Method in your madness:
System in your safety
Rede
uitgesproken
aan de Technische Universiteit Delft
vakgebied Veiligheidskunde aan de faculteit Techniek Bestuur en Management
op vrijdag 15 september 2006 om 15:00 uur door
ISBN xx-xxx-xxxx-x
Copyright ©2006 by A.R.Hale
All rights reserved. No part of the material protected by this copyright notice may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying, recording or by any information storage and retrieval system, without permission from the publisher:
Mijnheer de Rector Magnificus, Leden van het college van bestuur,
Collegae hoogleraren en andere leden van deze universitaire gemeenschap, Collegae van de sectie Veiligheidskunde,
Introduction
My career in safety science has left me with two lasting concerns. The first is the reaction when somebody hears that I have spent my whole working life in studying risk and safety. After a moment of stunned silence and a nervous grin, the reaction is usually ‘Are you mad, how can you spend 40 years studying that? It’s just a matter of stupid people breaking rules. Isn’t it incredibly boring?’ When I go on to say that, to boot, I am a psychologist and that I find it great fun and plan to spend at least another ten years doing so in my own free time, the grin becomes more fixed and people start reversing out of the presence of this madman. So one purpose of this speech is to explain why I have been so mad as to devote a life to studying safety and what is so fascinating about it.
Madness also refers to the conflicting emotions which safety, or rather its opposite a serious accident calls up. The first and most painful is the hopeless grief, sometimes turning to mad fury at the death or serious injury of a family member or friend. It is to prevent that madness, pain, grief and loss that most of us in the safety field devote our lives in whatever capacity. But there is another sort of fury which safety often calls up. That is the mad frustration with the petty rules, insensitively enforced, which are so often associated with safety. This was caricatured in a recent comedy programme I saw on Dutch television in which a character with the word ‘Arbo1’ on his
back kept coming on and calling a halt to anything which started to be any fun at all. This gives rise to the feelings of schadenfreude when people read the sort of news item shown in figure 1, where our initial concern for the victims turns to a hollow laugh when we see who they were. Safety can drive people mad in many ways and certainly gives them a black sense of humour. In order to keep madness and emotion in their rightful place we need understanding and rationality, not instead of, but as well as emotion – but what is that method to keep madness in check?
The other concern of my career, and the inspiration for the second part of my title, has been to try to introduce some coherence into what some have seen as a chaotic collection of unrelated facts and theories, which make up the practice of safety. In doing that I have sought inspiration in the complex of models, techniques and terminology which fall under the heading of ‘the systems approach’. This search for coherence and for the understanding of what the complex interactions are between different system levels and how they produce danger or safety has been a constant theme in my publications and is the theme I plan to pursue into my retirement.
Structure
A valedictory lecture is a time to look back and a time to look forward; back to what your subject area has achieved and you and your colleagues with it, and forward to what the great challenges of the future years are, which your successors have to face and overcome.
illness caused by our use of technology is what risk management is all about. But statistics can only reveal global trends, are subject to many caveats as to their completeness and reliability (which I shall not go into here for lack of space) and are essentially very boring. So, as long time editor of the journal Safety Science, I have turned also to an analysis of what the field of safety science has published in its journals over the period of 35 or so years that dedicated journals on the subject have existed. It was in 1969 that refereed scientific journals began to appear with the words ‘accident’ ‘safety’ or ‘risk’ in their titles, first in the USA and then in Europe. I have scanned the following 8 English language journals, which were available electronically or in paper copy in the TU Delft library2, from
their first appearance:
• Accident Analysis & Prevention (1969) • Journal of Safety Research (1969) • Journal of Hazardous Materials (1975)
• Safety Science, previously Journal of Occupational Accidents (1976) • Journal of Loss Prevention in the Process Industries (1988)
• International Journal of Occupational Safety & Ergonomics (1995) • Reliability Engineering & System Safety (1998)3
• Policy & Practice in Health & Safety, previously Journal of the Institution of Occupational Safety & Health (1997)
• Journal of Risk Research (1998)
For each article published I coded the country of origin of the first author, the activity or area of risk researched (industry, transport mode, sport, home, leisure, etc) and the topic of the paper (risk analysis, modelling, training, behavioural factors, machine design etc.). This data can tell us globally what progress our field has made and what it has considered important to study, and we can confront that with the accident data. Along the way I want to indicate briefly what I think has been the contribution that we have made to that progress in the two academic institutions I have served for the majority of my working life, the Universities of Aston and Delft.
2Two other relevant journals were not available in this way:
Risk Analysis (1980), International Journal of Injury Control & Safety Promotion, previously International Journal of Consumer & Product Safety (1994), and are not included, a limitation to be kept in mind when
interpreting my conclusions.
3 This journal was published under the title ‘Reliability Engineering’ for 19
Looking forward is always much harder. The crystal ball is still an unproven piece of technology. However, I will spend the remainder of the time looking in that crystal ball and giving at least my personal view of what the field should go and do, based on the areas which we have worked on in those two institutions.
Is it safer now?
Figure 2 shows UK data about absolute numbers of deaths, based on statistics reported under a range of legal provisions over the period of a century.
Figure 3 puts the years from 1966 in the UK under a magnifying glass for employees and the self-employed. A similar figure for the Netherlands is difficult, if not impossible, to draw over a similar period, because the reporting system and the definitions used changed so dramatically more than once in that 40 years (Venema et al 2006)4.
4 My thanks are due to Frits Claus, now of the Inspectie Werk & Inkomen
If we look at these figures, we seem as though we can congratulate ourselves on a sustained period of good work. The figures for accidents in all of these areas for developed countries, and even world-wide, show encouraging downward trends over long periods. There are upward trends in some periods, some of which are artefacts of changes in reporting requirements, but others of which (such as the increase in work accidents around the turn of the 19th to 20th centuries and during World War II and the
increase in road accidents in the post World War II period) caused by rapid increases in exposure to dangerous machinery or vehicles, coupled with the influx of many inexperienced workers or drivers. However the long term trend is always downwards. Before we decide that we can all pack up the safety science shop and go home, we need to place some cautionary remarks.
2. Only with figures such as those for aviation and the road, where we know that the amount of traffic has increased steadily, if not explosively, over the period covered, can we be really proud of the achievement in lives spared. However, for road deaths the figures are still frighteningly high, even in the best countries. Also the aviation industry finds its accident statistics too high for passenger confidence. 3. If we look at major disasters there is no evidence that the trend is
significantly downwards in process industries. It is these major accidents which drive the media and politicians, if not the public at large, and keep our preventive efforts going, as well as, incidentally, keeping our research funded.
4. These figures of accidents, particularly in developing economies and infrastructures, but also in the darker corners of our developed economies where temporary, part-time and migrant labour dominate, still represent a horrific toll of life and suffering, which we can never regard as acceptable. Almost 1000 people die world-wide in work accidents every day of every year and a multiple of that figure in road accidents.
has been plucked and further reductions in accidents, if we want them, cost more effort in both research and implementation.
What have we researched and written about and is it important?
An academic discipline is always judged by its peers on its publications in refereed scientific journals. Whether that always gives a complete picture of the achievements of a field, is something that we can also question. The field of safety is a very applied discipline, like all of engineering and management. The proof of its pudding is in the success of the changes it brings about in the real world and, like all applied sciences, a lot of its work is written up only in conference papers, company and government reports. It has been one of my tasks as editor of the journal Safety Science to try to persuade the people who write that grey literature to take the extra time to make a publishable paper of it and to persuade reluctant managers and nervous company lawyers to allow researchers and practitioners to publish results, even if (or perhaps especially if) they are negative ones. It is an indication of the growing status of the subject area that I and my fellow journal editors are increasingly inundated with papers from people who do just that. Let us accept that journal publication is a useful indicator of a subject area and ignore for the moment one possible factor in the increase in journal publications, namely that academics get tenure, career progression and funding proportionate to their publications and hence write and publish more even if they do not always research more.
makes the contributions of the Scandinavian countries and the Netherlands the more impressive. In the last ten years we see a great leap forward for a number of countries of Europe, reflecting the increasing dominance of English. Most notably we see a world-wide diversification in countries publishing, with strong development in countries like India, China, Taiwan, Japan, Korea, the Middle East and Eastern Europe. Authors from these countries tend to publish (as yet) mainly on technical safety subjects, but it is clear that they will be setting an ever-increasing stamp on the development of our subject area in the decades to come. If we compare these figures with table 1 we see very clearly that the rates of publication and of accidents are clearly negatively correlated. What the causal relations are is an interesting, but complex question. What the correlation does raise as question is whether the expenditure on research is well directed and whether the insights from the research in developed economies are in the least bit useful for the developing, or whether they have more to learn from our past than our present.
A broad division of the area of risk addressed by the papers (figure 7) shows the dominance of road safety and of risk in the so-called major hazard industries of the process industries, chemicals, energy, oil and gas. Occupational safety comes third, with only about half as much attention. Other transport modes, consumer and public safety and the risks of other aspects of life are way down the scale, at least in the journals surveyed5.
The number of deaths and hospitalisations in the Netherlands6 in each area
is also shown in the figure. The conclusion seems unavoidable that, apart from traffic accidents, the expenditure on research and publication is inversely correlated to the number of accidents occurring. We can pose the same question here as above for the geographical distribution. One of the challenges for the future is how to redirect at least some of the research effort towards the areas with the most accidents. Sometimes it is said that they do not need research, as they are very simple accidents. However, the fact that these simple accidents keep on happening with great regularity is a subject of research in itself.
5 Since the main consumer safety journal and the main societal risk journal
could not be included in this survey – see footnote 2 – this picture is somewhat distorted, but even with an analysis of these journals the overall picture would not change significantly.
6 Figures for 1992 from Central Bureau of Statistics, the last date these
The final dimension of analysis is that of the research topic. Here I have grouped the papers in broad categories of subject area, following the levels in a system model (figure 8): technical, human, organisational, societal7.
The technical and human behaviour topics are dominant, with organisational factors increasing after the end of the 1980s, but these are still far from major research concerns, despite the rhetoric, from myself among others, that we moved in the 1990s into the third age of safety (Hale & Hovden 1998), with a concentration on the management of safety. That may be the practical reality of safety in the major hazard industries and transport systems, but the research community has not made the switch yet. Also doing research on organisational (let alone societal) influences on safety is a much harder process, given the large size, slow dynamic and intractability of the unit of study compared to individuals or to hard– or software. What is striking at a more detailed level of analysis than is shown in figure 8 is that, of the 6058 articles coded, there are only a few hundred
7 Some relatively arbitrary decisions were necessary here in allocating
studies evaluating preventive measures at any system level and that studies of small and medium-sized enterprises are almost non-existent (21). Again the question must be raised of the match between research effort and the size of the accident problem, or the importance of an evidence-based approach to it.
Some challenges & achievements and their implications for the future
I want to leave the global trends and figures now and dive into more detail. I have had the privilege to work in, and later lead the safety science developments in two major European centres of research and teaching, firstly at the University of Aston in Birmingham in the UK and later at the Delft University of Technology in the Netherlands. I want to use the experiences and achievements of those two centres to underline what we have already achieved, but also to point up some challenges for the future. I will do that under the two broad headings of teaching and research.
Teaching
Systematising safety
One of the first milestones in the societal control of safety was the appointment of the first four inspectors of factories in the UK in 1833. They were described in a speech of one of the opponents of the factory reforms as “a briefless lawyer, a broken down merchant, a poor aristocrat and an intimate friend of Lord Drummond – incompetent for their task, but amply provided with the most unconstitutional means of annoyance and mischief.” ( Short Time Committee 1833)
These men were indeed amateurs, but it fell to them to develop the professional practice of labour inspection and the subject of safety and its regulation from their experiences in enforcing the first effective Factories Act of 1833. For 140 years that knowledge of how to improve safety through regulation was handed down through on-the-job training.
historian, a social psychologist, a medical scientist, an ex-manager and a chemical engineer, giving an indication of the breadth of disciplines needed to teach the subject.
A very similar experience awaited me in Delft in 1984 with a team no less mixed in background, but more biased to engineering (aerospace, electrical, mechanical, agricultural, chemical & building technology) and less to occupational health, but with a biochemist, and an information technologist and later leavened with a sprinkling of psychologists from cognitive and from work and organisational variants and from sociology, and later still by more disciplines, such as technology policy and civil engineering.
Such multi-disciplinary teams have the ingredients to study and control risk, but it takes a long period to learn about each other’s approaches, methods and skills and even longer to learn how to put together those disciplines into something coherent which can be researched, practised and, above all taught to others. There has always been a controversy as to whether subjects like safety science should be housed within one organisational group, or should be brought under in virtual centres, each person being loaned to the centre on a project basis as his or her skills are needed. The experience of establishing the centres in Aston and Delft have convinced me that it works by far the best if the people concerned are working for one group, who can dispose of their time and claim their full loyalty. Those outside that group seldom integrate so well. There is not enough intensive contact with them, in particular those vital informal contacts over coffee, lunch and in the bar to challenge and break down the interdisciplinary barriers and get genuine integration going. The experience of how fragile and vulnerable to university politics and to the departure of key staff such multi-disciplinary centres are has coloured my concerns about the longer term survival of the group here in Delft. It is particularly pleasurable therefore that a strong successor, in Ben Ale, has been appointed to continue the development of both the core group of Safety Science and the virtual centre of the Risk Centre that surrounds it, bringing in those working in several other faculties on related topics. Hopefully this combination will ensure the best of both worlds.
relevant to safety to the needs of the course and the subject. That was in my case the origin of my first book (Hale & Glendon 1987), but such books still remain largely within one of the primary discipline. The full coherence of the subject only emerges, if at all, in the minds of the course members exposed to all of the teaching. However, if they are vocal, they pose the questions to the lecturing staff, which force them to discuss and uncover the coherence in later versions of the course. True integration comes when graduates of the course are taken on as future lecturers. So emerged the Masters and Diploma courses in Occupational Safety & Hygiene in Aston in the 1970s and, building on this, the Masters in the Management of Safety, Health & Environment in Delft in the late 1980s. After 40 years the process of systematisation is still going on and I hope to contribute to it further in the coming years by putting down in book form the fruits of the many hours of discussion. Central to such a book, or perhaps even series of books, will be the precepts of systems thinking, which can provide a framework to unify all of the different disciplinary elements into a coherent whole.
Developing a body of practitioners
A subject area needs a group of practitioners in order to turn it into a discipline. The courses just mentioned have been a major contribution to developing such a body in those two countries. Aston trained the minds of more than a generation of the British Health & Safety Executive inspectors and of many safety professionals now in senior safety jobs. Similarly Delft has trained, through the MoSHE course and shorter versions of it for heads of safety services and inspectors of oil and gas, some 280 safety professionals, particularly for the major hazard industries, but also for government, defence, accident investigation and consulting. This has been the flagship of the Safety Science Group from which its contacts with practice in the field have flowed, which has been fed by its research and which in turn has fed that research with new questions about how to improve practice. Together with the HVK-courses run by the Stichting PHOV, with which there have always been a fruitful exchange of ideas and training designs, it has produced a body of professionals at senior level now determining the policy of Dutch and multinational industry and government in this area.
of health and safety professionals in the 1980s and 90s and now the European Network of Safety & Health Professional Organisations in this decade. It culminated recently in a major survey of what safety professionals actually do, conducted across 13 countries and still being analysed (Hale & Guldenmund 2006). This has helped to feed the discussions about harmonisation of qualifications across different countries and the relationships between and overlaps with other working conditions and risk professionals such as the occupational psychologists, ergonomists, occupational physicians, occupational health nurses and work and occupational psychologists. Such research can inform and guide the discussions which have been conducted over almost 50 years about possible alliances, federations, or even mergers between some of these groups. This has reached a recent peak in the Netherlands with discussions now going on between the three main prevention professions about some form of federation to underpin their increasing cooperation.
The future of safety education
I have painted a relatively rosy picture of developing and consolidating courses for future practitioners in the field. But there is another constituency which is equally important, if not more so, namely the future engineers, managers and other professionals whose decisions determine whether risks will taken in day to day work; the graduates of universities and higher technical colleges.
process of educating the line and staff to take over all of the systematic safety tasks and to integrate them with their other tasks. This results in the safety department shrinking in size and retiring to a position of auditors or monitors and of initiators of new initiatives to meet any changes in technology, organisation, regulation or risk perception which may appear on the horizon. In Delft, and earlier in Aston we flourished by training the specialists for stage 2 in industry, but let us now apply the stages to Delft University itself and how it fulfils its role in incorporating safety into its teaching and research.
What better place to start than with the University’s statements of policy. I quote from a very recent document ‘Roads to Innovation’, which gives the plans of the university for the period 2005-2008. Under the ‘Mission and Vision’ on the first page after the introduction we find this.
“The TU Delft is a diverse and societally oriented university which intends to offer education and conduct research of an internationally recognised level of excellence in the technical sciences. Teaching, research and design are intimately interwoven with the perspective of application in society. The TU Delft works
on the development of technology for future generations from the basis of the core values of sustainability, safety and the strengthening of economic vitality.”
training safety and risk specialists is a good indication that stage two is going well.
However, if we look for the signs of stage three, they are not so encouraging. We need to ask the question whether the university means what it says in its policy statement and whether it commits the resources to fulfilling it. A diligent search of the remaining 55 pages of the ‘Roads to Innovation’ document, with all its noble and exciting plans, fails to uncover any further use of the word ‘safety’ at any point. I fear that here, as in so many organisations, there is still a gap between policy and practice that will need the loud voice of a strong champion of safety to bridge. Safety will not of itself take root in the practices of a university, any more than it does in a company or a government. We still need dedicated safety professionals in research, teaching and practice to work for that end, but above all a leadership committed to implementing its safety goals.
values. The Risk Centre would be a perfect vehicle for supporting, monitoring or auditing this commitment.
Attempts to persuade the Dutch Education Ministry to formulate a similar requirement for the whole of Dutch higher education in the wake of the 1989 study came to nothing because of a fear of appearing to dictate policy centrally and of treading on the toes of academic freedom. An initiative at European level in 1991 (ISSA 1991) to introduce a directive requiring a demonstrable attention to health and safety in education at all levels from school through to vocational training also failed for similar reasons, with the additional internecine complications that the Directorate General responsible for education resented the initiative for action coming from the DG concerned with employment. The ENETOSH project, recently started in Europe is trying again tackle this objective, but on a much more voluntary basis (Bollman 2006). Let us hope that, if national or European governments will not take an initiative, local universities such as Delft will, to put the flesh of deeds onto the bones of the fine words in their policy statements. I would like to challenge employers’ federations and professional bodies to approach the relevant deans of faculties and rectors to persuade them just how important an understanding of risk management is to the success of the strategy of self regulation which so many countries have implemented in the last 30 years. If designers, managers and professionals do not understand risk and how it emerges and can be managed, such an approach is a dead letter. Employers should declare graduates unemployable without such a baggage integrated into their university, professional and technical training.
Research themes
I have laid an emphasis on training and education because it represents the system and structure of a discipline, but Delft has been for the last 20 years more a place of research than of teaching.
From a more or less random set of research contracts from external sponsors, with a pot pourri of research topics, some of which were difficult to distinguish from consultancy, we have gone through a phase of defining themes for focussing research (Hale & de Kroes 1997) to a mature research programme which got a 4 on a scale of 5 from its last external review in 2003. The themes which have emerged in Delft can be grouped under four headings:
• risk analysis and modelling;
• safety regulation.
The last is a relatively new development in collaboration with the Faculty research programme on ‘Reflection on Technology’. Our Delft group has worked in the past on issues such as the shift of regulatory attention from hardware to management systems(Kirwan et al 2002), but this had not been a major area of research. Recently we have received a great boost to that area from the arrival of Ferdinand Mertens as professor in our group and I refer you to his inaugural speech for a review of the challenges there (Mertens 2006). I will take up the other three themes and indicate some highlights in them.
1. Risk analysis and accident modelling
aircraft gate-to-gate, or working from ladders). Only then can you understand how earlier steps in the process create the conditions for later accidents or exposure and what resources and controls are necessary to keep the processes on the right path. However, the problems arise when we try to quantify the causal links in order to prioritise management actions. Because organisational factors have many to many links with human and technical causes they violate the basic requirements of fault tree analysis that causes should be independent in each part of the tree. Indeed we have defined safety management, perhaps perversely, as the creation of an effective common cause that strives to ensure that all technical and human causal factors operate continuously at the lower bound of their failure rate range. Solving this quantification problem is a major challenge which is still being tackled in our current projects on general accidents and air transport accidents. Quantification does, however, force a clarity of formulation of issues which poses new and interesting questions for research about exactly what aspects of management influence which aspects of risk. With the help of expert judgement, developed for deriving data on technical aspects of risk, progress is being made in this difficult area in collaboration with the Group of Roger Cooke in Mathematics (Goossens et al 2006). Quantification also forces us to ask the question about exposure – how often or how long was the hazard present and were accidents possible. About exposure we have traditionally had practically no data, a gap which the recent work for the Social Affairs and Employment Ministry is now trying to tackle with specifically designed surveys (Bloemhoff et al 2006).
One of the things which we have learned in all of this modelling is that safety and risk control is irreducibly complicated. Senior managers who ask for a safety management system to be explained on the famous ‘one sheet of A4’ are kidding themselves. That may work for a company employing five people in an office environment, but never for one with significant risks or a workforce of more than about 20. That means that there is a major challenge as to how to visualise the risk control system in such a way that it can be interrogated both at a global and strategic level and at a detailed operational level. We have experimented with the Structured Analysis and Design Technique (SADT), which offers a hierarchical view of systems and their transformations, allowing one to unpack a generic view to see deeper into the detail of each box (Hale et al 1999), but these pictures soon run aground in a welter of lines and arrows resembling tangled spaghetti. This problem will still be a challenge in the future.
escaping energy or substances which we could contain or divert with barriers, which simply had to be designed and put in place. Given the rules for their use, which were seen as holy writ, to be obeyed literally, the problem seemed solved. Breach of them was a violation to be tackled by replacing, disciplining or retraining the violator. Safety acquired, because of this, the image of a boring, bureaucratic process of going through endless checklists and being obedient and obsessive. However, we have known for many years intellectually that systems are dynamic and have many closed feedback and adaptation loops, especially once we start to model the influence of humans and organisations. Control engineers, such as Cownie & Calderwood in 1966 put forward models of safety with feedback loops, showing adaptation of behaviour based on observation of performance the previous time. Wilde worked out those ideas in his theory of risk homeostasis (Wilde 1994) and set off a storm of protest and research by claiming that many hardware barriers introduced into the system simply trigger behavioural adaptations which, in time counteract the expected effect on safety performance. Perhaps the policy based on this risk homeostasis theory, which it is simplest to grasp, is that of the catholic church concerning contraception: if you make condoms freely available, you will increase the risk of sexual intercourse. Other examples are the tendency for new or widened motorways built to alleviate traffic jams to attract more and more traffic until they too snarl up with traffic jams, and the tendency for designers to stretch and expand each generation of building, bridge or other structure until one collapses.
We need also to develop more tools to anticipate the effects of such dynamic forces. For example every set of rules, whether at operational level or at the level of national laws and regulations will always be bent, violated, or otherwise used creatively to fulfil the ends of the rule followers, alongside or in conflict with the ends intended by the rule makers. We need a tool to review them, that helps to predict how and when this will take place and we do not have that yet. If we can anticipate that, we can have a chance of putting in place other measures to discourage such rule bending, or at least to monitor and correct it.
A full implementation of such dynamic notions would move us away from the static models of risk, currently based on fault and event trees, which are therefore only snapshots in time. It would lead us towards models which would be more like dynamic management simulators, in which one could learn to drive complex systems and their risk levels at a strategic level.
2. Safety management systems, culture and learning organisations
based also on a closed loop model, linking management to the functioning of risk control measures, which are conceived of in this figure as barriers (fig 11), but can be equally well seen as measures to keep you away from the boundary of the safe envelope.
guaranteed by a risk analysis and learning loop to maintain adjustment to the dynamic environment. This just about fits the famous ‘one sheet of A4’ but gives far too little detail to be very useful except as a general structure. Each structural element in figure 11 is worked out only to one more level of detail, as shown in the example of procedure management in figure 12.
The audit manual that explains it and shows how to use it takes up almost 100 pages. It is designed as a management model for well-developed safety management systems and is predicated on the idea of an audit as a process whereby the audited company explains how it manages itself to achieve the relatively simple set of functions represented by the blocks in the figures. This is called ‘scenario-based auditing’. This notion of auditing as Socratic questioning and ‘story-telling’, coupled with critical assessment of the quality of the stories is fundamentally different from the audit based on a very lengthy checklist of items to be ticked off as present or not. This notion of ‘story-telling’ is one which I believe is vitally important to the whole practice of safety. Accidents become meaningful only as stories and not as dry statistics8. Only then, when placed in context, will they move decision
makers to action. Stories too are full of emotion, which is a seriously
8 In recent work for the Dutch Social Affairs Ministry 9000 of these
underestimated factor in determining managers decisions to take action (Rundmo & Hale 2003).
We need now to turn our attention to validation of this management model. A review of the safety management literature almost 10 years ago (Hale & Hovden 1998) revealed how sparse the scientific proof is for the importance of each of the elements defined in most guidance documents and management handbooks. A recent study in the USA (Robson et al. in press) found only a handful of studies that met even some of their criteria for scientific validation of a management intervention, out of a first filtering of several thousand potential scientific papers and reports. This is an area of research which it is difficult to carry out. Before and after studies of management interventions take time and few changes are clean introductions of single management system elements. Usually many things change at once or in overlapping sequences, making it hard to distinguish what is having what effect. Comparative studies of larger cohorts of matched companies with good and poor safety performance are hampered by problems in measuring safety performance independently of the SMS (companies with undeveloped SMSs have bad reporting systems to pick up accidents and near misses and can therefore appear better than good companies), but it is worrying how few attempts have even been made to set up such research or to document longitudinal case studies in single firms. Above all much of the literature which there is does not appear in refereed journals, as the relatively low figure of 182 papers over 21 years in my survey shows. One suspects that there is no influential actor who has an interest in validating these management and audits systems. Consultants can still sell SMSs with no difficulty without any proof of efficacy; certifiers make good money from conducting standard audits; companies go by word of mouth in buying, or developing their own SMS or audit system and regard them as no more than logical expressions of obvious requirements needing no scientific proof. Governments have been so busy switching their regulatory oversight to management system assessment in order to reduce inspection numbers and conform to the fashion of self-regulation that they have not dared to conduct or finance research which might show that such management system assessment has no predictive value in relation to safety performance.
safety rules are needed, only of where and by whom they should be devised – the answer being as close by practice as possible. If one level, such as government, makes less rules, then, either a layer below must make them instead, or the rules must be passed to the trainers and they must be lodged firmly in the heads of the users as part of competence management. Self-regulation therefore needs to be accompanied by more local rules and more effort to include safety and risk in all technical, managerial and professional training. I repeat my call to government and employers to ensure they put pressure on educational and training establishments to ensure that that objective is incorporated in all such courses as something they have to demonstrate their compliance with.
Again under this heading of management systems we meet the problems of links between system levels and of the dynamic nature of safety. The structure of an SMS tells only about what has to be done and how the management processes should be set up to function. It does not tell whether they do function and whether they engage with the right ‘handles’ at the level of hardware and behaviour, so that the primary risk control measures are correctly chosen, installed and kept working to specification (or better ‘to dynamically changing requirements’). An audit has to penetrate through the paper work and follow a trail into the practice of operations. Here we also meet another area of Delft research, that of Frank Guldenmund, who is trying now to do for culture and safety climate what we have done in the past for the SMS structure, namely to understand and define it, measure it and show how it relates to the structure and functioning of the SMS and its performance (Guldenmund 2000). Our criticism of the state of the field at present is that it is still immature (only 48 published papers in my survey, largely from the last ten years, though there are far more in the pipeline) and there is far too little concern for evaluating whether differences in culture or climate are reflected in differences in safety performance or its proven precursors.
change as the enemy of carefully established risk control systems. The central step in the design of any set of safety rules (see figure 13) is therefore the step of evaluating and changing them, when experience or changing demands make them obsolete. Dynamic change signifies life, ‘rest is rust’, as the Dutch saying goes. Without such a provision the rules as written and the practices as lived and worked drift far apart, as the studies by Mathilde Bourrier (1998) in the French nuclear industry and of Siobhan Corrigan (2002) in the aircraft maintenance industry have shown. Rules are bent, with the connivance of all concerned, because otherwise the activity grinds to a halt because of its in-built contradictions and inefficiencies. Short cuts (shop practice) rule until something goes badly wrong, when the senior echelons throw up their hands in hypocritical horror that people could be so disobedient to such clearly written rules. Only if we get this routine violation out into the open and accept and manage it, will we avoid these periodic scandals.
3. Safety in design
of prevention of accidents in industries such as construction, or to design and layout workplaces in many industries dominated by SMEs, it is not that the solutions to the problems are not known by our discipline, but that they are not available where they are needed when people are making the decisions about infrastructure, equipment, workplaces or risk control measures. The latest reforms of the Dutch Working Conditions Law place an emphasis on industry branches developing their own catalogues of safety and health solutions; hopefully the old work done in Delft can be dusted off and applied to make them work.
Another strand of research has been the development of tools to aid the development or evaluation of new technology to better take account of its safety implications, or to match better the needs and mental models of its potential users. Ellen Jagtman (2004) extended the use of the HAZOP method to road design and in-car information technology. Erik Wiersma (Butter & Wiersma 2002) has developed tests for assessing situation awareness in vessel traffic controllers and Maura Houtenbos (Houtenbos et al 2004) is just finishing a study on the way in which motorists interact at junctions and crossroads and what clues they use to adapt their behaviour to each other (the dynamic nature of safety returns here with a vengeance). Jaap v.d. Top is at an early stage of putting all of this knowledge to use, together with the insights from the risk modeling, in trying to drive the development of new technology and operating practices on the railways to make more flexible use of capacity without sacrificing safety9.
Future challenges for research
I want to widen my horizon in this last section from Delft to the whole discipline of safety science. I want to look at where the frontiers of our research are and suggest a couple of directions I think that progress should go, not just here in Delft, but internationally.
Two faces of Janus
My review of the scientific literature showed that the vast majority of the research published has been on the major hazard industries and disaster risks. Only road safety, of the activities which kill their participants in ones and twos rather than in tens or hundreds, has had comparable attention paid to it. Major hazard risks and their prevention are complex and high-tech and
9 This paper, long as it is, is too short to mention all of the staff and doctoral
hence they are sexy. They require very sophisticated methods and models to understand the interactions and emergent situations leading to disaster. They tend to be under the control of large, visible and in most cases responsible and well-intentioned companies, who actively seek help from researchers to fine-tune their preventive measures, safety management systems and cultures. This provides a paradise for researchers and Delft has profited from that climate to do the vast majority of its research work. It also provides a relatively easy life for regulators, with a high level of mutual trust and a feeling of professional camaraderie between industry safety professionals and inspectors. It is the smiling face of Janus. His scowling face is represented by a proportion of the ill-intentioned and ill-equipped small and medium-sized companies, the back street and home based industries, the labour-only contractors, temporary employees and the developing countries to which risky, polluting and unhealthy industry is exported. Progress in improving safety in these would be far more effective in lives saved, but the companies are shy of research and intervention, if not pathological; are concerned with making a quick profit, or simply surviving in a cut-throat market. The problems are not ones of understanding the risks and what is needed to control them, but of spreading knowledge about known good practices; understanding how to overcome the barriers to implementation; uncovering and punishing blatant flouting of the simple rules of prevention. The relationships with experts and inspectors is conflictual and their work resembles more that of the police than of the friendly adviser. There is little or no support for doing research to improve the situation, as the very small number of published research studies on these areas in my survey shows. In this area Delft, but also many other groups, has made little contribution.
It seems to me urgent that both governments and research funders recognise this scowling face of Janus, give it more priority and adapt their strategies to it10. The approaches which work for the one face do not work for the other.
Researchers such as Westrum (1991) have developed safety culture maturity scales to represent the steps leading from the pathological state or face to the smiling, generative one, but we know little or nothing about whether it is indeed possible to mount that scale, and if so how. We have not defined whether we should be trying to shift companies all the way from one to another end of the scale, or that we would be happy if the bulk of companies made it to the halfway point and became ‘calculative’. Longitudinal research studies of companies to plot such shifts and how to
10 This is no new viewpoint. Authors such as Carson (1979) have pointed
facilitate them are desperately needed. We might also need to expand our discipline base to do it. We would need more input from sociology, law and criminology, anthropology, economics and politics than we now have in Delft with our concentration on that smiling face of Janus.
Self-regulation
The divide between the well-intentioned and the cowboys also raises questions of a fundamental nature about the philosophy of regulation. The last thirty years have preached self-regulation (Robens 1972), the responsibility of the risk creator, the reduction of government intervention, the shift from rule- to goal-directed regulation, inspection of safety management systems and not of nuts and bolts. Many governments have responded accordingly, using this gratefully as an excuse to slim down the apparatus of government. However, not everyone has been happy to be given the burden of self-regulation and making their own rules, the SMEs particularly not. They thought initially that self-regulation would mean de-regulation, but it does not, or at least should not if we care for retaining a good safety performance. SMEs often plead for clear rules as a way of reducing this burden. This seems to parallel the division between religions which emphasise free will and personal responsibility and those which emphasise the strict adherence to an extensive code of explicit rules. We have seen increasingly clearly over the last five years that these do not sit comfortably as religious philosophies side by side in one culture. Is it possible to implement both approaches in safety regulation, allocating companies or sectors to self regulation or strict rule-based control, or letting them do that themselves, but creating well-defined ways to graduate from one category to the other, with clear tests? This seems to me a challenge for regulators, but particularly for enforcers. They need to be as unpleasant as possible to the pathological and reactive companies to give them the incentive to graduate to being at least calculative. They also need an audit tool to tell them when a company, or set of interacting companies in a complex system, can be trusted to self-regulate (VACS 2005). It is also a challenge to know what proportion of companies can be trusted in this way – the optimist say the majority, the pessimists think it is a very small number.
The big picture
process has been the overview of how safety and health is faring in those sectors. In studies in the period before commercialisation of the certification of pressure vessels, lifts and lifting gear (Pietersen et al 1996) we warned of this. We have seen its loss again in railways (Larsen et al 2004) and studies in the Dutch aviation sector (K+V 2005) have demonstrated that it does not exist there in a sufficient degree to optimise safety management efforts, or to detect threats to safety from sub-optimalisation by individual actors in the system. No one actor in the system has enough of the knowledge of what is going on to have a global view of how well or badly the system is doing and whether something should be changed. We have seen the same problem rearing its head in the series of scandals in the building industry in the Netherlands in the last few years, with threatened, or actual building collapses because of a lack, or loss of oversight of the building process as expensive construction controllers have disappeared, because they have been scrapped from the law. Cutthroat competition ensures that this is seen as a way of cutting costs without immediate consequences – they come later.
Perhaps we can apply the same development steps I outlined above for the safety management system to the regulatory system. Step 1 in this case is the realisation that legislation is needed, something achieved for occupational safety in the 19th century and for other technologies early in
One strategy which regulators seem to be trying, for example in the railways and aviation, is to try to allocate a certain risk budget between the different organisations making up the whole system and requiring each to prove that it stays within this figure. Whilst this takes one step towards the monitoring I have asked for, it discourages, rather than encouraging any collaborative effort between the actors. It encourages them to ignore interfaces with other system actors and optimise within their own budget, even if this causes extra problems for others. Level crossings then become an interorganisational battlefield as to whose accidents they are that happen there, rather than a joint challenge to find an integrated solution. A far better idea would be for the regulator to place an obligation on the sector parties to present a joint case as to how they remain within the overall risk criteria. This would encourage the sort of strategic and extensive discussion of how the various safety management systems fit together, which studies such as that at Schiphol (K+V 2005) show are now missing.
Absolute safety & absolute blame
I want to move now to a critical note on another fundamental basis of our philosophy in safety. That is the notion of zero accidents as an objective. It has been used as a rallying cry for the national road safety campaign in Sweden (Tingvall 2002). It is also the objective stated by many major hazard companies. This seems to be a shining example of altruism and concern for mankind, a notion on the same level as ‘motherhood and apple pie’ for the American culture. What could possibly be the objection to it, at least as ideal? My concerns are that it is, for many, too far off to be motivating, but much more fundamentally that it ignores the fact that safety is not an independent property of a system. It is always achieved in relation to, and trading off with other system goals. Whilst it may be possible in many instances to achieve very considerable improvements in safety without jeopardising seriously any other important system goals, ultimately there will be trade-offs. Claiming zero accidents as a goal denies those conflicts, or relegates them to unimportance in the face of the missionary zeal of the safety champion. This is to me safety’s equivalent of the cries of fundamental religious groups, subordinating all other goals to their one vision of the right path to salvation or paradise. Zero accidents is a pure, hard and shining ideal – I almost said ‘one worth dying die for’. All talk of relative risk and compromise smacks of heresy. However, something denied is something unresearched. It cannot be made explicit, so that it can be managed.
concerned; school children are deprived of visits around local farms because the teachers are not willing to accept liability if accidents happen under their supervision, old people’s homes close down because they cannot afford the upgrading to meet new safety standards and leave the potential residents in their much more dangerous own homes; labour inspectors require line closures on the railways to protect maintenance workers on the neighbouring track and displace passengers onto the significantly more dangerous road system; Indian ship-breakers strike to protest at their loss of employment, because the French government decides not to send the marine ship the Clemenceau to them for demolition because of the asbestos content. These are only a few random examples. We need better ways of looking not just at the costs of risk, but also its benefits, so as to optimise better.
However, if we accept risk and say honestly to ourselves that some accidents are therefore not worth the cost of avoiding, we have to face another conflict which we do not currently manage well. That is the conflict between perceptions before and after an accident – the curse of 20:20 hindsight. This is a difficult area. Victims seem increasingly to want to see somebody’s head roll when an accident occurs. This is important to them in coming to terms with the pain and sorrow of loss and injury. Lawyers on the behalf of victims want compensation and punishment and look for a ‘smoking gun’ in somebody’s hand, who knowingly made a decision leading to the accident. Lawyers for the defence require their clients to keep their mouths shut and admit nothing. The victim is the openness required for learning, as the case of an air traffic control prosecution at Schiphol after a runway incursion accident has shown us. Two controllers were prosecuted, partly on the basis of the information contained in the internal company incident reporting system. The result was a drop in reporting of potential problems and learning opportunities of more than 50%, which still has not recovered to normal levels today. As a result, our airport may well be a more dangerous place today than it could have been, as its learning system is crippled. This is but one example of a general dilemma for safety: is it about blame and punishment, or is it about learning to do better. We cannot have both. Learning fits with self-regulation and punishment with the Ill-intentioned and we are back to the question of how to categorise companies and industries into these contrasting boxes.
such cases from all sides to see how these different theatres of discussion – prevention, compensation, punishment and rehabilitation of victims and their dear ones – can be better reconciled.
In both these areas of conflict the role of safety science must be, in my view, to clarify the arguments and do research to test them. What are the costs of increased safety, in terms not only of money but also of loss of other system goals? What is the effect of punishment after accidents on those concerned, both victims and perpetrators and on those involved in potential future accidents of the same type? What mechanisms can be found to reconcile in the minds of victims the desire to see punishment and the need to make improvements and to learn? How does the conceptualisation of accidents and their causal factors in the minds of lawyers and the practice of liability, insurance and compensation overlap or conflict with the insights of safety science and the needs for prevention?
If we have better insights then we can help practitioners better in deciding when to stand their ground and defend the existing or proposed safety rules, despite their detrimental effect on other system goals, and when to be flexible and let the notional boundaries of the safe envelope be marginally exceeded.
Evaluation
intervention and in comparison with other research areas such as medicine, where more evaluation papers are published in one year than we have in 35. Our own field studies of a steel company, returning over a period of 15 years to re-evaluate the progress of the safety management system is one of the few longitudinal studies in the literature (Swuste et al 2002). I welcome in this respect the recent approach made to me as editor of Safety Science by the Cochrane Collaboration11, a foundation originally set up to stimulate
and collect reviews of the state of the art of validations of health interventions. They wanted to extend the work of the Collaboration more into the area of injury prevention and control. The first reviews have been agreed and it will be valuable to see just how many such evaluations per area chosen can be found. I fear it will not be very many.
Why is it that we are so prepared in the practice of safety to accept and implement sometimes very costly preventive measures, including whole safety management systems, without any good scientific basis as to whether they work or not? Do they seem so logically obvious that they do not need validating? Is there no interested party rich enough to carry out the research? Is it carried out, but does it never reach the scientific journals, because it is done by companies only interested in the results for themselves? I guess it is a bit of each of these. However, we know enough cases of things which seemed self-evidently true, but which turned out not to be so, to be very cautious here. Trevor Kletz (1979) in his inaugural lecture as professor of Chemical Safety Management in Loughborough almost 30 years ago discussed a number of these in relation to process design. The history of the love affairs of the safety field with the concept of accident proneness (Shaw & Sichel 1971) and with the Heinrich triangle (Hale 2001) show in other areas how perfectly respectable bases for prevention within a well-defined area can be extended outside it into areas where they are at best unproven and at worst have no preventive effect, or even divert resources from more useful measures. As candidates for well-designed validation studies I would have in my priority list:
• certification schemes for safety management systems such as the Safety Checklist for Contractors (SSVV 1997), or audits to OHSAS 18001 (BSI 1999)
• safety training programmes and qualification schemes at all levels from operator/worker/driver to senior management
• driver support technology in cars • outsourcing of safety critical jobs
• goal- vs rule-based legislation in specific industry sectors, with particular respect to SMEs
• advice from safety professionals
The last is inserted partly as an indication that he who calls for validation should be willingly to offer himself up to the same process
Some reflections on a career in safety
I hope that this tour d’horizon has shown that life in risk research can be fascinating. I want to stress also that it has been enormous fun.
I got my first taste of investigating accidents in a project which investigated 2000 minor accidents on the shop-floor (Powell et al 1971) and I then moved on to a major project investigating hundreds of switching errors in area electrical distribution networks. The opportunity to find out how fascinating accidents could be I owe to Dr Dick Buzzard and Philip Powell, the designers of those projects at the National Institute of Industrial Psychology in London. Professor Gordon Atherley chose me to help build up the Safety & Hygiene Department, later the Occupational Safety and Environmental Health Department at Aston University , together with Richard Booth now professor there and Dennis Else, now professor in Ballarat in Australia and former chairman of the Australian Health and Safety Commission. I owe to them and my other Aston colleagues now spread around the world my training in multi-disciplinarity, as well as the basis of my international network.
Eindhoven, after Delft decided for us that medical safety was not our core business; Ben Ale my worthy successor, bringing disaster management with him into our orbit and Ferdinand Mertens extending our coverage into regulation and enforcement.
My career in safety is characterised by my asking what I thought were simple questions, like: what are factory inspectors expected to do? How do individuals behave when faced with danger? Does safety training work? How do designers take account of safety? What is a good safety rule? And many more. In each case I thought I would be able to go and spend a couple of hours with an expert who would tell me all I wanted to know to be able to get on with the real work of putting the answers into practice. In each case I found that there was no expert who could tell me. As a result I usually ended up doing a minimum of five years work to try and find an answer that satisfied me, at least as a first approximation. Each time these questions took me into new areas and I could have the fun of playing the outsider asking the naïve, obvious questions that nobody else dares to ask. They often give the most revealing answers. You might say that I have become an expert in being a non-expert. Come to think of it that is perhaps not a bad definition of a safety professional. In that process I have moved up the levels in the system hierarchy. I started as biologist turned experimental psychologist; moved from individual behaviour in the control of danger to safety management and then got interested in safety regulation. Above the government and societal level in the system hierarchy there is only the transcendental. My scattered references in this speech to the parallels between safety, risk perception and religious beliefs may indicate my first steps along that road to the final meeting with my maker.
Let me at the end of this lecture return once more to the TU Delft plan “Roads to innovation”. I was delighted to see on p29 that the university wants to retain contact with its emeritus staff. I shall be happy to keep that contact in what I hope will be a few years of productive mutual exploitation. There are still books and papers to write, PhD students to supervise and a few more naïve questions to get answered. But the worry of keeping it all together and developing it further I leave happily to my worthy successor, Ben Ale to whom my last word of thanks goes for taking the concerns of management off my shoulders. Our names have caused confusion ever since I came to the Netherlands, so perhaps nobody will notice that we made the switch.
References
Storybuilder: a tool for the analysis of accident reports. Reliability Engineering & System Safety (in press).
Bloemhoff A., 2006. Search for exposure data. Paper to the 3rd
International Conference on Working on Safety, Netherlands.
Bollmann U. 2006. ENETOSH - European network education and training in occupational safety and health. Paper to the 3rd International
Conference on Working on Safety, Netherlands.
Bourrier M. 1998. Elements for designing a self-correcting organisation: examples from nuclear plants. In Hale A.R. & Baram M. Safety management: the challenge of change. Pergamon. Oxford.
British Standards Institution. 1999. OHSAS 18001:1999. Occupational health and safety management systems. Specification. London. BSI.
de Bruijne, M.L.C. 2006. Networked reliability: institutional fragmentation and the reliability of service provision in critical infrastructures. Doctoral thesis. Delft University of Tehcnology
Butter, R., Wiersma, J.W.F. 2002. Situation awareness in maritime traffic control: a comparison of two methods. In: D. de Waard (ed.); Human Factors in Transportation, Communication, Health, and the Workplace. Shaker Publishing BV, Nederland, , p. 377-385
Carson W.G. 1979. White collar crime and the enforcement of factory legislation. British Journal of Criminology 10 383-398.
Corrigan, S. 2002 Comparative analysis of safety management systems and safety culture in aircraft maintenance. PhD Thesis. Trinity College, Dublin
Cownie, A.R. & Calderwood, J.H. 1966. Feedback in accident control. Operational Research Quarterly 17, 253-262 & 310-314
Goossens L.H.J., Cooke R.M., Hale A.R. and Rodić-Wiersma, Lj. 2006. Fifteen years of expert judgement at the TU Delft. Paper to the 3rd
International Conference on Working on Safety. Netherlands
Guldenmund, F., 2000. The nature of safety culture: a review of theory and research. Safety Science 34. (1-3) 215-257.
Guldenmund, F., Hale, A.R., Goossens, L.H.J. Betten, J. & Duijm, N.J. 2005. The Development of an Audit Technique to Assess the Quality of Safety Barrier Management. J. Hazardous Materials 130 (3) 234-241
Hale, A.R. 1978. The role of HM Inspectors of Factories with particular reference to their training. PhD Thesis. University of Aston in Birmingham. Hale A.R. 1984. Is safety training worthwhile? Journal of Occupational Accidents v6 (1) pp17-33.
Hale A.R. 2001. Conditions of occurrence of major and minor accidents. Journal of the Institution of Occupational Safety & Health. 5 (1) 7-21.
Hale, AR 2003. SAMRAIL (Safety Management in Railways): Safety culture in nuclear and process control - WP2.1.9. Madrid: TIFSA, 32 pp.
Hale, A.R., Ale, B.J.M., Goossens, L.H.J., Bellamy, L.B., Mud M.L., Roelen, A., Baksteen, H., Post, J, Papazoglou I.A., Bloemhoff, A & Oh, J.I.H. 2006. Modelling accidents for prioritising prevention. In Stamatelatos M.G. & Blackman H.S. Proceedings of the 8th International Congress on
Probabilistic Safety Assessment & Management. ASME Press.
Hale, A., Glendon, A., 1987. Individual behaviour in the control of danger. Industrial safety series vol 2. Elsevier, Amsterdam
Hale A.R. & Hale M. A review of the industrial accident research literature. 1972. Research paper for the Robens Committee on Safety & Health at Work. National Institute of Industrial Psychology. HMSO London
Hale A.R., Heijer T. & Koornneef F. 2003. Management of Safety Rules: the case of railways. Safety Science Monitor v7 (1). http://www.ipso.asn.au/vol7/vol7idx.htm
Hale A.R. & Hovden J. 1998. Management and culture: the third age of safety. In A-M Feyer & A Williamson (eds.) Occupational Injury: risk, prevention and intervention. Taylor & Francis. London pp 129-166.
Hale A.R., Kirwan B. & Guldenmund F. 1999. Capturing the river: multi-level modelling of safety management. In Misumi J, Wilpert B. & Miller R. (Eds.) Nuclear safety: a human factors perspective. London. Taylor & Francis.
Hale A.R. & de Kroes J. 1997. System in Safety: 10 years of the chair in Safety Science at the Delft University of Technology. Safety Science 26 (1-2) pp. 3-19.
Hale, A.R., Paques-Koster, M. en Vergouw, E.G.M. 1989. Veiligheidskunde, part noch deel. Aandacht voor arbeidsveiligheid in hoger technisch onderwijs. (Safety science, neither hide nor hair: attention to occupational safety in higher technical education) Directoraat-Generaal van de Arbeid. Rapport S 56, + Bijlage S56-1. Voorburg, Ministerie van Sociale Zaken en Werkgelegenheid
Hämäläinen P. Takala J. Saarela K. (2006). Global estimates of occupational accidents. Safety Science 44:137-156
Houtenbos, M, Hagenzieker, M, Wieringa, PA, & Hale, AR . 2004 . Modelling interaction behaviour. In de Waard, D. Brookhuis K.A. & Weikert C.M. (Eds.), Human Factors in Design, Analog integrated circuits and signal processing (pp. 35-47). Maastricht: Shaker Publishing
ISSA. 1991. Proposal to the Commission of the European communities for a draft directive on Education and Training in the prevention of Occupational Risks. International Social Security Association Section on Education & Training. Paris CRAMIF.
K+V 2005. Final Report Schiphol Safety Investigation 2005. Arnhem K+V.
Kirwan B., Hale A.R., & Hopkins A. 2002. Changing regulations: controlling risks in society. Oxford. Pergamon.
Kletz T.A. 1979. Industrial safety: shaking the foundations. Inaugural lecture. Loughborough University of Technology.
Larsen, LD, Petersen, K, Hale, AR , Heijer, H, Parker, D, & Lawrie, D. 2004. A Framework for Safety Rule Management. contractno:GMA2/2001/52053. Lyngby: Danish Traffic Institute.
Mertens F.J.H. 2006. Toezicht in een polycentrische samenleving. (Regulation in a polycentric society) Inaugural lecture. TU Delft 26 April
Pietersen C.M., Hale A.R., Heming B.H.J., v.d. Broek B., Mol W.E. 1996. Evaluatieonderzoek periodieke gebruikskeuringen van arbeidsmiddelen . (Evaluation research of the periodic certification of work equipment). AEA Technology. Den Haag.
Powell P.I., Hale M., Martin J. & Simon M. 1971. 2000 accidents: a shop floor study of their causes. Report 21. National Institute of Industrial Psychology. London.
Rasmussen J. 1997. Risk management in a dynamic society: a modelling problem. Safety Science 27(2/3) 183-213.
Robson, L.S., Clarke, J.A.., Cullen, K., Bielecky, A., Severin, C., Bigelow, P., Irvin, E. & Culyer, A.J. The effectiveness of occupational health and safety management system interventions: a systematic review. Safety Science (in press)
Robens. Lord. 1972. Safety and health at work: report of the committee. HMSO. London.
Rundmo T & Hale A.R. 2003. Managers’ attitudes towards safety and accident prevention. Safety Science 41 (7) 427-443
Shaw, L.S. & Sichel, H.S. 1971. Accident Proneness. Pergamon. Oxford Short Time Committee of Birstall (1833) Address to the Friends of Justice, quoted in Thomas M.W. (1948) The Early Factory Legislation. Leigh on Sea. Thomas Bank Publishing
SSVV. 1997. VCA: Safety checklist for contractors. Leidschendam. SSVV.
Swuste, P., 1996. Occupational hazards, risks and solutions. Doctoral Thesis, Delft University of Technology, Delft, the Netherlands.
Swuste, P, Hale, A.R. & Guldenmund, F., 2002. Change in a steel works: learning from failures and partial successes. In Wilpert B. & Fahlbruch B. (Eds) System safety: challenges and pitfalls of intervention. Pergamon. Oxford.
Tingvall, C. 2002. Vision Zero - the death of cost-benefit analysis. Keynote presentation. Working on Safety Conference. Elsinore, Denmark.
VACS 2005. Advice on the Safety Investigation Schiphol 2005.
http://demo73.auto-interactive.nl/imgbase/portal_65/Advice%20Safety%20Investigation%20Sc hiphol%202005.pdf
Venema, A. , Bloemhoff, A., Ybema, J.F., Stam, C.A., 2006. Monitoring occupational accidents in the Netherlands: Does it work for prevention?
Paper to the 3rd International Conference on Working on Safety,
Netherlands.
Westrum R. 1991. Cultures with requisite imagination. In: Wise J., Stager P. & Hopkin J. (Eds.) Verification and validation in complex man-machine systems. Springer. New York.
