Causal-sequence models

This model has had a very large influence on the development of schemes for the classification of accidents applied in many countries. Classification is used to standardise the collection of data on accidents and to reduce the complexity of the data to a manageable level for statistical purposes. An early and important example is the American National Standards Institute s system for the classification of accidents, ANSI Z16.2. In this system, the following facts are recorded about the accident sequence  

3 Hazardous condition unguarded, defective tools, unsafe design, etc. 

4 Unsafe act failure to secure, operating at unsafe speed, etc. 

We recognise these different factors in many of the standard forms for use in accident reporting in Europe also. Statistics, based on the classification of accidents in accordance with these categories, usually show that a majority 

Source Adapted from Bird Germain, 1985. Copyright by Det Norske Veritas and reproduced by permission. 

---

The simplest types of accident models for use in the design of SHE Information Systems are the causal-sequence models. An early and historically very important example is the Chain of Multiple Events or Domino theory . Figure 5.1. In this model, an accident is described as a chain of conditions and events that culminate in an injury. A link in this chain is an unsafe act or unsafe condition at the workplace. It is suggested that accidents be prevented through the reduction of unsafe acts and conditions. 

A problem with causal-sequence models such as the Domino and ILCI models is that no clear distinction is made between the observable facts about the accident sequence on the one hand and the more uncertain causal relationships at the personal, organisational and management levels on the other hand. The user is thus led into believing that information on, for example, personal factors such as mental stress, has the same objective status and is as unambiguous as information on observable facts about the sequence of events. There is thus a risk of misunderstanding and false... 

A generalised process model constitutes the backbone of our accident-analysis framework in Chapter 6. Process models help us in understanding how a production system gradually deteriorates from a normal state into a state where an accident occurs. Time is thus a basic factor. In contrast to causal-sequence models, process models make a clear distinction between the accident sequence on the one hand and the underlying causal or contributing factors on the other hand. 

This distinction between facts and interpretations is not always made in the causal sequence models of accidents. Such linear accident causation models as the ILCI model do not make a clear distinction between observable facts and conditions on the one hand and opinions about effects of personal and... 

Theoretical methods offer the opportunity to explore structure-property relationships in ideal metal-ceramic interfaces. Ultimately, improved understanding of the causal sequence leading to a particular interface structure and set of properties would enable further optimization of manufacturing parameters. Atomistic modeling constitutes the perfect laboratory in this respect. Within the limits of the specific approximations used for interatomic interactions, physical properties may be resolved to arbitrary accuracy and competing effects may be separated. 

The causal sequence indicates that final failure committed by the operator is the effect of series of inadequate actions that begins at the organizational level, which the operator can not be blamed for. At each level should be specified vulnerabilities that are important in terms of providing safely of the process, personnel and environment. In probabilistic modeling of accident scenarios it is essential to identify possible dependencies between specified layers and their quantification in order to apply proper technical and organizational solutions. 

The model shows that the hazard may be introduced in two w s. It may occur through an error on the part of the subsequent victim, for example, the inadvertent ingestion of a toxin. Alternatively, it may be introduced by an error on the part of another person, remote in time or space - for example, when a design fault causes a weakness in a structnre that remains as an unsuspected hazard for a substantial period before eventual collapse. In both cases the causal sequence remains unchanged. Wigglesworth listed typieal human errors and their causes, involving ... 

The TRIPOD model presents an accident model of causal sequences rather similar to the logic principles of the ILCI model, Figure 5.3 (Reason, 1991 Reason, 1997). It has had a large influence on current thinking, because it models how erroneous decisions at different management levels lead up to the circumstances of which the accident is a result. We will apply aspects from the TRIPOD model in Chapter 6. We will illustrate how accident occurrence is affected both by operational decisions at the work system level immediately before the accident, and by higher management decisions. 

For acute releases, the fault tree analysis is a convenient tool for organizing the quantitative data needed for model selection and implementation. The fault tree represents a heirarchy of events that precede the release of concern. This heirarchy grows like the branches of a tree as we track back through one cause built upon another (hence the name, "fault tree"). Each level of the tree identifies each antecedent event, and the branches are characterized by probabilities attached to each causal link in the sequence. The model appiications are needed to describe the environmental consequences of each type of impulsive release of pollutants. Thus, combining the probability of each event with its quantitative consequences supplied by the model, one is led to the expected value of ambient concentrations in the environment. This distribution, in turn, can be used to generate a profile of exposure and risk. 

Several attempts have been made to graft systemic factors onto event models, but all have important limitations. The most common approach has been to add hierarchical levels above the event chain. In the seventies, Johnson proposed a model and sequencing method that described accidents as chains of direct events and causal factors arising from contributory factors, which in turn arise from systemic factors (figure 2.7) [93]. 

To handle system adaptation over time, our causal models and safety techniques must consider the processes involved in accidents and not simply events and conditions Processes control a sequence of events and describe system and human behavior as it changes and adapts over time rather than considering individual events and human actions. To talk about the cause or causes of an accident makes no sense in this systems or process view of accidents. As Rasmussen argues, deterministic causal models are inadequate to explain the organizational and social... 

A practice of safety based principally on the many extensions of the causation model represented by the domino sequence developed by H. W. Heinrich that focus on the so-called unsafe act or human error as the principal causal factor will be ineffective in relation to the actuality of causal factors. 

We present a model for the d3mamic spreading of disastrous events as networked systems.We consider a disaster as a time sequence of single events, which spreads fiwm an initiating event (parent, focus) to other nodes of network in a cascade-hke manner [4], [7]. The complex network can represent some production system, factory, bank, infrastructure or communication system, environmental system, geographic area and so on. The nodes can be system components such as buildings, storehouses, tubes, conduits, servers, communication hnes, forest, imder-ground water, river, air, etc. Links between nodes in the network describe possible interactions or the functional and structural dependencies between components, causal dependence from the point of view of possible disastrous events. 

Some of these stages have no exact parallels in the Mods and Rockers case, but a condensed version of this sequence (Warning to cover phases 1 and 2 then Impact then Inventory and Reaction to cover phases 5, 6 and 7) provides a useful analogue. If one compares this to deviancy models such as amplification, there are obvious and crucial differences. For disasters, the sequence has been empirically established in the various attempts to conceptualize the reactions to deviance this is by no means the case. In addition, the transitions within the amplification model or from primary to secondary deviation are supposed to be consequential (i.e. causal) and not merely sequential. In disaster research, moreover, it has been shown how the form each phase takes is affected by the characteristics of the previous stage thus, the scale of the remedy operation is affected by the degree of identification with the victim. This sort of uniformity has not been shown in deviance. 

Keywords acausal reasoning, case relations, causal accounts, causal event sequences, causal reasoning, constraint-based reasoning, current electricity, device model, dynamic physical model, dynamic processes. Educational Testing Service, electricity, electrostatics, envisioning, macroscopic models, naive physics, physics, prior knowledge, qualitative arguments, qualitative model, qualitative theory, transient processes... 

A further extension of these ideas, in which multiple states that evolve in time are possible, is obtained when one models the speech signal by a hidden Markov process (HMP) [8]. An HMP is a bivariate random process of states and observations sequences. The state process S t = 1,2,... is a finite-state homogeneous Markov chain that is not directly observed. The observation process yf,t = 1,2,...) is conditionally independent given the state process. Thus, each observation depends statistically only on the state of the Markov chain at the same time and not on any other states or observations. Consider, for example, an HMP observed in an additive white noise process W),t = 1,2,...). For each t, let Zt = Yt + Wt denote the noisy signal. Let Z = Zi,..., Z,. Let / denote the number of states of the Markov chain. The causal MMSE estimator of Y, given Z is given by [6]... 

The sequence of identified intermediate conditions is termed the hazard development scenario . The consequences lit into one of the following categories predominantly safety related consequence, predominantly commercial consequence, predominantly environmental consequence, broadly safe condition. The combination of a causal model of a core hazard and the consequence model, of the same core hazard, results in the Core Hazard Cause-Consequence Model. The model calculates the frequencies or probabilities of occurrence for all the consequences within the model. 

It is very difficult to prove the validity of a postulated mechanism of action of a hormone, i.e. of a sequence of causal relationships between biochemical phenomena. Rather, criteria can be set up which should be satisfied if a model is not to be rejected (1) each of the phenomena of the sequence should be demonstrated and the kinetics of the phenomena should be consistent with the model (2) each of the causal relationships should be evidenced (3) the inhibition or suppression of any phenomenon of the sequence should cause the inhibition or suppression of the consequent phenomoia (4) if a reaction or a pathway is stimulated by an agent, this should take place at the level of the rate limiting factor of the reaction, or the rate limiting step of the pathway. 

The OARU model uses the term determining factors rather than causal factors. These are technical, organisational and social properties of the man-machine system and department that affect the accident sequence, but change only slowly in comparison with it. Figure 5.4 shows an example of an accident analysed by means of the OARU model. The distinction between the accident sequence and the underlying, determining factors is here made clear. 

All relevant data about the accidents and near accidents are stored in a coded format. This coding may take place during data collection, see Section 13.4. Nominal scales of measurement are applied in coding the descriptions of losses, the sequence of event and causal factors, etc. The ISA, ILCI and MAIM accident models presented in Chapters 5 and 13 have typically been developed for this purpose. Table 15.2 shows a coding schedule based on the ILCI model. 

Thus, once the path Ib-IIa-III is naturally selected as the primary hierarchy of the ecotoxicity mechanism of T. pyriformis, one can expect that, with actual interpretation of the minimum spectral paths, the envisioned sequence of actions towards the measmed one can be causally modeled as the action of polarizability followed by that of hydrophobicity and finally by that of total energy, through the optimization of molecular geometry during the chemical-biological interactions involved. 

---