P e e r -R e v ie w e d O p tim iz in g Safety Engineering, Systems, Human Factors: Part 1 By Vladimir Ivensky T safety program is to reduce or eliminate in cidents that result in harm to people or the environment. A more detailed definition of the goal (completely eliminate injuries, prevent serious in juries, provide workplace free from rec ognized hazards) and ways to achieve IN BRIEF that goal are the subjects of debates that P a r t 1 o f t h is a r t ic l e r e help to develop the safety profession, its v i e w s m is b a la n c e s t h a t c a n tools and strategies. The trends in occu o c c u r a m o n g th e m a jo r e l e pational injury rates indicate a growing m e n ts o f a c o m p r e h e n s iv e gap between declining minor to medium s a fe ty p ro g ra m (e n g in e e r severity incident rates and serious injury in g c o n t r o l s , m a n a g e m e n t and fatality rates that have not declined s y s te m s , h u m a n fa c to r s ), at the same pace (Mangan, 2015; Manup o te n tia lly a ffe c tin g th o s e ele, 2003). That finding is sparking re p r o g r a m s ' e f f e c t i v e n e s s in newed interest in searching for optimally p r e v e n tin g s e r io u s i n c i balanced safety programs that are effec d e n ts . tive in preventing serious incidents. dents by concentrating on preventing the more frequent minor ones? 3) If the main causes of incidents are known, can preventive strategies be focused accordingly and modified to be more effective? Errors in answering these questions would re sult in misplaced priorities, resources and ineffec tive safety programs. Modern occupational safety programs integrate many elements that simplistically can be classified into three major categories: 1) engineering and technical standards and rules; 2) management and operation systems; and 3) hu man factors (Figure 1). Examples for each category are provided briefly for illustration only. Engineering & Technical ASSE's name, which includes the word engi neers, implies that the engineering and technical component is at the core of the OSH profession. I t s p e c ific a lly r e v ie w s U.S. federal OSH regulations are mostly techni d e b a te s o n in c id e n t c a u s a C o n te n t o f a n O c c u p a tio n a l cal in nature, providing specifications for tasks or t io n a n d b e h a v io r -b a s e d S a fe ty P ro g ra m items such as scaffolds, guardrails, trench cave-in s a fe ty p ro g ra m s , a n d on th e The topics debated within the safety protection, de-energizing, confined space entry or a d v a n ta g e s a n d lim ita tio n s profession include, among others: personal fall arrest devices. For example, OSHA's o f th o s e p ro g ra m s . 1) What is the predominant cause of industry standard 29 CFR 1926.652 construction safety incidents (if it exists)unsafe acts, requires "safe access and egress to all excavations, unsafe conditions (uncontrolled workplace including ladders, steps, ramps or other safe means hazards), operations and management systems defi of exit for employees working in trench excavations 4 ft or deeper. These devices must be located with ciencies, or some other causes or their combinations? 2) Do minor and serious incidents have similar in 25 ft of all workers." Violating any of those (and causes and is it possible to prevent serious inci many similar) specifications constitutes an OSHA violation. It is illegal to allow employees to work in an environment that does not comply with OSHA regulations. Vladimir Ivensky, CSP, CIH, has more than 25 years' experience in OSH. He is a corporate vice president of safety, health and environment for a global multidis ciplinary consulting and construction management firm. Ivensky holds a master's degree and doctorate (equivalents) in Occupational Safety and Health and Envi ronmental Protection from the Rostov Civil Engineering Institute in the former Soviet Union. He is a professional member of ASSE's Philadelphia Chapter and an author of numerous peer-reviewed articles in a wide range of OSH topics. 36 PrufessionalSafety JANUARY 2017 www.asse.org Systems OSHA does not prescribe content for safety management systems. The regulations for the construction industry (29 CFR 1926) indicate that "it shall be the responsibility of the employer to ISTOCKPHOTO.COM/SGURSOZLU he ultim ate purpose of any occupational initiate and maintain such programs as may be necessary to comply with" the regulations. Safety management systems provide the organizational framework (such as project parties' safety roles and responsibilities) and requirements such as regular inspections of job sites, prohibition of equipment and tools that are not in compliance with the reg ulations, and requirement for the competent and trained machinery operators [1926.20(b)], Some state-plan agencies, most notably Cal/OSHA, have requirements for injury and illness prevention pro grams, which are occupational safety and health management systems. A typical safety management system includes el ements such as management leadership, employee participation, safety planning, implementation of safety plans, evaluation of performance and cor rective actions, and management review. Well-known illustrations of safety management systems' structure and content are presented in the following consensus standards: ANSI/AIHA/ASSE Z10-2012, Occupational Health and Safety Management Systems, provides management systems requirements and guidelines for OSH improvement. OHSAS 18001, Occupational Health and Safety Management Systems Requirements, an interna tional OHS management system specification. Another safety program that integrates safe ty management systems with technical safety is described in U.S. Army Corps of Engineers' EM 385-1-1, Safety and Health Requirements Manual. Section 1 of that manual, Program Man agement, provides detailed requirements for proj ect safety organization, planning, risk assessments, inspections, deficiencies tracking, hazard analysis, incident reporting, subcontractor selection and management, safety officers and personnel quali fications, and training. In addition, the manual provides mandatory content for a project-specific incident prevention plan, which constitutes a stan dard safety management system for the project. Human Factors Lack of effective management of human fac tors has been a contributing factor of many ma jor incidents including the Piper A lpha oil rig fire, Esso Longford gas explosion, the passenger ferry capsize at Zeebrugge, the Paddington rail crash at Ladbroke Grove, the explosion and fires at Texa co's Milford Haven plant, the Chernobyl nuclear explosion, the toxic gas release at Union Carbide's Bhopal pesticide plant, and the explosion at BP's Grangemouth refinery (HSE, 2005). For many of these major incidents, the human failure was not the sole cause but one of many causes, including technical and organizational failures that led to the final outcome (HSE, 2005). Human factors safety considerations must be integrated into compre hensive safety programs; it is important to estab lish optimal ways to control and mitigate human failures to prevent incidents. Behavior-based safety (BBS) focuses on unsafe behaviors (unsafe acts) of line workers, people who may eventually be involved in an incident and be injured. Many BBS programs are based on a presumption that the majority of incidents are caused by unsafe behaviors that if corrected would prevent an equivalent percentage of incidents. BBS programs are not regulatory driven. Multiple con sultancies produce branded BBS packages while other programs are custom-designed for specific companies. Discussion is ongoing in the OSH profession about incident causation and application of BBS, which this article discusses briefly. Specifically dis cussed are the causes of human failures, many of which are interrelated to systematic, management, operational and engineering deficiencies (while others can be intentional safety violations or habitwww.asse.org JA NUARY 2017 ProfessionalSafety 37 F IG U R E 1 Comprehensive Safety Program ual acts) leading to the necessity to apply a holistic approach to safety. Comprehensive OSH Program To implement an effective safety program, it is important first to ensure that it is correctly de signed and balanced (Figure 1): Emphasizing regulatory compliance would not guarantee a hazard- and incident-free workplace, as no regulation can envision the many combina tions of workplace circumstances that can lead to an incident. Properly designed management systems are necessary, but would not work without technical safety rules, technical knowledge, safety culture and safe behaviors. Safe behaviors are not a solution in situations where hazards are not recognized or understood, or where no systematic approach exists for safety management. Inevitable unintentional human er rors must be controlled by engineering and man agement systems. It would be logical to assume that an optimal balance exists between major elements of a safety program, and emphasizing any particular element may be detrimental to the overall success of a re sulting safety program. The scope, component bal ancing and scale of the comprehensive program and senior management support of the program formulate the safety culture and, ultimately, the effectiveness of the program. Improperly selected priorities, strategies and tactics not shared by the employees, disagreements on perceived safety risks and ways to control them, and communica tion gaps damage the safety culture and the pro gram effectiveness. BBS: Ongoing Discussions According to Manuele (2003), most BBS pro grams fall into one of two diverse schools of 3 8 ProfessionalSafety JANUARY 2017 www.asse.org thought. One advances a culture change model, the other advocates a workerfo cu sed b e h a v io r-b a se d model. Here we primarily discuss the worker-focused BBS program model. That model's main premises and features are summarized by United Steelworkers (2000) as follows: Almost all incidents re sult from unsafe acts. For every incident, there are many unsafe behaviors. Consultant-employer re lationship. Worker buy-in. Identify key unsafe be haviors. Train workers and man agement to observe workers. Perform observations. Provide feedback to move away from unsafe behavior. Record and use data from observations. Worker-focused BBS programs aim to identify, observe, modify and correct the unsafe behav iors that lead to unsafe acts that are supposedly the source of the significant majority of incidents. The work behavior observations and behavior changing interventions are typically performed by coworkers trained to formally observe work place behaviors, recognize safe and unsafe ac tions, counsel coworkers on how to work more safely, and reinforce safe behaviors. Observations are reported to a centralized database for analysis and continuous learning. These programs are in tended to be a no-blame, employee involvement process providing incentives for safe behaviors and discouraging unsafe acts through discipline and information sharing (personal information with held). Implementation and management of a BBS program involves significant efforts. Companies planning to implement BBS pro grams should be aware of the advantages and limi tations of these programs, and aware of ongoing discussions on BBS among OSH professionals. It might be easy to be confused by opposing opinions regarding the BBS programs. Is BBS a magic bullet, instrumental in achieving injury-free work environment? Geller's (2000) dis cussion of 10 myths about BBS addresses the idea that it is a magic bullet: In fact, there is \"magic\" involved. Behaviorbased safety stimulates and facilitates interde pendent teamwork, which leads to innovation and creative synergy. To watch this transforma tion at work is a magical process. But this magic does not come easily nor quickly. It happens with proper top-down support and bottom-up involvement. Expecting too much too soon from behavior-based safety can result in disappoint ment and a label of \"failure.\" Is BBS a completely wrong solution for effective ly preventing incidents and injuries at work? There comes a time when an idea is so preva lent it is accepted and applied without question. When this happens we are so conditioned to the correctness of it we fail to examine its basic premise. I believe we are at that point when it comes to behavior-based safety. At the risk of invoking the wrath of those safety professionals who advocate its use I am going to suggest it's time to re-examine the behavior-based safety (BBS) model. (Smith, 1999) F IG U R E 2 Allocating Safety Program Resources Based on Presumed Incident Cause Distribution Incident Causes Safety Budget Incident Causes Safety Budget Or, more recently: The [popular brand of BBS] program should be eliminated as soon as possible, because it's founded on a misguided management principle: \"If anything goes wrong around here, it must be the fault of the workers.'' In consultant-speak, this self-serving concept is called \"behavioral safety.\" (Monforton & Martinez, 2015) According to Geller (2016), "Behavioral safety has provided a platform for constructive debate, and the conflicting opinions have challenged the safety professional to learn more about the psy chology of injury prevention." Representatives from both camps may skew the op timal balance of a safety program one way or another. The well-chosen title of "The Steelworker Perspective on Behavioral Safety: Comprehensive Health and Safe ty vs. Behavior-Based Safety" (United Steelworkers, 2000) emphasizes the hazard of overwhelming applica tion of BBS. The union's position paper states that BBS skews the safety program, emphasizing the behavioral aspect and sacrificing other important elements. The same criticisms would be fair for safety sys tems that ignore hum an behavior aspects. This author suggests that while "the safety professional has to learn more about the psychology of injury prevention" (Geller, 2016), behavioral psycholo gists involved in OSH may benefit from learning more about the technical, engineering and opera tional aspects of safety to ensure the proper bal ance and the maximum effectiveness of a resulting producta comprehensive safety program. These concerns were summarized by HSE (2005) as follows: 1) Imbalance between engineering controls (hardware) and hum an issues, focusing only on engineering or only on hum an issues. 2) Focusing on behavioral aspects of personal safety rather than on control of major hazards. 3) Focusing on operator error at the expense of system and m anagem ent failures. The author adds that BBS programs may not dis tinguish between an error and violation, classify ing both as an unsafe act and ignoring the fact that most operator errors are unintentional and uncon trollable by an individual, and that their root causes may lay in m anagem ent and system failures. BBS: Unsafe Act as a Main Cause of Incidents An important theme is that the assumptions about accident causation that one carries around nP O'' n QJ C (D (/> o r-+ IT fD B e h a vio ral S a fe ty C o m p re h e n s iv e S a fe ty in one's head are critical to the manner in which one then organizes a corrective response. If you believe, for example, that accidents are almost always caused by \"stupid and careless work ers,\" then you will focus your efforts in accident prevention on \"policing workers\" close super vision, discipline and training will be your chief activities. If, on the other hand, you believe that the ultimate causes of accidents are the inappro priate policies, operations and structures within management, then you will address organiza tional problems such as responsibility, authority and accountability. (Strahlendorf, 2003) The percentage of workplace incidents attribut ed to unsafe acts by some practitioners is typically 88% or more. The origin of that num ber is linked to H.W. Heinrich's studies from the 1930s, which led to his famous 88:10:2 ratio of direct and proximate accident causes (i.e., 88% of accidents are attribut able to unsafe acts, 10% to unsafe conditions and 2% are unpreventable). This study is also a source of the motto that "there is no such thing as u n preventable incident" (2% are treated as statistical noise and the remaining 98% of incidents can be prevented by correcting unsafe behavior, 88%, and unsafe conditions, 10%). O ther studies provide a similar and even higher percentages of incidents caused by unsafe acts, at tributing up to 95% (Krause, 1997), 96% (DuPont) and 98% (Difford, 2012) of all occupational inci dents to unsafe acts. www.asse.org JANUARY 2017 ProfessionalSafety 3 9 The postulation that the overwhelming majority of incidents and injuries are caused by unsafe acts would logically imply that a similar proportion of available resources in OSH should be spent on ob serving, correcting and preventing these unsafe acts. The discussion here, therefore, is not purely philosophical; it is about safety program strate gies, resource allocation and directions for further improvement, as if the base premise that safety should almost exclusively focus on unsafe acts is incorrect, the safety resources will be allocated im properly (Figure 2). Several well-known researchers (Petersen, Manuele, Hopkins, Reason) point to complicated net works of underlying causes that lead to an incident, including safety management, operation systems failures and engineering controls failures. Heinrich's results were challenged by Manuele (2003) who concludes: The methodology used in arriving at those ra tios cannot be supported. Current causation knowledge indicates that the premise is invalid. The premise conflicts with the work of others. Among all of Heinrich's premises, application of these ratios has done the greatest harm, since they promote preventive efforts being focused on workers rather on the operating system. No matter what definitions they give for the term unsafe act, they immediately moved from those figures to addressing means of resolving the at-risk behavior of employees though behavior modification methods, with minimum or no con sideration of system casual factors. That's ab surd. (Manuele, 2003) 4 0 ProfessionalSafety JANUARY 2017 www.asse.org Behavioral Psychology Model The behavioral psychology model is one incident causation theory. A review of incident causation theories by Board of Canadian Registered Safety Professionals (BCRSP) discusses 24 such theories, and more exist. Following is the brief description of the behavioral psychology model: The Behavioral Psychology Model assumes that individuals are not receiving the right mix of positive rewards and negative sanctions to rein force safe behavior. This branch of psychology, which is somewhat outdated, treats the human mind like an unknowable \"black box.\" A work er's reluctance to wear protective equipment is not addressed as an issue of cognitive persua sion or as an issue of answering the worker's IS T O C K P H O T O .C O M /S G U R S O Z L U Several well-known researchers point to complicated networks of underlying causes that lead to an incident, including safety management, operation systems failures and engineering controls failures. The "mono-causality" of the BBS approach is pointed out by Hopkins (2006). As Reason (2000) and Hopkins (2006) illustrate, an almost infinite network of causes can contribute to an incident, all of them causes in the sense that, had they been dif ferent, the incident would likely not have occurred. While Manuele (2003) suggests that Heinrich's premise that 88% of occupational incidents are caused by unsafe acts is a "huge problem" as it makes the safety profession focus on the wrong priorities, Difford (2012) insists that multiple cau sation theory is disproved by him and revises Henrich's 88% to "a logical 98%." According to Difford (2012), the management failure as a cause of inci dents is a myth. The multiple causation theory and Difford's statement that "human behavior, suitably de fined will be the underlying cause of any accident" (natural phenomena aside) cannot coexist. Difford states that "organizations with systems that are in full legal compliance and that achieve 100% in their audit returns are simply awaiting an injuryproducing or environment-damaging accident." Difford, however, concurs that those systems must be in place. Tire logical questions are then: Why must those systems be in place? What role do they play? How much attention must be paid to management sys tems and engineering controls? BP's Comprehensive List of Causes incident root-cause analysis system utilized by many com panies classifies incident causes by immediate causes and system causes. It lists actions (four cate gories) and conditions (four categories) among the immediate causes, and personal factors (six catego ries) and job factors (nine categories) among the system causes. A total of 23 categories or immedi ate and system causes are further divided into mul tiple subcategories, providing almost 300 incident cause options for an investigator to choose from. This tool provides a good illustration of multiplicity of incident causes. The behavior category is listed among personal factors (such as physical capabil ity, physical conditions, mental state, mental stress and skill level). The Comprehensive List of Causes system allows for limitless combinations of various incident cause parameters. concerns, but is instead viewed as a problem of changing physical behaviorhabitswith assumption that a good attitude will follow the physical habit rather than the other way around. \"Behavior-based safety\" techniques are founded on behavioral psychology. An excellent source for the behavioral psychology approach is Scott Geller's text, The Psychology of Safety Hand book. . . . Behavior is motivated by its conse quences, not primarily by thinking and free will. Self-esteem, attitudes and intentions cannot be scientifically studied according to this approach, but behavior can be studied and controlled. As Geller states: The basic idea is that behavior can be objectively studied and changed by identify ing and manipulating environmental conditions (or stimuli) that immediately precede and follow a target behavior. The antecedent conditions (\"activators\") signal when behavior can achieve a pleasant consequence (a reward) or avoid an unpleasant consequence (a penalty). Therefore, activators direct behavior, and consequences determine whether the behavior will recur. Ac cordingly, people are motivated by the conse quences they expect to receive, escape or avoid after performing a target behavior. The concepts are summarized as the \"ABC Model\" activa tor-behavior-consequence. The ABC model decreases at-risk behaviors to avoid failures. (Strahlendorf, 2003) Unsafe Act: Error, Habit or Violation? While the percentage of incidents caused by un safe acts is debated, some percentage of incidents clearly involve a human actan error, a habitual action or an intentional safety violation. The error can be defined as "an unintentional deviation from an expected behavior" (Conklin, 2016), and a vio lation can be defined as a "deliberate, intentional act to evade a known policy or procedure require ment for personal advantage usually adopted for fun, comfort, expedience or convenience" (Conk lin, 2016). Under workers' compensation acts, will ful misconduct by an employee means that s/he intentionally performed an act with the knowledge that it was likely to result in serious injuries or with reckless disregard of its probable consequences. The reduction and elimination of unsafe acts is a legitimate but not a comprehensive strategy due to a simple fact that humans tend to make uninten tional errors. Human error studies form an extensive library. Dhillon (2013) provides a list of more than 500 publications on safety and human error. The human-error-proofed engineering controls would be the preferred solution. Human errors can be classi fied as operator errors, design errors, assembly errors, inspection errors, installation errors, handling errors, and maintenance errors (Dhillon, 2013). The safety incident implications of those errors can include a person involved in a particular task, other people in the vicinity of that task or users of the product damaged by an error at some manu facturing phase. HSE (2005) classifies unsafe acts into two major categories: intended actions and unintended ac tions (errors). Unintended actions (errors) are clas sified as: 1) slips: attention failures; 2) lapses: memory failures; 3) mistakes: rule-based (misapplication of a good rule or application of a bad rule) and knowledgebased (HSE, 2005). Intended actions can be: 1) mistakes (same as above); 2) violations. Violations can be: 1) routine: habitual deviation from regular practice; 2) exceptional/situational: nonroutine, directed by extreme/local circumstances; 3) acts of sabotage. The ABC model and related BBS programs ap pear to be more applicable to the category of intended actions than to errors due to slip of atten tion, memory failure or a mistake. Selecting quali fied personnel, providing training and controlling fatigue would lead to reduction of errors. Engineer ing controls would eliminate the effect of some er rors. In addition, the level of errors would probably not be affected by the level of safety culture in the group but rather by group members' competence, physical and mental condition and level of fatigue. The level of safety violations would be a function of safety culture plus additional factors. For example, habitual failure to wear PPE would be a function of a safety culture and availability of PPE. According to Reason (2000): The human error [or unsafe acts and related incident] problem can be viewed in two ways: the person approach and the system approach. Each has its model of error causation and each model gives rise to quite different philosophies of error management. The person approach focuses on the errors of individuals, blaming them for forgetfulness, in attention or moral weakness. The system approach concentrates on the conditions under which individuals work and tries to build defenses to avert errors or mitigate their effects. (Reason, 2000) Reason (2000) further comments: Serious weakness of the person approach is that by focusing on the individual origins of error it isolates unsafe acts from their system context. As a result, two important features of human er ror tend to be overlooked. Firstly, it is often the best people who make the worst mistakeser ror is not the monopoly of an unfortunate few. Secondly, far from being random, mishaps tend to fall into recurrent patterns. The same set of circumstances can provoke similar errors, re gardless of the people involved. The pursuit of greater safety is seriously impeded by an ap proach that does not seek out and remove the error-provoking properties within the system at large. (Reason, 2000) In other words, even assuming that Heinrich is correct and that 88% or more incidents are caused by unsafe acts, the root causes of those incidents can be related to unsafe conditions of work and www.asse.org JANUARY 2017 ProfessionalSafety 41 hard hat and safety glasses at a project site) and less to hu man errors in more compli Misplaced Priorities in Safety cated tasks or addressing the systemic root causes of such errors. Event severitv Applying disciplinary ac tions to an error judged blame less would be impractical and would lead to situations where errors, omissions, near-hits or even incidents would not Major hazard be reported out of fear of the accidents are here disciplinary action or lengthy bureaucratic incident investiga tion. That in no way contradicts the necessity to have effective and implementable disciplinary equency probability programs to deal with inten tional safety violations and to ..but most o f the management system, e.g. develop and implement pro performance measures, audits, behaviour grams to reduce the errors or modification, etc. are aimed here mitigate their effects. Simplistically, following Note. From \"Inspectors Toolkit: Human Factors in the Management of Major Accident Hazards," by Health and Safety are the major ways to elimi Executive, 2005, Figure 6, p. 17. nate an incident: 1) Elimin through incentives, disci systematic, programmatic, management and engi pline and work observations. neering deficiencies. Reason suggests: 2) Eliminate unsafe acts through safety man agement system improvements. H ig h -re lia b ility o r g a n iz a tio n s w h ic h h a v e le s s 3) Elim inate the consequences of committed th a n th e ir fa ir s h a re o f a c c id e n t s re c o g n iz e th a t unsafe acts (engineering controls). h u m a n v a ria b ility is a fo r c e t o h a rn e s s in a v e rtin g 4) A combination of the above. e rro rs , b u t t h e y w o r k h a rd to fo c u s th a t v a ria b ility F IG U R E 3 a n d a re c o n s ta n tly p r e o c c u p ie d w ith th e p o s s i b ility o f fa ilu re . (R e a s o n , 2 0 0 0 ) Conklin (2 0 1 6 ) concurs that 9 0 % of operational upsets (incidents) are caused by a human error and the remaining 1 0 % by equipment failures. How ever, according to Conklin, 7 0 % of human-errorrelated operational upsets are system-induced and 3 0 % are "slip, trip or lapse" or intentional viola tion. Only a small percentage of "unsafe acts" in cidents are caused by intentional safety violations. According to Reason (2 0 0 0 ), "in aviation mainte nance some 9 0 % of quality lapses were judged as blameless." Errors are seen as a result of the limita tions of human nature (Conklin, 2 0 1 6 ): stress; avoidance of mental strain; inaccurate mental models; limited working memory and attention resources; limited perspective; susceptible to emotion; focus on goal; fatigue. It is important to emphasize that the ways to ad dress an intentional safety violation (with disciplin ary program) would differ from ways to address a human error or a habitual repetitive unsafe act. It appears that the ABC model is more applicable to intentional safety violations or to simple repar ative habitual acts (e.g., buckle up in a car, wear 42 ProfessionalSafety JA N U A R Y 2 0 1 7 w w w .a s s e .o rg Human Factors in the Hierarchy of Safety Controls Several authors (Hopkins, 2006, United Steel workers, 2000) have pointed out that BBS is con cerned with the lower end of the hierarchy of safety controls. They have also commented that a focus on behavioral safety can lead to the abandonment of a commitment to the hierarchy of controls. Hopkins (2006) and United Steelworkers (2000) suggest that behavioral safety is one element of the administrative control"changing the way people work." It is an important but not the dominating aspect. Abandon ment of the hierarchy of safety controls may lead to situations in which the hazard management and en gineering control aspects of safety are overwhelmed by the administrative controls, damaging the result ing program efficiency and regulatory compliance. Human Factors in Limited Site Control Situations Safe behaviors and prevention of unsafe acts are critical in situations where engineering controls may not be readily available, for example, during initial inspections of abandoned buildings where recog nition, assessment and avoidance of hazards is a predominant way to avoid an incident and injury. As the project site develops, the level of control and assurance would increase, more engineering con trol options would become available and behavioral safety aspects would become less critical. Human Factors in Reducing the Incident Rates BBS program developers and users report sig nificant reductions in occupational injuries through modifying workers' unsafe behaviors (Byrd, 2007). The promise of significantly reduced occupa tional injury rates is difficult to evaluate. Their use by best-in-safety companies hinders evaluation, as these companies already demonstrate serious at tention to safety. In addition, since injury rates be come a key performance indicator, more attention is applied to postincident case management (Ivensky, 2015). Incident underreporting caused by fears of being blamed or becoming part of a lengthy, dif ficult investigation process is documented (Myketiak, 2015). In addition, the declining rate of serious injuries and fatalities is lower than that of minor incidents (Mangan, 2015). Other studies indicate incident underreporting in application of BBS programs. According to a re port by U.S. House of Representatives' Committee on Education and Labor (2008): Rewarding good behavior or punishing bad be havior, according to [BBS] philosophy, can prevent accidents. But experts in analyzing accident cau sation note that, since workers are human and in evitably make errors, the consequence of rewards or punishment is often a failure to report incidents, rather than a reduction of injuries and illnesses. The case study involving KFM, a construction consortium rebuilding the eastern span of the San Francisco Bay Bridge in California, reported by Brown and Barab (2007), documents how the BBS process effectively suppressed reporting of worker injuries and illnesses on site. KFM reported inju ry and illness rates 55% to 72% lower than other bridge builders in the Bay Area, but Cal/OSHA issued willful citations to the consortium in June 2006 for failing to record 13 worker injuries on its OSHA 300 Log as required by law. Placing the Blame & Fear of Reporting Even if unsafe acts lead to incidents, this does not mean that employees should be blamed. "In the majority of casesfrom 80% to 95%acci dents are caused by unsafe behavior. This state ment emphatically does not mean that the injury is the employees fault" (Krause, 1997). However, many employee groups and unions perceive BBS as a blame-the-worker program. In that aspect, a willful safety violation, habitual un intentional action or an error may be confused by an investigator. Corrective actions would study and modify a particular person's behavior. Even in the absence of disciplinary actions, being at the center of an investigation that involves members of the senior management team is not enjoyable for an injured worker unless the investigative team re moves blame in situations that do not involve will ful intentional safety violations or negligence. The problem of placing blame for errors, associ ated fear of reporting and "blame culture" imped ing improvements is well studied, for example, in the medical field (as related to medical errors). Myketiak (2015) summarizes the following effects of blame culture in the medical field: Staff becomes resistant to report errors after they occur. Underlying issues leading to the error do not get broached. The frequency of errors is overlooked. Good employees may lose their jobs (and oth ers may choose to go into other careers). Patients become fearful. Bad publicity occurs. Transformational change is unlikely. In addition, she summarizes the drawbacks of blame culture in the medical field: fear and anxiety about potential errors; guilt and shame after making errors; lowered reporting of medical errors; limited dialogue about errors because of fear of retribution; lack of understanding about the causes of med ical errors; inability to prevent future errors. Further, Myketiak (2015) suggests alternatives to the blame culture: a culture where learning and accountability are balanced with responsibility; a holistic, multifaceted approach to error man agement that engages the entire system; a reporting procedure that is not based on fear but on how the system and individuals can learn from and prevent errors. Depressed reporting of minor- to mediumseverity incidents and near-hits is an important characteristic of a developed blame culture. Severe incidents will continue to be known as they are more difficult to hide. That characteristic matches the current trends in occupational injuries with a growing gap between declining minor- to medi um-severity incident rates and serious injury and fatality (SIF) rates that have declined at a slower pace (Mangan, 2015; Manuele, 2003). Setting up extreme goals for safety performance where each minor incident is considered unacceptable and causes wide-ranging effects may help create a blame culture. Incident investigators must be trained to separate willful safety violations or neg ligence from human errors, and must look beyond the immediate causes into the root causes of in cidents that may include systemic and operational deficiencies. Serious Incident Prevention Concentrating on high-frequency/probability, sim ple and easily observable events (e.g., speeding, not wearing a hard hat, wrong lifting techniques), while beneficial, may obscure addressing more sophisticated and not easily observable hazards that require profes sional safety support and may delay implementation of needed engineering and systemic controls, the ulti mate area of concentration (Figure 3). HSE (2015) suggests finding the real, control lable key performance indicators. This may include compliance with critical safety procedures, compli ance with the company policy on working hours, www.asse.org JANUARY 2017 detailed review and monitoring of occupational exposures to chemical substances, identified and corrected safety deficiencies or hazards or proce dure reviews. Manuele (2003) shares a similar concern: Unfortunately, many safety practitioners con tinue to act on the premise that if efforts are concentrated on the types of accidents that oc cur frequently, the potential for severe injury will also be addressed. That results in the severe in jury potential being overlooked, since the types of accidents resulting in severe injury or fatality are rarely represented in the data pertaining to the types of accidents that occur frequently. A sound case can be made that many accidents resulting in severe injury or fatality are unique and singular events. Manuele (2003) also states that Heinrich's related premise that the predominant causes of no-injury incidents are identical to the predominant causes of incidents resulting in major injuries is invalid. Mangan (2015) suggests that: 1) A typical BBS observation does not probe deep enough to discover and document SIF exposures, so the observation process must be modified. 2) Observation sheets must include not only behaviors, but also conditions and management controls. 3) Observers must receive specialty training so they are able to observe high-risk situations and can effectively interview the worker on the exposures and management controls. Mangan (2015) also suggests that the discrepancy between minor incident rates and serious incident rates exists, in part, because practitioners treat all 4 4 ProfessionalSafety JA NUA RY 2017 www.asse.org High-Hazard Industries The key point here is that the universal lagging indicator of safety performance is OSHA's record able incident rates. While this may seem logical, focusing on occupational injury rates as the main (and often only) indicator of any company's safe ty performance has shortcomings, especially for high-hazard industries. As Hopkins (2000) states, "Reliance on lost-time injury data in major hazard industries is itself a major hazard." The importance of correctly selected key perfor mance indicators is well illustrated by an example from the airline industry. Airlines would define their safety performance by the number and sever ity of plane mishaps per year or per million miles, not by the number of strains and sprains sustained by pilots. According to Anderson (2006): The majority of major hazard sites [in high-hazard industries] still tend to focus on occupational safety rather than on process safety and those sites that do consider human factors issues rarely focus on those aspects that are relevant to the control of major hazards. For example, sites consider the personal safety of those car rying out maintenance, rather than how human errors in maintenance operations could be an initiator of major accidents. This imbalance runs throughout the safety management system, as displayed in priorities, goals, the allocation of re sources and safety indicators. The same point is included in the report of the 2005 Texas City refinery disaster investigation: [The company] uses the Comprehensive List of Causes (CLC) for both personal safety acci dents and process safety accidents. As a result, the checklist CLC approach may tend to bias the analysis toward looking at human error as opposed to engineering and management is sues. In the Panel's opinion, the causal factors involved in occupational or personal safety inci- IS T O C K P H O T O .C O M /S G U R S O Z L U Each element of an occupational safety program plays an important role, yet many organizations continue to stress one at the expense of the others, creating an unbal anced and ineffective OSH program. incidents the same, while roughly only 20% of in cidents have a potential to become an SIF. He indi cates positive development in BBS-driven programs toward integration in a comprehensive safety model: 1) According to Mangan (2015), observation sheets must include conditions (site hazards) and management controls in addition to behaviors. That modification would make them comprehen sive safety inspection/audits with the integrated BBS element. Management system controls are difficult to observe (or if observed, difficult to judge whether appropriate) without the review of mul tiemployer project management system, contracts and documentation such as safety and health plans. Recognition of exposures to critical site haz ards caused by deficiencies in engineering controls may also require special technical, engineering and safety knowledge. 2) Specialty training for the observer must include basic safety training (e.g., OSHA 30-hour construc tion course) and should include a basic understand ing of safety management at multiemployer project sites, not just additional interviewing skills. dents and process safety incidents typically are very different. The use of personal safety incident hypothetical as the only examples in some of the training materials that the Panel reviewed may inadvertently reinforce this bias. . . . The human error analysis, which focuses in vestigators' efforts on personal safety aspects of incidents rather than on all aspects of an incident, may introduce additional bias in the analysis to ward finding behavioral root causes. (BP U.S. Re fineries Independent Safety Review Panel, 2007) As Hopkins (2000) says, "creating the right mind-set is not a strategy which can be effective in dealing with hazards about which workers have no knowledge and which can only be identified and controlled by management." Conclusion: Part 1 The three key elements of a modern occupational safety program are engineering and technical stan dards and controls, management and operation systems, and human factors. Each element plays an important role, yet many organizations continue to stress one at the expense of the others, creating an unbalanced and ineffective OSH program. The hu man factor is present in most every incident, yet often the focus is too narrowly trained on blam ing at-risk behaviors or unsafe acts rather than on identifying and addressing the conditions, systems and norms that enable or cause those errors. Part 2 of this article (coming in February 2017) will examine how employers can better incorporate engineering and system elements into humanfactor-oriented initiatives to create a more com prehensive approach to OSH and thereby better understand incident causes, reduce incident rates, confirm regulatory compliance, and prevent seri ous injuries and fatalities. PS References Anderson, M. (2006). Behavioral safety and major accident hazards: Magic bullet or shot in the dark? Mer seyside, U.K.: Health and Safety Executive. ANSI/ASSE. (2012). Occupational health and safety management systems (ANSI/ASSE Z10-2012). Des Plaines, IL: ASSE. BP U.S. Refineries Independent Safety Review Panel. (2007, Jan.). The report of the BP U.S. Refineries Independent Safety Review Panel (Baker Panel Report). Retrieved from www.csb.gov/assets/l/19/Baker_panel _reportl.pdf British Standards Institute (BSI). (2007). Occupational health and safety management system requirements (BS OHSAS 18001:2007). London, U.K.: Author. Brown, G.D. & Barab, J. (2007). "Cooking the books"Behavior-based safety at the San Francisco Bay Bridge. New Solutions: A Journal of Environmental and Occupational Health Policy, 27(4), 311-324. Byrd, H. (2007). A comparison of three well-known behavior-based safety programs: DuPont STOP Program, Safety Performance Solutions and Behavioral Science Tech nology (Thesis). Rochester Institute of Technology. Conklin, T. (2016). Human performance improve ment. Los Alamos National Laboratory. Dhillon, B. (2013). Saftey and human error in engineer ing systems. Boca Raton, FL: CRC Press. Difford, P. (2012, Jan.). The cause of the next in dustrial accident: Will it be man . . . or will it be myth? Retrieved from www.neucom.eu.com/documents/ replytoassemanuele.pdf Geller, E.S. (2000, Apr. 11). The 10 myths of be havior-based safety. Retrieved from www.ishn.com/ articles/83587-the-ten-myths-of-behavior-based-safety Geller, E.S. (2016). How to get more people involved in behavior-based safety: Selling an effective process. Retrieved from www.behavior.org/resources/332.pdf Health and Safety Executive (HSE). (2005, Oct.). Inspectors toolkit: Human factors in the management of major accident hazards. Retrieved from www.hse.gov .uk/humanfactors/topics/toolkit.pdf Hopkins, A. (2000). Lessons from Longford. Sydney, Australia: CCH Australia. Hopkins, A. (2006). What are we to make of safe behavior programs? Safety Science, 44(7), 583-597. Ivensky, V. (2015, Aug.). Reporting and recordkeep ing requirements: Their influence on safety manage ment in the U.S. and the U.K. Professional Safety, 60(8), 34-37. Krause, T.R. (1997). The behavior-based safety process: Managing involvement for an injury-free safety culture. New York, NY: Van Nostrand Reinhold. Mangan, M.D. (2015, Feb. 21). Safety in practice: Ap plying behavior-based safety to serious and fatal injury prevention. Safety + Health, 50. Manuele, F. (2003). On the practice of safety (3rd ed.). Hoboken, NJ: Wiley-Interscience. Monforton, C. & Martinez, J. (2015, Aug. 20). Monforton and Martinez: There's nothing 'safe' about DuPont. Retrieved from www.chron.com/opinion/out look/article/Monforton-and-Martinez-There-s-nothing -safe-6456101.php Myketiak, C. (2015). Blame discourses. London, Eng land: Queen Mary University of London. Reason, J. (2000, Mar. 18). Human error: Models and management. BMJ, 320(7237), 768-770. Smith, S. (2007, Oct. 1). Behavior-based safety: Myth or magic? EHS Today. Retrieved from http://ehstoday .com / safety/ehs_imp_75429 Smith, T.A. (1999, Sept.). What's wrong with behav ior-based safety? Retrieved from www.mocalinc.com/ id59.htm Step Change in Safety. (2001). Changing minds: A practical guide for behavior change in the oil and gas indus try. Aberdeen, U.K.: Author. Strahlendorf, P. (2003). Accident theories. In Board of Canadian Registered Safety Professionals (BCRSP) Study Guide. Mississauga, Ontario: BCRSP. U.S. Army Corps of Engineers. (2014). Safety and health requirements manual (EM 385-1-1). Washington, DC: Department of the Army, Author. U.S. House of Representatives Committee on Educa tion and Labor. (2008, June). Hidden tragedy: Underre porting of workplace injuries and illnesses. Washington, DC: Author. United Steelworkers Local 343. (2000). Local 343 says no to behavioral safety at Alcan. Retrieved from http:// www.oocities.org/local343/new.html United Steelworkers. (2000). The steelworker perspec tive on behavioral safety: Comprehensive health and safety vs. behavior-based safety. Retrieved from http:// assets.usw.org/resources/hse/Resources/uswbbs.pdf www.asse.org JANUARY 2017 ProfessionalSafety 45 Copyright of Professional Safety is the property of American Society of Safety Engineers and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use