and R

Cianfrocco. 1993. Fatal Injuries to Workers in the United States, 1980–1989: A Decade of
Surveillance. Cincinnati, OH: NIOSH.

Johnston, JJ, GTH Cattledge, and JW Collins. 1994. The efficacy of training for occupational
injury control. Occup Med: State Art Rev 9(2):147–158.
Kallberg, VP. 1992. The Effects of Reflector Posts on Driving Behaviour and Accidents on Two-
lane Rural Roads in Finland. Report 59/1992. Helsinki: The Finnish National Road
Administration Technical Development Center.

Kjellén, U. 1984. The deviation concept in occupational accident control. Part I: Definition and
classification; Part II: Data collection and assesment of significance. Accident Anal Prev 16:289–
323.

Kjellén, U and J Hovden. 1993. Reducing risks by deviation control—a retrospection into a
research strategy. Saf Sci 16:417–438.

Kjellén, U and TJ Larsson. 1981. Investigating accidents and reducing risks—a dynamic
approach. J Occup Acc 3:129–140.

Last, JM. 1988. A Dictionary of Epidemiology. New York: Oxford University Press.

Lehto, MR. 1992. Designing warning signs and warning labels: Part I—Guidelines for the
practitioner. Int J Ind Erg 10:105–113.

Lehto, MR and D Clark. 1990. Warning signs and labels in the workplace. In Workspace,
Equipment and Tool Design, edited by A Mital and W Karwowski. Amsterdam: Elsevier.

Lehto, MR and JM Miller. 1986. Warnings: Volume I: Fundamentals, Design, and Evaluation
Methodologies. Ann Arbor, MI: Fuller Technical Publications.

Leplat, J. 1978. Accident analyses and work analyses. J Occup Acc 1:331–340.

MacKenzie, EJ, DM Steinwachs, and BS Shankar. 1989. Classifying severity of trauma based on
hospital discharge diagnoses: Validation of an ICD-9CM to AIS-85 conversion table. Med Care
27:412–422.

Manning, DP. 1971. Industrial accident-type classifications—A study of the theory and practice
of accident prevention based on a computer analysis of industrial injury records. M.D. Thesis,
University of Liverpool.

McAfee, RB and AR Winn. 1989. The use of incentives/feedback to enhance work place safety:
A critique of the literature. J Saf Res 20:7-19.

Mohr, DL and D Clemmer. 1989. Evaluation of an occupational injury intervention in the

petroleum industry. Accident Anal Prev 21(3):263–271.

National Committee for Injury Prevention and Control. 1989. Injury Prevention: Meeting the
Challenge. New York: Oxford University Press.

National Electronic Manufacturers Association (NEMA). 1982. Safety Labels for Padmounted
Switch Gear and Transformers Sited in Public Areas. NEMA 260. Rosslyn, VA: NEMA.
Occupational Health and Safety Administration (OSHA). 1985. Specification for Accident
Prevention Signs and Tags. CFR 1910.145. Washington DC: OSHA.

—. 1985. [Chemical] Hazard Communication. CFR 1910.1200. Washington DC: OSHA.

Occupational Injury Prevention Panel. 1992. Occupational injury prevention. In Centers for
Disease Control. Position Papers from the Third National Injury Control Conference: Setting the
National Agenda for Injury Control in the 1990s. Atlanta, GA: CDC.

Organization for Economic Cooperation and Development (OECD). 1990. Behavioural

Adaptation to Changes in the Road Transport System. Paris: OECD.

Rasmussen, J. 1982. Human errors. A taxonomy for describing human malfunction in industrial
installations. J Occup Acc 4:311–333.

Rasmussen, J, K Duncan and J Leplat. 1987. New Technology and Human Error. Chichester:
Wiley.

Reason, JT. 1990. Human Error. Cambridge: CUP.

Rice, DP, EJ MacKenzie and associates. 1989. Cost of Injury in the United States: A Report to
Congress. San Francisco: Institute for Health and Aging, University of California; and Baltimore:
Injury Prevention Center, The Johns Hopkins University.

Robertson, LS. 1992. Injury Epidemiology. New York: Oxford University Press.

Saari, J. 1992. Successful implementation of occupational health and safety programs in

manufacturing for the 1990s. J Hum Factors Manufac 2:55–66.

Schelp, L. 1988. The role of organizations in community participation—prevention of accidental

injuries in a rural Swedish municipality. Soc Sci Med 26(11):1087–1093.

Shannon, HS. 1978. A statistical study of 2,500 consecutive reported accidents in an automobile
factory. Ph.D. thesis, University of London.

Smith, GS and H Falk. 1987. Unintentional injuries. Am J Prev Medicine 5, sup.:143–163.

Smith, GS and PG Barss. 1991. Unintentional injuries in developing countries: The

epidemiology of a neglected problem. Epidemiological Reviews :228–266.

Society of Automotive Engineers (SAE). 1979. Safety Signs. SAE J115: SAE.

Steckler, AB, L Dawson, BA Israel, and E Eng. 1993. Community health development: An
overview of the works of Guy W. Stewart. Health Educ Q Sup. 1: S3-S20.
Steers, RM and LW Porter.1991. Motivation and Work Behavior (5th ed). New York: McGraw-
Hill.

Surry, J. 1969. Industrial Accident Research: A Human Engineering Appraisal. Canada:

University of Toronto.

Tollman, S. 1991. Community-oriented primary care: Origins, evolutions, applications. Soc Sci
Med 32(6):633-642.

Troup, JDG, J Davies, and DP Manning. 1988. A model for the investigation of back injuries and
manual handling problems at work. J Soc Occup Med 10:107–119.

Tuominen, R and J Saari. 1982. A model for analysis of accidents and its applications. J Occup
Acc 4.

Veazie, MA, DD Landen, TR Bender and HE Amandus. 1994. Epidemiologic research on the
etiology of injuries at work. Ann Rev Pub Health 15:203–21.

Waganaar, WA, PT Hudson and JT Reason. 1990. Cognitive failures and accidents. Appl Cogn
Psychol 4:273–294.

Waller, JA. 1985. Injury Control: A Guide to the Causes and Prevention of Trauma. Lexington,
MA: Lexington Books.

Wallerstein, N and R Baker. 1994. Labor education programs in health and safety. Occup Med
State Art Rev 9(2):305-320.

Weeks, JL. 1991. Occupational health and safety regulation in the coal mining industry: Public
health at the workplace. Annu Rev Publ Health 12:195–207.

Westinghouse Electric Corporation. 1981. Product Safety Label Handbook. Trafford, Pa:
Westinghouse Printing Division.

Wilde, GJS. 1982. The theory of risk homeostasis: Implications for safety and health. Risk Anal
2:209-225.

—. 1991. Economics and accidents: A commentary. J Appl Behav Sci 24:81-84.

—. 1988. Risk homeostasis theory and traffic accidents: propositions, deductions and discussion
of dissemsion in recent reactions. Ergonomics 31:441-468.

—. 1994. Target Risk. Toronto: PDE Publications.

Williamson, AM and A-M Feyer. 1990. Behavioural epidemiology as a tool for accident
research. J Occup Acc 12:207–222.
Work Environment Fund [Arbetarskyddsfonden]. 1983. Olycksfall i arbetsmiljön—Kartläggning
och analys av forskningsbehov [Accidents in the work environment—survey and analysis].
Solna: Arbetarskyddsfonden

OTHER RELEVANT READINGS

Andersson, R, B Johansson, K Lindén, and L Svanström. 1978. Development of a model for
research on occupational accidents. J Occup Acc 1.

Apple, J. 1972. Materials Handling Systems Design. New York: The Ronald Press.

Bainbridge, L. 1983. Ironies of automation. Automatica 19:775-779.

Bamber, L. 1979. Accident costing in industry. Health and Safety at Work (Croyden) 2/4:32–34.

Barnett, R and D Brickman. 1986. Safety hierarchy. J Saf Res 17:49–55.

Booth, R. 1979. Making factories safe for forklift truck drivers. Occup Health 4:193–197.

Collinson, IL. 1980. Safety—the cost of accidents and their prevention. The Mining Engineer
(London), 561–571.

Corbett, JM. 1988. Ergonomics in the development of human-centred AMT. Appl Ergon 19:35-
39.

Diekershoff, K, W Hamacher, and G Kliemt. 1986. Gefährdungen und Belastungen beim

innerbetrieblichen Transport und Verkehr. Die Berufsgenossenschaft 7:378–384.

Franke, A and S Joki. 1975. Die volkwirtschaftlichen Kosten der Arbeitsunfälle [The economic
costs of occupational accidents]. Bundesanstalt für Arbeitsschutz und Unfallforschung.
Forschungsbericht Nr. 148. Dortmund: Marten.

Goodstein, LP, HB Anderson, and SE Olsen. 1988. Tasks, Errors and Mental Models. London:
Taylor & Francis.

Häkkinen, K. 1992. Failures in materials handling systems with the framework of EN 292. In
Proceedings of the Fourth International Conference on Structural Failure, Product Liability and
Technical Insurance, Technical University Vienna July 6–9, 1992, edited by HP Rossmanith.
Amsterdam: Elsevier.

—. 1991. Accidents and technological change in materials handling. In XIIth World Congress on
Occupational Safety and Health, Hamburg 6–11 May 1990, proceedings. Sankt Augustin: ILO.

Hale, AR and M Hale. 1970. Accidents in perspective. Occup Psychol 44:115–122.

Health and Safety Executive. 1992. Road Transport in Factories and Similiar Workplaces.
Guidance Note GS9(R). London: HMSO.

—. 1982. Transport Kills. A Study of Fatal Accidents in Industry 1978–1980. London: HMSO.

Hollnagel, E and D Woods. 1983. Cognitive systems engineering: New wine in new bottles. Int J
Man Mach Stud 18:593-600.

Kidd, P. 1994. Skill-based automated manufacturing. In Organization and Management of

Advanced Manufacturing Systems, edited by W Karwowski and G Salvendy. New York: Wiley.

Kuivanen, R. 1990. The impact on safety of disturbances in flexible manufacturing systems. In

Ergonomics of Hybrid Automated Systems II, edited by W Karwowski and M Rahimi.
Amsterdam:Elsevier.

LeNet, M. 1978. Le prix de la vie humaine [The cost of a human life]. Notes et études
documentaires. No. 4455. Paris: La Documentation française.

Miller, JM, MR Lehto, and JP Frantz. 1994. Warnings and Safety Instructions: Annotated and
Indexed. Ann Arbor, MI: Fuller Technical Publications.

Rasmussen, J. 1983. Skills, rules, and knowledge: signals, signs, and symbols, and other
distinctions in human performance models. IEEE T Syst Man Cyb 13(3):257–266.

Sinclair, TC. 1972. A Cost-effectiveness Approach to Industrial Safety. London: HMSO.

—. 1975. Safety Alert Symbol for Agricultural, Construction, and Industrial Equipment. SAE
J284: SAE.

—. 1983. Slow Moving Vehicle Identification Emblem. SAE J943: SAE.

Sugimoto, N. 1987. Subjects and problems of robot safety technology. In Occupational Safety
and Health in Automation and Robotics, edited by K Noro. London:Taylor & Francis.