People or systems? To blame is human. The fix is to engineer

Abstract

Person-centered safety theories that place the burden of causality on human traits and actions have been largely dismissed in favor of systems-centered theories. Students and practitioners are now taught that accidents are caused by multiple factors and occur due to the complex interactions of numerous work system elements, human and non-human. Nevertheless, person-centered approaches to safety management still prevail. This paper explores the notion that attributing causality and blame to people persists because it is both a fundamental psychological tendency as well as an industry norm that remains strong in aviation, health care, and other industries. Consequences of that possibility are discussed and a case is made for continuing to invest in whole-system design and engineering solutions.

In my first week lecturing a course on safety and human performance, I introduced my students to the distinction between the person-centered and systems-centered approaches to managing safety (Reason, 2000; Woods & Cook, 1999). It was to be a simple, if mind-changing, lesson on eschewing the person-focused approach of blame, punishment, and empty intonations for workers to “Be safer!” Instead, I encouraged students to view safety as the emergent product of a complex socio-technical system. The implication is that changes in safety can only come about through changes that address not only people, but also the many system components with which people interact. To illustrate the point, I offered the example of a US Food and Drug Administration (FDA) recall of a medication infusion device whose mechanical components were contributing to over-tenfold medication overdoses of hospital patients (see box 1). The FDA recalled only those devices that were not yet installed in hospitals. For those devices that remained, the solution to the overdose problem was to train nurses to, essentially, “be safer,” and to place warning labels on the devices. After what I thought was a convincing lesson on the absurdity of fixing a human-device interface problem by focusing on anything but that interface, a student raised his hand, and dashed my hopes:

Box 1.

Infusion pumps are devices that control the flow of medication or other product into a patient through an intravenous (IV) line. An infusion pump manufactured by Alaris Products and used in many hospitals had a “key bounce” problem such that pressing a button once would sometimes register that keypress twice. For example, pressing 4.8 might result in “44.8” being entered, which represents a 10-time overdose.

In August, 2006, the manufacturer was ordered by the US Food and Drug Administration (FDA) to send a letter to every hospital still using their device. The letter alerted hospitals to the problem and offered these “solutions”: (1) instructions for nurses to use a proper stance, listen to the number of keypress beeps, verify the screen display, obtain an independent double check, and look at the IV tubing to verify the correct flow rate; and (2) a warning label to be placed on each device.

A simpler and more effective solution might have been to fix the mechanical key bounce problem.

“Yes, I see how the manufacturer could make their product fool-proof, but it’s the user’s responsibility to not be a fool, in the first place.”¹

To my surprise, another student agreed. I was instantly reminded of safety classes I had taken in college, when I had heard similar comments from my peers. In one such class, a particularly memorable student firmly insisted that accidents were 90% the fault of humans,² and upon being encouraged by the professor to think it through, revised his estimate to 100%.

These person-centered views are not confined to the protestations of students. These views may even be a psychological tendency and an industry norm, despite teachings to the contrary. Psychological evidence about typical human behavior and a critical assessment of how accidents are handled in the modern world, both of which are discussed below, suggest that there is something fundamental, perhaps universal, about the assignment of accident causality (and sometimes blame) to the actions and dispositions of human beings.

The remainder of this article is organized as follows. First, a case is made that there is a tendency to attribute causality and blame to person factors. The tendency has been well described by psychologists who study what is known as causal attribution theory (Harvey & Martinko, 2009; Malle, Knobe, & Nelson, 2007). The tendency may also apply to managers, industry practitioners, official investigators, and legislators who deal with safety on a daily basis, and some evidence is presented to support that contention. Further, it is discussed how the newer trend in safety management of focusing on intentional safety protocol violations may be a pitfall if it simply reinforces the person-centered approach. Finally, the numerous implications of the human tendency and industry norm of focusing on the person are discussed. To foreshadow, the main implication is that person-centered tendencies engender ineffective person-centered solutions:

…associated countermeasures are directed mainly at reducing unwanted variability in human behaviour. These methods include poster campaigns that appeal to people’s sense of fear, writing another procedure (or adding to existing ones), disciplinary measures, threat of litigation, retraining, naming, blaming, and shaming.

Reason, 2000, p.768

How fundamental…?

Lee Ross (1977) found the person-centered approach to be so ubiquitous in society that he called it the fundamental attribution error. Researchers of the phenomena have found that when people observe an action or outcome, they tend to attribute its cause to the actor’s internal or dispositional traits, even in the face of overwhelming evidence that the action was caused by the situational context. For example, a worker who slips on a wet work surface may be said by observers to have fallen due to clumsiness, carelessness, or inattention. Other findings from research on causal attributions (Fiske & Taylor, 1991, see box 2) include that individuals tend to (1) attribute the cause of action to external factors if they were the one who performed the action, but to internal factors if they witnessed others performing it (the actor-observer bias); (2) attribute others’ failures to internal factors but their own failures to external factors, and the reverse for successes (the self-serving bias); and (3) make inferences about what a person is like (e.g., “dumb,” “motivated,” “risky”) based on the actor’s observed actions, even when those actions are constrained by external factors (the correspondence bias). Despite much early research on causal attributions—900-some studies published in the 1970’s alone—the link between attribution theory and safety was not made explicit until the mid 1990’s (see more recent discussion of the link in Chapter 3, Glendon, Clarke, & McKenna, 2006). However, the importance of attribution in safety management cannot be understated:

…attributional processes are at the very heart of workplace safety management. Workers, supervisors, managers, and safety specialists are all involved in making inferences of causality or attributions … these causal inferences, in turn, broadly determine the actions that are taken or not taken to correct hazards and prevent injuries. In a very real sense, actions to manage safety derive more from attributions than from actual causes.

DeJoy, 1994, p.3

Box 2. Occupational safety examples of the psychological tendencies to attribute cause.

Carly slipped on an oil spill in her work area. She managed to fall forward into a pile of cushions, avoiding serious injury. Roman, a co-worker, observed this happening.

Fundamental Attribution Error: Roman believes Carly to have slipped because of internal causes: her clumsy nature and carelessness.

Actor-Observer Bias: Although Roman believes that Carly slipped due to internal causes, Carly believes that she slipped because of external causes: oil spills are uncommon and poor lighting conditions made it hard to see this particular spill.

Self-Serving Bias: Carly believes that she successfully fell into a pile of cushions because of internal causes: her quick reflexes and knowledge of the environment. Roman believes that the causes were external: a lucky fall and the fortuitous presence of pillows. The opposite pattern of self-other attributions is seen with regard to her failure (i.e., slipping, see above).

Correspondence Bias: Roman infers from Carly’s slip that she is a risk-taker, a careless employee, or an absent-minded person in general.

Ultimate Attribution Error: If Carly belonged to a conspicuous (e.g., minority) social group, the cause of failure may be attributed to the traits of that group. Carly is female, and one might believe that Carly fell because women are clumsy and careless by nature.

For technical precision, it is worth noting that causal attributions and blame are not identical concepts. In attribution theory, blame implies that the behavior was inappropriate, unjustifiable, or intentional (Shaver & Drown, 1986). Thus, blame is a special case of causal explanations, but a person-centered causal attribution of work place accidents need not involve blame: worker behavior can be seen as the cause of accidents even when the behavior itself is not attributed to impropriety or intentions of harm. The causes of these attribution tendencies are still heavily debated. They include: the proposal that some cultural and educational systems promote individual agency and a focus on the individual (i.e., Western individualism); the high salience of human action (e.g., the noticeable nature of a human falling); the low salience of situational conditions especially if those conditions are chronic or latent (e.g., the less observable daily stress, prior upstream managerial decisions, or a slippery floor’s coefficient of friction); the sheer cognitive difficulty of adjusting initial judgments or searching for multiple, interactive causes; and differences in experience with the action being attributed (e.g., supervisors with more experience with a subordinate’s job are less likely to attribute accidents to subordinates).

The cause of attribution tendencies is quite important (see further discussion in DeJoy, 1994). Still, causes aside, much evidence points to a general psychological tendency toward person-centered attributions. If this is the case, a safety professional might ask to what extent this tendency prevails in the specialized, professional world of contemporary safety management. In other words, is the person-centered approach an industry norm? Aviation safety expert Sydney Dekker (2002) addresses this question. He writes of The Bad Apple Theory of safety management, according to which one “identifies bad apples (unreliable human components) somewhere in an organization, and gets rid of them or somehow constrains their activities” (p.3). This theory belongs to the “old view” of human error, which states that:

• Human error is the cause of many accidents.

• The system in which people work is basically safe; success is intrinsic. The chief threat to safety comes from the inherent unreliability of people.

• Progress on safety can be made by protecting the system from unreliable humans through selection, proceduralization, automation, training and discipline.

Dekker, 2002, p.3

The new view, according to Dekker, first succeeded the old view around the time when human factors pioneers Fitts and Jones were asked to advise the US military on how to select less error-prone fighter pilots. They instead discovered that it was not the pilots but their planes’ design that needed changing in order to improve the compatibility between the plane and the pilot. This systems-centered view is credited with having saved many lives and dollars during World War II and the Korean War (Helander, 2006). According to the new view,

• Human error is a symptom of trouble deeper inside the system.

• Safety is not inherent in systems. The systems themselves are contradictions between multiple goals that people must pursue simultaneously. People have to create safety.

• Human error is systematically connected to features of peoples tools [sic], tasks and operating environment. Progress on safety comes from understanding and influencing these connections.

Dekker, 2002, p.3; see also Hollnagel & Woods, 2005

Dekker is critical of the notion that the old view is a thing of the past, left behind in a pre-WWII era. The title of his report, “The re-invention of human error,” refers to a modern-day resurgence of blame, a “retread of the old view” (p.14). Dekker argues that even in the 21^st century safety management approach, the focus is too much on human failure and too little on flawed systems, too much on judgments and too little on explanations, and even when the worker or operator is not blamed, her boss is. He alleges that overly simplistic error classification and other modern safety management methods reinforce the old view, albeit unintentionally. The industry norm is still to attribute causality and blame to the person (see also Woods & Cook, 1999).

An empirical test of Dekker’s critique

To test Dekker’s critique that modern safety management has not abandoned the person-centered approach, the US National Transportation Safety Board’s (NTSB) investigations of major aviation accidents (http://www.ntsb.gov/ntsb/major.asp) was examined. The NTSB is the government agency that organizes investigations of accidents, including all aviation accidents in the US. Based on analysis of accident sites, record reviews, interviews, and more, the NTSB produces a report, including the attribution of probable causes and contributing factors.

In Table 1, the concluded probable cause(s) for 27 major accidents investigated by the NTSB are listed verbatim. Clearly, even in the modern world of safety management and accident investigation, there is a tendency to assign causality to humans. In 26 of 27 cases (96%), people—usually a pilot or flight crew—are mentioned as a probable cause of the accident. In 21 of those 26 cases (81%), people are the sole cause reported. Even in the one case where the cause appears purely mechanical (#12), the inspector in charge of manufacturing quality assurance is implicated in the contributing factors. Drivers, ramp agents, maintenance personnel, airline decision makers, and regulators are people not on the flight crew implicated in the accident reports. The vocabulary used is also telling: “crew failure” or a similar term appears in 20 of 27 (74%) of probable causes; the remaining 7 cases contain language such as “inadequate planning, judgment, and airmanship,” “inexperience,” and “unnecessary and excessive…inputs.” Finally, it appears as if violations of known protocols were implicated as causes or contributing factors in 9 of 27 cases (33%).

Table 1.

Analysis of 27 major aviation accidents investigated by the US National Transportation Safety Board.^†

#	Date and place of accident	Probable cause(s) and contributing factors as determined by National Transportation Safety Board investigation
1	10/11/2006, Manhattan, NYC, NY	“pilots' inadequate planning, judgment, and airmanship”
2	08/27/2006, Lexington, KY	“the flight crewmembers's [sic] failure to use available cues and aids to identify the airplane's location... and their failure to cross-check and verify that the airplane was on the correct runway”
		Contributing factors: flight crew conversation, inadequate regulatory procedures
3	12/19/2005, Miami, FL	“failure and separation of the right wing during normal flight, which resulted from (1) the failure of the Chalk's Ocean Airways maintenance program to identify and properly repair fatigue cracks in the right wing and (2) the failure of the Federal Aviation Administration to detect and correct deficiencies in the company's maintenance program”
4	12/8/2005, Chicago, IL	“pilots' failure to use available reverse thrust in a timely manner... This failure occurred because the pilots' first experience and lack of familiarity with the airplane's autobrake system distracted them”
		Contributing factors: inappropriate pilot guidance and training, onboard computer performance, new procedure poorly implemented, lack of safety margin, pilot’s failure to divert landing to other airport
5	06/07/2005, Washington, DC	“inexperience of the driver (fleet service agent)”
6	02/16/2005, Pueblo, CO	“flight crew's failure to effectively monitor and maintain airspeed and comply with procedures”
		Contributing factors: inadequate certification requirements for flight in icy conditions
7	11/22/2004, Houston, TX	“flight crew's failure to adequately monitor and cross check the flight instruments”
		Contributing factors: flight crew failure to carry out procedures in a timely manner, and flight crew non-compliance with procedures
8	10/19/2004, Kirksville, MO	“pilots' failure to follow established procedures and properly conduct a nonprecision instrument approach at night... and their failure to adhere to the established division of duties”
		Contributing factors: pilot failure to make standard callouts, inappropriate regulations, pilots’ unprofessional behavior, fatigue
9	10/14/2004, Jefferson City, MO	“pilots unprofessional behavior, deviation from standard operating procedures, and poor airmanship ... pilots failure to prepare for an emergency landing in a timely manner ... pilots improper management of the double engine failure checklist”
		Contributing factors: engine conditions that prevented engine from restarting, inadequate airplane flight manuals
10	08/13/2004, Florence, KY	“fuel starvation resulting from the captain's decision not to follow approved fuel crossfeed procedures”
		Contributing factors: captain’s inadequate flight plan, pilot distraction, pilot delay in using checklist, flight crew failure to monitor fuel and diagnose fuel-related problems
11	03/23/2004, Gulf of Mexico	“flight crew's failure to identify and arrest the helicopter's descent for undetermined reasons”
12	01/08/2003, Charlotte, NC	“airplane's loss of pitch control during take-off ... [that] resulted from the incorrect rigging of the elevator system compounded by the airplane's aft center of gravity”
		Contributing factors: lack of oversight of maintenance work, inappropriate maintenance procedures and documentation, airline program for weight and balance, manufacturer failure to detect problem, inappropriate regulatory support and oversight of weight and balance
13	10/25/2002,Eveleth, MN	“flight crew's failure to maintain adequate airspeed”
14	11/12/2001, Belle Harbor, NY	“in-flight separation of the vertical stabilizer as a result of the loads beyond ultimate design that were created by the first officer's unnecessary and excessive rudder pedal inputs”
		Contributing factors: design of rudder system, inadequate training
15	10/10/2001, Dillingham, AK	“in-flight loss of control resulting from upper surface ice contamination that the pilot-in-command failed to detect during his preflight inspection”
		Contributing factors: lack of inspection requirements
16	08/05/2001, Washington, DC	“ramp agent's impaired performance due to his hyperthyroidism, which was exacerbated by the heat and was inadequately controlled by medication, and possibly also due to the use of an antianxiety medication”
17	03/29/2001, Aspen, CO	“flight crew's operation of the airplane below the minimum descent altitude without an appropriate visual reference for the runway.”
		Contributing factors: poor policy communication by regulators, visual and weather conditions, pressure on pilot to land
18	01/27/2001, Strasburg, CO	“pilots spatial disorientation resulting from his failure to maintain positive manual control of the airplane”
		Contributing factors: loss of electrical power due to weather
19 & 20	08/09/2000, Burlington Twp., NJ	“failure of the pilots of the two airplanes to see and avoid each other and maintain proper airspace separation”
21	05/21/2000, Bear Creek Town, PA	“flight crews failure to ensure an adequate fuel supply for the flight”
		Contributing factors: flight crew failure to monitor fuel, flight crew failure to maintain control after engine failure
22	02/16/2000, Rancho Cordova, CO	“loss of pitch control resulting from the disconnection of the right elevator control tab. The disconnection was caused by the failure to properly secure and inspect the attachment bolt”
23	01/31/2000, Port Hueneme, CA	“loss of airplane pitch control resulting from the in-flight failure of the horizontal stabilizer trim system jackscrew assembly's acme nut threads ... caused by excessive wear resulting from [airline’s] insufficient lubrication of the jackscrew assembly”
		Contributing factors: airline’s delay to lubricate mechanical components, regulators’ permission of delay, lack of fail-safe mechanism to prevent catastrophe
24	10/31/1999, Atlantic Ocean	“departure from normal cruise flight ... as a result of the relief first officer's flight control inputs”
25	10/25/1999, Aberdeen, SD	“Incapacitation of the flight crewmembers as a result of their failure to receive supplemental oxygen following a loss of cabin pressurization, for undetermined reasons”
26	09/25/1999, Volcano, HI	“pilot's decision to continue visual flight into instrument meteorological conditions (IMC) in an area of cloud-covered mountainous terrain”
		Contributing factors: pilot’s failed navigation, violation of standard operating procedures
27	06/01/1999, Little Rock, AK	“flight crew's failure to discontinue the approach [in inclement weather] ... and the crew's failure to ensure that the spoilers had extended after touchdown”
		Contributing factors: flight crew fatigue and stress, continued approach to landing despite high winds, inappropriate use of reverse thrust

^†This table excludes investigations of four September 11, 2001 terrorist events

^‡Separate reports were made for each of the two planes that collided with one another

Reviewing Table 1 begs the question of whether causality is accurately assigned to human actions and failures because human actions were truly involved in, or even necessary contributors to the accident. Of course it is accurate to state that human action was involved, perhaps necessary, for most of the accidents in Table 1. This is not unexpected, given that:

Since no system has ever built itself, since few systems operate by themselves, and since no systems maintain themselves, the search for a human in the path of failure is bound to succeed. If not found directly at the sharp end—as a 'human error' or unsafe act—it can usually be found a few steps back. The assumption that humans have failed therefore always vindicates itself. The search for a human-related cause is reinforced by past successes and by the fact that most accident analysis methods put human failure at the very top of the hierarchy, i.e., as among the first causes to be investigated.

Hollnagel & Woods, 2005, p.9

However, it is more important to ask whether isolating human action as the cause of an accident is (1) sufficient, given that causation is often multi-factorial, non-linear, and complex (Woods & Cook, 1999), and (2) meaningful for the designer or organizational decision maker interested in ensuring safety for the future. To isolate human action as the cause or to start with human action as cause and to not go deeper than that leads one to de-prioritize engineering solutions and over-prioritize behavioral control. Indeed, recommendations offered by the NTSB are often aimed at administrative controls such as policy writing, regulation, training, better enforcement of compliance, and reminders to pilots to be more attentive.

Is aviation a special case? Research in the domain of health care, where “blame culture” or “blame-and-shame” are commonly used to describe how medical accidents are viewed, suggests that it is not. James Reason writes that “the person approach remains the dominant tradition in medicine, as elsewhere” (2000, p.768). Renowned physician and patient safety leader Lucian Leape reflects further on his profession: “We strive to eliminate errors by requiring perfection, and respond to failure (error) by blaming individuals. Errors are assumed to be someone’s fault, caused by a lack of sufficient attention or, worse, lack of caring enough to do it right (Leape, 2008, p.4). Cause-finding in health care has traditionally relied on morbidity and mortality conferences, wherein clinicians meet briefly to discuss a recent accident. However, some note that “with the morbidity and mortality conference an adverse outcome is known and serves as the starting point as one works backwards to connect the dots and find the culprits—a technique conducive to meting out a fair measure of shame and blame” (Henriksen & Kaplan, 2003). The medicolegal environment and its tort process, at least in the US, reinforces the assignment—or, if possible, shifting—of blame to individuals (Studdert, Mello, & Brennan, 2004). Formal cause finding in the medical domain (e.g., morbidity and mortality conferences, root cause analysis) is, like elsewhere, subject to the effects of attribution errors, hindsight bias (Blank, Musch, & Pohl, 2007), outcome bias (Tostain & Lebreuilly, 2006), faulty reconstructive memory (Loftus, 2005), and other cause-finding errors that trace accidents back to human actions at the “sharp end” of medical care. Well-publicized examples in the medical domain abound:

• In 2003, a Duke University Medical Center physician was involved in two erroneous heart-and-lung transplants, in which the patient died. The public response was person-centered, often blaming, exemplified by editorials with titles such as “Physician, heal thyself” (Lavin, 2003); moreover, the physician himself admitted ultimate responsibility in a clear example of medicine’s institutionalized person-centered approach.

• In 2006, California doctors at a children’s hospital removed the wrong side of a patient’s skull during brain surgery. A California Department of Health Services report determined that the cause was “failing to follow proper procedures.” New procedures were mandated to prevent future errors. However, in a Rhode Island hospital that mandated those very procedures, three highly publicized wrong-site brain surgeries occurred in less than a year’s span. Researchers investigating the incidence of wrong-site surgery commented that existing protocols are not always effective or efficient, and that better protocols are the solution for preventing wrong-site errors (Kwaan, Studdert, Zinner, & Gawande, 2006).

• In 2006, a Wisconsin nurse was charged with a felony count of neglect, and was convicted of two misdemeanors on a plea bargain. In July the nurse administered the wrong medication to a woman in labor, killing the woman. The nurse also did not use the hospital procedure for verifying the accuracy of the medication using a computerized bar-coding system. “This was my mistake,” the remorseful nurse said, taking responsibility for the accident.

• In 2008, cases of patients dying during long waits in the emergency room made national news, enraging citizens. In June, a 49-year old woman died in New York, NY, after a 24-hour wait, and in September a 58-year old man died in Dallas, TX, after a 19-hour wait and a 45-year old man died in Winnipeg, Manitoba, Canada, after a 34-hour wait. Earlier, in September 2006, a Lake County, IL coroner’s jury ruled that a 49-year old woman’s death after a 2-hour wait was a case of homicide, defined as “either a willful and wanton act or recklessness on the part of someone, whether that's by their actions or by their inactions.” Comments by public officials and experts such as “the system broke down,” “the system’s broken,” and “obviously the system failed” at first glance appear to reflect a systems approach, but upon reflection, one wonders what the term “system” refers to, and whether perhaps the word is a substitute used when no one person can be identified. Blame and focus on failure, whether that of a Bad Apple or a Bad Apple Cart (i.e., system), may result in the same ineffective procedure-writing, training, or poster campaign solutions.

Outside of aviation and health care, the situation is no different. In 2005, an explosion at BP’s Texas City, TX refinery claimed 15 lives and much more injury and destruction. The company’s vice president of North American refining testified in 2007 that “Our people did not follow their start-up procedures… If they'd followed the start-up procedures, we wouldn't have had this accident” (Calkins & Fisk, 2007). When it was found that the explosion was “years in the making” and that equipment was substandard, the company official questioned managerial decisions to use it. Examples such as these are so familiar in the public eye that the satirical publication The Onion lampooned the person-centered tendency with the headline “Investigators Blame Stupidity In Area Death” (May 25, 2005).

A look at how expert investigators, managers, and the public respond to accidents lends support to Dekker’s (2002) argument that there remains a strong tendency to focus on human failure, human fallibility, and person-centered, internal causes of accidents. Evidence of psychological phenomena such as the fundamental attribution error suggests that this sort of tendency is much broader, possibly affecting society or humanity as a whole.

Few modern safety professionals are naïve to the importance of engineering solutions. They know that system problems require system-centered solutions (Goetsch, 2007). Practical guides to occupational safety espouse the view that engineering controls are the most effective and the most preferred (e.g., Chapter 12, Reese, 2008). And although it is true that worker actions are often discovered to contribute to accidents, safety professionals often search further for more distal and root causes as well. The problem is that even a knowledgeable and well meaning professional may succumb to some of the biases of human nature described above. Biases may have at least three specific effects.

First, the bias to view accidents as products of a linear chain of causation may lead investigators to identify human action as the sole proximal cause, then to investigate the causes of human action. This is acceptable, except when the accident did not have a single proximal cause but rather resulted from a combination of co-occurring chance and non-chance events. For example, the disaster at Chernobyl was characterized by the co-occurrence of reduced operating power and a disabled safety system and a lack of information on system state or feedback about the outcome of operator actions and that operators were unfamiliar with the unusual situation and the complex nature of the RBMK-1000 nuclear reactor (Vicente, 2006). All of the above did not occur in sequence, as would be expected by a linear chain of event approach. The complexity of the reactor (like the inherent danger of placing a 400-ton airplane in the air) was probably a major contributor, yet this cause cannot be located on a timeline. Linear models of causation are common in safety management and they produce different approaches to investigations than do complex non-linear models, as shown in a recent study by Lunberg et al (in press).

Second, the salience of human action, especially in retrospect, may obscure distal contributors to safety problems which may not appear to be as obvious. If so, limited resources will not be spent on investigating deeper and distal systemic causes remain undiscovered. That means that engineering solutions may not be attempted, even when their importance is recognized. Charles Perrow (1984, p.146) writes that “formal accident investigations usually start with an assumption that the operator must have failed, and if this attribution can be made, that is the end of serious inquiry.” Although Perrow is clearly over-generalizing, there is surely variation in how many and which links of the causal chain are investigated. What causes this variation? One determining factor may be related to the strength of the bias to attribute causality to human action. Another possible explanation is that investigators will focus on the type or level of cause that they can control (G.R. Gruetzmacher, personal communication, April 13, 2009). For example, NTSB investigators, who suggest policy changes, may investigate until policy flaws or violations are found, whereas a line supervisor’s investigation may stop at human or machine failure.

Third, even when some erroneous or risky human action has prominently contributed to an accident, it is a challenge to overcome the tendency to attribute that accident to some characteristic of the worker. “Social psychological studies have consistently found that people have a strong tendency to overestimate internal factors, such as one’s disposition, and underestimate the external factors driving people’s behavior” (Horhota & Blanchard-Fields, 2006, p.310) and the same bias affects people involved in safety management. Thus, it is not surprising that theories that accidents are caused by inherently accident prone or dysfunctional workers, popular in the first half of the 20^th century, persisted in the second half (e.g., Holcom, Lehman, & Simpson, 1993) and persist today (e.g., Gauchard et al., 2006).

Other behavior-based approaches to safety management, however, recognize that human behavior has multiple causes and that changing behavior requires changing the whole system not just the person in it (DeJoy, 2005; Geller, 2001; Glendon et al., 2006). However, some have suggested that a behavioral approach, even when it considers systemic causes of behavior, is problematic because the theory and practice of behavioral change is still it its infancy.

Historically, little scholarly attention has been paid to understanding determinants of injury-related behaviors or how to initiate and sustain behavioral changes … Many authors have noted the need to improve behavioral interventions by using better empirical data about determinants of behavior as well as theories and frameworks pertaining to change in health behavior…

Gielen & Sleet, 2003, p.65

Nevertheless, excellent expositions on behavior-based safety (BBS) theory (Geller, 2003; 2005) and recent reviews showing that BBS interventions are quite effective (Cooper, 2009) hold promise for future use of behavioral modification and other psychological approaches. Of course, advances in BBS should not lead one to forget that behavior is only one factor in an interrelated web of safety and accident causation and that engineering solution that do not rely on compliance are sometimes the most effective. To quote the clever Western Electric slogan for designing hand tools with bent handles in order to avoid hazardous bent-wrist postures, “It is better to bend metal than to twist arms” (Helander, 2006). This is something that safety professionals know but may have trouble applying due to persistent psychological tendencies.

Violations of safety protocol: The new face of human failure?

The person-centered approach is applied not only when individuals make unintentional errors, but also when individuals violate a rule or regulation, especially when they do so intentionally. Person-centered attributions of accidents by people who deviated from some prescribed standard is common in general, and in safety management in particular. Even Helander (2006), in arguing for a systems approach to errors, writes “the notion that the operator should be punished or personally made responsible is unwarranted, unless of course there is a clear violation of regulations” (p.340).

In safety management, there is growing interest in safety protocol violations (Phipps, Parker, Pals, Meakin, Nsoedo, & Beatty, 2008), defined as “deliberate departures from rules that describe the safe or approved method of performing a particular task or job” (Lawton, 1998, p.78). Violations of safety protocol have been found to contribute to disasters such as Chernobyl, the Challenger space shuttle, and the Zeebrugge ferry. Recent studies also show that violations are prevalent in health care work (Alper et al, 2006).

Violations—also, work-arounds, shortcuts, and non-compliant behaviors—are the new face of human failure. Many in industry and academics have shifted their focus from the clumsy to the risky, from the “error prone” worker to “violation prone” driver (Reason, Manstead, Stradling, Baxter, & Campbell, 1990). Thus person-centered solutions continue to be applied to a new person-centered cause, by writing more rules, increasing regulations, skills training, and raising workers’ awareness of rules. In both of the wrong-site brain surgery examples above, hospital and regulatory officials created new policies and training requirements within days. The key question is, will such solutions work? (They did not at the Rhode Island hospital!) To answer the question, one has to understand the reason that people violate protocol (Mason, 1997). Imagine a worker removes the machine guard on a cutting tool in order to speed up work, or removes a jam without stopping the production line. The worker stands accused of violating protocol. He is brought in for training on how to use machine guards, how to stop the line, and is repeatedly reminded to do so. But this will not be effective if the causes of violations are not rooted in individuals who are ill-meaning or ignorant of the rules (Lawton, 1998; Reason et al., 1990). Causes may instead be rooted in the social nature of violations and the necessity to violate in order to get the work done. Violations are social, “governed by operating procedures, codes of practice, rules, norms, and the like” (Reason et al., 1990, p.1316)—perhaps the norm at the factory is to put productivity first and safety second, and no injunctions to “be safe” will override the piece-rate incentive and promotion system. Perhaps the cultural or social norms are to “keep the line moving,” “cut corners,” or to show off your skills (Mason, 1997).

Some maintain that violations may even be necessary to get the work done or to get it done safely (Amalberti, Vincent, Auroy, & de Saint Maurice, 2006; Reason, Parker, & Lawton, 1998). Perhaps using the safety barrier does not work when machining large parts. Perhaps a jammed line cannot be stopped without the approval of a supervisor who is not on hand. Thus, violations are sometimes adaptive and not irrational. When seen through the lens of local rationality—that is, given what the worker knew at the time, what was her mindset, and what were her goals—most violations appear to be reasonable or at least understandable (Woods & Cook, 1999).

Violations are usually risky, but can result in either success or failure. Retrospectively, violations can be seen as foolish if they failed and adaptive if they succeeded. However, there is a tendency to investigate only cases when things went wrong. Thus, accident investigations put workers in a double-bind situation: if workers violated the protocol and things went wrong, workers are reprimanded for being “risk takers,” and if they did not violate and things went wrong, they are reprimanded for being “non-adaptive” (Dekker, 2003).

Using rule following as a litmus test for appropriate behavior is problematic. General rules do not apply to every situation and some rules are inappropriately written in the first place (Reason et al., 1998; Wilpert, 2008). Sometimes rules are built into a system ex ante rather than being enforced ex post. For example, computer software can force workers to use it in a pre-specified way. However, to the extent that the system is poorly designed, workers may feel the need to work around it (Koopman & Hoffman, 2003). Holden et al (2008) describe how hospital clinicians apply innovative strategies to deal with bad systems, including “playing games” with overly rigid computer software. The authors suggest that although work-around behavior is sometimes necessary, it can increase risk, and refer to Reason and colleagues’ (1998, p.291) example of the motorist speeding at 100 miles per hour (mph). The rule-violating motorist may (1) be unfamiliar with such high-speed driving, and (2) if she is, there is lower tolerance for error at such speeds. Holden and his colleagues suggest that familiarity and error tolerance are issues of design. That is, planning for deviant or work-around strategies and actually supporting those strategies through design (Karsh, Holden, Alper, & Or, 2006), may (1) allow workers to become familiar with non-routine modes of performance, and (2) reduce the risk of non-routine performance. They point out that certain systems are actually built in this way, and extend the 100mph motorist analogy:

By designing systems that support high-speed [driving], law enforcement officers can deal effectively with criminals … without a substantial risk increase. A siren is installed, training on high speed pursuits is provided, cars on the road move aside, police cars are purchased for high-speed performance, and a well-developed system of pursuit is created wherein officers join and exit the pursuit, at different times.³

Holden et al., 2008, p.5

Violations and related concepts are important topics in modern safety management, but one can approach them in one of two ways. One could treat violations as the behaviors of bad people, and proceed with person-centered solutions. Or one could treat violations as an indicator to better design those system properties that necessitate violations, and also design support systems that keep workers safe when they must go outside of protocol or work around a flawed system. Although many safety professionals advocate for the latter approach, the former person-centered approach appears to dominate in industry.

Implications for professional safety

Thus far this paper argued for the existence of a psychological (and, likely, sociological) tendency to think in certain ways about the cause of safety-related events. To put it simply: to blame is human. To put it more accurately: to attribute causation to individual actions and dispositions is a fundamental tendency in some cultures. The tendency also appears to be a professional norm transcending industries. Preoccupation with “bad apples” and human failure has seen a strong resurgence, particularly in the recent focus on the “bad apples” who violate safety protocols. It is not that humans are uninvolved in accidents, but that in reality they are not typically the sole or primary causal agents. Nor are behaviors that contribute to accidents caused solely by internal factors.

What are the implications of person-centered tendencies and norms? What recommendations can be made to deal with the implications? To answer those questions, the next section considers each of the “three E’s of safety”: engineering, education, and enforcement (Goetsch, 2007).

Engineering

Person-centered tendencies de-prioritize engineering solutions, and instead rely on education and enforcement. Purely technical engineering solutions that do not consider the role of the human may not make sense to the person-centered practitioner. However, many resources exist for improving systems as a whole, human and all. Numerous writings on human factors engineering are a good source of information on how to achieve fit between workers and the rest of the work system in order to improve safety and performance (Eastman Kodak Company, 2004; Helander, 2006; Salvendy, 2006; Sanders & McCormick, 1993). What will it take for industry decision makers to think of accident outcomes as the product of the interplay of multiple system components, human and non-human? Will a commitment to prioritize whole-system engineering solutions affect the tendency to attribute cause and blame to people? Can systems be successfully engineered to support expert workers who must deviate from pre-determined actions? These are questions that remain to be answered. A starting point may be to demonstrate to industry leaders the efficacy and cost-efficiency of whole-systems engineering solutions (Kerr, Knott, Moss, Clegg, & Horton, 2008; Stapleton, Hendricks, Hagan, & DelBeccaro, 2009).

Education

If one believes that the cause of accidents is rooted in the person, one naturally turns to education (e.g., training, poster campaigns) for solutions. These may be ineffective, as in the case of a worker who is pushed by production pressures or inflexible technology to take risks. Should education be abandoned as a solution to all safety problems, and used only when workers are truly uninformed? And what about educating future managers and safety professionals? If person-centered tendencies are fundamentally human, how can they be overcome through college courses or training seminars or articles such as these? Again, these are empirical questions to explore. Many safety educators teach about different approaches to safety, about the fundamental attribution error, and about the many reasonable causes of so-called unsafe behavior—does this help students withhold the urge to assign cause or blame to people when people are not to blame? Or is telling people to “think systems” as ineffective as telling them to “be safer”?

Enforcement

Legal investigations, disciplinary actions, and other attempts to keep people accountable for safety are also predicated upon person-centered causality, reminiscent of fellow servant and contributory negligence rules of the not-so-distant past. Worker non-compliance with safety regulations, as discussed above, may actually be caused by design problems to be dealt with through engineering solutions, not enforcement. Is enforcement effective? When is enforcement appropriate? Enforcement is often the result of accident investigations, which themselves appear to be biased toward person-centered findings. Dekker (2002) suggests transitioning from the use of narrower investigative methods such as root-cause analysis—which tends to reveal that “the human did it”—to something more holistic that permits discovery of a multi-causal network. What kind of resources will be necessary to make holistic investigations plausible? Can better safety solutions be developed from investigations that do not result in assigning cause or blame predominantly to humans? What is the plight of retrospective investigations relative to proactive risk/hazard analysis? What affects whether one adopts a linear or non-linear model of causation? What affects how or whether one investigates distal and root causes when investigating a linear chain of causation?

Whatever the answers to the above questions about new methods of education, enforcement, and investigation, the biggest challenge will be to continue to produce successful engineering solutions to safety. Those are solutions that both modify behavior by supporting workers’ performance and obviate the need for behavioral change when old behaviors are made safe in the new system (Holden et al., 2008; Karsh et al., 2006). A focus on human failure is counterproductive. Fitts and Jones did not reduce human failure or fallibility. Rather, they improved the displays and controls in aircraft cockpits, which supported quick information processing and action on the part of WWII pilots. Thusly supporting worker performance resulted in fewer accidents. Hence, good performance is the essence of safety, and good system design the essence of good performance. So, too, will good design that leads to good performance be cost-efficient (Helander, 2006; Stapleton et al., 2009), which is yet another reason to promote engineering solutions. Without systems solutions being available, it is all too easy to give in to our human-centered cause and blame tendencies. But with adequate alternatives, we may accept that to blame is human, but the fix is to engineer.