Help with Board Question (No Word Count) and Unit Assessment (Word Count Noted On Each Question). APA Format Throughout to include Reference Page.

Board Question

Search the Internet for a newspaper or magazine article about an accident or injury, and share what you found with the class. If you were asked to investigate the accident, what accident causation theories or models would you use to guide the process?

unit assessment

QUESTION 1

What is the difference between linear and non-linear accident models? Why are non-linear accident models not used more often in workplace accident investigations? 
Your response must be at least 75 words in length.

QUESTION 2

Why is it better to apply the multiple causation theory rather than the unsafe acts/unsafe conditions model to an accident investigation? Provide an example that illustrates your point. 
Your response must be at least 75 words in length.

QUESTION 3

Consider the following accident scenario: 
Two workers were assigned to replace a water valve located in an underground concrete vault. After removing the manhole cover, worker #1 climbed down the ladder into the vault. Worker #1 collapsed and became unconscious within seconds of reaching the bottom. Worker #2 went down the ladder to rescue worker #1 but was quickly overcome by the lack of oxygen. Both workers died at the bottom of the vault. 
Discuss how you could apply a domino theory to investigate this accident. You may make additional assumptions about the scenario, as needed, for your discussion. 
Your response must be at least 200 words in length.

QUESTION 4

Consider the following accident scenario: 
Two workers were assigned to replace a water valve located in an underground concrete vault. After removing the manhole cover, worker #1 climbed down the ladder into the vault. Worker #1 collapsed and became unconscious within seconds of reaching the bottom. Worker #2 went down the ladder to rescue worker #1 but was quickly overcome by the lack of oxygen. Both workers died at the bottom of the vault. 
Discuss how you could apply the Haddon matrix theory to investigate this accident. You may make additional assumptions about the scenario, as needed, for your discussion. 
Your response must be at least 200 words in length.

34 Professional

S

afety OCTOBER 2014 www.asse.org

Incident
Investigation
Our Methods Are Flawe

d

By Fred A. Manuele

I
t would be a rare exception if an outline for
a safety management system did not include a
requirement for incidents to be investigated and

analyzed. And that is appropriate; incident inves-
tigation is a vital element within a safety manage-
ment system. The comments in section E6.2 of
ANSI/AIHA/ASSE Z10-2012, Standard for Occu-
pational Health and Safety Management Systems
(OHSMS) (ANSI/AIHA/ASSE, 2012, p. 25), de-
scribe the benefits that can be obtained from inci-

dent investigations:

as possible symptoms of prob-
lems in the OHSMS.

should be used for root-cause
analysis to identify system or
other deficiencies for develop-
ing and implementing correc-
tive action plans so as to avoid
future incidents.

–
vestigations are to be fed back
into the planning and correc-
tive action processes.

As Z10 proposes, organiza-
tions should learn from past
experience to correct deficien-
cies in management systems
and make modifications to
avoid future incidents.

Research Results
The author has reviewed more than 1,800

incident investigation reports to assess their

quality, with an emphasis on causal factors identifi-
cation and corrective actions taken (Manuele, 2013,
p. 316). This revealed that an enormous gap can
exist between issued investigation procedures and
actual practice. On a 10-point scale, with 10 being
best, an average score of 5.7 would be the best that
could be given, and that could be a bit of a stretch.

These reviews confirmed that people who com-
pleted investigation reports were often biased in
favor of selecting an employee’s unsafe act as the
causal factor and thereby did not proceed further
into the investigation.

The author then conducted a five-why analysis
to determine why this gap exists between issued
procedures and actual practice. As the analysis
proceeded, it became apparent that our model is
flawed on several counts. The author’s observa-
tions follow. These observations are made a priori,
that is, relating to or derived by reasoning from
self-evident proposition.

Why Incident Investigations
May Not Identify Causal Factors

When supervisors are required to complete inci-
dent investigation reports, they are asked to write
performance reviews of themselves and of those
to whom they report, all the way up to the board
of directors. Managers who participate in incident
investigations are similarly tasked to evaluate their
own performance and the results of decisions
made at levels above theirs.

It is understandable that supervisors will avoid
expounding on their own shortcomings in inci-
dent investigation reports. The probability is close
to zero that a supervisor will write: “This incident

d

a
le

s
a
o
in
ti
fu

v
in
ti

ti
e
c
a
a

R

IN BRIEF
An earlier review of incident investi-

gation reports revealed an enormous
gap between established reporting
procedures and actual practice.
Supervisors are commonly assigned

responsibility for incident investiga-
tion. However, most supervisors are
not qualified to offer recommendations
for improving operating systems be-
cause they lack sufficient knowledge
of hazard identification and analysis,
and risk assessment.
This article presents a sociotechnical

model for hazards-related incidents.
Such a system stresses an interde-
pendent relationship between humans
and machines, and accommodates the
needs of both the system’s output goal
and workers’ needs.

Fred A. Manuele, P.E., CSP,
–

ing director and manager of M&M Protection Consultants. His safety
experience spans several decades. Manuele’s books, Advanced Safety
Management: Focusing on Z10 and Serious Injury Prevention, and On
the Practice of Safety, have been adopted for several graduate and un-
dergraduate safety degree programs. He is also author of Innovations in
Safety Management: Addressing Career Knowledge Needs and Heinrich

Revisited: Truisms or Myths and coeditor of Safety Through Design.
He was chair of the committee that developed ANSI/ASSE Z590.3,
Standard for Prevention Through Design—Guidelines for Addressing
Occupational Hazards and Risks in Design and Redesign Processes.
Manuele is an ASSE Fellow and received the Distinguished Service
to Safety Award from NSC. He has served on the board of directors
for ASSE, NSC and BCSP, which he also served as president. In June

Safety Management
Peer-Reviewed

www.asse.org OCTOBER 2014 ProfessionalSafety 35

occurred in my area of supervision and I take full
responsibility for it. I overlooked X. I should have
done Y. My boss did not forward the work order for
repairs I sent him 3 months ago.”

Self-preservation dominates, logically. This also
applies to all management levels above the line su-
pervisor. All such personnel will be averse to de-
claring their own shortcomings. Similarly, it is not
surprising that supervisors and managers are reluc-
tant to report deficiencies in the management sys-
tems that are the responsibility of their superiors.

With respect to operators (first-line employees)
and incident causation, Reason (1990) writes:

Rather than being the main instigator of an ac-
cident, operators tend to be the inheritors of sys-
tem defects created by poor design, incorrect
installation, faulty maintenance and bad man-
agement decisions. Their part is usually that of
adding the final garnish to a lethal brew whose
ingredients have already been long in the cook-
ing. (p. 173)

Supervisors, one step above line employees, also
work in a “lethal brew whose ingredients have al-
ready been long in the cooking.” Supervisors have
little or no input to the original design of operations
and work systems, and are hampered with regard
to making major changes to those systems. The au-
thor’s practical on-site experience has shown that
most supervisors do not have sufficient knowledge
of hazard identification and analysis, and risk as-
sessment to qualify them to offer recommenda-
tions for improving operating systems.

History
In safety management systems, first-line su-

pervisors are often responsible for initiating an
incident investigation report. In relatively few or-
ganizations, this responsibility is assigned to a
team or an operating executive.

It is presumed that supervisors are closest to the
work and that they know more about the details of
what has occurred. The history on which such as-
signments are based can be found in three editions
of Heinrich’s Industrial Accident Prevention. Hein-
rich’s influence continues to this day. Heinrich

(1941, 1950, 1959) comments on incident inves-
tigation methods in the second, third and fourth
editions of his book.

The person who should be best qualified to
find the direct and proximate facts of individual
accident occurrence is the person, usually the
supervisor or foreman, who is in direct charge
of the injured person, The supervisor is not only
best qualified but has the best opportunity as
well. Moreover, he should be personally inter-
ested in events that result in the injury of workers
under his control.

In addition, he is the man upon whom man-
agement must rely to interpret and enforce such
corrective measures as are devised to prevent
other similar accidents. The supervisor or fore-
man, therefore, from every point of view, is the
person who should find and record the major
facts (proximate causes and subcauses) of ac-
cident occurrence.

In addition, he and the safety engineer should
cooperate in finding the proximate causes and
subcauses of potential injury producing acci-
dents. (1941, p. 111; 1950, p. 123; 1959, p. 84)

Heinrich’s premise that the supervisor is best
qualified to make incident investigations continues
to be influential to this day, as evidenced by the
following example from NSC (2009).

Depending on the nature of the incident and oth-
er conditions, the investigation is usually made
by the supervisor. This person can be assisted
by a fellow worker familiar with the process, a
safety professional or inspector, or an employee
health professional, the joint safety and health
committee, the general safety committee or a
consultant from the insurance company. If the
incident involves unusual or special features,
consultation with a state labor department, or
a federal agency, a union representative or an
outside expert may be warranted. If a contrac-
tor’s personnel are involved in the incident, then
a contractor’s representative should also be in-
volved in the investigation.

The supervisor should make an immediate re-
port of every injury requiring medical treatment
and other incidents he or she may be directed to

An enormous gap
can exist between

issued investigation
procedures and
actual practice.

©
IS

T
O

C
K

P
H

O
T

O
.C

O
M

/D
R

A
G

O
N

IM
A

G
E

S

36 ProfessionalSafety OCTOBER 2014 www.asse.org

investigate. The supervisor is on the scene and
probably knows more about the incident than
anyone else. It is up to this individual, in most
cases, to put into effect whatever measures can
be adopted to prevent similar incidents. (p. 285)

Ferry (1981) also writes that the supervisor is
closest to the action and most often is expected to
initiate incident investigations. But he was one of
the first writers to introduce the idea that supervi-
sors may have disadvantages when doing so.

The supervisor/foreman is closest to the action.
The mishap takes place in his domain. As a re-
sult, he most often investigates the mishap. If it is
the supervisor’s duty to investigate, he has every
right to expect management to prepare him for
the task.

Yet the same reasons for having the super-
visor/foreman make the investigation are also
reasons he should not be involved. His reputa-
tion is on the line. There are bound to be causes
uncovered that will reflect in some way on his
method of operation.

His closeness to the situation may preclude an
open and unbiased approach to the supervisor-
caused elements that exist. The more thorough
the investigation, the more likely he is to be impli-
cated as contributing to the event. (p. 9)

Ferry (2009) makes similar comments about line
managers and staff managers (e.g., personnel di-
rectors, purchasing agents).

A thorough investigation often will find their func-
tions contributed to the mishap as causal fac-
tors. When a causal factor points to their function
they immediately have a point in common with
the investigator. (p. 11)

In one organization whose safety director pro-
vided input for this article, the location manager
leads investigations of all OSHA recordable inci-
dents. That is terrific; senior management is in-
volved. Many of the constraints applicable to the
people who report to the manager can be over-
come. But, in a sense, the manager is required to

write a performance appraisal on him/herself and
on the people in the reporting structure above his/
her level. If contributing factors result from deci-
sions the manager made or his/her bosses made,
details about them may not be precisely recorded.

Investigation Teams
Discussions with several corporate safety profes-

sionals indicate that their organizations use a team
to investigate certain incidents. Assume the team
consists of supervisors who report to the same in-
dividual as the supervisor for the area in which the
incident occurred. The team is expected to write a
performance appraisal on the involved supervisor
as well as on the person to whom all of them re-
port, and that person’s bosses.

A priori, it is not difficult to understand that su-
pervisors would be averse to criticizing a peer and
management personnel to whom they also report.
The supervisor whose performance is reviewed be-
cause of an incident may someday be part of a team
appraising other supervisors’ performance.

At all management levels above line supervisor, it
would also be normal for personnel to avoid being
self-critical. Self-preservation dominates at all levels.

Safety professionals should realize that con-
straints similar to those applicable to a supervisor
also apply, in varying degrees, to all personnel who
lead or are members of investigation teams.

Nevertheless, the author found that incident
investigation reports completed by teams were
superior. Ferry (1981, p. 12) says, “Special investi-
gation committees are often appointed for serious
mishaps” and “their findings may also receive bet-
ter acceptance when the investigation results are
made public.”

To the extent feasible, investigation team leaders
should have good managerial and technical skills
and not be associated with the area in which the
incident occurred.

Chapter 7 of Guidelines for Investigating Chemi-
cal Process Incidents (CCPS, 2003) is titled “Build-

the word chemical appears in the book’s title, the
text is largely generic. The opening paragraph of
Chapter 7 says:

A thorough and accurate incident investigation
depends upon the capabilities of the assigned
team. Each member’s technical skills, expertise
and communication skills are valuable consider-
ations when building an investigation team. This
chapter describes ways to select skilled person-
nel to participate on incident investigation teams
and recommends methods to develop their capa-
bilities and manage the teams’ resources. (p. 97)

This book is recommended as a thorough dis-
sertation on all aspects of incident investigation.
Throughout the book, competence, objectivity, ca-
pability and training are emphasized.

Training for Personnel on Incident Investigation
If personnel are to perform a function they should

be given the training needed to acquire the nec-

In a sense, the manager is
required to write a perfor-
mance appraisal on him/
herself and on the people
in the reporting structure

above his/her level.

©
IS
T
O
C
K
P
H
O
T
O
.C
O
M
/D
R
A
G
O
N
IM
A
G
E
S

www.asse.org OCTOBER 2014 ProfessionalSafety 37

essary skill. Others make similar or relative com-
ments. Ferry (1981) says, “If it is the supervisor’s
duty to investigate, he has every right to expect
management to prepare him for the task” (p. 9).

The following citation is from Guidelines for
Investigating Chemical Process Incidents: “High
quality training for potential team members and
supporting personnel helps ensure success. Three
different audiences will benefit from training: site
management personnel, investigation support per-
sonnel and designated investigation team mem-
bers including team leaders” (CCPS, 2003, p. 105).

For each organization, several questions should
be asked; the answers may differ greatly.

–
vestigation techniques do supervisors and investi-
gation team members receive?

and technically qualified?

Consideration also must be given to the time
lapse between when supervisors and others attend
a training session and when they complete an in-
cident investigation report. It is generally accepted
that knowledge obtained in training will not be re-
tained without frequent use. It is unusual for team
members to participate in two or three incident in-
vestigations in a year. Inadequate training may be
a major problem.

What Is Being Taught: Causation Models
Dekker (2006) makes the following astute ob-

servation, worthy of consideration by all who are
involved in incident investigations.

Where you look for causes depends on how you
believe accidents happen. Whether you know it
or not, you apply an accident model to your anal-
ysis and understanding of failure. An accident
model is a mutually agreed, and often unspoken,
understanding of how accidents occur. (p. 81)

Safety professionals must understand that how
they search for causal or contributing factors relates
to what they have learned and their beliefs with re-
spect to incident causation. There are many cau-
sation models in safety-related literature. Dekker
(2006) describes three kinds of accident models.
His models, abbreviated, are cited as examples of
the many models that have been developed.

sees accidents as a chain of events that leads up
to a failure. It is also called the domino model, as
one domino trips the next. [Author’s note: The
domino sequence was a Heinrichean creation.]

accidents as related to latent failures that hide in
everything from management decisions to pro-
cedures to equipment design.

–
dents as merging interactions between system
components and processes, rather than failures
within them. (p. 81)

Dekker (2006) strongly supports a systems ap-
proach to incident investigation, taking into con-

sideration all of the relative management systems
as a whole. He says:

The systems approach focuses on the whole, not
the parts. The interesting properties of systems
(the ones that give rise to system accidents) can
only be studied and understood when you treat
them in their entirety. (p. 91)

Dekker is right: Whether persons at all levels are
aware of it, they apply their own model and their
understanding of how incidents occur when in-
vestigations are made. Thus, two questions need
consideration:

about incident causation?

people in the organizations they advise?
Answers to those questions greatly affect the

quality of incident investigations. Based on the
author’s research (Manuele, 2011), the myths that
should be dislodged from the practice of safety are:

1) Unsafe acts of workers are the principal causes
of occupational incidents.

2) Reducing incident frequency will achieve an
equivalent reduction in injury severity.

These myths arise from the work of Heinrich and
can be found in the four editions of Industrial Ac-
cident Prevention (1931, 1941, 1950, 1959). Analyti-
cal evidence developed by the author indicates that
these premises are not soundly based, supportable
or valid.

Heinrich professed that among the direct and
proximate causes of industrial incidents:

88% are unsafe acts of persons; 10% are unsafe
mechanical or physical conditions; and 2% are
unpreventable. (1931, p. 43; 1941, p. 22; 1950,
p. 19; 1959, p. 22)

Heinrich advocated identifying the first proximate
and most easily prevented cause in the selection of
remedies for the prevention of incidents. He says:

Selection of remedies is based on practical
cause-analysis that stops at the selection of the
first proximate and most easily prevented cause
(such procedure is advocated in this book) and
considers psychology when results are not pro-
duced by simpler analysis. (1931, p. 128; 1941;
p. 269; 1950, p. 326; 1959, p. 174)

Note that the first proximate and most easily
prevented cause is to be selected (88% of the time,
a human error). That concept permeates Hein-
rich’s work. It does not encompass what has been
learned subsequently about the complexity of in-
cident causation or that other causal factors may
be more significant than the first proximate cause.

Many safety practitioners still operate on the be-
lief that the 88-10-2 ratios are soundly based. As a
result, they focus on correcting a worker’s unsafe
act as the singular causal factor for an incident
rather than addressing the multiple causal factors
that contribute to most incidents.

A recent example of incident causation complex-
ity appears in the following excerpt from the report
prepared by BP (2010) following the April 20, 2010,
Deepwater Horizon explosion in the Gulf of Mexico.

38 ProfessionalSafety OCTOBER 2014 www.asse.org

The team did not identify any single action or in-
action that caused this incident. Rather, a com-
plex and interlinked series of mechanical failures,
human judgments, engineering design, opera-
tional implementation and team interfaces came
together to allow the initiation and escalation of
the accident. (p. 31)

During an incident investigation, a professional
search to identify causal factors such as through
the five-why analysis system will likely find that
the causal factors built into work systems are of
greater importance than an employee’s unsafe act.

The author’s previous work (Manuele, 2011) cov-
ered topics such as moving the focus of preventive
efforts from employee performance to improving
the work system; the significance of work system
and methods design; the complexity of causation;
and recognizing human errors that occur at orga-
nizational levels above the worker.

Although response to that article was favorable,
some communications received contained a dis-
turbing tone. It became apparent that Heinrich’s
premise that 88% of occupational incidents are
caused by the unsafe acts of workers is deeply em-
bedded in the minds of some safety practitioners
and those they advise. This is a huge problem. This
premise was taught to students in safety science
degree programs for many years and is still taught.
The author received a call from one professor who
said that the 2011 article gave him the leverage he
needed to convince other professors that some of
Heinrich’s premises are not valid and should not
be taught.

How big is the problem? Paraphrasing an April
2014 e-mail from the corporate safety director of
one of the largest companies in the world, “We
are thinking about how far to go to push Heinrich
thinking out of our system. We still have some
traditional safety thinkers who would squirm and
voice concerns if we did that.”

In May 2014, the author spoke at a session ar-
ranged by ORCHSE, a consulting organization

whose members represent Fortune 500 companies.
When the more than 85 attendees were asked by
show of hands whether Heinrich concepts domi-
nated their incident investigation systems, more
than 60% responded affirmatively. This author
believes that many of those who did not respond
positively were embarrassed to do so.

At an August 2014 meeting of 121 safety person-
nel employed by a large manufacturing company,
participants were asked: About what percentage of
the incident reports at your location identify unsafe
acts as the primary cause? The results follow:

% of reports Participant responses
100% 3%
75% 33%
50% 37%
25% 12%
< 25% 15%

A total of 73% of participants indicated that for
50% to 100% of incident reports, workers’ unsafe
acts are identified as the primary cause. To quote
the colleague who conducted this survey, “We’ve
got work to do.”

Also, note the following comments that are sig-
nificant with respect to how big the problem is.
For more than 35 years, E. Scott Geller has been
a prominent practitioner in behavior-based safety.
His current thinking is relative to the reality of
causal factors and their origins. Excerpts from a re-
cent article follow (Geller, 2014).

A person who believes that most injuries are
caused by employee behavior can be viewed as
a safety bully. This belief could influence a focus
on the worker rather than the culture or manage-
ment systems, or many other contributing fac-
tors. As Deming warns, “Don’t blame people for
problems caused by the system.”

When safety programs are promoted on a
premise such as “95% of all workplace acci-
dents are caused by behavior,” one can under-
stand why union leaders object vehemently and
justifiably to such. Claiming that behaviors cause
workplace injuries and property damage places
blame on the employee and dismisses manage-
ment responsibility. Most worker behavior is an
outcome of the work culture, the system.

It is wrong to presume that behavior is a cause
of an injury or property damage. Rather, behavior
is one of several contributing factors, along with
environmental and engineering factors, manage-
ment factors, cultural factors and person-states.
(pp. 41-42)

This author concludes that supervisors, manage-
ment personnel above the supervisory level, in-
vestigation team members and safety practitioners
who are not informed on current thinking with
respect to incident causation are not qualified to
identify causal and contributing factors, particular-
ly those that derive from inadequacies in an orga-
nization’s culture, operating systems and technical
aspects applications, and from errors made at up-
per management levels. This presents a challenge
for safety professionals, as well as an opportunity.

Practitioners
who are not
informed on

current thinking
with respect
to incident

causation are
not qualified

to identify
causal and
contributing

factors.

©
IS
T
O
C
K
P
H
O
T
O
.C
O
M
/D
R
A
G
O
N
IM
A
G
E
S

www.asse.org OCTOBER 2014 ProfessionalSafety 39

Multifactorial Aspects of Incident Causation
Most hazards-related incidents, even those that

seem to be the least complex, have multiple causal
factors that derive from less than adequate work-
place and work methods design, operations man-
agement and personnel performance.

The author’s reviews of incident investigation
reports, mostly on serious injuries and fatalities,
showed that:

fatality are unique and singular events, having
multiple and complex causal factors that may have
organizational, technical, operational systems or
cultural origins.

–
quence events are seldom represented in the ana-
lytical data on incidents that occur frequently. (Some
ergonomics-related incidents are the exception.)

Those studies also showed that a significantly
large share of incidents resulting in serious injuries
and fatalities occurred:

performed;

–
tions (replacing a motor weighing 800 lb to be in-
stalled on a platform 15 ft above the floor);

and startups;
–

trical, steam, pneumatic, chemical);
–

mal to abnormal).
In every report reviewed, multiple causal fac-

tors were identified; there was an initiating event
followed by a cascade of contributing factors that
developed in sequence or in parallel. They related
directly to deficiencies in operational management
systems that should be subjects of concern when
investigations are made.

Johnson (1980) writes succinctly about the mul-
tifactorial aspect of incident causation:

Accidents are usually multifactorial and develop
through relatively lengthy sequences of changes
and errors. Even in a relatively well-controlled
work environment, the most serious events in-
volve numerous error and change sequences, in
series and parallel. (p. 74)

Human Errors: Management Decision Making
Particular attention is given here to Guidelines for

Preventing Human Error in Process Safety (CCPS,
1994). Although the term process safety appears in
the book’s title, the first two chapters provide an
easily read primer on human error reduction.

Safety professionals should view the following
highlights as generic and broadly applicable. They
advise on where human errors occur, who commits
them and at what level, the influence of organiza-
tional culture and where attention is needed to re-
duce the occurrence of human errors.

It is readily acknowledged that human errors at
the operational level are a primary contributor to

the failure of systems. It is often not recognized,
however, that these errors frequently arise from
failures at the management, design or technical
expert levels of the company. (p. xiii)

A systems perspective is taken that views error as
a natural consequence of a mismatch between
human capabilities and demands, and an inap-
propriate organizational culture. From this per-
spective, the factors that directly influence error
are ultimately controllable by management. (p. 3)

Almost all major accident investigations in recent
years have shown that human error was a signifi-
cant causal factor at the level of design, operations,
maintenance or the management process. (p. 5)

One central principle presented in this book is
the need to consider the organizational factors
that create the preconditions for errors, as well
as the immediate causes. (p. 5)

Since “failures at the management, design or
technical expert levels of the company” affect the
design of the workplace and the work methods (i.e.,
the operating system), it is logical to suggest that
safety professionals encourage that incident investi-
gations focus on improving the operating system to
achieve and maintain acceptable risk levels.

Dekker’s (2006) premises are pertinent to this
subject. Several excerpts follow:

Human error is not a cause of failure. Human er-
ror is the effect, or symptom, of deeper trouble.
Human error is systematically connected to fea-
tures of people’s tools, tasks and operating sys-
tems. Human error is not the conclusion of an
investigation. It is the starting point. (p. 15)

Sources of error are structural, not personal. If
you want to understand human error, you have to
dig into the system in which people work. (p. 17)

Error has its roots in the system surrounding it;
connecting systematically to mechanical, pro-
grammed, paper-based, procedural, organiza-
tional and other aspects to such an extent that
the contributions from system and human error
begin to blur. (p. 74)

The view that accidents really are the result of
long-standing deficiencies that finally get acti-
vated has turned people’s attention to upstream
factors, away from frontline operator “errors.”
The aim is to find out how those “errors,” too,
are a systematic product of managerial actions
and organizational conditions. (p. 88)

The Systemic Accident Model . . . focuses on the
whole [system], not [just] the parts. It does not
help you much to just focus on human errors, for
example, or an equipment failure, without tak-
ing into account the sociotechnical system that
helped shape the conditions for people’s per-
formance and the design, testing and fielding of
that equipment. (p. 90)

Reason’s (1997) book, Managing the Risks of
Organizational Accidents, is a must-read for safety
professionals who want to learn about human er-
ror reduction. Reason writes about how the effects

40 ProfessionalSafety OCTOBER 2014 www.asse.org

of decisions accumulate over time and become the
causal factors for incidents resulting in serious in-
juries or substantial damage when all the circum-
stances necessary for the occurrence of a major
event fit together. He stresses the need to focus on
decision making above the worker level to prevent
major incidents:

Latent conditions, such as poor design, gaps in
supervision, undetected manufacturing defects
or maintenance failures, unworkable proce-
dures, clumsy automation, shortfalls in training,
less than adequate tools and equipment, may
be present for many years before they combine
with local circumstances and active failures to
penetrate the system’s layers of defenses.

They arise from strategic and other top level
decisions made by governments, regulators,
manufacturers, designers and organizational
managers. The impact of these decisions spreads
throughout the organization, shaping a distinctive
corporate culture and creating error-producing
factors within the individual workplaces. (p. 10)

If the decisions made by management and others
have a negative effect on an organization’s culture
and create error-producing factors in the work-
place, focusing on reducing human errors at the
worker level—the unsafe acts—will not solve the
problems. Thus, the emphasis in incident investi-
gations should be on the management system defi-
ciencies that result in creating a negative “culture”
and “error-producing factors in the workplace.”

A Causation Model
Safety professionals are obligated to give advice

based on a sound and studied thought process that
considers the reality of the sources of hazards. The
author proposes that a causation model must en-
compass the following premises.

–
miner with respect to the avoidance, elimination,
reduction or control of hazards and whether ac-
ceptable risk levels are achieved and maintained.

to operational risk management is an extension of
the organization’s culture.

at the management level when policies, standards,
procedures, provision of resources and the ac-
countability system are less than adequate.

–
tion are systemic. They derive from management
decisions that establish the operating sociotech-
nical system—the workplace, work methods and
governing social atmosphere-environment.

incidents must consider the entirety of the socio-
technical system, applying a holistic approach to
both the technical and social aspects of operations.
It must be understood that those aspects are inter-
dependent and mutually inclusive.

The sociotechnical system in an organization is a
derivation of its culture. The following definition of a
sociotechnical system is a composite of several defi-
nitions and the author’s views, based on experience.

A sociotechnical system stresses the holistic,
interdependent, integrated and inseparable inter-
relationship between humans and machines. It
fosters the shaping of both the technical and so-
cial conditions of work in such a way that both the
system’s output goal and the workers’ needs are
accommodated.

This article presents a sociotechnical model for
hazards-related incidents (Figure 1). It is the au-
thor’s composite and is influenced by his research
and experience.

Cultural Implications That Encourage
Good Incident Investigations

In one company in which management person-
nel are fact-based and sincere when they say that
they want to know about the contributing factors
for incidents, regardless of where the responsibility
lies, a special investigation procedure is in place for
serious injuries and fatalities.

That company’s management recognized that it
was difficult for leaders at all levels to complete fac-
tual investigation reports that may be self-critical.
Thus, an independent facilitator serves as the in-
vestigation and discussion team leader. At least five
knowledgeable people serve on the team. All team
members know that a factual report is expected.

It is known that the CEO reads the reports, asks
questions to ensure that the reports are complete,
and sees that leaders resolve all of the recommen-
dations made to a proper conclusion. Thus, the
CEO’s actions demonstrate that the organization’s
culture requires fact determination and continual
improvement. The culture dominates and governs.

Cultural Implications That May Impede
Incident Investigations

Guidelines for Preventing Human Error in Pro-
cess Safety (CCPS, 1994) contains a relative and
all-too-truthful paragraph related to an organiza-
tion’s culture:

A company’s culture can make or break even a
well-designed data collection system. Essential
requirements are minimal use of blame, freedom
from fear of reprisals and feedback which indi-
cates that the information being generated is be-
ing used to make changes that will be beneficial
to everybody.

All three factors are vital for the success of a
data collection system and are all, to a certain ex-
tent, under the control of management. (p. 259)

In relation to the foregoing, the title of Whit-
tingham’s (2004) book, The Blame Machine: Why
Human Error Causes Accidents, is particularly ap-
propriate. According to Whittingham, his research
shows that, in some organizations, a blame culture
has evolved whereby the focus of investigations is
on individual human error and the corrective ac-
tion stops at that level. That avoids seeking data on
and improving the management systems that may
have enabled the human error.

What Whittingham describes is indicative of an
inadequate safety culture. As an example of an as-
pect of a negative safety culture, consider the fol-

www.asse.org OCTOBER 2014 ProfessionalSafety 41

lowing real-world scenario with which this author
became familiar that represents a culture of fear:

An electrocution occurred. As required in that
organization, the corporate safety director visited
the location to expand on the investigation. Dur-
ing discussion with the deceased employee’s im-
mediate supervisor, it became apparent that the
supervisor knew of the design shortcomings in the
lockout/tagout system, of which there were many
at the location.

When asked why the design shortcomings were
not recorded as causal factors in the investigation
report, the supervisor responded, “Are you crazy?
I would get fired if I did that. Correcting all these
lockout/tagout problems will cost money and my
boss doesn’t want to hear about things like that.”

This culture of fear arose from the system of
expected performance that management created.
The supervisor completed the investigation report
in accord with what he believed management ex-
pected. He recorded the causal factor as “employee
failed to follow the lockout/tagout procedure” and
the investigation stopped there.

In such situations, corrective actions taken usual-
ly involve retraining and giving additional empha-
sis to the published standard operating procedure.
Design shortcomings are untouched. Overcoming
such a culture of fear in the process of improving
incident investigation processes will require careful
analysis and much persuasive diplomacy.

A Course of Action
If incident investigations are thorough and un-

biased, the reality of the technical, organizational
methods of operation and cultural causal factors
will be revealed. If appropriate action is taken on
those causal factors, significant risk reduction can
be achieved. To improve incident investigation
quality, safety professionals should do the neces-
sary research and develop a plan of action.

on sound principles. They must understand the
importance of and the serious need for their guid-
ance on incident investigation to all levels of man-
agement and for investigation teams. Thus, it is
suggested that safety professionals review the cau-
sation model on which their advice is based.

–
ards-related incidents (Figure 1) emphasizes the
influence of an organization’s culture and the
shortcomings that may exist in controls when safe-
ty policies, standards, procedures and the account-
ability system are inadequate with respect to the
design processes and operations risk management.
A causation model should relate to such inadequa-
cy of controls.

–
tions in most organizations will require significant
changes in their culture and safety professionals
must understand the enormity of the task. In such
an initiative, knowledge of management of change
methods is necessary (Manuele, 2014).

–
tions should be developed. So, an evaluation should

be made of a sampling of completed investigation
reports. In studies made by the author, the identi-
fication entries in incident investigation forms (e.g.,
name, department, location of the incident, shift,
time, occupation, age, time in the job) received rela-
tively high scores for thoroughness of completion.

Thus, it is suggested that the evaluation concen-
trate on incident descriptions, causal and contributing
factor determination, and corrective actions taken.
If the number of entries in an available data bank
presents a manageable unit, all incident descriptions
can be reviewed. As the data bank increases in size,
decisions must be made about the number of inci-
dents that practicably should be reviewed. Where the
data bank is large, a safety professional may want to
evaluate only incidents that result in serious injury or

be made of a sampling of completed investigation

Figure 1
Sociotechnical Causation Model
for Hazards-Related Incidents

An organization’s culture is established by the board of directors
and senior management.

Management commitment or noncommitment to providing the
controls necessary to achieve and maintain acceptable risk levels is

an expression of the culture.

Causal factors may derive from shortcomings in controls when
safety policies, standards, procedures, the accountability system or

their implementation are

Inadequate with respect to

The design processes and operational risk management
and the inadequacies impact negatively on:

Multiple causal factors derive from inadequate controls.

The incident process begins with an initiating event.
There are unwanted energy flows or exposures to harmful

substances.
Multiple interacting events occur sequentially or in parallel.

Harm or damage results, or could have resulted in slightly
different circumstances.

42 ProfessionalSafety OCTOBER 2014 www.asse.org

illness, perhaps those valued in workers’ compensa-
tion claims data at $25,000 or more.

This level was selected pragmatically while
working with larger companies. Safety directors
decided to have the incident review process pertain
to perhaps two or three or 5,000 incidents. For ex-
ample, in a company in which about 5,000 workers’
compensation claims are reported annually, the
computer run at a $25,000 selection level provided
data on 375 cases, about 7.5% of total cases. They
represented more than 70% of total claims values.

culture in place with respect to incident investiga-
tions. This is vital. Safety professionals must under-
stand that the culture will not be changed without
support from senior management and that they must
adopt a major role to achieve the necessary change.

what is being taught about incident investigation;
whether the guidance given in procedure manuals
is appropriate and adequate; and whether the in-
vestigation report form assists or hinders thorough
investigations.

should draft an action plan to convince manage-
ment of the value of making changes in the expect-
ed level of performance on incident investigation.
One item in the action plan should propose adopt-
ing a problem-solving technique, an incident in-
vestigation technique.

The Five-Why Analysis System
The five-why analysis and problem-solving tech-

nique is easy to learn and effective; the training time
and administrative requirements are not

extensive.

Before applying this technique, training should cover
the fundamentals of hazard and risk identification
and analysis. The author promotes adoption of the
five-why technique rather strongly. For most organi-
zations, achieving competence in applying the tech-
nique to investigations will be a major step forward.

The five-why concept is based on an uncom-
plicated premise, so it can be easily adopted in an
incident investigation process, as some safety pro-
fessionals have done. For the occasional complex
incident, starting with the five-why system may
lead to the use of event trees, fishbone diagrams or
more sophisticated investigation systems.

Other incident investigation techniques exist.
Highly skilled investigators may say that the five-
why process is inadequate because it does not pro-
mote identification of causal factors resulting from
decisions made at a senior management level. That
is not so. Usually, when inquiry gets to the fourth
“why,” considerations are at the management lev-
els above the supervisor and may consider deci-
sions made by the board of directors.

Given an incident description, the investigator or
the investigation team would ask “why” five times
to get to the contributing causal factors and out-
line the necessary corrective actions. A colleague
who has adopted the five-why system says that he
has taught incident investigators to occasionally
interject a “how could that happen?” into the dis-

cussion—an interesting innovation. A not-overly
complex example of a five-why application follows.

The written incident description says that a tool-
carrying wheeled cart tipped over onto an em-
ployee while she was trying to move it. She was
seriously injured.

1) Why did the cart tip over? The diameter of
the casters is too small and the carts are tippy.

2) Why is the diameter of the casters too small?
They were made that way in the fabrication shop.

3) Why did the fabrication shop make carts
with casters that are too small? It followed the
dimensions provided by engineering.

4) Why did engineering provide fabrication di-
mensions for casters that have been proven to
be too small? Engineering did not consider the
hazards and risks that would result from using
small casters.

5) Why did engineering not consider those
hazards and risks? It never occurred to the de-
signer that use of the small casters would create
hazardous situations. The designer had not per-
formed risk assessments.

Conclusion: I [the department manager] have
made engineering aware of the design problem.
In that process, an educational discussion took
place with respect to the need to focus on hazards
and risks in the design process. Also, engineer-
ing was asked to study the matter and has given
new design parameters to fabrication: The caster
diameter is to be tripled. On a high-priority basis,
fabrication is to replace all casters on similar carts.
A 30-day completion date for that work was set.

I have also alerted supervisors to the problem
in areas where carts of that design are used.
They have been advised to gather all personnel
who use the carts and inform them that larger
casters are being placed on carts, and instruct
them that until then, moving the carts is to be a
two-person effort. I have asked our safety direc-
tor to alert her associates at other locations of
this situation and how we are handling it.

Sometimes, asking “why” as few as three times
gets to the root of a problem; on other occasions,
six times may be necessary. Having analyzed in-
cident reports in which the five-why system was
used, the author offers several cautions:

reality of causal factors is necessary for success.

and not a “what” or a diversionary symptom.

be necessary to get the idea across. Doing so in
group meetings at several levels, but particularly at
the management level, is a good idea.

the systemic causal factors identified as skill is de-
veloped in applying the five-why process.

A safety director who contributed material for
this article says the following about his application
of the five-why system.

I have trained supervisors, shift managers, de-
partment managers and facility managers in the
use of the five-why system for accident inves-
tigations. I taught them the difference between

The five-
why analy-

sis and
problem-

solving
technique
is easy to
learn and
effective;

the training
time and

administra-
tive re-

quirements
are not

extensive.

www.asse.org OCTOBER 2014 ProfessionalSafety 43

fact finding and fault finding. They understand
that documenting a failure on their part does not
necessarily mean that they are lousy supervi-
sors and will help us identify system problems
that we must correct. I review every investigation
report. Anytime I feel they have stopped asking
“why” too soon, I assist them with additional in-
vestigation to ensure that the root cause(s) are
identified and appropriate corrective actions are
developed and implemented.

The literature on the five-why system is not ex-
tensive because it is not complex. Two Internet re-
sources are listed in the references for this article.

Conclusion
If incident investigations are objective and thor-

ough, the symptoms relating to technical, organi-
zational, methods of operation and cultural causal
factors will be revealed. If appropriate action is tak-
en on those causal factors, significant risk reduc-
tion can be achieved. But, as is established in this
article, incident investigations are most often not
thorough and factual.

That presents significant challenges and oppor-
tunities for safety professionals. It is incumbent on
them to be well informed about incident causation.
As Dekker (2006) says, “Where you look for causes
depends on how you believe accidents happen.
Whether you know it or not, you apply an accident
model to your analysis and understanding of fail-
ure,” (p. 81).

It is apparent that the magnitude of the need as
safety professionals give advice on incident inves-
tigation and causal factor determination is huge. In
most organizations, a major culture change will be
necessary to significantly improve the quality of in-
cident investigations, a change that can be achieved
only with management support over time.

Assume that a safety professional decides to take
action to improve the quality of incident investiga-
tion. It is proposed that the following comments
about incident investigation, as excerpted from
the Report of the Columbia Accident Investigation
Board (NASA, 2003), be kept in mind as a base for
reflection throughout the endeavor.

Many accident investigations do not go far
enough. They identify the technical cause of the
accident, and then connect it to a variant of “op-
erator error.” But this is seldom the entire issue.

When the determinations of the causal chain
are limited to the technical flaw and individual
failure, typically the actions taken to prevent a
similar event in the future are also limited: fix the
technical problem and replace or retrain the in-
dividual responsible. Putting these corrections in
place leads to another mistake—the belief that
the problem is solved.

Too often, accident investigations blame a fail-
ure only on the last step in a complex process,
when a more comprehensive understanding of
that process could reveal that earlier steps might
be equally or even more culpable. In this Board’s
opinion, unless the technical, organizational, and
cultural recommendations made in this report
are implemented, little will have been accom-

plished to lessen the chance that another acci-
dent will follow. (p. 177)

Paraphrasing, for emphasis: If the cultural, tech-
nical, organizational and methods of operation
causal factors are not identified, analyzed and re-
solved, little will be done to prevent recurrence of
similar incidents. PS

References

ANSI/AIHA/ASSE. (2012). American national standard
for occupational health and safety management systems.

BP. (2010, Sept. 8). Deepwater Horizon accident inves-
tigation report. Retrieved from http://cdm16064.content
dm.oclc.org/cdm/ref/collection/p266901coll4/id/2966

Center for Chemical Process Safety (CCPS). (1994).
Guidelines for preventing human error in process safety.
New York, NY: American Institute of Chemical Engineers
(AIChE).

CCPS. (2003). Guidelines for investigating chemical
process incidents (2nd ed.). New York, NY: AIChE.

Dekker, S. (2006). The field guide to understanding
human error.

Ferry, T.S. (1981). Modern accident investigation and
analysis: An executive guide. Hoboken, NJ: John Wiley
& Sons.

Geller, E.S. (2014, Jan.) Are you a safety bully? Rec-
ognizing management methods that can do more harm
than good. Professional Safety, 59(1), 39-44.

Heinrich, H.W. (1931). Industrial accident prevention.
New York, NY: McGraw-Hill Book Co.

Heinrich, H.W. (1941). Industrial accident prevention
(2nd ed.). New York, NY: McGraw-Hill Book Co.

Heinrich, H.W. (1950). Industrial accident prevention
(3rd ed.). New York, NY: McGraw-Hill Book Co.

Heinrich, H.W. (1959). Industrial accident prevention
(4th ed.). New York, NY: McGraw-Hill Book Co.

Johnson, W.G. (1980). MORT safety assurance sys-
tems. New York, NY: Marcel Dekker.

Manuele, F.A. (2011, Oct.). Reviewing Heinrich:
Dislodging two myths from the practice of safety. Profes-
sional Safety, 56(10), 52-61.

Manuele, F.A. (2013). On the practice of safety (4th
ed.). Hoboken, NJ: John Wiley & Sons.

Manuele, F.A. (2014). Advanced safety management:
Focusing on Z10 and serious injury prevention (2nd ed.).
Hoboken, NJ: John Wiley & Sons.

Mapwright Pty Ltd. The 5 whys method. Essendon,
Australia: Author. Retrieved from www.mapwright
.com.au/5-whys-method.html

MoreSteam.com. 5-why analysis. Powell, OH: Au-
thor. Retrieved from www.moresteam.com/toolbox/
5-why-analysis.cfm

NASA. (2003, Aug.). Columbia accident investigation

Retrieved from www.nasa.gov/columbia/home/CAIB
_Vol1.html

National Safety Council (NSC). (2009). Accident
prevention manual for business and industry: Administra-
tion and programs

Reason, J. (1990). Human error. New York, NY: Cam-
bridge University Press.

Reason, J. (1997). Managing the risks of organizational
accidents.

Whittingham, R.B. (2004). The blame machine: Why
human error causes accidents. Burlington, MA: Elsevier
Butterworth-Heinemann.

Copyright of Professional Safety is the property of American Society of Safety Engineers and
its content may not be copied or emailed to multiple sites or posted to a listserv without the
copyright holder’s express written permission. However, users may print, download, or email
articles for individual use.

1

Course Learning Outcomes for Unit II

Upon completion of this unit, students should be able to:

5. Compare various accident causation theories and models.
5.1 Relate accident causation theories and models to accident scenarios.

Reading Assignment

Chapter 3:
A Short History of Accident Theory

In order to access the resource below, you must first log into the myWaldorf Student Portal and access the
Business Source Complete database within the Waldorf Online Library.

Manuele, F. A. (2014). Incident investigation: Our methods are flawed. Professional Safety, 59(10), 34-43.

The following work can be found on the Internet by typing the title into a search engine or clicking on the link
provided:

Toft, Y., Dell, G., Klockner, K., & Hutton, A. (2012). Models of causation: Safety. Retrieved from
http://www.ohsbok.org.au/wp-content/uploads/2013/12/32-Models-of-causation-
Safety ?ce18fc

Unit Lesson

Why do accidents happen? What needs to be done to prevent accidents from happening? These two
questions are at the heart of any organization’s accident prevention efforts. Unfortunately, there is no simple
answer. Some may even say that there is no answer at all. Remember that the various definitions of an
accident include words like “unplanned” and “unanticipated.” Can we really identify ways to prevent something
from happening that we cannot (or did not) anticipate? The accident investigation process gives us the
opportunity to learn what went wrong. The worldwide body of knowledge related to accident causation has
been a significant contributor to accident prevention efforts.

Before an attempt is made to investigate an accident, it is helpful to have a better understanding of how—not
why—accidents happen. Analysis of accidents over the last century has led to a number of theories and
models of accident causation. One the earliest theories came from H. W. Heinrich in the 1930s (Oakley, 2012;
Toft, Dell, Klockner, & Hutton, 2012b). Heinrich postulated that accidents are caused by unsafe acts, unsafe
conditions, or some combination of these. According to Heinrich, unsafe acts represented 80% of the causal
factors, and unsafe conditions represented 20% (Oakley, 2012). More than 80 years later, this theory is still
applied by many safety practitioners. Indeed, you can see it reflected in the way the Occupational Safety and
Health Administration (OSHA) addresses workplace safety: OSHA standards contain prescriptive guidelines
to control workplace hazards (unsafe conditions). OSHA standards also contain training and operational
guidelines to modify or control worker behavior (unsafe acts). In the latter part of the 20th century, the
behavior-based safety (BBS) movement further increased focus on controlling unsafe acts.

Heinrich expanded on his unsafe acts/unsafe conditions theory and incorporated it into a representation, or
model, of the accident sequence. He described the accident sequence as a series of dominos. If one domino
(causal factor) is removed, the accident will not happen. Heinrich’s domino theory has been updated and

UNIT II STUDY GUIDE

Accident Causation Theory

2

UNIT x STUDY GUIDE

Title
modified over the years, but its use remains pervasive. Undoubtedly, its use has resulted in many
improvements to the accident investigation process.

The domino theory is an example of a simple linear model of accident causation (Toft et al., 2012b). It is
simple, in that it is a single series of events, and linear, in that the events happen in sequence. It has been
shown, however, that there are often multiple linear events that converge, resulting in an accident. In
response, several complex linear models have been developed, such as the time sequence model, the
epidemiologic model, and the energy damage model.

In the 1990s, the focus of accident modeling shifted from unsafe acts and unsafe conditions to a broader
approach, which involves the interactions among people, their equipment, work processes, and organizational
management (Toft et al., 2012b). It was recognized that failures in the system played a significant role in

worker error, which resulted in accidents.
The human element has not been removed
from the accident causation theory; rather,
we are beginning to better understand how
the system in which the employee works
contributes to decisions and behaviors that
may lead to accidents.

Another contribution to accident theory
made by Heinrich is the accident ratio study
(also recognized as the accident pyramid or
the accident triangle). This theory has been
updated and modified over the years, but
the premise remains the same: For every
serious injury that happens, there will be a
larger number of minor injuries, an even
larger number of property damage incidents,
and an even greater amount of close calls or
near misses. The most common ratios used
are 1-10-30-600 (Oakley, 2012). The
numbers are arranged in a pyramid to
indicate that the 600 close calls provide the
foundation for all of the other levels of the
pyramid. If we eliminate one or more of the
levels, we weaken the foundation for the
more serious levels above. In theory, if we
eliminate all of the close calls, we would

eliminate all of the incidents above them in the pyramid. The accident ratio theory has been widely accepted
for many years and is often the driving force behind many accident investigation processes.

In recent years, however, some safety professionals have questioned the validity of the accident ratio
(Manuele, 2013). While some minor incidents can be precursors to more serious incidents, there is very little
data to support the idea that reducing injury frequency will reduce injury severity. Research has shown that in
order for the ratios to be valid, the injuries at the various levels would need to have the same causal factors.
This is certainly contrary to the multiple causation theory, and even a brief study of mishap causes would
reveal the flaw.

Nonetheless, current-day safety practitioners continue to focus on near-miss reporting while possibly missing
the true causes of serious injuries. That does not mean the accident ratio should be ignored. It needs to be
looked at critically for what it is, which is a theory—not an immutable law of physics.

What are the benefits of understanding and using accident causation theories and models? Hovden et al. (as
cited in Toft et al., 2012b) offer these thoughts on accident causation theories and models:

 They create a common understanding of accident phenomena through a shared, simplified
representation of real-life accidents.

 They help structure and communicate risk problems.

 They help prevent personal biases regarding accident causation and provide an opening for a wider

An example of a time sequence accident model
(Toft et al., 2012a)

3

UNIT x STUDY GUIDE

Title
range of preventative measures.

 They guide investigations regarding data collection and accident analyses.

 They help analyze interrelations between factors and conditions.

 Different accident models highlight different aspects of processes, conditions, and causes.

As research into accident causation continues, we can expect to see new and more complex theories and
models emerge. The safety practitioner is not limited to using one theory or model in the accident
investigation process. Simple accidents—if there really are such things—may be well served by simpler
models. Time and resources available to conduct an investigation may also dictate the complexity of the
model used. Using multiple models can help balance the weaknesses of any single model.

The domino theory and its many variations are perhaps the most common models in use today (Oakley,
2012). While this course focuses more on these linear time-sequence models, the student is encouraged to
learn more about the newer, emerging theories through independent research and study.

References

Manuele, F. A. (2013). On the practice of safety (4th ed.). Somerset, NJ: Wiley.

Oakley, J. S. (2012). Accident investigation techniques: Basic theories, analytical methods, and applications
(2nd ed.). Des Plaines, IL: American Society of Safety Engineers.

Toft, Y., Dell, G., Klockner, K., & Hutton, A. (2012a). Generalised time sequence model [Image]. Retrieved
from http://www.ohsbok.org.au/wp-content/uploads/2013/12/32-Models-of-causation-
Safety ?ce18fc

Toft, Y., Dell, G., Klockner, K., & Hutton, A. (2012b). Models of causation: Safety. Retrieved from
http://www.ohsbok.org.au/wp-content/uploads/2013/12/32-Models-of-causation-
Safety ?ce18fc

Suggested Reading

The most common approach to safety involves a defensive strategy; most organizations focus on barriers that
reduce risk. This article looks at a new model of accident prevention; the article explores more of a systems
approach.

In order to access the resources below, you must first log into the myWaldorf Student Portal and access the
Business Source Complete database within the Waldorf Online Library.

Mitropoulos, P., Abdelhamid, T. S., & Howell, G. A. (2005). Systems model of construction accident
causation. Journal of Construction Engineering & Management, 131(7), 816-825.

This article focuses on a specific accident model—the entropy model. Take a few minutes to read this article if
you are interested in learning more about this model.

Mol, T. (2002). An accident theory. Occupational Hazards, 64(10), 89.

Learning Activities (Non-Graded)

Bird and Germain’s accident ratio study (accident pyramid) is often cited as a reason to investigate minor
accidents and near misses. Their work builds on research done in the 1930s by H. W. Heinrich, who is often
considered as a pioneer in accident causation theory. In recent years, however, the accident pyramid has
been criticized as being non-scientific and misleading.

Research the safety literature for recent articles that discuss the accident pyramid controversy. Summarize
what you found, and provide your own conclusions as to whether or not safety practitioners should continue to

4

UNIT x STUDY GUIDE

Title

rely on the accident pyramid to drive accident investigation efforts.

Non-graded Learning Activities are provided to aid students in their course of study. You do not have to
submit them. If you have questions, contact your instructor for further guidance and information.

OHS Body of Knowledge

Models of Causation:

Safety

April, 2012

Models of
Causation:

Safety

OHS Body of Knowledge
Models of Causation: Safety April, 2012

Copyright notice and licence terms

First published in 2012 by the Safety Institute of Australia Ltd, Tullamarine, Victoria, Australia

.

Bibliography.
ISBN 978-0-9808743-1-0

This work is copyright and has been published by the Safety Institute of Australia Ltd (SIA) under the
auspices of HaSPA (Health and Safety Professionals Alliance). Except as may be expressly provided by law
and subject to the conditions prescribed in the Copyright Act 1968 (Commonwealth of Australia), or as
expressly permitted below, no part of the work may in any form or by any means (electronic, mechanical,
microcopying, digital scanning, photocopying, recording or otherwise) be reproduced, stored in a retrieval
system or transmitted without prior written permission of the SIA.

You are free to reproduce the material for reasonable personal, or in-house, non-commercial use for the
purposes of workplace health and safety as long as you attribute the work using the citation guidelines below
and do not charge fees directly or indirectly for use of the material. You must not change any part of the work
or remove any part of this copyright notice, licence terms and disclaimer below.

A further licence will be required and may be granted by the SIA for use of the materials if you wish to:

• reproduce multiple copies of the work or any part of it
• charge others directly or indirectly for access to the materials
• include all or part of the materials in advertising of a product or services, or in a product for sale
• modify the materials in any form, or
• publish the materials.

Enquiries regarding the licence or further use of the works are welcome and should be addressed to:

Registrar, Australian OHS Education Accreditation Board
Safety Institute of Australia Ltd, PO Box 2078, Gladstone Park, Victoria, Australia, 3043
registrar@ohseducationaccreditation.org.au

Citation of the whole Body of Knowledge should be as:

HaSPA (Health and Safety Professionals Alliance).(2012). The Core Body of Knowledge for
Generalist OHS Professionals. Tullamarine, VIC. Safety Institute of Australia.

Citation of individual chapters should be as, for example:
Pryor, P., Capra, M. (2012). Foundation Science. In HaSPA (Health and Safety Professionals
Alliance), The Core Body of Knowledge for Generalist OHS Professionals. Tullamarine, VIC.
Safety Institute of Australia.

Disclaimer
This material is supplied on the terms and understanding that HaSPA, the Safety Institute of
Australia Ltd and their respective employees, officers and agents, the editor, or chapter authors and
peer reviewers shall not be responsible or liable for any loss, damage, personal injury or death
suffered by any person, howsoever caused and whether or not due to negligence, arising from the
use of or reliance of any information, data or advice provided or referred to in this publication.
Before relying on the material, users should carefully make their own assessment as to its accuracy,
currency, completeness and relevance for their purposes, and should obtain any appropriate
professional advice relevant to their particular circumstances.

OHS Body of Knowledge
Models of Causation: Safety April, 2012

.

OHS Body of Knowledge
Models of Causation: Safety April, 2012

OHS Body of Knowledge
Models of Causation: Safety April, 2012

Synopsis of the OHS Body of Knowledge

Background

A defined body of knowledge is required as a basis for professional certification and for
accreditation of education programs giving entry to a profession. The lack of such a body
of knowledge for OHS professionals was identified in reviews of OHS legislation and
OHS education in Australia. After a 2009 scoping study, WorkSafe Victoria provided
funding to support a national project to develop and implement a core body of knowledge
for generalist OHS professionals in Australia.

Development

The process of developing and structuring the main content of this document was managed
by a Technical Panel with representation from Victorian universities that teach OHS and
from the Safety Institute of Australia, which is the main professional body for generalist
OHS professionals in Australia. The Panel developed an initial conceptual framework
which was then amended in accord with feedback received from OHS tertiary-level
educators throughout Australia and the wider OHS profession. Specialist authors were
invited to contribute chapters, which were then subjected to peer review and editing. It is
anticipated that the resultant OHS Body of Knowledge will in future be regularly amended
and updated as people use it and as the evidence base expands.

Conceptual structure

The OHS Body of Knowledge takes a ‘conceptual’ approach. As concepts are abstract, the
OHS professional needs to organise the concepts into a framework in order to solve a
problem. The overall framework used to structure the OHS Body of Knowledge is that:

Work impacts on the safety and health of humans who work in organisations. Organisations are
influenced by the socio-political context. Organisations may be considered a system which may
contain hazards which must be under control to minimise risk. This can be achieved by
understanding models causation for safety and for health which will result in improvement in the
safety and health of people at work. The OHS professional applies professional practice to
influence the organisation to being about this improvement.

OHS Body of Knowledge
Models of Causation: Safety April, 2012

This can be represented as:

Audience

The OHS Body of Knowledge provides a basis for accreditation of OHS professional
education programs and certification of individual OHS professionals. It provides guidance
for OHS educators in course development, and for OHS professionals and professional
bodies in developing continuing professional development activities. Also, OHS
regulators, employers and recruiters may find it useful for benchmarking OHS professional
practice.

Application

Importantly, the OHS Body of Knowledge is neither a textbook nor a curriculum; rather it
describes the key concepts, core theories and related evidence that should be shared by
Australian generalist OHS professionals. This knowledge will be gained through a
combination of education and experience.

Accessing and using the OHS Body of Knowledge for generalist OHS professionals

The OHS Body of Knowledge is published electronically. Each chapter can be downloaded
separately. However users are advised to read the Introduction, which provides background
to the information in individual chapters. They should also note the copyright requirements
and the disclaimer before using or acting on the information.

OHS Body of Knowledge
Models of Causation: Safety April, 2012

Core Body of
Knowledge for the

Generalist OHS
Professional

Models of Causation: Safety

Associate Professor Yvonne Toft DProf.(Trans Stud), MHlthSc, GDipOHS, GCertFlexLearn,
FSIA, MHFESA, MICOH.

Faculty of Sciences, Engineering & Health, CQUniversity
Email: y.toft@cqu.edu.au

Yvonne combines teaching in human factors, worksite analysis, accident analysis,
systems safety and research and design with active research interests in engineering
design, accident analysis, prediction of error sources, systems safety and
transdisciplinary communication and design,

Associate Professor Geoff Dell PhD, M.App Sci OHS, Grad Dip OHM, CFSIA, MISASI

Faculty of Sciences, Engineering & Health, CQUniversity
Email: g.dell@cqu.edu.au

Geoff is a career system safety, risk management and accident investigation specialist
with 30 years experience across a range of high risk industries and is a qualified air
safety investigator. He is currently implementing a suite of investigation education
programs at CQ University.

Karen K Klockner, CQUniversity

Allison Hutton, CQUniversity

Peer-reviewers
Dr David Borys PhD, MAppSc(OHS), GDipOHM, GCertEd, AssDipAppSc(OHS), FSIA

Senior Lecturer, VIOSH Australia, University of Ballarat

Professor David Cliff MAusIMM MSIA, CChem, MRACI, MEnvANZ
Director of Minerals Industry Safety and Health Centre, Sustainable Minerals

Institute, University of Queensland

David Skegg, GDipOHM, CFSIA, FAICD
Manager, Health, Safety and Environment, CBH Australia Pty Ltd

OHS Body of Knowledge
Models of Causation: Safety April, 2012

Core Body of Knowledge for the Generalist OHS Professional

Models of Causation: Safety

Abstract

Understanding accident causation is intrinsic to their successful prevention. To shed light
on the accident phenomenon, over the years authors have developed a plethora of
conceptual models. At first glance they seem as diverse and disparate as the accident
problem they purport to help solve, yet closer scrutiny reveals there are some common
themes. There are linear models which suggest one factor leads to the next and to the next
leading up to the accident and there are complex non linear models which hypothesise
multiple factors are acting concurrently and by their combined influence, lead to accident
occurrence. Beginning with a look at the historical context, this chapter reviews the
development of accident causation models and so the understanding of accidents. As this
understanding should underpin OHS professional practice the chapter concludes with a
consideration of the implications for OHS professional practice.

Key words
accident, occurrence, incident, critical incident, mishap, defence/s, failure, causation,

safety

Note from the Body of Knowledge Technical Panel and the authors of this chapter:
The development of theories and modeling of accident causation is a dynamic field with the result that
there is often a gap between the theoretical discussion and practice. This chapter has taken on the
difficult task of collating a selection of models and presenting them in a format that should facilitate
discussion among OHS professionals. It is considered ‘version 1’ in what should be a stimulating and
ongoing discussion. It is anticipated that this chapter will be reviewed in the next 12 months.

OHS Body of Knowledge
Models of Causation: Safety April, 2012

Contents

1 Introduction ………………………………………………………………………………………………….1

2 Historical context ………………………………………………………………………………………….2

3 Evolution of models of accident causation …………………………………………………………3

3.1 Simple sequential linear accident models …………………………………………………….4

3.2 Complex linear models …………………………………………………………………………….7

3.3 Complex non linear accident models ………………………………………………………… 16

4 Implications for OHS practice ………………………………………………………………………. 19

5 Summary …………………………………………………………………………………………………… 21

References ……………………………………………………………………………………………………….. 21

OHS Body of Knowledge
Models of Causation: Safety April, 2012

OHS Body of Knowledge Page 1 of 35
Models of Causation: Safety April, 2012

1 Introduction
Accidents have been broadly defined as:

a short, sudden and unexpected event or occurrence that results in an unwanted and undesirable
outcome … and must directly or indirectly be the result of human activity rather than a natural
event’. (Hollnagel, 2004, p. 5)

Accident prevention is the most basic of all safety management paradigms. If safety
management is effective, then there should be an absence of accidents. Conversely, if
accidents are occurring then effective safety management must be absent. Therefore,
understanding how accidents occur is fundamental to establishing interventions to prevent
their occurrence. A simple nexus it would seem, yet the reality is accidents are complex
events, seldom the result of a single failure, and that complexity has made understanding
how accidents occur problematic since the dawn of the industrial revolution.

In an attempt to unravel the accident causation mystery, over the years authors have
developed a plethora of conceptual models. At first glance they appear to be as diverse and
disparate as the accident problem they purport to help solve, yet closer scrutiny reveals
there are some common themes. There are linear models which suggest one factor leads to
the next and to the next leading up to the accident, and complex non linear models which
hypothesise multiple factors are acting concurrently and by their combined influence, lead
to accident occurrence. Some models have strengths in aiding understanding how accidents
occur in theory. Others are useful for supporting accident investigations, to systematically
analyse an accident in order to gain understanding of the causal factors so that effective
corrective actions can be determined and applied.

Accident models affect the way people think about safety, how they identify and analyse risk factors
and how they measure performance … they can be used in both reactive and proactive safety
management … and many models are based on an idea of causality … accidents are thus the result of
technical failures, human errors or organisational problems. Hovden, Albrechtsen and Herrera,
2010, p.855).

This chapter builds on the discussion of hazard as a concept1 to trace the evolution of
thinking about accident causation through the models developed over time thus it forms a
vital foundation for developing the conceptual framework identified as an essential
component of professional OHS practice2. The importance of models of causation to OHS
professional practice is highlighted by Kletz:

To an outsider it might appear that industrial accidents occur because we do not know how to
prevent them. In fact, they occur because we do not use the knowledge that is available.
Organisations do not learn from the past …and the organisation as a whole forgets. (1993.)

1 See OHS BoK Hazard as a Concept
2 See OHS BoK Practice: Model of OHS Practice

OHS Body of Knowledge Page 2 of 25
Models of Causation: Safety April, 2012

2 Historical context
Perhaps the earliest well documented application of accident causation knowledge is that
of the Du Pont company which was founded in 1802 with a strong emphasis on accident
prevention and mitigation. Klein (2009), in a paper entitled “Two Centuries of Process
Safety at DuPont” reported that the company founder E.I. Du Pont (1772 – 1834) had once
noted “we must seek to understand the hazards we live with”. The design and operation of
Du Pont explosives factories, over the next 120 years, were gradually improved as a result
of a consistent effort to understand how catastrophic explosions were caused and
prevented. In that period many of the principles of modern accident prevention theory were
formulated. By 1891 management accountability for safe operations was identified as a
necessary precept to such an extent that the original Du Pont plant design included a
requirement for the Director’s house, in which Du Pont himself, his wife and seven
children lived, to be constructed within the plant precinct, a powerful incentive indeed to
gain an understanding of accident causation. As described by DeBlois (1915), the first
head of DuPont’s Safety Division, elimination of hazards was recognised as the priority in
1915 and a goal of zero injuries was also established at that time. Amongst a list of other
safety management initiatives which would still be considered appropriate in today’s
companies’ safety programs, the Du Pont Safety Division was established in their
Engineering Department in 1915 and carried out plant inspections, conducted special
investigations and analysed accidents.

Accident research was also reported as being part of the work of the British Industrial
Health Board between the two World Wars (Surry, 1969). Surry cited Greenwood and
Woods’ (1919) statistical analysis of injuries in a munitions factory and Newbold’s (1926)
study of thirteen factories which also reviewed injuries purported to be the first research
work into industrial accidents. Various other studies around the time (Osborne, Vernon &
Muscio 1922; Vernon 1919;1920; Vernon, Bedford & Warner 1928) examined previously
unresearched areas of working conditions such as humidity, work hours, workers age,
experience and absenteeism rates. Surry also reported that the appearance of applied
psychologists influenced research studies to focus on ‘human output’ and during the 1930s
attention was directed towards the study of individual accident proneness. Surry noted that
“pure accident research declined after 1940 while the study of performance influencing
factors has flourished” (p. 17).

The history of accident modelling itself can be traced back to the original work by Herbert.
W. Heinrich, whose book Industrial Accident Prevention in 1931 became the first major
work on understanding accidents. Heinrich stated that his fundamental principles for
applying science to accident prevention was that it should be: “(1) through the creation and
maintenance of an active interest in safety; (2) be fact finding; and (3) lead to corrective
action based on the facts” (Heinrich, 1931, p. 6). Heinrich’s book, now in its 5th edition,
attempted to understand the sequential factors leading to an accident and heralded in what
can be termed a period of simple sequential linear accident modelling. While sequential

OHS Body of Knowledge Page 3 of 25
Models of Causation: Safety April, 2012

linear models offered an easy visual representation of the ‘path’ of causal factor
development leading to an accident they did not escape the widely accepted linear time
aspect of events which is tied into the “Western cultural world-view of past, present and
future as being part of everyday logic, prediction and linear causation” (Buzsáki, 2006, p.
8).

3 Evolution of models of accident causation
The history of accident models to date can be traced from the 1920s through three distinct
phases (Figure 1):

• Simple linear models
• Complex linear models
• Complex non-linear models. (Hollnagel, 2010).

Each type of model is underpinned by specific assumptions:

• The simple linear models assume that accidents are the culmination of a series of
events or circumstances which interact sequentially with each other in a linear
fashion and thus accidents are preventable by eliminating one of the causes in the
linear sequence.

• Complex linear models are based on the presumption that accidents are a result of a
combination of unsafe acts and latent hazard conditions within the system which
follow a linear path. The factors furthest away from the accident are attributed to
actions of the organisation or environment and factors at the sharp end being where
humans ultimately interact closest to the accident; the resultant assumption being
that accidents could be prevented by focusing on strengthening barriers and
defences.

• The new generation of thinking about accident modelling has moved towards
recognising that accident models need to be non-linear; that accidents can be
thought of as resulting from combinations of mutually interacting variables which
occur in real world environments and it is only through understanding the
combination and interaction of these multiple factors that accidents can truly be
understood and prevented. (Hollnagel, 2010).

Figure 1 portrays the temporal development of the three types of model and their
underpinning principle. The types of model, their evolution, together with representative
examples are described in the following sections.

OHS Body of Knowledge Page 4 of 25
Models of Causation: Safety April, 2012

Figure 1: Summary of a history of accident modelling (Hollnagel, 2010, slide 7)

3.1 Simple sequential linear accident models
Simple sequential accident models represent the notion that accidents are the culmination
of a series of events which occur in a specific and recognisable order (Hollnagel, 2010) and
now represent the “commonest and earliest model of accident research … that describing a
temporal sequence” where the “accident is the overall description of a series of events,
decisions and situations culminating in injury or damage .. a chain of multiple events”
(Surry, 1969).

3.1.1 Heinrich’s Domino Theory
The first sequential accident model was the ‘Domino effect’ or ‘Domino theory’ (Heinrich,
1931). The model is based in the assumption that:

the occurrence of a preventable injury is the natural culmination of a series of events or
circumstances, which invariably occur in a fixed or logical order … an accident is merely a link in
the chain. (p. 14).

This model proposed that certain accident factors could be thought of as being lined up
sequentially like dominos. Heinrich proposed that an:

… accident is one of five factors in a sequence that results in an injury … an injury is invariably
caused by an accident and the accident in turn is always the result of the factor that immediately
precedes it. In accident prevention the bull’s eye of the target is in the middle of the sequence – an
unsafe act of a person or a mechanical or physical hazard (p. 13).

Heinrich’s five factors were:

OHS Body of Knowledge Page 5 of 25
Models of Causation: Safety April, 2012

• Social environment/ancestry
• Fault of the person
• Unsafe acts, mechanical and physical hazards
• Accident
• Injury.

Extending the domino metaphor, an accident was considered to occur when one of the
dominos or accident factors falls and has an ongoing knock-down effect ultimately
resulting in an accident (Figure 2).

Figure 2: Domino model of accident causation (modified from Heinrich, 1931)

Based on the domino model, accidents could be prevented by removing one of the factors
and so interrupting the knockdown effect. Heinrich proposed that unsafe acts and
mechanical hazards constituted the central factor in the accident sequence and that removal
of this central factor made the preceding factors ineffective. He focused on the human
factor, which he termed “Man Failure”, as the cause of most accidents. Giving credence to
this proposal, actuarial analysis of 75,000 insurance claims attributed some 88% of
preventable accidents to unsafe acts of persons and 10% to unsafe mechanical or physical
conditions, with the last 2% being acknowledged as being unpreventable giving rise to
Heinrich’s chart of direct and proximate causes (Heinrich, 1931, p.19). (Figure 3)

OHS Body of Knowledge Page 6 of 25
Models of Causation: Safety April, 2012

Figure 3: Direct and proximate accident causes according to Heinrich (1931)

3.1.2 Bird and Germain’s Loss Causation model

The sequential domino representation was continued by Bird and Germain (1985) who
acknowledged that the Heinrich’s domino sequence had underpinned safety thinking for
over 30 years. They recognised the need for management to prevent and control accidents
in what were fast becoming highly complex situations due to the advances in technology.
They developed an updated domino model which they considered reflected the direct
management relationship with the causes and effects of accident loss and incorporated
arrows to show the multi-linear interactions of the cause and effect sequence. This model
became known as the Loss Causation Model and was again represented by a line of five
dominos, linked to each other in a linear sequence (Figure 4).

OHS Body of Knowledge Page 7 of 25
Models of Causation: Safety April, 2012

Figure 4: The International Loss Control Institute Loss Causation Model (modified
from Bird and Germaine, 1985)

3.2 Complex linear models
Sequential models were attractive as they encouraged thinking around causal series. They
focus on the view that accidents happen in a linear way where A leads to B which leads to
C and examine the chain of events between multiple causal factors displayed in a sequence
usually from left to right. Accident prevention methods developed from these sequential
models focus on finding the root causes and eliminating them, or putting in place barriers
to encapsulate the causes. Sequential accident models were still being developed in the
1970’s but had begun to incorporate multiple events in the sequential path. Key models
developed in this evolutionary period include energy damage models, time sequence
models, epidemiological models and systemic models.

3.2.1 Energy-damage models
The initial statement of the concept of energy damage in the literature is often attributed to
Gibson (1961) but Viner (1991, p.36) understands it to be a result of discussions between
Gibson, Haddon and others. The energy damage model (figure 5) is based on the
supposition that “Damage (injury) is a result of an incident energy whose intensity at the
point of contact with the recipient exceeds the damage threshold of the recipient” (Viner,
1991, p42).

OHS Body of Knowledge Page 8 of 25
Models of Causation: Safety April, 2012

Figure 5: The Energy Damage Model (Viner, 1991, p.43)

In the Energy Damage Model the hazard is a source of potentially damaging energy and an
accident, injury or damage may result from the loss of control of the energy when there is a
failure of the hazard control mechanism. These mechanisms may include physical or
structural containment, barriers, processes and procedures. The space transfer mechanism
is the means by which the energy and the recipient are brought together assuming that they
are initially remote from each other. The recipient boundary is the surface that is exposed
and susceptible to the energy. (Viner, 1991)

3.2.2 Time sequence models
Benner (1975) identified four issues which were not addressed in the basic domino type
model: (1) the need to define a beginning and end to an accident; (2) the need to represent
the events that happened on a sequential time line; (3) the need for a structured method for
discovering the relevant factors involved; and (4) the need to use a charting method to
define events and conditions. Viner’s Generalised Time Sequence Model is an example of
a time sequence model that addresses Benner’s four requirements. (Figure 6)

OHS Body of Knowledge Page 9 of 25
Models of Causation: Safety April, 2012

Figure 6: Generalised Time Sequence Model (Viner, 1991, p.58)

Viner considers that the structure for analysing the events in the occurrence-consequence
sequence provided by the time sequence model draws attention to counter measures that
may not otherwise be evident. In Time Zone 1 there is the opportunity to prevent the event
occurring. Where there is some time between the event initiation and the event, Time Zone
2 offers a warning of the impending existence of an event mechanism and the opportunity
to take steps to reduce the likelihood of the event while in Time Zone 3 there is an
opportunity to influence the outcome and the exposed groups. (Viner, 1991)

While Viner takes a strictly linear approach to the time sequence Svenson (1991; 2001)
takes a more complex approach in his Accident Evolution and Barrier Function (AEB)
model. The AEB model analyses the evolution of an accident as a series of interactions
between human and technical systems and is visualised as a flow chart. Svenson considers
that the required analysis can only be performed with the simultaneous interaction of
human factors and technical experts. (Svenson, 2001)

3.2.3 Epidemiological models
Epidemiological accident models can be traced back to the study of disease epidemics and
the search for causal factors around their development. Gordon (1949) recognised that
“injuries, as distinguished from disease, are equally susceptible to this approach”, meaning

OHS Body of Knowledge Page 10 of 25
Models of Causation: Safety April, 2012

that our understanding of accidents would benefit by recognising that accidents are caused
by:

a combination of forces from at least three sources, which are the host – and man is the host of
principal interest – the agent itself, and the environment in which host and agent find themselves (p.
506)

Recognising that doctors had begun to focus on trauma or epidemiological approaches,
engineers on systems, and human factors practitioners on psychology Benner (1975);
considered these as only partial treatments of entire events rather than his proposed entire
sequence of events. Thus Benner contributed to the development of epidemiological
accident modelling which moved away from identifying a few causal factors to
understanding how multiple factors within a system combined. These models proposed that
an accident combined agents and environmental factors which influence a host
environment (like an epidemic) that have negative effects on the organism (a.k.a.
organisation). See for example Figure 7.

Figure 7: A generic epidemiological model (modified from Hollnagel, 2004, p.57)

Reason (1987) adopted the epidemiological metaphor in presenting the idea of ‘resident
pathogens’ when emphasising:

the significance of causal factors present in the system before an accident sequence actually begins
… and all man-made systems contain potentially destructive agencies, like the pathogens within the
human body (1987, p.197).

OHS Body of Knowledge Page 11 of 25
Models of Causation: Safety April, 2012

The term became more widely known as ‘latent errors’, then changed to ‘latent failures’
evolving further when the term ‘latent conditions’ became preferred (Reason, 1997).

Accident prevention methods matching an epidemiological accident model focus on
performance deviations and understanding the latent causes of the accident. These causes
might be found in deviations or unsafe acts and their suppression or elimination can
prevent the accident happening again. Errors and deviations are usually seen by OHS
professionals in a negative context, and programs such as ‘safe behaviour’ methodologies
attempt to ensure that strict rules and procedures are always followed. However safety
prevention thinking is moving to an understanding that systems should be resilient enough
to withstand deviations or uncommon actions without negative results.

3.2.4 Systemic models
By the 1980s OHS researchers realised that previous accident models did not reflect any
realism as to the true nature of the observed accident phenomenon. As noted by Benner:

one element of realism was non-linearity … models had to accommodate non-linear events. Based
on these observations, a realistic accident model must reflect both a sequential and concurrent non-
linear course of events, and reflect events interactions over time (1984, p. 177).

This was supported by Rasmussen (1990) who, whilst quoting Reason’s (1990) resident
pathogens, acknowledged that the identification of events and causal factors in an accident
are not isolated but “depend on the context of human needs and experience in which they
occur and by definition … therefore will be circular” (p. 451).

Systemic accident models which examined the idea that systems failures, rather than just
human failure, were a major contributor to accidents (Hollnagel, 2004) began to address
some of these issues (but not non-linear concepts) and recognised that events do not
happen in isolation of the systemic environment in which they occur.

Accident models also developed with further understanding of the role of humans, and in
particular the contribution of human error, to safety research. A skill-rule-knowledge
model of human error was developed in the earlier work of Rasmussen & Jensen (1974)
and has remained a foundation concept for understanding of how human error can be
described and analysed in accident investigation. Research by Rouse (1981) contributed to
the understanding of human memory coding, storage and retrieval. Cognitive science came
to the fore in accident research, and further work by Rasmussen (1981; 1986) and Reason
(1979; 1984a; 1984b; 1984c) saw the widespread acceptance and recognition of the skill-
based, rule-based and knowledge-based distinctions of human error in operations.

Rasmussen (1990) wrote extensively on the problem of causality in the analysis of
accidents introducing concepts gleaned from philosophy on the linkage between direct

OHS Body of Knowledge Page 12 of 25
Models of Causation: Safety April, 2012

cause-effect, time line and accident modelling. Rasmussen explored the struggle to
decompose real world events and objects, and explain them in a causal path found
upstream from the actual accident where latent effects lie dormant from earlier events or
acts. At this stage, Rasmussen recognised that socio-technical systems3 were both complex
and unstable. Any attempt to discuss a flow of events does not take into account:

closed loops of interaction among events and conditions at a higher level of individual and
organizational adaption … with the causal tree found by an accident analysis is only a record of one
past case, not a model of the involved relational structure” (1990, p. 454).

In calling for a new approach to the analysis of causal connections found in accident
reports Rasmussen heralded in a more complex approach to graphically displaying
accidents and understanding and capturing the temporal, complex system and events
surrounding accident causation.

Reason’s early work in the field of psychological error mechanisms (Reason 1975; 1976;
1979) was important in this discussion on complexity of accident causation. By analysing
everyday slips and lapses he developed models of human error mechanisms (Rasmussen
1982). Reason (1990) went on to address the issue of two kinds of errors: active errors and
latent errors. Active errors were those “where the effect is felt almost immediately” and
latent errors “tended to lie dormant in the system largely undetected until they combined
with other factors to breach system defences” (p. 173). Reason, unlike Heinrich (1931) and
Bird and Germain (1985) before him, accepted that accidents were not solely due to
individual operator error (active errors) but lay in the wider systemic organisational factors
(latent conditions) in the upper levels of the organisation. Reason’s model is commonly
known as the Swiss Cheese Model (see Figure 6).

Figure 6: Reason’s ‘Swiss Cheese’ Model (modified from Reason, 2008 p.102)

3 See OHS BoK Systems for a discussion on socio-technical systems.

OHS Body of Knowledge Page 13 of 25
Models of Causation: Safety April, 2012

Unlike the modelling work of Heinrich (1931) and Bird and Germain (1985), Reason did
not specify what these holes represented or what the various layers of cheese represented.
The model left the OHS professional to their own investigations as to what factors within
the organisation these items might be.

The “Swiss Cheese” model was only one component of a more comprehensive model he
titled the Reason Model of Systems Safety (Reason 1997) (Figure 7).

Figure 7: The Reason Model of System Safety (Reason, 1997)

Reason had a major impact on OHS thinking and accident causation in that he moved the
focus of investigations from blaming the individual to a no-blame investigation approach;
from a person approach to a systems approach; from active to latent errors; and he focused
on hazards, defences and losses. Reason’s Swiss Cheese and Systems Safety models were
an attempt to reflect these changes.

OHS Body of Knowledge Page 14 of 25
Models of Causation: Safety April, 2012

To understand the role of James Reason in changing the thinking about accidents it is
important to see his work in the historical context that his work followed closely the
accepted work of Rasmussen on human error (see Rasmussen, 1982) and Reason’s 1987
work in this area gave him initial credibility in the safety arena. However, by 1997 he
wanted accident investigation to move away from blaming the individual at the sharp end
of the system towards a no-blame approach, as had been an underpinning tenet of
professional air safety investigators for many years (ICAO 1970 & USNSC 1973).4 In
focusing on hazards, defences and losses Reason (1997) wanted to convey the message that
organisational accidents were a result of a failure to recognise the hazards in the system
and the need to establish a variety of defences to prevent their adverse effects. The holes in
the Swiss cheese represented a lack of strong, air-tight defences which ultimately let the
accident sequence happen. Reason continued to discuss human error, but from an error
management perspective, requiring organisations to again put in place barriers for errors
rather than trying to eradicate them as he recognised total eradication as an impossible
task.

These models, whilst becoming highly recognisable and favoured, were criticised for a
number of reasons including their lack of definition of what the holes in the barriers
represented.

[T]he Reason model, in its current form, fails to provide the detailed linkages from individual to
task/environment to organization beyond a general framework of line management deficiencies and
psychological precursors of unsafe acts” (Luxhøj & Maurino, 2001, p. 1).

Also, the model did not allow for the variation in organisational and individual working:

Reason’s model shows a static view of the organisation; whereas the defects are often transient, i.e.
the holes in the Swiss cheese are continuously moving … the whole socio-technical system is more
dynamic than the model suggests (Qureshi, 2007,”Epidemiological Accident Models” par.2)

While Reason’s models achieved a change in thinking about accidents recognising the
complexity of causation he was also part of the move away from the heavy human error
emphasis (Reason, 1990) towards a no blame or “just culture” approach (Reason, 1997).
The “just culture” approach recognised that human error was not only a normal operating
mode but a normal occurrence allowing humans to learn as part of their natural path of
development and function. Woods, Johannesen, Cook & Sarter (1994) describe this
scenario as “latent failures [that] refer to problems in a system that produce a negative
effect but whose consequences are not revealed or activated until some other enabling
condition is met” (p. 19). By recognising that latent conditions require a trigger in the form
of an interaction, usually with a human, it can be seen that the study of humans in the
accident trajectory moves away from what the human did wrong to the study of normal

4 While this has now largely been accepted across industry, the recent emergence of the criminalisation of
aircraft accidents has the real potential to undermine the effort and adversely impact the successful
investigation of future accidents (Michaelidis and Mateou, 2010; Trogeler, 2010; Gates and Partners, 2011).

OHS Body of Knowledge Page 15 of 25
Models of Causation: Safety April, 2012

human behaviour and decision making based on the environment in which they are
functioning and the knowledge and technology available for decision making at the time.
The study of humans in the system moves from the individual to groups of individuals
embedded in a larger system (Woods et al 1994). This is represented in Woods et al.,
depiction of the sharp and blunt end of large, complex systems (Figure 8.)

Figure 8: The sharp and blunt ends of a large complex system (Woods et al., 1994)

In 1984 Purswell and Rumar reviewed the progress of accident research in recent decades
and in particular accident modelling. They noted the continuing discussion around the
suitability of one accident model over another with the resolution that at this time “no
universally accepted approach which is unique to occupational accident research” had yet
emerged. They cautioned against the apparent dangers of trying to obtain uniformity in the
methodology of accident investigation with the dilemma being “the prospect of the model
driving the problem definition, rather than the problem generating the appropriate model to
be used” (p. 224). This observation and concern was still appropriate a decade later.

OHS Body of Knowledge Page 16 of 25
Models of Causation: Safety April, 2012

3.3 Complex non linear accident models
As shown in Figure 1 there has been considerable overlap in the development of the
various conceptual approaches to accident causation. In parallel with the development of
thinking around epidemiological models and systemic models the thinking around the
complexity of accident causation led to non complex linear models. Key researchers in this
approach have been Perrow, Leveson and Holnagel. The implications of recent discussions
on complexity and ‘drift’ are briefly considered.

In the early 1980s Perrow began to argue that technological advances had made systems
not only tightly coupled but inheritably complex, so much so that he termed accidents in
these systems as being “normal”. Perrow’s normal accident theory postulated that tightly
coupled systems had little tolerance for even the slightest disturbance which would result
in unfavourable outcomes. Thus tightly coupled systems were so inherently unsafe that
operator error was unavoidable due the way the system parts were tightly coupled.
(Perrow, 1984) Components in the system were linked through multiple channels, which
would affect each other unexpectedly, and with the complexity of the system meaning that
it was almost impossible to understand it (Perrow, 1984; Tenner, 1996).

Two new major accident models were introduced in the early 2000s with the intention of
addressing problems with linear accident models (Hovden, et al., 2009):

• The Systems-Theoretic Accident Model and Process (STAMP) (see Leveson,
2004).

• The Functional Resonance Accident Model (FRAM) (see Hollnagel, 2004)

3.3.1 Systems-Theoretic Accident Model and Process (STAMP)
Leveson’s model considered systems as “interrelated components that are kept in a state of
dynamic equilibrium by feedback loops of information and control” (2004, p. 250). It
emphasised that safety management systems were required to continuously control tasks
and impose constraints to ensure system safety. This model of accident investigation
focused on why the controls that were in place failed to detect or prevent changes that
ultimately lead to an accident. Leveson developed a classification of flaws method to assist
in identifying the factors which contributed to the event, and which pointed to their place
within a looped and linked system. Leveson’s model expands on the barriers and defences
approach to accident prevention and is tailored to proactive and leading safety performance
indicators (Hovden, et al., 2009). However this model has had little up take in the safety
community and is not widely recognised as having a major impact on accident modelling
or safety management generally. Roelen, Lin and Hale (2010, p.6) suggest that this may be

OHS Body of Knowledge Page 17 of 25
Models of Causation: Safety April, 2012

because Leveson’s model does “not connect to the current practice of safety data collection
and analysis” making it less favourable than event chain models such as Reason’s.

3.3.2 Functional Resonance Accident Model (FRAM)
Erik Holnagel is one of the more forward thinking researchers in the area of accident
modelling and the understanding of causal factors. While Hollnagel’s early published work
(Cacciabue & Hollnagel 1995; Hollnagel 1993; 1998) centred on human/cognitive
reliability and human/machine interface his more recent work Barriers and Accident
Prevention (2004) challenged current thinking about accident modelling. He introduced the
concept of a three dimensional way of thinking about accidents in what is now known to be
highly complex and tightly coupled socio-technical systems in which people work. He
describes systemic models as tightly coupled and the goals of organisations as moving
from putting in place barriers and defences to focusing on systems able to monitor and
control any variances, and perhaps by allowing the systems to be (human) error tolerant.

Hollnagel’s Functional Resonance Accident Model (FRAM) (Figure 9), is the first attempt
to place accident modelling in a three-dimensional picture, moving away from the linear
sequential models, recognising that “forces (being humans, technology, latent conditions,
barriers) do not simply combine linearly thereby leading to an incident or accident”
(Hollnagel, 2004, p. 171).

FRAM is based on complex systemic accident theory but considers that system variances
and tolerances result in an accident when the system is unable to tolerate such variances in
its normal operating mode. Safety system variance is recognised as normal within most
systems, and represents the necessary variable performance needed for complex systems to
operate, including limitations of design, imperfections of technology, work conditions and
combinations of inputs which generally allowed the system to work. Humans and the
social systems in which they work also represent variability in the system with particular
emphasis on the human having to adjust and manage demands on time and efficiency (p.
168).

Hollnagel’s (2005) theory of efficiency-thoroughness trade-off (ETTO) expanded on these
demands on the humans, where efficiency was often given more priority to thoroughness
and vice versa. Hollnagel recognised that complex systems comprise a large number of
subsystems and components with performance variability usually being absorbed within
the system with little negative effect on the whole. Four main sources of variability were
identified as:

• Humans
• Technology
• Latent conditions

OHS Body of Knowledge Page 18 of 25
Models of Causation: Safety April, 2012

• Barriers (p. 171).

Holnagel proposed that when variables within the system became too great for the system
to absorb them; possibly through a combination of these subsystem variables of humans,
technology, latent conditions and barriers; the result will be undetectable and unwanted
outcomes. That is a ‘functional resonance’ results, leading to the system being unable to
cope in its normal functioning mode. (Figure 9)

Figure 9: Functional Resonance as a System Accident Model (Holnagel, 2004)

Hollnagel’s FRAM model presents a view of how different functions within an
organisation were linked or coupled to other functions with the objective of understanding
the variability of each of the functions, and how that variability could be both understood
and managed. The functions are categorised as inputs, outputs, preconditions, resources,
time and control. Variability in one function can also affect the variability of other
functions (p. 173). In 2010 Hollnagel launched a web site in support of the growing cohort
of researchers and OHS professionals interested in using the model as a tool for
understanding and managing accidents and incidents. While the Functional Resonance
Accident Model provided a theoretical basis for thinking about accident causation
Hollnagel clearly differentiated between models that aided thinking about accident
causation and methods of analysing accidents as part of investigations. The Functional

OHS Body of Knowledge Page 19 of 25
Models of Causation: Safety April, 2012

Resonance Analysis Method evolved from the conceptual thinking embodied in the model
which was highlighted by retaining the FRAM acronym. A detailed description of the
method is given in Sundstrom & Hollnagel (2011). .

3.3.3 Complexity and accident modelling
While the FRAM model begins to address complexity of organisation and the relationship
with accident causation Dekker (2011) takes the discussion of complexity further to
challenge the notion of accident modelling and the predictive ability of accident models. In
describing complexity of society and technology Dekker considers that:

The growth of complexity in society has got ahead of our understanding of how complex systems
work and fail. Our technologies have got ahead of our theories. Our theories are still fundamentally
reductionist, componential and linear. Our technologies, however are increasingly complex
emergent and non-linear. Or they get released into environments that make them complex, emergent
and non-linear. (2011, p.169)

Accidents occur in these complex systems by a “drift into failure” which occurs through a
slow but steady adaptive process where micro-level behaviours produce new patterns
which become embedded and then in turn are subject to further change. Dekker’s position
is that as there are no well-developed theories for understanding how such complexity
develops and the general response is to apply simple, linear ideas in the expectation that
they will assist in understanding causation (p.6). He considers the search for the “broken
and part or person” that underpins linear models where risk is considered in terms of
energy-to-be-contained, barriers and layers of defence, or cause and effect are misleading
because they assume rational decision-making (p.2).

Where does this leave the OHS professional wanting to understand accident causation and
seeking a conceptual framework to inform prevention and investigation activities?

4 Implications for OHS practice
In 2010, Hovden, Albrechtsen & Herrera observed that:

… technologies, knowledge, organisations, people, values, and so on are all subject to change in a
changing society. Nonetheless, when it comes to occupational accident prevention most experts and
practitioners still believe in the domino model and the iceberg metaphor. (p. 953)

If this is currently the case in Australia then a lack of awareness of the development of
thinking about accident causation and the application of models of causation may be
inhibiting the development of effective prevention strategies as:

Merely identifying a proximate cause as the ‘‘root cause” may, however, lead to the elimination of
symptoms without much impact on the prospect of reducing future accidents (Marais et al., 2004;
Leveson, 2004). In order to identify systemic causes, one may need to supplement with models

OHS Body of Knowledge Page 20 of 25
Models of Causation: Safety April, 2012

representing alternative mindsets in order to spark the imagination and creativity required to solve
the accident risk problem. (Hovden et al., 2010, p. 954)

The Model of OHS Practice5 highlights the role of a conceptual framework in
underpinning professional practice. An understanding of the evolution of accident, or
occurrence, modelling is vital grounding for the OHS professional in developing their
conceptual framework or mental model of accident causation. This chapter has considered
a number of models for causation of accidents but which on initial reading may leave the
OHS professional asking “Are models useful?” and ‘So which model?’.

Hovden et al., (2010) put this discussion into perspective for the OHS professional. While
recognising that today’s organisations are dynamic socio-technical systems characterised
by increased complexity, working life at the sharp end has, with some exceptions, largely
remained unaltered. They argue that there is little need for new models for the sake of
understanding the direct causes of accidents in daily work life but these basic models
should be enriched by the theories and models developed for high-risk socio-technical
systems. Thus, in developing their mental model the OHS professional should be aware of
a range of models of causation and be able to critically evaluate the model for application
to their practice. This evaluation should address the question of currency verses best
practice. The more recent the model does not necessarily imply better practice. Section
3.3.1 noted that the STAMP model has not received broad acceptance while, in some
industries, the Swiss Cheese model is still considered best practice 22 years after its
introduction. The OHS professional investigating a workplace accident may be informed
by discussions on complexity but may find that the energy damage model or the swiss
cheese models is more informative for the particular situation. The OHS professional must
also work within the environment of the organisation and the limitations that that brings.
As noted by Roelen, Lin & Hale (2011) one of the problems with the advanced models of
causation including complexity factors is that they do not connect with current practices in
safety data collection and analysis (p.6). In applying a particular model the OHS
professional also needs to be able to differentiate between what actually occurs in the
workplace with that which should happen.

The OHS professional should differentiate between the model and methods that may or
may not be underpinned by theoretical models. For example sequential models inform
some of traditional forms of accident analysis such as events trees, fault trees and critical
path models. The Incident Cause Analysis Method (ICAM) of investigation was developed
from Reason’s Swiss Cheese model. Holnagel’s Functional Resonance Analysis Method is
clearly underpinned by the Functional Resonance Accident Model.

5 See OHS BoK Practice: Model of OHS Practice

OHS Body of Knowledge Page 21 of 25
Models of Causation: Safety April, 2012

5 Summary
Hovden et al., provide six uses for accident causation models:

– Create a common understanding of accident phenomena through a shared simplified representation
of real-life accidents.

– Help structure and communicate risk problems.
– Give a basis for inter-subjectivity, thus preventing personal biases regarding accident causation and

providing an opening for a wider range of preventive measures.
– Guide investigations regarding data collection and accident analyses.
– Help analyse interrelations between factors and conditions.
– Different accident models highlight different aspects of processes, conditions and causes. (p.955)

Accidents are complex events and that complexity has made understanding how accidents
occur problematic. Beginning in the 1930s there has been an evolution in thinking about
accident causation. While there has been significant overlap in the development phases,
and a number of the models have enduring application in certain circumstances. The
evolution has progressed from simplistic ‘domino models’ that focus on the behaviour of
individuals through more complex linear models that consider the time sequence of event
analysis, ‘epidemiological’ models, to systemic models that consider barriers and defences.
With greater recognition of the complexity of causation of accidents newer recent models
became complex and non-linear.

While recent discussions on complexity and ‘drift’ have been interpreted by some as
casting doubt on the usefulness of models of accident causation, the reality of OHS
professional practice is that understanding accident causation is central to effective OHS
practice. The learning and understanding about accident causation engendered by an
awareness of the evolution in thinking about causation and with these models leads to the
establishment of effective preventive methods and systemic defences and the ability to
effectively respond to those which do occur. Failure to understand accident causation leads
to degradation of preventive mechanisms and accident occurrence or recurrence.

References
Benner, L. (1975). Accident Investigations: Multilinear Events Sequencing Methods.

Journal of Safety Research, 7(2), 67-73.

Benner, L. (1984). Accident models: How underlying differences affect workplace safety.
Paper presented at the International Seminar on Occupational Accident Research,
Saltjobaden: Sweden.

Bird, F. E. J., &Germain, G. L. (1985).Practical Loss Control Leadership. Loganville,
Georgia: International Loss Control Institute, Inc.

Buzsáki, G. (2006). Rhythms of the Brain. New York: Oxford University Press.

OHS Body of Knowledge Page 22 of 25
Models of Causation: Safety April, 2012

Cacciabue, P. C., Holnagel, E. (1995). Simulation of Cognition: Applications. In J.M. Hoc,
P.D. Cachiabue & E. Holnagel, (Eds.), Expertise and Technology, New Jersey:
Lawrence Erlbaum and Associates.

DeBlois, L. A. (1915), The Application of Safety Devices, Hagley Museum and Library,
Wilmington, DE

Dekker, S. (2011). Drift into Failure: From Hunting Broken Components to Understanding
Complex Systems. Surry: Ashgate.

Gates and Partners (2011), Aviation and the Implications of Criminalisation, Gates and
Partners Solicitors, http://alae.org/downloads/legal/accidents

Gibson, J.J. (1961). The contribution of experimental psychology to the formulation of the
problem of safety – a brief for basic research, in Jacobs, H.H. et al., Behavioural
Approaches to Accident Research, New York Association for the aid of crippled
children.

Gordon, J. E. (1949). The epidemiology of accidents. American Journal of Public Health,
39, 504-515.

Greenwood, M., Woods, H. M. (1919). A report on the incidence of industrial accidents
upon individuals with special reference to multiple accidents. British Industrial
Fatigue Research Board.

Heinrich, H. W. (1931). Industrial Accident Prevention: A scientific approach. New York:
McGraw-Hill.

Hollnagel, E. (1993). Human reliability analysis: Context and control. London: Academic
Press.

Hollnagel, E. (1998). Cognitive reliability and error analysis method: CREAM: Elsevier.

Hollnagel, E. (2004). Barriers and Accident Prevention: Aldershot:Ashgate,.

Hollnagel, E. (2005). The ETTO Principle – Efficiency-Thoroughness Trade Off. Retrieved
from http://www.ida.liu.se/~eriho/ETTO_M.htm

Hollnagel, E. (2010). FRAM Background. Retrieved from
http://sites.google.com/site/erikhollnagel2/coursematerials/FRAM_background

Hovden, J., Abrechtsen, E., & Herrera, I. A. (2010). Is there a need for new theories,
models and approaches to occupational accident prevention? Safety Science, 48(8),
950-956.

Klein J (2009),Two Centuries of Safety History at DuPont, Process Safety Progress, Vol.
28 Issue 2 pp114 – 122, Wiley Interscience.

Kletz, T. (1993). Lessons from disasters: How organisations have no memory and
accidents recur. Warwickshire: Institution of Chemical Engineers l

OHS Body of Knowledge Page 23 of 25
Models of Causation: Safety April, 2012

Leveson, N. (2004). A new accident model for engineering safer systems. Safety Science,
42, 237-270.

Luxhøj, J. T., Maurino, M. (2001). An aviation system risk model (ASRM) case study: Air
Ontario 1363. The Rutgers Scholar, 3.

Michaelidis-Mateou S. and Mateou A. (2010), Flying in the Face of Criminalisation,
Ashgate

Newbold, E. M. (1926). A contribution to the study of the human factor in causation of
accidents. British Industrial Health Research Board.

Osborne, E. E., Vernon, H. M., &Muscio, B. (1922). Two contributions to the study of
accident causation. British Industrial Fatigue Research Board.

Perrow, C. (1984). Normal Accidents: Living with High-Risk Technologies. New York:
Basic Books Inc.

Purswell, J. J., &Rumar, K. (1984). Occupational accident research: Where have we been
and where are we going? Journal of Occupational Accidents, 6, 219-228.

Qureshi, Z. H. (2007). A review of accident modelling approaches for complex socio-
technical systems. Paper presented at the 12th Australian Workshop on Safety Related
Programmable Systems (SCS’07). http://crpit.com/confpapers/CRPITV86Qureshi

Rasmussen, J. (1981). Models of mental strategies in process plant diagnosis. In J.
Rasmussen & W. Rouse (Eds.), Human Detection and Diagnosis of System Failures.
New York: Planum.

Rasmussen, J. (1982). Human errors: A taxonomy for describing human malfunction in
industrial installations. Journal of Occupational Accidents, 4(311-335).

Rasmussen, J. (1986). Information Processing and Human-Machine Interaction.
Amsterdam: North-Holland.

Rasmussen, J. (1990). Human error and the problem of causality in analaysis of accidents.
Paper presented at the Human Factors in Hazardous Situations. Proceedings of a
Royal Society Discussion Meeting.

Rasmussen, J., Jensen, A. (1974). Mental procedures in real-life tasks: A case study of
electronic troubleshooting. Ergonomics, 17, 193-307.

Reason, J. T. (1975). How did I come to do that? New Behaviour, 24.

Reason, J. T. (1976).Absent minds.New Society, 4(November).

Reason, J. T. (1979). Actions not as planned: The price of automatization. In G.
Underwood & R. Stevens (Eds.), Aspects of Consciousness (Vol. 1). London: Wiley.

Reason, J. T. (1984a).Lapses of attention.In R. Parasuraman& R. Davies (Eds.), Varieties
of Attention. New York: Academic Press.

OHS Body of Knowledge Page 24 of 25
Models of Causation: Safety April, 2012

Reason, J. T. (1984b).Absent-mindedness and cognitive control.In J. Harris & P. Morris
(Eds.), Everyday Memory, Actions and Absent-Mindedness. London: Academic Press.

Reason, J. T. (1984c).Order of output in category generation. Paper presented at the
Cognitive Section, British Psychological Society, Oxford.

Reason, J. T. (1987).The Chernobyl Errors. Bulletin of the British Psychological Society,
40, 201-206.

Reason, J. T. (1990).Human Error. Aldershot: Ashgate.

Reason, J. T. (1997).Managing the Risks of Organisational Accidents. Aldershot: Ashgate.

Reason, J.T. (2008). The Human Contribution: Unsafe Acts, Accidents and Heroic
Recoveries. Surrey: Ashgate.

Roelen, A. L. C., Lin, P. H., & Hale, A. R. (2011). Accident models and organisational
factors in air transport: The need for multi-method models. Safety Science, 49, 5-10.

Rouse, W. B. (1981). Models of human problem solving: Detection, diagnosis and
compensation for system failures. Paper presented at the Proceedings of IFAC
Conference on Analysis, Design and Evaluation of Man-Machine Systems., Baden-
Baden, FRG.

Sundstrom, G.H., Hollnagel, E. (2011). The Importance of Functional Interdependence in
Financial Services Systems. In E. Hollnagel, J Pariés & D.D. Woods (Eds.), Resilience
Engineering in Practice: A Guide Book. Ashgate.

Surry, J. (1969). Industrial Accident Research: A Human Engineering Appraisal. Toronto,
Ontario: Labour Safety Council, Ontario Department of Labour.

Svenson, O. (1991). The accident evolution and barrier function (AEB) model applied to
incident analysis in the processing industries. Risk Analysis, 11(3), 499-507.

Svenson, O. (2001). Accident and incident analysis based on accident evolution and barrier
function (AEB) model. Cognition, Technology & Work, 3(1), 42-52.

Tenner, E. (1996). Why things bite back. London: Fourth Estate Limited.

Trogeler M. (2010), Criminalisation of air accidents and the creation of a Just Culture,
European Air Law Association,
http://www.eala.aero/library/Mildred%20Trgeler%20EALA%20prize

Vernon, H. M. (1919). The influence of hours of work and of ventilation on output in
tinplate manufacturing. British Industrial Fatigue Research Board.

Vernon, H. M. (1920). Fatigue and efficiency in the iron and steel industry. British
Industrial Fatigue Research Board.

Vernon, H. M., Bedford, T., & Warner, C. G. (1928). A study of absenteeism in a group of
10 collieries. British Industrial Fatigue Research Board.

OHS Body of Knowledge Page 25 of 25
Models of Causation: Safety April, 2012

Viner, D. (1991), Accident analysis and risk control, Derek Viner Pty Ltd, Melbourne.
Woods, D. D., Johannesen, L. J., Cook, R. I., &Sarter, N. B. (1994). Behind Human Error:

Cognitive Systems, Computers, and Hindsight. Dayton, Ohio;Dayton University
Research Institute.