32 Models of Causation Safety

Published on January 2017 | Categories: Documents | Downloads: 62 | Comments: 0 | Views: 313
of 35
Download PDF   Embed   Report

Comments

Content

Models of
Causation:
Safety

OHS Body of Knowledge
Models of Causation: Safety

April, 2012

Copyright notice and licence terms

First published in 2012 by the Safety Institute of Australia Ltd, Tullamarine, Victoria, Australia.
Bibliography.
ISBN 978-0-9808743-1-0
This work is copyright and has been published by the Safety Institute of Australia Ltd (SIA) under the
auspices of HaSPA (Health and Safety Professionals Alliance). Except as may be expressly provided by law
and subject to the conditions prescribed in the Copyright Act 1968 (Commonwealth of Australia), or as
expressly permitted below, no part of the work may in any form or by any means (electronic, mechanical,
microcopying, digital scanning, photocopying, recording or otherwise) be reproduced, stored in a retrieval
system or transmitted without prior written permission of the SIA.
You are free to reproduce the material for reasonable personal, or in-house, non-commercial use for the
purposes of workplace health and safety as long as you attribute the work using the citation guidelines below
and do not charge fees directly or indirectly for use of the material. You must not change any part of the work
or remove any part of this copyright notice, licence terms and disclaimer below.
A further licence will be required and may be granted by the SIA for use of the materials if you wish to:
· reproduce multiple copies of the work or any part of it
· charge others directly or indirectly for access to the materials
· include all or part of the materials in advertising of a product or services, or in a product for sale
· modify the materials in any form, or
· publish the materials.
Enquiries regarding the licence or further use of the works are welcome and should be addressed to:
Registrar, Australian OHS Education Accreditation Board
Safety Institute of Australia Ltd, PO Box 2078, Gladstone Park, Victoria, Australia, 3043
[email protected]
Citation of the whole Body of Knowledge should be as:
HaSPA (Health and Safety Professionals Alliance).(2012). The Core Body of Knowledge for
Generalist OHS Professionals. Tullamarine, VIC. Safety Institute of Australia.
Citation of individual chapters should be as, for example:
Pryor, P., Capra, M. (2012). Foundation Science. In HaSPA (Health and Safety Professionals
Alliance), The Core Body of Knowledge for Generalist OHS Professionals. Tullamarine, VIC.
Safety Institute of Australia.
Disclaimer

This material is supplied on the terms and understanding that HaSPA, the Safety Institute of
Australia Ltd and their respective employees, officers and agents, the editor, or chapter authors and
peer reviewers shall not be responsible or liable for any loss, damage, personal injury or death
suffered by any person, howsoever caused and whether or not due to negligence, arising from the
use of or reliance of any information, data or advice provided or referred to in this publication.
Before relying on the material, users should carefully make their own assessment as to its accuracy,
currency, completeness and relevance for their purposes, and should obtain any appropriate
professional advice relevant to their particular circumstances.

OHS Body of Knowledge
Models of Causation: Safety

April, 2012

.

OHS Body of Knowledge
Models of Causation: Safety

April, 2012

OHS Body of Knowledge
Models of Causation: Safety

April, 2012

Synopsis of the OHS Body of Knowledge

Background

A defined body of knowledge is required as a basis for professional certification and for
accreditation of education programs giving entry to a profession. The lack of such a body
of knowledge for OHS professionals was identified in reviews of OHS legislation and
OHS education in Australia. After a 2009 scoping study, WorkSafe Victoria provided
funding to support a national project to develop and implement a core body of knowledge
for generalist OHS professionals in Australia.
Development

The process of developing and structuring the main content of this document was managed
by a Technical Panel with representation from Victorian universities that teach OHS and
from the Safety Institute of Australia, which is the main professional body for generalist
OHS professionals in Australia. The Panel developed an initial conceptual framework
which was then amended in accord with feedback received from OHS tertiary-level
educators throughout Australia and the wider OHS profession. Specialist authors were
invited to contribute chapters, which were then subjected to peer review and editing. It is
anticipated that the resultant OHS Body of Knowledge will in future be regularly amended
and updated as people use it and as the evidence base expands.
Conceptual structure

The OHS Body of Knowledge takes a ‘conceptual’ approach. As concepts are abstract, the
OHS professional needs to organise the concepts into a framework in order to solve a
problem. The overall framework used to structure the OHS Body of Knowledge is that:
Work impacts on the safety and health of humans who work in organisations. Organisations are
influenced by the socio-political context. Organisations may be considered a system which may
contain hazards which must be under control to minimise risk. This can be achieved by
understanding models causation for safety and for health which will result in improvement in the
safety and health of people at work. The OHS professional applies professional practice to
influence the organisation to being about this improvement.

OHS Body of Knowledge
Models of Causation: Safety

April, 2012

This can be represented as:

Audience

The OHS Body of Knowledge provides a basis for accreditation of OHS professional
education programs and certification of individual OHS professionals. It provides guidance
for OHS educators in course development, and for OHS professionals and professional
bodies in developing continuing professional development activities. Also, OHS
regulators, employers and recruiters may find it useful for benchmarking OHS professional
practice.
Application

Importantly, the OHS Body of Knowledge is neither a textbook nor a curriculum; rather it
describes the key concepts, core theories and related evidence that should be shared by
Australian generalist OHS professionals. This knowledge will be gained through a
combination of education and experience.
Accessing and using the OHS Body of Knowledge for generalist OHS professionals

The OHS Body of Knowledge is published electronically. Each chapter can be downloaded
separately. However users are advised to read the Introduction, which provides background
to the information in individual chapters. They should also note the copyright requirements
and the disclaimer before using or acting on the information.

OHS Body of Knowledge
Models of Causation: Safety

April, 2012

Models of Causation: Safety
Associate Professor Yvonne Toft DProf.(Trans Stud), MHlthSc, GDipOHS, GCertFlexLearn,
FSIA, MHFESA, MICOH.

Faculty of Sciences, Engineering & Health, CQUniversity
Email: [email protected]
Yvonne combines teaching in human factors, worksite analysis, accident analysis,
systems safety and research and design with active research interests in engineering
design, accident analysis, prediction of error sources, systems safety and
transdisciplinary communication and design,
Associate Professor Geoff Dell PhD, M.App Sci OHS, Grad Dip OHM, CFSIA, MISASI
Faculty of Sciences, Engineering & Health, CQUniversity
Email: [email protected]
Geoff is a career system safety, risk management and accident investigation specialist
with 30 years experience across a range of high risk industries and is a qualified air
safety investigator. He is currently implementing a suite of investigation education
programs at CQ University.
Karen K Klockner, CQUniversity
Allison Hutton, CQUniversity
Peer-reviewers
Dr David Borys PhD, MAppSc(OHS), GDipOHM, GCertEd, AssDipAppSc(OHS), FSIA
Senior Lecturer, VIOSH Australia, University of Ballarat
Professor David Cliff MAusIMM MSIA, CChem, MRACI, MEnvANZ
Director of Minerals Industry Safety and Health Centre, Sustainable Minerals
Institute, University of Queensland
David Skegg, GDipOHM, CFSIA, FAICD
Manager, Health, Safety and Environment, CBH Australia Pty Ltd

OHS Body of Knowledge
Models of Causation: Safety

Core Body of
Knowledge for the
Generalist OHS
Professional
April, 2012

Core Body of Knowledge for the Generalist OHS Professional

Models of Causation: Safety
Abstract
Understanding accident causation is intrinsic to their successful prevention. To shed light
on the accident phenomenon, over the years authors have developed a plethora of
conceptual models. At first glance they seem as diverse and disparate as the accident
problem they purport to help solve, yet closer scrutiny reveals there are some common
themes. There are linear models which suggest one factor leads to the next and to the next
leading up to the accident and there are complex non linear models which hypothesise
multiple factors are acting concurrently and by their combined influence, lead to accident
occurrence. Beginning with a look at the historical context, this chapter reviews the
development of accident causation models and so the understanding of accidents. As this
understanding should underpin OHS professional practice the chapter concludes with a
consideration of the implications for OHS professional practice.

Key words
accident, occurrence, incident, critical incident, mishap, defence/s, failure, causation,
safety

Note from the Body of Knowledge Technical Panel and the authors of this chapter:
The development of theories and modeling of accident causation is a dynamic field with the result that
there is often a gap between the theoretical discussion and practice. This chapter has taken on the
difficult task of collating a selection of models and presenting them in a format that should facilitate
discussion among OHS professionals. It is considered ‘version 1’ in what should be a stimulating and
ongoing discussion. It is anticipated that this chapter will be reviewed in the next 12 months.

OHS Body of Knowledge
Models of Causation: Safety

April, 2012

Contents

1

Introduction................................................................................................................1

2

Historical context .......................................................................................................2

3

Evolution of models of accident causation ..................................................................3
3.1

Simple sequential linear accident models .............................................................4

3.2

Complex linear models ........................................................................................7

3.3

Complex non linear accident models .................................................................. 16

4

Implications for OHS practice .................................................................................. 19

5

Summary.................................................................................................................. 21

References ....................................................................................................................... 21

OHS Body of Knowledge
Models of Causation: Safety

April, 2012

OHS Body of Knowledge
Models of Causation: Safety

April, 2012

1

Introduction

Accidents have been broadly defined as:
a short, sudden and unexpected event or occurrence that results in an unwanted and undesirable
outcome … and must directly or indirectly be the result of human activity rather than a natural
event’. (Hollnagel, 2004, p. 5)

Accident prevention is the most basic of all safety management paradigms. If safety
management is effective, then there should be an absence of accidents. Conversely, if
accidents are occurring then effective safety management must be absent. Therefore,
understanding how accidents occur is fundamental to establishing interventions to prevent
their occurrence. A simple nexus it would seem, yet the reality is accidents are complex
events, seldom the result of a single failure, and that complexity has made understanding
how accidents occur problematic since the dawn of the industrial revolution.
In an attempt to unravel the accident causation mystery, over the years authors have
developed a plethora of conceptual models. At first glance they appear to be as diverse and
disparate as the accident problem they purport to help solve, yet closer scrutiny reveals
there are some common themes. There are linear models which suggest one factor leads to
the next and to the next leading up to the accident, and complex non linear models which
hypothesise multiple factors are acting concurrently and by their combined influence, lead
to accident occurrence. Some models have strengths in aiding understanding how accidents
occur in theory. Others are useful for supporting accident investigations, to systematically
analyse an accident in order to gain understanding of the causal factors so that effective
corrective actions can be determined and applied.
Accident models affect the way people think about safety, how they identify and analyse risk factors
and how they measure performance … they can be used in both reactive and proactive safety
management … and many models are based on an idea of causality ... accidents are thus the result of
technical failures, human errors or organisational problems. Hovden, Albrechtsen and Herrera,
2010, p.855).

This chapter builds on the discussion of hazard as a concept1 to trace the evolution of
thinking about accident causation through the models developed over time thus it forms a
vital foundation for developing the conceptual framework identified as an essential
component of professional OHS practice2. The importance of models of causation to OHS
professional practice is highlighted by Kletz:
To an outsider it might appear that industrial accidents occur because we do not know how to
prevent them. In fact, they occur because we do not use the knowledge that is available.
Organisations do not learn from the past …and the organisation as a whole forgets. (1993.)

1
2

See OHS BoK Hazard as a Concept
See OHS BoK Practice: Model of OHS Practice

OHS Body of Knowledge
Models of Causation: Safety

Page 1 of 35
April, 2012

2

Historical context

Perhaps the earliest well documented application of accident causation knowledge is that
of the Du Pont company which was founded in 1802 with a strong emphasis on accident
prevention and mitigation. Klein (2009), in a paper entitled “Two Centuries of Process
Safety at DuPont” reported that the company founder E.I. Du Pont (1772 – 1834) had once
noted “we must seek to understand the hazards we live with”. The design and operation of
Du Pont explosives factories, over the next 120 years, were gradually improved as a result
of a consistent effort to understand how catastrophic explosions were caused and
prevented. In that period many of the principles of modern accident prevention theory were
formulated. By 1891 management accountability for safe operations was identified as a
necessary precept to such an extent that the original Du Pont plant design included a
requirement for the Director’s house, in which Du Pont himself, his wife and seven
children lived, to be constructed within the plant precinct, a powerful incentive indeed to
gain an understanding of accident causation. As described by DeBlois (1915), the first
head of DuPont’s Safety Division, elimination of hazards was recognised as the priority in
1915 and a goal of zero injuries was also established at that time. Amongst a list of other
safety management initiatives which would still be considered appropriate in today’s
companies’ safety programs, the Du Pont Safety Division was established in their
Engineering Department in 1915 and carried out plant inspections, conducted special
investigations and analysed accidents.
Accident research was also reported as being part of the work of the British Industrial
Health Board between the two World Wars (Surry, 1969). Surry cited Greenwood and
Woods’ (1919) statistical analysis of injuries in a munitions factory and Newbold’s (1926)
study of thirteen factories which also reviewed injuries purported to be the first research
work into industrial accidents. Various other studies around the time (Osborne, Vernon &
Muscio 1922; Vernon 1919;1920; Vernon, Bedford & Warner 1928) examined previously
unresearched areas of working conditions such as humidity, work hours, workers age,
experience and absenteeism rates. Surry also reported that the appearance of applied
psychologists influenced research studies to focus on ‘human output’ and during the 1930s
attention was directed towards the study of individual accident proneness. Surry noted that
“pure accident research declined after 1940 while the study of performance influencing
factors has flourished” (p. 17).
The history of accident modelling itself can be traced back to the original work by Herbert.
W. Heinrich, whose book Industrial Accident Prevention in 1931 became the first major
work on understanding accidents. Heinrich stated that his fundamental principles for
applying science to accident prevention was that it should be: “(1) through the creation and
maintenance of an active interest in safety; (2) be fact finding; and (3) lead to corrective
action based on the facts” (Heinrich, 1931, p. 6). Heinrich’s book, now in its 5th edition,
attempted to understand the sequential factors leading to an accident and heralded in what
can be termed a period of simple sequential linear accident modelling. While sequential

OHS Body of Knowledge
Models of Causation: Safety

Page 2 of 25
April, 2012

linear models offered an easy visual representation of the ‘path’ of causal factor
development leading to an accident they did not escape the widely accepted linear time
aspect of events which is tied into the “Western cultural world-view of past, present and
future as being part of everyday logic, prediction and linear causation” (Buzsáki, 2006, p.
8).

3

Evolution of models of accident causation

The history of accident models to date can be traced from the 1920s through three distinct
phases (Figure 1):
·
·
·

Simple linear models
Complex linear models
Complex non-linear models. (Hollnagel, 2010).

Each type of model is underpinned by specific assumptions:
·

·

·

The simple linear models assume that accidents are the culmination of a series of
events or circumstances which interact sequentially with each other in a linear
fashion and thus accidents are preventable by eliminating one of the causes in the
linear sequence.
Complex linear models are based on the presumption that accidents are a result of a
combination of unsafe acts and latent hazard conditions within the system which
follow a linear path. The factors furthest away from the accident are attributed to
actions of the organisation or environment and factors at the sharp end being where
humans ultimately interact closest to the accident; the resultant assumption being
that accidents could be prevented by focusing on strengthening barriers and
defences.
The new generation of thinking about accident modelling has moved towards
recognising that accident models need to be non-linear; that accidents can be
thought of as resulting from combinations of mutually interacting variables which
occur in real world environments and it is only through understanding the
combination and interaction of these multiple factors that accidents can truly be
understood and prevented. (Hollnagel, 2010).

Figure 1 portrays the temporal development of the three types of model and their
underpinning principle. The types of model, their evolution, together with representative
examples are described in the following sections.

OHS Body of Knowledge
Models of Causation: Safety

Page 3 of 25
April, 2012

Figure 1: Summary of a history of accident modelling (Hollnagel, 2010, slide 7)

3.1

Simple sequential linear accident models

Simple sequential accident models represent the notion that accidents are the culmination
of a series of events which occur in a specific and recognisable order (Hollnagel, 2010) and
now represent the “commonest and earliest model of accident research ... that describing a
temporal sequence” where the “accident is the overall description of a series of events,
decisions and situations culminating in injury or damage .. a chain of multiple events”
(Surry, 1969).

3.1.1 Heinrich’s Domino Theory
The first sequential accident model was the ‘Domino effect’ or ‘Domino theory’ (Heinrich,
1931). The model is based in the assumption that:
the occurrence of a preventable injury is the natural culmination of a series of events or
circumstances, which invariably occur in a fixed or logical order … an accident is merely a link in
the chain. (p. 14).

This model proposed that certain accident factors could be thought of as being lined up
sequentially like dominos. Heinrich proposed that an:
… accident is one of five factors in a sequence that results in an injury … an injury is invariably
caused by an accident and the accident in turn is always the result of the factor that immediately
precedes it. In accident prevention the bull’s eye of the target is in the middle of the sequence – an
unsafe act of a person or a mechanical or physical hazard (p. 13).

Heinrich’s five factors were:

OHS Body of Knowledge
Models of Causation: Safety

Page 4 of 25
April, 2012

·
·
·
·
·

Social environment/ancestry
Fault of the person
Unsafe acts, mechanical and physical hazards
Accident
Injury.

Extending the domino metaphor, an accident was considered to occur when one of the
dominos or accident factors falls and has an ongoing knock-down effect ultimately
resulting in an accident (Figure 2).

Figure 2: Domino model of accident causation (modified from Heinrich, 1931)

Based on the domino model, accidents could be prevented by removing one of the factors
and so interrupting the knockdown effect. Heinrich proposed that unsafe acts and
mechanical hazards constituted the central factor in the accident sequence and that removal
of this central factor made the preceding factors ineffective. He focused on the human
factor, which he termed “Man Failure”, as the cause of most accidents. Giving credence to
this proposal, actuarial analysis of 75,000 insurance claims attributed some 88% of
preventable accidents to unsafe acts of persons and 10% to unsafe mechanical or physical
conditions, with the last 2% being acknowledged as being unpreventable giving rise to
Heinrich’s chart of direct and proximate causes (Heinrich, 1931, p.19). (Figure 3)

OHS Body of Knowledge
Models of Causation: Safety

Page 5 of 25
April, 2012

Figure 3: Direct and proximate accident causes according to Heinrich (1931)

3.1.2 Bird and Germain’s Loss Causation model
The sequential domino representation was continued by Bird and Germain (1985) who
acknowledged that the Heinrich’s domino sequence had underpinned safety thinking for
over 30 years. They recognised the need for management to prevent and control accidents
in what were fast becoming highly complex situations due to the advances in technology.
They developed an updated domino model which they considered reflected the direct
management relationship with the causes and effects of accident loss and incorporated
arrows to show the multi-linear interactions of the cause and effect sequence. This model
became known as the Loss Causation Model and was again represented by a line of five
dominos, linked to each other in a linear sequence (Figure 4).

OHS Body of Knowledge
Models of Causation: Safety

Page 6 of 25
April, 2012

Figure 4: The International Loss Control Institute Loss Causation Model (modified
from Bird and Germaine, 1985)

3.2

Complex linear models

Sequential models were attractive as they encouraged thinking around causal series. They
focus on the view that accidents happen in a linear way where A leads to B which leads to
C and examine the chain of events between multiple causal factors displayed in a sequence
usually from left to right. Accident prevention methods developed from these sequential
models focus on finding the root causes and eliminating them, or putting in place barriers
to encapsulate the causes. Sequential accident models were still being developed in the
1970’s but had begun to incorporate multiple events in the sequential path. Key models
developed in this evolutionary period include energy damage models, time sequence
models, epidemiological models and systemic models.

3.2.1 Energy-damage models
The initial statement of the concept of energy damage in the literature is often attributed to
Gibson (1961) but Viner (1991, p.36) understands it to be a result of discussions between
Gibson, Haddon and others. The energy damage model (figure 5) is based on the
supposition that “Damage (injury) is a result of an incident energy whose intensity at the
point of contact with the recipient exceeds the damage threshold of the recipient” (Viner,
1991, p42).

OHS Body of Knowledge
Models of Causation: Safety

Page 7 of 25
April, 2012

Figure 5: The Energy Damage Model (Viner, 1991, p.43)

In the Energy Damage Model the hazard is a source of potentially damaging energy and an
accident, injury or damage may result from the loss of control of the energy when there is a
failure of the hazard control mechanism. These mechanisms may include physical or
structural containment, barriers, processes and procedures. The space transfer mechanism
is the means by which the energy and the recipient are brought together assuming that they
are initially remote from each other. The recipient boundary is the surface that is exposed
and susceptible to the energy. (Viner, 1991)

3.2.2 Time sequence models
Benner (1975) identified four issues which were not addressed in the basic domino type
model: (1) the need to define a beginning and end to an accident; (2) the need to represent
the events that happened on a sequential time line; (3) the need for a structured method for
discovering the relevant factors involved; and (4) the need to use a charting method to
define events and conditions. Viner’s Generalised Time Sequence Model is an example of
a time sequence model that addresses Benner’s four requirements. (Figure 6)

OHS Body of Knowledge
Models of Causation: Safety

Page 8 of 25
April, 2012

Figure 6: Generalised Time Sequence Model (Viner, 1991, p.58)

Viner considers that the structure for analysing the events in the occurrence-consequence
sequence provided by the time sequence model draws attention to counter measures that
may not otherwise be evident. In Time Zone 1 there is the opportunity to prevent the event
occurring. Where there is some time between the event initiation and the event, Time Zone
2 offers a warning of the impending existence of an event mechanism and the opportunity
to take steps to reduce the likelihood of the event while in Time Zone 3 there is an
opportunity to influence the outcome and the exposed groups. (Viner, 1991)
While Viner takes a strictly linear approach to the time sequence Svenson (1991; 2001)
takes a more complex approach in his Accident Evolution and Barrier Function (AEB)
model. The AEB model analyses the evolution of an accident as a series of interactions
between human and technical systems and is visualised as a flow chart. Svenson considers
that the required analysis can only be performed with the simultaneous interaction of
human factors and technical experts. (Svenson, 2001)

3.2.3 Epidemiological models
Epidemiological accident models can be traced back to the study of disease epidemics and
the search for causal factors around their development. Gordon (1949) recognised that
“injuries, as distinguished from disease, are equally susceptible to this approach”, meaning

OHS Body of Knowledge
Models of Causation: Safety

Page 9 of 25
April, 2012

that our understanding of accidents would benefit by recognising that accidents are caused
by:
a combination of forces from at least three sources, which are the host – and man is the host of
principal interest – the agent itself, and the environment in which host and agent find themselves (p.
506)

Recognising that doctors had begun to focus on trauma or epidemiological approaches,
engineers on systems, and human factors practitioners on psychology Benner (1975);
considered these as only partial treatments of entire events rather than his proposed entire
sequence of events. Thus Benner contributed to the development of epidemiological
accident modelling which moved away from identifying a few causal factors to
understanding how multiple factors within a system combined. These models proposed that
an accident combined agents and environmental factors which influence a host
environment (like an epidemic) that have negative effects on the organism (a.k.a.
organisation). See for example Figure 7.

Figure 7: A generic epidemiological model (modified from Hollnagel, 2004, p.57)

Reason (1987) adopted the epidemiological metaphor in presenting the idea of ‘resident
pathogens’ when emphasising:
the significance of causal factors present in the system before an accident sequence actually begins
… and all man-made systems contain potentially destructive agencies, like the pathogens within the
human body (1987, p.197).

OHS Body of Knowledge
Models of Causation: Safety

Page 10 of 25
April, 2012

The term became more widely known as ‘latent errors’, then changed to ‘latent failures’
evolving further when the term ‘latent conditions’ became preferred (Reason, 1997).
Accident prevention methods matching an epidemiological accident model focus on
performance deviations and understanding the latent causes of the accident. These causes
might be found in deviations or unsafe acts and their suppression or elimination can
prevent the accident happening again. Errors and deviations are usually seen by OHS
professionals in a negative context, and programs such as ‘safe behaviour’ methodologies
attempt to ensure that strict rules and procedures are always followed. However safety
prevention thinking is moving to an understanding that systems should be resilient enough
to withstand deviations or uncommon actions without negative results.

3.2.4 Systemic models
By the 1980s OHS researchers realised that previous accident models did not reflect any
realism as to the true nature of the observed accident phenomenon. As noted by Benner:
one element of realism was non-linearity … models had to accommodate non-linear events. Based
on these observations, a realistic accident model must reflect both a sequential and concurrent nonlinear course of events, and reflect events interactions over time (1984, p. 177).

This was supported by Rasmussen (1990) who, whilst quoting Reason’s (1990) resident
pathogens, acknowledged that the identification of events and causal factors in an accident
are not isolated but “depend on the context of human needs and experience in which they
occur and by definition ... therefore will be circular” (p. 451).
Systemic accident models which examined the idea that systems failures, rather than just
human failure, were a major contributor to accidents (Hollnagel, 2004) began to address
some of these issues (but not non-linear concepts) and recognised that events do not
happen in isolation of the systemic environment in which they occur.
Accident models also developed with further understanding of the role of humans, and in
particular the contribution of human error, to safety research. A skill-rule-knowledge
model of human error was developed in the earlier work of Rasmussen & Jensen (1974)
and has remained a foundation concept for understanding of how human error can be
described and analysed in accident investigation. Research by Rouse (1981) contributed to
the understanding of human memory coding, storage and retrieval. Cognitive science came
to the fore in accident research, and further work by Rasmussen (1981; 1986) and Reason
(1979; 1984a; 1984b; 1984c) saw the widespread acceptance and recognition of the skillbased, rule-based and knowledge-based distinctions of human error in operations.
Rasmussen (1990) wrote extensively on the problem of causality in the analysis of
accidents introducing concepts gleaned from philosophy on the linkage between direct

OHS Body of Knowledge
Models of Causation: Safety

Page 11 of 25
April, 2012

cause-effect, time line and accident modelling. Rasmussen explored the struggle to
decompose real world events and objects, and explain them in a causal path found
upstream from the actual accident where latent effects lie dormant from earlier events or
acts. At this stage, Rasmussen recognised that socio-technical systems3 were both complex
and unstable. Any attempt to discuss a flow of events does not take into account:
closed loops of interaction among events and conditions at a higher level of individual and
organizational adaption … with the causal tree found by an accident analysis is only a record of one
past case, not a model of the involved relational structure” (1990, p. 454).

In calling for a new approach to the analysis of causal connections found in accident
reports Rasmussen heralded in a more complex approach to graphically displaying
accidents and understanding and capturing the temporal, complex system and events
surrounding accident causation.
Reason’s early work in the field of psychological error mechanisms (Reason 1975; 1976;
1979) was important in this discussion on complexity of accident causation. By analysing
everyday slips and lapses he developed models of human error mechanisms (Rasmussen
1982). Reason (1990) went on to address the issue of two kinds of errors: active errors and
latent errors. Active errors were those “where the effect is felt almost immediately” and
latent errors “tended to lie dormant in the system largely undetected until they combined
with other factors to breach system defences” (p. 173). Reason, unlike Heinrich (1931) and
Bird and Germain (1985) before him, accepted that accidents were not solely due to
individual operator error (active errors) but lay in the wider systemic organisational factors
(latent conditions) in the upper levels of the organisation. Reason’s model is commonly
known as the Swiss Cheese Model (see Figure 6).

Figure 6: Reason’s ‘Swiss Cheese’ Model (modified from Reason, 2008 p.102)
3

See OHS BoK Systems for a discussion on socio-technical systems.

OHS Body of Knowledge
Models of Causation: Safety

Page 12 of 25
April, 2012

Unlike the modelling work of Heinrich (1931) and Bird and Germain (1985), Reason did
not specify what these holes represented or what the various layers of cheese represented.
The model left the OHS professional to their own investigations as to what factors within
the organisation these items might be.
The “Swiss Cheese” model was only one component of a more comprehensive model he
titled the Reason Model of Systems Safety (Reason 1997) (Figure 7).

Figure 7: The Reason Model of System Safety (Reason, 1997)

Reason had a major impact on OHS thinking and accident causation in that he moved the
focus of investigations from blaming the individual to a no-blame investigation approach;
from a person approach to a systems approach; from active to latent errors; and he focused
on hazards, defences and losses. Reason’s Swiss Cheese and Systems Safety models were
an attempt to reflect these changes.

OHS Body of Knowledge
Models of Causation: Safety

Page 13 of 25
April, 2012

To understand the role of James Reason in changing the thinking about accidents it is
important to see his work in the historical context that his work followed closely the
accepted work of Rasmussen on human error (see Rasmussen, 1982) and Reason’s 1987
work in this area gave him initial credibility in the safety arena. However, by 1997 he
wanted accident investigation to move away from blaming the individual at the sharp end
of the system towards a no-blame approach, as had been an underpinning tenet of
professional air safety investigators for many years (ICAO 1970 & USNSC 1973).4 In
focusing on hazards, defences and losses Reason (1997) wanted to convey the message that
organisational accidents were a result of a failure to recognise the hazards in the system
and the need to establish a variety of defences to prevent their adverse effects. The holes in
the Swiss cheese represented a lack of strong, air-tight defences which ultimately let the
accident sequence happen. Reason continued to discuss human error, but from an error
management perspective, requiring organisations to again put in place barriers for errors
rather than trying to eradicate them as he recognised total eradication as an impossible
task.
These models, whilst becoming highly recognisable and favoured, were criticised for a
number of reasons including their lack of definition of what the holes in the barriers
represented.
[T]he Reason model, in its current form, fails to provide the detailed linkages from individual to
task/environment to organization beyond a general framework of line management deficiencies and
psychological precursors of unsafe acts” (Luxhøj & Maurino, 2001, p. 1).

Also, the model did not allow for the variation in organisational and individual working:
Reason’s model shows a static view of the organisation; whereas the defects are often transient, i.e.
the holes in the Swiss cheese are continuously moving … the whole socio-technical system is more
dynamic than the model suggests (Qureshi, 2007,"Epidemiological Accident Models" par.2)

While Reason’s models achieved a change in thinking about accidents recognising the
complexity of causation he was also part of the move away from the heavy human error
emphasis (Reason, 1990) towards a no blame or “just culture” approach (Reason, 1997).
The “just culture” approach recognised that human error was not only a normal operating
mode but a normal occurrence allowing humans to learn as part of their natural path of
development and function. Woods, Johannesen, Cook & Sarter (1994) describe this
scenario as “latent failures [that] refer to problems in a system that produce a negative
effect but whose consequences are not revealed or activated until some other enabling
condition is met” (p. 19). By recognising that latent conditions require a trigger in the form
of an interaction, usually with a human, it can be seen that the study of humans in the
accident trajectory moves away from what the human did wrong to the study of normal
4

While this has now largely been accepted across industry, the recent emergence of the criminalisation of
aircraft accidents has the real potential to undermine the effort and adversely impact the successful
investigation of future accidents (Michaelidis and Mateou, 2010; Trogeler, 2010; Gates and Partners, 2011).

OHS Body of Knowledge
Models of Causation: Safety

Page 14 of 25
April, 2012

human behaviour and decision making based on the environment in which they are
functioning and the knowledge and technology available for decision making at the time.
The study of humans in the system moves from the individual to groups of individuals
embedded in a larger system (Woods et al 1994). This is represented in Woods et al.,
depiction of the sharp and blunt end of large, complex systems (Figure 8.)

Figure 8: The sharp and blunt ends of a large complex system (Woods et al., 1994)

In 1984 Purswell and Rumar reviewed the progress of accident research in recent decades
and in particular accident modelling. They noted the continuing discussion around the
suitability of one accident model over another with the resolution that at this time “no
universally accepted approach which is unique to occupational accident research” had yet
emerged. They cautioned against the apparent dangers of trying to obtain uniformity in the
methodology of accident investigation with the dilemma being “the prospect of the model
driving the problem definition, rather than the problem generating the appropriate model to
be used” (p. 224). This observation and concern was still appropriate a decade later.

OHS Body of Knowledge
Models of Causation: Safety

Page 15 of 25
April, 2012

3.3

Complex non linear accident models

As shown in Figure 1 there has been considerable overlap in the development of the
various conceptual approaches to accident causation. In parallel with the development of
thinking around epidemiological models and systemic models the thinking around the
complexity of accident causation led to non complex linear models. Key researchers in this
approach have been Perrow, Leveson and Holnagel. The implications of recent discussions
on complexity and ‘drift’ are briefly considered.
In the early 1980s Perrow began to argue that technological advances had made systems
not only tightly coupled but inheritably complex, so much so that he termed accidents in
these systems as being “normal”. Perrow’s normal accident theory postulated that tightly
coupled systems had little tolerance for even the slightest disturbance which would result
in unfavourable outcomes. Thus tightly coupled systems were so inherently unsafe that
operator error was unavoidable due the way the system parts were tightly coupled.
(Perrow, 1984) Components in the system were linked through multiple channels, which
would affect each other unexpectedly, and with the complexity of the system meaning that
it was almost impossible to understand it (Perrow, 1984; Tenner, 1996).
Two new major accident models were introduced in the early 2000s with the intention of
addressing problems with linear accident models (Hovden, et al., 2009):
·
·

The Systems-Theoretic Accident Model and Process (STAMP) (see Leveson,
2004).
The Functional Resonance Accident Model (FRAM) (see Hollnagel, 2004)

3.3.1 Systems-Theoretic Accident Model and Process (STAMP)
Leveson’s model considered systems as “interrelated components that are kept in a state of
dynamic equilibrium by feedback loops of information and control” (2004, p. 250). It
emphasised that safety management systems were required to continuously control tasks
and impose constraints to ensure system safety. This model of accident investigation
focused on why the controls that were in place failed to detect or prevent changes that
ultimately lead to an accident. Leveson developed a classification of flaws method to assist
in identifying the factors which contributed to the event, and which pointed to their place
within a looped and linked system. Leveson’s model expands on the barriers and defences
approach to accident prevention and is tailored to proactive and leading safety performance
indicators (Hovden, et al., 2009). However this model has had little up take in the safety
community and is not widely recognised as having a major impact on accident modelling
or safety management generally. Roelen, Lin and Hale (2010, p.6) suggest that this may be

OHS Body of Knowledge
Models of Causation: Safety

Page 16 of 25
April, 2012

because Leveson’s model does “not connect to the current practice of safety data collection
and analysis” making it less favourable than event chain models such as Reason’s.

3.3.2 Functional Resonance Accident Model (FRAM)
Erik Holnagel is one of the more forward thinking researchers in the area of accident
modelling and the understanding of causal factors. While Hollnagel’s early published work
(Cacciabue & Hollnagel 1995; Hollnagel 1993; 1998) centred on human/cognitive
reliability and human/machine interface his more recent work Barriers and Accident
Prevention (2004) challenged current thinking about accident modelling. He introduced the
concept of a three dimensional way of thinking about accidents in what is now known to be
highly complex and tightly coupled socio-technical systems in which people work. He
describes systemic models as tightly coupled and the goals of organisations as moving
from putting in place barriers and defences to focusing on systems able to monitor and
control any variances, and perhaps by allowing the systems to be (human) error tolerant.
Hollnagel’s Functional Resonance Accident Model (FRAM) (Figure 9), is the first attempt
to place accident modelling in a three-dimensional picture, moving away from the linear
sequential models, recognising that “forces (being humans, technology, latent conditions,
barriers) do not simply combine linearly thereby leading to an incident or accident”
(Hollnagel, 2004, p. 171).
FRAM is based on complex systemic accident theory but considers that system variances
and tolerances result in an accident when the system is unable to tolerate such variances in
its normal operating mode. Safety system variance is recognised as normal within most
systems, and represents the necessary variable performance needed for complex systems to
operate, including limitations of design, imperfections of technology, work conditions and
combinations of inputs which generally allowed the system to work. Humans and the
social systems in which they work also represent variability in the system with particular
emphasis on the human having to adjust and manage demands on time and efficiency (p.
168).
Hollnagel’s (2005) theory of efficiency-thoroughness trade-off (ETTO) expanded on these
demands on the humans, where efficiency was often given more priority to thoroughness
and vice versa. Hollnagel recognised that complex systems comprise a large number of
subsystems and components with performance variability usually being absorbed within
the system with little negative effect on the whole. Four main sources of variability were
identified as:
·
·
·

Humans
Technology
Latent conditions

OHS Body of Knowledge
Models of Causation: Safety

Page 17 of 25
April, 2012

·

Barriers (p. 171).

Holnagel proposed that when variables within the system became too great for the system
to absorb them; possibly through a combination of these subsystem variables of humans,
technology, latent conditions and barriers; the result will be undetectable and unwanted
outcomes. That is a ‘functional resonance’ results, leading to the system being unable to
cope in its normal functioning mode. (Figure 9)

Figure 9: Functional Resonance as a System Accident Model (Holnagel, 2004)

Hollnagel’s FRAM model presents a view of how different functions within an
organisation were linked or coupled to other functions with the objective of understanding
the variability of each of the functions, and how that variability could be both understood
and managed. The functions are categorised as inputs, outputs, preconditions, resources,
time and control. Variability in one function can also affect the variability of other
functions (p. 173). In 2010 Hollnagel launched a web site in support of the growing cohort
of researchers and OHS professionals interested in using the model as a tool for
understanding and managing accidents and incidents. While the Functional Resonance
Accident Model provided a theoretical basis for thinking about accident causation
Hollnagel clearly differentiated between models that aided thinking about accident
causation and methods of analysing accidents as part of investigations. The Functional

OHS Body of Knowledge
Models of Causation: Safety

Page 18 of 25
April, 2012

Resonance Analysis Method evolved from the conceptual thinking embodied in the model
which was highlighted by retaining the FRAM acronym. A detailed description of the
method is given in Sundstrom & Hollnagel (2011). .

3.3.3 Complexity and accident modelling
While the FRAM model begins to address complexity of organisation and the relationship
with accident causation Dekker (2011) takes the discussion of complexity further to
challenge the notion of accident modelling and the predictive ability of accident models. In
describing complexity of society and technology Dekker considers that:
The growth of complexity in society has got ahead of our understanding of how complex systems
work and fail. Our technologies have got ahead of our theories. Our theories are still fundamentally
reductionist, componential and linear. Our technologies, however are increasingly complex
emergent and non-linear. Or they get released into environments that make them complex, emergent
and non-linear. (2011, p.169)

Accidents occur in these complex systems by a “drift into failure” which occurs through a
slow but steady adaptive process where micro-level behaviours produce new patterns
which become embedded and then in turn are subject to further change. Dekker’s position
is that as there are no well-developed theories for understanding how such complexity
develops and the general response is to apply simple, linear ideas in the expectation that
they will assist in understanding causation (p.6). He considers the search for the “broken
and part or person” that underpins linear models where risk is considered in terms of
energy-to-be-contained, barriers and layers of defence, or cause and effect are misleading
because they assume rational decision-making (p.2).
Where does this leave the OHS professional wanting to understand accident causation and
seeking a conceptual framework to inform prevention and investigation activities?

4

Implications for OHS practice

In 2010, Hovden, Albrechtsen & Herrera observed that:
… technologies, knowledge, organisations, people, values, and so on are all subject to change in a
changing society. Nonetheless, when it comes to occupational accident prevention most experts and
practitioners still believe in the domino model and the iceberg metaphor. (p. 953)

If this is currently the case in Australia then a lack of awareness of the development of
thinking about accident causation and the application of models of causation may be
inhibiting the development of effective prevention strategies as:
Merely identifying a proximate cause as the ‘‘root cause” may, however, lead to the elimination of
symptoms without much impact on the prospect of reducing future accidents (Marais et al., 2004;
Leveson, 2004). In order to identify systemic causes, one may need to supplement with models

OHS Body of Knowledge
Models of Causation: Safety

Page 19 of 25
April, 2012

representing alternative mindsets in order to spark the imagination and creativity required to solve
the accident risk problem. (Hovden et al., 2010, p. 954)

The Model of OHS Practice5 highlights the role of a conceptual framework in
underpinning professional practice. An understanding of the evolution of accident, or
occurrence, modelling is vital grounding for the OHS professional in developing their
conceptual framework or mental model of accident causation. This chapter has considered
a number of models for causation of accidents but which on initial reading may leave the
OHS professional asking “Are models useful?” and ‘So which model?’.
Hovden et al., (2010) put this discussion into perspective for the OHS professional. While
recognising that today’s organisations are dynamic socio-technical systems characterised
by increased complexity, working life at the sharp end has, with some exceptions, largely
remained unaltered. They argue that there is little need for new models for the sake of
understanding the direct causes of accidents in daily work life but these basic models
should be enriched by the theories and models developed for high-risk socio-technical
systems. Thus, in developing their mental model the OHS professional should be aware of
a range of models of causation and be able to critically evaluate the model for application
to their practice. This evaluation should address the question of currency verses best
practice. The more recent the model does not necessarily imply better practice. Section
3.3.1 noted that the STAMP model has not received broad acceptance while, in some
industries, the Swiss Cheese model is still considered best practice 22 years after its
introduction. The OHS professional investigating a workplace accident may be informed
by discussions on complexity but may find that the energy damage model or the swiss
cheese models is more informative for the particular situation. The OHS professional must
also work within the environment of the organisation and the limitations that that brings.
As noted by Roelen, Lin & Hale (2011) one of the problems with the advanced models of
causation including complexity factors is that they do not connect with current practices in
safety data collection and analysis (p.6). In applying a particular model the OHS
professional also needs to be able to differentiate between what actually occurs in the
workplace with that which should happen.
The OHS professional should differentiate between the model and methods that may or
may not be underpinned by theoretical models. For example sequential models inform
some of traditional forms of accident analysis such as events trees, fault trees and critical
path models. The Incident Cause Analysis Method (ICAM) of investigation was developed
from Reason’s Swiss Cheese model. Holnagel’s Functional Resonance Analysis Method is
clearly underpinned by the Functional Resonance Accident Model.

5

See OHS BoK Practice: Model of OHS Practice

OHS Body of Knowledge
Models of Causation: Safety

Page 20 of 25
April, 2012

5

Summary

Hovden et al., provide six uses for accident causation models:
-

Create a common understanding of accident phenomena through a shared simplified representation
of real-life accidents.
Help structure and communicate risk problems.
Give a basis for inter-subjectivity, thus preventing personal biases regarding accident causation and
providing an opening for a wider range of preventive measures.
Guide investigations regarding data collection and accident analyses.
Help analyse interrelations between factors and conditions.
Different accident models highlight different aspects of processes, conditions and causes. (p.955)

Accidents are complex events and that complexity has made understanding how accidents
occur problematic. Beginning in the 1930s there has been an evolution in thinking about
accident causation. While there has been significant overlap in the development phases,
and a number of the models have enduring application in certain circumstances. The
evolution has progressed from simplistic ‘domino models’ that focus on the behaviour of
individuals through more complex linear models that consider the time sequence of event
analysis, ‘epidemiological’ models, to systemic models that consider barriers and defences.
With greater recognition of the complexity of causation of accidents newer recent models
became complex and non-linear.
While recent discussions on complexity and ‘drift’ have been interpreted by some as
casting doubt on the usefulness of models of accident causation, the reality of OHS
professional practice is that understanding accident causation is central to effective OHS
practice. The learning and understanding about accident causation engendered by an
awareness of the evolution in thinking about causation and with these models leads to the
establishment of effective preventive methods and systemic defences and the ability to
effectively respond to those which do occur. Failure to understand accident causation leads
to degradation of preventive mechanisms and accident occurrence or recurrence.

References
Benner, L. (1975). Accident Investigations: Multilinear Events Sequencing Methods.
Journal of Safety Research, 7(2), 67-73.
Benner, L. (1984). Accident models: How underlying differences affect workplace safety.
Paper presented at the International Seminar on Occupational Accident Research,
Saltjobaden: Sweden.
Bird, F. E. J., &Germain, G. L. (1985).Practical Loss Control Leadership. Loganville,
Georgia: International Loss Control Institute, Inc.
Buzsáki, G. (2006). Rhythms of the Brain. New York: Oxford University Press.

OHS Body of Knowledge
Models of Causation: Safety

Page 21 of 25
April, 2012

Cacciabue, P. C., Holnagel, E. (1995). Simulation of Cognition: Applications. In J.M. Hoc,
P.D. Cachiabue & E. Holnagel, (Eds.), Expertise and Technology, New Jersey:
Lawrence Erlbaum and Associates.
DeBlois, L. A. (1915), The Application of Safety Devices, Hagley Museum and Library,
Wilmington, DE
Dekker, S. (2011). Drift into Failure: From Hunting Broken Components to Understanding
Complex Systems. Surry: Ashgate.
Gates and Partners (2011), Aviation and the Implications of Criminalisation, Gates and
Partners Solicitors, http://alae.org/downloads/legal/accidents.pdf
Gibson, J.J. (1961). The contribution of experimental psychology to the formulation of the
problem of safety – a brief for basic research, in Jacobs, H.H. et al., Behavioural
Approaches to Accident Research, New York Association for the aid of crippled
children.
Gordon, J. E. (1949). The epidemiology of accidents. American Journal of Public Health,
39, 504-515.
Greenwood, M., Woods, H. M. (1919). A report on the incidence of industrial accidents
upon individuals with special reference to multiple accidents. British Industrial
Fatigue Research Board.
Heinrich, H. W. (1931). Industrial Accident Prevention: A scientific approach. New York:
McGraw-Hill.
Hollnagel, E. (1993). Human reliability analysis: Context and control. London: Academic
Press.
Hollnagel, E. (1998). Cognitive reliability and error analysis method: CREAM: Elsevier.
Hollnagel, E. (2004). Barriers and Accident Prevention: Aldershot:Ashgate,.
Hollnagel, E. (2005). The ETTO Principle - Efficiency-Thoroughness Trade Off. Retrieved
from http://www.ida.liu.se/~eriho/ETTO_M.htm
Hollnagel, E. (2010). FRAM Background. Retrieved from
http://sites.google.com/site/erikhollnagel2/coursematerials/FRAM_background.pdf
Hovden, J., Abrechtsen, E., & Herrera, I. A. (2010). Is there a need for new theories,
models and approaches to occupational accident prevention? Safety Science, 48(8),
950-956.
Klein J (2009),Two Centuries of Safety History at DuPont, Process Safety Progress, Vol.
28 Issue 2 pp114 – 122, Wiley Interscience.
Kletz, T. (1993). Lessons from disasters: How organisations have no memory and
accidents recur. Warwickshire: Institution of Chemical Engineers l

OHS Body of Knowledge
Models of Causation: Safety

Page 22 of 25
April, 2012

Leveson, N. (2004). A new accident model for engineering safer systems. Safety Science,
42, 237-270.
Luxhøj, J. T., Maurino, M. (2001). An aviation system risk model (ASRM) case study: Air
Ontario 1363. The Rutgers Scholar, 3.
Michaelidis-Mateou S. and Mateou A. (2010), Flying in the Face of Criminalisation,
Ashgate
Newbold, E. M. (1926). A contribution to the study of the human factor in causation of
accidents. British Industrial Health Research Board.
Osborne, E. E., Vernon, H. M., &Muscio, B. (1922). Two contributions to the study of
accident causation. British Industrial Fatigue Research Board.
Perrow, C. (1984). Normal Accidents: Living with High-Risk Technologies. New York:
Basic Books Inc.
Purswell, J. J., &Rumar, K. (1984). Occupational accident research: Where have we been
and where are we going? Journal of Occupational Accidents, 6, 219-228.
Qureshi, Z. H. (2007). A review of accident modelling approaches for complex sociotechnical systems. Paper presented at the 12th Australian Workshop on Safety Related
Programmable Systems (SCS'07). http://crpit.com/confpapers/CRPITV86Qureshi.pdf
Rasmussen, J. (1981). Models of mental strategies in process plant diagnosis. In J.
Rasmussen & W. Rouse (Eds.), Human Detection and Diagnosis of System Failures.
New York: Planum.
Rasmussen, J. (1982). Human errors: A taxonomy for describing human malfunction in
industrial installations. Journal of Occupational Accidents, 4(311-335).
Rasmussen, J. (1986). Information Processing and Human-Machine Interaction.
Amsterdam: North-Holland.
Rasmussen, J. (1990). Human error and the problem of causality in analaysis of accidents.
Paper presented at the Human Factors in Hazardous Situations. Proceedings of a
Royal Society Discussion Meeting.
Rasmussen, J., Jensen, A. (1974). Mental procedures in real-life tasks: A case study of
electronic troubleshooting. Ergonomics, 17, 193-307.
Reason, J. T. (1975). How did I come to do that? New Behaviour, 24.
Reason, J. T. (1976).Absent minds.New Society, 4(November).
Reason, J. T. (1979). Actions not as planned: The price of automatization. In G.
Underwood & R. Stevens (Eds.), Aspects of Consciousness (Vol. 1). London: Wiley.
Reason, J. T. (1984a).Lapses of attention.In R. Parasuraman& R. Davies (Eds.), Varieties
of Attention. New York: Academic Press.

OHS Body of Knowledge
Models of Causation: Safety

Page 23 of 25
April, 2012

Reason, J. T. (1984b).Absent-mindedness and cognitive control.In J. Harris & P. Morris
(Eds.), Everyday Memory, Actions and Absent-Mindedness. London: Academic Press.
Reason, J. T. (1984c).Order of output in category generation. Paper presented at the
Cognitive Section, British Psychological Society, Oxford.
Reason, J. T. (1987).The Chernobyl Errors. Bulletin of the British Psychological Society,
40, 201-206.
Reason, J. T. (1990).Human Error. Aldershot: Ashgate.
Reason, J. T. (1997).Managing the Risks of Organisational Accidents. Aldershot: Ashgate.
Reason, J.T. (2008). The Human Contribution: Unsafe Acts, Accidents and Heroic
Recoveries. Surrey: Ashgate.
Roelen, A. L. C., Lin, P. H., & Hale, A. R. (2011). Accident models and organisational
factors in air transport: The need for multi-method models. Safety Science, 49, 5-10.
Rouse, W. B. (1981). Models of human problem solving: Detection, diagnosis and
compensation for system failures. Paper presented at the Proceedings of IFAC
Conference on Analysis, Design and Evaluation of Man-Machine Systems., BadenBaden, FRG.
Sundstrom, G.H., Hollnagel, E. (2011). The Importance of Functional Interdependence in
Financial Services Systems. In E. Hollnagel, J Pariés & D.D. Woods (Eds.), Resilience
Engineering in Practice: A Guide Book. Ashgate.
Surry, J. (1969). Industrial Accident Research: A Human Engineering Appraisal. Toronto,
Ontario: Labour Safety Council, Ontario Department of Labour.
Svenson, O. (1991). The accident evolution and barrier function (AEB) model applied to
incident analysis in the processing industries. Risk Analysis, 11(3), 499-507.
Svenson, O. (2001). Accident and incident analysis based on accident evolution and barrier
function (AEB) model. Cognition, Technology & Work, 3(1), 42-52.
Tenner, E. (1996). Why things bite back. London: Fourth Estate Limited.
Trogeler M. (2010), Criminalisation of air accidents and the creation of a Just Culture,
European Air Law Association,
http://www.eala.aero/library/Mildred%20Trgeler%20EALA%20prize.pdf
Vernon, H. M. (1919). The influence of hours of work and of ventilation on output in
tinplate manufacturing. British Industrial Fatigue Research Board.
Vernon, H. M. (1920). Fatigue and efficiency in the iron and steel industry. British
Industrial Fatigue Research Board.
Vernon, H. M., Bedford, T., & Warner, C. G. (1928). A study of absenteeism in a group of
10 collieries. British Industrial Fatigue Research Board.

OHS Body of Knowledge
Models of Causation: Safety

Page 24 of 25
April, 2012

Viner, D. (1991), Accident analysis and risk control, Derek Viner Pty Ltd, Melbourne.
Woods, D. D., Johannesen, L. J., Cook, R. I., &Sarter, N. B. (1994). Behind Human Error:
Cognitive Systems, Computers, and Hindsight. Dayton, Ohio;Dayton University
Research Institute.

OHS Body of Knowledge
Models of Causation: Safety

Page 25 of 25
April, 2012

Sponsor Documents

Recommended

No recommend documents

Or use your account on DocShare.tips

Hide

Forgot your password?

Or register your new account on DocShare.tips

Hide

Lost your password? Please enter your email address. You will receive a link to create a new password.

Back to log-in

Close