Heinrich is among the founders of the modern safety profession, and while decades of additional experience and science have shown us that part of his work is flawed, still a great deal can be learned from his heritage. Also, he has left us at least two strong safety metaphors: the dominos and the pyramid/iceberg. Alas, there is also a great deal of misunderstanding and confusion around his work.
The iceberg/triangle/pyramid may be the one thing that is most frequently gotten wrong. Way too much time is spent in discussing ratios. This is useless because Heinrich himself already said these would vary from case to case. Discussions like these take away the attention from the essence of the iceberg, which is all about learning from weak signals.
A central element in the pyramid metaphor is the so-called Common Cause Hypothesis (CCH), a term that Heinrich himself never used and probably didn’t fully understand himself because he changed and omitted some parts after the first (1931) edition of his seminal book “Industrial Accident Prevention”. In the 1980 update of the book, Petersen and Roos even have included a section where they entirely dismiss the concept. A rather misguided move, in my opinion, because the authors confuse severity and frequency ratios (or the causes for these ratios) with causal mechanisms of the incidents. An excellent and scientific discussion of this (along with scientific proof for the CCH) can be found in Linda Wright’s 2002 PhD thesis. A summary of this thesis can be found in this Journal of Hazardous Materials article.
The thought behind the CCH is that certain incidents (regardless the severity of their outcome) share causal paths. Acting upon (or even removing) the causes of incidents with little or no consequence will help to prevent more severe incidents and accidents from happening. The benefit of applying the CCH is thus that one doesn’t have to wait with safety measures until an accident with a major consequence happens, but rather focus on incidents with a similar causal pathway without the consequence. These ‘minor’ incidents do occur more frequently than the ‘major’ ones and thus one is offered many chances for improvement for a rather low ‘price’ (loss).
One can even go one step further than just looking at ‘minor’ incidents, but also at precursor incidents or even at pro-active/positive precursors that are found in the causal pathways. After all, a neglected, or less than adequate pro-active precursor (e.g. training of personnel, or maintenance) may become a part of the causal chain in the long run.
In the second (1941) edition of his book Heinrich presents the pyramid in the section “Foundation of a major injury” and states that “…for every mishap resulting in an injury there are many other similar accidents that cause no injuries whatever…” (p.26). A keyword that is essential in understanding the CCH and applying the pyramid correctly is ‘similar’. Oddly it appears that this is only found in the 1941 edition.
So, the thing that is crucial when trying to use Heinrich’s pyramid concept is to make sure that one does not blend unrelated types of incidents, which is exactly the thing that all too often happens. Traditionally incidents are piled all together sorted by consequence. Then the illusion is applied that actions on incidents with minor consequences will ‘automatically’ reduce the number of major incidents - a logically flawed concept if one forgets the CCH-concept!
To illustrate this point more bluntly: reacting upon frequent occupational trip, slip and fall hazards will usually not contribute to prevent a refinery from exploding, simply because the causal paths are entirely different. The non-similarity of the incidents (fall versus explosion) should already be a major clue, without studying causal paths all that close.
Another reason for the traditional sorting on consequence being a meaningless practice is that consequences occur rather randomly and do not, in general, reflect any relation in causation.
So, what we basically have to do is break up our iceberg into several icebergs, sorted according to causal chains. Of course one has to remain practical, but any company will be able to, without much problem, define a number of hazards/risks/types of incidents that can be grouped due to similarity and causal connection. Examples include handling chemicals, working at height, lifting or traffic accidents.
I’ve tried to illustrate one such pyramid for my main working area, transport safety. Below is a simplified causal tree for the unwanted event of a train derailing.
The tip of the iceberg would be major accidents due to a derailment (the ones you read about in the newspaper) and bubbling around the surface are the other actual derailments with only minor consequences. Derailments can occur due to a large number of direct causes, which include misalignments of the rails, broken rails, objects on the tracks, excessive speed or rolling stock failure. In the iceberg I’ve shown, there are only a few of these direct precursors. From these one can follow the causal path upstream. Broken rails are (for example) caused by a number of varying detectable faults (e.g. hair cracks) due to wear, fatigue or unstable ballast. Misalignments may for example be caused by washouts due to severe weather, insufficient drainage etc.
While Heinrich drew his iceberg with just incidents in mind, I’ve chosen to go one step further and include relevant ‘positive’ precursors at the bottom of the causal chain (in green, to separate them from the negative precursor events).
Having established an iceberg like this, it becomes possible to start managing (or even steering) safety by using both lagging indicators (found in the upper part of the iceberg - the actual accidents and their precursor incidents) and leading indicators (found in the nether regions of the iceberg, e.g. timely and adequate follow-up on detected faults, inspections done, adequate design, etc.).
This application also makes clear that safety cannot be managed by just the traditional approach of looking at accidents and incidents, but has to be integrated with among others design, construction and maintenance.
Let me try to apply this now to a more occupational safety example, for example falls from height (again with a simplified causal tree - suggestions for improvement welcome!).
The tip of the iceberg again consists of the actual falls, which may range by consequence (I’ve chosen not to). These are, for example, caused by not wearing safety gear for a number of reasons. Again it’s possible to find positive precursors, including a workplace culture where using safety gear is “the way we do things around here”, adequate training of personnel, procurement of adequate and fitting gear and the existence of an observation and feedback scheme. Again it’s possible to use these positive precursors as leading indicators for safety (and, by the way, often a better one than counting the number of LTIs due to falls).
For example, the number of workplace observations (e.g. ratio of observed desired actions and number of observations) as well as the adequacy/timeliness of actions after observations may give some indication of working at height safely.
Again: it’s important to keep a clear eye on the causal paths. The best forms of maintenance (the most right branch of the causal tree) won’t help if one doesn’t use the safety gear (the left branch)… Application of simple logic and regular critical checks should keep you on the right path!
Recently the U.S. Chemical Safety Board has commented (again) that refiners rely too much on data from personal workplace injuries and not enough on other information that might warn of dangers before catastrophic events occur. Proper and logical application of the (enhanced) iceberg principle with the Common Cause Hypothesis as the guideline as illustrated above is a good tool for addressing this issue and improving safety and quality in your company.
