accident analyses and work analyses

Jvwnal of O&~~patjQ~~~ Accidents, 1 (1978) 331-340 331 o Elsevier Scientific Publishing Company, Amsterdam - Printed in The Netherlands

ACCIDENT ANALYSES AND WORK ANALYSES

ABSTRACT

Leplat, J., 1978. Accident analyses and work analyses. Journal of Occupational Accidents. 1: 331-340.

The methods of systematic accident analysis are based upon hypotheses which must be made expiieit if progress in these methods IS to be made. Starting from the example of a method proposed by the fnstitut National de Recherche et de §&urit6 (France) which is briefly described, the present article selects a number of hypotheses and discusses the relations between a&dent analysis and work analysis. Concerning these relations, the article touches on the problem af the genesis and causation of accidents. The crit.ical analysis which this article develops may easily be transposed into other analyses of the same kind. It points out at the same time the difficulties, but also the great interest, in the systematic study of accident analysis.

1. INTRQDUCTION

An accident, defined as an event injuring the physical integrity of man, might be considered as a symptom of bad relations between man and his living conditions or, more p~t~~~l~~~, his working conditions. We developed this point and its consequences in a study written in collaboration with Cuny (Leptat and Cuny, 1974). If the accident is a symptom, its analysis should give some very useful information about the various forms of malfunctioning that cause it and should therefore enable safety measures to be directed in the most useful way. This is certainly the reason for the many efforts currently undertaken to define the methods of analysis, if possible according to some standards, so as to facilitate the teaching and to support a systematic treatment of the results they make possible (Kravsky et al., 1972; Johnson, 1975; Nielsen, 1975; Szekely, 1976).

To andyse the accident means to trace its genesis i.e. to retrace the circumstances of its occurrence. This is a most difficult task because of the complexity of the system of variables into which the accident may enter. Fortu- nately, it is possible to carry out this task at different levels, In most cases we shall limit ourselves to singIing out the most important factors of the

332

genesis. However, the analysis of the accident will always be determined by the analysis of the situation from which the accident occurred. The model of the accident will finally reflect the model of the situation on which it is based.

This article aims to show some aspects of the connection between the two types of analysis. In order to keep the presentation concise as well as factual, we shall use as reference the system of accident analysis proposed by I.N.R.S. (Institut National de la Recherche et de Securite) and presented in several documents (see particularly Kravsky et al., 1972; Merit et al., 1976). We consider, however, that the thoughts presented here and the conclusions they suggest are also valid for other methods of accident analysis.

2. INCIDENT’AL FACTORS ANALYSIS AS A METHOD OF ACCIDENT ANALYSIS

We shall recall here only the general characteristics of this method, exten- sively described in the documents mentioned above. This method is based on the claim that an accident is a result of a sequence of events. It proposes to single out from among them those which are unusual and which are called “incidental factors” - “factors” for short. Examples are:

the accident-stricken worker was a replacement; the machine used was not the usual one, which had broken down; the task was not one normally executed by the operator. All these “factors”, having been previously noted by different authors,

need to be classified and organised. The classification, which we shall not develop further here, is divided into 4 categories: individual, task, equipment, environment.

The marshalling of the factors is shown diagrammatically in Fig. 1 in the form of a tree whose origin is constituted by the accident. The construction is made on the basis of principles which we may briefly outline.

Assuming X and Y are events (factors) to be marshalled, they might be illustrated by Fig. 1.

(1) Event chain

0 X -------)Y 0

This relation indicates that Y will not occur in the absence of X.

(2) Confluence

333

This relation indicates that in the absence of two independent events, X, and X2, Y will not occur. We may also state: no Y without X1, no Y without X2, no Y without X1 and X2.

(3) Branching

This relation indicates that without X, neither YE nor Y2 may occur. SOme authors use a broken line

0 x -- - _ - -+ 0 y to indicate a relation of a probabil-

istic type, which could be defined as follows: “if X had not appeared, Y would have had a lesser chance of occurring”.

In practice, it is not always easy to decide whether or not a relation is of a deterministic type. For instance, can one state with absolute certainty that if the brakes were in good condition, the collision would not have happened? However, this difficulty, which will be spelled out more fully in due course, is not of essential import~ce for the aims of the analysis. These relations can in practice as well as in theory produce errors. The most frequent one, induced by the symbolism 0 x - i , is to interpret the relation in 0 terms of causality and to state that “X is the cause of Y”. It is, however,

onother route gradient

USUUI lorry Replowment I defective iorry I

Fig. 1. Accident diagram.

334

rather different to say “when X is absent, then Y is absent” from “X is the cause of Y”. If we agree with Ullmo (1967) that “causality, in its most general sense, means to attribute events or phenomena to identifiable objects which are capable of producing them” (p. 642), it becomes obvious that the arrow as defined above does not represent a relation of causality, but indicates simply that X is one of the conditions necessary for the occurrence of Y.

Thus in t.he diagram of Fig. 1. “X (insufficient response of brakes) -+ Y (collision with wall)“, X is not the cause of Y in the sense t,hat if X were present., the presence of Y would always result. The brakes can be iI~sufficient and the truck might, not collide with the wall, because a particularly skilful driver, say, would make a manoeuvre to avoid it. X is here only one condition for t,he occurrence of Y. In order to produce Y, X is indeed necessary, but something else is too.

Another way of putting these remarks would be to interpret the arrows linking the factors as expressing a relation of conditional causality: given a specific context determined by X, X leads to Y. The bad condition of the brakes leads to the collision, account being taken of the particular driver concerned, the particular load of the machine and the particular condition of the ground. The factors diagram is drawn for a given accident and what it embodies is relevant only with reference to a global situation which is sup- posed to be known by the investigator but does not appear in the diagram.

Thus the diagram enumerates and marshals all the factors without which the accident would not have occurred, but these are not sufficient to account for the occurrence of the accident. The tree has to be read, as it is constructed, leftwards, and one might ask, moreover, whether the arrows should not be reversed in order to avoid the aforementioned errors. If the tree is read starting from the left (see Fig. 1) it is clear that X does not necessarily lead to Y (strict causality) but is just one of its conditions. Its relation to Y is of a stochast,ic nature when considered with reference to the whole of the situation in which it might be present, but of a deterministic nature (to a first approximation) when considered in relation to the specific situation which is the object of the analysis (therefore an unbroken line).

3. INCIDENTAL FACTORS ANALYSIS AND ANALYSIS OF GENESIS

Since the investigator wants to explain the accident, that is, to determine the circumstances of its occurrence (its genesis) he cannot content himself with the analysis of the factors. Nevertheless we consider - and this is in our view one of its most important qualities - that the analysis of the factors gives an excellent basis for the analysis of the genesis. In fact, owing to the selection of facts it allows initially, the analysis of the factors directs the work of the investigator, reducing from the start its complexity and orienting the studies, which makes it possible to reconstruct the genesis.

The const~ction of the tree of the genesis requires a different definition of the relations linking the events.

335

(1) Event chain

This relation will now be a causal one and should be read as follows: X is necessary and sufficient for the occurrence of Y. Questions of the type “why did Y occur?“, “ what is the cause of Y?” thus become pertinent.

Example: X (temperature of about -5°C) + Y (water of the tank frozen); X {usual lorry defective) -+ Y (replacement lorry).

In fact, these causal relations are just as qualified but the field of their validity can be very wide. Thus the water of the tank will be frozen at -$C, if it has a certain purity; given the work rules of the company., a replacement truck will be used and so on . . .

(2) Confluence

In the same way the definition of confluence is as follows: the simultaneous occurrence of X1 and X, is necessary and sufficient for the occurrence of Y.

This confluence relation, which might combine of course more than 2 eventualities, will be the most frequent one since it is of course rather rare to see a case of strict causality in which the presence of one unique variable provokes the appearance of another.

f3j Branching

The branching relation shall be read as foliows: occurrence of X is necessary and sufficient for the occurrence of Y, and Yz.

L,et us consider for example the diagram of Fig. 1 and the relation X1 (insufficient response of brakes) + Y (collision with wall). The analysis of the genesis leads to the search for other circumstances, the confluence of which provokes collision with the wall, One might find for example:

a continuous wall running alongside the road (X,); the driver is driving a truck of this type for the first time (X,); an old vehicle with dynamic characteristics different from those of the

usual trucks (X,). One would then have the scheme of the confluence illustrated in Fig. 2. In the I.N.R.S. method, the antecedents X2, X3, X4, are catled antecedent

Fig. 2. Scheme of the confhence (see text fax symbols]. Shaded, the two terms of the factors relation.

336

“states”, in order to distinguish them from the antecedent “factors” (Xi in our case).

In the latter case, it will not always be easy - indeed, it may even be very difficult in most cases - to satisfy the requirements necessary for the construction of the diagram, in the sense that all the facts X mentioned (or conditions, or factors) are indeed necessary and sufficient to provoke the occurrence of Y. In the following parts we shall consider the problems arising in

this study. There is another interpretation of the factors relation ‘1 . ’ 0 0

suggested in Fig. 2: “X, is a necessary condition of Y in the situation considered”, that is, in the present case, the situation defined by the simultaneous presence of XZ, X3, X,. With different antecedents, Xi could indeed no longer be a necessary condition.

Important note: According to the definition of the two diagrams, as given here, the factors diagram is a sub-diagram of the genesis diagram. In cases where it is possible to build up “the diagram of events”, of events able to induce a given consequence (through the methods of the so-called “fault-tree analysis”), the diagram of genesis itself would be a sub-diagram of the diagram of events. The genesis that this diagram illustrates is just one of the possible genesis situations of the final accident or incident.

4. WORK ANALYSIS AND ITS RELATION TO THE PRECEDING ANALYSIS

Obviously, it is not possible to analyze the accident, to define its genesis, without referring to a model of the operation of the system which provoked this accident. The procedures of accident analysis are a form of diagnosis that could, as a rule, be defined as the process of identification of a malfunctioning, based on the knowledge of a certain number of symptoms and of the operating rules of the system considered.

If it is a case of failure in a strictly defined system, the diagnosis is then, as a rule, a process perfectly formalisable (Rigney, 1969). In fact, the functioning of the system is perfectly known and does allow us to foresee the consequences of any external or internal change. Reliability studies have

largely used, by the way, these favorable circumstances (Powers and Tomp- kins, 1974; Nielsen, 1975).

When man intervenes in the functioning of the system and has certain functions in it, the analysis becomes more complex, since it is more difficult to determine the modes of functioning of man than those of the technical elements. Let us add that the analysis of accident aims to retrace the genesis, which means that it aims to determine not only the immediate malfunctioning causing the accident but also the malfunctioning lying at the origin of this malfunctioning (Leplat, 1976). In other words, an elaboration of the genesis of the accident should consider this accident with reference to still larger systems.

337

The analysis of the work, particularly, should attempt to set up functional models for these different systems. This analysis does, of course, precede any process of diagnosis. Compared to the simple (in principle) diagnosis of the repair, the diagnosis of the accident will be much more complex, as it is much more difficult to locate and to define the systems considered (man- machine, human organization, socio-technical, etc . . .) and as the conditions of malfunctioning are, in many cases, not well known. The analysis of the work remains, in all these cases, very important, but it is far from being reducible to a technique. It is still based essentially on the competence of the investigator as well as on the employment of good methods. This point was developed elsewhere (Leplat and Cuny, 1977) so we shall not now dwell upon it further, stressing only the necessity of a functional model of the system for any analysis of the genesis.

4.1. Diagram of the genesis and work analysis

It is clear that all the relations entering the genesis tree can only be specified with reference to a model of the work or, more generally, of the system considered. The conditions which are necessary and sufficient to produce a given event can only be determined with reference to a well defined system whose rules of functioning are known. It is this knowledge which can attribute to a subsequent event its necessary character.

The scheme of Fig. 2 shows an example of the situation. In the confluence, knowledge of dynamic properties of vehicles, of the repercussion of these properties on the performance, and of the effects of training, all interfere (often implicitly, as regards the investigator).

The model to which it refers can be more or less elaborated, specified and justified. It is at this stage that the competence of the investigator becomes of paramount importance. Obviously, the more qualified the investigator, the more rewarding will be the analysis of the accident. At the same time, the analysis reveals, as does the genesis of the accident, the nature of this qualification.

Thus it appears that the diagram of the genesis is based on a model of the activity, or, more generally, of the functioning of the system and the diagram can only be as valid as this model. Improving the analysis of the genesis will therefore essentially mean improving the knowledge of the work in its widest sense.

The need for this is not always appreciated by safety specialists who only have a partial view and who look for the sources of malfunction either in the characteristics of man or of his material. If, on the ,other hand, the concept of the accident as a symptom of malfunctioning of the system is ad&ted, it becomes necessary to analyze the functioning of this system wherein particularly human and material elements interact.

338

4.2. Factors diagram and work analysis

The relations which form the basis of the diagram of the factors also necessarily refer to a model of the activity or of the functioning of the system, but this model might seem rather coarse. There is obviously less knowledge needed to find the event without which, in given circumstances, another event would not have occurred, than to define the conditions for the occurrence of the same event.

Let us take the same example once again and consider the two factors “insufficient response of brakes” and “collision with the wall”. Firstly, it appears that in order to identify the factors, a (more or less approximate) model of the work is already needed, so as to estimate their relevance. The same model should make possible the organization of these factors. At this point the investigator, relying on his knowledge of the work, judged that if the brakes had been in good condition, the wall would have been avoided. It is important to insist upon the conditional character of this judgment, which can be put in the following way: given the circumstances in which this accident did occur (the characteristics of the driver, of the material, of the environment), one can estimate that good brakes would have made it possible to avoid the collision.

We can see arising here an additional reason to recommend that the analysis be initiated with identifying and organizing of the factors. The experience of the work, by the investigator or by his interviewers, in fact, makes the realisa- tion of these stages possible. Not all problems can be solved in this way but it allows us to collect most of the essential information and to ask the right questions, which will subsequently direct the analysis of the genesis.

5. CONCLUSIONS

There are some important results we would like to underline at the end of this critical study concerned with the investigation of the links between work analysis and accident analysis.

(1) The relevance of the accident analysis depends upon the relevance of the work analysis on which it is based. Any analysis of an accident is supported - in most cases implicitly - by a model of the work, on which its validity is based. We demonstrated this through the examination of the analysis of factors and genesis. Conversely, it would have been possible to show that certain concepts of work can induce only certain types of accident analysis. A concept of work in terms of rules and standards, for instance, can be induced only by an analysis of accidents in terms of infractions or deviations. Improvement in the analysis of accidents in the sense that the analysis should permit extraction of maximum information from them about the work cannot be obtained without an improved knowledge of the work itself. It is therefore necessary to become better acquainted with the worker, the technical installa- tions, the work place, the organization and their manner of functioning, in

339

short, of all the different systems in which the worker is situated, in order to usefully define the conditions under which accidents occur. It is to this extent that the study of accidents can be related to the more general study of work conditions.

(2) The fact that work analysis plays an essential role in the analysis of accidents should not lead to the conclusion that a good knowledge of the work will automatically enable us to reconstruct with ease the genesis of accidents (in the same way as one might know perfectly well how a machine functions and yet not know very well how to repair it). That is why it is so important to define the systematic methods of reconstructing the genesis of accidents. In nearly all cases, in fact, the work analysis and the analysis of the genesis do interact with one another and each of them can contribute to the enrichment of the other.

(3) The analysis of accidents has a somewhat clinical character. It is based on previous knowledge expressed in the work model used by the investigator. An important problem at this stage is to determine how far these analyses can contribute to the enrichment of this knowledge in terms of safety, the point being to establish the way in which these analyses can be used so as to single out the risk factors or potential risk factors (Darmon et al., 1975), the latter consisting of single factors or of a configuration of factors. Difficult methodological problems appear at this point, whose investigation is currently being planned.

(4) The analysis of accidents poses numerous other problems which cannot be gone into here. We may mention in particular the problem of choosing the unit of analysis. This merits serious study which could be considerably en- lightened if referred to the work analysis and the models underlying it.

(5) A systematisation of the analysis of accidents has therefore the advan- tage of stressing important problems, the efficiency of the analysis relying upon the solution of the problems. However, one should not conclude that these problems are inherent in the systematisation: in fact, they are implied throughout the whole analysis but the coarse character of some of them does hide these problems. The simple report of an accident leaves implicit the questions raised in the present paper but does not eliminate them. As they lead the investigator to consider explicitly the problems of the causes of accidents, the methods of analysis, imperfect as they may still be, both in theory and in practice, do constitute an important step forward and their development should be encouraged. This development will lead not only to an improvement in safety, but also to a better understanding of the work itself and to a higher level of competence on the part of the investigators, both of which are necessary in order to bring about an improvement in the conditions of work in general.

ACKNOWLEDGEMENTS

This research was supported by a grant of the fnstitut National de Recherche et de S&n-it&

340

REFERENCES

Benner, L., 1975. Accident investigations: Multilinear events sequencing methods. J. Safety Research, 7(2): 67-73.

Darmon, M., Monteau, M., Quinot, E., Rohr, D. and Szekely, J., 1975. Les facteurs potentiels d’accidents. Rapport No. 200/RE, Institut National de Recberche et de Securite, 54500 Vandoeuvre, 57 pp.

Johnson, W.G., 1973. Sequences in accident causation. J. Safety Research, 5(2): 54-57. Krawsky, G., Monteau, M. and Cuny, X., 1972. Methods pratique de recherche des

facteurs d’accidents. Rapport 024/RE/A, Institut National de Recherche et de Securite, 54500 Vandoeuvre, 27 pp.

Leplat, J. and Cuny, X., 1974. Les accidents du travail. PUF, Paris. Leplat, J., 1976. Origin of accidents and risk factors. In: Occupational Accident Research.

Arbetarskyddsfonden Stockholm, pp. 146-156. Leplat, J. and Cuny, X., 1977. Introduction a la Psychologie du travail, P.U.F., Coil. SUP,

Paris. Merit, M., Monteau, M. and Szekely, J., 1976. Techniques de gestion de la securiti.

Rapport 243/RE, Institut National de Recherche et de Securite, 54500 Vandoeuvre,

85 PP. Nielsen, D.S., 1975. Use of cause-consequence charts in practical systems analysis. In:

Reliability and Fault-Tree Analysis. SIAM, Philadelphia, pp. 849-880. Powers, G.J. and Tompkins, F.C., 1974. Fault-tree synthesis for chemical processes.

AIChE J., 20(2): 376-387. Rigney, J.W., 1969. Simulation of corrective maintenance behavior. In: La simulation du

comportement humain, Dunod, Paris, pp. 419-428. Uilmo, J., 1967. Les concepts physiques. In: Logique et Connaissance Scientifque,

J. Piaget (Ed.), Encyclopedic de la Pleiade, Paris, pp. 623, 705.

accident analyses and work analyses

Documents