Safety Science, 16 (1993) 417-438

Elsevier

417

Reducing risks by deviation control - a retrospection into a research strategy

Urban Kjellch” and Jan Hovdenb “Norsk Hydro ax, P.O. Box 200, N-1321 Stabekk, Norway

‘Norwegian Institute of Technology, N-7034 Trondheim, Norway

Abstract

A conceptual model for practical investigation of occupational accidents within industry was

presented in 1981. The model has served as a theoretical framework for research into safety man-

agement tools including methods for accident investigation, safety audits and risk analysis and

computerized safety information systems. The original model is presented and the subsequent

theoretical and applied research is reviewed. The significance of the model to the field of occu-

pational accident research in general and to safety practice is discussed. It is concluded that all

aspects of the original model have not survived the test of time. The model and the subsequent

research has contributed to a converging trend as regards accident theories and models. The con-

tribution from the model mainly lies in an improved understanding of the accident process and of

the deviation concept as a common element in many theories and models of accidents.

R&urn6

Un mod&le conceptuel pour mener a bien des etudes pratiques sur les accidents du travail dans

le secteur de l’industrie a &S present6 en 1961. Ce modele a et.6 utilise comme trame (theorique)

lors de recherches sur les outils de gestion de la securite comprenant les methodes utilisees pour

enqu8ter sur les accidents, les audits de securite, les analyses de risques et les systitmes d’infor-

mation informatiques sur la se’curitk. Le modele original est present& et les recherches appliquees

et theoriques effect&es par la suite ont Qtk revues. L’importance dudit modele dans le domaine

des recherches sur les accidents du travail en general et dans celui de la skcurite est discutee. On

arrive a la conclusion suivante, a savoir que tous les aspects du modele original n’ont pas subi avec

succes l’drosion du temps. Ce mod&le et les recherches qui ont suivi ont debouche sur une tendance

converge&e en ce qui concerne les theories sur les accidents et les modules. La contribution ap-

port& par ledit modele reside principalement dans une meilleure comprehension du processus de

l’accident et de l’idde de deviation comme &ant un element normal dans un grand nombre de

theories et modbles d’accidents.

Zusammenfassung

Im Jahre 1981 wurde ein Konzeptmodell zur praktischen Untersuchung von Arbeitsunfallen in

der Industrie dargestellt. Das Model1 hat als theoretischer Rahmen zur Forschung der Instrumente

zur Regelung der Sicherheit, LB. Methoden zur Untersuchung von Unfallen, Sicherheitskontrol-

len und Risikoanalysen sowie computerisierten Sicherheitsinformationssystemen gedient. Es wird

das ursprtingliche Model1 dargestellt und die anschlieRende theoretische bzw. angewandte For-

schung besprochen. Es wird gezeigt, welche Bedeutung das Model1 tir den Bereich der Forschung

von Arbeitsunfallen im allgemeinen sowie fi_ir die Sicherheitsvorkehrungen in der Praxis hat. Es

wird gefolgert, da& kein einziges Aspekt des ursprtinglichen Modells die Zeitprtifung tiberstanden

hat. Das Model1 und die anschliel3ende Forschung haben zu einem konvergierenden Trend in

bezug auf Unfalltheorien und Modelle beigetragen. Das Model1 hat vor allem zu einem besseren

Verstlndnis des Unfallablaufs und des Abweichungskonzeptes als gemeinsames Element in vielen

Theorien und Unfallmodellen gefiihrt.

1. Introduction

Basic to the systematic control of accidents is an understanding of the na- ture of this phenomenon. In older days, accidents were often viewed as being outside the scope of human control, i.e., they were determined by fate or were a punishment for sins and lack of moral standards. These types of fatalistic views of accidents are also found today among the general population as well as among, for example, safety executives (Hovden and Larsson, 1987). The implications are that archaic accident perceptions survive in parallel with more rational and action oriented perceptions.

Safety research has contributed to the development of rational and system- atic methods for accident control. In this tradition of safety research, there has been a focus on developing models of accidents which support inquiries into accidents and design of remedial actions. The potential of this strategy lies in supplying safety practice with efficient tools for collection and analysis of data about accident risks as well as in influencing the accident perceptions of the members of the industrial organization in a more rational direction.

This research tradition has its roots in the basic work in the 1920s by Hein- rich (1931). Heinrich’s domino theory of accidents was translated into ana- lytic tools for accident investigation and analysis and has been decisive in the further developments in safety management.

The development since Heinrich has been divergent and has gone through various phases with different focuses. In the 1960s and 1970s there was typi- cally a focus on technical faults and human errors and on logical relations between these. The 1980s was the era of safety management. The develop- ments in safety research during this period were influenced by the principles for quality assurance as represented by the International Standards Organi- zation IS0 9000-series and by the regulatory principles of Self Regulation and Internal Control (Hovden and Tinmannsvik, 1990). For recent overviews of accident theories and models, see Andersson (1991) and Laflamme (1990). Several attempts to synthesize have been made; however, these attempts have, in general, added to the diversity.

419

1.1. This paper

This paper takes as its point of departure an accident model that was origi- nally published in the Journal of Occupational Accidents in 1981 (Kjellen and Larsson, 1981). The model was the result of theoretical and empirical work within the Occupational Accident Research Unit (OARU) of the Royal Insti- tute of Technology in Stockholm and was developed for different purposes. One was to establish a common conceptual framework for the members of the OARU. A second aim was to support research into tools for use inside compa- nies in the systematic prevention of accidents.

The paper gives a summary description of the model, as it was presented in the original article. Subsequent research work by members of the OARU and other researchers are reviewed concerning research applications and further developments of the OARU model. The significance of the model to the field of occupational accident research as well as to safety practice is discussed. The aim is to evaluate the importance of the original research work that was pub- lished in the article of 1981 in the context of the developments since then.

2. The OARU model

The original OARU model was intended for use as an aid in investigations into accidents resulting in one-person injury. The following requirements were considered in the development of the model: (1) The model should be suitable for practical investigation work. (2 ) The concepts and definitions in the model should be easy to understand

and should be related to concepts and terms that are in general use. (3 ) The model should be applicable to different types of accidents and systems. (4) The model should be complete, i.e. no important causal factors should be

omitted. (5) Use of the model should result in information that indicates hazards and

is suitable for use in preventive work. In brief, the model has two levels: the accident sequence and the underlying,

determining factors. The accident sequence is described as a chain of deuia- tions, i.e. events or conditions which conflict with the norm for the faultless and planned production process. The determining factors are properties of the production system that affect the accident sequence, but change only slowly by comparison with it.

The accident sequence is divided into three phases. The initiatory phase starts when there is a deviation in the production system, which at the same time is the first logical and chronological occurrence in the sequence of events result- ing in injury. The concluding phase is initiated when the flow of energy is in- advertently released and the individual stands in its way. The injury phase

420

starts when the body begins to absorb energy and continues until the body has fully absorbed the energy.

A near accident is a deviation or sequence of deviations which includes a concluding phase but not an injury phase and which is perceived as hazardous.

Checklists of deviations and determining factors were developed in order to support the investigation of accidents, Fig. 1.

Two different preventive strategies were envisaged in addition to the short- term remedial action of correcting deviations; i.e., improved control of devia- tions and changes in determining factors. These preventive strategies had been further elaborated in an earlier report describing the OARU model and in- cluded (Kjellen and Larsson, 1980): (1) eliminating the possibility of the oc- currence or reducing the probability of certain types of deviations; (2) reduc- ing the expected consequences of the deviations; and (3 ) improved systems for detection and amelioration of deviations.

Various models of accidents and other sources had contributed to the OARU model. Important concepts that had been incorporated were the energy model by Gibson (1961)) accident process models by Benner (1975) and Haddon (1968) and according to ISA (Andersson and LagerlBf, 1983), and the “inci- dental factors” concept by Leplat (1978). Figure 2 shows a comparison be- tween the phases of the OARU model and other process models of accidents.

The taxonomies of deviations and determining factors were not derived from a clear cut theory of accidents. Important features are related to industrial engineering and socio-technical systems views (Seiler, 1967).

The original paper presented results from a study where the OARU model was used as a basis for content analyses of official accident reports and collec- tion and systematising of information from supervisors and safety engineers on the accidents in question. Figure 3 shows a typical example of the total results of an analysis of the accident report and the supplementary investigation.

The conclusion from the empirical work was that the supplementary inves- tigations were most valuable in elucidating the earlier events in the accident sequence and the determining factors. It was also concluded that the interview results concerning initiatory phase deviations and determining factors did not constitute an objective and comprehensive description of causal factors. They were dependent on numerous conditions governing the circumstances of the interview including the interviewee’s knowledge and readiness to share information.

It was recommended that data collection should be organized in such a way as to ensure input from persons familiar with the occurrence and the way the work is performed and organized. Persons representing the different levels and functions of the organization and different interests should also participate. It was further recommended that the operationalisation of deviations and deter- mining factors should be adapted to the given production system.

421

I DETERMINING/SUF

Physical / technical (F)

1) Workplace layout 2) Design of equipment 3) Physical hazard

(energy) 4) Physical environment 5) Protective equipment 6) Intensity of work 7) Method of work 8) Work material

XJNDING FACTORS

Drganisationall economical (0)

1) Routines of decisions, construction or buying of equipment 2) Maintenance routines 3) Quality control 4) Organisation of work, manning 5) Activity planning 6) Education, training 7) Systems of remuneration, promotion, sanctioning 8) Controls of other type, e.g. economic, "third party" 9) Systems of shift, work- time 10) Instructions, rules 11) Routines in safety work 12) Organisation of first aid

II DEVIATIONS a) Deviations in flow of material b) Deviations in the flow of labour power c) Deviations in the flow of information d) Technical deviation in the man-machine system e) Human deviation in the man-machine system f) Deviation throuqh intersectins or parallel activities gj Deviation in the surrounding envirbnment

Social/ individual (I)

1) Work management, instructions 2) Informal information flow 3) Workplace norms 4)Individual norms and attitudes 5) Individual knowledge and experience 6) Special circumstances

III DEVIATIONS IN PROTECTIVE EQUIPMENT a) Stationary guards b) Personal safety equipment

IV INJURY 1) Part of body 2) Nature of injury 3) Severity

Fig. l.Checkliston deviations and determining factors.

422

Andersson & Lagerlbf, 1983

First phase I

Second phase Haddon, 1968

I Initiatory OARU model phase I

Concluding phase I

Injury phase I

t

Lack of Loss 01 Body exposed control

Energy exposure control to energy ceases

Fig. 2. Relations between the phases of different models of accidents (Kjellkn, 1984a).

Co-worker sick, replaced by apprentice (IIb)

Crane also needed elsewhere (IIf)

Ice on beam (IIg)

Building worker erected slab crooked (IIe)

Building worker walked out on beam to re-align slab (IIe)

INITIATORY PEASE

Fig. 3. Accident at a building site.

I below (IIe)

CONCLUDING PHASE INJURY PHASE

3. Theoretical assessment of the deviation concept

Following this first phase of theoretical development, reviews of the accident research literature were performed in order to assess the potentials and limi- tations of the deviation concept as applied to occupational accident control (Kjellen, 1984a; Kjellen, 1984b; Kjellen, 1987b ).

The use of the term deviation requires the definition of a norm. A scrutiny of definitions of different terms in the research literature such as “critical in- cident”, “ unsafe act or condition” and “disturbance” showed that various types of norm were applied. These can be characterized as formal (i.e. standard, rule, regulation, planned) or informal (adequate, acceptable, usual/normal, ex-

423

petted or intended). It was suggested that deviations be defined in relation to formal norms in order to give support in establishing norms that produce rea- sonable risk levels and to improve the reliability of data collection.

An overview of taxonomies of deviations that are found in the research lit- erature was established and related to different theories of accidents. Special attention was paid to taxonomies of human actions that deviate from a norm, i.e. human errors. A comprehensive approach for analysis and classification of human errors was recommended. This should take into account theories and models related to: (1) the effects of physiological and motivational factors on the probability of human errors; and (2 ) the probability of maladaptive re- sponse by the operator to deviations.

A theoretical analysis of the relation between deviations and accidents was performed by developing a model for risk assessment. Measures of the signif- icance of incidents (i.e. concluding phase deviations) and initial phase devia- tions with respect to the risk of accidents were developed. Studies employing statistical and analytical methods for establishing relations between devia- tions and accidents were reviewed. It was concluded that it is not possible to establish general relations between types of deviations and accidents on the basis of this research. Taken together, the research literature gives support to the assumption that certain types of deviations or patterns of deviations are valid indicators of the risk of accidents in the context of the system in which they are observed.

The accident research literature describes various methods for collection of data on deviations, including accident and near-accident reporting, safety in- spections and safety/activity sampling. The review of the literature identified distinct problems for each method. These were related to the lack of reliability in data collection and to the filtering of data by type of deviation. The results supported conclusions from empirical studies of corporate safety practice, see Section 4.1. Measures to improve the reliability and comprehensiveness in data collection were discussed. These included use of structured checklists or ques- tionnaires, training of investigators and fixed routines.

4. A research strategy emanating from the OARU model

The original article identified needs for action oriented research into tools for use in safety practice in industry and by the authorities. The research work that followed was, in general, based on a common understanding of the objec- tive of the research and on a common conceptual framework for development of theories and methods. This sequence of research, which continues to de- velop, may be characterized as a research strategy (Gunnarsson, 1985 ).

A general basis for this research has been the conception that it is possible to prevent accidents through proper decisions in a structured decision making

424

safety information

PRODUCTION SYSTEM

Fig. 4. Model of a safety information system (Kjellkn, 1983b).

process, Fig. 4. Criteria for the evaluation of safety information systems to support these decisions were identified on the basis of general control theory and on the basis of earlier accident research (Kjellen, 1983a; see also Van Gigch, 1978; Tarrants, 1965). The criteria included: (1) scope of data collection in relation to production systems variables that have significant effects on the risk of accidents and that can be manipulated through management decisions; (2 ) reliability and timeliness of data collection; (3 ) the decision makers’ access to information when it is needed; (4) the extent to which the information is presented in a lucid and understandable manner; (5 ) cost-effectiveness; and (6) acceptance by those actively working with the system.

The tools that were developed have also been applied as research tools in various studies with the aim to explore accident causal factors and to evaluate the efficiency of preventive measures (see, for example, Backstrom and Harms- Ringdahl. 1984; Hallgren, 1992). This research is outside the scope of the pres- ent paper.

425

4.1. Evaluation of corporate safety information systems

The OARU model was applied in a content analysis of documents that had been produced by the safety organizations of six large and medium-sized com- panies, representing different branches of industry (Kjellen, 1982; see also Carlsson, 1980; Harms-Ringdahl, 1980; Kjellen, 1980; Larsson, 1980; Nilsson, 1980). The documents included accident reports, near-accident reports, safety inspection protocols and minutes from safety committee meetings. Compari- sons were made with results from supplementary interviews of supervisors and safety engineers on the accident occurrences (Kjellen and Larsson, 1981). The aim was to evaluate the usefulness of the information that was collected by the safety organizations at the six companies.

It was possible to interpret the results of the analysis in terms of filters in the data collection process rather than in terms of characteristics of the risk pictures of the six companies. In general, each type of document was related to a typical set of filters. These filters could be explained by data collection rou- tines and by the motivation and perceptions of the members of the safety or- ganizations of the companies.

Lost-time accident reports frequently lacked data on deviations in the initial (initiatory) phase of the accident sequence and about determining factors, although these types of data were available, though latent at the work places. The results were interpreted in terms of the accident investigator’s (usually the supervisor’s) accident perception and motivation. The supervisor’s legal responsibility for safety and lack of feedback were identified as factors influ- encing motivation.

Near-accident reports had mainly been used for collection of data on tech- nical deviations and determining factors. The lack of data on human errors was explained by the fact that anonymity could not be guaranteed and by fear of disciplinary action.

The safety inspections functioned as a means of tracing deviations repre- senting unsafe conditions at the work places, i.e. technical deviations, environ- mental deviations (chiefly poor housekeeping) and faulty guards. Only excep- tionally were deviations related to the method of work or determining factors such as shortcomings in design or routines identified.

The conclusion was made that the different filters narrowed the scope for the type and timing of corrective and preventive actions. For example, the focusing in accident investigations on the immediate cause of the injury (i.e. the concluding phase deviations or energy release) will direct the investigator towards remedies to stop the energy flow, i.e. protective devices. Safety in- spections will mainly result in correction of deviations. Further research should focus on ways to remove obstacles to a systematic utilization of experience about accident risks which full use of the OARU model could provide and on studies of the decision makers’ needs for information about accident risks.

426

4.2. Methods for accident investigation and safety audits

The research by the OARU following this original work took different direc- tions. One line of research was to develop methods for accident investigations and safety audits for use by safety practitioners in industry and government authorities.

In two studies on methods of accident investigations, the OARU model was the basis for the design of accident investigation forms and checklists and for the structuring of the investigation procedure (Harms-Ringdahl, 1983; Kjel- l&r, 1983a). An action research design was applied in the studies (cf. Clark, 1972 ). The method was tested by investigation teams consisting of supervisors, safety representatives of the workers and safety engineers at two paper mills and four construction sites. The aim was to evaluate the OARU model and to gain experience for the purpose of developing instruction materials on accident investigations.

The use of the OARU model in the development of tools for accident inves- tigations included the following: l Designing checklists, where deviations and determining factors were defined

and made operational through typical examples from the type of production in question. Efforts were made to use a terminology that was understood by the users, but the original taxonomies of the model were maintained.

l Splitting the investigation into two parts. The first part (immediate inves- tigation) should focus on collection of data on the sequence of events includ- ing deviations and on immediate remedies. The second part was carried out by an investigation team that met at regular intervals. The investigation team should concentrate on analyzing determining factors and on the devel- opment of more permanent safety measures.

l Defining the respective roles and responsibilities of the supervisor who per- formed the immediate investigation and the investigation team. The results of the accident investigations during the test period were com-

pared to the accident reports from the work places during a period prior to the test period. It was shown that the test resulted in increased information about initial phase deviations and determining factors. More important, however, was the improvement during the test period in the number and quality of the safety measures that were the result of the accident investigations. More long- term measures (i.e. changes in determining factors) were developed and these were of a more varied scope, i.e. covered measures directed at technical and organizational as well as individual factors.

Problems were encountered, especially at the construction sites, in drawing a line between what is a faultlessly operating system and deviations from this. This had to do with the focus of managerial control on work outcomes. The method of work was mainly left to the discretion of the worker. It was con- cluded from the study that the application of this type of accident investigation

427

method could be expected to increase the awareness among workers and man- agement of the norms de&in g the methods of work that will result in accept- able risk levels.

It was further concluded that the documentation of determining factors was unreliable. This finding is in line with the conclusions from the original study.

The so called SMORT-method (Safety Management and Organization Re- view Technique) represents a further development of the OARU model for use in accident investigations and safety audits (Kjellen et al., 1987). The method has been developed through cases studies by researchers and safety engineers. The following characteristics distinguish the SMORT method from the OARU model: l The SMORT-method is typically intended for use in analyzing severe acci-

dents and near accidents. Consequently, the injury or damage phase is ex- tended for accidents to include development of loss and emergency response.

l The critical phase (i.e. the concluding phase according to the OARU model) is more structured to account for typical accident scenarios in the process industry and includes the critical incident (i.e. the loss of control) and de- viations concerning active safety systems, passive protection (i.e. barriers including guards and personal protection) and personnel in the risk zone.

l The determining factors have been structured far more than in the original model and comprise three levels: daily operations; design and construction of new systems; and safety management. For each level, a set of checklists and questionnaires have been developed. This part of the method has been influenced by the MORT method (Johnson, 1980). The SMORT method defines and applies the deviation concept in accord-

ance with the original OARU model. A problem encountered in using SMORT in safety audits is that this definition and application differ from the way the term deviation or nonconformance is defined and applied in quality control (Norsk Verkstedindustris Standardiseringssentral, 1989). The term is in qual- ity control defined in relation to a well defined norm, i.e. a specified require- ment, whereas the term deviation in SMORT also includes conflicts with the planned production process, see Section 2. These plans need not necessarily be documented. The definition in accordance with quality control is too narrow for the purpose of giving a comprehensive description of the initial phase of the accident sequence. As to application, SMORT restricts the use of the de- viation concept to the accident sequence, whereas the quality control applica- tion is general.

The OARU model and the SMORT method have also influenced the devel- opment of an investigation chart for use by safety engineers in investigations of accidents in automatic production (Do& and Backstrom, 1990). The inves- tigator is directed towards questions about technical failures, human errors and faulty barriers or guards.

The original accident investigation method based on the OARU model as

428

well as variations of it are described in a number of text books and booklets for safety practitioners (see, for example, Kjellen and Moller, 1984; Kjellen et al., 1987; Kjellen, 1992; Harms-Ringdahl, 1993; Rosness, 1992 ). Harms-Ringdahl recommends a bi-level investigation strategy, where so called deviation anal- ysis is applied to in-depth investigation, based on the supervisor’s first report. A distinction is made between technical, human and organizational deviations. The subcategories of human deviations have not been derived from a clear-cut taxonomy but have been influenced by the taxonomies of Rasmussen (1987) and Reason (1990). The organizational deviation categories include classes of deviations as well as determining factors from the original OARU model. The concept of determining factor is abandoned.

The bi-level investigation strategy is similar to the one employed in SMORT analysis. Deviation analysis thus becomes an expert tool and a resulting high quality output of the analysis is to be expected. However, this is at the cost of risking to lose important data about the accident sequence due to the post- ponement of the identification of deviations to the in-depth investigation.

4.3. Computerized safety information systems

In studies at an air line and a steel mill, questions related to the need for information from long time experience of accidents and near accidents in de- cision making were addressed (Kjellen, 1986; Kjellen, 1987a). A data base on accident and near accident reports from a period of about two years was estab- lished at each company. The data base was supplemented with coded data about the main type of concluding phase deviation (i.e. injury inflicting energy) and with coded and free text data about initial phase deviations.

The data base at each company was employed in experiments involving sim- ulated decision-making situations. Information about accidents and near ac- cidents was retrieved, and the effect of the information on safety related de- cisions was evaluated. The information retrieval system that was utilized included powerful means for free text searches.

Results showed that the data bases were mainly used in retrieving single accident and near accident reports by searching for specific characteristics and in identifying concentrations of injuries and near accidents. A total of 28 ob- servations about each occurrence were stored in the data bases. Only a rela- tively small share of these were actually employed in searches in the data bases and in requests for displays of the results of the searches. The results indicated that structured information such as information about initial phase deviations had a relatively low utility in comparison with, for example, the free text de- scriptions of the sequence of events.

The conclusion was made that it is not necessary to use the full OARU model in the first phase of development of an accident and near-accident experience data base. A first priority should be to secure an efficient use of existing infor-

429

mation from routine accident and near accident reports by means of a powerful information retrieval system.

4.4. Methods of risk analysis

The OARU model has inspired the development of methods of risk analysis for use in analyzing production systems in both the operation and the design phase. Typical for this research has been that the researchers have had the dual role of developing the methods and of being actively involved as users in tests of the methods.

Deviation analysis was first introduced by Harms-Ringdahl in a study which aimed at demonstrating the feasibility of applying risk analysis in the improve- ment of safety in automatic systems (Harms-Ringdahl, 1986). The method was used in combination with energy analysis (Hammer, 1972). The analysis encompasses three steps: (1) summarize systems functions and operator ac- tivities and divide into subsections; (2 ) examine each activity in order to iden- tify possible deviations and assess the potential consequences of each devia- tion; and (3) develop remedies. A check-list similar to the one applied in deviation analysis in connection with accident investigations is utilized, see Section 4.2. In a follow up study the results of the application of these methods during design of a section of a paper mill were compared to experiences from accidents during a period of three years after the installation (Harms-Ring- dahl, 1987). The results showed that, for the system functions that were sim- ilar to those analyzed, the risk analyses had identified all hazards that later had manifested themselves in accidents. It was concluded that it is possible to integrate these methods smoothly in design, and that they are effective tools in reducing the risk of accidents.

In a subsequent development, energy analysis and deviation analysis have been combined (Kjellen et al., 1990; Rundmo et al., 1990). The objective of this research has been to develop a safety procedure for use in the design of automatic production systems in accordance with the type of preventive strat- egy that is outlined in the new European standards for safety of machinery (CEN, 1988). The procedure includes use of risk analysis in the specification of detailed safety requirements for particular systems and in design reviews. A method of risk analysis was developed and tested on mechanical and process systems in operation in order to assess the operational qualities of the method and to collect experience on accident risks.

The method differs from deviation analysis in that step 2 involves the iden- tification of potential hazards (energies) and step 3 the identification of de- viations that may result in loss-of-control of the energy. It follows that there is a one-to-one relation between these two steps of the method and the con- cluding and initial phases of the OARU model. Separate checklists have been developed for each step of the method. The checklist for step 2 separates haz-

430

ards (energies) that are under direct human control from hazards that are controlled by technical systems. The checklist of deviations includes three main classes: human; technical; and safety system. The human deviation classes coincide with the human error taxonomy according to Swain (1977). A com- parison between results from risk analyses and analyses of accident cases showed that the methods yield representative results concerning technical hazards. Accident risks in auxiliary tasks (eg. housekeeping) and hazards re- lated to human body movements are de-emphasized.

5. The Nordic influence of the OARU model

Of special importance for the development of research collaboration has been the OARU’s participation in the Scandinavian Risk Analysis Technology Co- operation, 197882 (SCRATCH, 1984)) and the Nordic cooperative program of Effective Accident Prevention Methods, 1983-87 (Institute of Occupational Health, 1987).

Within Sweden the OARU represented an alternative approach to the de- velopment of the official “ISA” system, a new national information system on occupational injuries which was set up in 1979. The ISA model for classifica- tion of occupational accidents was based on a taxonomy of activities, the se- quence of events, and the epidemiological tradition of external agencies (see Andersson and Lager&f, 1983; Andersson, 1991). This limited the opportuni- ties of the OARU model to influence the contents and use of national occupa- tional accident statistics by the National Board of Occupational Safety and Health. When insurance companies in the late 1980s developed a new system on information about occupational injuries in Sweden, very little of the original OARU model was adopted (Larsson, 1990).

The establishment of the OARU gave rise to an academic cleavage with re- search groups associated to the ISA system. This national competition on the accident research scene encouraged all groups in setting higher scientific goals for their accident research.

In the years just after the presentation of the OARU model many different accident models were developed by accident research groups in the Nordic countries. The Finnish model is based on an energy and sequence frame of modelling like the OARU model (Tuominen and Saari, 1982 ) . They explain it as a system based model where the accident is considered as a state of distur- bance in an organized dynamic system of man and his technical environment. It is, however, difficult to judge the direct influence of the OARU model.

A “Danish model” was also developed (Jorgensen, 1985). It adopted the deviation concept and the phases of the accident process from OARU and linked these to a hierarchy of causal factors.

As a reaction to all these efforts in accident modelling Hovden (1984) asked

431

the provocative question “do we need accident models?” at the yearly Nordic conference in accident research, and questioned the utility of these analogue models for the progress of safety science and for improved accident prevention in industry. Was it mostly an empty scholastic, academic debate about the meaning of words and a competition about the aesthetics of drawing boxes and arrows? The systems approach combined with a lack of scientific theory from which hypotheses for falsification could be derived, which all these models had in common, led to the pessimistic conclusion that the models were (1) not scientific enough, (2) not practical enough, (3) not specific enough, and (4) not holistic enough. In fact, the development of new accident models by Scan- dinavian safety researchers stopped in the mid eighties, although there is no evidence for suggesting a causal relationship with the critical questions raised above.

In contrast to occupational accident research in the other Nordic countries the Norwegian research program at SINTEF “Analysis of accidents and risk behaviour in industry” (called AURA) started in 1982, did not develop their own accident model or a common conceptual framework for development of theories and methods. The approaches were pragmatic and practical and to a large extent based on needs defined by industry. The strategy was to gather a tool kit of models and methods from others, modifying and combining them for applied research and development and consultant activities. The OARU model and the collaboration about the development of the SMORT method had great influence on the overall results of the AURA program as demon- strated in the final handbook (Rosness, 1992 ) and in the teaching material of safety courses at the University of Trondheim/the Norwegian Institute of Technology. An example of this combined use of different models and methods is accident investigation by the STEP method (Sequentially Timed Events Plotting) of Hendrich and Benner (1989) supplemented by the SMORT method for the purposes of explanation and identification of safety measures.

The focus of research interest shifted during the eighties to safety analysis, safety auditing, safety management systems and strategies for accident pre- vention. The accidents models are, however, part of the theoretical framework for these safety research strategies. The usefulness of the OARU model in safety analysis and auditing is demonstrated by its use in two doctoral dissertations (Suokas, 1985; Tinmannsvik, 1991).

The study of Suokas (1985) evaluated the validity and reliability of two methods of safety analysis - work safety analysis and hazard and operability study (HAZOP). The concepts of deviation and determining factors from the OARU model were employed in the theoretical framework for the evaluation of differences in the output from the safety analyses. A main recommendation from Suokas’ studies was that employing several methods in a safety analysis implies an enhancement of coverage and validity. Different methods have dif-

432

ferent search patterns, resulting in the cumulation of information when the results obtained by different methods are integrated.

The main goal of Tinmannsvik (1991) was to develop and validate a set of criteria for safety performance in industry. These criteria are to be used in a decentralized safety diagnosis method, i.e. a planned and systematic investi- gation of the organization and the administrative procedures in order to con- trol the safety of an industrial organization. The development of indicators for measuring safety performance in the questionnaire of the study was based on secondary analysis of five case studies using the SMORT method, other case studies using different methods and accident statistics. The finding from this secondary analysis revealed that the SMORT checklist covered all the signif- icant indicators of safety performance in the other studies.

Tinmannsvik grouped the safety indicators into general and specific safety factors. An interesting result of this study is that the specific safety factors (means exclusively related to safety) had a strong correlation with the overall safety performance evaluation of line management and safety representatives, while the general safety factors (multi-purpose means to improve the produc- tion system and organization) correlated strongly with the injury frequency rate.

Menckel’s (1990) work on the role of occupational health services in the prevention of occupational injuries, uses the OARU model and the related eval- uations of corporate safety information systems as an important input to the theoretical framework and research strategy.

Andersson’s (1991) work on the role of accidentology in occupational injury research discusses classifications of accident theories and models and the in- terface with safety management at one end and with traumatology at the other end. The classification of accident models and approaches proposed by Kjellen et al (1986) and based on the theoretical framework of the OARU model is discussed and related to the attempt of Laflamme (1990) to classify accident models in another way. The review of literature demonstrates a conceptual confusion and a need for increasing scientific efforts and integrated ap- proaches in the field of accident and injury research.

6. The OARU model in the light of international trends

The literature based on the OARU model is quoted in numerous scientific articles and textbooks in the field of safety science and accident research. As example the sequence of phases, deviation and controls is used in the textbook of Hale and Glendon ( 1987 ) when discussing models of the harm process.

Symptomatic for the accident models which have gained most recognition from industry in the last ten years, is that they are based on modelling of causal sequences quite similar to the original domino theory of Heinrich (1931) rather

than on sequentially timed events (Benner, 1975) or sequentially timed phases as in the OARU model. That means that descriptive process models linked to causal explanations such as deviations, contributing factors, conditions, etc. seem to be less comprehensive in industrial practice than the linear causal sequence models.

On the other hand, accident analysis by causal sequences models may mix together descriptive and explanatory factors, while OARU type models with their distinction between description of time sequences and explanations by deviations and determining factors may be more precise and logical regarding general scientific requirements.

The increasing interest on safety management approaches has led to greater attention on domino modelling and basic causes related to management failure types. Looking, for example, at the causal sequences of the ILCI Loss Causa- tion Model (Bird and Germain, 1985) compared to the equivalent time se- quences of phases in the OARU model, we get:

ILCI: OARU:

Lack of control Determining factors Basic causes Determining factors

Immediate causes Initial phase Incident Concluding phase Loss Injury phase

The TRIPOD method of Reason et al. (1988) presents an accident causation model of causal sequences rather similar to the logic and principles of the ILCI model, and using the metaphor of resident pathogens as a common expression for all the potential causes of accidents which can be related to management of the production system. The TRIPOD method bases the properties of the system involved on the system taxonomy of Perrow (1984). In the framework of modelling feedback loops of safety information systems they are using the results of the OARU’s evaluation of corporate safety information systems, see Section 4.

An advantage of the OARU model is the stringent definitions of the starting point of each phase, whereas the cut-offs between the sequences of causes can be more unclear.

7. The significance of the OARU model today

Not all aspects of the original OARU-model have survived the test of time. The distinction between deviations and determining factors is still valid. How- ever, the original concept of determining factor and its taxonomy are hardly in use today. This development has taken two directions. One is to abandon

434

the concept all together and go directly from the identification of deviations to the development of remedies (Harms-Ringdahl, 1993). The other direction is to develop the taxonomy of determining factors further on the basis of a gen- eral safety management model (Kjellen et al., 1987).

The modelling of the accident sequence into three phases is still valid, al- though the focus is now more on the transition between the phases. The sig- nificance of the energy model in the understanding of the processes of the concluding and injury phases has been acknowledged. Consequently, the clas- sification of deviations describing the concluding phase in the original model has been abandoned in favour of typical energy model classifications in later developments.

The OARU model has yet to find valid applications in injury epidemiology and information systems based on mass accident statistics. Problems related to the poor stability of the deviation concept in its operational definition have to be solved. At present the OARU-model is best suited for use in accident prevention through feed-back control at the workplace level.

An interesting question is the significance today of the OARU-model as compared to competing models and concepts of the 197Os, such as the energy model by Gibson (1961) and Haddon (1968) and accident models based on psychological theories on human information processing (Surry, 1969; An- dersson et al., 1978; Hale and Hale, 1970 ).

The energy model has been paramount to the developments in safety re- search as well as safety practice during the last decades. Its significance has been clearly demonstrated in more basic injury epidemiology research as well as in research into injury prevention and into tools for use in safety practice. For example, energy analysis is now a generally accepted method for coarse risk analysis (Harms-Ringdahl, 1993; Rausand, 1991). It is also an integrated part of conceptual models for accident prevention and safety management in common use.

The energy model is, in general, all inclusive. The difference in relation to the OARU-model lies in the focus. The energy model puts the focus on the processes where the control of energies in the system cease and a person is exposed to these energies. The OARU-model, by definition, includes this phase. However, the focus is shifted to the occurrences preceding the loss-of-control of energies. The emphasis is rather on prevention of accidents than on protec- tion against injuries. By this, the OARU-model is more congruent with such regulatory philosophies as self regulation and internal control and manage- ment philosophies as total loss control and total quality management (Bird and Germain, 1985; Hovden and Tinmannsvik, 1990; Jersin, 1992).

Human information processing models of accidents put the focus on the human actions in the accident process. This approach is highly relevant also today, even though automation has removed the operator from the risk zone in many routine tasks. Most industrial systems are still dependent on inter-

435

vention of human operators into the risk zone during such tasks as machine adjustment, programming, handling of disturbances and materials handling. However, the utility of these models in the development of tools for use by safety practitioners has yet to be demonstrated. The potential is most likely to be found in the development of risk analysis methods for use by experts (Hale and Glendon, 1987; Ingstad and Bodsberg, 1989).

Recent reviews of the theoretical developments in safety research have shown that there is a converging trend as regards accident theories and models (Laf- lamme, 1990; Andersson, 1991). The OARU-model and the later developments in the research strategy emanating from it have contributed to this general understanding. This contribution lies mainly in the following two areas: l The time dimension, i.e. the understanding of an accident as a process rather

than as a single event or as a chain of causal factors. More specifically, the OARU-model has contributed to a better understanding of how this process develops through consecutive phases, where there is a transition from lack of control to loss of control and further to injury development.

l The deviation concept as a common element of many theories and models of accidents; the understanding that the application of various concepts in safety research requires the definition of norms and that there is a subjective ele- ment involved. There is limited evidence of routine application in current safety practice of

methods and tools based on the OARU-model. This is not regarded as evidence of the unsuitability of the tools and methods for this purpose. Rather, wide- spread use would have required institutionalization of these tools and methods, for example, in a mandatory accident reporting scheme or as part of a compre- hensive safety management strategy (cf. Lowin, 1968). The potential of this latter approach is clearly demonstrated, for example, by the International Safety Rating System, of which the ILCI Loss Causation Model is an integrated part (Bird and Germain, 1985). There is ample anecdotal evidence on the positive effects of this system on the accident rates of companies that have adapted it.

Almost 15 years of safety research since the OARU-model was first pre- sented has clearly demonstrated the significance of the research strategy based on this theoretical concept. The model has formed the basis for evaluation research into corporate safety information systems. The structure and con- tents of the model have been translated into practical tools for accident inves- tigation and risk analysis. By applying these tools, significant improvements in the quality of information for use in accident prevention have been achieved. It has been possible to validate the results from these different studies on the basis of criteria derived from general control theory. The OARU-model has also influenced the research design and the interpretation of results of various studies in the field of occupational safety. Compared to parallel developments in the field of occupational accident research, it seems that the OARU model still represents the state of the art.

436

References

Andersson, R., 1991. The role of accidentology. Arguments for a scientific approach. Doctoral

Dissertation. Arbete och Halsa, No. 17.

Andersson, R., Johansson, B., Linden, K., Svanstrom, K. and Svanstrom, L., 1978. Development

of a model for research on occupational accidents. J. Occup. Accid., 1: 341-352.

Andersson, R. and Lagerlof, E., 1983. Accident data in the new Swedish information system on

occupational injuries. Ergonomics, 26: 33-42.

Backstrom, T. and Harms-Ringdahl, L., 1984. A statistical study of control systems and accidents

at work. J. Occup. Accid., 6: 201-210.

Benner, L., 1975. Accident investigations. Multilinear events sequencing methods. J. Safety Res.,

7(2): 67-73.

Bird, F.E. and Germain, G.L., 1985. Practical Loss Control Leadership. Institute Publishing,

Division of International Loss Control Institute, Loganville, Georgia.

Carlsson, J., 1980. Accident risks and safety at work. 1: A steel mill. 2: A wire-rolling mill (in

Swedish). Royal Institute of Technology, Reports No. Trita AOG-0005/6, Stockholm.

CEN, 1988. Safety of machinery-Basic concepts-General principles for design. European Com-

mittee for Standardization, Draft European Norm CEN/TEC 114 N 93E, Brussels.

Clark, P.A., 1972. Action Research and Organizational Change. Harper and Row, London.

Do&, M. and Backstrom, T., 1990. Lair av olycksfallen. En utredningsmodell med exemplifierande

resultat. Institute of Occupational Health, Social Psychology Unit, Report No. 1990: 1, Solna.

Gibson, J., 1961. The contribution of experimental psychology to the formulation of the problem

of safety. In: Behavioral Approaches to Accident Research. Association for the Aid of Crippled

Children, New York.

Gunnarsson, O., 1985. Om olycksfallsforskningens paradigm. In: J. Hovden, S.R. Larsen, J. Lund

and T. Sten (Eds.), 5. Nordiske Konferanse for Ulykkesforskere. SINTEF, Trondheim.

Haddon, W., 1968. The changing approach to epidemiology, prevention and amelioration of trauma.

Am. J. Public Health, 58(8): 1431-1438.

Hale, A.R. and Hale, M., 1970. Accidents in perspective. Occup. Psychol., 44: 115-121.

Hale, A.R. and Glendon, A.I., 1987. Individual Behaviour in the Control of Danger. Elsevier,

Amsterdam.

Hallgren, L.-E., 1992. Strategies for occupational accident prevention. From methods to measures.

Doctoral dissertation, Royal Institute of Technology, Stockholm.

Hammer, W., 1972. Handbook of System and Product Safety. Prentice-Hall, Englewood Cliffs,

NJ.

Harms-Ringdahl, L., 1980. Accident risks and safety at work. 5: mobile repairmen (in Swedish).

Royal Institute of Technology, Report No. Trita AOG-0009, Stockholm.

Harms-Ringdahl, L., 1983. Learning by accident. Trial of a systematic approach to the investi-

gation of occupational accidents at two paper mills (in Swedish). Royal Institute of Technol-

ogy, Report No. Trita AOG-0025, Stockholm.

Harms-Ringdahl, L., 1986. Experiences from safety analysis of automatic equipment. J. Occup. Accid., 8: 139-148.

Harms-Ringdahl, L., 1987. Safety analysis in design - evaluation of a case study. Accid. Anal.

Prevention, 19(4): 305-317. Harms-Ringdahl, L., 1993. Safety Analysis. Principles and Practice in Occupational Safety. El-

sevier, Amsterdam, in press.

Hendrich, K. and Benner, L., 1989. Investigating Accidents with STEP. Marcel Dekker, New

York.

Heinrich, H.W., 1931. Industrial Accident Prevention. McGraw-Hill, New York. Hovden, J., 1984. Behaver vi ulykkesmodeller? Fordeler og begrensninger ved ulike modeller. In:

437

Fjarde Nordiska Olycksfallsforskningsseminariet, Technical Research Centre, Symposium 55,

Espoo.

Hovden, J. and Larsson, T.J., 1987. Risk: Culture and Concepts. In: T. Singleton and J. Hovden

(Eds.), Risk and Decisions. Wiley, New York. Hovden, J. and Tinmannsvik, R.K., 1990. Internal control: A strategy for occupational safety and

health. Experiences from Norway. J. Occup. Accid., 12(1-3): 21-30.

Ingstad, 0. and Bodsberg, L., 1989. CRIOP: A scenario-method for evaluation of the offshore

control centre. SINTEF, Report No. STF75 A89028, Trondheim.

Institute of Occupational Health, 1987. Successful Accident Prevention. Recommendations and

ideas field tested in the Nordic countries. Reviews 12, Helsinki.

Jersin, E., 1992. Integrering av internkontroll og kvalitetssikring. SINTEF, Report No. STF75

A92017, Trondheim.

Johnson, W.G., 1980. MORT Safety Assurance System. Marcel Dekker, New York.

Jergensen, K., 1985. Vade om arbejdsulykker. In: J. Hovden, S.R. Larsen, J. Lund and T. Sten

(Eds.) 5. Nordiske konferanse for ulykkesforskere. SINTEF, Trondheim.

Kjellen, U., 1980. Accident risks and safety at work. 4: house construction (in Swedish). Royal

Institute of Technology, Report No. Trita AOG-0008, Stockholm.

Kjellen, U., 1982. An evaluation of safety information systems at six medium-sized and large firms.

J. Occup. Accid., 3: 273-288.

Kjellen, U., 1983a. The application of an accident process model to the development and testing

of changes in the safety information systems of two construction firms. J. Occup. Accid., 5:

99-119.

Kjellen, U., 198313. Analysis and development of corporate practices for accident control. Royal

Institute of Technology, Doctoral Dissertation, Report No. Trita AVE-0001, Stockholm.

Kjellen. U., 1984a. The deviation concept in occupational accident control. Part I: Definition and

classification; Part II: Data collection and assessment of significance. Accid. Anal. Prevention,

16: 289-333.

Kjellen, U., 1984b. The role of deviations in accident causation and control. J. Occup. Accid., 6: 117-126.

Kjellen, U., 1986. Development of a prototype computerized safety information system of an air-

line. Le Travail humain, 49(2): 147-161.

KjellCn, U., 1987a. Simulating the use of a computerized injury and near accident information

system in decision making. J. Occup. Accid., 9: 87-105.

Kjellen, U., 198713. Deviations and the feedback control of accidents (Ch. 14). In: Rasmussen, J.,

Duncan, K. and Leplat, J. (Eds). New Technology and Human Error. Wiley, Chichester.

Kjellen, U., 1992. Arbeidsulykker. In: Grunnbok i arbeidsmiljeopplmring. Tiden Norsk Forlag, Oslo.

Kjellen, U. and Larsson, T.J., 1980. A model of the accident sequence - the approach of the oc-

cupational accident research unit (in Swedish). Royal Inst. of Technology, Report No. Trita-

AOG-0011, Stockholm.

KjellCn, U. and Larsson, T.J., 1981. Investigation accidents and reducing risks - a dynamic ap-

proach. J. Occup. Accid., 3: 129-140.

Kjellen, U. and Moller, M., 1984. Utredning av olycksfall och tillbud i byggbranschen. Byggforla-

get, Stockholm.

Kjellen, U., Menckel, E., Lauritzen, J. and Maijala, P., 1986. Utredning av arbetsolycksfall och

tillbud som de1 i ett lokalt skyddsinformationssystem. Arbete och Hllsa, No. 3. Kjellen, U., Tinmannsvik, R.K., Ulleberg, T., Olsen, P.E. and Saxvik, B., 1987. SMORT - Sik-

kerhetsanalyse av industriell organisasjon, offshore versjon (in Norwegian). Yrkeslitteratur, Oslo.

Kjellen, U., Rundmo, T., Sandetorv, H. and Sten, T., 1990. Safety analysis of manual tasks in

438

automatic production systems - Implications for design. Accid. Anal. Prevention, 22 (5): 475-

486.

Laflamme, L., 1990. A better understanding of occupational accident genesis to improve safety in

the workplace. J. Occup. Accid., 12( l-3): 155-165.

Larsson, T.J., 1980. Accident risks and safety at work. 6: railway work (in Swedish). Royal Insti-

tute of Technology, Report Trita AOG-0010, Stockholm.

Larsson, T.J., 1990. Accident information and priorities for injury prevention. Doctoral disser-

tation. The Institute for Human Safety and Accident Research, Publ. No. IPSO Factum 21,

Stockholm.

Leplat, J., 1978. Accident analyses and work analyses. J. Occup. Accid., 1: 331-340. Lowin, A., 1968. Participative decision making: A model, literature critique, and perceptions for

research. Organizational Behavior and Human Performance, 3: 68-106.

Menckel, E., 1990. Intervention and Cooperation. Occupational Health Services and Prevention

of Occupational Injuries in Sweden. Doctoral dissertation. Arbete och H&a, No. 31.

Nilsson, B.-C., 1980. Accident risks and safety at work. 3: falling stones and scaling in mining (in

Swedish). Royal Institute of Technology, Report No. Trita AOG-0007, Stockholm.

Norges Verkstedindustris Standardiseringssentral, 1989. Quality terminology. Norwegian Stan-

dard NS-IS0 8402, Oslo.

Perrow, C., 1984. Normal Accidents. Basic Books, New York.

Rasmussen, J., 1987. Cognitive control and human error mechanisms. In: Rasmussen, J., Duncan,

K. and Leplat, J. (Eds). New Technology and Human Error. Wiley, Chichester.

Rausand, M., 1991. Risikoanalyse. Veiledning til NS 5814. Tapir Forlag, Trondheim.

Reason, J.T., 1990. Human Error. Cambridge University Press, New York.

Reason, J., Shotton, R., Wagenaar, W., Hudson, P., Groeneweg, J., 1988. TRIPOD: A Principle

Basis for Safer Operations. Report prepared for Shell Internationale Petroleum Maatschappij,

University of Manchester and University of Leiden.

Rosness, R. (Ed.), 1992. Ulykkesforebyggende arbeid. Yrkeslitteratur, Oslo.

Rundmo, T., Sten, T. and Kjellen, U., 1990. Use of safety analysis in automatic production SW-

terns. J. Occup. Accid., 12: 139-147.

SCRATCH, 1984. Sikkerhetsanalyse som beslutningsunderlag. Scandinavian Risk Analysis

Technology Co-operation. Yrkeslitteratur, Oslo.

Seiler, J., 1967. Systems analysis in organizational behavior. Irwing, Homewood, IL.

Soukas, J., 1985. On the reliability and validity of safety analysis. Doctoral dissertation. Technical

Research Centre of Finland, Publication No. 25, Espoo.

Surry, J., 1974. Industrial Accident Research. A Human Engineering Appraisal. Labour Safety

Council, Ontario Ministry of Labour, Toronto.

Swain, A.D., 1977. Estimating human error rates and their effects on system reliability. Paper

presented at the C.E.A.E.D.F. Cycles de conferences sur la fiabilite et disponibilitk des SYS-

temes mecaniques et de leur composants, Jouy-en-Josas, October 3-7,1977. Tarrants, W.E., 1965. An evaluation of the critical incident technique as a method for identifying

accident causal factors. Unpublished doctoral dissertation, New York University, New York.

Tinmannsvik, R.K., 1991. Bruk av diagnoseverktey i sikkerhetsstyring. Norges Tekniske Hegskole, Doctoral dissertation 1991: 32, Trondheim.

Tuominen, R. and Saari, J., 1982. A model for analysis of accidents and its applications. J. OCCUP.

Accid., 4: 263-273.

Van Gigch, J.P., 1978. Applied General Systems Theory. Harper & Row, New York.