Incident Prevention at Work ELIMINATE the RISK

Every day, more than 500 men or women do not come home because they were killed

by incidents at work. These are dramatic numbers which draw fairly little public

attention. Considering the fact that incidents take a considerable economic toll from

nations, companies and individuals, incidents do not get much publicity.

Fortunately there are people working with a sense of purpose, often behind the

scenes, towards understanding and managing safety and incident prevention better,

and their efforts have not been wasted. Our understanding of incident prevention and

safety is on a far higher level than ever before. We have left behind the simplistic

model of dividing behaviour and conditions into two categories: safe or unsafe.

The important observation is that two safe conditions which by themselves are safe,

may not be safe together. Workers are the connecting link, as their behaviour

changes according to the environment and their physical surroundings.

Every user of power saws knows from personal experience that this noisy, vibrating

and obviously sharp cutting tool appears to be very dangerous to use, and the

beginner operator is very cautious. However, after hours of experience operators

lose their sense of any hazard and start handling the saw less carefully. The

kickback guard may produce a similar effect. Operators who know kickback is

possible try to avoid it. When operators know that there is a mechanical device

preventing the saw from hurting them in event of kickback, they become less

cautious.

Even if these protective arrangements have been successful, in the final analysis

their effects do not have a linear relationship with safety. Two safe conditions,

kickback guard and leg protection, do not double the safety. The normal arithmetic

of one plus one equals two (1 + 1 = 2), does not apply in this case, as one plus one

makes less than two. Fortunately, one plus one (1 + 1) makes more than zero in some

cases. In other cases, however, the sum may even be negative.

The simple division of behaviours and conditions into safe and unsafe does not lead

very far toward prevention. The credit for progress has to be given to systems

management. After understanding that humans, their tasks, their equipment and the

environment make up a dynamic system, we have made considerable progress

towards more effective incident prevention.

Incident prevention has been traditionally based on learning from incidents and near

incidents (near misses). By investigating every incident, we learn about causes and

can take actions towards mitigating or removing the causes. The problem is that we

have not been able to develop, in the absence of sufficiently good theories,

investigation methods which would bring up all the relevant factors for prevention.

An investigation may give a fairly good picture about the causes. However, this

picture is usually relevant only for the specific case investigated. There may be

conditions and factors which contributed to the incident whose connections the

investigators do not recognize or understand. Generalizing from one incident to other

situations bears a degree of risk.

The new steps in safety management is the notion of

safety culture. It may be a difficult concept, since culture is not a visible entity. It is

an abstract concept prevailing within an organization or society. There are no direct

ways of adjusting it. Safety culture is, however, a crucial concept for understanding

the possibilities of prevention.

Calculating the magnitude of the incident problem; it is not a description of the

magnitude itself. In dealing with occupational incidents, the magnitude of the

problem can be estimated in different ways, depending on one’s need to estimate

how big the problem has been or how big it will be in the future. An incident may be

described as a result of a chain of events in which something has gone wrong,

resulting in an undesired conclusion. It has been shown that human intervention may

prevent the injury or damage to which such a chain of events would otherwise lead.

However, given the fact of human intervention, the potential exists for far more

dangerous possible chains of events than those actually leading to injury or damage.

These possibilities must be considered in assessing the full extent of workplace risk.

Assuming that events that might lead to injury or damage occur because of factors

in the workplace, one is led to conclude that the magnitude of the problem has to be

determined on the basis of the existence and frequency of such factors.

When dealing with incidents in the workplace, one can estimate the magnitude of

the problem retrospectively by comparing the number of incidents (incidence rate)

with the severity of the incidents (lost work days). However, if one wants to estimate

the magnitude of the problem prospectively, it is done by evaluating the presence of

risk factors in the workplace—that is, factors that might lead to incidents.

A sufficiently complete and accurate view of the state of affairs with respect to

workplace incidents can be gained by means of a comprehensive reporting and

record-keeping system. Analyses of well-prepared incident reports can give a picture

of the basic relationships essential to understanding the causes of the incidents. In

order to estimate the magnitude of the problem in detail, a determination of risk

factors is essential. Knowledge of the relevant risk factors can be obtained by

analyzing the detailed information provided with each incident record as to where

workers and operators were located when the incident occurred, what they were

doing or handling, by what means, what damages or injuries occurred and other

particulars surrounding the incident.

Risk

Risk measurement must be made on the basis of information regarding the number

and seriousness of injuries that have occurred in the past, yielding a retrospective

measurement. The risk of injury to individuals may be described by two types of

data:

� Measurement of risk provides a calculated frequency of injuries and a measurement

of the seriousness of the injury.

� Type of risk or element of danger assessment provides not only an indication of the

exposure sources and other harmful factors which may cause an incident, but also

an indication of the circumstances leading to injury or damage.

Many types of risk, not apparent to common sense, may be overlooked. With regard

to these, the worker must be informed of the risk (e.g., that noise causes hearing

damage, that some solvents cause brain damage and that certain chemicals cause

acute poisoning by inhalation). Our knowledge of types of risk, from the most to the

least conspicuous, whether gained through everyday experience or through research

efforts, is based on past events. However, it is one thing to know what has

happened, and another to assess what will happen in the future. It should be noted

that the very knowledge of the exposure sources and other potentially harmful

factors which may cause damage or injury in connection with tasks of various sorts,

as well as knowledge of the factors that can either heighten or reduce those risk

factors that influence risk measurement, can provide a basis for recognition of the

risk.

Factors Determining Risk

The factors which are of greatest relevance in determining risk are:

� factors which determine the presence or absence (or potential) of risks of any sort

� factors which either increase or minimize the probability of these risks resulting in

incidents or injuries

� factors affecting the seriousness of incidents associated with these risks.

To clarify the first point, it is necessary to identify the causes of the incident—

namely, exposure sources and other harmful factors; the two latter points constitute

the factors which influence the measurement of risk.

The primary factors in the working environment which are the direct causes of harm,

either by way of occupational diseases or occupational incidents, are as follows:

Exposure sources and occupational disorders

The concept of injuries due to exposure sources is often linked to the concept of

disease (or disorder) because a disease can be viewed as caused by exposure to one

or several agents over a short (acute exposure) or long (chronic exposure) period of

time. Chronic exposure agents are usually not directly harmful, but take effect rather

after a relatively constant and extended period of exposure, whereas acute

exposures are almost instantaneously harmful. The intensity, harmfulness and period

of action is of importance to the development of the injury, which may often be a

matter of a combination of the effects of several different agents. This fact makes it

difficult to point out and determine the exposure sources because (among other

reasons) monocausal correlations between specific disorders and specific exposure

sources are almost never found.

Examples of exposure sources which may result in an injury in the form of a disease-

like condition are:

� chemical exposures (solvents, cleaning agents, degreasing agents, etc.)

� physical exposures (noise, radiation, heat, cold, inadequate lighting, lack of oxygen,

etc.)

� physiological exposures (heavy loads, bad work postures or repetitive work)

� biological exposures (viruses, bacteria, flour, animal blood or leather, etc.)

� psychological exposures (work in isolation, threat of violence, changing working

hours, unusual job demands, etc.).

Harmful factors and occupational incidents

The concept of harmful factors (not including exposure sources) is linked to

occupational incidents, because this is where damages occur and workers are

exposed to the type of actions that cause instant injury. This type of action is easily

identified because the damage or injury is recognized immediately when it occurs.

The difficulty attached to this type of injury is the unexpected contact with the

harmful factor.

Controlling Exposures

Exposure sources or other harmful factors are to a great extent governed by the

nature of the processes, technologies, products and equipment to be found in the

workplace, but may also be governed by the way in which the work is organized.

From the point of view of measurable risk, it should be recognized that control of the

probability of exposures and the seriousness of injuries to workers often depends on

the following three factors:

� Elimination/substitution safety measures. Workplace hazards in the form of

exposure sources or other harmful factors may be eliminated or mitigated by

substitution (e.g., a less harmful chemical may replace a toxic chemical in a

process). It should be noted that this is not totally possible, as exposure sources and

other harmful factors will always be present in human surroundings (not least with

respect to human working conditions).

� Technical safety measures. These measures, often called engineering controls,

consist of separating persons from harmful factors by encapsulating the harmful

elements, or installing barriers between workers and the factors which may cause

injury. Examples of these measures include, but are not limited to, automation,

remote control, use of ancillary equipment and machine protection (guarding).

� Organizational safety measures. Organizational safety measures, also known as

administrative controls, include separating persons from harmful factors either by

means of special working methods or by separation in time or space.

Controlling Human Conduct

It is often not possible to isolate all hazards using the above control measures. It is

commonly supposed that incident prevention analysis ends here because it is

believed that the workers will then be able to take care of themselves by acting

“according to the rules”. This means that safety and risk will at some point depend

on factors which control human conduct—namely, whether the individual person has

the knowledge, the skills, the opportunity and the will to act so as to ensure safety

in the workplace. The following illustrates the role of these factors.

� Knowledge. Workers must first be aware of the types of risk, potential hazards and

elements of danger that may be found in the workplace. This usually requires

education, training and job experience. The risks also need to be identified,

analyzed, recorded and described in a readily understandable manner so that

workers know when they are in a specific risk situation and what consequences are

liable to follow from their actions.

� The opportunity to act. It must be possible for the workers to act safely. It is

necessary for workers to be able to make use of the available technical and

organizational—as well as physical and psychological—opportunities for action.

Positive support of the safety program must be forthcoming from management,

supervisors and the surroundings, including concern about risk taking, designing and

following working methods with safety in view, safe use of the proper tools, clearly

defining tasks, establishing and following safe procedures, and providing clear

instructions on how equipment and materials are to be safely handled.

� The will to act safely. Technical and organizational factors are important with

respect to workers’ readiness to behave in ways that will ensure workplace safety,

but social and cultural factors are at least equally important. Information on the

causes of incidents serves the following purposes:

� It can demonstrate where something is wrong and what needs to be changed.

� It indicates the types of harmful factors that cause incidents (or near incidents) and

also describes the situations that result in damage and injuries.

� It identifies and describes the underlying circumstances that determine the

presence of potential hazards and risky situations and that will result in optimum

safety by their being altered or eliminated.

Information of a general sort can be obtained by a thorough analysis of the damage

or injuries and the circumstances under which they occurred. Information obtained

from other similar incidents may point out more general factors of importance, thus

disclosing less immediately visible causal relationships.

Analysis of individual incidents has two primary purposes:

First, it can be used to determine the cause of an incident and the specific work

factors that contributed to it. Following analysis, one can assess the extent to which

the risk has been recognized. One may also decide upon technical and organizational

safety measures and the degree to which more job experience might have

diminished the risk. Furthermore, a clearer view is gained of the possible actions

that might have been taken to avoid the risk, and the motivation that a worker must

have to take these actions.

Second, one can gain knowledge which may be used for analyses of many similar

incidents at both the enterprise level and at more comprehensive (e.g., organization-

wide or national) levels. The identity of the workplace and the work itself (that is,

information relating to the sector or the trade in which the workplace is positioned),

and the work processes and the technology that characterize the work

� the nature and the seriousness of the incident

� factors causing the incident, such as exposure sources, the way in which the

incident occurred and the specific working situation causing the incident

� general conditions at the workplace and the working situation (comprising the

factors mentioned in the foregoing paragraph).

There are five primary types of analyses of incidents, each having a distinct purpose:

� Analyses and identification of where and which types of incidents occur. The goal

is to determine the incidence of the injuries, as associated, for example, with

sectors, trade groups, enterprises, work processes and types of technology.

� Analyses with respect to monitoring developments in the incidence of incidents.

The purpose is to be warned of changes, both positive and negative. Measuring the

effect of preventive initiatives may be the result of such analyses, and increases in

new types of incidents within a specified area will constitute warning of new risk

elements.

� Analyses to prioritize initiatives that call for high degrees of risk measurement,

which in turn involve calculating the frequency and seriousness of incidents. The

goal is to establish a basis for prioritization to determine where it is more important

to carry out preventive measures than elsewhere.

� Analyses to determine how the incidents occurred and, especially, to establish both

direct and underlying causes. This information is then applied to the selection,

elaboration and implementation of concrete corrective action and preventive

initiatives.

� Analyses for elucidation of special areas which have otherwise attracted attention

(a sort of rediscovery or control analyses). Examples include analyses of incidences

of a special injury risk or the discovery of a hitherto unrecognized risk identified in

the course of examining an already known risk.

Phases of the Analysis

Irrespective of the level from which an analysis starts, it will usually have the

following phases:

� identification of where the incidents occur at the general level selected

� specification of where the incidents occur at a more specific level within the

general level

� determination of goals in view of the incidence (or frequency) and seriousness of

the incidents

� description of exposure sources or other harmful factors—that is, the direct causes

of damage and injury

� examination of the underlying causal relation and causal development.

Different levels of incident analysis

The type of workplace risk is established by descriptions of the types of incidents

that take place and the way in which they arise within the individual workplace

areas. In this way, knowledge is obtained of the exposure sources and other harmful

factors present in the workplace in the event that preventive measures—attention to

safety conditions, awareness of risk, providing opportunity for action and the appeal

to the workers’ will—have proved insufficient to avert the incident.

Identification, measurement and description of incidents together provide the basis

for what is to be done and who is to do it in order to reduce the risk. If, for example,

specific exposure sources can be linked to specific technologies, it will help

determine what special safety measures are necessary to control the risk. This

information may also be used to influence manufacturers and suppliers associated

with the technology in question.

Incident Causation Theories

The domino theory

According to W.H. Heinrich (1931), who developed the so-called domino theory, 88%

of all incidents are caused by unsafe acts of people, 10% by unsafe actions and 2%

by “acts of God”. He proposed a “five-factor incident sequence” in which each factor

would actuate the next step in the manner of toppling dominoes lined up in a row.

The sequence of incident factors is as follows:

1. ancestry and social environment

2. worker fault

3. unsafe act together with mechanical and physical hazard

4. incident

5. damage or injury.

In the same way that the removal of a single domino in the row would interrupt the

sequence of toppling, Heinrich suggested that removal of one of the factors would

prevent the incident and resultant injury; with the key domino to be removed from

the sequence being number 3. Although Heinrich provided no data for his theory, it

nonetheless represents a useful point to start discussion and a foundation for future

research.

Multiple causation theory

Multiple causation theory is an outgrowth of the domino theory, but it postulates that

for a single incident there may be many contributory factors, causes and sub-causes,

and that certain combinations of these give rise to incidents. According to this

theory, the contributory factors can be grouped into the following two categories:

Behavioural. This category includes factors pertaining to the worker, such as

improper attitude, lack of knowledge, lack of skills and inadequate physical and

mental condition.

Environmental. This category includes improper guarding of other hazardous work

elements and degradation of equipment through use and unsafe procedures.

The major contribution of this theory is to bring out the fact that rarely, if ever, is an

incident the result of a single cause or act.

The pure chance theory

According to the pure chance theory, every one of any given set of workers has an

equal chance of being involved in an incident. It further implies that there is no

single discernible pattern of events that leads to an incident. In this theory, all

incidents are treated as corresponding to Heinrich’s acts of God, and it is held that

there exist no interventions to prevent them.

Biased liability theory

Biased liability theory is based on the view that once a worker is involved in an

incident, the chances of the same worker becoming involved in future incidents are

either increased or decreased as compared to the rest of workers. This theory

contributes very little, if anything at all, towards developing preventive actions for

avoiding incidents.

Incident proneness theory

Incident proneness theory maintains that within a given set of workers, there exists

a subset of workers who are more liable to be involved in incidents. Researchers

have not been able to prove this theory conclusively because most of the research

work has been poorly conducted and most of the findings are contradictory and

inconclusive. This theory is not generally accepted. It is felt that if indeed this theory

is supported by any empirical evidence at all, it probably accounts for only a very low

proportion of incidents without any statistical significance.

The energy transfer theory

Those who accept the energy transfer theory put forward the claim that a worker

incurs injury or equipment suffers damage through a change of energy, and that for

every change of energy there is a source, a path and a receiver. This theory is useful

for determining injury causation and evaluating energy hazards and control

methodology. Strategies can be developed which are either preventive, limiting or

ameliorating with respect to the energy transfer.

Control of energy transfer at the source can be achieved by the following means:

� elimination of the source

� changes made to the design or specification of elements of the work station

� preventive maintenance.

The path of energy transfer can be modified by:

� enclosure of the path

� installation of barriers

� installation of absorbers

� positioning of isolators.

The receiver of energy transfer can be assisted by adopting the following measures:

� limitation of exposure

� use of personal protective equipment.

The “symptoms versus causes” theory

The “symptoms versus causes” theory is not so much a theory as an admonition to

be heeded if incident causation is to be understood. Usually, when investigating

incidents, we tend to fasten upon the obvious causes of the incident to the neglect

of the root causes. Unsafe acts and unsafe conditions are the symptoms—the

proximate causes—and not the root causes of the incident.

Structure of Incidents

The belief that incidents are caused and can be prevented makes it imperative for us

to study those factors which are likely to favour the occurrence of incidents. By

studying such factors, the root causes of incidents can be isolated and necessary

steps can be taken to prevent the recurrence of the incidents. These root causes of

incidents can be grouped as “immediate” and “contributing”. The immediate causes

are unsafe acts of the worker and unsafe working conditions. The contributing

causes could be management-related factors, the environment and the physical and

mental condition of the worker.

Structure of incidents

Incident causation is very complex and must be understood adequately in order to

improve incident prevention. With such a diversity of theories, it will not be difficult

to understand that there does not exist one single theory that is considered right or

correct and is universally accepted. These theories are nonetheless necessary, but

not sufficient, for developing a frame of reference for understanding incident

occurrences.

HUMAN FACTORS IN INCIDENT MODELLING

Traditional models of incident causation placed superficial emphasis on human

factors. Where human factors were included, they were depicted as linked to error

occurring in the immediate sequence of events leading to the incident.

Incident Causation Models

Recent models have extended the role of human factors beyond the immediate

causal events leading to the incident. Models now tend to include additional factors

in the wider circumstances of the incident.

Model of incident causation

The Nature of Error

An essential component of incident prevention, therefore, is gaining an

understanding of the nature, timing and causes of error. One of the important and

unique characteristics of error, distinguishing it from other factors involved in

incidents, is that error is a normal part of behaviour. Error plays a fundamental role

in learning new skills and behaviours and in maintaining those behaviours. Through

testing the boundaries of interactions with the environment, and consequently

making errors, humans learn just what the boundaries are. This is essential not only

for learning a new skill but also for updating and maintaining ones they have already

learned. The degree to which humans test the boundaries of their skills is related to

the level of risk that they are prepared to accept.

It seems that errors are a constant feature of all behaviour. Studies show also that

they occur in the causes of approximately two-thirds of work-related fatal incidents.

It is essential therefore to develop some ideas about the form they are likely to take,

and when and why they might occur. While there are many aspects of human error

that are not yet understood, our current level of understanding allows some

predictions to be made about error types. Knowledge of these types of error will, it is

to be hoped, guide our efforts to prevent error or at least to modify the adverse

consequences of error.

One of the most important features of the nature of error is that it is not a unitary

phenomenon. Even though traditional incident analysis often treats error as if it were

a singular entity which cannot be dissected further, there are a number of ways that

errors can occur. Errors differ depending on the information-processing function

being challenged.

A second characteristic of errors is that they are not novel or random. Error forms

are limited. They take similar forms in all types of functions. This means that the

error forms that occur in everyday life in the kitchen, for example, occur in the same

manner in the most high-risk industries. The consequences of these errors, however,

are very different and are determined by the setting in which the error occurs, rather

than by the nature of the error itself.

These categorizations of error distinguish between those occurring during skilled

behaviour (slips, lapses or unintended acts) and those occurring during unskilled or

problem-solving behaviour (mistakes).

Slips or skill-based errors are defined as unintended errors occurring when the

behaviour is a highly practiced routine or automatic in nature.

Mistakes have been further categorized into two types:

� rule-based errors, which occur when the behaviour requires the application of rules

� knowledge-based errors, which occur during problem solving when the person has

no skill or rule to apply.

This means that knowledge-based errors occur through lack of expertise, rule-based

Elaboration of the involvement of human factors other than human error in the

circumstances immediately surrounding the incident represents a major advance in

understanding incident genesis. While there is no question that error is present in

most incident sequences, human factors are also involved in a broader sense, taking

the form, for example, of standard operating work procedures and the influences that

determine the nature and acceptability of work procedures, including the earliest

decisions of management.

The conventional view of incidents as a number of things suddenly going wrong at

the time and the place of the incident, concentrates attention on the overt

measurable event at the time of the incident.

Thus, to understand how incidents occur, how people contribute to them and why

they behave the way that they do, it is necessary to ensure that analysis does not

begin and end with the circumstances that most directly and immediately lead to

harm.

In acknowledging the potential aetiological significance of the wider circumstances

surrounding the incident, the model best describing incident causation has to take

into account the relative timing of elements and how they relate to each other.

First, causal factors vary in terms of their causal importance, and also in terms of

their temporal importance. Furthermore, these two dimensions can vary

independently; that is, causes can be important because they occur very close in

time to the incident and therefore they reveal something about the time of the

incident, or they can be important because they are a prime cause underlying the

incident, or both. Second, incidents are generally agreed to be multicausal. Human,

technical and environmental components in the work system can interact in critical

ways. Third, these two considerations, the nature of the event and the nature of its

contribution to the incident, interact. Although multiple causes are always present,

they are not equivalent in role.

Effective prevention would be best served if it were targeted towards the latent

underlying causes, rather than the immediately precipitating factors. This level of

understanding of the causal network and how it influences outcome is possible only

if all types of factors are included for consideration, their relative timing is examined

and their relative importance is determined.

The first is the notion that people have a target level of risk—that is, the level of risk

they accept, tolerate, prefer, desire or choose. The target level of risk depends on

perceived benefits and disadvantages of safe and unsafe behaviour alternatives, and

it determines the degree to which they will expose themselves to safety and health

hazards.

The second premise is that the actual frequency of lifestyle-dependent death,

disease and injury is maintained over time through a closed-loop, self-regulating

control process. Thus, fluctuations in the degree of caution people apply in their

behaviour determine the ups and downs in the loss to their health and safety.

Moreover, the ups and downs in the amount of actual lifestyle-dependent loss

determine the fluctuations in the amount of caution people exercise in their

behaviour.

Finally, the third premise holds that the level of loss to life and health, in so far as

this is due to human behaviour, can be decreased through interventions that are

effective in reducing the level of risk people are willing to take—that is, not through

measures of the “safe cigarette” variety or other such efforts towards a

“technological fix” of the problem, but by means of programs that enhance people’s

desire to be alive and healthy.

Homeostatic model relating changes in incident loss to changes in operator

behaviour and vice versa, with the target level of risk as the controlling variable

In principle, there are four ways in which workers and drivers may be motivated to

lower their target level of risk:

� Reduce the expected benefits of risky behaviour alternatives.

� Increase the expected costs of risky behaviour alternatives.

� Increase the expected benefits of safe behaviour alternatives.

� Decrease the expected costs of safe behaviour alternatives.

While some of these approaches have been found to be more effective than others,

the notion that safety may be enhanced by acting upon motivation has a long history,

as is obvious from the universal presence of punitive law.

Punishment

Although enforcement of punitive law is one of society’s traditional attempts at

motivating people towards safety, the evidence for its effectiveness has not been

forthcoming. First is the “self-fulfilling prophecy” effect of attribution. For example,

labelling people with undesirable characteristics may stimulate individuals to

behave as if they had these characteristics. Treat people as if they were

irresponsible and eventually some will behave as if they were.

Second, the emphasis is on process controls; i.e., on specific behaviours such as

using a piece of safety equipment or obeying the speed limit, instead of focusing on

the end result, which is safety. Process controls are cumbersome to design and

implement, and they can never totally encompass all undesirable specific behaviours

of all people at all times.

Third, punishment brings negative side-effects. Punishment creates a dysfunctional

organizational climate, marked by resentment, uncooperativeness, antagonism and

even sabotage. As a result, the very behaviour that was to be prevented may in fact

be stimulated.

Encouragement

In contrast to punishment, incentive programs have the effect for which they are

intended, as well as the positive side-effect of creating a favourable social climate .

Behavioural Adaptation

According to risk homeostasis theory, the incident rate per person-hour of task

performance or the annual incident rate per head of population do not primarily

depend upon a person’s ability to be safe, nor upon the opportunity to be safe, but

instead upon that person’s desire to be safe.

Humans play important roles in most of the processes leading up to incidents and in

the majority of measures aimed at incident prevention. Therefore, it is vital that

models of the incident process should provide clear guidance about the links

between human actions and incidents. Only then will it be possible to carry out

systematic incident investigation in order to understand these links and to make

predictions about the effect of changes in the design and layout of workplaces, in

the training, selection and motivation of workers and managers, and in the

organization of work and management safety systems.

Individual problem solving in the face of danger

Danger is considered to be always present, but kept under control by a large number

of incident-prevention measures linked to hardware (e.g., the design of equipment

and safeguards), people (e.g., skilled operators), procedures (e.g., preventive

maintenance) and organization (e.g., allocation of responsibility for critical safety

tasks). Provided that all relevant dangers and potential hazards have been foreseen

and the preventive measures for them have been properly designed and chosen, no

damage will occur.

The Hale and Glendon model conceptualizes the role of human action in controlling

danger as a problem-solving task.

Problem-solving cycle

Hence safety management systems can be modelled in a consistent way with human

behaviour, allowing the designer or evaluator of safety management to take an

appropriately focused or a wide view of the interlocking tasks of different levels of

an organization.

Behaviour in the face of danger

These situations of imminent danger are rare in most industries, and it is normally

desirable to activate workers to control danger when it is much less imminent.

To ensure the appropriate quality of alertness, they must accustom themselves to

recognize potential incident scenarios—that is, indications and sets of indications

that could lead to loss of control and so to damage. This is partly a question of

understanding webs of cause and effect, such as how a process can get out of

control, how noise damages hearing or how and when a trench can collapse.

Just as important is an attitude of creative mistrust. This involves considering that

tools, machines and systems can be misused, go wrong, or show properties and

interactions outside their designers’ intentions. It applies “Murphy’s Law” (whatever

can go wrong will go wrong) creatively, by anticipating possible failures and

affording the opportunity of eliminating or controlling them. Such an attitude,

together with knowledge and understanding, also helps at the next step—that is, in

really believing that some sort of danger is sufficiently likely or serious to warrant

action.

Skill-based. The skill-based level is highly reliable, but subject to lapses and slips

when disturbed, or when another, similar routine captures control. The responses

are so automatic that workers may not even be aware that they are actively

controlling danger with them.

Rule-based. The rule-based level is concerned with choosing from a range of known

routines or rules the one which is appropriate to the situation—for example,

choosing which sequence to initiate in order to close down a reactor which would

otherwise become overpressurized, selecting the correct safety goggles to work

with acids (as opposed to those for working with dusts ), or deciding, as a manager,

to carry out a full safety review for a new plant rather than a short informal check.

Errors here are often related to insufficient time spent matching the choice to the

real situation, to relying on expectation rather than observation to understand the

situation, or to being misled by outside information into making a wrong diagnosis.

Knowledge-based. The knowledge-based level is engaged only when no pre-existing

plans or procedures exist for coping with a developing situation. This is particularly

true of the recognition of new hazards at the design stage, of detecting unsuspected

problems during safety inspections or of coping with unforeseen emergencies.

Surry’s model

The WEF model It provides for self-correcting safety systems by means of the

feedback of results from studied incidents.

Hence, it becomes irrelevant and misleading to ask whether people know how to

avoid (and choose to avoid) something which is not really avoidable unless they

decide to quit their job.

� The model provides no insight into the important issue of why the dangerous

activity was necessary to begin with, and why it was performed by the specific

individual. Sometimes dangerous tasks can be made unnecessary; and sometimes

they can be performed by other, more appropriate persons with greater skills.

� The analysis is restricted to a single person, but many incidents occur in

interaction between two or more persons. However, it was suggested that this

deficiency could be overcome by combining the results of parallel analyses, each

made from the perspective of one of the different individuals involved. A tentative

comprehensive model, based on Surry’s original design and including these

additional elements, Tentative comprehensive model on incident causation

Deviations

The definition of deviations in relation to specified requirements coincides with the

definition of nonconformities in the International Organization for Standardization’s

ISO 9000 series of standards on quality management . The value of a systems

variable is classified as a deviation when it falls outside a norm. Systems variables

are measurable characteristics of a system, and they can assume different values.

Norms

There are four different types of norms. These relate to: (1) specified requirements,

(2) what has been planned, (3) what is normal or usual and (4) what is accepted.

Each type of norm is characterized by the way it has been established and its degree

of formalization.

Safety regulations, rules and procedures are examples of specified requirements. A

typical example of a deviation from a specified requirement is a “human error”,

which is defined as a transgression of a rule. The norms that relate to what is

“normal or usual” and what is “accepted” are less formalized. They are typically

applied in industrial settings, where the planning is oriented to outcome and the

execution of the work is left to the discretion of the operators.

The Time Dimension

Time is a basic dimension in the deviation model. An incident is analysed as a

process rather than as a single event or a chain of causal factors. The process

develops through consecutive phases, so that there is a transition from normal

conditions in the industrial system to abnormal conditions or a state of lack of

control. Subsequently, a loss of control of energies in the system occurs and the

damage or injury develops.

Analysis of an incident at a construction site on the basis of the OARU model

A distinction is made between corrective and preventive actions. Correction of

deviations coincides with the first order of feedback in Van Court Hare’s hierarchy of

feedback, and does not result in any organizational learning from the incident

experiences. Preventive actions are accomplished through higher orders of feedback

that involve learning.

Examples of taxonomies for the classification of deviations

Theory or model and variable Classes

Process model

Duration Event/act, condition

Phase of the incident sequence Initial phase, concluding phase, injury phase

Systems theory

Subject-object (Act of) person, mechanical/physical

condition

Systems ergonomics Individual, task, equipment, environment

Industrial engineering Materials, labour power, information,

technical, human, intersecting/parallel

activities, stationary guards, personal

protective equipment

Human errors

Human actions Omission, commission, extraneous act,

sequential error, time error

Energy model

Type of energy Thermal, radiation, mechanical, electrical,

chemical

Type of energy control system Technical, human

Consequences

Type of loss No significant time loss, degraded output

quality, equipment damage, material loss,

environmental pollution, personal injury

Extent of loss Negligible, marginal, critical, catastrophic

Application of the Deviation Model

The coverage of different tools for use in safety practice

For example, Safety sampling is a method for the control of deviations from safety

rules through performance feedback to the workers. Positive effects of safety

sampling on safe performance, as measured by the risk of incidents, have been

reported.

THE MERSEYSIDE INCIDENT INFORMATION MODEL

MAIM, the Merseyside Incident Information Model, which is most naturally adapted

to the second purpose—recording and storing incident information. Following an

outline of the rationale for MAIM, some early studies evaluating the model are

described. The article ends with recent progress with MAIM, including the use of

“intelligent software” to collect and analyses information on injury incidents.

A simple example illustrates the problem. A worker slips on a patch of oil, falls and

strikes his or her head on a machine and suffers a concussion. We can easily

distinguish the (immediate) cause of the incident (slipping on oil) and the cause of

the injury (hitting the head on the machine). Some classification systems, however,

include the categories “falls of persons” and “striking against objects”. The incident

could be allocated to either of these, although neither describes even the immediate

cause of the incident (slipping on oil) or causal factors (such as how did the oil get

on the floor).

The MAIM Incident Model

The behaviour of the equipment or person is described by the general activity at the

time and a more specific description of the type of corporal movement when the first

event occurred.

The example of a worker who slips on a patch of oil, falls and hits his or her head

provides an illustration. The first event is “foot slipped”—instead of remaining still,

the foot acquires kinetic energy. The second event is “fell”, when further kinetic

energy is acquired. This energy is absorbed by the collision of the worker’s head with

the machine when the injury occurs and the sequence ends. This can be “plotted”

onto the model as follows:

1. 1st event: foot slipped on oil.

2. 2nd event: person fell.

3. 3rd event: head struck against machine.

A number of principles guide the selection and implementation of prevention

measures in a public health approach to injury control. These include:

(1) The importance of basing prevention measures on prior assessment and

evaluation. The first principle acknowledges the importance of selecting

interventions that are targeted to have a high impact on community health status

and are likely to be successfully implemented. Thus, interventions selected on the

basis of a thorough assessment phase, rather than merely common sense, are more

likely to be effective. Interventions that have been demonstrated as effective in the

past are even more promising.

(2) The relative importance of control measures that automatically protect the

worker. The second principle emphasizes the continuum between active and passive

protection. Active protection is that which requires constant repetitive individual

action; passive protection offers relatively automatic protection. For example, seat-

belts require individual action to initiate protection each time someone gets into a

vehicle. An air bag, on the other hand, bestows protection on a vehicle occupant

without any initiating action—it automatically protects that person. Active

interventions require modifying and sustaining individual behaviour change, which

has been the least successful of injury prevention strategies to date. This principle is

similar to the traditional hierarchy of controls in occupational safety which

emphasizes the importance of engineering controls over administrative controls,

personal protective equipment and training.

(3) The importance of behaviour modification rather than education. The third

principle recognizes the importance of behaviour modification and that not all

hazards can be engineered out of the environment at the manufacturing stage.

Modification of the behaviour of employers, managers and employees is central, not

only to the installation and maintenance of passive protection, but to most other

occupational injury control strategies as well. Another important aspect of this

principle is that classroom instruction, posters, pamphlets and other forms of

education that merely seek to increase knowledge, usually have little effect on

behaviour when used alone.

The Haddon Matrix reveals that interventions targeted at humans, the vehicles

which can transfer damaging energy (e.g., cars, machinery), or the physical or

psychosocial environment may operate to control injury in the pre-event, event or

post-event phases.

The Haddon Matrix applied to motor vehicle injuries

Phases Factors

Human Vehicles and

equipment

Environment

Pre-event Educate public in the

use of seat-belts and

child restraints

Safe brakes and tires Improved road

design; restrict

alcohol advertising

and availability at

gas stations

Event Prevention of

osteoporosis to

decrease likelihood of

fracture

Air bags and a

crashworthy vehicle

design

Breakaway utility

poles and crash

barriers

Post-event Treatment of

haemophilia and other

conditions that result

in impaired healing

Safe design of fuel

tank to prevent

rupture and fire

Adequate emergency

medical care and

rehabilitation

Haddon’s Ten Countermeasure Strategies shows how these strategies can be

applied to controlling injury from falls in construction. As shown, not all strategies

will be applicable for specific problems.

Countermeasure Intervention (and relevant notes)

Prevent the creation of the hazard. Do not construct buildings—generally

not a practical option, to be sure.

Reduce the amount of the hazard

brought into being.

Lower the height of construction

project to below fatal levels—usually

not practical, but may be possible in

some work zones.

Prevent the release of the hazard. Install non-slip walking surfaces on

roofs and other heights.

Modify the rate of release of the

hazard from its sources.

Use safety lanyards. Use safety nets.

Separate the hazard from the worker

by time and space.

Do not schedule unnecessary foot

traffic near fall hazards until the

hazards are abated.

Separate the hazard from the worker

by physical barriers.

Install guardrails on elevated surfaces.

Modify basic qualities of the hazard. Remove sharp or protruding

projections on the ground surface

where workers can fall—practical only

for very low heights.

Make worker as injury resistant as

possible.

Require, e.g., safety helmets.

Begin to counter damage done by the

hazard.

Apply first aid.

Stabilize, treat and rehabilitate

worker.

Develop a regionalized trauma system;

provide for effective rehabilitation and

retraining.

Assessing the injury problem and establishing an ongoing surveillance system was

an essential part of this and earlier studies of injuries on oil rigs that were conducted

by these authors. The subsequent development of a simple engineering prevention

strategy was then followed by a rigorous evaluation strategy which included an

evaluation of cost savings.

Theory of Job Safety

Job safety involves the interrelationship between people and work; materials,

equipment and machinery; the environment; and economic considerations such as

productivity. Ideally, work should be healthful, not harmful and not unreasonably

difficult. For economic reasons, as high a level of productivity as possible must be

achieved.

Job safety should start in the planning stage and continue through the various

phases of production. Accordingly, requirements for job safety must be asserted

before work begins and be implemented throughout the work cycle, so that the

results can be appraised for purposes of feedback, among other reasons. The

responsibility of supervision toward maintaining the health and safety of those

employed in the production process should also be considered during planning. In

the manufacturing process, people and objects interact.

Worker-Job Relationships

The following three possible relationships within the manufacturing process indicate

how personal injury incidents (especially incidents) and harmful working conditions

are unintended effects of combining people and the objective working environment

for the purpose of production.

1. The relationship between the worker and the objective working environment is

optimal. This means well-being, job safety and labour-saving methods for the

employees as well as the reliability of the objective parts of the system, like

machines. It also means no defects, incidents, incidents, near misses (potential

incidents) or injuries. The result is improved productivity.

2. The worker and the objective working environment are incompatible. This may be

because the person is unqualified, equipment or materials are not correct for the job

or the operation is poorly organized. Accordingly, the worker is unintentionally

overworked or underutilized. Objective parts of the system, like machines, may

become unreliable. This creates unsafe conditions and hazards with the potential for

near misses (near incidents) and minor incidents resulting in delays in production

flow and declining output.

3. The relationship between the worker and the objective working environment is

completely interrupted and a disruption results, causing damage, personal injury or

both, thereby preventing output. This relationship is specifically concerned with the

question of job safety in the sense of avoiding incidents.

Principles of Workplace Safety

Because it is apparent that questions of incident prevention can be solved not in

isolation, but only in the context of their relationship with production and the

working environment, the following principles for incident prevention can be derived:

1. Incident prevention must be built into production planning with the goal of

avoiding disruptions.

2. The ultimate goal is to achieve a production flow that is as unhindered as

possible. This results not only in reliability and the elimination of defects, but also in

the workers’ well-being, labour-saving methods and job safety.

Some of the practices commonly used in the workplace to achieve job safety and

which are necessary for disruption-free production include, but are not limited to the

following:

� Workers and supervisors must be informed and aware of the dangers and potential

hazards (e.g., through education).

� Workers must be motivated to function safely (behaviour modification).

� Workers must be able to function safely. This is accomplished through certification

procedures, training and education.

� The personal working environment should be safe and healthy through the use of

administrative or engineering controls, substitution of less hazardous materials or

conditions, or by the use of personal protective equipment.

� Equipment, machinery and objects must function safely for their intended use, with

operating controls designed to human capabilities.

� Provisions should be made for appropriate emergency response in order to limit the

consequences of incidents, incidents and injuries.

The following principles are important in understanding how incident prevention

concepts relate to disruption-free production:

1. Incident prevention is sometimes considered a social burden instead of a major

part of disruption prevention. Disruption prevention is a better motivator than

incident prevention, because improved production is expected to result from

disruption prevention.

2. Measures to ensure workplace safety must be integrated into the measures used

to ensure disruption-free production. For example, the instructions on hazards must

be an integral part of the general directions governing the flow of production at the

workplace.

Incident Theory

An incident (including those that entail injuries) is a sudden and unwanted event,

caused by an outside influence, that causes harm to people and results from the

interaction of people and objects.

Often the use of the term incident in the workplace is linked with personal injury.

Damage to a machine is often referred to as a disruption or damage, but not an

incident. Damage to the environment is often called an incident. Incidents, incidents

and disruptions which do not result in injury or damage are known as “near

incidents” or “near misses”. So while it may be considered appropriate to refer to

incidents as cases of injury to workers and to define the terms incident, disruption

and damage separately as they apply to objects and the environment, in the context

of this article they will all be referred to as incidents.

The conceptual model for the term incident indicates that workplace incidents occur

from workers and objects interacting with each other through the release of energy.

The cause of an incident can lie in the characteristics of the injured worker (e.g., not

capable of performing the work safely) or of the object (e.g., unsafe or unsuitable

equipment). The cause can also be another worker (providing erroneous information),

supervisor (receiving incomplete job instructions) or trainer (receiving incomplete or

incorrect training). The following can be derived for incident prevention:

Potential Hazards and Risks

Although a hazard or danger may exist in an object, if the worker and the object are

so separate from one another that they cannot come into contact, no incident is

possible. The risks of incidents are different in various workplaces, under various

conditions. For example, the risks involved in drilling for oil, using the same workers

and identical equipment, differ widely depending on the geography (drilling on land or

off shore) and the climate (Arctic exploration or deserts). The level of incident risk

depends on:

� the anticipated frequency of error of the worker and the technology (number per 1

million hours, etc.)

� the probability of the errors resulting in incidents (incident: error = 1:x)

� the probability of the seriousness level of the incident.

The acceptance of incident risks also varies widely. High incident risk appears to be

acceptable in road traffic whereas a zero base tolerance is expected in the field of

nuclear energy. For purposes of incident prevention, it therefore follows that the

driving force is the smallest possible acceptance of incident risk.

Causes of Incidents

The occurrence of an incident requires classification on a scale from cause to effect.

Three levels must be differentiated:

� the level of the causes of possible and actual incidents

� the level of the incident’s origins

� the level of the incident’s consequences in the form of personal and material

damages.

Cause is the reason for the incident. Almost every incident has multiple causes such

as hazardous conditions, combinations of factors, courses of events, omissions and

so on. It is important to differentiate the factors associated with the production

process from the incident causes linked to workers (conduct of the immediate

operator), the organization (safe work procedures or policies) and technical incident

causes (environmental changes and object failures). However, in the final analysis,

every incident results from faulty conduct of people, because people are always at

the end of the causal chain. For example, if faulty material is determined to be the

cause of a boiler bursting, then improper conduct existed either on the part of the

builder, manufacturer, tester, installer or owner (e.g., corrosion due to inadequate

maintenance).

Effect of Strains and Demands

Mechanization and automation of production processes have advanced considerably

in recent years. It may appear that the causes of many incidents have shifted from

human error to those related to the maintenance of and interface with automated

processes. However, these positive consequences of technology are counterposed

to other, negative ones, particularly the increase in psychological strains and

corresponding ergonomic physical demands on workers in automated plants due to

the increased attention and responsibility required for overseeing the automated

operations process, impersonal working environment and monotony of work. These

strains and corresponding demands increase the occurrence of incidents and can be

harmful to health.

1. Strains are effects on workers which originate in the workplace, such as

environmental strains (temperature, heat, humidity, light, noise and air pollution), or

they can be static or dynamic strains originating directly from the work process

(lifting, climbing, chemical exposure and so on). Strain levels can be physically

measured (noise, force, atmospheric exposures and so on), whereas strain factors

are physically unmeasurable influences (fatigue, mental stress, plant

worker/management relationships and so on).

2. Demands on workers are dependent on the type and degree of the strain as well

as differing individual capability to withstand the strain. Effects of demands show up

physically and psychologically in the human body. The effects of the demands can be

desirable or undesirable, depending on the type and degree. Undesirable effects,

such as physical and psychological exhaustion, work aggravations, illness, lack of

coordination and concentration, and unsafe behaviour cause increased risk of

incident.

Near Incidents (Near Misses)

A large part of production loss results from disruptions in the form of near misses

(near incidents), which are the basis of occurrences of incidents. Not every

disruption affects work safety. Near incidents (near misses) are those occurrences

or incidents in which no injury or damage resulted, but if injury or damage had

occurred, they would be classified as incidents.

Incident Pyramid

Incidents are relatively rare occurrences, and usually the more serious the incident,

the more rare the occurrence. Near incidents form the bottom, or base, of the

incident pyramid, whereas fatal incidents stand at the top. If lost time is used as a

criterion for the seriousness of incidents, we find a relatively high degree of

correspondence with the incident pyramid. (There may be a slight deviation as a

result of the reporting requirements of different countries, companies and

jurisdictions.)

From the incident pyramid, it follows for purposes of incident prevention that:

1. Incident prevention begins with avoiding near incidents (near misses).

2. Eliminating minor incidents usually has a positive effect on eliminating serious

incidents.

Incident Prevention

The different paths of incident prevention for ensuring workplace safety are as

follows:

1. Eliminate the hazard or danger so that injury or damage is no longer possible.

2. Provide for separation between the worker (or equipment) and the hazard (equal to

elimination of the hazard). The danger remains, but an injury (or damage) is not

possible since we make sure that the natural zones of influence of workers

(equipment) and object (hazard or danger) do not intersect.

3. Provide shielding, such as fireproofing, protective clothing and respirators to

minimize the hazard. The hazard still exists, but the possibility of an injury or

damage is reduced by minimizing the chances of the hazard having an effect by

shielding the danger.

4. Adapt to the hazard by providing measures such as warning systems, monitoring

equipment, information about dangers, motivation for safe behaviour, training and

education.

Four Stages of the Incident Sequence

Task stage in incident sequence

Prior to task Routine task

performance

Abnormal task

conditions

Incident

conditions

Objectives

(Behavioural)

Educate and

persuade worker of

the nature and

level of risk,

precautions,

Instruct or

remind

worker to

follow safe

procedures

Alert worker of

abnormal

conditions.

Specify needed

actions.

Indicate

locations of

safety and first

aid equipment,

exits and

remedial measures

and emergency

procedures.

or take

precautions.

emergency

procedures.

Specify remedial

and emergency

procedures.

Example

sources

Training manuals,

videos or

programs, hazard

communication

programs, material

safety data sheets,

safety propaganda,

safety feedback

Instruction

manuals, job

performance

aids,

checklists,

written

procedures,

warning

signs and

labels

Warning

signals: visual,

auditory, or

olfactory.

Temporary

tags, signs,

barriers or

lock-outs

Safety

information

signs, labels, and

markings,

material safety

data sheets

First stage. At the first stage in the incident sequence, sources of information

provided prior to the task, such as safety training materials, hazard communication

program and various forms of safety program materials (including safety posters and

campaigns) are used to educate workers about risks and persuade them to behave

safely.

Second stage. At the second stage in the incident sequence, sources such as written

procedures, checklists, instructions, warning signs and product labels can provide

critical safety information during routine task performance.

Third stage. At the third stage in the incident sequence, highly conspicuous and

easily perceived sources of safety information alert workers of abnormal or

unusually hazardous conditions.

Fourth stage. At the fourth stage in the incident sequence, the focus is on expediting

worker performance of emergency procedures at the time an incident is occurring, or

on the performance of remedial measures shortly after the incident. Safety

information signs and markings conspicuously indicate facts critical to adequate

performance of emergency procedures (e.g., the locations of exits, fire

extinguishers, first aid stations, emergency showers, eyewash stations or

emergency releases). Product safety labels and SDSs may specify remedial and

emergency procedures to be followed.

Summary of recommendations within selected warning systems such as GHS

pictograms and standards in general for worker ease of understanding

System Signal words Colour

coding

Typograp

hy

Symbols Arrangement

ANSI Z129.1

Hazardous

Industrial

Chemicals:

Precautionar

y Labeling

(1988)

Danger

Warning

Caution

Poison

optional

words for

“delayed”

hazards

Not

specified

Not

specified

Skull-and-

crossbones

as

supplement

to words.

Acceptable

symbols for

3 other

hazards

types.

Label

arrangement

not specified;

examples given

ANSI Z535.2

Environment

al and

Facility

Safety Signs

(1993)

Danger

Warning

Caution

Notice

(general

safety)

(arrows)

Red

Orange

Yellow

Blue

Green

as above;

black and

white

otherwise

per ANSI

Z535.1

Sans

serif,

upper

case,

acceptabl

e

typefaces

, letter

heights

Symbols

and

pictographs

per ANSI

Z535.3

Defines signal

word, word

message,

symbol panels

in 1 to 3 panel

designs. 4

shapes for

special use.

Can use ANSI

Z535.4 for

uniformity.

ANSI Z535.4

Product

Safety Signs

and Labels

(1993)

Danger

Warning

Caution

Red

Orange

Yellow

per ANSI

Z535.1

Sans

serif,

upper

case,

suggeste

d

typefaces

, letter

heights

Symbols

and

pictographs

per ANSI

Z535.3; also

SAE J284

safety alert

symbol

Defines signal

word, message,

pictorial panels

in order of

general to

specific. Can

use ANSI

Z535.2 for

uniformity. Use

ANSI Z129.1 for

chemical

hazards.

NEMA

Guidelines:

NEMA 260

(1982)

Danger

Warning

Red

Red

Not

specified

Electric

shock

symbol

Defines signal

word, hazard,

consequences,

instructions,

symbol. Does

not specify

order.

SAE J115

Safety Signs

(1979)

Danger

Warning

Caution

Red

Yellow

Yellow

Sans serif

typeface,

upper

case

Layout to

accommoda

te symbols;

specific

symbols/

pictographs

not

prescribed

Defines 3 areas:

signal word

panel, pictorial

panel, message

panel. Arrange

in order of

general to

specific.

ISO

Standard:

ISO R557

(1967); ISO

3864 (1984)

None. 3

kinds of

labels:

Stop/prohibiti

on

Mandatory

action

Warning

Red

Blue

Yellow

Message

panel is

added

below if

necessar

y

Symbols

and

pictographs

Pictograph or

symbol is

placed inside

appropriate

shape with

message panel

below if

necessary

OSHA

1910.145

Specification

for Incident

Prevention

Signs and

Tags (1985)

Danger

Warning

(tags only)

Caution

Biological

Hazard,

BIOHAZARD,

or symbol

(safety

instruction)

(slow-moving

vehicle)

Red

Yellow

Yellow

Fluorescent

Orange/oran

ge-red

Green

Fluorescent

yellow-

orange and

dark red per

ANSI Z535.1

Readable

at 5 feet

or as

required

by task

Biological

hazard

symbol.

Major

message

can be

supplied by

pictograph

(tags only).

Slow-

moving

vehicle

(SAE J943)

Signal word and

major message

(tags only)

OSHA

1910.1200

(Chemical)

Hazard

Communicati

on (1985)

Per

applicable

requirements

of EPA, FDA,

BATF, and

CPSC; not

otherwise

specified.

In English Only as Material

Safety Data

Sheet

Westinghous

e Handbook

(1981); FMC

Danger

Warning

Caution

Red

Orange

Yellow

Helvetica

bold and

regular

Symbols

and

pictographs

Recommends 5

components:

signal word,

Guidelines

(1985)

Notice Blue weights,

upper/low

er case

symbol/pictogra

ph, hazard,

result of

ignoring

warning,

avoiding hazard

Cognitive guidelines

Design specifications, such as those discussed above, can be useful to developers of

safety information. However, many products and situations are not directly

addressed by standards or regulations. Certain design specifications may not be

scientifically proven, and, in extreme cases, conforming with standards and

regulations may actually reduce the effectiveness of safety information. To ensure

effectiveness, developers of safety information consequently may need to go beyond

safety standards.

A model for designing and evaluating product information

Workers who are the victims of work-related incidents suffer

from material consequences, which include expenses and loss of earnings, and from

intangible consequences, including pain and suffering, both of which may be of short

or long duration. These consequences include:

� doctor’s fees, cost of ambulance or other transport, hospital charges or fees for

home nursing, payments made to persons who gave assistance, cost of artificial

limbs and so on

� the immediate loss of earnings during absence from work (unless insured or

compensated)

� loss of future earnings if the injury is permanently disabling, long term or precludes

the victim’s normal advancement in his or her career or occupation

� permanent afflictions resulting from the incident, such as mutilation, lameness,

loss of vision, ugly scars or disfigurement, mental changes and so on, which may

reduce life expectancy and give rise to physical or psychological suffering, or to

further expenses arising from the victim’s need to find a new occupation or interests

� subsequent economic difficulties with the family budget if other members of the

family have to either go to work to replace lost income or give up their employment

in order to look after the victim. There may also be additional loss of income if the

victim was engaged in private work outside normal working hours and is no longer

able to perform it.

� anxiety for the rest of the family and detriment to their future, especially in the

case of children.

Workers who become victims of incidents frequently receive compensation or

allowances both in cash and in kind. Although these do not affect the intangible

consequences of the incident (except in exceptional circumstances), they constitute

a more or less important part of the material consequences, inasmuch as they affect

the income which will take the place of the salary. There is no doubt that part of the

overall costs of an incident must, except in very favorable circumstances, be borne

directly by the victims.

When passing from the abstract concept of an undertaking to the concrete reality of

those who occupy senior positions in the business (i.e., the employer or the senior

management), there is a personal incentive which is not only financial and which

stems from the desire or the need to further their own career and to avoid the

penalties, legal and otherwise, which may befall them in the case of certain types of

incident.