near miss incidents in chemical industry

Risk Analysis, Vol. 23, No. 3, 2003

Near-Miss Incident Management in the ChemicalProcess Industry

James R. Phimister,1 Ulku Oktem,1∗ Paul R. Kleindorfer,1 and Howard Kunreuther1

This article provides a systematic framework for the analysis and improvement of near-missprograms in the chemical process industries. Near-miss programs improve corporate environ-mental, health, and safety (EHS) performance through the identification and managementof near misses. Based on more than 100 interviews at 20 chemical and pharmaceutical facil-ities, a seven-stage framework has been developed and is presented herein. The frameworkenables sites to analyze their own near-miss programs, identify weak management links, andimplement systemwide improvements.

KEY WORDS: Near-miss management; precursors; process industries; safety

1. INTRODUCTION

In review of adverse incidents in the process in-dustries, it is observed, and has become accepted, thatfor every serious accident, a larger number of inci-dents result in limited impact and an even larger num-ber of incidents result in no loss or damage. This obser-vation is captured in the well-known Safety Pyramidshown in Fig. 1.(1)

Incidents at the pyramid pinnacle, referred to inthis article as accidents,2 may result in injury and loss,environmental impact, and significant disruption anddowntime of production processes. These incidentsare often obvious, are brought to the attention of man-agement, and are reviewed according to site protocols.Near misses comprise the lower portion of the pyra-mid. These incidents have the potential to, but do not,

1 Risk Management and Decision Processes Center, Operationsand Information Management, The Wharton School of Manage-ment, University of Pennsylvania.

∗ Address correspondence to Ulku Oktem, Director of the Near-Miss Project, Risk Management and Decision Processes Cen-ter, 1323 Steinberg Hall-Dietrich Hall, 3620 Locust Walk,Philadelphia, PA 19104-6366; [email protected].

2 The term “accident” is used to imply solely an incident that in-volves some form of loss to an individual, environment, property,and/or process.

result in loss. Near misses are often less obvious thanaccidents and are defined as having little if any imme-diate impact on individuals, processes, or the environ-ment. Despite their limited impact, near misses pro-vide insight into accidents that could happen. As nu-merous catastrophes illustrate, management failure tocapture and remedy near misses may foreshadow dis-aster. Notable examples where near misses have beenobserved but not effectively managed include:

1. The 1986 Space Shuttle Challenger explosion.Engineers had identified and reported de-graded O-ring seals on previous missions dat-ing back to 1982 with degradation increasingas ambient lift-off temperature decreased. Thenight before the disaster, management hadbeen warned of the potential for catastrophicfailure when lifting off at ambient tempera-tures of 53◦F or below (the lift-off temperaturewas 36◦F).(2)

2. The 1997 Hindustan refinery explosion in In-dia. Sixty people died and more than 10,000metric tons of petroleum-based products werereleased to the atmosphere or burned. Writtencomplaints of corroded and leaking transferlines where the explosion originated went un-heeded.(3)

445 0272-4332/03/1200-0445$22.00/1 C© 2003 Society for Risk Analysis

446 Phimister et al.

NearMisses

Accidents

10 minor injuries

1seriousinjury

60 incidents withproperty damage

600 incidents withoutdamage or loss

? unsafe/hazardousconditions

Fig. 1. Safety pyramid (the lowest strata, unsafe conditions, is not shown by Bird and Germain(1)).

3. The 1999 Paddington train crash catastrophein which 31 people died. From 1993–1999,eight near misses, or “signals passed at dan-ger” (SPADS), had occurred at the locationwhere the eventual collision and explosion oc-curred (Signal 109). At the time of the crash,the signal was one of 22 signals with the great-est number of SPADS.(4)

4. The 1998 Morton explosion and fire result-ing from a reactor temperature excursion.Nine people were injured, two seriously. Inan accident investigation, the Chemical SafetyBoard concluded: “Management did not in-vestigate evidence in numerous completedbatch sheets and temperature charts of hightemperature excursions beyond the normaloperating range.” A disproportionate numberof excursions resulted after the process wasscaled-up.(5)

As these examples illustrate, failure to benefit fromnear misses to identify and remedy systemic flaws canproduce catastrophic results. To reduce the likelihoodof future catastrophe and further improve employeesafety, process reliability, and environment integrity,management systems that recognize operationalweaknesses need to be developed to seek and utilizenear-miss incidents.(6) These programs operate underthe umbrella of “near-miss management systems.”

Near-miss management systems have been devel-oped and are implemented across a range of indus-tries, including the chemical and process, airline, rail,nuclear, and medical disciplines. A compilation of pa-pers with a cross-industry perspective is provided inNear-Miss Reporting as a Safety Tool.(7) The book il-

lustrates how management strategy and program im-plementation vary according to application area.

Within the chemical and process industries, anal-ysis of near-miss management has been limited. Themost detailed study of near-miss management in thechemical industry known to us is the thesis of T. W.Van der Schaaf.(8) The work presents a discussion ofthe human factors involved in reporting, and empha-sizes that to encourage reporting, site managementshould not express or infer the view that near-miss re-port rates are a desirable metric to decrease over time.The authors of this article found evidence to supportthis same recommendation.(9)

The Van der Schaaf thesis provides a system for(1) near-miss classification, (2) the analysis of a groupof near-miss reports, and (3) the implementation ofsafety improvements based on near-miss events. In theVan der Schaaf approach, the causes of near misses areidentified and classified and are used to analyze hu-man performance. Van der Schaaf applies this frame-work to a near-miss program at an Exxon Chemicalfacility in Holland. He argues that the integration ofthe program was successful in achieving higher levelsof near-miss reporting (an increase of 300% was ob-served). The site had a high safety standard prior toimplementation of the program; hence Van der Schaafwas unable to assess to what degree the program mayhave actually improved safety performance.

Jones et al.(10) provide an account of near-miss management systems successfully applied in theEuropean chemical industries. Two examples of near-miss programs applied at Norsk Hydro’s offshore andonshore facilities are studied. In both cases, the resultssuggest that an increase in near-miss reports can yieldimproved safety performance. In off-shore drilling,

Near-Miss Incident Management—Chemical Process Industry 447

over seven years a 10-fold increase in near-miss re-porting corresponded with a 60% reduction in losttime injuries. In on-shore activities, over a 13-yearspan, an increase in reporting rates from zero, to onereport per two employees per year corresponded witha 75% reduction in lost time injuries.3 Jones et al.note the recent inclusion of near misses in the ma-jor accident reporting system(11) (MARS) as a favor-able step in encouraging sites to implement near-missprograms.

There has been notable work in the codifying andevaluation of precursor data through utilization ofBayesian analysis.(12−14) Precursors are sequences orevents in accident chains; on some occasions a pre-cursor event can be considered synonymous with anear miss. This approach has received considerableattention within the nuclear industry where modelingapproaches are used to identify and assess potentialprecursors to reactor core meltdown.(15,16) In the ap-proach taken in the nuclear industry, a prior distribu-tion is formed as a product of a precursor distributionand a distribution representing a final barrier failing,hence leading to core meltdown. When new observa-tions of precursors, accidents, or lack thereof occurover time, an updated posterior distribution is gener-ated from the prior. The Bayesian procedure can helpidentify sources for improvement to reduce the likeli-hood of both precursors and accidents. Upon updatingdistributions, shifts in the posterior distribution curvesprovide insight into increased and decreased accidentlikelihood resulting from the failure modes associatedwith specific precursors.

In this article a seven-stage framework for themanagement of near misses is presented, with the em-phasis on obtaining operational and strategic valuefrom such incidents. The key finding of this article isthat near-miss management can be systematized andprovide an important reinforcing element of accidentprevention and preparedness at hazardous facilities.To do so, however, requires a well-designed infras-tructure for recognizing, reporting, analyzing, iden-tifying, and implementing solutions to prevent futurenear misses and accidents. This article’s intended con-tribution is to synthesize best practices for such aninfrastructure from the companies in our interviewsample and from other near-miss systems reportedin the literature. Although the sample in our studywas Fortune 500 companies, the sites visited rangedin size from 50 to several thousand full-time employ-ees; hence we believe that the general framework pro-posed is widely applicable even though it should be

3 Estimated from graphs in citation.

customized to fit particular organizational and busi-ness needs.

The article proceeds as follows. In the next sec-tion, we describe the structure of near-miss manage-ment systems and identify key stages in the process-ing of a near miss, from identification to resolution.We also point out similarities, differences, and inter-actions with accident-management systems. In Sec-tion 3, an overview of the data sample and interviewframework is provided. In Section 4 we analyze eachof the near-miss stages in our proposed framework inmore detail and present data from our interviews onbest practices for each stage. We conclude with obser-vations on the implementation of near-miss manage-ment systems, and with a discussion of future researchactivities.

2. FRAMEWORK

We propose a framework that relates the effec-tiveness of a company’s near-miss management sys-tem to the operational and strategic value that canbe derived from a systematic analysis of such inci-dents. Our field research and surveys of existing near-miss management systems delineate seven consecu-tive stages underlying the identification and manage-ment of near misses. These stages, shown in Fig. 2,are:

1. Identification: An incident is recognized tohave occurred.

2. Reporting: An individual or group reports theincident.

3. Prioritization and Distribution: The incidentis appraised and information pertaining to theincident is transferred to those who will assessfollow-up action.

4. Causal Analysis: Based on the near miss, thecausal and underlying factors that could haveenabled an accident are identified.

5. Solution Identification: Solutions to mitigateaccident likelihood or limit impact of the po-tential accident are identified and correctiveactions are determined.

6. Dissemination: Follow-up corrective actionsare relayed to relevant parties. Informationis broadcast to a wider audience to increaseawareness.

7. Resolution: Corrective actions are imple-mented and evaluated, and other necessaryfollow-up action is completed.

The seven stages have a “conjunctive” effecton each other. Near misses that are not identified


Report Prioritize Identify Resolve Dissemination Causal

Analysis SolutionIdentification

Fig. 2. Incident processing stages.

cannot be used to reduce risk exposure. Further,near misses that are identified but not reported, oridentified and reported but not acted on further,will, at best, have a modest impact on reducing site-risk exposure. Implicit in the framework is that onlythrough the successful execution of every stage is themaximum risk reduction achieved for a given nearmiss.

It is perhaps not surprising that sites often achievesignificant risk reduction through forensic evalua-tion of accidents, although they may gain little ben-efit in the identification and management of nearmisses. In an accident, both identification and re-porting are all but guaranteed. In such instances,the injury of an individual, an environmental impact,large-scale property damage, and/or other undesir-able outcomes force both identification and report-ing. The presence of legal and regulatory require-ments, combined with other factors such as empathy,employee concern, and desire to avoid event recur-rence, ensure that the incident is a high priority andthat a prompt and thorough investigation according topredefined investigation protocols is conducted, withcorrective actions disseminated and implemented. Incontrast, for near misses, many may occur unnoticed.Even for recognized near misses, factors such as con-cern for personal culpability, investigation time com-mitments, and belief that change might not resultcan discourage reporting. And even for those nearmisses that are reported, many of the external fac-tors that infer successful stage performance are notpresent.

Also implicit in the proposed framework is thatnear misses are analyzed with the intention of re-ducing the likelihood and/or severity of a poten-tial accident, and not simply in an attempt to re-duce the likelihood of a near miss recurring. This as-sumption presumes a linkage between near missesand accidents and we propose that near misses arelinked to potential accidents through an “inherentAND,” whereby a near miss and an additional eventare necessary to culminate in an accident. Basedon this observation, we illustrate how this linkagecan help structure risk-mitigating decision makingin the Causal Analysis and Solution Identificationstages.

3. THE INTERVIEW PROCESSAND STRUCTURE

The seven-stage framework presented in thisdocument and the elements intrinsic to successfulstage performance were derived from 106 interviews.The interviews were performed between June andNovember 2000 at 20 sites of five Fortune 500 chemi-cal and pharmaceutical companies. Of the sites vis-ited, seven were in the Houston, Texas area, twowere in Delaware, and the remaining ones were nearPhiladelphia in Pennsylvania. Fifty-nine of the inter-viewees were hourly employees, consisting of labora-tory technicians, plant operators, mechanics, and pipe-fitters. The others were site or company managementthat included EHS executives, engineers, and plantmanagers.

Interviews lasted between 20 and 40 minutes. Theinterview started with a short discussion of the pur-pose of the interview, and a discussion of the intervie-wee’s responsibilities. The remainder of the interviewfocused on five of the seven stages of the proposedframework (Identification, Reporting, Prioritizationand Distribution, Dissemination, and Resolution).

Due to the idiosyncratic nature of incidents andthe expertise required to analyze them, interviews didnot focus on site performance in the Causal Analysisor Solution Identification stages. However, manage-ment structure of these stages (e.g., Are the stagesmanaged separately? Are analytical tools brought tobear? etc.) was analyzed.

4. DISCUSSION OF INDIVIDUAL STAGES

In the following sections, elements intrinsic to thesuccessful performance of each stage are discussed. Ineach section:

1. Stage objectives are defined.2. Key elements for successful stage perfor-

mance are identified.3. Common obstacles that impede successful

stage performance are outlined.4. General observations of practice to overcome

these obstacles are presented.


4.1. Identification

To harvest value from a near miss it must be iden-tified. To successfully identify a near miss, individualsmust recognize an incident or a condition with po-tential for serious consequence. To aid in near-missidentification, individuals require an understandingof what is a near miss. In our study, 40 (68%) of thehourly employees expressed confusion as to what con-stitutes a near miss, believed that near misses musthave resulted in a threat to safety (though not the en-vironment, or potential for significant process upset),or expressed the sentiment of “you know it when yousee it.”

To have an effective near-miss management sys-tem there is an overwhelming need for sites to havean encompassing and helpful near-miss definition thatcan be easily understood by all employees. We believe,in providing a site- or corporate-wide definition, theissue should not be whether an occurrence is an eventwith potential for more serious consequences, an ac-cident, or simply the identification of an unsafe condi-tion or unsafe behavior. Rather, the definition shouldfocus on identifying a situation from which site EHSperformance may be improved. In search for a newdefinition, the tree shown in Fig. 3, which includesdesirable definition features, is generated.

The following new definition, based on the ele-ments depicted in Fig. 3, is:

Near-miss: An opportunity to improve envi-ronmental, health and safety practice basedon a condition, or an incident with potentialfor more serious consequence.

By this definition a wide variety of incidents and con-ditions are defined as near misses. These include:

� Unsafe conditions.� Unsafe behavior.

DEFINITION

Encouraging definition Broad

definition

Easily understandable

unsafe conditions

minor accidents

environmental potential

unsafe behavior

last barrier challenged

potential property damage

potential product loss

Fig. 3. Definition tree.

� Minor accidents and injuries that had potentialto be more serious.

� Events where injury could have occurred butdid not.

� Events where property damage results.� Events where a safety barrier is challenged.� Events where potential environmental dam-

age could result.

The definition proposed captures the ephemeralquality of a near miss without dwelling on how anevent should be classified. Near misses are opportu-nities. If the underlying hazard is quickly identifiedand remedied, the likelihood of the event recurringis greatly reduced or eliminated. If not identified, dis-closed, and properly managed, the incident may beforgotten and the latent potential for damage remains.

Through utilization of a broad near-miss defini-tion, identification is encouraged, whereas restrictivedefinitions, and failure to recognize near misses as op-portunities to improve EHS practice, present the pos-sibility that many near misses may not be recognized.Two restrictions to near-miss definitions that were ob-served in the field are (1) near misses must entail an“event,” or (2) near misses must involve a last barrierbeing challenged. The rational for these restrictionsmay be the perception that when an event occurs or alast barrier is challenged, an operation is closer to anaccident threshold. Consider Fig. 4, which illustratesa process in operation, and how it responds after anevent E. In the case of event E, two barriers, A and B,are in place to prevent an accident coming to fruition,and an accident occurs only if A and B fail. DefiningP(E) as the probability event E occurs over a giventime frame, and P (A′/E) as the probability barrier Afails if challenged given incident E, P (B′/EA′) is theprobability B fails if challenged given incident E, andA failing.

It will be noted that at point X, the probability ofan accident occurring is P(E)P(A′/E)P (B′/EA’), at Ythe accident probability is P (A′/E)P (B′/EA’), and at

Fails

Normal Operation

Event E Barrier A Challenged

Barrier B Challenged

Accident

Recovery

Recovery

Fails

Success

Success X Y

Z

Fig. 4. Event tree with two barriers.


Z it is P (B/EA’). Furthermore, provided barriers Aand B are in place:

PX(accident) < PY(accident) < PZ(accident)

where Pi(accident) is the probability of an accidentat location i. Under these circumstances, a processthat exhibits a last barrier challenged is indeed closerto an accident threshold than a process operating atlocation X.

However, consider if barriers A and B hadbeen temporarily removed (e.g., for maintenance).Then, if:

P(E) > P(B′/EA)

the operation is closer to an accident threshold at lo-cation X, where an event has not been expressed nora barrier challenged, than if the barriers A and B arefunctioning and the last barrier is challenged. Giventhe proximity of the operation to the accident thresh-old, the operation should be considered a near misseven though no event has occurred.

To illustrate the benefit of encompassing near-miss definitions, an incident discussed by a plant me-chanic is presented. The mechanic’s responsibilitiesinvolved the maintenance of a distillate stream at thetop of a 20-meter-high column. The mechanic, whowas positioned on a platform at the top of the col-umn, was short in stature and required a step-ladderto reach the pipework. Prior to climbing the ladder,the mechanic noted that to reach the pipework hispositioning would be precarious, and would resultin his leaning over a guardrail. He reported the un-safe condition through the site near-miss program, ashort investigation proceeded, and subsequently theguardrail was raised.

When the above incident was discussed with in-terviewees, some indicated that they did not considerthe incident a near miss and hence would not report it.However, they countered, had the individual climbedthe ladder, slipped, and not been injured, then it wasa near miss. If management conveys that near missesmust be “event-driven” or the result of a last barrierbeing challenged, many similar opportunities may gounreported.

4.2. Reporting

A recognized near miss has only limited value,even to the person who recognized it, unless it is re-ported and properly analyzed with appropriate mea-sures taken to prevent its recurrence. However, whena near miss is recognized, there is no assurance that

it will be reported. The objective therefore in the Re-porting stage is to ensure that all identified near missesare reported.

Bridges(17) focuses on barriers that inhibit report-ing. To increase report rates, Bridges advocates thatnine barriers be overcome. In this article we groupthese barriers as:

1. Potential recriminations for reporting (fear ofdisciplinary action, fear of peer teasing, andinvestigation involvement concern).

2. Motivational issues (lack of incentive andmanagement discouraging near-miss reports).

3. Lack of management commitment (sporadicemphasis, and management fear of liability).

4. Individual confusion (confusion as to whatconstitutes a near miss and how it should bereported).

Based on our interviews, we provide correspond-ing solutions to help overcome these four groups. Indeveloping near-miss programs, site and EHS man-agers should identify the barriers at their sites that in-hibit reporting. The above barriers and correspondingsolutions to address each one of them are presentedbelow.

4.2.1. Reporting Recriminations

Employees may be reluctant to report near missesdue to potential recriminations that could result. Po-tential recriminations are:

1. Peer Pressure: Employees may feel pressurefrom colleagues not to report.

2. Investigation Style: Lengthy investigationsthat require employee participation may dis-courage reporting.

3. Direct Disciplinary Action: Concern about re-ceiving a verbal warning, the potential addi-tion of the incident to the employee’s record,up to and including job dismissal, will discour-age reporting.

4. Unintended Disciplinary Action: For exam-ple, upon incident investigation, additional jobtasks or wearing cumbersome PPE may beperceived as punishment for reporting.

To overcome peer pressure, it is recommendedmanagement consider:

1. Wide dissemination of submitted near-missreports.


2. The formation of employee teams to evaluateand prioritize near-miss reports.

3. Publicizing of improvements that result fromreported near misses.

4. Requiring a specified number of near missesbe reported per person per year (e.g., one perperson per year).

Broad dissemination of near-miss reports may be con-sidered counterintuitive to alleviating peer pressure ifone thinks an individual would be reluctant to reportif he or she believed it was to be widely publicized.However, we found that if near misses are widely dis-seminated, individuals are exposed to many incidentsand an additional report does not draw attention tothe reporter, thus alleviating peer pressure.

For the chemical process industries, the authorsdo not favor schemes where employees remain anony-mous upon submitting a report. Our field workstrongly underscores the view that anonymous report-ing is problematic because (1) it is often necessaryto follow-up with the reporter to ascertain incidentcauses, and (2) anonymity does not infer that nearmisses are desirable learning opportunities. Threesites visited offered anonymous reporting, though atthese sites anonymity systems were run in conjunctionwith incentive schemes that encouraged identity dis-closure, and hence anonymous reporting was rarelyutilized.

Our assessment of existing near-miss systems alsosuggests that reporting should be quick and simpleas completion of long forms discourages reporting.Though follow-up action may necessitate a thoroughinvestigation, a short summary of the near miss andtime and location of the incident or observation nor-mally suffices. Including a brief appraisal of causesand potential solutions at the time of reporting is de-sirable but should not be a reporting requirement.Note that even if completion of the report form is aquick process, if retrieving near-miss forms is difficult,or involves trolling through websites, reporting rateswill be adversely affected.

To remove fear of disciplinary action, sites maywish to develop a nondisciplinary policy. Such a policycould be based around the following statement.

Provided a cardinal rule has not been brokenand no damage done, disciplinary action willnot be taken.

If implemented, this policy must be rigidly adheredto; damage that results from management failure toadhere to their policies can take years to undo. More-

over, safeguards to help catch instances when man-agement fails to abide by this policy should be con-sidered.

Finally, on determining solutions, managementmust scrutinize whether corrective actions that resultfrom near-miss investigations might be perceived aspunishment. In such cases, alternate solutions shouldbe sought.

4.2.2. Lack of Incentive

Interviewees at 14 sites expressed a lack of in-centive to report near misses. Perhaps the largest en-ticement to submit a near-miss report is the knowl-edge the report will be handled seriously and ap-propriately, with appropriate remedial action whennecessary. Management can also provide additionalencouragement through implementation of incentiveprograms. Two types of incentive programs observedduring site visits are:

1. Tchotchkes Giveaways: A near-miss report en-titles the reporter to a T-shirt, mug, or some-thing similar.

2. Lottery Systems: Each near miss constitutes alottery ticket, with drawings held quarterly, bi-annually, or annually. Lottery prizes observedat sites included cash prizes, dinner at a localrestaurant, event tickets, and a day off.

Of the sites visited, lottery programs showed higherparticipation levels than giveaway programs, althoughmost sites did not adopt either. The four sites thathad “tchotchkes” giveaways had an average near-missreporting rate of 0.9 per person per year, whereas thetwo sites that had lottery systems had reporting ratesthat averaged 3.0 reports per person per year.

Senior and site management should not createdisincentives to report near misses. Van der Schaaf(7)

reports of a site where senior management conveyedto personnel that high near-miss reporting correlateddirectly with poor safety performance. It was specu-lated that although this site was subsequently success-ful in reducing the number of near misses reported,the actual number of near misses experienced likelyremained constant and hence, due to inaction, thesite’s risk exposure actually increased. Confusion ofwhether high near-miss reporting rates are positiveor negative indicators of safety performance remains.Eleven sites in our study viewed the number of near-miss reports as a metric that was desirable to increaseor keep constant over time. These sites expressed theview that near-miss reports were a gauge of employee


EHS awareness and involvement. The remaining ninesites either did not maintain a view on this issue, orviewed submitted near-miss reports as a metric that isdesirable to decrease over time.

4.2.3. Individual Confusion

Since near misses can be subjective, there can beconfusion as to what constitutes a near miss. As dis-cussed in the Identification section, an encompassingnear-miss definition can facilitate understanding, andthereby encourage reporting. One site in our studyreferred to near misses as “safety event communica-tions,” which were shared over the site intranet. The“litmus test” for sharing a safety event communica-tion was:

Could someone benefit by learning from theevent?

It was believed that this simple test encouragedreporting.

Another site in our study included a similar defi-nition on the back of the near-miss report form. Inter-viewees, when questioned for their near-miss defini-tion, referred the interviewer to the back of the form.

In addition to understanding what constitutes anear miss, individuals must know to whom and howto report near misses. Multiple mechanisms (e.g., bothpaper-based and intranet-based) can aid reporting, ascan management emphasis and training.

4.2.4. Lack of Management Commitment

Failure of management to remain committed tonear-miss programs can decrease employee reportingand result in employee accusations that near-miss pro-grams are “a flavor of the month.” Commitment fail-ure can be both passive, where management stops em-phasizing program participation due to inattention, oractive, where management actively seeks to reduceprogram participation.

Passive failures can be avoided by:

1. Regular report generations and postings thathighlight program participation, resulting im-provements, and other benefits of the near-miss program.

2. Integrating near-miss program componentswith other site-management mechanisms,such as work-order entry, action-item track-ing, and accident-investigation systems. Thisapproach utilizes employee familiarity with

current procedures that would otherwise haveto be instilled if new systems are implemented.

3. Linking process with outcome. Specifically,sites may wish to attempt to show that near-miss program participation correlates favor-ably with EHS performance.

Active measures by site management to reducenear-miss reporting can stem from inability of sitemanagement to process a high level of participation,and management concern about being liable due toinaction on reported near misses. Addressing each ofthese items:

1. Integration of management systems, distribut-ing management responsibilities, and imple-menting a two or higher tier-investigationclassification system can greatly reduce the re-source burden of a near-miss program withhigh levels of participation.

2. Ensuring that every identified cause has anaccompanying solution, or solutions, and thatsystems are in place to track solutions until im-plemented can alleviate liability concerns.(18)

4.3. Prioritization and Distribution

This stage incorporates two tasks: near-miss pri-oritization and distribution. These two activities areperformed in unison to allocate the appropriate time,expertise, and resources to follow-up on an incident.

Prioritization is very important for a near-missprogram with a high number of near-miss reports. Forthese systems, most near misses will be investigatedby the reporter and/or his or her supervisor. However,occasionally, some near misses may be flagged as be-ing of a higher priority. Such “high priority” incidentsmay have some of the following characteristics:

1. Expertise beyond the reporter’s/supervisor’scapabilities is required to investigate the inci-dent.

2. The incident has significant potential for ma-jor loss, environmental damage, costs, and soforth.

3. The incident is recognized as part of a trendand similar or identical to previous near missesand accidents.

4. The potential for “lessons learned” is far-ther reaching than the majority of near-missreports.


Correspondingly, high priority reports may have sep-arate distribution channels to ensure that the incidentis trafficked to the appropriate parties.

Common obstacles that limit Prioritization andDistribution performance include:

� Lack of understanding of the characteristics ofhigh priority near misses.

� Lack of guidelines or tools to distinguish lowand high priority near misses.

� Lack of protocols for low and/or higher prior-ity near misses.

� Slowness in relaying near-miss information.� Paper distribution systems that do not specify

a time frame for near-miss review.� Distribution systems where information is

transferred in series and not in parallel.� Overprioritizing where investigators are re-

quired to analyze in detail relatively straight-forward reports.

� Nontargeted distributions where reports donot reach the necessary expertise.

Only one site in our study had an incident prior-itization step that was conducted upon reporting theincident, though EHS managers at sites with high re-porting rates often expressed the need for such a sys-tem. The one site that did prioritize reports used a two-tier rating of low and high priority, with correspond-ing protocols for each level. Two sites in our studyreviewed near-miss reports periodically (monthly orquarterly) in an attempt to discern trends and to flagincidents that required more investigation.

To improve report distribution, four strategies arerecommended:

1. Merge incident distribution with reporting.This can be performed relatively easily inautomated systems, where decisionmakers,whether supervisors, EHS managers, engi-neers, or others, are copied upon initialreporting.

2. Specify time frames on information transfer.This has been observed in paper-based sys-tems where protocols specify that reportednear misses must be reviewed by EHS man-agers within a certain time frame.

3. Automate systems to ensure cross-checking.These systems require management review toconfirm accurate prioritization.

4. Enable reporters and supervisors to performmost investigations. Such systems that engagereporters and supervisors to perform inves-

tigations involve employees, quicken investi-gations, and decrease investigator and EHSworkload.

4.4. Causal Analysis

Once a near miss is reported and transferred toappropriate parties, it is necessary to carry out stepsto ensure that the near miss does not recur. Theobjective in Causal Analysis is to determine whatare the direct and underlying factors that enable anincident or unsafe condition. Short-term solutionsresolve direct causes, farther-reaching and more per-manent solutions rectify root causes. Although instructuring near-miss programs it is important to rec-ognize the interaction between Causal Analysis andSolution Identification, it is equally important to rec-ognize that these are two distinct activities.

There are a number of obstacles that limit CausalAnalysis performance. Factors that deteriorate stageperformance include:

1. Lack of tools or frameworks to analyze nearmisses.

2. Insufficient expertise to analyze near misses.3. Dilution of relevant information due to infor-

mation transfer or lapsed time prior to inci-dent investigation.

The presence of the feedback loop betweenCausal Analysis and Reporting must be recognizedin structuring stage activities. There can be a trade-off between high reporting rates and comprehensiveinvestigations in that if all reported near misses arethoroughly investigated, near-miss reporting may beadversely affected due to concern over lengthy pro-ceedings. As a consequence, many sites may wish toforego a lengthy investigation for most reported nearmisses. At the same time, and as indicated duringour interviews, reporters must have some involve-ment in the investigation, for failure to consider whatthe reporter views as causes may discourage futurereporting.

In sites visited, root-cause analysis tools were gen-erally not used to analyze near misses; rather, sitesappeared to base corrective actions on incident de-scriptions. There are a number of techniques to aidin Causal Analysis that are widely used in accidentinvestigations. These include:

1. Event and Causal Factor Diagrams: Thedetailing of events leading up to, during,and following an incident, followed by the


deconstruction of each subevent into enablingcausal factors linked through AND/OR gates.

2. Event-Tree Analysis: An evaluation of succes-sive outcomes that could occur after an initi-ating event.

3. Fault-Tree Analysis: A deconstruction of anevent based on possible or required prior fail-ures or events.

4. Failure Mode and Effect Analysis: An evalua-tion of individual subsystems, assemblies, andcomponents and assessment of how subsystemfailures interact to lead to total system failures.

5. The “Why Test”: A recursive procedure forchallenging premises of potential root causes.

Many of these methods can equally be applied to near-miss investigations although it is outside the scopeof this article to provide a thorough presentationof these methods. Readers are referred to Soukasand Rouhiainen,(19) Greenberg and Cramer,(20)

and Paradies and Ungar(21) for presentations ofanalytical tools available. In addition, Bird andGermain(1) provide a discussion of accident in-vestigation procedures and incident interviewingmethods.

Four sites provided questions on the report formthat attempted to gauge the “most-likely accident sce-nario” had the near miss been an accident. None ofthe sites asked what would have been the additionalcontributing factors or events (nonmaterialized keyevents) necessary to occur for the near miss to bean accident. It is noted that these three events—thenear miss, the potential accident, and a contributingevent—can be linked through the fault tree shown inFig. 5.

As an example, one story we heard concerned anindividual who was replacing a light bulb on a plat-

The near missNonmaterialized

key events

AND

Accident

Fig. 5. Near-miss fault tree.

During bulb replacementburnt out hot bulb fell out

of my hand

Someone was walkingunderneath bulb

replacement

AND

Person injuredby falling

glass shard

1

2

3

4

5

6

Fig. 6. Near-miss fault tree for bulb-breaking incident (circles 1–6represent leverage points for corrective actions; see Solution Iden-tification).

form several stories high. The light bulb that was be-ing removed was hot, and upon being removed lightlyburned the individual. The light bulb slipped out of theperson’s hand and shattered on the platform grating,spraying shards of glass onto lower levels. An acci-dent was averted as no one was walking below. Fig. 6illustrates how this near-miss’s accident potential canbe represented as a simplified fault tree.

In developing systems to address weaknesses inthe Causal Analysis, the following practices were ob-served:

� Reporter Involvement: The reporter is oftenintrinsic in understanding what caused a nearmiss and how it may be avoided in the future.Hence, where possible, the reporter must beinvolved in determining causal factors.

� Listed Causes: Investigation forms should haveentries for multiple direct and root causes. Inaddition, if solutions are linked in an adjoiningcolumn, the structure provides a frameworkto help ensure each cause has a correspondingsolution or solutions.

� Integrated Systems: Although the majority(60%) of near-miss programs analyzed inour study are run independently of accident-investigation programs, some integrated ac-cident and near-miss systems to streamlineinvestigation systems, eliminate system dupli-cation, and improve employee understand-ing that near misses are intrinsically relatedto accidents that result in loss. System in-tegration may improve near-miss root-causeanalysis with tools developed for accident


investigations being similarly applied to near-miss investigations.

4.5. Solution Identification

The objective in the Solution Identification stageis to determine corrective actions that will remedycauses of the potential accident.

The process is achieved through three substages.

1. Generation of potential corrective actions.2. Comparative evaluation of corrective actions.3. Selection of corrective actions to implement.

None of the sites in our survey had a widely ap-plied procedure for generating corrective actions toprevent future near misses. Rather, appropriate cor-rective actions were generally thought to be identifi-able by the reporter and/or supervisor. All sites didhave management of change procedures to screen cor-rective actions for the possibility of new risks createdby the corrective action, but the application of theseprocedures was not assessed.

The authors believe the generation of multiplecorrective actions from which one or several are se-lected for implementation enables investigators tobetter determine corrective actions that are both ef-fective and also practical. Generation of multiple so-lutions can be achieved through nonconfrontational“brainstorming” activities between two or more peo-ple to obtain an initial list from which solutions may beculled.(22,23) Alternatively, corrective actions can bedetermined for the fault-tree leverage points shownin Fig. 6 using the following guidelines.

� Leverage Point 1: Based on the near-miss de-scription, corrective actions are determined toreduce the likelihood of the near miss occur-ring again.

� Leverage Point 2: Assuming the near miss de-scribed in Leverage Point 1 occurs, a “barrier”is constructed to make it less likely that theevent can be joined with the nonoccurring keyevent.

� Leverage Point 3: Based on the description ofthe other key event, corrective actions are de-termined to make the occurrence of this non-event less likely.

� Leverage Point 4: Assuming the nonoccurringevent described in Leverage Point 3 occurs, a“barrier” is constructed to make it less likelythat the event can be joined with the near miss.

Table I. Potential Corrective Actions for Bulb-Breaking IncidentBased on Incident Leverage Points

1A: Always wait for bulbs to cool prior to replacement.1B: Wear gloves while replacing bulbs.2A: Put drop blanket below area of bulb replacement.3A: Install warning signs or cones on floors below signaling

overhead work.4A: Rather than grating each floor, put covers on each floor to

prevent objects falling through.5A: Use shatter-proof bulbs.5B: Continue to ensure hard-hat compliance.6A: Put first aid stations closer to platforms.6B: Train personnel in removing glass shards.

� Leverage Point 5: Assuming both the nearmiss and the other nonoccurring event occurand that any barriers constructed at LeveragePoints 3 and 4 fail, a barrier is determined tomake the accident less likely.

� Leverage Point 6: Assuming that the accidentoccurs, contingency plans to lessen the severityof the accident are determined.

Table I shows potential corrective actions for thebulb-breaking example depicted in Fig. 6, at eachleverage point.

With a set of potential solutions identified, thesolution set must be reduced to determine which cor-rective action or actions to implement. Gauging howwell identified solutions successfully reduce risk expo-sure is not a simple endeavor since generally metricsare not easily applied. Nonetheless, proposed safetyimprovements can be loosely rated from most to leastbeneficial by the following ranking.

1. The corrective action eliminates the hazard.2. The corrective action reduces the hazard level.3. The corrective action manages incident recur-

rence.4. The corrective action alerts people of hazard

(e.g., through alarms or signs).5. Standard operating procedures (SOPs) are

changed to account for hazard.6. Employee awareness is increased.

In addition to the proposed solutions reducingthe likelihood or impact of the exposed hazard, thesolution must also not infer new risks. Hence, cor-rective actions must be carefully screened to ensurethat new and unexpected risks are not inferred uponimplementing new solutions. Here it is stressed thatthe remedying of one problem can result in otherunforeseen hazards, particularly when changes are


subtle. Dowell and Hendershot(24) provide examplesof changes intended to improve safety or processreliability resulting in operations with unexpectedrisks (the widespread implementation of airbags andthe unexpected risks these infer on children is citedas one example). They recommend implementationof management of change programs where all pro-cess changes are considered. Failure Mode and Ef-fect Analysis in the location of the instituted processchanges is one method that can be applied to assesswhether changes infer new risks.(19) If new risks areunacceptable, alternative solutions must be identified.

Corrective actions should be evaluated acrossnonrisk dimensions to assess the “practicality” of thesolution. It is noted that selecting corrective actionsbased solely on risk reduction may not be practical.If solutions are unfavorable to either management oremployees, future reporting and participation in a sitenear-miss program may be adversely affected. Amongother dimensions, solutions should be assessed ac-cording to:

1. Solution cost.2. Potential increased revenue on solution im-

plementation.3. Potential improved process/product quality of

implementation.4. Employee acceptance of solution.5. Management acceptance of solution.6. Time needed to implement the solution.

Preference diagrams can assist in the screeningof corrective actions. These diagrams spatially rep-resent identified solutions on a graph with the ab-scissa representing solution effectiveness in reducingrisk exposure (both directly and in incurring of newrisks) and the ordinate representing practicality (theamalgamation of nonrisk solution dimensions). Fig. 7provides a hypothetical preference diagram for thebulb-breaking example. This diagram is generated byplacing a corrective action on the diagram and po-sitioning other corrective actions relative to the first(and each other). The corrective actions in the upper-right quadrant are deemed the most preferable.

In addition to approaches outlined above, thefollowing can improve Solution Identification perfor-mance.

� Link Solutions to Causes: Report form struc-ture can help ensure that remedying solutionshelp resolve identified causes. Clear mappingswhere a solution or solutions are linked tocauses reduce the likelihood of spurious so-

Most Effective

Least Practical

Least Effective

More training

Wear gloves

More first aid stations

Let bulbs cool

Drop blanket

Most Practical

Warning cones Floor covers

Use shatter-proof bulbs

Ensure hard-hat compliance

Fig. 7. Preference diagram for bulb-breaking incident.

lutions being applied. EHS incident reviewsshould evaluate whether corrective actions areresolving identified causes.

� Work-Order Integration: Work orders thatstem from an investigation should, where pos-sible, be seamlessly integrated with the inves-tigation file such that on reviewing a file, it isclear which work orders remain outstandingand on reviewing a work order it is evidentwhether the work order resulted from an inci-dent investigation and if so, what the investi-gation findings were.

Common obstacles that limit Solution Identifica-tion success are:

1. Failure to generate more than one correctiveaction for a near miss.

2. Lack of procedures to reduce the number ofidentified corrective actions to just a few forimplementation.

3. Failure to address management of change is-sues, whereupon solutions give rise to unrec-ognized new risks.

4. Identified corrective actions fail to achievetheir intended purpose. Specifically, the solu-tion does not remedy the identified cause.

Adhering to above practices during Solution Identifi-cation should help to eliminate these obstacles.

4.6. Dissemination

Upon suitable corrective actions being deter-mined, they are disseminated to implementers. Also,at this point, having completed the near-miss analy-sis and determined the remedying actions it becomes


prudent to inform a broader audience of the informa-tion collected and decisions made.

Hence, there are two objectives in the Dissemi-nation stage.

1. Transfer corrective actions that stem from anear-miss investigation to implementers.

2. Inform a broader audience of the incident soas to increase awareness.

In addition, if EHS has not been involved in the inves-tigation to this stage, it may be desirable for EHS toreview the incident to determine if further investiga-tion is warranted. A more detailed evaluation of theincident may be necessary if, on review, it is evidentthat the near miss is a repeat incident, thus indicat-ing that previous near misses were not suitably ad-dressed, or if it is believed that additional root causescould be uncovered, or farther-reaching solutionsfound.

The two objectives have corresponding chal-lenges. One of the most significant problems that de-teriorate stage performance when transferring action-item information is when intended corrective actionsare not possible (e.g., due to lack of resources). Insuch instances it is critical that EHS or similar incidentoverseers intervene to determine suitable alterna-tive solutions that satisfy the same intended purpose.Common obstacles that limit the sharing of lessonslearned include both underdissemination, where allwho could benefit from learning of the near miss donot receive the near-miss report, and overdissemina-tion, where reports are not read or absorbed due tothe high number of reports disseminated.

Recommendations provided in the Prioritizationand Distribution stage apply equally to Dissemina-tion. Particularly, intranet systems can be excellentvehicles for transferring information, initiating actiontracking, and informing a broad audience of the re-port. Corrective-action monitoring to ensure that in-dividuals or departments are not overwhelmed withassignments that stem from investigations have beenobserved and applied successfully.

4.7. Resolution

Resolution is the final stage—all investigationcorrective actions are completed and all remaining ac-tivities prior to closing an incident report are fulfilled.Remaining activities prior to closing an incident fileinclude:

1. Updating the near-miss report if deviationsfrom the intended action item were imple-mented.

2. Reviewing/auditing the corrective actionsupon completion to ensure the implementedaction item fulfills its intended purpose.

3. Informing the reporter, and others when ap-propriate, that all actions that stemmed fromthe report are completed and the incident fileis closed.

Although sites in our study generally tracked cor-rective actions until completion, not all sites consis-tently implemented the three activities listed above.Sites that did complete the three activities had up-date fields on report forms to track deviations frominitially intended actions, prespecified audit proto-cols to review completed corrective actions, and auto-generated emails that informed the initial reporterwhen all corrective actions were completed and thereport was closed. In addition, some companies gen-erated monthly status reports to provide a “picture”of the near-miss programs, and to highlight recentlyclosed incidents and outstanding corrective actions.

A typical “action-traction” algorithm to ensurecorrective actions are completed is shown in Fig. 8. Toaccount for the obstacles that can impede stage per-formance, observed variations to the action-tractionalgorithm include:

1. Inclusion to allow for updates in the case ofchanges to intended design.

2. Audits to evaluate action-item effectiveness insatisfying the intended item purpose.

3. Procedures to return the action item to theinitiator if implementation of the proposal isnot possible.

4. Priority levels that affect when alerts are sentto implementers for outstanding action items.

Lastly, prior to closing the incident file it may bebeneficial to disseminate incident descriptions, find-ings, and actions taken offsite if the learning value isof significant benefit.

5. CONCLUSIONS AND FUTURE STUDIES

This article proposes a near-miss managementframework that adds operational and strategic valueto corporate environmental, health, and safety prac-tice. Since our field visits show that to improve near-miss management systems one must focus on the de-tails of the process by which near misses are identified,


ACTION TRACTION of single entry (mulitple entries are done in parallel)

Definition: Owner—the person responsible to complete action.Definition: Steward—the person who overseas that the item is completed(e.g., EHS or Owner's direct supervisor).

Action item consists of description of required activities, expectedcompletion date, owner, and steward.

Action entered

Has completiondate expired?

Has the actionbeen completed? STOP

CheckTomorrow

Remind Ownerthat completion is

required

Alert EHS,manager andothers if delay

mounts

Have 2 weekspassed since last

reminder?

CheckTomorrow

Has the actionbeen

completed?

STOP

yes

yesno

no

no

yes

yes

no

Fig. 8. Action-traction algorithm.

reported, analyzed, and, where appropriate, correc-tive actions implemented, we identify a seven-stageframework that helps sites accomplish this objective.Each one of these stages is critical for the effectivenessof the overall system, with incidents recommendedto be processed as follows: Identification of a nearmiss, Reporting and Prioritization and Distributionof relevant information, Causal Analysis, Identifica-tion of Solutions to prevent recurrence, Disseminationof remedial action, and Resolution through tracking.To achieve best results, all seven stages must be per-formed in sequential fashion.

Since each stage can take place only if the pre-vious stages have already been completed success-fully, earlier stages in the near-miss management sys-

tem have “conjunctive” effects on later stages. Al-though it is important to have a near-miss systemwhere all stages perform successfully, developmentof such a system is contingent upon thorough un-derstanding of fundamental issues. For example, itis important to avoid cumbersome reporting forms,lengthy analysis for every near miss, corrective ac-tions that discourage future reporting, and so forth.Any of these defects could cause near-miss manage-ment to do more harm then good to the overall safetyprocess.

Future studies on near-miss management sys-tems will include adaptation of various statistical toolsfor each one of the seven stages to improve theirefficiency, effectiveness, and quality control. Two crit-ical and highly desired research areas that can con-tribute significantly to corporate management opera-tions are:

� Development of tools for the identification ofresource levels to be dedicated to each nearmiss based on the potential impact of the in-cident (thereby differentiating between nearmisses that illuminate potential for major ac-cidents from ones whose impact is more toler-able).

� Identification of tools for the leveraging ofknowledge that is collected and stored in near-miss databases.

ACKNOWLEDGMENTS

Preparation of this document was partially sup-ported through a Cooperative Agreement betweenthe U.S. EPA/CEPPO and the Wharton Risk Man-agement and Decision Processes Center. Ongoingproject support from ATOFINA, Johnson and John-son, Rohm and Haas, Sunoco, W.R. Grace, Eli Lilly,Phelps Dodge Corporation, the Ackoff Center for theAdvancement of Systems Science, and E-LearningLab of the Wharton School is gratefully acknowl-edged. The authors thank two anonymous reviewersand Tjerk Van der Schaaf for constructive commentsduring article preparation.

DISCLAIMER

Although the authors believe the systems de-scribed in this article are an accurate depiction of suc-cessful near-miss management systems at Fortune 500or similarly large companies, no warranty or represen-tation, expressed or implied, is made with respect to


any or all of the content herein, and hence no legalresponsibility is assumed. The views expressed in thisarticle are those of the authors and do not necessarilyrepresent views of companies that participated in thestudy.

REFERENCES

1. Bird, F. E., & Germain, G. L. (1996). Practical loss controlleadership. Loganville, GA: Det Norske Verita.

2. Vaughan, D. (1996). The Challenger launch decision: Risk tech-nology, culture and deviance at NASA. Chicago, IL: Universityof Chicago Press.

3. Khan, F. I., & Abbasi, S. A. (1999). The world’s worst indus-trial accident of the 1990s. Process Safety Progress, 18, 135–145.

4. Cullen, W. D. (2000). The Ladbroke Grove mail inquiry. Nor-wich, UK: Her Majesty’s Stationary Office.

5. Chemical Safety Board. (2000). Investigation report: Chemicalmanufacturing incident, NTIS PB2000-107721. Washington,DC: Chemical Safety Board.

6. March, J. G., Sproull, L. S., & Tamuz, M. (1991). Learning fromsamples of one or fewer. Organization Science, 2, 1–13.

7. Van der Schaaf, T. W., Lucas, D. A., & Hale, A. R.(Eds.). (1991). Near-miss reporting as a safety tool. Oxford:Butterworth-Heinmann.

8. Van der Schaaf, T. W. (1992). Near-miss reporting in the chem-ical process industry. Ph.D. thesis. Eindhoven University ofTechnology.

9. Phimister, J. R., Oktem, U., Kleindorfer, P. R., &Kunreuther, H. (2000). Near-miss system analysis: Phase I.Risk Management and Decision Processes Center, The Whar-ton School. Available at http://opim.wharton.upenn.edu/risk/wp/nearmiss.pdf.

10. Jones, S., Kirchsteiger, C., & Bjerke, W. (1999). The impor-tance of near miss reporting to further improve safety perfor-mance. Journal of Loss Prevention in the Process Industries,12, 59–67.

11. Kirchsteiger, C. (1999). The functioning and status of theEC’s major accident reporting system on industrial accidents.Journal of Loss Prevention in the Process Industries, 12, 29–42.

12. Bier, V. M., & Yi, W. (1995). The performance of precursor-based estimators for rare event frequencies. Reliability Engi-neering and System Safety, 50, 241–251.

13. Bier, V. M., & Mosleh, A. (1990). The analysis of accident pre-cursors and near misses: Implications for risk assessment andrisk management. Reliability Engineering and System Safety,27, 91–101.

14. Kaplan, S. (1990). On the inclusion of precursor and near missevents in quantitative risk assessments: A Bayesian point ofview and a space shuttle example. Reliability Engineering andSystem Safety, 27, 103–115.

15. Johnson, J. W., & Rasmuson, D. M. (1996). The US NRC’saccident sequence precursor program: An overview and de-velopment of a Bayesian approach to estimate core damagefrequency using precursor information. Reliability Engineer-ing and System Safety, 53, 205–216.

16. Kaplan, S. (1992). “Expert information” versus “expertopinions.” Another approach to the problem of elicit-ing/combining/using expert knowledge in PRA. ReliabilityEngineering and System Safety, 35, 61–72.

17. Bridges, W. G. (2000). Get near misses reported, processindustry incidents: Investigation protocols, case histories,lessons learned. In Center for chemical process safety inter-national conference and workshop (pp. 379–400). New York:American Institute of Chemical Engineers.

18. Risk Management and Decision Processes Center, TheWharton School. (2000). Minutes from Wharton near-missroundtable meeting, May 4.

19. Suokas, J., & Rouhiainen, V. (Eds.). (1993). Quality manage-ment of safety and risk analysis. Amsterdam: Elsevier.

20. Greenberg, H. R., & Cramer, J. J. (Eds.). (1991). Risk assess-ment and risk management for the chemical process industry.New York: Van Nostrand Reinhold.

21. Paradies, M., & Unger, L. (2000). TapRoot�: The system forroot cause analysis, problem investigation, and proactive im-provement. Knoxville, TN: System Improvements.

22. Eckes, G. (2000). The six-sigma revolution: How General Elec-tric and others turned process into profits. New York: JohnWiley.

23. Peace, G. S. (1992). Taguchi methods: A hands on approach.Reading, MA: Addison Wesley.

24. Dowell III, A. M., & Hendershot, D. C. (1997). No good deedgoes unpunished: Case studies of incidents and potential inci-dents caused by protective systems. Process Safety Progress,16, 132–139.

near miss incidents in chemical industry

Documents