Accident Investigation and Analysis - a roadmap for organisational learning -

1. Scope & Objective Scope: The investigation of occupational accidents has long been a matter of discussion, mainly among specialists, but its translation into company practice has only registered real growth on the turn of the new millennium, essentially as a natural consequence of the H&S (Health & Safety) emerging management systems. In Europe, the many H&S Directives have also played a central role in this field by bringing about new requirements and creating new needs. This trend has boosted the development of new methods and tools designed to serve the goal of safety improvement. Objective: this is a thematic lecture aiming at communicating fundamental but important aspects of “accident investigation and analysis” (AIA). At the end, attendants are expected: a) to recognise the most important characteristics of any AIA method, b) to know where to find a variety of up-to-date methods that are aligned with modern safety management thinking, and c) to understand how to use AIA processes for promoting safety through organisational learning. 2. Basic definitions and terminology At the beginning of the session a few fundamental concepts are defined to ensure that all participants have a common understanding and interpretation of the terminology used. Formal definitions are provided for the terms “accident”, “near-miss”, “dangerous occurrence”, “investigation”, “analysis” and “learning”. In particular, the last three are hereby defined as: Investigation – means a search for factual accident data; implies a systematic search of the relevant facts; it is essentially about fact-finding and the identification of observable elements (raw data) (Jacinto et al, 2011). 1 Celeste Jacinto – thematic lecture on accident investigation and analysis Analysis – this concept holds the need to interpret data and to establish causal links; it implies the search for logical explanations rather than facts and events; a certain amount of information might be inferred (information) (Jacinto et al, 2011). 3. Models & methods of accident causation Attention is firstly drawn to the difference between “models” and “methods”, highlighting how the term “model” is used for theories that help explaining accident mechanisms, whereas “methods” are something more specific. These can be seen as a practical tool to help a user to perform a specific task. Models are usually more abstract, in contrast with methods that are much more specific. After a glance at several accident theories and a few methods considered relevant in this field, the attention goes to a specific process, called RIAAT, which was designed for the recording, investigation and analysis of occupational accidents. Models: this short review (Jacinto et al, 2011) includes a few models (theories) considered important “landmarks” in the domain. Domino theory, by Heinrich in 1931. Heinrich’s domino theory is now out of date and is now considered over-simple. However, it still has historical value and helps starting the debate on causation theories. It postulates that accidents result from a chain of sequential events, metaphorically like a line of dominoes falling over. Removing a key factor (such as an unsafe condition or an unsafe act) prevents the injury by interrupting the chain of events. Loss control model, by Bird in 1974. Bird proposed the first update of the domino theory. Fundamentally, it traces the root causes of accidents to failures in management ‘loss of control’ and has been a standard model of accident causation in manufacturing and industrial settings for decades. Energy model, by Haddon in 1973. The concept of “energy release” or “energy damage” emerged in the late 1960s by the work of William Haddon Jr. It postulates that in an accident, the injury (or damage) is caused by the transference of the Learning – encompasses the processes related to establishing new knowledge aiming to implement changes to, or gaining deeper comprehension of, and/or confirming the basis for current practices (Njå & Braut, 2010). 2 Celeste Jacinto – thematic lecture on accident investigation and analysis harmful energy (e.g.: mechanical, electrical, thermal, chemical, etc.), from its source to the person in “contact” with it. The various risk control strategies include both prevention (e.g.: to avoid the building-up of harmful energy) and protection (e.g.: implementation of barriers that minimize consequences). Therefore, this theory is implicitly linked to the concept of “barriers”. Deviation model, by Kjellén in 1978. This concept involves any abnormal event that ‘deviates’ from the established ‘norm’, i.e., from its planned and normal process (e.g., deviations in technical functions of machines, working procedures or instructions). Deviations can be searched for within technical, human and organisational functions, on the basis of work activities. The fundamental idea is that ‘deviations’ from the norm can represent a hazard. This approach was first introduced in Sweden by Urban Kjellén in the late 1970s for the post-analysis of occupational accidents. During the 1980s, it was adapted by Harms-Ringdahl for use in risk analysis in production systems. Incubation - Trigger Event Theory, by Turner in 1978. Turner’s model addresses the multi-causality aspect and explains accidents as the result of a combination of undesirable events, in which ill-defined safety problems will “incubate” for a period of time until a “trigger” event provokes or precipitates the accident. “Swiss Cheese” Model or the Model of Organisational Accidents, by Reason in 1990 and 1997. Reason traces accident causation from the “distal” (or latent) organisational factors, to local workplace conditions, which in turn combine with human factors, resulting in errors and violations, labelled as “unsafe acts”, which are the “proximal” causes of accidents. Some of these unsafe acts breach the system’s defences (safety barriers), often due to existing latent conditions, resulting in an event, which may vary from a near miss to a catastrophic occurrence. Reason’s model outlines three levels of concern: (1) the organisation/management, (2) the workplace and (3) the person (or team). Reason’s theory is still the main pillar of many contemporary methods for both risk assessment (proactive) and/or post- accident investigation (reactive). This theory was developed for complex organisations, but it also became widespread in the field of occupational safety. Socio-technical system model, by Rasmussen in 1997, and Svedung & Rasmussen in 2002. This model follows a dynamic system’s approach. It presents a multi-level 3 Celeste Jacinto – thematic lecture on accident investigation and analysis framework of a socio-technical system, ranging from the workplace (i.e., at workshop level), to management, regulators and the government. The framework is concerned with the flow of information around the various decision-makers and all parties involved. It focuses on key questions, such as how objectives and values are communicated, how operational activities are monitored through incident reporting to regulators, and how the boundaries of safe operation are identified and communicated. This model embodies the competitive dynamics and commercially aggressive environment in which many companies operate today. The model is best suited to complex Socio-technical systems (e.g., nuclear energy, offshore oil, aviation, etc.). Given the scope of this lecture, Reason’s model was discussed in more detail since this is, currently, the theory most widely used to underline many practical methods. Methods: on the other hand, as mentioned before, methods are practical tools, which help users to carry out a specific task. In the case of accidents at work, at least five methods are easily available to help safety professionals with “accident investigation and analysis”. Almost all of them supply a user’s manual. Investigating Accidents and Incidents – Users Manual. Guidance HSG245 (HSE, 2004). This is the guidance published and recommended by the British Health and Safety Executive (HSE). Available at http://www.hsebooks.com/Books/ 3CA (Control Change Cause Analysis) – Users Manual (Kingston J., 2002 and 2009). This is published by the NRI (The Noordwijk Risk Initiative), which is a non- profit European Foundation co-financed by the EU Commission, created to share good practice in risk assessment and accident investigation. Available at http://www.nri.eu.com WAIT - Work Accidents Investigation Technique – Users Manual. Verlag Dashofer (Jacinto C., 2003, 2011 4a Ed.). It was developed as part of a PhD thesis in 2003. Later on, in 2007, it was adopted by the Portuguese Senior Labour Inspectorate (SLI), for use in their official enquires. It is formally published in Portuguese, but the English version available free at http://xenofonte.demi.fct.unl.pt/wait_method 4 Celeste Jacinto – thematic lecture on accident investigation and analysis RIAAT - Recording, Investigation and Analysis of Accidents at Work – Users Manual (Jacinto et al, 2010). This is a more modern and simplified version of WAIT. It was developed under a research project entirely dedicated to accident information and learning potential. The method was also adopted by the Portuguese Senior Labour Inspectorate (SLI), for use in their official enquires. Available free (PT & EN) at Proj. CAPTAR: http://www.mar.ist.utl.pt/captar/en/home.aspx RCA - Root Cause Analysis (Análisis de Causa Raíz). AENOR (2015). This is a recommended International Standard, recently published and it offers a way of finding the root causes, which frequently are the latent causes of accidents. AENOR: Norma UNE-EN 62740:2015. Among other things, the norm suggests several accident analysis techniques and helps users on how to select a tool for “root cause” analysis. Almost all the above techniques rely on Reason’s theory for accident causation. The exception is the 3CA method that follows a generalised form of barrier analysis called "Control Change Analysis”. Of the five alternatives mentioned, the RIAAT process is explained in more detail as it offers a quite complete process to deal with accident investigation and analysis. 4. Fundamentals of the RIAAT process for analysing accidents at work The lecture continues with a summary of the RIAAT process (Recording, Investigation and Analysis of Accidents at Work). This approach offers a systematic and comprehensive structure where accidents are studied in-depth, using a "standard form" that guides the analysis and provides assistance for interviewing the injured workers. RIAAT intends to promote good practice on matters concerning accidents at work. This tool, which combines a structured methodology with a form-style protocol, is among the key outputs of a research project called CAPTAR - learn to prevent. The main objective of the project, as a whole, was to increase the efficiency of how accident information is obtained, treated, and then used to improve safety. It departs 5 Celeste Jacinto – thematic lecture on accident investigation and analysis from the assumption that the processing of accident information flows in the hierarchy through a cycle of different activities. The novelty about RIAAT is that it was designed as a “complete process” that covers the full cycle of accident information; i.e., it flows from the accident/ incident itself, to the final stage of sharing information and learning from the relevant facts, as depicted in Figure 1. INPUT Accidental events PROCESS OUTPUT Continuous Improvement Investigation & Analysis (information) Recording (data) Part II Part III Part IV Plan of Action Organisational Learning Fig. 1- Illustration of the RIAAT process Part I The “process” itself engages a cycle of activities: the recording of data in a specific format, the investigation of the pertinent facts and circumstances, the analysis of causes and their interpretation, the setting up of a plan of action, and, finally, the identification of the key people with whom to share key information to ensure organisational learning. This successive processing of information adds value to the organisation’s level of safety. All the working materials, including the user’s manual, the “form” and an application example are available at the CAPTAR web page. 5. Final remarks The lecture ends with a couple of concluding remarks, to highlight that: 1) 2) The literature is plenty of ideas, new standards, new methods, new ways, etc., to help conducting an investigation. Therefore, there are no excuses for not doing it. On the other hand, practitioners should bear in mind that methods are meant to help, not to dictate rules. They should, therefore, select the method that best suits their interests. Indeed, learning is the real “added value” and the best justification for performing the investigation and analysis of accidents at work. Sharing with others the lessons (learned from accidents) help improving safety culture and preventing accidents. 6 6. Main References (c.f. Las EEAT - Estadísticas Europeas de Accidentes de Trabajo) Celeste Jacinto – thematic lecture on accident investigation and analysis AENOR: Norma UNE-EN 62740:2015. Root Cause Analysis (Manual) (Análisis de Causa Raíz). Eurostat (2013).European Statistics on Accidents at Work (ESAW) – Methodology. Luxembourg. European Commission, DG Employment& Social Affairs, 2013 HSE – CRR (2001). Root causes analysis – literature review”. By: W.S. Atkins, Contract Research Report 325/2001 for the Health and Safety Executive, HSE Books, UK HSE - Health and Safety Executive (2004).Investigating accidents and incidents. Guidance HSG245, HSE Books, UK. ISBN: 0-7176-2827-2. (PO Box 1999, Sudbury, Suffolk CO10 2WA, UK). Available at: http://www.hsebooks.com/Books/ Jacinto, C.; Guedes Soares, C.; Fialho, T. & Silva, A.S. (2010). Users’ Manual. RIAAT - Recording, Investigation and Analysis of Accidents at Work (2010). http://www.mar.ist.utl.pt/captar/en/home.aspx Jacinto, C.; Guedes Soares, C.; Fialho, T. & Silva, A.S. (2011).The Recording, Investigation and Analysis of Accidents at Work (RIAAT) process. Policy and Practice in Health and Safety (PPHS), Vol.9(1), pp. 57-77. IOSH Publications, UK, ISSN: 1477-3996. Kjellén, Urban (2000).Prevention of accidents through experience feedback. Taylor & Francis, London. Njå, O. & Fjelltun, S.H. (2010). Managers’ attitudes towards safety measures in the commercial road transport sector. Safety Science, 48(8), pp. 1073-1080. NRI – The Noordwijk Risk Initiative Foundation (2002). 3CA – Control Change Cause Analysis Manual.By: John Kingston, NRI-3. The Netherlands. Available at: www.nri.eu.com Reason, James (1997).Managing the risks of organisational accidents. Ashgate Publishing Ltd, Aldershot HantsUniversidad de Málaga. Campus de Excelencia Internacional Andalucía Tech

Why Catastrophic Organizational Failures Happen

Excerpt from the introduction: The purpose of this chapter is to examine the major streams of research about catastrophic failures, describing what we have learned about why these failures occur as well as how they can be prevented. The chapter begins by describing the most prominent sociological school of thought with regard to catastrophic failures, namely normal accident theory. That body of thought examines the structure of organizational systems that are most susceptible to catastrophic failures. Then, we turn to several behavioral perspectives on catastrophic failures, assessing a stream of research that has attempted to understand the cognitive, group and organizational processes that develop and unfold over time, leading ultimately to a catastrophic failure. For an understanding of how to prevent such failures, we then assess the literature on high reliability organizations (HRO). These scholars have examined why some complex organizations operating in extremely hazardous conditions manage to remain nearly error free. The chapter closes by assessing how scholars are trying to extend the HRO literature to develop more extensive prescriptions for managers trying to avoid catastrophic failures

Can the Heinrich ratio be used to predict harm from medication errors?

The purpose of this study was to establish whether, for medication errors, there exists a fixed Heinrich ratio between the number of incidents which did not result in harm, the number that caused minor harm, and the number that caused serious harm. If this were the case then it would be very useful in estimating any changes in harm following an intervention. Serious harm resulting from medication errors is relatively rare, so it can take a great deal of time and resource to detect a significant change. If the Heinrich ratio exists for medication errors, then it would be possible, and far easier, to measure the much more frequent number of incidents that did not result in harm and the extent to which they changed following an intervention; any reduction in harm could be extrapolated from this

Air Traffic Safety: continued evolution or a new Paradigm.

The context here is Transport Risk Management. Is the philosophy of Air Traffic Safety different from other modes of transport? – yes, in many ways, it is. The focus is on Air Traffic Management (ATM), covering (eg) air traffic control and airspace structures, which is the part of the aviation system that is most likely to be developed through new paradigms. The primary goal of the ATM system is to control accident risk. ATM safety has improved over the decades for many reasons, from better equipment to additional safety defences. But ATM safety targets, improving on current performance, are now extremely demanding. What are the past and current methodologies for ATM risk assessment; and will they work effectively for the kinds of future systems that people are now imagining and planning? The title contrasts ‘Continued Evolution’ and a ‘New Paradigm’. How will system designers/operators assure safety with traffic growth and operational/technical changes that are more than continued evolution from the current system? What are the design implications for ‘new paradigms’, such as the USA’s ‘Next Generation Air Transportation System’ (NextGen) and Europe’s Single European Sky ATM Research Programme (SESAR)? Achieving and proving safety for NextGen and SESAR is an enormously tough challenge. For example, it will need to cover system resilience, human/automation issues, software/hardware performance/ground/air protection systems. There will be a need for confidence building programmes regarding system design/resilience, eg Human-in-the-Loop simulations with ‘seeded errors’

Management of Road Infrastructure Safety

Road Infrastructure Safety Management (RISM) refers to a set of procedures that support a road authority in decision making related to the improvement of safety on a road network. Some of these procedures can be applied to existing infrastructure, thus enabling a reactive approach; and other procedures are used in early stages of a project's life-cycle allowing a proactive approach. The objective of this paper is to provide an overview of the most well-known procedures and present a series of recommendations for successful road infrastructure safety management. The work described in the paper was completed by the IRTAD sub-working group on Road Infrastructure Safety Management and presented in detail in the respective Report. The methodology followed on this purpose included the description of the most consolidated RISM procedures, the analysis of the use of RISM procedures worldwide and the identification of possible weaknesses and barriers to their implementation, the provision of good practice examples and the contribution to the scientific assessment of procedures. Specifically, the following RISM procedures were considered: Road Safety Impact Assessment (RIA), Efficiency Assessment Tools (EAT), Road Safety Audit (RSA), Network Operation (NO), Road Infrastructure Safety Performance Indicators (SPI), Network Safety Ranking (NSR), Road Assessment Programs (RAP), Road Safety Inspection (RSI), High Risk Sites (HRS) and In-depth Investigation. Each procedure was described along with tools and data needed for its implementation as well as relevant common practices worldwide. A synthesis summarizing the key information for each procedure was also drafted. Based on a survey on 23 IRTAD member countries from worldwide, the lack of resources or tools is the most commonly stated reason for not applying a RISM procedure. This has been frequently found mainly in European countries. Another common reason is the absence of recommendations/guidelines, especially for SPI, RAP, RSI and RSA. This highlights the importance of the presence of some legislation regulating the application of the procedures. Lack of data was found important mainly for SPI, HRS and EAT. Good practices of road infrastructure safety management have been explored in order to find solutions to the issues highlighted by the survey and provide examples about how these issues have been overcome in some countries. Specifically, issues related to data, legal framework, funding, knowledge, tools and dealing with more RISM procedures were addressed. Finally, nine key messages and six recommendations for better Road Infrastructure Safety Management were developed based on the conclusions made

Occupational injuries among construction workers at the Chep Lap Kok Airport construction site, Hong Kong : analysis of accident rates, and the association between injuries, error types and their contributing factors : a thesis presented in partial fulfilment of the requirements for the degree of Master of Aviation at Massey University, Palmerston North, New Zealand

Accidents on construction sites are a major cause of morbidity and mortality in Hong Kong. This study investigated the likely causes of occupational injuries that were present among the construction workers during the construction of the new Chep Lap Kok (CLK) Airport in Hong Kong. In order to accumulate the requisite information, 1648 accident investigation reports in a four-year period (1993-1996) were reviewed. The first part of the study described the pattern and magnitude of occupational injuries among the CLK construction workers and compared the accident rates of the CLK workers with those of the construction industry as a whole in Hong Kong. The study examined the effects of the workplace infrastructure at CLK in order to explain why this site presented fewer work place injuries and accidents than other workplaces. The second part of the research used these injury and accident occurrences as the basis to construct the causes of accidents and injuries within an error causation classification system. The results showed that at CLK, the commonest workplace injury was contusion & crushing which appeared to be due to mistakes made through lapses in memory often caused by pressure of work being imposed on the employee. This section also indicated what types of errors were most closely associated with what kinds of injuries and what conditions were most likely to trigger these types of events. Among the major associations were links between contusion and crushing and violation error, perceptual error; between memory lapse and work pressure, equipment deficiencies, poor working environment, fatigue, and between violation error and work pressure. The research suggested that work pressure was an important contributing factor to construction injury and it increased the prevalence of a human error type namely, memory lapse many fold. The outcomes from this study provide important new information on the causes and types of errors which have led to occupational injuries among construction workers in Hong Kong. A better understanding of the human factors-based causes of accidents and injuries in the construction industry and an inculcation of a safety culture on construction sites are critically important in the reduction of the rate of construction accidents and improvement of workers' human performance. The results should assist the construction industry in the designing accident prevention training and education strategies, estimating human error probabilities, and the monitoring organizational safety performance

Truth­-Makers

During the realist revival in the early years of this century, philosophers of various persuasions were concerned to investigate the ontology of truth. That is, whether or not they viewed truth as a correspondence, they were interested in the extent to which one needed to assume the existence of entities serving some role in accounting for the truth of sentences. Certain of these entities, such as the Sätze an sich of Bolzano, the Gedanken of Frege, or the propositions of Russell and Moore, were conceived as the bearers of the properties of truth and falsehood. Some thinkers however, such as Russell, Wittgenstein in the Tractatus, and Husserl in the Logische Untersuchungen, argued that instead of, or in addition to, truth-bearers, one must assume the existence of certain entities in virtue of which sentences and/or propositions are true. Various names were used for these entities, notably 'fact', 'Sachverhalt', and 'state of affairs'. (1) In order not to prejudge the suitability of these words we shall initially employ a more neutral terminology, calling any entities which are candidates for this role truth-makers

FRAM for systemic accident analysis: a matrix representation of functional resonance

Due to the inherent complexity of nowadays Air Traffic Management (ATM) system, standard methods looking at an event as a linear sequence of failures might become inappropriate. For this purpose, adopting a systemic perspective, the Functional Resonance Analysis Method (FRAM) originally developed by Hollnagel, helps identifying non-linear combinations of events and interrelationships. This paper aims to enhance the strength of FRAM-based accident analyses, discussing the Resilience Analysis Matrix (RAM), a user-friendly tool that supports the analyst during the analysis, in order to reduce the complexity of representation of FRAM. The RAM offers a two dimensional representation which highlights systematically connections among couplings, and thus even highly connected group of couplings. As an illustrative case study, this paper develops a systemic accident analysis for the runway incursion happened in February 1991 at LAX airport, involving SkyWest Flight 5569 and USAir Flight 1493. FRAM confirms itself a powerful method to characterize the variability of the operational scenario, identifying the dynamic couplings with a critical role during the event and helping discussing the systemic effects of variability at different level of analysis

Remedial training: Will CRM work for everyone

The subject of those pilots who seem unresponsive to Cockpit Resource Management (CRM) training is addressed. Attention is directed to the need and opportunity for remedial action. Emphasis is given to the requirement for new perspectives and additional training resources. It is also argued that, contrary to conventional training wisdom, such individuals do not represent a hard core which is beyond assistance. Some evidence is offered that such a new perspective will lend itself to a wider appreciation of certain specific training needs. The role of appropriately trained specialists is briefly outlined, and a selected bibliography is attached. The combined experiences of several Pilot Advisory Groups (PAG's) within IFALPA member association form the basis for this discussion. It does not purport to desribe the activities of any one PAG. While much of the activities of PAG's have no relevance to CRM, there are clearly some very important points of intersection. The relevance of these points to diagnostic skills, and remedial training in the general domain of CRM is made obvious