Safety at Work 6 E Part 7 docx

The safety adviser is interested particularly in behaviour at work and moreparticularly in the behaviour of people in situations which may endangertheir health or safety.. We need to get

want, in a paternalistic sort of way Jens Rasmussen5has provided a morechallenging analogy in talking about the way organisations are pushed bycompeting pressures towards unsafe areas on the edge of controllability.

We can adapt his metaphor and apply it to understanding individualbehaviour in relation to danger This is like steering a course in partlyunknown waters, under pressure from many motives, which are alwaysonly partially compatible with safety The task is continuously to stay offthe reefs which represent the potential accidents If we can stay within acertain boundary, we will not come close to the reefs and only very rareobstacles in the open waters will harm us But sailing very close to thereefs can have great advantages for other objectives, such as convenience,speed, production, etc The trick is to find a course which allows usconstantly to measure the distance to the reefs, but gives us time tomanoeuvre away from them if danger increases This is steering by theboundaries of what is safe enough, rather than sticking strictly to themiddle of the channel, as far as possible away from the reefs Such aconcept offers more room for manoeuvre and for individual choice than

an idea of strict standards and no deviation We can also still use the steps

in Figure 2.7.2, if we replace the ‘deviations from normal’ with

‘approaches towards safe limits’

2.7.3 Behavioural science and the human information processor

2.7.3.1 What is behavioural science?

Behavioural science has four main aims: to describe, to explain and to predict human behaviour, with the objective of influencing it The safety

adviser is interested particularly in behaviour at work and moreparticularly in the behaviour of people in situations which may endangertheir health or safety Even describing behaviour in such situations is notalways easy People who are observed may not behave as they normallywould Observers, or individuals trying to explain afterwards what theydid in a situation, may describe what they expected to see or do, ratherthan what someone actually did Explaining behaviour requires theoriesabout why it happens We need to get to this level of understanding inorder to understand behaviour in accidents and to decide how to designhardware and organisations which will be useable by people andcomplement their skills What we really want to do is to predict in detailhow decisions on selection, training, design and management willinfluence the way people will behave in the future If we can do that, wecan modify our decisions and influence the ultimate behaviour This is avery severe test of theories about individual behaviour, and psychology isoften not far enough advanced as a science to withstand such scrutiny Inthis chapter the aim is to describe in broad terms what is known and can

be used to help us understand and guide human behaviour

A human individual is far more complex than any machine, and whenindividuals are placed together in groups and organisations the inter-actions between them add many times to the complexity which needs to

be understood Individuals are also extremely adaptable They changetheir behaviour as they learn and if they know that they are beingobserved They may change it in different social situations, behaving infront of their friends or work colleagues in ways they would beembarrassed to do before their parents Each individual is to an extentunique because of their unique experience Because of all this thebehavioural scientists’ task can be seen to be daunting indeed What theytry to do is to understand the patterns and the influences in order tosimplify the complexity The explanations and predictions of behaviouralscience therefore have wider margins of error than those which can beoffered by engineers or even by doctors Statements made aboutbehaviour will usually be qualified by words such as ‘probably’ or ‘ingeneral’ Individual exceptions to the predictions will always occur.Because of its limitations behavioural science is dismissed by some asbeing no more than common sense dressed up in fancy language Everyonethinks they are an expert on human behaviour, and they are partially right.All individuals must have some ability to explain and predict thebehaviour of themselves and others, or they would not be able to functioneffectively in the world However, the most common way for non-experts

to try to understand another’s behaviour is to think how you wouldbehave yourself in those circumstances People forget how broad the range

of individual differences is, and so how poor this comparison will often be.Most individuals’ explanations and predictions are, therefore, quite oftenproved wrong Behavioural science used in a systematic and rigorous waycan always improve on unaided ‘common sense’

Behavioural science commonly works by developing models ofparticular aspects of human behaviour These models are inevitablysimplifications of real life, in order to make it comprehensible Themodels are frequently analogies drawn from other branches of knowl-edge and can reflect in their history the history of technology We used torepresent the brain as a telephone exchange; we now routinely compare

it to a computer Different behavioural scientists may use differentanalogies, or divide up the complexity in different ways This, to someextent, explains why there sometimes appear to be parallel andincompatible theories about the same aspect of human behaviour.Analogies are powerful and useful, but they have limitations which mustalways be acknowledged They can never be perfect descriptions of theway that an individual functions, and will be useful only within theirlimits In the sections which follow some models will be described andused to explain particular aspects of behaviour Readers are urged to usethem, but with care

2.7.3.2 The relevance of behavioural science to health and safety

Here are some of the questions relevant to a safety practitioner whichbehavioural science can help to answer:

 What sort of hazards will people spot easily, and which will theymiss?

 Are there vulnerable times of day for errors and accidents?

 Can you predict what sorts of people will have accidents in particularcircumstances?

 Why do people ignore safety rules or fail to use protective equipmentand what changes can be made in the rules or equipment to make itmore likely that people will use them when they should?

 What sorts of beliefs do supervisors and managers have about whatcauses accidents and how does that affect how they try to managethem?

 If people understand how things harm them, will it make them takemore care?

 Can you frighten people into being safe?

 What will motivate a line manager to spend more time on safety?

 What knowledge and training do people need to cope withemergencies?

 What dangers arise, or are prevented when people work in teams?

 How do company payment, incentive and promotion schemes affectpeople’s behaviour in the face of danger?

 How can training help people to take care?

 When are committees better than individuals at solving health andsafety problems?

 What constitutes a good set of attitudes and beliefs, which make safety

a central goal of an organisational culture?

The list of questions can go on almost indefinitely Before studyingbehavioural science it is a valuable exercise to draw up a list of questionsrelevant to your own workplace, which you hope more knowledge ofbehavioural science will help you to solve See how many of the questionsyou have answered, or reformulated, by the end of your study That is agood test of your study course, and of this book as a part of it

2.7.3.3 The human being as a system

A common model used in behavioural science, and in the biological andengineering sciences, is the ‘systems’ model Systems are defined asorganised entities which are separated by distinct boundaries from theenvironment in which they operate They import things across thoseboundaries, such as energy and information; they transform those inputsinside the system, and export some form of output back across theboundaries Open systems are entities which have goals or objectiveswhich they pursue by organising and regulating their internal activityand their interchange with their environment They use the feedbackfrom the environment to check constantly whether they are getting nearer

to or further away from their objectives Figure 2.7.3 shows a generalised

system model

Such models can be applied to a single cell in the body, to theindividual as a whole, to a group of individuals who are workingtogether, and to an organisation such as a company

Figure 2.7.47 considers the human being as a system for taking in,processing and acting on information The system objective we consider

in this chapter is the avoidance of harm to the person or to others.Accidents and ill-health can then be conceived as damage which occurs tothe system when one or other part of this information processing fails.The human factor causes of accidents can be classified according to whichpart of the system failed In section 2.7.4 we will apply this model directly

to understanding behaviour in the face of danger, but it is useful first togive some basic insights into the different aspects of human functioning,particularly of goals and motivation

2.7.3.4 Some basic facets of human information processing and action

2.7.3.4.1 Goals, objectives and motivation

Any understanding of human behaviour must start with an attempt todescribe the goals and objectives of the human system Individuals havemany goals Some such as the acquisition of food and drink are innate.Others are acquired, sometimes as means of achieving the innate goals,and sometimes as ends in themselves, for example the acquisition ofmoney, attainment of promotion, purchase of a house, etc Some are shortterm, e.g food at dinnertime; others are much longer term, e.g earningenough for retirement In some cases the short- and long-term goals may

be in conflict For example, a person may fail to check equipment beforestarting work in order to satisfy the short-term goal of getting the jobdone as fast as possible, as a result jeopardising the long-term goal ofpreserving his own health and safety

Not all goals are consciously pursued, either because people may notwant to admit even to themselves that they are pursuing a particular goal,

or because the goal is so basic that it has been built into the person’sbehaviour and no longer requires any conscious attention

An individual’s goals can be conceived of as vying with each other tosee which one will control the system from moment to moment People

Figure 2.7.3 Simplified system model (adapted from Hale and Glendon6)

will therefore show to some extent different and sometimes dictory behaviour from day to day, and certainly from year to year,depending on which goal is uppermost at the time However, peoplewill also show consistency in their behaviour, since the power of each

contra-of their goals to capture control contra-of the system will change only slowlyover the sort of time periods which concern those interested inbehaviour at work

Many theorists have written about motivation, particularly tion at work They have emphasised different aspects at different times

motiva-as being dominant motives, and have frequently tried to give ahierarchical ordering of their importance At the start of the 19thcentury Taylor8 divided people into two groups: potential managerswho were competent at and enjoyed planning, organising and monitor-ing work, and the majority of the workforce who did not like thoseactivities but preferred to have simple tasks set out for them Taylorconsidered that, once work had been rationally organised by the formerand the latter had been trained to carry it out, money was the mainmotive force to get more work out of them His ideas of scientificmanagement encouraged the development of division of labour and theflow line process, work-study and the concentration on training,selection and study of the optimum conditions for work Later work,such as that by Elton Mayo9 showed that this was much too simple aview His studies in the 1930s at the Hawthorne works of the WesternElectric Company in Chicago led to the realisation that people were notautomata operated by money, but that they worked within social norms

of a fair day’s work for a fair day’s pay It showed that they wereresponsive to social pressure from their peers, and to interest shown inthem by the company This led to a new emphasis on the role of thesupervisor as group leader, rather than as autocrat, and also to a greateremphasis on building group morale Maslow10looked at the motivation

of people who were successful and satisfied with their work He foundthat there was always an important element of achievement, self-esteemand personal growth in their descriptions of their behaviour He put

forward his theory of the hierarchy of needs (Figure 2.7.5) to express

this concept of growth He postulated that the homeostatic needs had to

be satisfied before the growth needs would emerge Although thishierarchy has not been subjected to rigorous scientific confirmation, it isbroadly borne out by research studies, at least in Western capitalistcountries

Modern motivation theory tries to incorporate what is valuable fromall of the earlier theories, and recognises that there are individualdifferences in the strengths of different motivations both betweenindividuals and over time in the same individual As far as possible,incentives need to be matched to the individual and the situation (thejob of human resources management) It is also recognised that thehuman system is more complex than many early theories postulated,and that expectations play a strong part in motivation11 In other wordsthe force of a motivator is dependent on the sum of the value of thereward and the expectancy that a particular behaviour will lead to thereward If someone perceives that it will take a great deal of effort to

gain any increase in reward, or that the reward does not appear to bedependent upon how much effort is actually put in, their behaviourwill not be influenced by that reward.

The unique combination of goals and behaviour which represents eachindividual’s adaptation to the environment in which he finds himself isone definition which is given to the word personality (see 2.7.3.4.2) Thus,those who habitually place a high value on their need for acceptance bypeople around them are called gregarious or friendly, whereas thosepeople who habitually subordinate their need for approval by peers totheir goal of achieving high status in the organisation, we callambitious

It may be thought axiomatic that the preservation of the self (i.e ofsafety and health) would be one of the basic goals of all individuals.Clearly this is not a goal of all people at all times, as the statistics ofsuicides must indicate* However, we can assume that most failures toachieve that goal are because individuals do not perceive that their safety

is immediately threatened, and so other goals which the individual hasare given priority over the one of self-preservation If risks are perceived

to be small and gains great, then individuals are willing to trade off aslight increase in (long-term) risk for a bigger short-term gain in speed orcomfort It also seems that the majority of people are optimists in respect

of risk They think that situations will stay under control, particularly ifthey themselves are the ones who can influence the risk Hence, typicallythree-quarters of drivers asked will say that they are safer than theaverage driver†

Figure 2.7.5 Hierarchy of needs (after Maslow)

* In the case of suicide, murder or self-sacrifice some other goal supersedes, but we do not deal with those cases here Freudian theorists have speculated that accidents can be unconscious attempts to punish oneself, which override self-preservation However, we do not find this a useful concept when dealing with behaviour at work.

† In case the paradox here is not clear, the figure should be no higher than 50%!

2.7.3.4.2 Personality and attitudes

Personality is formed partly from innate characteristics, inherited cally, partly by what happens in the critical years of maturation and partly

geneti-by subsequent experience Since each individual will have been subject to aunique mixture of all of these factors, the result is that no two individualswill be entirely alike in the combination of characteristics which make uptheir behaviour No two people will perceive the world in quite the sameway No two individuals will react in quite the same way to the samecircumstances confronting them To predict with certainty how any oneindividual will behave in a particular set of circumstances would require acomplete knowledge of all the factors which had gone to make up thatperson, and that we never have However, the position is not entirelyhopeless since there is enough common ground in individual responses tomost circumstances to make predictions worthwhile That commonground within one person is labelled personality; where it is commonground between people in a group we label it norms or group attitudes.The study of personality is an area of psychology which has spawnedmany parallel and conflicting theories One style of theory tries to explainwhere personality comes from and classifies people into ‘types’ or groupsbased on differences in personality development; other theories merelyclassify the end result and measure existing differences (trait theories) Atypical example of the latter is Cattell’s trait theory12 From extensiveresearch based upon the responses to questionnaires on their beliefs andpreferences by many thousands of individuals, Cattell produced a list of 16

personality factors (see Table 2.7.1) The factors are envisaged as 16

dimen-sions on which an individual’s position can be plotted to produce a profilewhich describes that unique individual Since someone can score from 1 to

10 on each scale, these 16 scales provide 1016unique character tions or personalities, which is more than the total number of humanbeings who have ever walked the earth since Homo sapiens evolved

combina-Table 2.7.1 Cattell’s 16 personality factors

1 Reserved, detached, critical Outgoing, warm-hearted

2 Less intelligent, concrete thinking More intelligent, abstract thinking

3 Affected by feelings, easily upset Emotionally stable, faces reality

4 Humble, mild, accommodating Assertive, aggressive, stubborn

5 Sober, prudent, serious Happy-go-lucky, impulsive, lively

6 Expedient, disregards rules Conscientious, persevering

7 Shy, restrained, timid Venturesome, socially bold

8 Tough-minded, self-reliant Tender-minded, clinging

9 Trusting, adaptable Suspicious, self-opinionated

11 Forthright, natural Shrewd, calculating

12 Self-assured, confident Apprehensive, self-reproaching

15 Undisciplined, in self-conflict Controlled, socially precise

16 Relaxed, tranquil Tense, frustrated

There have been attempts to relate personality types to accident rates,notably to define ‘risk takers’ In section 2.7.4 this is briefly discussedunder the heading of accident proneness.

While personality is the underlying core of relatively unchangingbehavioural consistency in a person, we can consider attitudes as rathermore superficial manifestations Attitude is sometimes defined as ‘atendency to behave in a particular way in a certain situation’ Underlyingthis definition is one of the thorniest problems in psychology, theconsistency between what people say they believe or will do and whatthey actually do As with personality many theories abound in this area

We illustrate just one In their theory Fishbein and Ajzen13define:

Attitude.Attraction to or repulsion from an object, person or situation.Evaluation, e.g liking rock climbing, favouring trades unions, avoidingunproven new machinery, etc

Belief. Information about an object, person or situation (true or false)linking an attribute to it, e.g that machine guards are a hindrance toproduction, that accidents are caused by careless workers

Behavioural intention.People’s beliefs about what they will do if a givensituation arises in the future, e.g that they will use a safety belt whendriving on a motorway, or that they could find the exits to the buildingfast enough to escape a fire

Behaviour. Actual overt action, e.g actually wearing your seat belt orevacuating the building

All these are linked in Fishbein and Ajzen’s theory as shown in Figure 2.7.6.

As an example, someone may believe that breathing apparatus isuncomfortable and dislike it (which may feed back to beliefs by makingthat person hypercritical of the comfort of any new apparatus) This mayresult in resistance to wearing it, but, knowing that it is a company rule(norm) the person will hurriedly put it on (behaviour) when the safetyadviser walks by (trigger) If this happens many times he may find it is not

so bad after all and there will be feedback which will change the beliefs

Figure 2.7.6 Links between attitudes and behaviour

2.7.3.4.3 From inputs to outputs

Figure 2.7.4 shows the process of taking in information from the

environment, processing it and taking actions The general effects of theenvironment will be discussed in section 2.7.4.6 In section 2.7.4.2 weconsider the question of individual differences in accident susceptibilitybecause of the way an individual functions at each of these steps

Feedback and monitoring loops The most important thing to say about

human behaviour and information processing is that it is a closed loopprocess It is purposive and not purely reactive We formulate intentionsand objectives, scan the world to find information useful for reachingthem and make plans to steer ourselves towards them We then takeaction and monitor whether it takes us in the right direction to achievewhat we want If not, we adjust our behaviour Attempts to influencebehaviour are therefore always attempts to modify an ongoing process.They neither operate in a vacuum, nor start with a blank sheet Unless wesucceed in changing the goals and objectives a person is seeking toachieve, we must therefore always expect that pressure to changebehaviour will be met with resistance or will only be partly vectored intothe direction people will steer their own behaviour

These feedback and monitoring loops operate at all levels A basicphysiological one is the ‘proprioceptive’ or ‘kinaesthetic’ sense whichtransmits information from the muscles and joints to the brain, informing

it about their position in space, and their orientation one to another Thisdrives the sense of balance and position which can be disorientated byrapid movement, resulting in motion sickness Other loops partly insideand partly outside the brain monitor where we have got to in a task Stilllonger loops drive our learning

Perception is a process which is also purposive and selective It is not

like a camera taking a snapshot of a whole scene People register someaspects of the situation very rapidly, but ignore or overlook others whichare not relevant to their goals at the time These attention mechanisms can

be crucial in spotting hazards or warning signals Perception is alsostrongly influenced by expectations We sometimes see what we expect tosee, or rather we accept evidence from our senses much more readily if itmatches what we expect In this way we can be fooled by situationswhich have something in common with what we expect to happen andoverlook vital differences The control room operators at Three MileIsland did that in misdiagnosing the problem there

Expectancy can be seen as a mental model of the real world which hasbeen built up from experience over an individual’s lifetime This can form

a very ‘real’ alternative for perception to direct input from the worlditself Every one living in an industrial society knows what a motor carlooks like and can conjure up a mental picture of one comparativelyeasily This means that, when confronted with a particular car in the realworld, there is no need to take in all of the details, which are already onfile in the brain People can concentrate upon only those characteristicswhich differentiate this car from the ‘standard’ car of their mental picture,e.g its colour, or make, or its driver Again there is a cost: we can make

errors For example, in the UK we are so used to expecting the driver to

be sitting on the right of the car, that we may not see that this particularcar is from abroad and that the person on the left is the one driving.Machines, processes, people, and whole situations are stored in the brainand can be recalled at will, like files from the hard disk of a computer Thiscuts down enormously on the amount of information about any scenewhich an individual need take in order to perceive and understand it Thereliance upon expectation is an essential mechanism in skilled operationand many tasks would take a great deal longer to carry out if this was not

so Thought therefore needs to be given to ways in which reality can bemade to fit people’s simple models Standardisation of machine controls,layout of workplaces, colour coding and symbols, etc are all designed toachieve this result, as are codes of rules such as the Highway Code or PlantOperating Procedures But standardisation has a hidden snag The morestandard things normally are, the more likely are exceptions to trapsomeone into an error So, once they have given rise to strong expectations,standards and rules must be enforced 100% to avoid this danger Anycircumstances which are unclear or ambiguous (e.g fog, poor lighting) orwhere an individual is under pressure of time, is distracted, worried, orfatigued, will encourage expectancy errors In extreme cases individualsmay even perceive and believe in what are in fact hallucinations

Memory The storage facility of the human system is the memory The

memory is divided into two different types of storage, a long-term, largecapacity store which requires some time for access, and a short-termworking storage, which is of very small capacity and rapidly decays, butcan be tapped extremely rapidly

The short-term memory is extremely susceptible to interference fromother activities It is used as a working store to remember where one hasgot to in a sequence of events, for example in isolating a piece ofequipment for maintenance purposes It also stores small bits ofinformation between one stage of a process and another, such as thetelephone number of a company between looking it up in the directoryand dialling the number

Long-term memory contains an abundant store of information which isorganised in some form of classification Any new information is perceived

in terms of these categories (closely related to expectations) and may beforced into the classification system even when it may not fit exactly In theprocess it can become distorted This process probably also results inspecific memories blurring into each other, with the result that the wrongmemory may be retrieved from the store when it is demanded

People are not able to retrieve on any one occasion all the things whichthey have stored in their memory There are always things which theyknow, but cannot recall, and which ‘pop out’ of store at some later stage.They are there, but we have forgotten where we put them This sort oflimitation can frequently be overcome by recalling the circumstances inwhich the original memory was stored, or by approaching it viamemories which we know were associated with it Unavailability ofmemories may be crucial in emergency situations where speed of action

is essential A technique for overcoming unavailability is to recall and

reuse the memories (knowledge and skills) at regular intervals Refreshercourses, emergency drills, and practice sessions all perform this function.However, one unwanted side effect of constant recall and reuse ofmemories is that they may undergo significant but slow change Whenthe memory is unpleasant, or shows the individual in a bad light, it isextremely likely that distortion will occur at each recall and it will bethese that will be remembered rather than the original story Testimonyfollowing an accident is notoriously subject to such distortion People canquite genuinely remember doing what they should have done (the rule)rather than the slip they actually made They can also construct memories

as they go over the story time and again ‘I must have done X, if Yhappened’, can unconsciously become ‘I did X and Y happened’

Decision-making, or processing, has been the subject of an enormous

amount of research Much of it has been normative, often carried out byeconomists or management and policy theorists, and studies how

decisions should ideally be reached These decision theories often assume

perfect knowledge of all alternative courses of action and their sequences and then calculate trade-offs and optimum courses of actionbased on utility functions The theories can be modified to allowpreferences such as ‘minimax’, which tries to minimise the occurrence ofextreme (maximum) consequences, rather than optimising across alldecisions This is an attempt to model the well-known risk aversionwhich many people show in decisions they make in practice However,even the most sophisticated normative theories do not predict or matchnormal human decision-making very well Natural decisions are far fromrational in the economists’ sense of the word, which may explain whyeconomists are so poor at predicting the behaviour of markets andeconomies, which are a combination of many people’s naturalisticdecisions interacting with each other

con-Human decision-making is influenced by a combination of manyfactors All alternatives are never fully known, or even looked for, and all ofthe consequences are not worked out in detail This is usually too complex

a process for people to carry out in their heads in the time available, andthey do not take the time to do it exhaustively even when they could Theyset limits to what they take account of, a situation we call ‘boundedrationality’ These limits are set by experience and expectation and aresubject to many biases Reason14discusses these in relation to human error

in his classic book In many instances people reduce conscious

decision-making to a process of following rules We call these rules habits, which are

pre-programmed sequences of decisions stored for use in routinecircumstances (see also section 2.7.3.5) Decision-making is also stronglyinfluenced by beliefs which may have only a tentative link to reality Wecan see this at work in gamblers’ betting behaviour15, their belief that theycan see regularities in the random behaviour of a roulette wheel, or caninfluence the outcome of a throw of the dice by blowing on them It is also

to be found in the gross overestimates of the time saved by (possiblydangerous) speeding and overtaking on the roads and the unquestioningacceptance of the efficacy of some safety measures, which may have noobjective basis in the scientific literature16

Action Once the decision to act has been made, the remaining

limitations on the human system are those of its capacity to act, e.g itsspeed, strength, versatility Humans differ from machine systems in thattheir actions are not carbon copies of each other, even when theindividual is carrying out the same task again and again The objectivemay be unchanging, but the system adapts itself to small changes in bodyposition, etc to carry out a different sequence of muscular actions eachtime to achieve that same result This use of constantly changingcombinations of muscles in coordination is an essential means for thebody to avoid fatiguing any particular muscle combination

In all human actions there is also a trade-off between the speed of anaction and its accuracy Speed can be improved by reducing the amount

of monitoring which the brain carries out during the course of the action,but only at the cost of reducing the accuracy

2.7.3.5 Levels of behaviour and types of error

The description of behaviour given up to now has blurred a distinctionwhich is vital in understanding the types of error which people make.This distinction has arisen from the work of Rasmussen17and Reason14.They distinguish three levels of behaviour, which show an increasinglevel of conscious control:

1 Skill-based behaviour in which people carry out routines on ‘automaticpilot’ with built-in checking loops

2 Rule-based behaviour in which people select those routines, at a more

or less conscious level, out of a very large inventory of possible routinesbuilt up over many years of experience

3 Knowledge-based behaviour where people have to cope with tions which are new to them and for which they have no routines This

situa-is a fully conscious process of interaction with the situation to solve aproblem

As a working principle we try to delegate control of behaviour to themost routine level at any given time Only when we pick up signals thatthe more routine level is not coping, do we switch over to the next level

(see Figure 2.7.7) This provides an efficient use of the limited resources of

attention which we have at our disposal, and allows us to a limited extent

to do two things at once The crucial feature in achieving error-freeoperation is to ensure that the right level of operation is used at the righttime It can be just as disastrous to operate at too high a level of consciouscontrol as at too routine a level

Each level of functioning has its own characteristics and error types,which are described briefly in the following sections

2.7.3.5.1 Skills and routines

The moment-to-moment decision-making about what action to take next

in order to cope with and respond to the environment around the

individual has to be funnelled through a narrow capacity channel whichcan only handle small numbers of items at one time This limited capacitycan be used to best effect by grouping actions together as packages orhabits which can be set in motion as one, rather than as separate steps.Such habits form the basic structure of many repetitive skills, for examplesigning one’s name, loading a component into a machine, changing gear

in a car Such grouping of activities does, however, carry with it thepenalty that, once initiated, the sequence of actions is difficult to stopuntil it has run its course Monitoring is turned down low during the

Figure 2.7.7 Dynamics of generic error-modelling system14

routine The packaging of actions in these chunks also places a greaterpremium on correct learning in the first place, since it becomes verydifficult to insert any new actions into them at a later stage All routinesconsist of a number of steps which have been highly practised and slottedtogether into a smooth chain, where completion of one step automaticallytriggers the next Routine dangers which are constantly or frequentlypresent in any situation are (or should be) kept under control by buildingthe necessary checks and controls into the routines as they are learned.The checks still require a certain amount of attention and the relativelysmall number of errors which occur typically at this level of functioningare ones where that attention is disturbed in some way The fourexamples below demonstrate this point.

1 If two routines have identical steps for part of their sequence, it ispossible to slip from one to the other without noticing This nearlyalways occurs from the less frequently to the more frequently usedroutine An example is driving up to your normal workplace ratherthan turning off at a particular point to go to an early meeting inanother building Almost always these slips occur when the person isbusy thinking about other things (e.g making plans, worrying aboutsomething, under stress)

2 If someone is interrupted half way through a routine they may return

to the routine at the wrong point and miss out a step (e.g a routinecheck) Alternatively they may carry out an action twice (e.g switchingoff the instrument they have just switched on, because both actionsinvolve pushing in the same button)

3 If the environment in which the routine is practised changes withoutthe person noticing, or that change slips the mind, the routine can beused or persist in the wrong situation This can result in injury, forexample if someone steps off a loading platform at the point where thesteps always used to be, without remembering that they have recentlybeen moved

4 The final problem at this level is that routines are dynamic chains ofbehaviour and not static ones There is a constant tendency tostreamline them with practice and to erode steps which appearunnecessary The most vulnerable steps are the routine checks for veryinfrequent problems in very reliable systems (e.g checking the oil level

in a new car engine)

Many of these errors occur because the boundary between skill-basedand rule-based activity has not been correctly respected

These sorts of error will be immediately obvious in many cases becausethe next step in the routine will not be possible The danger comes whenthe routine can proceed apparently with no problem and things only gowrong much later You can still start your car with a low oil level and findyourself driving down the fast lane of the motorway when the oilwarning light comes on The cure for the errors does not lie in trying tomake people carry out their routines with more conscious attention Thiswill take too long and so be too inefficient, and will be subject over a shorttime to the erosion of the monitoring steps The solution lies to a great

extent with the designer of the routines (and so of the apparatus orsystem) to ensure that routines with different purposes are very different,

so that unintended slipping from one to the other is avoided Where this

is not possible extra feedback signals can be built in to warn that thewrong path has been entered by mistake (see section 2.7.4.2)

The second line of defence is to train people thoroughly so that thecorrect steps are built into the system, and then to organise supervisionand monitoring (by the people themselves, their work or reference group,and supervisors or safety staff) so that the steps do not get eroded.2.7.3.5.2 Rules and diagnosis

When the routine checks indicate that all is not well, or when a choice isneeded between two or more possible routines, people must switch to therule-based level Choice of a routine implies categorisation of thesituation as ‘A’ or ‘B’ and choice of routine X which belongs to A or Ywhich belongs to B This is a process of pattern recognition This isanalogous to computer program rules of the form IF , THEN The errors which people make at this level are linked to a built-in bias

in decision-making We all have the tendency to formulate hypothesesabout the situation which faces us on the basis of what has happened

most often before We then seek evidence to confirm that diagnosis rather

than doing what the scientific method bids us and seeking to disprove thehypothesis This means that people tend to think they are facing well-known problems until they get unequivocal evidence to the contrary TheThree Mile Island accident was a classic case of misdiagnosis Theoperators persisted with a false diagnosis for several hours in the face ofcontradictory evidence until a person coming on shift (and so without theperceptual set coming from having made the initial diagnosis) detectedthe incompatibility between symptoms and diagnosis

The solution lies in aiding people to make diagnoses more critically(e.g defensive driving courses, permit-to-work systems) and in support-ing their decisions with warnings about signals they may have missed(e.g checking critical decisions with a colleague or supervisor beforeimplementing them)

2.7.3.5.3 Knowledge and problem solving

When people are facing situations they have no personal rules for, theymust switch to the fully interactive problem-solving stage Here theyhave to rely upon their background knowledge of the system and theprinciples on which it works, in order to derive a new rule to cope withthe new situation There are meta-rules for problem solving which can betaught (see section 2.7.5.2) Besides these there is the creativity andintelligence of the individual and the thoroughness of their training in theprinciples underlying the machine or system Errors at this level can betraced to:

1 Inadequate understanding of these principles (inadequate mentalmodels)

2 Inadequate time to explore the problem thoroughly enough and toexplore the consequences of different courses of action.

3 The tendency to shift back to rule-based operation too soon and to besatisfied with a solution without checking out the full ramifications ithas for the system

The first two are typical errors of novices, the last more of the expert.Experts are by definition the most capable of functioning at thisknowledge level, but also the people who need to do so least often,because they have learned to reduce most problems to rules They mayalso become less willing to accept that there are situations which

do not fit their rules Almost all experts overestimate their ownexpertise

2.7.4 Individual behaviour in the face of danger

Hale and Glendon6 combined the insights from the processing model with the theories of the three levels of functioning14,17and other sources18, into a model of individual behaviour in the face of

information-danger (Figure 2.7.8) Their model allows us to discuss a number of

practical issues of how to influence human safety behaviour, e.g throughtask design or training

Danger is always present in the work situation (as in all othersituations) The only question is how great is the danger and is itincreasing, or could it suddenly increase in the foreseeable future That isindicated at the top of the figure, which is the starting point for thisdiscussion The task of the individual is to keep danger under control, toavoid errors which provoke an increase in danger and to detect and avoid

or recover from danger increasing from other reasons Much of thisactivity occurs by more or less routine reaction to warning signals Onlyoccasionally do people in their normal work situations need actively tocontemplate danger However, these occasions are vitally importantwhen they do occur Examples of such activities are:

1 Designers making decisions about machine or workplace design, plantlayout, work procedures, etc They need to predict the actions of thepeople who will use these products and the hazards which will arise inuse

2 Operators, safety committees, safety advisers and inspectors carryingout hazard inspections, safety audits and surveys, who need to seek outhazards or shortcomings in preventive measures

3 Policy makers in industry and government deciding whether a level ofrisk associated with a technology or plant location is to be accepted.Members of the public assessing whether that policy decision isacceptable to them

4 Planners designing emergency plans for reacting to disasters

Such decisions and activities are all largely carried out at the based level and the borders with the rule-based level

knowledge-2.7.4.1 Perception and hazard detection

This covers the four steps joined by arrows at the left-hand side of Figure 2.7.8 Hazard detection is important in three situations:

Figure 2.7.8 Individual behaviour in the face of danger6

1 Emergency situations where the signals of danger are so clear andinsistent that they lead to an instant, pre-programmed response toescape or to control the danger.

2 Other situations in which danger is known to be possible, but is notalways present Here an obvious warning can alert people to thedanger and trigger the correct response to keep it under control

3 In all other situations in which the warnings about danger are notobvious, people will only detect danger if they go looking for it and weneed to know what initiates hazard seeking and what makes itsuccessful

Surprisingly little scientific study has been made of how hazard detectionand recognition operates in any of these situations and what alerts people

to the presence of danger What follows is a summary of the availableinformation6 It starts with some general information about perceptionand then takes each of the three situations above in turn

Information gets into the human system through the sense organs.Hazards which are not perceptible to the senses will not be noticed unlesssuitable alarms are triggered by them or warnings given of them, orpeople go intelligently in search of them Examples are odourless,colourless gases such as methane, X-rays, innocuous looking chemicalswhich are in fact carcinogens, ultrasound, or hazards in the dark Thecanary falling off its perch in the mine because of its greater sensitivity tomethane was an early example of a warning device, subsequentlysuperseded by the colour change in a safety lamp flame and now by themethanometer

If any of the senses are defective the necessary information may notarrive at the brain at all, or may be so distorted as to be unrecognisable

Some sensory defects are set out in Table 2.7.2 Limitations similar to

sensory defects can also be ‘imposed’ by some of the equipment orclothing provided to protect people against exposure to danger, e.g.safety goggles, gloves or ear defenders These sensory defects can beovercome by taking more care elsewhere in the behavioural model This

Table 2.7.2 Some sensory defects

Sense Natural and ‘imposed’ sensory defects

Sight Colour blindness, astigmatism, long and short-sightedness,

monocular vision, cataracts, vision distortion by goggles and facescreens

Hearing Obstructed ear canal, perforated ear drum, middle ear damage,

catarrh, ear plugs or muffs altering the sound reaching the earTaste and smell Lack of sensitivity, genetic limitations, catarrh, breathing apparatus

screening out smellsTouch senses Severed nerves, genetic defects, lack of sensitivity through gloves

and apronsBalance M´eni`er´es disease, alcohol consumption, rapid motion, etc

means, for example, that people with poor sight or hearing do notnecessarily have more accidents2 They often learn to avoid situationswhich would be critical in this respect If that choice is not open, however,they may be caught out.

The sense organs themselves have a limited capacity for receiving andtransmitting information to the brain The environment around us alwayscontains far more information than they can accept and transmit We try

to cope with this limited capacity by using a switchable attention filter.The brain classifies information by its source and type It is capable ofselecting on a number of parameters those stimuli that it will allowthrough a filter into the system The setting of the filters on each sensorymode is partly conscious and partly unconscious The main visualattention mechanism is the direction of gaze which ensures that thestimulus from the object being looked at is directed to the most sensitivepart of the retina (fovea) where it can be analysed in detail The rest of thefield of view is relegated to the less sensitive parts of the retina In normalactivity this centre of focus is shifted constantly in a search pattern whichranges over the field of view until an object of interest is picked out Thesenses can be tuned to seek out a particular facet such as a defect in amachine or component, provided that we know in advance whatcharacteristics to tune it to This ability is known as ‘perceptual set’.People can also tune their hearing sense to pay attention to strangesounds coming from a particular part of a machine, while ignoring allothers Perceptual set can also show longer term settings which producedifferences between individuals because of their interests and theirexperience Safety advisers notice hazards because they are interested inthem and used to finding them; motor cycle addicts spot a Bonneville in

a crowded street, where others might not even notice that there was amotor bike

Inputs which do not vary at all are usually not particularly useful to thesystem, e.g a constant noise or smell, a clock ticking, the sensation ofclothes rubbing on the skin The filter alters over time to exclude suchconstant stimuli from consciousness As soon as they change, however,e.g the clock stops, the filter lets through this information and we notice

it In this way we are alerted very efficiently to ‘something wrong’ and wecan go in search of it This seems to be one of our main hazard detectiondevices

These selective attention mechanisms are extremely efficient andinvaluable in many tasks But any mechanism which is selective carrieswith it the penalty that information which does not conform to thecharacteristics selected by the filter will not get through to the brain,however important that information is People can be concentrating sohard on one task that they are unaware of other information Hencesomeone can fall down a hole because they were walking along staring atsome activity going on in the opposite direction Pre-setting the filter canalso lead to false alarms; searching a list for the name Jones we cansometimes be fooled by James The maintenance fitter can expect to see aparticular type of fault and jump to the conclusion it is there, based onjust a few of the necessary symptoms The cost of a rapid response is anincrease in errors

Expectations are one of the main bases for setting the attention filters.

In that case we may see what we expect and not what is there This ismost often the case with situations which go against populationstereotypes, for example a machine on which moving a lever downwardsturns it off We see the lever in the down position and ‘see’ it as ‘on’.Other population stereotypes are red for danger and stop, clockwise turnsthe volume up or shuts the valve These examples are very widely shared,but in other cases stereotypes for one population may contradict thoseheld by others, e.g you turn the light on by putting the switch down inBritain but by pushing it up in the USA and parts of Europe Designswhich do not match expectations can trap people into making errors

In some circumstances these false expectations may result in little morethan annoyance and delay In other cases they may be a prelude tophysical damage or injury For example, a machine operator may reachrapidly towards his pile of components without looking and gash hishand on the sharp edge of one of them which has fallen off the pile and

is nearer than he expected The truck driver may drive rapidly throughthe doors which are reserved for trucks without looking or sounding awarning, because no one is supposed to be there, only to find thatsomeone is using the truck doors as pedestrian access

2.7.4.1.1 ‘Flight or fight’ responses

The body has built-in danger detectors, which trigger instant reaction Allextremes of heat, cold, loud noise, rapid movement, strong smells, smoke

or irritant chemicals in the lungs are pre-programmed to set off the body’sfight or flight responses Whether we respond adequately to such stimulidepends partly on how extreme they are, but has everything to do withthe programming of the response and little to do with any perceptualproblems In extreme danger, such as a large fire, only some 15% ofpeople seem to respond with rational alertness and rapidity Another 15%seem to freeze and become totally passive, while the rest show impairedalertness and fall back on well-learned behaviour and routines, whichmay or may not be appropriate for the situation Hence customers in ashop or disco will tend to try to find the way back to the entrance theynormally use, ignoring closer fire exit signs People may stop to collecttheir belongings before leaving, as they routinely do at the end of theworking day Car drivers will tend to brake and steer in an imminentcollision, as they do to avoid more common and less serious situations Ittakes an enormous amount of training and practice to get over theseconservative responses and give people the full armoury of necessaryresponses and the capacity to use them appropriately An effectiveresponse to emergencies in situations where a large or shifting populationmay be present, therefore, depends upon training at least a small number

of people to that level and making sure they can influence and controlthose who have not been trained This applies to sports stadia, shops,theatres and discos, hotels and many workplaces with high staffturnover

Some workplaces, such as textile mills, steel rolling mills or high riseconstruction sites have the same effect on people the first time they see or

hear them as the emergency situations mentioned above They are scared

by the noise, heat and fast moving machinery or by the heights Yetpeople who have worked there for some time are quite happy there and

do not regard them as overly dangerous This illustrates a learningprocess, which is vitally important in understanding hazard detectionand recognition We can learn that the insistent danger signals do notactually mean danger As a person learns where the specific dangers insuch workplaces lie, the general fear response gets replaced by a muchmore sophisticated sense of hazard The individual learns that it is quitepossible to approach seemingly horrific dangers quite closely as long asthe last vital barriers are not breached The sense of danger is tempered

by the knowledge of how to control the danger For this reasonexperienced workers can do things and enter situations which the novicecannot The question is always whether the novice realises his lack ofcontrol and so avoids the danger, or copies too rapidly the behaviour ofthe experienced worker without having the control skills necessary Theresearch evidence2is that there is a large peak in accidents in the first fewdays, when novices get caught out by completely unknown problems.Then there is a rapid decline in accidents However, the sense of dangerseems to decline faster than the control ability increases in manysituations, resulting in another small peak in accidents some days orweeks later

2.7.4.1.2 Responding to warnings and error signals

If the danger signals are not so insistent that they demand response, thereaction will depend upon a more conscious assessment of the warningsigns These may be the learned specific warnings which are alreadypresent (see 2.7.4.1), or they may be artificially introduced warnings.These can range from alarms which go off when the danger is present (afire alarm), to general notices alerting people to the fact that danger may

be present (‘Beware of the dog’)

The following criteria can be used for the design and placing ofwarnings19 They should:

 be present only when and where needed,

 be clearly understandable and stand out from the background in order

to attract attention,

 be durable,

 contain clear and realistic instructions about action,

 preferably indicate what would happen if the warning is notheeded

Warnings should preferably not be present when the hazard is absent,otherwise people will soon learn that it is not necessarily dangerous in thatarea They will then look for further confirmatory evidence that somethingreally is a problem before taking preventive action The philosophy of ‘if indoubt put up a warning sign’ is counterproductive, unless an organisation

is prepared to go to great lengths in enforcing it even in the face of thepatent lack of need for the precautions at some times

If an alarm goes off and there proves to have been no danger, there will

be a small, but significant loss of confidence in it If false alarms exceedtrue ones, the first hypothesis an individual will have when a new alarmgoes off is that it is a false one Tong20reports that less than 20% of peoplebelieve that a fire alarm bell going off is a sign that there really is a fire.The rest interpret the bell in the absence of other evidence as a test, afaulty alarm or a joke The recognition of the presence of fire is thereforeoften delayed, and the first reaction to warnings of a fire is often toapproach the area where it is, in order to check whether there really is aproblem, rather than to move away

Because warnings must be understood quickly and sometimes underconditions of stress, there can never be too much attention to their ease ofcomprehension The language used must be consistent, whether verbal orvisual (e.g a red triangle round a sign must always mean a warning, a redcircle a prohibition) The language must be taught Written warningsmust take account of the reading age of the intended audience and theproportion of illiterates or foreign nationals with a poor understanding ofthe language A word such as ‘inflammable’ should, for example, beavoided because many misunderstand it to mean ‘not flammable’ (byanalogy with ‘inappropriate’ or ‘incomprehensible’)

A special category of warnings are those applicable in routine tasks,which need to bring people up short with an insistent indication that theirroutine has gone off on the wrong track In routine tasks we normallyonly conduct minimal monitoring Designers should improve upon theavailability of information about deviations in such tasks and consciouslybuild into their designs feedback about the actions which the individualhas just taken, and their consequences Examples of such feedback whichhelps error detection are the following:

 displays on telephones which show the number you have just keyed

in, so that you can check before dialling it;

 a click or bleep when a key is pressed hard enough to enter aninstruction on a keyboard;

 commands echoed on a visual display as they are entered on akeyboard; and

 the use of tick boxes on a checklist to indicate the stage in the checkwhich has been reached

2.7.4.1.3 Inspection and hazard seeking

If there are no immediately relevant warnings, people will not usually go

in search of hazards There may be a general level of alertness to unusualsignals, but it will not be high Entry into novel situations may triggersome hazard seeking There may be a strong influence of personality orexperience here Those with a distrust of technology or with experience ofdangers in the past may be more inclined to go in search Recency effectsmay be important After reports of a horrific hotel fire on the television,

we may all check the fire exits of the hotel we stay in that week, but theeffect usually fades by the next month In general, if we want people tosearch for hazards in such circumstances we have to instruct them to do

so, or train them to make it a routine During such workplace safetyinspections the people concerned are, therefore, already alerted to thepossibility that there are hazards present, and are actively seeking them.But to seek is not always to find Untrained inspectors characteristicallymiss hazards which have one or more of the following features:

1 Not detectable by the unaided eye, but requiring active looking in,behind or under things, rattling guards or asking questions about thebag of white powder in the corner

2 Transient; e.g most unsafe behaviour which can only be discovered byasking questions and using the imagination

3 Latent; i.e contingent upon other events, such as a breakdown, a fire,

or work having to be done by artificial light Again, only ‘what if’questions can uncover these

Too many people think that inspection rounds can be passive walks, ‘justkeeping the eyes open’ This is absolutely not the case Inspection must be

an active and creative search process, of developing hypotheses abouthow the system might go wrong It requires the allocation of time andmental resources Checklists can help to make the search systematic and

to avoid forgetting things, but they should not be allowed to become asubstitute for active thinking It often helps to get people in from otherwork areas, or with other backgrounds, who see things through new eyesand spot hazards which the regular workforce have ceased to see.2.7.4.1.4 Predicting danger

Prediction at the design stage is an extension of the problem ofinspections, made more difficult because there may be no system inexistence, comparable to the one envisaged in the design, from which tolearn Imagination and creativity are therefore relevant attributes for therisk analyst in addition to both plant knowledge and expertise inbehavioural sciences

There are large individual differences in how good people are atimagining the creative misuse that operators will make of their systems.Those who are good are known as ‘divergent’ thinkers There is someevidence that people who gravitate towards the sciences, maths andengineering are more ‘convergent’ in their thinking, and tend to be morebound by experience and convention, than those who choose socialsciences and the arts They may therefore be less able to anticipate themore unusual combinations of events which could lead to harm.Designers are, anyway, rather inclined not to want to think about howpeople might use (or misuse) their beloved designs in the real world.They tend to think normatively: this is how it should be used, and so, this

is how it will be used This suggests the need for teamwork in design andhazard prediction

Risk assessment techniques such as HAZOP, design reviews and faultand event trees are systematic methods to guide and record the process ofcreative thinking about risks They are also often used to quantify thechance of failure That step is only legitimate if we are certain that all

modes of failure have been identified That is particularly difficult withhuman-initiated failures because people can act (and fail) in so manymore ways than hardware elements.

A systematic task analysis21is essential for a good prediction of humanerror The data for such an analysis come partly from logical analysis of

what should happen and partly from observation of what does happen

when people carry out the tasks Such job safety analysis techniques aredealt with in chapter 2.4 of this book

Task analysis forms the basis for the use of techniques for errorprediction22 They all depend upon one or other sort of checklist Forexample each sub-task can be subjected to the following standard list ofquestions to specify what would happen if these types of error occurredand how such an error could happen (c.f HAZOP):

 inadequate performance of sub-task:

 input signals misinterpreted (misdiagnosis)

 skills not adequate

 tools/equipment not correctly chosen

 procedure not correct

 inappropriate stop point

– too soon

– too late

– not accurate enough

– quality too low

 routine confusable with other routines

Other checklists have been produced linked to the models of Reason23and Rasmussen17or derived from ergonomics24

2.7.4.1.5 Knowledge of causal networks

Hazard detection has been shown above to be dependent on the mentalmodels people have of the way in which events happen and systemsdevelop If these mental models are incomplete or wrong they can lead toinappropriate behaviour in the face of hazards Interview studies6showthat such problems frequently occur, particularly in relation to occupa-tional disease hazards

Examples of such significant inaccuracies are:

 Men sawing asbestos cement sheets who said that they only wore theirface masks when they could see asbestos particles in the air (Yet it isthe microscopic, invisible particles which are the most dangerousbecause they are in the size range which can penetrate to the lung.)

 Wearers of ear defenders who fail to incorporate the notion of timeweighted average exposure in their concept of what constitutes

dangerous noise Hence they fail to realise that ‘just taking the muffs off for a few moments to let the ears breathe’ in high noise areascan negate much of their protective effect.

ear- Misconceptions about the link between posture and musculo-skeletaldamage such as considering postures as ‘relaxed’ and therefore goodwhen they show the body and notably the spine in a slumped position(which in fact puts extra load on the back muscles to stabilise the spine

in that position)

The examples above are of causal links quite close to the actual harm.When we look at perceptions of causal links further back in the chain, wefind even greater distortions and individual differences in attribution ofcause This is particularly clear when we look at people’s attribution ofcauses to accidents that have happened to them or others They find itvery hard to construct logical and complete causal trees, which satisfy thetest that each effect needs a set of causes which are necessary andsufficient to produce it This means that fault trees are often constructedwith missing branches and people checking them do not notice the gaps.People also tend to mention as causes only those things they can envisage

as being modifiable25 They often fail to mention design features of theworkplace or machine as causes, if they see them as ‘given’ In contrast,human behaviour is almost always seen as modifiable (I could have done

X differently), and hence gets mentioned more often as cause

We need to pay considerable attention to causal perceptions in training.They will determine both how seriously people take the risks (howimminent, nasty or probable they consider them: section 2.7.4.2), and whothey see to be responsible for taking action (section 2.7.4.3) If theprevailing attitude among both managers and shop floor is that accidentsare inevitable, because their causes are too varied always to predict them,

we have an organisational culture that will never excel at safety andalways be willing to shrug its shoulders at a continuing trickle ofaccidents Both initial training and the discussion of accidents andincidents which have happened need to go deeply into what theseperceptions are and how appropriate they are

2.7.4.2 Labelling as dangerous: reactions to perceived risk

Perceiving a hazard and assessing its seriousness are very closely relatedprocesses They are separated here in order to discuss them more clearly.However, in practice the two steps are iterative We only see something as

a hazard if we see it as (potentially) out of control The law may require

us first to make an inventory of all possible hazards and then to assesstheir likelihood (risk) In fact we do it the other way around We havealready applied a cut-off in doing a risk assessment, which has excludedfor us ‘non-credible’ accidents

The reactions of different groups to risks they perceive has been thesubject of much research in the past few decades6,26,27 Much of it hasconcentrated on decisions about siting hazardous plants or developingtechnologies such as nuclear power A main focus has been the question

of ‘acceptability of risk’ This term has led to much confusion because itimplies that people are, or should be content, or even actively happy with

a particular risk level The word ‘tolerated’28gives a better assessment ofthe situation, since it carries with it an idea that the opportunity to dosomething about the hazard is a relevant factor in any decision There isalso overwhelming evidence that people do not consider the risk attached

to an activity or technology in isolation from the benefits to be gainedfrom it29 Therefore no absolute ‘acceptable’ level for a wide range ofdifferent hazards can be meaningful, since the benefits which go withthem will vary widely

A clear distinction has emerged from the research between threats topersonal safety, threats to health and threats to societal safety30 Thefactors which people use in assessing each of them appear to weighdifferently, and this is likely to be related to the sort of action whichpeople perceive they can take against the differing threats For example,moving house or changing jobs will solve the threat to an individual’ssafety from a particular chemical plant, but will do nothing for the threat

to societal safety from that same plant

Despite these differences there appear to be common factors whichpeople use to make assessments of danger and to apply a label to asituation indicating that something must be done about it What variesbetween types of hazard and between responses to different questions isthe weighting given to the different factors The research has used twobasic approaches Either to ask people directly what they think abouthazards and how they react to them, or to measure actual behaviour inrespect of different hazards The first is called ‘expressed preference’research, the second ‘revealed preference’

One clear result of expressed preference research is that people use amore sophisticated assessment process in judging risk decisions than justconsidering probability of harm They also consider a wide range of otherfactors, which can be grouped under the following headings:

1 Whether the victim has a real choice to enter the danger or not, or toleave it once exposed

2 Whether the potential for harm in the situation is under the control ofthe potential victim or another person, or outside any humancontrol

3 The foreseeability of the danger

4 The vividness, and severity of the consequences

2.7.4.2.1 Choice to enter and leave danger

People generally think of those who choose to engage voluntarily indangerous activities like rock climbing, rallying or caving, as people whorealise the nature of the hazards and have accepted their own responsibil-ity to control them The problem of accidents or disease is then seen astheir affair, and not a matter of concern for society On the other hand ifthere is no choice about exposure to the danger, e.g whether a chemicalplant or nuclear waste dump is built near your village, far higherdemands on the level of safety are made The situation is, however,

seldom clear-cut Can, for example, the choice of a person to take a job on

a construction site in an area of high unemployment be called a voluntaryacceptance of risks associated with that job? Hazards frequently come aspart of a package with other costs and benefits In the early years of theindustrial revolution workers were deemed to have accepted voluntarilythe hazards of the job that they accepted Therefore they were deemedliable for their own accidents Now both society’s view and the law havechanged The employee is not considered to accept occupational hazardsvoluntarily, unless there is talk of some gross deviation from normalcarefulness Perceptions of what is voluntary do change, but thedimension remains important in determining how serious we consider asafety problem

The demand for increased safety levels is also stronger if the risks andbenefits are not equitably shared and one group profits from the riskexposure of another The great public concern about risks of geneticdamage from radiation, genetically manipulated organisms or teratogensseems partly explainable in terms of the threats they bring to unborngenerations who have no choice in the matter and no share in benefitsoccurring now

If we look at risk perception for those taking part in an activity, there

is some evidence that dangerous activities which are voluntarily chosenare positively valued just because of their finite element of danger.Mountaineers choose to attempt climbs of increasing difficulty as theirskill increases, finding the old ones tame There is an element here oftesting the degree of control which one has over a situation to checkthat it is real The element of apparent loss of control is one of theattractions of fairground rides such as the ‘wall of death’ But thefascination seems to go further than this Greater danger, such as in war

or time of disaster, is associated in the minds of survivors with greatergroup friendliness, shared emotions, sense of purpose and competencewhich makes that danger in retrospect positively valued, or at leastwillingly accepted

If the assessment of personal control is such an important factor inevaluating hazards, it is very important that the assessment is accurate,and that people do not believe they are in control when they are not Butthere is ample proof that people can have illusions of great control wherenone or less exists Svenson32quotes a number of examples from the field

of driving For example between 75% and 90% of drivers believethemselves to be better than average when it comes to driving safely.Similarly 88% of trainees in cardiopulmonary resuscitation felt confidentafter an interval of several months to perform it, while only 1% actuallyperformed adequately Experts always tend to be overconfident in theirexpertise This is particularly dangerous when specific knowledge, forexample of a theoretical nature, about a process is taken to mean controlover the whole activity involving that process This can be a serioussource of overconfidence in skilled personnel such as research chemists ortoolroom personnel, most of whose accidents in fact come from theeveryday hazards of the machinery or the laboratory which have little to

do with their speciality

When people have no personal control they may place their trust inothers to keep the situation safe Again it is a question of whether theassessment is accurate and whether the trust is justifiably placed Thework of Vlek and Stallen29 suggests that one of the clusters of beliefscharacterising those who oppose large nuclear, transport and chemicalplant developments is personal insecurity and lack of trust in thosecontrolling the technology The situation is made worse by the spectacle

of experts disagreeing violently with each other about the safety issues ofthe developments in question

In the field of health promotion the concept of control has also beenshown to be important One of the main thresholds to be crossed beforepeople will act to change their own behaviour is to admit that theypersonally are susceptible to the health threat, for example, fromsmoking, alcohol, drugs, or heart disease, i.e that they have lost control.The other side of this coin is the need to believe in the efficacy of thepreventive action before it will be adopted This means believing that theproposed action would restore the lost control; that giving up smokingwould reduce the risk of cancer and heart disease, that wearing theprotective ear-muffs would reduce the hearing loss and so on Theopportunity to prove for oneself the effectiveness of protective devices istherefore important in persuading people to wear them

2.7.4.2.3 Foreseeability

Foreseeability is a word familiar from the case law of the English legalsystem relating to health and safety It has been defined by judges asbeing what the ‘reasonable man’ would expect to happen given access tothe current state of knowledge at the time of making a decision It is used

to draw a dividing line between situations in which people should havetaken action to prevent an accident, and those for which it is notreasonable to hold them liable

At an individual level hazard detection is limited by what isforeseeable or foreseen However, if people cannot foresee exactly what

may happen, but suspect that it may still go wrong they will be afraid Ifthis feeling goes hand in hand with the belief that there could be severeconsequences and that the person is powerless to do anything, thereaction may be extreme Evidence that a new and unknown technologylike genetic engineering is not as much under control as previouslythought would therefore have a profound effect on people’s beliefs,shifting them rapidly from indifference to strong opposition This isapproximately the effect which Chernobyl had on nuclear power.2.7.4.2.4 Vividness, dreadfulness and severity

The most recent accident or tragedy weighs heavily in the minds ofpeople when they are asked about priorities for prevention, but this mayfade rapidly On a more permanent basis, people have reasonablyconsistent ratings of how nasty particular types of injury or disease are33.For example cancer is greatly feared, an eye is worth more than a leg andsome injuries such as quadriplegia and brain damage are consistentlyrated as worse than death

An important element in memorability is ‘kill size’, the number ofpeople who either actually do, or potentially could get killed in anincident This is why people tend to be more concerned about the safety

of air or train travel, where accidents tend to cause multiple deaths, andmuch less about road safety which usually kills people one at a time Thecumulative numbers of deaths in a year and the probability of death pertrip have a much smaller influence on the assessment of seriousness.2.7.4.2.5 Risk scales and probability

With such a complex of factors determining the reaction of bothindividuals and society to risk it is not surprising that no simple scalesuch as Fatal Accident Frequency Rate can capture its essence Man-agers and planners may wish to reduce decision-making to a tidyconsideration of probability times cost of harm (usually deaths) Theymay even wish to label as irrational any opposition to this definition ofrisk But this is no more than one powerful group putting an emotivelabel on something they seek to oppose A better approach is to treatthe factors for what they are, namely the basic elements which must beinfluenced if we wish to change behaviour If you want someone to use

a safety device, you must convince them that the danger is foreseeable,unpleasant and avoidable, that the safety device is effective and thatthey can choose how to use it

There is an additional problem with the use of probability in thedefinition of risk For the average person probability is not a concept thatcomes naturally This is an idea which will be readily accepted by anyonewho has tried to learn the fundamentals of statistics Most normal peoplehave little need for accurate probability judgements and little practice inmaking them Individuals normally only rate whether they think thingswill remain under control Despite this it is surprising how good thecorrelation is between measured probability of particular types ofaccident and subjective assessments by the general population The major