Keywords

1 Safety, Model and Culture

Safety culture, safety model, model of safety culture, maybe even, culture of safety model…how to think about these three words and their relationship? How do safety, culture and model actually relate to each other? The two expressions, safety culture or safety model have been around for a long time, and I believe that the notion of safety model is older than that of safety culture. For instance, Barry Turner, who created the incubation model of disaster, was a sociologist who developed a strong interest for the topic of culture. He published one of the first books in the sociology of organisation on the topic of culture (Turner, 1971).

The idea of safety culture emerged after Chernobyl, in the late 80 s, as described in many writings (e.g., Cox & Flin, 1998). The incubation model of disaster emphasised the need to consider the problem of information handling in organisations, and was very much about the now very popular concept of learning.

James Reason, a psychologist, developed one of the most famous safety models in the field during the 1980s (Reason, 1990a, 1990b) but only later applied the notion of safety culture to the topic (Reason, 1997), with no previous experience, as a psychologist, of using the notion of culture (Reason & Mycielska, 1982). Other prominent authors in the field could be added here to illustrate further the many different uses of these notions, and their relationships. For this reason, I think that the connection between safety, model and culture is a complex one, something that somehow becomes yet more complex when considering the visual aspect of models. The aim of this chapter is therefore to raise awareness among readers about this dimension of models which represents an important aspect of safety practices and research.

2 The Visual Side of Safety

In the past few decades, history, sociology, anthropology and the philosophy of science and technology have engaged in a strong and sustained interest for the world of visualisations (Coopmans, Vertesi, Lynch, & Woolgar, 2014). Latour has been one of the early promoters of this interest for the materialisation of scientific practices (Latour, 1986; Latour & Woolgar, 1979). In “Thinking with eyes and hands”, Latour convincingly argued for paying greater attention to the diversity of what he described as “inscriptions”, these textual, graphic or computerised supports and traces of all sorts that scientists manipulate daily to describe, to approach, to depict, to comprehend, to conceptualise, to explain, to anticipate, to predict phenomena. They provide the concrete visual support through which one can build or construct networks of inscriptions within which an understanding of phenomena is possible, and a world enacted.

Of course, beyond the practice of science, in our current image-saturated culture, including the issue of big data, people rely on a kind of visual literacy which consists of constructing meaning from everything we see. The notion of visual literacy—derived from the notion of literacy initially developed to investigate the relation between thinking and writing (Olson, 1998)—is an ability developed from early age to adulthood in order to evolve and to cope in an environment in which a very good part of our information is received through our eyes.

Translated into the daily practices of the process industry, one can indeed observe that there is a world of images made of texts, signs, diagrams (including PID: process instruments diagrams), alarms, thresholds, schemas, tables, pictograms, posters, procedures, schedules, Gantt charts, indicators, maps, logs, forms, etc., supporting and guiding actions (Le Coze, 2015; Le Coze, forthcoming). These pictures are based on graphical features such as lines, shapes, colours, spaces and textures but also balance, variety, movement, proportion, etc. Here are some examples and selections of pictures, drawings and graphics which structure the environment of safety management in high risk systems. I indicate artefacts which primarily concern the activity of different actors of safety critical systems.

2.1 Control Rooms Interfaces

Interfaces are probably the first visualisations which come to mind because of how much they frame the activities of process operators in control rooms, of pilots in the cockpit, of surgeons in operating theatres, etc. Of course, it has been an important research area in the field of cognitive engineering since the early 1980s (Rasmussen & Lind, 1981), and there are now many established writers and standards publications on the topic (e.g. Bennet & Flach, 2011). The importance of such visualisations is obvious, and an ethnographic study of practices in a control room of a chemical plant shows how much interpretive work by the operators is required to navigate between the (animated and interactive) pictures and the real chemical, physical or electrical processes (Fig. 1).

Fig. 1
figure 1

A control room interface

Full size image

Examples abound of situations of uncoupling between the information provided by the interfaces, events and people’s sense making. Alarms for pilots creating much confusion due to design choices, as in the Rio-Paris case, or sensors in a raffinate tower indicating the wrong level of liquid to operators in the Texas City case, are two illustrations where visual environments shape decision-making processes. It is precisely because of this potential of a discrepancy between what is happening, what is graphically represented and what is constructed in the mind of users of interfaces that great care should be given to visualisations.

2.2 Risk Assessment Matrices

Engineers also rely on drawings and visualisation to help assess risks and design safe processes. Analysis by Tufte of the graphics which supported the decision rationale of the Challenger launch in 1986 has become a landmark study of this aspect of engineering decision making (Tufte, 1997). By omitting to exhibit in an appropriate manner data which were available and that they knew to be important to ground their rationale, engineers failed to provide a more complete view of the relationship between temperatures and rings’ problems.

The chart makers had reached the right conclusion. They had the correct theory and they were thinking causally, but they were not displaying causally. (Tufte, 1997, 44)

The pattern of issues with rings as temperatures dropped was not visible for all to see, especially managers who had to be convinced.

Considering that this issue was at the heart of the debate between engineers and managers the night before the launch, the importance of visualising is made convincingly by Tufte, although retrospectively. Viewing data differently could have made a difference in the decision-making process.

2.3 Safety Trends

Operators and engineers are, of course, not the only users of graphics; managers also rely on many of them in their activities. The most obvious examples in the field of safety are the trends based on indicators which are built and followed to steer organisations’ degree of achievement in preventing health, occupational or process events. The widespread use of ratios in occupational safety calculating the number of days off for injured people per 1000 h worked (at the level of a plant or an entire corporation), but also the number and magnitude of incidents which are considered important to follow, are transformed into graphics.

Because of the heuristic power of simplifying reality through lines translating trends, such visualisations are extremely popular in management circles. They synthetize or aggregate data for quickly grasping trends that need to be supervised and acted upon. As trends rise and fall, managers have to explore causes and to look for explanations in order to maintain or to improve situations that are considered inadequate. Of course, doing so means going beyond what is made available through this reduction of reality through numbers translated in graphics.

2.4 Constructing Safety Through Seeing

Interestingly, our understanding of safety as a construct enacted on a daily basis by a multitude of artefacts, actors and institutions, has never really been seen from the angle of these drawings, pictures or visualisations. Emphasis on cognition, organisation or regulation through established disciplines such as cognitive psychology, sociology of organisation or political sciences has framed our understanding of safety in the past 30 years. Little credence has been given to a transversal appreciation of visual artefacts across descriptions and conceptualisations. However, the sustained attention from science and technology studies (STS) on pictures, diagrams or inscriptions (in a Latourian sense as introduced above) has gradually raised awareness of their importance among safety researchers involved in qualitative empirical case studies.

For instance, the concept of “coordination centres” by Suchman (1997) is more materialistically based than the notions of “heedful interactions” or “collective mindfulness” derived from HRO studies (Weick & Roberts, 1993; Weick, Obstfeld, & Sutcliffe, 1999), indicating this renewed interest by ethnographers in the embedded context of practices, cognition and social networks. So, our understanding of reliability, resilience or safety would gain from a greater attention to how cognition, organisation or regulation are supported by processes of representing graphically, of explaining through drawing, of visualising safety.

2.5 Researching Through Drawing

But, what can be established from ethnographic fieldwork about the practices of personnel in high-risk or safety-critical systems, whether operators, engineers or managers, namely the importance of drawings, pictures or visualisations for interpretation (and action), is in fact no different for the scientists studying these practices. In particular, safety researchers who interact with professionals in organisations also rely greatly on an array of drawings, graphics or visualisations. Conceptual issues such as comparing high-risk systems, framing sociotechnical systems, theorising safety and accidents, representing human error or establishing causality have been supported by drawings, graphics or visualisations (Le Coze, forthcoming). Two examples regarding the problem of theorising safety are now discussed to defend this thesis, the Heinrich-Bird Pyramid (HBP) and the Swiss Cheese Model (SCM).

2.6 The Heinrich-Bird Pyramid

The Heinrich or Bird Pyramid (HBP) is a very well-known triangle deconstructed into several layers (Fig. 2). Practitioners have been long keen to use this representation to design prevention strategies. The image is therefore performative, namely it supports action. This kind of pyramid is built on ratio which differs from time to time; according to authors.

Fig. 2
figure 2

The Heinrich-Bird pyramid

Full size image

Hale studied the rationale behind these representations (Hale, 2001). His conclusion is that the original authors never implied a connection, such as a causal relationship, between minor and major injuries or events.

What is therefore surprising is how the strong belief came to get established among safety practitioners, and apparently also among researchers that the causes of major and minor injuries are indeed the same. This seems to be an example of an urban myth (…) We are not going to get very far in preventing major chemical industry disasters by encouraging people to hold the handrail when walking down stairs. (Hale, 2001)

Against this prevailing interpretation, Hale (2001) and subsequently Hopkins (2008) offer alternative views to challenge the implied causality between minor and major injuries (Fig. 3).

Fig. 3
figure 3

Hale’s (a) and Hopkins’ (b) alternative versions of the Heinrich-Bird pyramid

Full size image

Safety practitioners are actually often very keen on deconstructing the rationale of Fig. 2 and react very positively to the alternative pyramids. But, as far as I know, the pyramid as presented in Fig. 2 remains very popular and dominant, and these alternatives have yet to be used and disseminated. The pyramid case remains a very simple yet powerful example of the visualisation of safety. On the basis of a visualisation and its interpretation, safety professionals derive preventive actions, revealing the performative character of this visualisation, namely its ability to take part in enacting specific practices.

And part of its success lies indeed in its graphical properties. The fact that Hale and Hopkins created different and alternative options of the pyramid is proof that they, at least implicitly, recognised its visual heuristic strength. One way to “break the spell” is for them to transform the image, to deconstruct its rationale visually transmitted, to show the limitations of the pyramid and what it implicitly conveys. These authors hope to trigger renewed interpretations of the relationship between near misses and major accidents by substituting one representation with another.

The matter is not superficial, accident investigations in the industry have shown that organisations relying on indicators of occupational safety obtaining very good results can suffer major process accidents. This situation therefore directly challenges some of the graphics introduced above and widely used by managers (Fig. 3b). Without careful appreciation of what it is that the lines represent, managers could take for granted, based on the HBP, that occupational safety improvement equals process safety improvement and therefore wrongly interpret the trends.

2.7 A More Sophisticated Example: The Swiss Cheese Model

Some models of safety are much more sophisticated than the HBP (Le Coze, 2013). One example is the popular Swiss Cheese Model (SCM), originally developed in the 1980s (Reason, 1990a) (Fig. 4).

Fig. 4
figure 4

Defence in depth model (adapted from Reason, 1997)

Full size image

Reason’s initial approach (Reason, 1990b) is—to use the words of the author—based on a metaphor and a more workable theory. The starting point of the model is empirical. It consists of the outcomes of accident investigations conducted in the 80s, particularly reports on the King’s Cross fire and the Herald of Free Enterprise disaster (Reason, 1990b). These reports enabled him to distinguish between ‘active failures’ and ‘latent failures’. For Reason,

Latent failures have their primary systemic origin in the errors of high-level decision makers. (Reason, 1990b, 31)

The metaphor used is a medical one:

latent failures are analogous to the resident pathogens within the human body, which combine with external factors (stress, toxic agencies, etc.) to bring about disease. (Reason, 1990b, 29)

The ‘workable theory,’ to go beyond the metaphor, consists of a series of basic elements: decision makers, line management, preconditions, productive activities and finally, defences. They represent a series of ‘planes’, where

several factors are required to create a ‘trajectory of opportunity’ through these multiple defences. (Reason, 1990b, 33)

The success of this model is probably even greater than the HBP.

As commented in Table 1, the success of both models, HBP and SCM, can be explained by several factors (Le Coze, 2016). First is their capacity to be generic, whether in the chemical industry, in aviation or in the railways, both models adapt fairly well (1) and normative because they provide principle for assessing specific situations (2). They also have the ability to mobilise appealing metaphors (3), to be inscriptions (4) and to become boundary objects (5) with a performative dimension (6).

Table 1 H-B Pyramid and SCM properties
Full size table

3 Strengths and Weaknesses of Visual Models

Because safety is somehow a product of how these inscriptions participate in structuring and shaping the world of safety practitioners and researchers, these visual models have also triggered a certain number of questions about their limitations and drawbacks. Just as the HBP was challenged, as shown above (Hale, 2001; Hopkins, 2008), the SCM has been analysed and criticised (Dekker, 2002; Hollnagel, 2004; Reason, Hollnagel, Pariès, 2006; Shorrock, Young, Faulkner, 2004; Turner & Pidgeon, 1997). This certainly demonstrates their popularity and the need to reflect on them.

Now, if considering the HBP from its strengths and weaknesses, one could say that HBP is valuable because it is simple and easily understandable by anyone. It visually expresses a ratio of events (600:30:10:1) coupled with their intensity (from near miss to major) with, at the top of the triangle, a major event to be prevented. The downside to this strength is that it implies a dubious causal relationship and hides some complexities. It conflates all kind of events into broad categories and it supports therefore an intuitive but false belief about how safety is produced. The problem is that it influences preventive strategies on a very large scale.

The case of SCM needs a bit more elaboration because of its higher degree of sophistication. On the positive side, the model provokes an immediate intuitive understanding and provides a very clear similarity with the technical approach of ‘defence in depth’, which translates very well, metaphorically, from technology to organisation (a). It expresses and reduces the complexity of the problem of accidents by indicating the many potential (but unfortunate, or ‘normal’) combinations of holes that characterise an accident sequence (b). It allows the user(s) to imagine that there are practical recommendations to be derived from the model, by targeting and improving some selected defences (c). It indicates a distance from the targets (the damages), so that incidents can be expressed by their level of proximity to a catastrophe, and therefore offers, in principle, the possibility of a normative assessment (d). It distinguishes between proximal and remote individuals, who play a different role in the genesis of accidents, and is, in some senses, systemic rather than individualistic in this respect (e).

On the negative side, it does not explain clearly what the holes are in reality—users are left to translate this for themselves—it is only suggestive and not analytical (a′). It does not indicate how holes are likely to align (b′). It relies on an underlying philosophy of failure and errors (whether ‘latent’ or ‘active’), introducing the notion of blame either at the level of proximal or remote actors (c′). It is not explicit or insufficiently specific about the slices or planes (or defences) although they are to be associated with different scientific fields (psychology, management, sociology, etc.) and leaves a lot of room for interpretation about how slices are to be considered (e.g. functions, actors, procedures) and how far the slices should go back in space and time (d′). It offers a linear and sequential view of accident trajectories, as a sequence of events following each other over time, and cannot account for multiple and/or circular causalities with different time spans (e′).

In sum, HBP and SCM are challenged by a number of authors in the field and exhibit indeed a multiplicity of positive and negative aspects. They are two famous examples of safety models for which their visual properties are specifically at the heart of their heuristic value and power to explain, to make sense and to perform (note also that their downside is that they are ways of not seeing, they lock users in certain interpretations). With regards to the intention of this article to justify the relevance of paying attention to the drawings, graphics and visualisations available when one studies safety, it is now, I hope, perfectly clear that they find their place among the more textual models of sociology or the mathematical ones of engineering… .

4 Conclusion

The chapter addresses a complementary topic for this book: the visual side of safety. Safety, model and culture are interwoven notions which are difficult to disentangle. This chapter adds to the complexity of this conundrum with a focus on the drawings, graphics and visualisations which support the daily practices of a multitude of actors in high-risk systems, but which support research and conceptualisation too. With the help of two examples, the Heinrich-Bird pyramid (HBP) and the Swiss Cheese Model (SCM), it is argued that safety practices and research are intrinsically developed on the basis of some form of drawings, graphics and visualisations which play a central role in the performance of safety-critical systems.