The Accident Model
Primary Sources: Reason, James, Human Error, Cambridge
University Press, 1990. Reason, James, Managing The
Risks Of Organizational Accidents, Ashgate Publishing
Company, 1997. Turner, Barry A. and Nick F. Pidgeon, ManMade Disasters, Butterworth-Heinemann, 1997.
An Accident Model
Triggering
!@#$
Events
%
Acciden
t
or Other
Loss Event
May 2008
RC Management System ODM1
2
Barriers
Triggerin
g events
Procedures
Process Automation
Maintenance
Program
Management Of
Change Process
Accident Reporting
& Investigation
Process
Permits
JEPs
STACs
Training
Ibid.
May 2008
RC Management System ODM1
3
Holes Can Develop
Fatigue
Triggerin
g events
Inadequate Job
Planning
Inadequate
Maintenance
Mistake
Poor Teamwork Or
Coordination
Incorrect
Tool
Poor Quality
Training
Poor
Judgment
Ibid.
May 2008
Information Or
Communication
Failure
RC Management System ODM1
Acciden
t
Incident,or
Other Loss
Event
4
Layers In The “Swiss Cheese” Model
Triggerin
g events
Strategy
Layer
“Local”
System
Layer
Sharp End
Layer
May 2008
Ibid.
RC Management System ODM1
5
Potential Sharp End Barriers
Triggerin
g events
• Skills/knowledge
• Judgment
• Attention to detail
Experience, knowledge/skills,
health, aptitude, personality
factors, internal performance
standards, stress levels, task
pacing, mental models, mental
capability/acuity, vision, hearing,
dexterity, physical capability,
etc.
Ibid.
May 2008
Sharp End
Barriers
RC Management System ODM1
6
Examples Of Sharp End “Holes”?
Triggerin
g events
Exceeding individual abilities
Lack of knowledge or skill
Fatigue
Task overload
Stress
Poor judgment
Sharp End
Misperception of hazard,
lack of hazard awareness
Ibid.
May 2008
RC Management System ODM1
7
Potential System Barriers
Triggerin
g events
• Procedural guidance
• Problem resolution
• Review/verification
System
Barriers
Tools & equipment, human-machine interfaces, oversight, training, local
planning/scheduling, leader-worker ratios, pay, local culture, morale,
procedures, standards, specifications, work practices, local performance
May
2008
RC Management
standards,
local information
flow,System
localODM1
industry influences, etc. 8
Ibid.
Examples of System “Holes”?
Unworkable or ambiguous
procedures
Triggerin
g events
Poor coordination or
teamwork
Poor quality
training
System
Inadequate
maintenance
Misperceive hazard
Poor Judgment
May 2008
Ibid.
Inadequate staffing allocation
RC Management System ODM1
9
Potential Strategy Barriers
Triggerin
g events
Strategy
Barriers
• Structure
• Leadership
• Risk management
• Culture
Strategic decisions, forecasting, budgeting,
resource allocation, planning/scheduling,
leading, auditing, corporate culture,
information flow and availability, clarity of
objectives, etc.
May 2008
Ibid.
RC Management System ODM1
10
Examples of Strategy “Holes”?
Triggerin
g events
Strategy
Inability of
organization to
learn
Excessive cost cutting,
inadequate budget
Poor judgment
Inadequate risk
awareness or
management
Poor selection
of personnel
Ibid.
May 2008
Ambiguous
responsibilities
RC Management System ODM1
11
Triggering
events
Changes in one layer can affect other layers.
Accident
Triggering
events
Holes can develop at any time.
Vigilance. System ODM1
May Barrier
2008 Maintenance requires Constant
RC Management
Accident
12
Complex Systems
The more complex (interconnected & tightly
coupled) the system, the more prone it is to
fail in ways we didn’t anticipate.
– More combinations that can lead to failure.
– The odds of any one combination is extremely
remote, but the likelihood that one will occur,
sooner or later, is high.
– Many combinations we consider impossible aren’t
impossible at all - they just take longer.
The Powerball Lottery’s Evil Twin !
May 2008
RC Management System ODM1
Inviting Disaster, James R. Chiles, referencing the work of Charles Perrow
13
So What Does That
Mean?
Safety is a “Dynamic Non-Event”
The more dynamic the system, the less safety is
‘bankable’. In a dynamic system, you can’t ‘fix’ the
safety problem, store up safety, and then move on to
something else. If a system has been failure-free for
sixty-seven days, that doesn’t mean that the system
is safe. All it means is that the unexpected has not
escaped containment.
Avoid the
“tick off”
phenomenon
May 2008
RC Management System ODM1
14
Source: Reason, ibid., and Weick Karl E. and Kathleen M. Sutcliffe, Managing the Unexpected: Assuring High Performance in an Age of Complexity, Vol. 1, Jossey-Bass Inc., 2001.
Triggerin
g events
Strategy
System
Sharp End
Acciden
t incident, or
May 2008
RC Management System ODM1
other negative
event
15
Page 36
Lessons?
The barriers can be
interdependent … closing a
hole in one area can open a
hole somewhere else
EHS is a “dynamic nonevent” … it takes a lot of
activity for nothing to
happen
Safety critical errors can
happen at any level of
the system
Avoid the “Tick Off”
phenomenon … we need
to monitor and optimize
our EHS processes
May 2008
!
RC Management System ODM1
The “Swiss Cheese”
accident model can
be used with our
existing RCI Process
Latent failures can
exist for a long time
before contributing
to an event
16
How to use this information?
When conducting RCIs and Determining
Corrective Actions:
– Identify the sharp end failure(s)
– Determine what management systems could
have contributed to the incident.
• Was a system missing?
• Does something in the system need to be
improved or added on to?
– Are there company strategic decisions that
impacted this incident?
Example
Triggering
events
Corporate Incident sharing inadequate
Strategy
Organization Redesign inadequate
System
Training - inadequate
Inadequate hazard mitigation
Sharp End
Personal decision
Procedure – inadequate
Incident
After completion of an RCI, we can go back and take a second look at the results from
the perspective of the accident model … asking “Have we identified the holes at each
layer? If we haven’t identified the holes at each of the three layers, can we justify that
May 2008
RC Management System ODM1
18
those layers were bypassed or not involved?” If not, then we’ve missed something.