Keywords

2.1 Introduction

One of the first examples of a visualisation in Western European literature came from Agricola’s standard work ‘De Re Metallica’. This book on geology, mineralogy and mining devoted a few pages to accidents of miners. Foreman of mines should anchor ladders in mine tunnels to prevent sliding of these ladders and fall-accidents of miners (Fig. 2.1). Mine entrances should not face the North. In winter times with freezing northern winds, miners could lose their grip [1].

Fig. 2.1
An illustration presents a deep horizontal mine shaft. A short vertical and a slant shaft connected to shallow horizontal, connects through a long vertical to the deep shaft. Another short vertical mine shaft is on the side.

Sixteenth-century mine shafts

Full size image

From the late nineteenth-century posters became popular, promoting public health and warned against excessive use of alcohol, tuberculosis, syphilis. Safety posters were produced after World War I. Also, safety concepts, theories, models and metaphors were visualised. This article gives some examples of these visualisations, based upon recently published historical overviews of developments in the safety domain in a Safety Science series on safety knowledge development 2009–2020 [18,19,20,21,22,23,24,25]. Questions below are leading for this contribution:

  • Is there a trend in visual presentations and how can this development be characterised?

  • Are visualisations changing safety concepts?

  • What are limitations of visualisations?

2.2 Safety Posters

Figure 2.2 shows one of the first US safety posters and the first Dutch safety poster. The Safety First Movement, which started in the US, is dominant at that time, aiming at safe behaviour of workers and at hazards of moving parts of machines: safety technique.

Fig. 2.2
2 posters. 1, a poster in a foreign language, where a person without cap leans on the other with cap. 2, a poster titled, gambling with fate with an illustration of a death sign near a worker. Below are a few lines of text.

Left: Dutch safety poster from 1922 (why did you not wear a cap like me? Loose hair in proximity of machines and gears is dangerous). Right: US safety poster from 1919

Full size image

Safety technique, the enclosure of rotating parts of machines and the fencing of heights started in 1844 in the UK and spread over Europe and the US. US authors publish many practical examples of safety techniques in various industrial sectors. The posters refer to behavioural consequences of unguarded rotating machinery. National figures of accidents are available in the US in 1907. It shows a very high death toll in the American steel industry (0.6–0.8 per 100 man-hour), compared to Germany (0.2 per 100 man-hour) [2, 3]. The reliability of these figures is not clear, but the high occupational mortality in the American industry, compared to Europe, was a repeated argument in various publications. US Steel, the largest steel company, started in 1906 the ‘Safety First Movement’ [15]. A 1913 poster on occupational accidents shows ignorance, indifference, carelessness as main causes of accidents (Fig. 2.3).

Fig. 2.3
A poster. A broad path over a terrain with label, safety first, emerges from a rising sun labeled, happiness 1914, and leads to a tunnel labeled, education. The path has branches of indifference, carelessness, and ignorance. Below are 4 lines of text with a title, the road to happiness.

US Safety First Movement poster, 1913

Full size image

The Dutch Safety Museum started in 1893 and played an active role in promoting occupational safety. It published a monthly journal The Safety Journal in the 1920s and had a weekly radio presentation on safety-related issues. The safety posters of this institute had a simple message of hazards and family values [11] (Fig. 2.4). Religious parties dominated Dutch politics at that time and posters avoided any political message.

Fig. 2.4
A poster in a foreign language with some text at the bottom. A man beside a woman. She points to an aged person seated reading a newspaper, and the man looks.

Dutch safety poster from 1922: because he was careful, Grandpa became 70 without suffering an accident

Full size image

For fear of tensions in companies, there is no reference to class differences, or shortcomings of management. Unions, active from the late nineteenth century onward, did not pay much attention to occupational safety. Their topics were salaries, working hours and general working conditions.

After World War II, the political climate changed. In the 1970s, ‘humanisation of labour’ became a new topic. The 1980 Dutch Working Conditions Law included well-being of workers. Posters were neutral without a moral undertone (Fig. 2.4).

2.3 Safety Concepts, Theories, Models and Metaphors

The concept of an accident as a process was published in the 1920s [5]. DeBlois postulated hazards being equivalent to energy, and process disruptions as causes of occupational accidents. Management decisions were the centre of the process. 15 years later, Heinrich presented his first visualisation of an accident process, the domino metaphor [10]. The ‘unsafe act’ of the victim was the centre of the domino metaphor, in line with the message of the Safety First Movement. The strength of this metaphor is its simplicity. Even today the metaphor has a major impact on safety professionals. Another publication before DeBlois also showed external factors as causes of accidents. In 1910, Crystal Eastman [6] published a death calendar. In the period of one year, the mortality amongst steelworkers in the US Steel plant in Allegheny district, Pittsburgh was 526 (Fig. 2.5). These numbers were staggering. Every day one and a half fatal accidents occurred. Her research was a first attempt of a socio-technical approach to safety. According to Eastman, causes of the accidents were the fatal interactions and uneducated employees, mostly kids, send by managers to dangerous machines.

Fig. 2.5
A calendar titled death calendar in industry for Allegheny County. Calendar months from July 1906 to June 1907 are listed with markings. The text below reads, each red cross stands for a man killed at work or for one who died as a direct result of an injury received in the course of his work.

Death calendar showing the number of work-related deaths by day, Allegheny County, Pennsylvania

Full size image

Different scientific disciplines are active in safety research. Engineers look at accident processes, hazards, scenarios and barriers. Organisational processes and decision-making in companies is the focus of sociologists, while behaviour is a starting point of psychologists. A special group of engineers, risk analysts, calculate risks of major accidents using failure probabilities of technical components and probabilities of consequences, mostly mortality. Apart from risk analysis, all other disciplines look for factors which bring production system into an uncontrolled state. The terminology differed over time and discipline. The sociologist Turner, promoting a socio-technical approach to safety, defined an ‘incubation period’ of major accidents, a period of systematic risk denial of an organisation [28]. The engineer Kjellén defined causes of an occupational accident processes as ‘process disturbances’ and ‘loss of control’ [12].

Different models and metaphors were published in the 1990s; the ‘Tripod’ model of the psychologist Groeneweg, named after a three-legged dog seen during fieldwork, the metaphors ‘Swiss cheese’, and the ‘bowtie’. Operational disturbances, with incomplete barriers, caused by decision-makers were starting points of accident processes, both of occupational and major ones [7]. The model referred to the ‘hazard-barrier-target’ model from the 1960s [8]. The 11 ‘Basic Risk factors’ (BRF) were mostly organisational factors. These factors were a specification of Turner’s incubation period. The accident process started with decision makers, like the ‘blunt end’ of the well-known Swiss cheese metaphor of the psychologist Reason [17].

The bowtie was an engineering metaphor for both occupational and major accidents, without unsafe acts, or psychological precursors. There are multiple scenarios (arrows from left to right), barriers (the rectangular shapes in the scenarios) and a ‘central event’. This is the centre of the accident processes when hazard(s) became uncontrollable [28]. There were no holes in barriers. Instead of managerial factors, the upward lines determined the quality of barriers, like the BRF’s in Tripod. The metaphor had different time dimensions. Deficient or absent barriers and management factors had an effect over a long period of time, like Turner’s incubation period. Accident scenarios left of the central event could take week, or longer to develop. If a central event became active, scenarios to consequences would unroll very quickly.

A conceptual model of safety was Rasmussen’s ‘Drift to danger’ [16]. The financial dominance of ‘the market’ initiated a management focus of cost-effectiveness of production resulting in an increased pressure on workers. According to Rasmussen, human failures were not causes of major accidents, but systematic migration of organisational behaviour towards an accident was.

(Re)design is the topic of engineers. In the 1980s, the concept of ‘Inherently safe design’ was published [13]. ‘Small is better’, and the use of safe, less toxic and less flammable chemicals was his message. This concept was strong because of its simplicity. Kletz proposed transparency, because morally it was preferably to inform society ‘if we know, we must tell’.

LOPA (layers of protection) was another design concept for the process industry, developed in the same period as inherent safe design [4]. This design strategy followed a ‘defence in depth’ principle. LOPA implied multiple layers of independent safety barriers for the mechanical integrity of a production system, to prevent emission or loss of containment. But all barriers have their weaknesses, like the resident pathogens of Swiss cheese. When operators were unaware of failures in one of more layers, an unnoticed scenario developed after a process failure, a so-called wildness in the wait. According to Rasmussen, there was a ‘fallacy of defence in depth’.

Monitoring accident scenarios is possible when management factors, the latent factors, are linked to process indicators in a bowtie analysis. These factors can influence hazards (inherently safe design), scenarios (training, information) or technical barriers for specific scenarios. Scenario-specific interventions are possible and puts safety closer to the core business of the company. Recent research in a manufacturing company and a chemical plant showed these possibilities.

Accidents with pallet movers for internal transport were a major problem in a Belgium manufacturing company. Literature research, interviews and workplace observations gave an overview of actual and possible accident scenarios. Leaking cubitainers, resulting in spills of products on floors, increasing breaking distance of pallet movers and destabilises loads was a major issue in the company. The bowtie analysis showed management factors with an impact on both technical and non-technical safety barriers. Training operators is a non-technical barrier, and only effective when training concentrates on possible and occurring scenarios, barriers and central events. The next step was to define process indicators for management and workers to follow the development of scenarios [14, 26]. Figure 2.6 shows the influence of different management factors on elements of the bowtie. Sandblasting floors was a technical barrier which prevented pallet movers from slipping.

Fig. 2.6
An illustration of a bowtie analysis for sandblasting floors. The management factors are listed that influence the following elements. A hazard, non-technical and technical safety barriers, management delivery system, and central event.

An elaboration of the left side of a bowtie

Full size image

Major accidents in chemical plants are complex. Following a similar strategy as above, the bowtie analysis of a NH3 producing plant resulted in a visualisation of scenarios. Cracking of natural gas (CH4) in the Meka 1 is the first step of the process. A vertical tube reactor and a secondary reformer produce hydrogen (H2) under high pressure (40 bar) and temperature (1000 °C).

Figure 2.7 shows the secondary reformer. Cooling of the secondary reformer (R3201) with water jackets is essential, due to process conditions. When these water jackets fail, excessive heat exposes and weakens the reformer wall with possible catastrophic consequences and a massive emission of highly flammable and explosive gas. The activation of alarms on low/high temperature, low/high flow, and low level is connected to accident scenarios, coming from the literature, company documentation, and interviews with operators, maintenance and safety staff, technical and operational managers and the CEO of the company [26].

Fig. 2.7
An illustration and 3 tables. 1. a secondary reformer with water jackets. 2, 3 tables present 3 levels with various factors. Each factor has a shaded indicator button. Labels Meka 1 and R 3102 from levels 1 and 2, respectively, have the same indicators.

Reformer R3102 of Meka 1 (left), with the level 1 (top right) and level 2 (bottom right) dashboards

Full size image

Various levels of information are presented:

  • Level 1 shows the production steps at the NH3 production. This level provides an overview of the whole plant, relevant for a CEO. The red dot in the level 1 dashboard shows a problem at Meka 1.

  • Level 2 shows the installations of Meka 1, relevant for the safety, and plant manager. The second reformer R3102 is red, indicating the location of the problem.

  • Level 3 (see Fig. 2.8) shows the second reformer’s scenarios, including instrumental safeguards and barriers. This level gives information on the operational status of individual barriers, relevant for operators, and maintenance, safety, and mechanical engineers. The first scenario, water jacket failure, shows three alarms. FIAL1110 (flow indicator alarm, low flow) is red, this alarm is activated, and two LAL’s (level alarm, low level) are yellow. These alarms are not reliable. A scenario related to overheating of the second reformer starts to unroll.

    Fig. 2.8
    A table of 6 rows presents level 3 of a secondary reformer. Each row header lists different operational statuses with a flow indicator alarm and level alarm in 3 shaded buttons. They represent active, not active, and not reliable indicators.

    Level 3 indicators and scenarios for reformer 2

    Full size image

2.4 Discussion and Conclusion

Posters show a major development over time. They reflect the political atmosphere and dominant views on accident processes. In the 1920s, fear was the central message. From the 1970s onwards, the message was non-moralistic. In the early days, some authors pointed at external factors, and managerial influences of accidents, but the dominant cause attributed was unsafe acts of workers. Posters were popular, and cheap, and decorated walls of factories. They showed a safety interest of a safety department, or a vision of management. It is questionable whether posters had any influence on accident processes. No research was conducted to give credit to their effects.

Between the 1970s and 1990s, a very productive period of safety science, theories, models and metaphors of accident processes showed a growing focus on organisational factors. Internal, or latent factors in combination with external factors created unstable production systems, leading both to occupational accidents and major accidents with a high media coverage. Graphical presentations contained arrows. The arrow in Tripod, as in Swiss cheese, might refer to correlations, to causal relations, or even to accident scenarios. Most likely this reflected a social science interpretation of accident processes with less focus on hazards and scenarios. The bowtie metaphor depicted specific scenarios leading to loss of control. This metaphor offered opportunities to follow the scenarios in real time, offering management and workers an overview of the safety state of their processes. A clear relation between management and workers’ activities and (major) accident processes is vital, because (major) accidents are not prevented by regulatory compliance, nor by ISO standards.

Risk management, calculating frequencies and probabilities of major accidents, and cost benefits of safety measures are an essential part of a management approach. But rational arguments and quantifications only have a limited influence in decision-making. The formal rationality of organisations is doubtful. Management actions are rarely preceded by a comprehensive problem analysis, or an overview of possible actions. Generally, Rasmussen’s external factors, such as ‘the market’, play a dominant role. Rationality is more a façade, and reality is like a metaphor for how people in an organisation understand the flow of information they have to deal with [29]. It is questionable whether managers are always interested in quantitative information. Having witnessed a major accident, or reputational arguments will often guide their safety initiatives [9].

Theories, models, and metaphors in this paper also present a rational explanation of accident processes. This knowledge only partly enters the domain of safety professionals, process engineers or corporate management. Some concepts are generally accepted, like dominoes, Swiss cheese, Normal Accidents, High Reliability Organisations, Inherently safe design and LOPA. Other concepts as Tripod, bowtie, process disturbances only have a local, or national appreciation. Barry Turner’s theory from 1978 was a special case, staying dormant for almost 20 years. His concept of ‘incubation’, risk blindness of organisations, is important and later transformed as latent factors (Swiss cheese), basic risk factors (Tripod), and management factors (bowtie). One explanation for its dormant state was that Turner’s article [27], published in management journals, was rarely read by safety scientists.

It is not clear why safety concepts gain acceptance by safety professionals and beyond. Maybe it is language, simplicity of concepts or effective promotion by authors. The dominant status of the domino metaphor is directly related to Heinrich’s position. His production of easy-to-understand concepts and ratios is impressive. Also, James Reason was effective in promoting his cheese metaphor. But process disturbances, as postulated by Eastman, DeBlois and Kjellén got less attention. Maybe these concepts are too complex to communicate or not promoted externally.