The Sequence of Events Model
This is a simple, linear cause and effect model where accidents are seen as the natural culmination of a series of events or circumstances that occur in a specific and recognizable order. A chain often represents the model with a weak link or a series of falling dominos. This model prevents accidents by fixing or eliminating the weak link, removing a domino, or placing a barrier between two dominos to interrupt the events.
The Domino Theory of Accident Causation developed by H.W. Heinrich in 1931 is an example of a sequence of events model. [Heinrich, 1931] The sequential model is not limited to a simple series and may utilize multiple sequences or hierarchies such as event trees, fault trees, or critical path models. Sequential models are attractive because they encourage thinking in causal series, which is easier to represent graphically and understand. In this model, an unexpected event initiates a sequence of consequences culminating in the unwanted outcome. The unexpected event is typically considered unsafe, with human error as the predominant cause.
The sequential model is also limited because it requires strong cause and effect relationships that typically do not exist outside the technical or mechanistic aspect of the accident. In other words, true cause and effect relationships can be found when analyzing equipment failures. Still, causal relationships are extremely weak when addressing the human or organizational aspect of the accident. For example: While it is easy to assert that “time pressure caused workers to take shortcuts,” it is also apparent that workers do not always take shortcuts when under pressure.
In response to large-scale industrial accidents in the 1970s and 1980’s, epidemiological models were developed that viewed an accident as the outcome of a combination of factors, some active and some latent, that existed together at the time of the accident.
Epidemiological or Latent Failure Model
This is a complex, linear cause and effect model where accidents are seen as the result of a combination of active failures (unsafe acts) and latent conditions (unsafe conditions). These are often referred to as epidemiological models, using a medical metaphor that likens the latent conditions to pathogens in the human body that lay dormant until triggered by an unsafe act. In this model, accidents are prevented by strengthening barriers and defenses. The “Swiss Cheese” model developed by James Reason is an example of the epidemiological model. [Reason, 1997]
This model views the accident as the result of long-standing deficiencies triggered by active failures. The focus is on the organizational contributions to the failure and views human error as an effect instead of a cause. The epidemiological models differ from the sequential models on four main points:
Performance Deviation – The concept of unsafe acts shifted from being synonymous with human error to the notion of deviation from the expected performance.
- Conditions – The model also considers the contributing factors that could lead to the performance deviation, which directs analysis upstream from the worker and process deviations.
- Barriers – Considering barriers or defenses at all stages of the accident development.
- Latent Conditions – The introduction of latent or dormant conditions present within the system well before any recognizable accident sequence.
The epidemiological model allows the investigator to think in terms other than causal series, offers the possibility of seeing some complex interactions, and focuses on organizational issues. The model is still sequential, with a clear trajectory through the ordered defenses. Because it is linear, it tends to oversimplify the complex interactions between the multitude of active failures and latent conditions.
The limitation of epidemiological models is that they rely on “failures” up and down the organizational hierarchy, but does nothing to explain why these conditions or decisions were seen as normal or rational before the accident. The recently developed systemic models start to understand accidents as unexpected combinations of normal variability. [Dekker, 2006]
Systemic Model
This is a complex, non-linear model where both accidents (and success) emerge from unexpected combinations of normal variability in the system. In this model, accidents are triggered by unexpected combinations of normal actions, rather than action failures, which combine or resonate with another normal variability in the process to produce the necessary and jointly sufficient conditions for failure to succeed. Because of this model’s complex, non-linear nature, it is difficult to represent graphically. The Functional Resonance model from Erik Hollnagel uses a signal metaphor to visualize this model with the undetectable variabilities unexpectedly resonating to result in a detectable outcome.
The JengaTM game is also an excellent metaphor for describing the complex, non-linear accident model. Every time a block is pulled from the stack, it has subtle interactions with the other blocks that cause them to loosen or tighten in the stack. The missing blocks represent the sources of variability in the process and are typically described as organizational weaknesses or latent conditions.
Realistically, these labels are applied retrospectively only after what was seen as normal before the accident, is seen as having contributed to the event, but only in combination with other factors. Often, the worker makes an error or takes an action that seems appropriate, but when combined with the other variables, the stack crashes. The first response is to blame the worker because his action demonstrably led to the failure, but it must be recognized that without the other missing blocks, there would have been no consequence.
A major benefit of the systemic model is that it provides a more complete understanding of the subtle interactions that contributed to the event. Because the model views accidents as resulting from unexpected combinations of normal variability, it seeks to understand how normal variability combined to create the accident. This understanding of contributing interactions can identify latent conditions or organizational weaknesses.
Source: DOE
