JousnaE of Ucc~~~~iona~ Accidents, 3 (1981) 129-140 Elsevier Scientific Publishing Company, Amsterdam - Printed in Belgium

129

~NV~ST~~ATING AGG~~ENTS AND ~E~~G~N~ RISKS - _ A ~~NAMIG APPROACH

URBAN KJELLl&V and TORE J. LARSSON

Uc~u~u~~ona~ Accident Resew& Unit, Royal Institute of Teclmofogy, S-100 44 Stmhhotm $Stueden)

(Received November 3, 1980)

ABSTRACT

Kjellen, U. and Larsson, T.J~ 1981. Investigating accidents and reducing risks - A dynamic approach. Journal of Occrrpational slccidents, 3: l29--140.

A conceptual model for practical investigation of occupational accidents within the in- dustrial company is presented.

The model comprises two levels of investigation. On the accident sequence level, devia- tions or chains of deviations are mapped. On the second, de~e~~~~~ng factors ievel, the production process conditions related to the accident are highlighted.

A preliminary version of the model has been used in five pilot studies within different branches of Swedish industry. Results show that information existing within the company on accident sequences and determining factors, but not included in the accident reports used by the local safety organisation, could be tapped by applying the model in the inves- tigative procedure.

The authors propose to use the model in intervention projects within Swedish compa- nies aimed at establishing new methods in local accident prevention. The analysis of acci- dents and the development of counter=measures will take place in a structured group set- ting including workers, management and staff.

Investigations into industrial accidents in Sweden are conducted in a num- ber of different ways at present. As regards less serious accidents, the foreman or supervisor will usually fill in a form during an interview with the injured person. The form may be for internal use by the company, or may be the official form of the National Social Insurance Board. In the case of serious accidents, a more detailed investigation will be carried out by the internal safe- ty unit at the company, a fabour inspector or the police. One of the difficulties in using the results of such investigations in accident prevention work is that the documentation is often incomplete or faulty. This mainly applies to in- vestigations conducted by the site foreman, for example, but is also true of investigations carried out by the internal safety unit, the labour inspector, etc. An important reasun for this is the unsystematic approach used during

63766349/81/0000-0000/$02.50 0 3981 Elsevier Scientific Publishing Company

130

the investigation, which itself may be the result of inadequate knowledge of the link between the occurrence of injuries and the conditions existing at the workplace and within the company.

To solve this problem, numerous aids to accident investigation have been produced in recent years. Several of these are based on different models or views of the occurrence of injuries from accidents. Several analytical aids and models are rooted in systems theory. According to such theory, an acci- dent is seen as an abnormal effect of the system. The causes of the accident are defects in individual parts of a system or in the interaction between them. In a fault-tree analysis, the point of departure is the injury itself, on which a logic tree is then constructed to show the relationships between the faults in the system that have caused the injury to occur (Recht, 1965). A variant of the fault-tree analysis is the INRS model for the analysis of accidents (Leplat, 1978; Monteau, 1977). An injury is seen as an effect of a sequence of events in the form of deviations from an expected work cycle. The analysis of an accident involves identification of these deviations and the relationships be- tween them. MORT is a standardised checklist, which is based on a logic tree for identification of the special oversights and omissions in the accident situation, and the general weaknesses in the company’s management system (Johnson, 1975).

The energy model is associated with practical experience gained in technic- al safety work (Gibson, 1961; Haddon, 1968). Using the energy model, it is possible to identify the situation that has resulted in energy being built up, released and subsequently giving rise to injury. The hazard-carrier theory (Die Gefahrentragertheorie, Skiba, 1973) is a variant of the energy model. In this model an injury is seen as the result of a collision between an individual (the subject) and his environment (the object), whereupon energy is released. The reason for such a collision occurring lies in technical, human and organisa- tional conditions.

In the process model, an accident is seen as a sequence of events, which implies that the time factor is an important part of the description of an ac- cident. The domino theory is an early variant of this model and has had a great deal of influence on practical investigation work (Heinrich, 1936). The multilinear events sequencing method is a model for the description of the se- quence of events leading up to an accident (Benner, 1975). The model is partly based on the P-theory, according to which, the first event to create un- balance in the system constitutes the start of a chain of events that ends in the injury. In the model, the accident sequence is described as an interaction between various actors in the system. A description of the accident sequence constitutes the starting point for identification of the situation that can ex- plain why the accident occurred. The RoSPA model (Manning, 1974), AIM (Safety Sciences, 1978) and the ISA model (Lagerliif and Andersson, 1979) are examples of process models with a structured design, which renders the results from accident investigations suitable for statistical processing. In the RoSPA model, an accident can be described in the form of up to three suc-

131

cessive, unforeseen events, together with the type of movement and the type of objects that were involved in the respective events. The ISA model, which is used by the National Board of Occupational Safety and Health for national accident statistics in Sweden, describes the accident sequence in the form of an injury event, a contact event, pre-events and external factors, such as technical equipment and materials, that were involved in the events.

Another group of models, which have certain similarities with the process models, are based on information-psychology theories. The focus of these models is the individual, i.e., the way in which the operator deals with hazards and system dist~bances. In Surry’s model, which has subsequently been further developed by Andersson et al., an accident occurs as a consequence of an individual having failed to identify, or bring under control, hazards in the system (Surry, 1969; Andersson et al., 1978; Andersson and Svanstrom, 1980). In Hale and Hale’s model, an accident is the result of an individual’s inability to cope with a deviation in a system (Hale and Hale, 1970; Corlett and Gilbank, 1978). The inability of the individual may be due to a mistaken conception of the environment, or incorrect decisions or actions. These types of models result in lists of questions about the situations that could have been significant to the accident, and the answers must be decided on by the investi- gators.

The above mentioned models are of varying scope. The research carried out by the Occupational Accident Research Unit (OARU) aims at implementing changes in industry to reduce accidents. The OARU therefore needs an ap- proach that constitutes a compromise between theoretical considerations and practical applications and is geared towards action. Some important require- ments thus considered were:

(1) The model should be suitable for practical investigation work. (2) The concepts and definitions in the model should be easy to under-

stand and should be related to concepts and terms that are in general use. (3) The model should be suitable for use for different types of accidents

and systems. (4) The model should be complete, i.e. no important causal factors should

be omitted. (5) Use of the model should result in information that indicates hazards

and is suitable for use in the preventive work. A scrutiny of different models has shown that it is difficult to find one

model that meets all the requirements. Accordingly, MORT, for example, is far too complex for use in other than very detailed investigations conducted by experts. Some models are characterised by being so abstract that they can- not be regarded as a practical aid to safety officers and the like in investigation work. This applies to some of the system models, such as the fault-tree anal- ysis model and the INRS model, and also to models based on information- psychology theories. With the pure form of the energy model, there is a risk that important psychological and organisational factors that could give rise to accidents will be omitted from the investigation.

132

We have found that there is a need for continued work on the development of a model that meets the requirements for practical applicability and useful- ness. Moreover, it should be possible to develop a model that meets scientific requirements for validity, reliability and intersubjectivity. The model presented here represents a further development and synthesis of a number of existing and proven models. Important aspects of the model have been taken from Benner’s variant of the process model (Benner, 1975) and from the “inci- dental factors” concept according to Faverge and Leplat (Faverge, 1967; Leplat, 1978). The energy model (Gibson, 1961) and Surry’s model (Surry, 1969) have also contributed to the model. The model is based on a descrip- tion of the accident sequence. Linked to this is a systems checklist, the pur- pose of which is to elucidate the relationship between the actual sequence of events that resulted in personal injury, and the technical, organisational, economic, psychological and social circumstances within the given industrial system.

THE DEVELOPMENT OF THE MODEL

A preliminary version of the model presented here was developed during planning carried out by the OARU, early in 1979, of five parallel projects at different companies.

Discussions during 1979 about the model and its application in practice resulted in an instrument for data collection and updating, which is still in the formative stage.

The most important subgoal in the preliminary project was to examine reports of accidents that had occurred, and, together with the safety engineers and safety officers at the companies, supplement the findings of the report. The present model was used in this work, largely as a method of systematis- ing the knowledge of the above persons on the events and causes.

A certain degree of initial success was achieved in the use of the model as a systematic, heuristic method of accident investigation. Several intervention studies, in which the model will be used as an aid, are planned for initiating changes at the co’mpanies.

DESCRIPTION OF THE MODEL

The model is typically intended for description and analysis of accidents resulting in one-person injuries. In brief, the model has two levels: the acci- dent sequence, and the underlying, determining factors. In the application of the model, the accident sequence is systematised in a chain of deviations, of varying durations, with the deviations arranged chronologically from the initiatory phase, to the concluding phase and through to the injury phase. Thus, on the first level in the model, the deviations that have preceded, triggered and inflicted the actual injury are specified. On the second level of the model, the underlying, determining factors that may have contributed to

133

the accident sequence are highlighted. The model does not contain any ex- plicit, clear-cut, causal relationships, but includes a checklist of those aspects of the system, of which the production process is a part, that are pertinent to safety hazards.

The immediate amelioration of the injury takes place in a first-aid phase, which is de-emphasised in this model. Focussing on the system of production in the model, however, covers some important deviations and determining fac- tors pertinent to the physical outcome of the injury.

The use of the model in practice may therefore be summarised as follows: (1) All deviations in the process associated with the injury (including any

that may not be documented in the accident report) are systematised and arranged in chronological order.

(2) A description is made of the determining factors that are relevant to the accident sequence.

(3) The list of deviations and determining factors is used in the talks that are held to decide on action at different levels within the company to enhance safety. The safety measures may be of two kinds: improved control of devia- tions from the planned process or changes in the process itself (e.g. the deter- mining factors).

DEFINITIONS

The point of departure is the injury. This occurs in a phase in which an external, physical force causes damage to the body tissue. The phase is initiated when the body starts to absorb energy and continues until the body has fully absorbed the energy or the energy flow has ceased.

The concluding phase is initiated when a flow of energy is inadvertently released and the individual stands in its way. During the concluding phase, the sequence of events is usually very rapid and an individual has little or no chance of controlling the situation.

The initiatory phase starts when there is a deviation in the production system, which at the same time is the first logical and chronological occurrence in the sequence of events resulting in the injury.

A deviation is an event or a condition in the production process that con- flicts with the norm for the faultless and planned process. In this approach, a near-accident is a deviation or a chain of deviations which gives rise to the concluding phase but not to an injury phase and is subjectively perceived as hazardous. The injury phase may be averted, for example, by an individual managing to stop the flow of energy or to escape from its path.

The above definitions refer to the first level of the model - the accident sequence. The determining factors, on the other hand, are the relatively stable situations that represent the production-process conditions. Accordingly, these factors are given when the accident sequence is initiated. The factors consist of various aspects of the production system: technical, physical, organisational, economic, social and personal. This is the second level of the model.

134

The model has been translated into a checklist. The concepts have been chosen for the checklist on several criteria. They should describe the produc- tion system fairly exhaustively, describe and pinpoint the technical, organisa- tional and social functions of the system and point to the right function, person or phenomenon for proper counter-measures.

APPLICATION PROBLEMS

Three questions spring to mind: What is a deviation? What is a determining factor? How is a line drawn between deviations and determining factors?

The trouble with the majority of theoretical models - even in this field - is that it is seldom clear how they are to be applied in practice. Who shall use the model? And in what organisational situation? What should the objectives be? Every theoretical model in the field of social science will be, in some sense, relativistic and will have subjectivistic application. The objectives, which were clearly defined by the OARU in advance, were that the model should be suitable as a practical tool in the work to introduce changes. This implies that the model and the working method must be able to withstand the test of reality.

Thus, the application itself must decide where the line is to be drawn be- tween a deviation and a determining factor, between deviations in the ini- tiatory phase and the determining factors, and which deviations and determin- ing factors are relevant to the accident. The model is intended for use within a production system, by and together with the holders of several positions within the system. The basis of information is the knowledge and experience of the workers, the management and the staff.

Some may find it scientifically hard to accept that there is no explicit distinction between events and conditions in this model. To make this distinc- tion would, in our view, complicate the practical use of the model and would not necessarily promote an understanding of the accident sequence. The most important trait of this approach is the reaching of agreement on what is a normal, faultless and planned process and what is not. Geographically and/or temporally discernible occurrences of the latter kind are termed deviations.

Experience of the model so far has established that it is quite possible to draw a line between what is a faultlessly operating system and deviations from this. On the other hand, of course, opinions differ within the system on whether a particular production process condition is relevant to the occurrence of a given accident. What is intended is that the determining factors of the model/ checklist will be activated if there are differing views within the system on which solutions are satisfactory, safe and possible. It follows, then, that a determining factor will not be considered when everyone within the system agrees that the conditions are satisfactory. Obviously a determining factor in the model/checklist will also be considered as relevant, when everyone within the system agrees that a problem has not been solved satisfactorily.

In the implementation of changes, it is realistic to assume that opinions will

135

differ about the cause of the problem. This is also one of the main points of departure for the application of the model presented here. Conflicts of in- terests and views are assumed and agreement on practical counter-measures by way of making the differences in opinion explicit, is the goal.

INVESTIGATION OF ACCIDENT CASES

0 bjec tives and scope

A number of accident reports were studied and supplemented by interviews for the purpose of evaluating and supplementing a preliminary version of the model of the accident sequence. The investigation was part of a project which included extensive study of safety hazards and safety work at six companies operating in five different fields of activity: mining, steelworks, building, re- pair work and work on the railways (Carlsson, 1980a; Carlsson, 1980b; Harms-Ringdahl, 1980; Kjellen, 1980; Larsson, 1980; Nilsson, 1980). The criteria used for the evaluation of the model are discussed in the introduction.

In the application of the model, a checklist has been used which includes a list of deviations and determining factors. Figure 1 shows a modified version of the checklist used in the field-work.

Data collection and analysis

A total of 182 accidents, which occurred between 1977 and 1979 and resulted in at least one day’s sick leave, were included in the investigation. The accident reports were obtained from the safety unit at the respective compa- nies and were compiled by the foreman or supervisor, who completed the forms required for registration with the National Social Insurance Board.

The supplementary interviews were carried out by researchers from OARU in 1979, i.e. up to 3 years after the accident occurred. Generally speaking, the interviewee was a foreman or supervisor, or a safety officer who was employed at the workplace and was familiar with the accident. The basic information for the interviews included the official occupational injury report for the rele- vant accident and a special questionnaire, which was based on the preliminary version of the model of the accident sequence.

The researcher who conducted the interview carried out preliminary pro- cessing and classification of the interview results. The final classification of the information for each field of activity was carried out by the authors, to- gether with the interviewer. The results were used in a statistical analysis and in a specification and modification of the model.

Example: Investigation of an accident on a building site

The results of an investigation into an accident on a building site are given to illustrate the application of the model. The accident occurred during the

136

CONCEPTUAL FRAMEWORK AND MODEL OF OCCUPATIONAL ACCIDENTS (1979) I-- ~~

DETERMINING/SURROUNDING FACTORS ~~ ~7

Physical/technical (F) Organisational/ Social/individual (S)

1) Workplace layout 2) Design of equipment 3) Physical hazard

(energy) 4) Physical environment 5) Protective equipment 6) Intensity of work 7) Method of work 8) Work material

DEVIATIONS

economical (0)

1) Routines of de- cisions on premises, construction/buying of equipment

2) Maintenance routines 3) Quality control

4

5) 6) 7)

8)

9)

10) 11)

12)

Organisation of work/manning 5) Activity planning Education/training 6) Systems of remuneration/ promotion/ sanctioning Controls of other type, e.g. economic, “third party”, etc. System of shift/ work-time Instructions/rules Routines in safety work Organisation of first aid

1)

2)

3) 4)

1

a) Deviation in the flow of material b) Deviation in the flow of labour power c) Deviation in the flow of information d) Technical deviation in the man/machine system e) Human deviation in the man/machine system f) Deviation through intersecting or parallel activities g) Deviation in the surrounding environment ~ -.1

I&%VIATIONS IN PROTECTIVE EQUIPMENT

a) Stationary guards

1) Part of body 2) Nature of injury

Work management/ instruction I

Informal information flow Workplace norms Individual norms and attitudes I

Individual knowledge and experience Special circumstances

Fig. 1. Checklist on deviations and determining factors.

137

erection of balcony access slabs on concrete beams. The work was carried out by three men, two of whom were on the building, the third being the crane operator. Adjustment of the position of the slabs during erection as well as commands to the crane operator were made from previously erected balcony access slabs.

On the occasion of the accident, N.N. was working with an apprentice, since his regular co-worker was off sick. Because the crane was needed by another work gang for casting work, the men were in a hurry. During the work, one of the balcony access slabs became stuck. Consequently, N.N. walked out on- to a beam so that he could reach the slab and adjust its position by means of a crowbar. During the work he slipped on the ice on the beam, lost his balance and fell backwards onto a concrete floor, one storey down.

Co-worker sick, replaced by apprentice (IIb)

Crane also needed elsewhere (IIf)

Ice on beam (IIg)

Building worker erected slab crooked (IIe)

Building worker walked out on beam

i to re-align slab (IIe) J INITIATORY PHASE CONCLUDING

PHASE INJURY PHASE

Fig. 2. Accident on building site.

The interview findings are shown in Fig. 2. As can be seen, the initiatory phase included several deviations. None of these were documented in the acci- dent report, which merely contained a description of the concluding phase and the resulting injury.

From interviews with various employees at the company, numerous acci- dent-determining factors in the erection of balcony access slabs were forth- coming:

(a) poor visibility from the crane (Fl) (b) working at height without adequate precautions (F3) (c) heavy concrete slabs used for balcony access floor (F8) (d) unsatisfactory replacement system for workers off sick (04) (e) unsatisfactory planning for the use of the crane (05) (f) piecework (07)

138

(g) short building period (08) (h) norms for risk-taking among building workers (S3)

Examples of remedies that could reduce or eliminate the danger of such acci- dents are:

(a) better visibility from the crane (b) safety netting in case of a fall (c) wood instead of concrete in the balcony access floor (d) improved replacement system for workers off sick (e) better planning for the use of the crane

Results

This section presents the results of a simple statistical analysis of the in- vestigation data. A comparison between the information contained in the acci- dent reports and that obtained from supplementary interviews reveals the fol- lowing:

(1) That only five of a total of 200 deviations during the concluding phase were forthcoming from the interviews, i.e. the concluding phase was fairly well documented by the accident reports.

(2) That out of a total of 224 deviations during the initiatory phase, 100 were forthcoming during the interviews, which represents an average of 0.6 deviations per accident. Of the deviations observed, 30 were human deviations, 14 were technical deviations, 11 were deviations in the information flow and 10 in the flow of labour. In contrast, only one deviation from the norm for permanent guards was forthcoming during the interviews.

(3) That of a total of 413, 353 determining factors were forthcoming dur- ing the interviews, which represents 1.9 determining factors per accident. The greatest absolute difference between the accident reports and interviews was in the physical/technical factors (219 additional factors were forthcoming), while the greatest relative difference was in organisational/economic factors (16 times as many determining factors were forthcoming during the inter- views).

(4) That there are wide differences between the different production sys- tems in the amount of information on deviations and determining factors that was forthcoming in the interviews. The new information about deviations dur- ing the initiatory phase varied between 0.3 and 1.2 deviations per accident, and for determining factors, between 1.2 and 4.4 per accident.

One conclusion to be drawn from the analysis is that the supplementary interviews based on the model were most valuable in elucidating the earlier events in the sequence and the determining factors. Another conclusion to be drawn is that although the differences between the various production systems, in terms of the new facts that were forthcoming from the interviews, were greatest in the determining factors, wide variations were also observed in deviations during the initiatory phase. The interview findings do not there- fore constitute an objective and comprehensive description of the sequence

139

of events and determining factors, but are dependent on numerous conditions governing the circumstances of the interview, e.g. the interviewee’s knowledge of the relevant production system and readiness to impart information, and the time that is devoted to the investigation.

DISCUSSION AND CONCLUSIONS

As is clear from the synopsis of the results presented in the last section, the model has been tested as an instrument for data collection at a number of Swedish companies. There is only limited scope for making generalisations and comparisons from these preliminary tests of the model. Some important prob- lems must be solved before the model will be suitable as a tool for use by safety organisations in bringing about changes within a company.

The situation in which data is collected must be structured and must in- clude persons familiar with a given accident, the way in which the work is performed and organised and the various levels and functions within the sys- tem. The participants should also represent different interests and functions within the company.

The operationalisation of deviation types and determining factors (which are currently of a general nature and not included in this paper) must be care- fully adapted to the given production system. As regards deviations, for ex- ample, special production conditions at a company may mean that the devia- tions will have to be defined more closely. Similarly, the determining factors must be translated into tangible conditions existing in the field and at the company, not least to make discussions on possible remedies and changes factual and creative.

The model must also be tested and accepted within the dynamic system that makes the decisions about occupational safety activities and safer produc- tion. As a result of the pilot studies, intervention projects on accident investiga- tion and systematic reporting of deviations are now proposed and initiated at Swedish companies. These discussions indicate that different interest groups inside these companies have accepted the basic principles of the approach presented in this paper.

The outcome of these projects will show whether it is possible to use the model in the development of safety information systems within specific branches of industry. These projects will also show if it will be possible to use the model as a risk-analysis and risk-simulation tool in future planning of new industrial environments.

REFERENCES

Andersson, R., Johansson, B., Linden, K., SvanstrGm, K. and Svanstrijm, L., 1978. Develop- ment of a model for research on occupational accidents. Journal of Occupational Accidents, 1: 341-352.

140

Andersson, R. and Svanstrom, L., 1980. Olycksfall i arbete- analys och AtgCrder, Stock- holm.

Benner, L., 1975. Accident investigations. Multilinear events sequencing methods. Journal of Safety Research, ‘7 (2): 67-73.

Carlsson, J., 1980a. Accident Risks and Safety Work. 1: A Steel Plant. (In Swedish) Royal Institute of Technology. Report No. Trita-AOG 0005, Stockholm.

Carlsson, J., 1980b. Accident Risks and Safety Work. 2: A Wire Rolling Mill. (In Swedish). Royal Institute of Technology. Report No. Trita-AOG-0006, Stockholm.

Corlett, E. and Gilbank, G., 1978. A systemic technique for accident analysis. Journal of Occupational Accidents, 2: 25-38.

Faverge, J.M., 1967. Psychosociologie des Accidents du Travail. Presses Universitaires de France, Paris.

Gibson, J., 1961. The contribution of experimental psychology to the formulation of the problem of safety. In: Behavioral Approaches to Accident Research. Association for the Aid of Crippled Children, New York.

Haddon, W., 1968. The changing approach to epidemiology, prevention and amelioration of trauma. American Journal of Public Health, 58(8): 1431-1438.

Hale, A.R. and Hale, M., 1970. Accidents in perspective. Occupational Psychology, 44: 115-121.

Harms-Ringdahl, L., 1980. Accident Risks and Safety Work. 5: Mobile Repairmen. (In Swedish) Royal Institute of Technology. Report No. Trita-AOG 0009, Stockholm.

Heinrich, H.W., 1936. Industrial Accident Prevention. McGraw Hill, New York. Johnson, W.G., 1975. MORT: the management oversight and risk tree. Journal of Safety

Research, 7(l): 4-15. Kjellen, U., 1980. Accident Risks and Safety Work. 4: House Construction. (In Swedish)

Royal Institute of Technology. Report No. Trita-AOG 0008, Stockholm. Lagerlof, E. and Andersson, R., 1979. The Swedish Information System on Occupational

Injuries. The Swedish Board of Occupational Safety and Health, Stockholm. Larsson, T. J., 1980. Accident Risks and Safety Work. 6: Railway Work. (In Swedish) Royal

Institute of Technology. Report No. Trita-AOG 0010, Stockholm. Leplat, J., 1978. Accident analyses and work analyses. Journal of Occupational Accidents,

1: 331-340. Manning, D., 1974. An accident model. Oecupat~onal Safety and Health, 4(l). Monteau, M., 1977. A practical method of investigation accident factors. Office for Offici-

al Publications of the European Community, Luxembourg. Nilsson, B.-C., 1980. Accident Risks and Safety Work. 3: Falling Stones and Scaling in

Mines. (In Swedish) Royal Institute of Technology. Report No. Trita-AOG 0007, Stockholm.

Recht, I.L., 1965. System safety analysis - a modern appraoch to safety problems. National Safety News, December 1965 and February, April, June 1966.

Safety Sciences, 1978. AIM: Accident Investigation Methodology. San Diego, California. Skiba, R., 1973. Die Gefahrentragertheorie. Bundesanstalt fur Arbeitsschutz und Unfall-

forschung. Forschungsbericht Nr. 106, Dortmund. Surry, J., 1969. Industrial Accident Research. A Human Engineering Approach. University

of Toronto, Canada.