Strategies for controlling hazards at work

lournalojSajetyResearch, Vol. 13, pp. 95-112.1982 o 1983 National Safe@ Council and Pergamon Press Ltd

0022-4375/82/030095-18$03.00/O

Printed in the USA

Strategies for Controlling Hazards at Work Sandra Dawson, Philip Poynter, and David Stevens

This paper presents an heuristic framework for analyzing hazards (potential for loss or harm) and strategies that may be developed to control their realization. Two basic forms of intervention for hazard control (anticipation and reaction) are identified. Three broad anticipative strategies are discussed: (1) elimination of the source of the hazard, (2) containment of the risk of its realization, and (3) mitigation of likely consequences. The communication and

judgmental processes involved in decisions about strategies are shown to be embedded in the organizational “political” context, in which a variety of interests backed by varying sources of power and influence are represented. The development, implementation, and monitoring of any strategies that are decided upon are then discussed, including the fact that such actions and events may not produce the intended results. Comments are also made on the need for data provided by monitoring to be evaluated and appropriate adaptations made. Finally, a brief section of the paper discusses reactive strategies.

This paper is based on work being done as part of a research project’ analyzing the development and operation of health and safety programs in sectors of British industry. Programs are defined as the policies, structures, and practices that have been developed

Sandra Dawson (SeniorLecturer, and Philip Poynter David Stevens (Research Officers) worked together from 1979 to 1982 on research in Health and Safety Programmes at Work, in the Department of Social and Eco nomic Studies, Imperial College, London Universitv. Sandra Dawson is continuing r&&arch in this area at Imaerial Colleee. phiho Povnter and David Stevens now hold special~t safety~appbintments elsewhere. ‘The project was funded through the Joint Committee of the Science and Engineering Research Council (SERC) and the Social S&en& &s&h Council (SSRC). The SERC and SSRC are uart of thesvstem wherebv the British Government fund; independent research inuniversities and other public-sector research institutions. and

Fall 1982AJolume

13Ahmber

3

for or are associated with the improvement of health and safety at work. Case studies have been made in eight plants that handle substantial quantities of chemical materials, although not all of them would be technically classified as in the “chemical” industry. Data have been collected from two oil refineries, an industrial gas plant, and factories manufacturing general industrial chemicals, detergents, man-made fibers, plastics, and cosmetics. The purpose of this paper - one of the first based on this research project - is to introduce aspects of the analytical framework developed in the course of this research and to discuss the range of strategies available to those who seek to improve health and safety at work. Our aim is to provide an heuristic framework of use to both practitioners and researchers. 95

SOURCES OF REALIZATION OF HAZARDS While health and safety programs are molded by a number of factors and processes, they are most obviously linked to the nature of the hazards they are designed to contain. Hazards are defined in this paper as the potential for loss or harm to people and/or things. If that potential harm or loss occurs, then we say that the hazard has been“‘realized”.2 (See Figure 1.) The two things about hazards that attract the most interest are: 1. The probability of hazard realization; and 2. The seriousness and nature of the consequences should hazard realization occur. The point of hazard realization is defined as the moment when the harm or loss actually occurs, irrespective of when this harm or loss is “noticed” by people or automatic monitoring devices. The x in Figure 1 indicates an actual occurrence in this sense. Such points are fairly obvious for most accidents or incidents, but are more difficult to define for occupational disease, where there can be considerable gaps between the onset of ill health, its diagnosis, and the association of the disease with the work place. The event of hazard realization will not necessarily prevent the continuation of the 2The concept that accidents occur as the result of (I sequence of events is not of course new. Many writers have developed this idea in various ways. See, for example, Heinrich (1959)) Houston (1971)) and DeReamer ( 1980).

hazard. The realization, however, together with its aftermath or “other consequences,” will often alter (either increase or decrease) the probability of its recurrence andior the seriousness of its consequences should it recur. Potential for loss or harm is endemic in the nature of the two basic characteristics of all work places: (1) people (their knowledge, skills, attitudes, and actions), and (2) what we have collectively called “the hardware” of the working environment. The latter includes all aspects of the plant (types of vessels, flowlines, and other process equipment), the workplace (plant layout, building fabric), substances (toxic, flammable, and corrosive properties of raw materials, intermediates, and products), and machinery and equipment (moving parts, hand tools, vehicles). People hazards exist in the form of employees lacking knowledge, skill, or concentration. Hardware awareness, hazards may consist of carcinogenic raw materials, production processes that use large quantities of acid or steam under pressure, machines with moving parts capable of causing harm, or large quantities of flammable materials used or stored at the worksite. Usually, however, hazards derive more from the interaction of environmental and human factors than they do from either of these alone. For example, maintenance activity may require craftsmen to work at considerable heights and to enter vessels that have previously contained corrosive or flammable substances. Alternatively, process op-

FIGURE 1 THE PROCESS OF HAZARD REALIZATION Hazard realized

Time scale

96

of

one

hazard

realisation

process

Journal

of Safety Research

erators may be required to come regularly into close proximity with toxic materials or with machinery that moves (e.g., cranes, fork lift trucks) and/or contains moving parts (e.g., lathes). Finally, production processes may generate large quantities of scrap that litter areas regularly used as walkways by employees. 3 In focusing on the human and hardware ingredients of workplaces, we do not mean to imply that their particular characteristics are inevitable and unalterable and that they must therefore be accepted together with the hazards embodied in them. Indeed, later in the paper, considerable space is devoted to a discussion of how people and hardware can be changed to improve health and safety at work. For the moment, however, we are taking any workplace and looking at the characteristics of its people and hardware without asking why they are as they are. While any potential for harm or loss can be traced to its origins in the human/hardware core, other factors are also involved that can affect both the probability of a hazard being realized and the seriousness and scope of its consequences. Figure 2 shows how these factors operate in the workplace. The most important of these other factors are the formal and informal organizational and administrative systems, or what we may call the “software.” These include the roles, relationships, and responsibilities that exist, both formally and informally, in the workplace, and comprise rules and procedures as well as means for gathering and disseminating information. To appreciate the relevance of software factors to hazard realization, think of the adverse implications for health and safety at work of such things as ambiguities in clearance procedures, inadequacies in training arrangements, or tensions because of inconsistent job definitions for safety specialists and line managers. Similarly, consider the beneficial effects of effective supervision, well thought out and rehearsed emergency procedures, and an organiza30ur location of the sources of hazards in people, hardware, and their interaction is somewhat analagous to the unsafe acts and unsafe conditions of Heinrich (1959). Like many other writers (Petersen, 1971; NIIP, 197I), however, we prefer a theory of accident causation that acknowledges the multiplicity of factors in\Ol\d.

Fall 1982Nolume

13LVumber 3

tional context that facilitates trust and cooperation between safety specialists, line managers, and the workforce. One of the most important features of Figure 2 is that it is not a static model. Rather, it is one in which there is interactive change between the parts over time. In this paper we deal primarily with the interactions between people, hardware, and software and their effects on the hazard realization process. It must, however, be emphasized that the hazard realization process is not merely a repository for these effects-it can itself affect the other factors. For example, the existence of a hazard may lead people to try to alter some or all of the factors that contribute to its existence, before it is actually realized. The effects of hazard realization on the human and/or hardware characteristics of the workplace are often self-evident. Most obviously, there may be an injured worker or damaged plant, but other less immediate consequences may also follow. For example, there can be direct financial costs in the form of compensation payments, repair and replacement costs, or increased insurance premiums. In addition, machinery may be modified, substitute materials may be found, and people may “learn a lesson” and modify their behavior. Moreover, there may be considerable scrutiny of the organizational measures taken (or not taken) to prevent the hazard being realized in the same way again. The number and type of hazards and the frequency with which they are realized vary a great deal between workplaces. This variation can be partly explained by the characteristics of people and hardware in any particular location. For example, the hazards of working at heights or of falling objects are more widespread in the construction industry than in mechanical engineering firms where hazards from machinery may predominate. Similarly, a higher potential for damage exists in large chemical plants than occurs in other manufacturing industries. Nevertheless, the extent to which hazards exist and are realized is greatly influenced by the ways in which they are identified, approached, and controlled. Hence, we now turn to the central part of this paper and consider the interventions that may be made to eliminate and contain hazards and minimize their consequences should they be real97

central operating core

time scale

I

process

llardware factors

Iluman/llardware Interact ion t

Human factors

of one hazard realisation

4

v

AAA 1

for 10s or hana)

I Hazard ’ (potential

Hazard Realized

software

FIGURE 2 THE HAZARD REALIZATION PROCESS IN THE CONTEXT OF THE WORKPLACE

ized. Thus, we will explore the nature of “software” as shown in Figure 2. For the moment we are not concerned with who performs or initiates these interventions, but only with the forms of action that may be taken. ACTIONS TO IMPROVE WORKPLACE HEALTH AND SAFETY Actions to improve standards of health and safety at work are not taken in a vacuum. Like the generation and realization of hazards, they must be considered in the context of the existing people, hardware, and software. This context can sometimes impose constraints on what action is feasible. For example, the existence of strict limits on spending, entrenched attitudes, or old fashioned equipment that is not economical to replace, may all severely limit the interventions that are made. Alternatively, characteristics of the workplace can sometimes present opportunities for action. For example, the appointment to the Board of a person with a strong commitment to improving health and safety, the planning of a new plant, or a reorganization of departmental relations can all encourage intervention. The simple diagram of the hazard realization process in Figure 1 suggests two basic forms of action in respect to hazards. As shown in Figure 3, these are: 1. Anticipation - actions that are taken against hazards before they are realized; and

2. Reaction-actions hazards are realized.’

that are taken

after

Since realization does not always remove the hazard, however, part of the reaction may be to develop new forms of anticipation to cope with the continuing potential for loss or harm. Anticipation The process of anticipation viduals or groups:

involves

indi-

1. Identifying potential sources of loss or harm in the workplace (hazard identification); 2. Assessing the probability of identified hazards being realized (euent analysis); 3. Determining the nature and extent of the loss that is likely to occur (consequence analysis);5 4. Evaluating the situation revealed through steps 1,2, and 3 above; and 5. Deciding what, if anything, should be done. It is of course possible that those who are influential in the decision-making process may decide that the risks and consequences are, in fact, acceptable, given the context of the plant and that nothing further need be ‘These concepts of anticipation and reaction are akin to Atherley’s discussion (1974) of Pre-accident and Postaccident strategies.

5Theaetwo stages (event and consequence analysis) togethercomprise risk anulysis.

FIGURE3 ANTICIPATION AND REACTION IN THE HAZARD REALIZATION PROCESS Hazard Realized llazard continuing, maybe with nltered probability of recurrence seriousne!;s of consequences a

(potential for loss or harm)

Other

Anticipation

time

Fall 1982Nolume

consequences

Reaction

scale

of

13hVumber 3

one hazard

and/or

realization

,-w

Anticipation

process

99

done. Alternatively, they may decide that the risks are to some extent unacceptable and may therefore consider a variety of strategies to reduce the risk and/or consequences of hazard realization. Three broad strategies can be identified: 1. Elimination - removal of the source of hazard; 2. Containment-reduction of the probability of occurrence; or 3. Mitigation - reduction of the seriousness of the consequences. These strategies are not mutually exclusive; often they will be used in combination. The formality and systematization with which anticipation is undertaken vary enormously. Recent developments in Hazard Analysis and Hazard and Operability Studies, pioneered in the chemical, petrochemical, and nuclear industries, represent the most sophisticated and systematic approach to anticipation. These techniques are particularly attractive because they offer more quantitative data for decision-making than do less systematic and more qualitative approaches. They are likely to continue to have the most impact in plants where the consequences of realized hazards are high, where process control is largely automated, and where substantial resources are concentrated in plant design. Nevertheless, anticipation is equally relevant and necessary in less potentially hazardous and technologically complex environments. In such contexts, however, the process of anticipation may well be intuitive, brief, and far less quantitative or systematic. Although it would be rare under the circumstances for the stages described above to be followed exactly as described, we have chosen to identify them clearly and sequentially to illustrate the decisions that are implicit in an anticipative approach to hazard control.e A complete absence of anticipation occurs where no consideration is given to the hazards that may arise and thus the strate*This sequenceof stages is similar in concept to approaches adopted elsewhere by researchers deahng with risk at a more general level. See: Rowe, 1975; Kates, 1976; Otway, 1977. 100

gies (if any) to control endemic hazards are merely a fortuitous byproduct of other considerations. In legal terms this may amount to negligence. Figure 4 summarizes the processes involved in anticipation. When decisions are made in complex organizations composed of different interest groups with different sets of priorities, many factors other than “pure” health and safety considerations are involved. Some of the more important considerations affecting the processes summarized in Figure 4 will now be discussed. Of prime importance is the availability of scarce resources, particularly: 1. Money to finance the search for and implementation of appropriate strategies; 2. Technical and specialist knowledge to generate and interpret information on hazards and to aid in identifying solutions; 3. Time to allow line management to play a full part in developing and implementing strategies. The extent to which these essential but scarce resources are made available in any particular plant - both generally and for particular projects - depends in part on economic, staff, and time constraints. Such constraints are never completely fixed, however. They can be changed through efforts to increase financial and personnel resources and/or the way they are distributed between competing priorities. What happens by way of redistribution is crucially dependent on the “political” organization of the workplace. In particular, the perceptions and interests of the different groups involved will be reflected in what they believe in and are prepared to champion. For health and safety, the key interest groups are likely to be corporate management, plant management, technical specialists, first line supervision, and workforce safety representatives.7

‘Section 2(4) of the Health & Safety at Work etc. Act 1974 allowed for the appointment, by trade unions retognized for the purpose of collective bargaining, of safety representatives. These representatives, who are appointed from the body of employees, are charged with representing them in consultations with their employer, as well as a number of other functions specified in the Safety Representatives and Safety Committees Regulations 1977. Journal

of Safety Research

2

2 %

z

2

2 “,

- differences of interest between participating groups backed up by varying sources of power and influence

Organizational political context including - the availability of technical advice and knowledge I

+

b

about:

5. Cost and availability resources

of

4. Nature of possible solutions

3. Nature of consequences

2. Probability of hazard realisation

1. Nature of hazard

Judgements

ANTICIPATION

FIGURE4 THECONTEXTOFANTICIPATION

Situation

MITIGATION

CONTAINMENT-

ELIMINATION-

-

Although none of these groups “wants” accidents or ill health, they may well have different views on what constitutes “acceptable” levels of risk to which different groups may be exposed. They may also attach different priorities to the expenditure of scarce resources to health and safety. The groups involved are not of course equally matched in terms of the power and influence they have to advance their interests. Hence, sources of power and influence are another critical organizational aspect that affect the development of health and safety strategies. This is one reason why the commitment of senior management has been found to be so important in securing effective health and safety programs (Cohen, 1977; Smith, Cohen, Cohen, & Cleveland, 1978). This political aspect is well documented in organizational analysis (Abell, 1975; Dawson, 1979; Pfeffer, 1981), but it tends to have been underplayed in discussions of health and safety. One reason for this seems to be the view, often expressed by managers, that health and safety should not be negotiable or subject to any considerations other than purely technical ones. Yet, in all our we encountered situations case studies, where these same managers were in fact involved in activities and decisions that involved balancing health and safety with other considerations. For example, in one factory fighting to remain viable in a particularly difficult commercial environment, a senior manager conceded that strict adherence to clean air standards was economically unfeasible. Although management was endeavoring to improve airborne contamination levels, they would still need forbearance on the part of trade union representatives and government inspectors until they had sufficient resources to achieve better standards. In contrast, in another company, the arrival of a senior American executive with firm ideas and a commitment to safety meant that economic and management constraints that had previously been tight suddenly became much looser. Extra resources were found and a new 5-year program to reduce accidents and improve safety performance was launched and subsequently pursued with zeal. 102

The one area of health and safety activity that has long been acknowledged as “political” is that which surrounds joint unionmanagement safety committees. (See Kothan, Dyer, and Lipsky, 1977, for a discussion of such bodies.) This was symbolized by a distinction made by several managers in our study between “real safety” and “political safety.” The former was designed into processes and plants and was very rarely a subject of overt contention. The latter was “the sort of nonsense which goes on in safety committees,” including what was seen as undue wrangling, particularly over ways to prevent the commoner, minor mishaps such as falling, tripping, etc. This distinction reflects the belief that many managers hold about the “purity of real health and safety.” In fact, we would suggest that, rather than one being “real” and “pure” and the other being “political” and “pathological,” they in fact represent two extreme points on the political dimension of safety management activity. Having set the organizational scene in which strategies are developed, further consideration will now be given to the three broad strategies outlined in Figure 4: (1) elimination, (2) containment, and (3) mitigation. In identifying three strategies, we are adopting a somewhat simpler classification than can be found elsewhere. (See for example HSE, 1977.) We believe, however, that our classification addresses the two crucial questions: 1. Do we eliminate or contain? and 2. Do we try to stop the danger or limit the consequences? It will be recalled that hazards at work derive from the characteristics of people, hardware, and their interaction. Figure 5 shows how the three types of anticipative strategy can be focused on each of three sources of hazard. The strategies are not of course mutually exclusive and are often used in combination. The importance of a well thought out approach to dealing with the various sources of hazard and the different stages of the accident sequence is demonstrated by research on successful safety programs (e.g., journal

of Safety Research

I$ I:

i

3 m

F

0’

s

a?

L*

2 !z

.-.. -~.--_.__~“._--

.---

--

~_.

rwwJ?,E OF .smATErY I) ___._ .__-._ -_l___, -

~___~~

1. Opeiatiig rocedures both operatioal and safety 5 erected: l Permit-to-work systems * Systems of work l Ergonomics l Threshold limit values l Biological limit values ____~_______

x -.

.__~__.-_--__.._ -_.

..____

._...

--.

___..~__~_-_-

I. Evacuation procedures 2. Major hazard/in~iderlt plans 3. Plantlprms siting policies

-.

.~__

~---~-1. Physical provision such as: l Blastwalls l Means of Lwape routes l Medical centers/first aid equipment l Fire protection devices

Miti~tioll of Likely ConserIucncL~ .._- ---..-~~---- __._._____--1, Training, Instruction, Selection. etc. concerning: l Fire fighting l First aid 9 bkdns of escape l Emergency squads

-.

^___._ --.

. ___ -....

_- _____I__ .-.__...

__

Directed at: I. Pr~~s/Plant/Workpla~/Metl~~s, etc.: * Enclosure of substances/machines l All forms of “safety device” l Ventilation systems l Access/egress etc.

C(~ntainment Elimination l___~___-... ___^_-.--____ -- -- __I____.. _.-_------ _I_-. 1. Exclusion of activities/people which may Ma be directed at: be based upon: I. r5ogm‘t’rve characteristics through: l Education * Age l Training l Sex l Instruction l Physical characteristics, e.g., height l Cognitive characteristics, e.g., definil Information nition of cotn~tent or appointed per2. Behavior through: son l Supervision 3. Physical characteristics through: l Protective clothing ~_______________-~-_-._-__~I_~-

~_

_..____._______-

1, Exclusion of hardware: l Plant l Substances l Equipment 2. Plant/equipment design: l Safe by construction l Noise elimination at source 3. Work method design ~-.~-Interaction of People and I. Automation (removing necessity CJf interaction between people and hardware) Hardware afthough all elimination strategies aimed at people or hardware will inevitably affect their interaction

P

FOCUS OF STRATEGY

-~ Hardware

People

---__ ---

FIGURE 5 STRATEGIES OF INTERVENTION _~_. --.-... ________ ----~_I_-_. __~_ _II_

Cohen, 1977). Lees (1980) has also stressed the importance of a systematic approach. Elimination. The obvious strategy if a hazard is found unacceptable is to eliminate it from the workplace. For example, substitute raw materials may be found or noise levels may be reduced at the source. There may be opportunities to eliminate dangerous parts of machinery and thus make the plant safe by construction. Automation of production processes often eliminates hazards in the interactions of people and hardware that characterize more traditional forms of manufacturing. The use of a “competent person” restriction may also eliminate certain persons from undertaking specified tasks.8 One problem with elimination as a strategy is that getting rid of one hazard may create others. For example, the hazards to welders working on car assembly lines may be eliminated by automation in the form of robots. At the same time, however, this creates new hazards, since maintenance work must be carried out on the new plant. Thus, careful consideration should be given to the health and safety implications of any proposed changes. In practice, the scope for elimination may be limited, particularly from the perspective of those in plants and factories already engaged in manufacturing specific products for which there is a continuing demand. It is not unusual therefore for such strategies to be initiated at a national level. For example, in Britain, the Carcinogenic Substances

aA “competent person” in U.K. terms is someone qualified to perform certain high-responsibility jobs connected with safetv. These may range from checking exhaust ventilation equipment for a&e&s (as required-by regu lation 7(3) of the U.K. Asbestos Regulations, 1969) through ‘supervision of an entire proc&plant by a fully qualified professional engineer. Although there is no legal definition of a competent person, it is commonly held that whoever is selected or appointed “must have practical and theoretical knowledge together with actual experience on the type of plant, machinery, equipment or work he is called upon to examine. Such knowledge and experience will enable him to detect faults, weakness, defects, etc. which it is the purpose of the examination todiscover and assess.” (c.f. Armitage, 1981). The importance of the presence of a competent person was demonstrated in the official inquiry into the Flixborough explosion (HMSO, 1975). 104

Regulations of 1967 prohibited the manufacture and use of certain proven carcinogens and the Blasting (Casting and Other Articles) Special Regulations of 1949 banned the use of blasting mediums containing free silica. Other regulations have eliminated specified groups of workers from exposure to particular hazards; for example, the employment of women has been prohibited in some industrial processes connected with lead manufacture. Containment. If elimination of the hazard is not possible, then another availablestrategy is containment. This is aimed at controling the probability of hazard realization. Containment strategies may again act upon people, hardware, or their interaction, and examples are shown in Figure 5.e A large part of what is called preventive activity in health and safety would fall in this containment category. For workers, containment strategies may consist of providing protective clothing and equipment or may involve activity to alter behavior by changing skill levels, values, attitudes, and awareness. Examples of such strategies would be training, education, information, instruction, and supervision. Containment directed at hardware may consist of specified standards for pressure vessel construction, machine guards, exhaust ventilation equipment, enclosure of substances, lighting, heating, and guard rails. These all contain hazards since the hazard deriving from hardware is not actually removed from the workplace, but rather is controlled by certain standards. Finally, containment may be directed at the interaction of people and hardware. The most obvious examples of such a strategy are procedures that specify how people and hardware should interact. These may include definitions of safe operating procedures, permit to work systems, plant shut down procedures, and threshold limit values. Mitigation.

The third strategy that can result from anticipation is aimed at mitigating ‘%e also Atherley’s discussion and “safe place” strategies.

(1975) of “safe person”

Journal of Safety Research

the likely consequences should the hazard be realized. Once again, such mitigativestrategies may be directed at people, hardware, and their interaction as shown in Figure 5. Typical mitigative strategies focused on people are evacuation procedures. Such strategies for hardware consist of the provision of fire fighting equipment, emergency showers, means of escape, and first aid facilities. The interaction of people and hardware may be subject to the development of evacuation procedures and major disaster contingency plans. In summary, anticipation, as we have described it, is capable of generating three broad types of strategy to eliminate, contain, and mitigate the realization of hazards. A great deal needs to be done after a strategy has been decided upon if it is to have a beneficial effect on standards of health and safety at work. To begin with, the strategy has to be developed and put into practical use. Once implemented, efforts need to be devoted to monitoring both the implementation and the associated consequences. The importance of monitoring cannot be overstressed. There is considerable evidence (APAU, 1980; Dawson, Poynter, & Stevens, 1982) that without ensuring some feedback on the application and effects of strategies, they are likely to be shortlived and unsatisfactory. Furthermore, the information generated through monitoring needs to be evaluated and appropriate adaptations made. Hence, we now turn to the organizational processes of development, implementation, detection, investigation, evaluation, and adaptation, which are shown in Figure 6. The importance of seeing management activity in terms of control cycles has been stressed by both general management theorists (Eilon, 1962) and those working in the safety sphere. (See Petersen, 1971, and his reference to ASSE, 1966.) Development and Implementation of Strategies If the development and implementation of strategies to control known hazards at work were the sole objectives of an organization then one would expect relatively few problems in achieving these objectives. In practice, these processes take place in organFall 1982Nolume

13LVumber 3

FIGURE 6 ORGANIZATIONAL PROCESSES ESSENTIAL TO THE ACHIEVEMENT OF THE OBJECTIVES OF IMPROVING STANDARDS OF HEALTH AND SAFETY AT WORK

r

b

5 E K z

Evaluation

Detection

bf

Information

T

and Investigation

t Implementation

I.

t

Development of Strategy with the object unprovzng health and safety at worl.

of

izations that have limited resources and many objectives,. those relating to output, efficiency, and quality, as well as those concerned with the control of hazards. There is, then, as we have already discussed, likely to be conflict over the distribution of scarce resources between competing objectives. Our research indicates that such conflict between goals is quite widespread; in eight of our case studies, approximately 75% of questionnaire respondents (managers, supervisors, and safety representatives) felt that health and safety considerations were in conflict with other aspects of their jobs either “frequently” or “some of the time.” Consequently, it cannot be taken for granted that suitable intervention strategies will be developed, let alone fully implemented, in the face of other competing objectives. This is likely to be the case when no one with sufficient power is committed to the implementation of plans for health and safety. Problems in developing and implementing strategies are also often compounded because of unanticipated consequences that may impede hazard control. Our earlier example regarding the introduction of robots to eliminate welding hazards illustrates this point. The development and implementation of any strategy can be identified in terms of the dimensions shown in Figure 7: 1. Deuelopment. This refers to the extent to which the strategy has been developed in 105

FIGURE7 THE DEVELOPMENTAND THE IMPLEMENTATIONOF STRATEGIES Development Extent to which strategy is (standards and goals set)

developed

f Complete

Partial

Not at a11

\ Implementation Extent

Complete

to

which strategy

C personalized Systeln

-

Parti al

D

E

F

Not at all

H ’ Dead letter

I

J Anarchy

of

designers’ specification

terms of both its aims and standards being specified in a written systematic way. For example, the development of a strategy for coping with toxic substances would be complete if there were clear statements available in the workplace about such things as the nature of the substances, acceptable levels of exposure, methods of monitoring exposure, and emergency treatments should specified levels be exceeded. Such a “complete strategy” is required in the UK now by the 1980 Control of Lead at Work Regulations. The degree of development is not of course a dichotomous variable but may range from complete through many phases of partial development to a complete lack of any system.

2. Implementation. This refers to the extent to which the specified strategy has been implemented in the terms intended by its designers. This too is a continuous variable, although it is shown in discrete categories in Figure 7 for ease of presentation. It ranges from complete implementation, through many phases of partial implementation, to nothing at all being done to implement the strategy. In this latter case, the requirements, standards, rules, and procedures 106

B

is

implemented in terms

A Effective Organizat ional system

’

have only a “paper” existence. For example, a chemical may be used so that employees are frequently exposed to excessive levels, agreed upon inspections may never be carried out, or prescribed protective clothing may not be worn. The four extreme cells in Figure 7 (A, C, H, J) can be illustrated by referring to the permit-to-work systems described earlier as a containment strategy aimed at the interaction of people and hardware (Figure 5). From the designer’s point of view, strategies that fall into Cell A are ideal, although this view may not be shared by all the people affected by the strategy. Here we have an effective organizational system in which a permit-to-work system is fully codified with clear instructions as to who and when the system should be used. In practice, the system is not ignored, bypassed, or modified in any way. At the other extreme, Cell J represents the worst situation. Here there is no formal system of control. Even with entry into vessels or other confined spaces, individuals are left to deal with problems as they see fit and undertake work in a random fashion depending on their inclination. In other lournal

of Safety Research

words, anarchy prevails. Box H represents what might be called the “dead letter” in which a permit-to-work system has been developed, but nobody uses it. Finally, Box C represents a personalized system, where regular, predictable procedures exist but are only conveyed by custom, practice, and word of mouth. There is reliance on individual peculiarities for its existence and continuation. Unanticipated consequences. Apart from considering the extent to which strategies are developed and implemented, it is also important to ask whether in their development and implementation they have generated occurrences that are unanticipated by the designers and are in some way detrimental to the intended objectives of improved health and safety. Figure 8 shows this third dimension added to the two already shown in Figure 7. Adverse unanticipated consequences can follow any of the combinations of development and implementation already discussed. Asbestos coating of buildings to minimize the effects of fire is a notorious example of a strategy for improving health and safety that in fact has caused unanticipated harm to employees. We encountered an example of unanticipated consequences in a factory that had established a procedure for ranking

requests for maintenance work in terms of its health and safety significance. This led to all maintenance work which was seen as “urgent” being classified as “necessary on account of risk to health and safety,” regardless of the actual amount of objective risk. Thus, in practice, the scheme was undermined. In a third example, a system of guard interlocking was implemented on one process unit, but not on similar units in the same factory; i.e., the standards were not fully implemented. This created unanticipated industrial relations problems. Craftsmen who adopted “unsafe” working practices to defeat the guards on the interlocked plant could not reasonably be disciplined when they were required to work on similar plants that were not interlocked. Obviously, the development and implementation of hazard control strategies are not without problems and cannot be guaranteed to follow automatically from decisions about what should be done. Therefore, an effective program to control hazards also requires a monitoring system to ascertain whether and where such problems are arising. Monitoring: Detection and Investigation Detection and investigation are concerned with generating information on three fronts:

F’IGLJRE8 UNANTICIPATED CONSEQUENCES: THE THIRD DIMENSION

WICIPATED CCNSEQumcU

Fall 1982Nolume

13hVumber 3

1. The. extent to which strategies have been developed; 2. The extent to which strategies have been implemented; and 3. The extent to which development and implementation of strategies gives rise to unanticipated consequences. Consider, for example, entry into vessels10 that have contained toxic substances or that may be deficient in oxygen. A combination of strategies (usually centered on permit systems) may be employed to control the hazard. Effective monitoring involves addressing a range of questions relating to the development, implementation, and possible unanticipated consequences of these strategies. Examples of such questions are given below. Development of strategy GOT safe vessel entry. In order to assess the extent to which strategies have been developed to deal with the hazard(s) of vessel entry, one might ask: 1. Have potential situations requiring entry been identified, recorded, and, where possible, the need for entry eliminated? 2. Has responsibility for identifying and assessing vessel entry situations been allocated? 3. Have methods of vessel isolation and preparation been specified? 4. Have procedures for testing and certifying the atmosphere within the vessel been prepared? 5. Has a written permit system been established? 6. Have training requirements for the “responsible person,” operators, rescue teams, etc. been documented? 7. Has necessary rescue equipment been specified, e.g., breathing apparatus, rescue harness, etc.? 8. Have arrangements been made for maintenance of essential equipment? loBecause of the potential hazards involved in vessel entry, special provisions in British law apply (section 30 of the 1961 Factories Act; TheChemical Works Realations, 1922). These are also backed up by a guidince note issued by the Health and Safety Executive (HSE, 1976).

108

Implementation of strategies for safe vessel entry. Monitoring the implementation of strategies involves establishing what is actually happening at the site. Questions that might be considered are: 1. Are the controls to be adopted in all situations specified? 2. How, in practice, are vessels isolated and prepared prior to entry? 3. Are testing procedures carried out according to the standards specified? 4. Are permit-to-work systems being used as intended? 5. Is training carried out and documented? 6. What is the actual condition of necessary equipment? Unanticipated consequences ofstrategiesfor safe vessel entry. Finally, the development and implementation of strategies regarding vessel entry may give rise to consequences that are detrimental to the hazard control. To detect such situations, one might ask: 1. Are mutually exclusive requirements built into a permit system? 2. Are requirements creating additional and possibly greater hazards? 3. Does the system require time and effort that are incompatible with existing demands on personnel? 4. Are systems too elaborate and thus generating confusion or uncertainty as to what is required? The answers to these questions will provide a wealth of information indicating the thoroughness with which strategies have been developed, the completeness of their implementation, and the existence of adverse consequences that were not intended. The bulk of such detective activity is usually carried out personally by means of inspections, audits, supervision, etc. Some impersonal monitoring is, however, possible with hardware. For example, a machine guard may contain a self-monitoring system that automatically activates the device whenever the machine is in operation. Evaluation and adaptation. The information derived from detection and investigaJournal of Safety Research

tion has to be evaluated within the organizational political context in order to assess its significance. Some findings will have little significance for the degree of control exerted over the hazard realization process, while other information may have important implications for the continuing control of hazards. Evaluation of these data makes possible feedback to other parts of the control system and consequent adaptation. This process of adaptation may be directed at any one of the stages in the control process as illustrated in Figure 9. For example, in situations where the feedback suggests that existing arrangements are appropriate, if only they were fully adhered to, adaptation would consist of seeking to enforce these arrangements through training, discipline, and reviewing of individual performance. This could in turn lead to greater emphasis on detection and investigation. Alternatively, where the feedback suggests that existing arrangements are inadequate or inappropriate, then adaptation would probably be more concerned with changes in the mix of strategies than with enforcement.

Reaction The discussion so far has concentrated on strategies that are available prior to a hazard being realized, i.e., before any loss or harm has occurred. Hazards are realized, however. People are injured by moving parts of machinery. Fuel, oxygen, and ignition sources combine to produce fires and explosions. Toxic dusts are inhaled and people come into contact with corrosive liquids. Indeed, certain outcomes and levels of harm are often anticipated or predictable, since the bulk of the strategies applied at the workplace are those of containment rather than complete elimination of hazards. The essence of containment is that, either consciously or unconsciously, people make judgments about “acceptable” levels of risk. Inevitably then, precautions sometimes fail. Moreover, there are some situations where, because of a lack of knowledge, inclination, or resources, little has been done to eliminate or contain hazards. Thus, we need to consider how people react to hazard realization. The process of reaction is shown on the right hand side of Figure 10.

FIGURE 9 ADAPTATION IN ORDER TO IMPROVE STANDARDS OF HEALTH AND SAFETY AT WORK

l-4

Fall 1982Nolume

DETECTION

AND

INVESTIGATION

13hhmber

3

I

109

I

ANTICIPATION

for

loss

EVALUATlON OF INFORHATION

tUIZAHb(potential

>

FIGLJRE IO

or ham)

I

I I t i

HAZARD REALISER

I 1 t

<

INTERVENTIONSAVAILABLE TO DEAL WITH WAZARDSAT WORK

OF

Other consequences

I

rnaybe with of recurrence of conseuuences

DI%XT I ON AND INVESTIGATION

EVALUATtON INFORMATION

Hazard continuing!, altered probability and/or seriousness

I

r

Mitigation of actual consequences. Once a hazard is realized, mitigative strategies planned to minimize the anticipated consequences should come into operation. At this stage, fire fighting equipment, first aid facilities, means of escape, training in evacuation procedures, and emergency shutdown procedures will all be put to the test in a practical setting, in an attempt to minimize the consequences of the hazard realization. When the actual situation differs from what was anticipated, actions are likely to be taken on an ad hoc basis. Detection and investigation after hazard realization. At some point after the hazard has been realized and initial attempts at mitigation have been made, the situation will stabilize sufficiently to permit detection of the extent of loss or harm and investigation of the reasons for the hazard realization. This may involve forensic examination of the hardware and detailed interviews with the workers involved. The scale of this form of intervention varies enormously. It may be restricted to investigation by a supervisor or may be a full-scale internal inquiry involving detailed interviews and forensic examinations. In the U.K., external inquiries may also arise, involving insurance companies, Government Inspectorates, and, at the extreme, a full scale Court of Inquiry as occurred following the Flixborough explosion in 1974 (HMSO, 1975). Evaluation and adaptation after hazard realization. The data derived from detection and investigation need to be evaluated to determine their significance, and these too are often important in providing feedback to other stages in the control program. Adaptation may also be short-term to change the way the hazard is dealt with at the mitigative stage (Figure 10). CONCLUSIONS

Figure 10 provides a summary view of the strategies discussed. This model and the preceding discussion are intended to serve two purposes. First, they provide an heuristic framework centered on the concept of hazard and encompassing both the strategies for Fall 1982Nolume

13LVumber

3

hazard control and the organizational processes that are involved if those strategies are to have an impact on health and safety at work. Hopefully, this framework could be used by people in industry to analyze and assess their present activity and organization with respect to health and safety. Existing research already stresses the importance of a systematic approach to the management of health and safety rather than piece-meal ad hoc actions to deal with particular situations. Our model provides the basis for the development of such an approach. Used in conjunction with empirical data (e.g., APAU, 1980; Cohen, 1977; Dawson, Poynter, & Stevens, 1982) to demonstrate where particular emphasis needs to be applied, it can guide practitioners in the development and refinement of their hazard control programs. The second purpose is to provide a framework to aid in the analysis of our research data. In collecting the data, it has become increasingly obvious that a model was needed to encompass the range of actions and choices available, as well as to indicate the nature of the constraints on these actions and choices. Hence, this paper provides researchers with a tool for organizing data to offer maximum insights into hazard control strategies. REFERENCES American Society of Safety Engineers. Scope andfinctions of the professional safety position. Chicago: Author, 1966. Ahell, P. (Ed.1 0rganisation.s as bargaining and infZuen~esy&&. L&don: Heinemani, 197% _ Accident Prevention Advisorv Unit. Effective volicies for health adsafety. London: Her &jesty’s Stationery Office, 1980. Armitage, J. S. Health and safety management in the construction industry. In S. S. Chissick and R. Derricott (Eds.), Occupational health and safety management. London: John Wiley, 1981. Atherley, G. R. S. Strategies in he&h andsafety at work. E. W. Hancock paper presented at the Royal Imtitution, London, October 1974. Atherley, G. R. S. Strategies in health and safety at work. The Production Engineer, 1975,54,50-S. Cohen, A. Factors in successful occupational safety programs. Journal of Safety Research, 1977,9,X%-178. Dawson, S. Organisational analysis and the study of policy formulation and implementation. Public Administration Bdletin, 1979,31,52-68. Dawson, S., Poynter, P., & Stevens, D. Activities and

111

of safety performance.

Kochan, T. A., Dyer, L., & Lipsky, D. B. The effectioe-

Chemistry and Industy, in press. DeReamer, R. Modem safety and health technology. New York: John Wiley, 1980.

ness of union-management safety and health committees. Kalamazoo, Michigan: W. E. Upjohn Institute

outcomes-The

monitoring

Eilon, S. Problems in studying management control. International Iournal of Production Research, 1962, 1, U-20.

Her Majesty’s Stationery Office. Repoti of the Court of Enquiry on the Flixborough disaster, London: HMSO, 197s. __.-.

Health and Safety Executive. Entry into con@ed spaces, Guidunce Note GS5. London: Her Majesty’s Stationery Office, 1977. Health and Safety Executive: Toxic substances: A precautionary policy, Cuiaimce Note EH18. London: Her Majesty’s Stationery Office, 1978. Heinrich, H. W. Zndustrial accident preuention (4th ed.). New York: McGraw-Hill, 1959. Houston, D. E. L. New approaches to the safety problem. Institution of Chemical Engineers, London, Symposium Seties, 1971,34,210-216. Kates, R. W. An “anatomy”ofrisk. Washington, D.C.: U.S. Environmental Protection Agency, 1975.

112

for Employment Research, 1977. Lees, F. P. Loss prevention in the process industries. London: Butterworths, 1980. National Institute of Industrial qsychology. Zoo0 Accidents-A shop floor study of their courses, London: NIIP, 1971. Otway, H. Present status of risk assessment. In Risk analysis: Industry, government and society, 10th Intemational TN0 Conjerence. The Hague: Netherlands

Central Organisation for Applied Scientific Research TNO, 1977. Petersen, D. C. Techniques of safety management. New York: McGraw-H& 1991. . Pfeffer. 1. Powerin oreanizations. Boston: Pitman. 1981. Rowe,‘!$. A. An “ana>omy”ofrisk. Washington,‘D.C.: United States Environmental Protection Agency, 1975. Smith, M. J., Cohen, H. H., Cohen, A., & Cleveland, R. J. Characteristics of successful safety programs. Journal of Safety Research, 1978,10,5-15.

Journal

ofSafety Research