Theories of Accident Causation

This article attempts to deliver explanation s of why accidents occur by analyzing the
fundamental and developmental predecessors to accidental events. Accidents, events that
injure people, damage property and equipment don’t just happen. They are not random
acts of fate that occur out of the blue. Rather accidents are the combination of events that
come together to create a flow of process where a progression of events leads to a negative
outcome, an accident.

The need for a theory reflects the difficulties in providing logical and rationale
explanations as to actually why certain events, people, equipment interacted to generate a
usually predictable negative outcome.

Over the years many academics of the safety profession have tried to bring logic to create
an understanding of the underlying and contributory factors that when collide from a series
of events produce the environment for an injury to occur.

A theory is: “systematically organized knowledge applicable in a wide variety of
circumstances; especially, a system of assumptions, accepted principles, and rules of
procedure devised to analyze, predict, or otherwise explain the nature or behavior of a
specified set of phenomena.”[3]

Accidents (defined) are unintended and unplanned single or multiple event sequences that
are caused by unsafe acts and/or unsafe conditions and may result in immediate or delayed
undesirable effects to workers.
Risk is defined as the chance of injury, damage or loss relative to the failure potential and
the consequences of injuries.

3. Hazards are defined as unsafe conditions that have the potential for an activity, a
situation or circumstances to produce harmful effects. It is a set conditions or a
changing set of circumstances that presents a potential for injury, illness or property
damage. Any element that increases the chance of loss is called a hazard.
Henrich, an early contributor, to the safety profession had several ideas about how the
casual affects that produce injuries aligned to generate the negative outcome.

Henrich studied 75,000 accidents and sorted the accidents by conditions:

88% or 66,000 of the 75,000 accidents were from unsafe acts
10% were from unsafe conditions
2% were unpreventable causes

This review and analysis was one of the first such studies that gave insight into exactly
what is the major driver of injuries. Armed with this knowledge the safety profession can
better focus resources.

Domino Theory:

Henrich further contributed to the basic understanding of accident causation by developing
the widely known Domino Theory. The domino Theory holds that accidents are not
random acts of fate that just happen out of the blue. This theory uses the analogy of 5
Dominos standing up of the thin base side and when one falls it will push the other down
all tumbling toward injury.

The theory is designed to help practitioner identify intervention points, points that , if acted
on, will yield a different outcome, a more favorable outcome such as no accident or an
event that does not lead to injury or property damage. If you eliminate just one, any one of
the first four Domino’s that have aligned then the Domino’s will not complete the
sequenced fall and no injury will result.

Domino Theory

• Ancestry and Social Environment (negative character traits leads to unsafe behavior
can be inherited, Can be acquired
• Fault of Person (the above is why people behave in unsafe manner)
• Unsafe acts (committed by people and mechanical hazards are the causes of
accidents
• Accident
• Injury

If you eliminate any one of the first four factors then you will prevent the injury.
Chain of events caused by human error lead to accidents INSET DOMINO”S WITH LABLELS ON BOTTOM

Energy Release Theory:

Another theory that has gained respect is the energy release Theory which compares the
rate of release of energy and relates to the kind of and severity of injuries. This theory
focuses on the prevention of allowing energy to stores up in an uncontrolled way. The first
step is to prevent the marshalling of energy by reducing the amount needed and/or
providing vent release mechanisms. The next step would be to install control methods that
modify the release rate which can be accomplished with the use of space (distance) and
time. For example, a fixed barrier guard separates space by not allowing workers or
machinery to reach a point of operation. This is a separation by space. Other control techniques include strengthen the object that may release the energy to prevent such release. For example, slings used in hoisting operations are strength tested to withstand 2
times there working load.

Multiple Causation Theory:

This theory purports that multiple factors combine in random fashion (any given order)
and come together at the intersection point to produce an accident.

One example of a multiple causation theory is the 4 M’s which stand for:

Man
Media (environment)
Machine
Management

The analysis of these contributors is used to help identify which combinations are most
likely to provide the catalyst to bring conditions together for injuries to manifest. It is
important to note that this theory is one of the first that recognizes the critical role ( as we
now know it ) that management plays in providing the essential leadership and support to
execute the safety mission.

Another Multiple Causation Theory with emphasis on prevention of the negative event is
the 3 E’s:

Engineering
Education
Enforcement

Safety Engineering is the application of engineering principles to hazard recognition and
control. An important part of safety engineering is the study of forces that are exerted on
machines, men and control apparatus and the action of such exerted forces. The effects of
force is related to material strength and it’s ability (or lack of ability to deform when force
pressure is applied.

Regarding the control of hazards, also known as a safety program, the acts of corporate
authority are required to set the prevention ideal into motion:

1) Authorization- this is top management legitimization whereby it is sated and
communicated that the company will work to identify and eliminate hazardous
conditions.
2) Appropriation is the second needed element – where adequate resources are
provided to fulfill the safety mission.

Hazard control begins with hazard recognition. Hazard Control is defined as any means of
eliminating or reducing the risk of loss from the hazard that has been recognized.

Just as with any program that management initiates and desires a favorable of, the hazard control
process is:

1) Hazard recognition- you can’t begin to control it if you did not know it could cause
injuries.
2) Define and select preventative measures
3) Assign responsibility for implementation of the selected control technique. Provide an effective means for measuring effectiveness.

Human Factors Theory:

The Human factors theory of accident causation holds that a chain of events that is or was
caused by consistent human error lead to an accident. Factors that lead to human error.

Factors that lead to human error are:

► Overload (action that exceeds the ability of component to handle the amount)
► Inappropriate Response
► Inappropriate Activities

Overload
Environmental Factors (noise, Distractions)
Internal Factors (Personal problems, stress)
Situational Factors (Instructions not clear/risk level to high)
Inappropriate Response

Know about the hazard but not doing anything about it.
Removing safeguards
Ignoring safety rules
Inappropriate Activities

Not trained to do the job that is being done. This is a lack of new worker orientation as to
the appropriate, safe and efficient way to perform the task for which the person was hired.
Not judging the degree of risk correctly is another factor of the Human factors Theory that
seek to give understanding to the decision when a person underestimates they level of risk
that was associated with the current process.

Accident/Incident Theory

Epidemiological Theory

Systems Theory of Causation

Combination Theory of Accident Causation

The actual cause may combine parts of several parts of several different models. It is
important to avoid the tendency to try to apply one model to all accidents because “One
Model Does Not Fit All”.

Conclusion:

Accident proneness, near miss, accident phenomenon, Risk responsibilities
Theories guide and shape our investigative menal thoughts and out physical activities to
seek out more information so that we may better understand the root causes of what are the
germinating factors that conspire to grow into an accident.

Accident Theory: Why Bother?

Professional: a calling requiring specialized knowledge and often long and intensive
preparation, including instruction in skills and methods as well as in the scientific,
historical or scholarly principles underlying such skills and methods, maintaining by force
of organization or concerted opinion high standards of achievement and conduct, and
committing its members to continued study and to a kind of work which has as its prime
purpose the rendering of a public service.

Widespread differences in individual perceptions of the accident phenomenon would
become evident. If one were to ask when an accident begins and ends, and what the criteria
are for establishing the beginning and the end of an accident, the range of view would
increase. If you need further evidence of the lack of underlying principles in the field of
accident investigation, try to apply scientific rigor to the investigator’s jargon—-words like
human or pilot error, accident proneness, near miss, hazard, etc. Each example is a
symptom of the lack of a sound theoretical basis of accident investigation.

The most persuasive argument for developing an accident theory for SASI members is that
assumptions, principles and rules of procedure are nowhere systematically organized, and
that generally accepted rules of procedure for analyzing, predicting or explaining the
accident phenomenon are not available to the accident investigator. The ICAO manual
contains procedures for organizing the investigation, its coordination and the reporting of
investigative findings. But the contents do not address the underlying scientific principles,
nor reflect scientific method. Knowledge of these principles is assumed to be the province
of the investigators. Each investigator has specialized knowledge and technique which he
brings to an investigation. In a large accident, where investigative groups are formed, the
coordination of these individual skills compensates to some extent for the absence of
professional principles and theories, because interactions among the group members
generate hypotheses that are subject to vigorous debate. However, the principles governing
the scope and development of the hypothesis are not well organized or documented. Accident investigation methods for establishing their validity are even less rigorous, and almost totally undocumented, in most modes of transportation. In small accident investigations, conducted by one investigator, even this compensating mechanism is
absent.

The result is that the investigative effort is often inefficient, and may be incomplete, or
may leave unresolved significant points of controversy. Furthermore, it usually does not
provide scientifically rigorous contributions to the body of data from which future
assumptions, principles or rules of procedure can be discovered and practiced by others in
the profession.

To elaborate on this latter point, each accident can be viewed as an unscheduled and
largely uninstrumented scientific experiment performed to test a hypothesis (or theory.) In
this context, the experiment and all the costs of performing it—-the injuries, damage,
anguish, monetary loss, delays, disruptions—-are wasted if the investigator has no
hypothesis or theory to evaluate.

As an investigator, how do you establish the scope of your investigation? How far back in
time must you delve—-an hour, a day, a year, two years, five? What rules of procedure or
what principles establish the beginning or end of the accident? How is one assured of
enough facts in an investigation, and how are the facts to be reported distinguished from
the facts that are not reported? What rules or principles govern these decisions?

Still other problems attributable to the lack of theory could be cited, including research
difficulties, training deficiencies, inequitable litigation, popular misconceptions about the
nature of accidents and others, but this would be redundant. The point is that if we are to
be professional investigators of accidents, we need to organize the principles on which our
work is based in a professional manner.

What Theories Exist Now?

Some rules and principles do exist now for the accident investigator. However, they are
fragmented, occasionally contradictory, often privately communicated, usually not
scientifically tested, and sometimes wholly without merit. Their systematic organization
has not yet been achieved. When this organization is accomplished, the contradictions and
fallacious assumptions will become evident, and gaps can be remedied.
A brief review of some of the most influential historical assumptions, principles and rules
discloses the present state of accident theory.

The statistical work of Greenwood and Woods in 1919[4] and Newbold[5] suggested the
“accident proneness” concept. Their work still influences some accident investigation,
particularly in the police accident investigation field with its focus on license revocation or
suspension proceedings which reflect this concept. Investigators still look for data in
accidents that will support the idea that “conditions” such as attitudes, attentiveness and so
forth “cause” accidents. This statistical work focused on static conditions and set the
pattern for untold man years of research into “unsafe conditions” as causes of accidents. In
aviation, Ames contributed much to perpetuation of this view.[6]

In 1936,’ Heinrich[7]suggested the “domino” theory of accidents. His idea was that
accidents are a sequence of events in a predetermined proceed/follow relationship, like a
row of falling dominos. This view changed the thrust of investigations toward the events
involved, rather than the conditions. It represented a redirection of the search for
understanding of the accident phenomenon on the basis of a “chain–of–events” that had
occurred.

An accident “reconstruction” approach emerged not long thereafter[89] which was refined
extensively in the highway accident investigation field by Baker. The reconstruction
focused on identification of the linear chain of events theory of the accident phenomenon.
About 1960, work at Bell Laboratories in missile system safety produced another
breakthrough in the field.[10] This was the “fault tree analysis” method, generally credited
to H. A. Watson.[11] This is a method for arraying events in a flow chart with a proceed!
follow logic pattern. It provided an objective for the analytical effort in the sense of
management by objectives, and it provided a procedure by which informed speculations
about accident events sequences were organized in a visible, easily criticized and readily
understood display. This work introduced a “branched events chains” concept of accidents
through use of the “and/or” logic gates.

About the same time, air safety investigators contributed another milestone in the accident
investigation field. The Civil Aeronautics Board published the first chart on which were
plotted the flight data recorder (FDR) data.[12] This chart was the first display of the
parallel events along a time scale, showing what can be viewed as a “multi– linear events
sequence” on which the findings were partially based. It appears to be the first to use the
timeo term, about which more will be said shortly. It also is the predecessor of the
“multilinear events sequence theory” for the accident phenomenon.

In the latter 1960’s, a medical doctor changed accident investigation approaches
significantly with his insistence on an etiologic basis for looking at accident trauma.[13]
Haddon also introduced a matrix of accident phases and components of the accident events
sequence. This work was influenced by DeHaven’s research in 1942, but it was Haddon
who brought about the directions in accident research which now largely dominate the
highway accident field at the Federal level.

Attempts by Surry[14] and others to organize these and other related concepts into a
general accident model are indicated in the SASI Forum article. The concept of
homeostasis is an essential theory for the understanding of accidents. The term is generally
applied in medicine to a state of physiological equilibrium produced by a balance of
functions and chemical composition in an organism. I propose this concept be extended to
“activities,” in the sense that an operational equilibrium is produced by a balancing of
interrelated functions and capabilities in response to varying influences arising as the
activity progresses toward its intended outcome.

The principal conclusion suggested is that an accident is not a single event, but rather an
accident is the transformation process by which a homeostatic activity is interrupted with
accompanying unintentional harm. The critical point is that an accident is a process
involving interacting elements and certain necessary or sufficient conditions.

The objective of an accident investigation should be to isolate this process and prepare a
description of the entire process by which the activity was transformed.
Expansion of some of the elements of my earlier accident process chart may be helpful.
Maintenance of homeostasis during an activity requires a continuing series of adaptive
responses to perturbations which arise as the activity progresses. To achieve the intended
outcome, these perturbations must be accommodated without injury to any of the “actors”
and without discontinuing the activity. For example, an aircraft crew makes many adaptive
responses to external and internal influencing events during the course of a flight from one
point to another, to maintain a stable flight activity within prescribed operational bounds.
This is accomplished through a process of detecting the perturbation or indications of its
presence or occurrence; of predicting the significance of the data detected; of identifying
the adaptive action choices that would maintain homeostasis; of selecting the best adaptive
action; of implementing the action selected; of monitoring the effects of the action
implemented; and of deciding whether or not the adaptive response countered the
perturbation sufficiently to maintain homeostasis without further adaptive response. Each
step is an element of an accident process chart if the adaptive response is unsuccessful.
Any breakdown in the adaptive process described can be used to identify the beginning (to)
of the transformation from homeostasis into the accident being investigated.
This approach differs from the “last clear chance” doctrine in law, from the key event
approach of Baker[15] and the “critical event” approach of Perchonok[16] in that they
characterize different events in a linear events sequence. The last event in the process must
be the last injurious event directly linked to one or more of the pre–existing actors in the
activity. The problem of secondary harm can be treated by considering the impinged
activity in the accident sequence.[17]

The product of the process’ charting effort could take two forms. First, a detailed chart
with all the actions by all the actors who acted in the specific accident would be generated,
for all immediate users in need of a complete technical description of the accident. The
second output could be an abbreviated, more generalized model, such as is found in an
NTSB surface accident report[18] or in the hazardous materials field.[19] Criteria for
entries on such a general process chart would depend on its use; reference 19 describes
possible use for development of countermeasure strategies.

Applications of Accident Theory

The accident process flow chart preparation seems most nearly available in air carrier
investigations. The FDR charts, now routinely slotted, are often correlated with the cockpit voice recorder (CVR) data in a linear form[20] which could readily be converted to a multilinear events chart. Actions of others such as air traffic controllers, as indicated by the
ATC tapes, could be added. Any gaps in the events sequence discovered by the application
of the proceed/follow logic tests for any of the actors could be bridged by the use of logic
tree analysis methods. On a linear scale, the same technique can be used in light aircraft
accidents.

To provide an indication of the work effort involved, the following procedural steps are
presented; they reflect the approximate order to be followed to produce the detailed chart.

1. Determine, in gross terms, the apparent events sequence that describes what happened,
and sketch it in events chart form.

2. From this gross description, delineate the actors (animate and inanimate) whose
probably were involved in the accident process, i.e., the pilot, an aircraft component, the
controller, wind currents, passengers, etc.

3. Using the general process model described above, tentatively assign to to the point in the
flight when the perturbation which transformed homeostasis occurred.

4. In a vertical column ahead of to list on a large chart each actor so the actions of each
actor can be listed chronologically across the chart according to the time the action
occurred (approximately, if necessary.)

5. Begin to record the “actions” of each actor for which supportable evidentiary data is
developed. Add to these entries as new evidence is developed. Note that the search for
evidence is guided by the gaps which become visible in the action sequence and the
general process model.

6. Test each event pair entered on the chart against its temporal and spatial proceed/follow
logic, both vertically for its relationship with actions of other actors and horizontally for its
relationship to prior or subsequent actions (chronology) by that actor. This is the key
method of validating assumed events or time/space relationships.

7. Where evidence of missing actions, suggested by the logic tests in step 6, can not be
located, for whatever reason, construct a logic tree to identify possible predecessor events
or actions, using the event or action to the right of the gap as the “top” event for the
tree.[21] It is likely that evidence of one or more of the hypothesized events placed on the
tree can be found to identify a “critical path.” Alternatively, the use of simulators has
helped to discover missing actions, or establish informed judgments about the comparative
likelihood of alternative critical paths through the logic tree.

8. Insert the most likely events sequence for each actor and then test the vertical
chronological or spatial relationships. Repeat the cycle if logic errors appear.

9. Compare the refined multilinear events sequence logic chart against the general accident
process model, and verify t0 and tend. Note that the cascading events or actions as harm
cascades, either in series or parallel, may become very complex. These events usually
progress naturally according to physical laws. The value of detailing this phase of the
process may or may not warrant the level of detail if catastrophes are analyzed and the
injury mode is repeated frequently.

10. Prepare a refined process chart of the entire accident.

11. Depending on the purpose of the investigation, a companion chart on which the path of
correctable events flows is shown, and to which the necessary and sufficient conditions for
the events to occur are added, can be prepared. This procedure provides an approach for
identifying corrective actions which might be taken to reduce future risk.

Rules to govern the description and coding of the process charts have not yet been
developed. Codes denoting precise events sequence pairs or sets or patterns seem to be
feasible. The development of libraries of accident “process patterns” by professional
investigators also seems feasible.

Such descriptions of accidents should help to dispel semantic difficulties in the accident
investigation and safety field. For example, if the time required to adapt to a perturbation
is less than the time it takes for the human organism to process the data and go through the
physical motions of implementing the action selected, how should this be described? As
human error, or human perception, diagnostic, or muscular limitations? A narrative is not
very informative compared to a process chart which displays these relationships.

Expectations of an Accident Theory.

What can the application of this theory and the related charting procedures do for the
professional accident investigator? Since both the theory and methods are essentially
untested, prediction of the effects of their use is highly speculative. However, based on the
author’s experience, the following expectations appear reasonable.

1. The efficiency of accident investigations will be significantly enhanced. This will be
accomplished by reducing the quantity of data needed to explain the accident, and by
introducing “objectives” toward which the investigator is able to narrow his search for
facts. No longer need the investigator “get all the facts” and then come home for the
analysis, hopeful that he has all the data he needs.

2. It appears that “templates” of accident processes could be developed so each accident
does not constitute a mystery for the investigator.[22] Accumulation of accident data in
chart form would make available a “library” of accident processes for numerous purposes
such as training, design, safety regulations, etc.

3. Development and adoption of systematically organized assumptions, principles and
procedures by accident investigators would elevate their activities to professional status, if
other considerations of a profession were met.

4. The availability of process charts would probably have a profound effect on safety
research, and probably would permit the development of risk analyses based on the
resultant data base and process research.

5. The visualization of the processes would be likely to change the public’s concept of the
nature of accidents, and changes in liability and tort concepts would be likely to follow as
the nature of accidents is clarified.

What Can You Do?

Now, let us consider the purpose of a profession—-the rendering of a public service. If you
concur with the contention that the accident investigation field would benefit by the
development of accident theory and systematically organized rules of procedure, then you
can make some specific contributions.

One approach is to take the theory and procedures advanced in this paper, apply them in
your work, and help to correct or refine them. Make an effort to identify—-and chart—-
the t0 and the perturbing, adaptive, stressing, injurious, cascading and subsiding events in
the accident.

Secondly, review past accidents that you have investigated, as time permits, and identify
these same events sequences in these accidents. Chart them, too. In other words, help to
build the data base to support the process theory and methods.

Third, share the results of your experience, through the SASI FORUM or perhaps, through
SASI, establish a mechanism for the exchange of professional criticism of these process
`templates.” This assumes you are not inhibited from such exchanges by your work or
position. If you are so inhibited, start to try to change the constraints. Suppression of such
exchanges seems contrary to one’s professional interests.

Lastly, if the theories which have been suggested are unsatisfactory to you, propose your
alternatives for testing by your fellow SASI members. In my view, air safety investigators
are in a unique position to exercise leadership in this effort, because of the FDR, CVR and
other records of actions by most of the actors involved in accidents. If you have the will,
yours can become an outstanding contribution in the safety field.
———————
This module introduces you to the concepts of assessment and analysis as they relate to the
accident investigation process. We’ll review some theories of accident causation and
discuss the process of developing and analyzing the sequence of events occurring prior to,
during, and immediately after an accident.

Sorting it all out…
We’ve collected a lot of factual data and it’s strewn all over the desk. The task now is to
turn that data into useful information. We’ve got to somehow take this data and make some
sense of it. It’s important to know that we are not just conducting an “assessment” to
determine what actors and acts were present. More importantly, we’re conducting an
“analysis” to determine specifically how system weaknesses interacted with those actors
and acts to cause the accident.

Analysis defined

Webster defines analysis as the, “separation of an intellectual or substantial whole into its
parts for individual study.”

When there is a workplace accident we need to separate or “break down” the accident
process (the whole) into its component parts (events) for study to determine how they
relate to the whole. Since the accident, itself, is the main event, its component “parts” may
be thought of as the individual events leading up to and including the main event or the
accident. The accident investigator’s challenge is to effectively assess and analyze each
event to determine if and how it contributed to the accident. To do this we need to makes
assumptions about what causes accidents…why they happen.

Why accidents happen

Over the past century, safety professionals have tried to more effectively explain how and
why accidents occur. As you will see below, their explanations were at first rather
simplistic. Theorists gradually realized that it was not sufficient to explain away workplace
accidents as simple cause-effect events. The developed new theories that better explained
the complicated interaction among conditions, behaviors and systems that result in an
accident. Let’s take a look at some of these theories.

• Single Event Theory – “Common sense” leads us to this explanation. An accident is
thought to be the result of a single, one-time easily identifiable, unusual, unexpected
occurrence that results in injury or illness. Some still believe this explanation to be
adequate. It’s convenient to simply blame the victim when an accident occurs. For
instance, if a worker cuts her hand on a sharp edge of a work surface, her lack of
attentiveness may be explained as the cause of the accident. ALL responsibility for
the accident is placed squarely on the shoulders of the employees. An accident
investigator who has adopted this explanation for accidents will not produce quality
investigation reports that result in long-term corrective actions.

• The Domino Theory – This explanation describes an accident as a series of related
occurrences which lead to a final event that results in injury or illness. Like
dominos, stacked in a row, the first domino falling sets off a chain reaction of
related events that result in an injury or illness. The accident investigator will
assume that by eliminating any one of those actions or events, the chain will be
broken and future accidents prevented. In the example above, the investigator may
recommend removing the sharp edge of the work surface (an engineering control) to
prevent any future injuries. This explanation still ignores important underlying
system weaknesses or root causes for accidents.

Multiple Cause Theory – This explanation takes us beyond the rather simplistic
assumptions of the single event and domino theories. Once again, accidents are not
assumed to be simple events. They are the result of a series of random related or unrelated
acts/events that somehow interact to cause the accident. Unlike the domino theory, the
investigator will realize that eliminating one of the events does not assure prevention of
future accidents. Removing the sharp edge of a work surface does not guarantee a similar
injury will be prevented at the same or other workstation. Many other factors may have
contributed to an injury. An accident investigation will not only recommend corrective
actions to remove the sharp surface, it will also address the underlying system weaknesses
that caused it.

Developing the sequence of events

Our challenge at this point in the investigation process is to accurately determine the
sequence of events in the accident process so that we can more effectively analyze the
accident process.

Once the steps in the process are developed, we can then study each
event to determine related:

• Hazardous conditions. Things and states that directly caused the accident

• Unsafe behaviors. Actions taken/not taken that contributed to the accident.

• System weaknesses. Underlying inadequate or missing programs, plans, policies,
processes, and procedures that contributed to the accident.

We’ll study these in the next module.

The final event in an unplanned process

When we understand that the accident is actually the final event in an unplanned process,
we’ll naturally want to know what the initial event was. When the initial event occurs, it
effects the actions of others, setting in motion a potentially very complicated process
eventually ending in an injury or illness. The trick is to take the information gathered and
arrange so that we can accurately determine what initial condition and/or action
transformed the planned work process into an unplanned accident process.

Remember, that in the multiple-cause approach to accident investigation, many events may
occur, each contributing to the final event. For instance, if a supervisor ignores an unsafe
behavior because doing so is not thought to be his or her responsibility, the failure to
enforce behavior represents an event in the production process that may contribute to or
increase the probability of an accident.

Each event in the unplanned accident process describes a unique:

• Actor. An individual or object that directly influenced the flow of the sequence of
events. An actor may participate in the process or merely observe the process. An
actor initiates a change by performing or failing to perform an action.

• Action. Something that is done by an actor. Actions may or may not be observable.
An action may describe something that is done or not done. Failure to act should be
though of as an act in itself.

It’s important to understand that when describing events, first indicate the actor, then tell
what the actor does. Remember, the actor is the “doer,” not the person or object being
acted upon or otherwise having something done to them. For instance, take a look at the
statement below:

ARTICLE:

Incident Investigation: Rethinking the Chain of Events Analogy

A chain of events that leads to an incident seems like a good model to use
in investigating accidents and injuries. But the logic behind the chain may
be its weakest link.
by Allan T. Goldberg

The chain is both a tool and a symbol that is familiar to one and all. Almost
inseparable from any thinking involving a chain is the notion that a chain will fail at
its weakest link.

In the safety profession, we frequently use a chain analogy in describing incidents
and their causation. This most commonly takes the form of relating an incident to a
chain of events. Within this chain of events, we look for the weak link as a means of
identifying what went wrong that allowed the incident to occur. We then very often
go further and identify a specific human error that was made, and the person who
made it. That person, and/or what they did or didn’t do, is thought of as a weak link
in the sense of a “performance” chain. Rigid adherence to this way of thinking can
lead to some significant errors in improving safety performance. We can and should
avoid them.

There are three main problems that this traditional thinking about the chain of
events analogy can lead to:

1. The very notion of a chain invokes an image of a linear sequence and can lead
to a failure to acknowledge the multivariable nature of outcomes in systems where
people are involved. That is to say, there are, in fact, many different possible paths
to an incident. A consequence of ignoring multivariable outcomes is the incorrect
notion that any one change or interruption in “the chain” will prevent an incident. In
reality, this wishful thinking is seldom the case.

2. The “weakest link” approach implies that there is only one “main” cause for a
given incident, and that doing something directly to deal with that one cause will
preclude a recurrence of the incident. This is very much at odds with modern
thinking on multiple causation factors in virtually all incidents. It compounds the
problem by tending to focus on what are commonly called direct or immediate
causes, at the expense of getting to the root or underlying causes.

3. Looking almost exclusively at the weak link creates a focus on the point of
failure and assumes that this is also the best and most effective point of control.
The point of failure is often well removed from the best point of control. Not
understanding this crucial concept is an error that can make it nearly impossible to
seek out and deal with root causes of a problem and the system deficiencies that
underlie those root causes. It also has significant implications towards
overemphasis on behavioral approaches or any single-point intervention technique.
Every link in a physical chain is in fact only connected to one other on each end.
The real world chain of events, however, has many more “options” in terms of
inputs and outputs. Breaking a single “link” will not necessarily preclude the end
event from occurring.

Human actions are a combination of attitudes, beliefs, moods, training, awareness
and many other factors. The point being, we may not respond to a given situation
today the same way we did yesterday. The key idea here is that many sets of
inputs and outputs are possibilities in incident causation. We must be very careful
to avoid thinking about causation in a purely linear manner.

It is not that hard to find what is apparently a single weak link in almost any given
incident situation, whether it is a physical problem, a human error problem or some
combination of both. In fact, it is almost too easy. Too easy, that is, in the sense
that once we do find the weak link, we tend to stop looking for any other sources of
the problem. It is vitally important to move past the notion that there is only one
cause for an incident, or the almost congruent notion that only one thing needs to
be corrected to preclude a recurrence. It is also important to note that any and all
immediate or direct causes are but symptoms of more serious problems, the root
causes. The failed link itself is a direct cause, the observable multiple factors
leading to it are likewise, and until we ask why those are present, we can all too
easily overlook the root (or underlying) causes.

Root causes are likely to apply to a whole series of potential incidents, not just one
event. These root causes are in fact the key to prevention of future incidents. And
contrary to what all too many people may think, human error is not one of them!
Human error itself is a symptom that there are other problems in the management
of the work that is taking place. These error problems themselves have root causes.
When a worker makes an error or fails to follow a procedure, there are reasons that
set up the situation. These are the root causes that must be found.

Corrective Action

When we look at the failed link in a chain, it can be very tempting to focus all
attention on keeping that one link from failing again. How should we go about doing
that? The most obvious immediate course of action might be to repair and/or
strengthen that one link so that it is no longer the weak point. This sets us up for
failure, for as was pointed out previously, the failure of the link is just a symptom.
The difficulty is a failure to see the difference between the point of failure and the
point of control. It is often necessary to design corrective actions for both places,
but we need to base such a decision on careful analysis. Another way to think of
this is that unless and until you are reasonably sure of all the factors leading to a
problem, you can’t make an effective decision on how to control the problem.
The leading writers in quality management disciplines point out that at least 85
percent of the factors leading to quality problems are the responsibility of
management, yet we in the safety profession still deal with believers (particularly
among the managers we work for) that a similar percentage of safety incidents are
the sole result of “unsafe acts” of the workers. Errors or omissions on the part of
executives and managers do not enter into this equation. Such thinking is then too often used as justification for over-reliance on single-point approaches to behavior-based safety (BBS), when in reality, there is no single point where the problem can be dealt with exclusively. By the way, please do not take this statement to be a denunciation of BBS; it is a proven and useful part of an overall approach to safety
improvement.

What we cannot do is allow ourselves to think that the only place human error can
be effectively dealt with is at the individual worker level. That approach to BBS falls
prey to the problems inherent in misinterpreting the weak link problem. So where is
the most effective point of control, if not at the point of failure? It is back where all
aspects of the workplace are actually controlled, at the heart of the management
system governing the organization.

Consider the following example. A large trucking company has a policy to fire any
driver who has a “preventable” traffic accident. This in fact keeps that driver from
having another accident (for that company), but does nothing to improve the
performance of the company’s remaining drivers. If the same company determines
the root causes and points of control leading to the first accident, effective remedial
actions will have a positive effect on all of the company’s drivers. Which approach
makes more sense? It depends on whether you want to address only the broken
link, or the whole “chain system.” Most of us shouldn’t have much trouble making
the most effective choice.

Avoiding Pitfalls

We have looked at three ways that the chain of events analogy is commonly
misused. In each of these areas, we have seen that these problems can keep us
from finding useful solutions to incident prevention. As in so many other situations,
the very problems themselves contain the seeds of their own solutions. The chain
analogy can be a useful tool in dealing with incidents, but only if we avoid the
pitfalls to which its traditional interpretation can lead. There are key aspects to
consider in making sure we get it right:

Recognize the multivariable nature of incident causation. Avoid the trap of thinking
that there is only one path to an incident and that any change made along the way
will provide adequate protection against recurrence.

Understand the Principle of Multiple Causes. Look for all the causes of an incident,
not just at the failed link in the chain. Make sure you find root causes as well as
direct causes, and don’t mistake human error as a root cause.
Realize the point of failure and the point of control are not necessarily the same.
Seek to understand the problem as part of the overall system, and identify where
the system itself can be best controlled.

When incidents are looked at in this manner, great success can be achieved.
Instead of misleading us, the chain analogy can be an effective component in our
toolbox, joining timelines, Ishikawa (fishbone) diagrams, and various other analysis
techniques as vital ways to help solve problems. Edmund Burke, the English
political philosopher, said, “Experience is the school of mankind, and they will learn
at no other.” Almost all of us have experience in thinking about or using the chain
analogy. We need not abandon or ignore this experience, but we do need to rethink
how we use it in interpreting events. When we use the chain analogy properly, it
will become a more useful way to help us find the solutions to new and ever more
complex problems. Effective controls to the causes of incidents can and must be
found. We can’t afford to do less in a world of hazards ready to lead to serious
workplace incidents.