Sie sind auf Seite 1von 95

NEBOSH International Diploma in Occupational Health and Safety Please be advised that the course material is regularly reviewed and updated on the eLearning platform. SHEilds would like to inform students downloading these printable notes and using these from which to study that we cannot ensure the accuracy subsequent to the date of printing. It is therefore important to access the eLearning environment regularly to ensure we can track your progress and to ensure you have the most up to date materials. Version 1.2c (05/11/2012)

to ensure we can track your progress and to ensure you have the most up to
Element IA4: Identifying Hazards, Assessing & Evaluating Risks. Learning outcomes On completion of this element,
Element IA4: Identifying Hazards, Assessing & Evaluating Risks.
Learning outcomes
On completion of this element, candidates should be able to:
1. Describe how to use external and internal sources of information in the identifica-
tion of hazards and the assessment of risk.
2. Outline a range of hazard identification techniques.
3. Explain how to assess and evaluate risk and to implement a risk assessment pro-
4. Explain the principles and techniques of failing tracing methodologies with the use
of calculations.
Relevant Standards
 International Labour Standards, Prevention of Major Industrial Accidents Conven-
tion, C174, International Labour Organisation, Geneva, 1993
 International Labour Office, Prevention of Major Industrial Accidents, an ILO Code
of Practice, ILO, Geneva, 1991. ISBN 922107101
 Reducing risks, protecting people (R2P2). HSE books.
Minimum hours of tuition 12 hours.
1.0 External Sources of Information in the Identification of Hazards & the
Assessment of Risk
The use of external information sources will always be a necessary and vital part of the
health and safety profession. However, due to the vast amount of sources it would be un-
wise for all these sources of information to be detailed in this course.
Seven relevant and topical sources of external information however will be used to high-
light the diversity available. It should be noted though this list is not exhaustive and you are
fully encouraged to research other types of external sources that may be available.
Information Source
The Health and Safety
Commission and Health
and Safety Executive
Occupational Safety and
Health Administration
European Agency for
Safety and Health at Work
The World Health
The International Labour
The Institution of
Occupational Safety and
The International Institute of
Risk and Safety
Management The following text gives a little more detail on the work that these organisations
The following text gives a little more detail on the work that these organisations do and the
type of information you can in return expect to get from them.

1.1 The Health and Safety Executive

Until 1st April, 2008, there were two bodies responsible between them for the administra- tion
Until 1st April, 2008, there were two bodies responsible between them for the administra-
tion and enforcement of Health and Safety in Britain. They were the Health and Safety
Commission and the Health and Safety Executive.
The Health and Safety Commission was created by the Health and Safety at Work Act
1974. It consisted of a chairman and between six and nine other people, appointed by the
appropriate Secretary of State.
Its duties included assistance and encouragement to those concerned with matters rele-
vant to the operation of the HSWA, encouraging research, publication, training and infor-
mation in relation to its work and informing government departments, employers, employ-
ees and interested organisations on matters relating to health and safety. It also had the
duty to propose regulations where these were felt to be necessary.
In August 2007, the Department for Work and Pensions began a consultative process on
the merger of the HSC and HSE. This consultation received a broadly positive response
and on 18th March 2008, Lord McKenzie of Luton, the minister responsible announced
that the merger would be completed during the spring. It officially took place on 1st April.
The Health and Safety Executive (HSE) in both its original and revised form is the body
responsible for the regulation and enforcement of workplace health, safety and welfare and
for research into these matters. Since its inception, it has absorbed other bodies such as
the Factory Inspectorate and the Railway Inspectorate (although the latter was transferred
to the Office of Rail Regulation in 2006. It also regulates the nuclear industry through its
Nuclear Directorate.

Local authorities are responsible to the HSE for enforcement in shops, offices and other parts of the service sector.

Part of the HSE's work is the investigation of industrial accidents, including major incidents such as the Buncefield explosion of December 2005. Before the merger, it reported to the HSC, although in practice, a large amount of the commission's work was devolved to the executive. As such, its duties mirror those of the now-defunct commission.

The HSE also has two agencies under its control, the Explosives Inspectorate and the Health and Safety Laboratory at Buxton in Derbyshire.

In the thirty or so years since the creation of the HSE, there has been massive economic,

social and technological change. In some ways, the workforce of today is unrecognisable from that of 1974. Yet the fundamental aspirations laid down then remain equally valid to- day.

The HSC, in its report for 1977/8 stated "Our overriding concern is to stimulate awareness of the risks and encourage the joint participation of workers and management in efforts to eliminate them." In 2004, the Commission stated "the mission for the HSC and HSE is to work with local authorities to protect people's health and safety by ensuring that risks in the changing workplace are properly controlled."

As can be seen, the style may be different and the message broader but the
As can be seen, the style may be different and the message broader but the core objective
is essentially the same.
While the rapidly-changing economic and political environment has thrown up new chal-
lenges in the form of new responsibilities and new demands, the central task remains to
minimise the risk of harm and create a society where risk is properly appreciated, under-
stood and managed.
1974-2004: Changing demands - changing responsibilities
Since 1974, Britain's industrial structure has changed beyond all recognition. Three million
jobs in manufacturing have disappeared, while the service sector has grown from employ-
ing less than two-thirds of workers to over three-quarters.
At the same time, the number of small firms has grown dramatically: at the beginning of
2003, there were 4 million enterprises in the UK, of which over 99% were classified as
small (having fewer than 50 employees) and just 0.2% had over 250 employees. Overall,
small and medium sized enterprises (SMEs) now employ nearly 60% of the workforce and
71% of enterprises have no employees.
There have also been other more subtle changes in the composition of the labour force.
Part-time workers now constitute a quarter of the workforce, compared to a sixth in the
mid-1970s; half of all employees are now women (compared to less than two-fifths); and
trade union membership has fallen from over 50% of the working population in 1979 to
less than 30% in 2003.
In addition, there has been a shift to new patterns and modes of working demanded by
modern economies. This has seen a massive rise in temporary, agency and contract work-
ing, together with an inflow of migrant workers both from within and outside the EU.
1.2 Changing Responsibilities
HSE's current responsibilities are spread across almost all risks arising from workplace
activity, ranging from nuclear and offshore installations through to schools, farms and fac-
tories. In the early 1970s, the picture was very different, with large numbers of British
workers falling outside the protection offered by sector-specific regulations.
An immediate effect of the HSW Act was to extend protection to a further 8 million workers
– including employees working in local government, hospitals, education and other ser-
It also imposed duties on self-employed people and on the designers, manufacturers and
suppliers of equipment and materials. Those 'affected by work activities' were brought un-
der the legislative umbrella for the first time. In the mid-1970s, this latter provision pro-

voked widespread astonishment.

Over the following decades, responsibilities expanded in several directions as HSC was asked to tackle new issues and perform new regulatory duties. Sometimes this was a direct consequence of a major incident that sparked a review of safety regulation in a particular industry. The Piper Alpha oil installation explosion, the Clapham train crash and the Kings Cross fire were followed by transfers of areas previ- ously regulated by the Departments of Energy and Transport.

In other cases, it was a response to changes in the workplace, the emergence of new risks, technological developments, and society's shifting demands.

Notices and prosecutions In their enforcement role, inspectors have daily face-to-face contact with duty holders.
Notices and prosecutions
In their enforcement role, inspectors have daily face-to-face contact with duty holders. This
puts them in a unique position to improve workplace controls, and provide information and
However, the Robens Report also recognised that pressing problems had to be dealt with
swiftly and that, in some cases, inspectors needed a quick, effective tool with which to ex-
ert pressure. With this in mind, the HSW Act introduced the concept of preventative en-
forcement notices.
Unlike legal proceedings, these are designed to remove the hazard before it can cause
harm, rather than punish for non-compliance. In 1976, HSE stated: 'The Executive is quite
clear from its experience that the power to issue notices has enabled it to deal effectively
with many situations where previously no satisfactory procedure existed for protecting
works people and others.'
That year it issued 7,334 notices and instituted 1,200 prosecutions. By 2002/03, the num-
ber of notices issued had risen to 13,263, while prosecutions were taken for 1,688 sepa-
rate alleged offences.
1.3 Sensible Health and Safety
In this climate, and building on the philosophy enshrined in the Health and Safety at Work
Act 1974, HSE continues to believe that sensible health and safety is about managing
risks, not necessarily eliminating them.
Recognising this, it has re-emphasised its commitment to making sound judgements
based on balancing harm against cost and risk against benefit, and adhering to the con-
cept of reasonable practicability.
Its current long-term aims include:
 further tackling the causes of occupational ill-health and encouraging rehabilitation;
 focusing on the right interventions where HSE has the skills, expertise and evi-
dence to reduce injury and ill-health;
 continuing to prevent incidents from industries which have potential to cause sig-
nificant harm, including to members of the public, such as chemical, offshore, nu-
clear and railways industries - HSE is currently reviewing its safety case regimes to
ensure that they remain relevant and proportionate;
 building new ways of working in partnership with local authorities and other stake-

influencing organisations to embrace high standards of health and safety as an in- tegral part of a modern society and as a contribution to social justice and inclusion;

anticipating and identifying future workplace, demographic and economic changes;

meeting the ongoing Revitalising and Securing health targets;

developing a broader leadership, facilitative and developmental role in the overall health and safety system - examining what needs to be done to make high stan- dards of health and safety a reality for every worker and for society as a whole.

1.4 Occupational Safety and Health Administration (OSHA) The Occupational Safety and Health Administration aims to
1.4 Occupational Safety and Health Administration (OSHA)
The Occupational Safety and Health Administration aims to ensure employee safety and
health in the United States by working with employers and employees to create better
working environments. Since its inception in 1971, OSHA has helped to cut workplace fa-
talities by more than 60 percent and occupational injury and illness rates by 40 percent. At
the same time, U.S. employment has increased from 56 million employees at 3.5 million
worksites to more than 135 million employees at 8.9 million sites.
In 2007, OSHA has 2,150 employees, including 1,100 inspectors. The agency's appropria-
tion is $486.9 million.
Under the current administration, OSHA is focusing on three strategies: 1) strong, fair and
effective enforcement; 2) outreach, education and compliance assistance; and 3) partner-
ships and cooperative programs.
Strong, Fair, and Effective Enforcement
A strong, fair and effective enforcement programme establishes the foundation for OSHA's
efforts to protect the safety and health of the nation's workers. OSHA seeks to assist the
majority of employers who want to do the right thing while focusing its enforcement re-
sources on sites in more hazardous industries -- especially those with high injury and ill-
ness rates. Less than 1 percent of inspections -- about 467 (2006) -- came under the
agency's Enhanced Enforcement Programme, designed to address employers who re-
peatedly and willfully violate the law. At the same time, injuries and illnesses continue to

Outreach, Education, and Compliance Assistance

Outreach, education and compliance assistance enable OSHA to play a vital role in pre- venting on-the-job injuries and illnesses. OSHA offers an extensive website at that includes a special section devoted to small businesses as well as in- teractive eTools to help employers and employees address specific hazards and prevent injuries. In 2006, 80 million visitors logged onto OSHA's website.

The agency provides a variety of publications in print and online. In addition, workplace safety and health information or assistance for employees is available during business

hours through OSHA's call centre. The hotline remains open 24 hours a day for fatality and accident reporting during non-business hours.

OSHA strives to reach all employers and employees, including those who do not speak English as a first language. The agency maintains a Spanish Web page, and Spanish- speaking operators can be reached at the OSHA national call centre during business hours. Various publications, training materials and videos are available in Spanish, and OSHA continues to issue new publications. Many regional and area offices also offer in- formation in other languages such as Japanese, Korean and Polish.

Free workplace consultations are available in every state to small businesses that want on- site help establishing safety and health programmes and identifying and correcting work- place hazards. In addition, OSHA has a network of more than 70 Compliance Assistance Specialists in local offices available to provide employers and employees with tailored in- formation and training.

Cooperative Programmes OSHA's Alliance Programme enables employers, labour unions, trade or professional groups,
Cooperative Programmes
OSHA's Alliance Programme enables employers, labour unions, trade or professional
groups, government agencies, and educational institutions that share an interest in work-
place safety and health to collaborate with OSHA to prevent injuries and illnesses in the
workplace. A signed formal agreement between OSHA and the organisation provides
goals addressing training and education, outreach and communication and promoting the
national dialogue on workplace safety and health.
In the Strategic Partnership Programme, OSHA enters into long-term cooperative relation-
ships with groups of employers, employees, employee representatives and, at times, other
stakeholders to improve workplace safety and health. These partnerships focus on safety
and health programmes and include enforcement and outreach and training components.
Written agreements outline efforts to eliminate serious hazards and provide ways to meas-
ure the effectiveness of a safety and health programme.
The Safety and Health Achievement Recognition Programme is designed to provide incen-
tives and support to employers to develop, implement and continuously improve effective
safety and health programmes at their worksite(s). SHARP provides recognition for em-
ployers who demonstrate exemplary achievements in workplace safety and health.
The Voluntary Protection Programmes (VPP), OSHA's premier partnership, continues to
pay big dividends by recognising safety and health excellence. Today VPP worksites save
millions each year because their injury and illness rates are more than 50 percent below
the averages for their industries.
1.5 The European Agency for Safety and Health at Work
Introduction to the European Agency for Safety and Health at Work

Health and safety at work is one of the EU's most important social policy areas. It is also one of the most challenging. Every five seconds an EU worker is involved in a work-related accident, and every two hours one worker dies in an accident at work. Addressing the diversity of occupational safety and health (OSH) issues and the need for increased awareness at workplace level are beyond the resources and expertise of a sin- gle Member State. That is why in 1996 the European Agency for Safety and Health at Work was set up to collect, analyse and promote OSH-related information.

The Agency's mission is to make Europe's workplaces safer, healthier and more produc- tive, and in particular to promote an effective prevention culture.

The Agency, located in Bilbao, Spain, has a dedicated staff of specialists in OSH, commu-
The Agency, located in Bilbao, Spain, has a dedicated staff of specialists in OSH, commu-
nication and public administration. At the national level, a network of 'focal points', typically
the lead OSH organisations in their respective countries, represents the Agency. The focal
points work through tripartite networks made up of representatives of government, em-
ployers and workers. This tripartite structure is also reflected in the composition of the
Agency's Governing Board and network structures.
The Agency is managed by a Director and has a Governing Board which is made up of
representatives of government, employers and workers from the 27 Member States and
representatives of the European Commission. The Governing Board establishes a Bureau.
1.6 The World Health Organisation
The World Health Organisation
The World Health Organisation is the United Nations specialised agency for health. It was
established on 7 April 1948. WHO's objective, as set out in its Constitution, is the attain-
ment by all peoples of the highest possible level of health. Health is defined in WHO's
Constitution as a state of complete physical, mental and social well-being and not merely
the absence of disease or infirmity.
WHO is governed by 192 Member States through the World Health Assembly. The Health
Assembly is composed of representatives from WHO's Member States. The main tasks of
the World Health Assembly are to approve the WHO programme and the budget for the
following biennium and to decide major policy questions.
The World Health Assembly is the supreme decision-making body for WHO. It generally
meets in Geneva in May each year, and is attended by delegations from all 192 Member
States.Its main function is to determine the policies of the Organisation.
The Health Assembly appoints the Director-General, supervises the financial policies of
the Organisation, and reviews and approves the Proposed programme budget.
It similarly considers reports of the Executive Board, which it instructs in regard to matters
upon which further action, study, investigation or report may be required.
The Executive Board is composed of 32 members technically qualified in the field of
health. Members are elected for three-year terms. The main Board meeting, at which the
agenda for the forthcoming Health Assembly is agreed upon and resolutions for forwarding
to the Health Assembly are adopted, is held in January, with a second shorter meeting in

May, immediately after the Health Assembly, for more administrative matters.

The main functions of the Board are to give effect to the decisions and policies of the Health Assembly, to advise it and generally to facilitate its work. The Secretariat of WHO is staffed by some 3,500 health and other experts and support staff on fixed-term appointments, working at headquarters, in the six regional offices, and in countries.

Awards When it came into being in 1948, the World Health Organisation took over the public health functions of the Health Organisation of the League of Nations and also the administration of two awards: the Darling Foundation Prize and the Léon Bernard Foundation Prize. Since then, other foundations have been established within the framework of WHO and are administered by the Organisation. These foundations have generally been founded by, or set up in memory of, eminent health personalities. The prizes are awarded, in general, to individuals or institutions for outstanding achievements in general health development; the fellowships are intended to further research in specific areas of medicine.

Over the years, the awards have been presented to well-known scientists, researchers or simply dedicated
Over the years, the awards have been presented to well-known scientists, researchers or
simply dedicated people who have greatly contributed with their work to the advancement
of public health, and to institutions caring for the health of local communities.
1.7 Nomination & Application
The Director-General is currently the administrator of several foundation prizes and fellow-
ships, and regularly invites nominations of candidates, in accordance with the provisions
laid down in the relevant statutes.
Depending on the regulations governing each prize or fellowship, nominations may be
submitted to either the Director-General or the Regional Directors of WHO, through na-
tional health administrations, former prize recipients, WHO regional committees, research
institutions or international organisations and associations.
Nominations are considered by the Foundation Committees or Selection Panels which de-
cide on the recommendation to be made to the Executive Board, or the Regional Commit-
tee concerned, which designate the recipients of the awards.
1.8 The International Labour Organisation


The International Labour Organisation is the UN specialised agency which seeks the pro- motion of social justice and internationally recognised human and labour rights. It was founded in 1919 and is the only surviving major creation of the Treaty of Versailles which brought the League of Nations into being and it became the first specialised agency of the UN in 1946.

The ILO formulates international labour standards in the form of Conventions and Recom- mendations setting minimum standards of basic labour rights:

freedom of association, the right to organise, collective bargaining, abolition of forced labour, equality of opportunity and treatment, and other standards regulating conditions across the entire spectrum of work-related issues. It provides technical assistance primarily in the fields of vocational training and vocational rehabilitation; employment policy; labour administration; labour law and industrial relations; working conditions; management development; co-operatives; social security; labour statistics and occupational safety and health.

It promotes the development of independent employers' and workers' organisations and provides training and advisory services to those organisations. Within the UN system, the ILO has a unique tripartite structure with workers and employers participating as equal partners with governments in the work of its governing organs. The need for such an organisation had been advocated in the nineteenth century by two industrialists, Robert Owen (1771-1853) of Wales and Daniel Legrand (1783-1859) of France.

After having been put to the test within the International Association for Labour Legislation, founded in Basel in 1901, their ideas were incorporated into the Constitution of the Interna- tional Labour Organisation, adopted by the Peace Conference in April of 1919. The initial motivation was humanitarian. The condition of workers, more and more numer- ous and exploited with no consideration for their health, their family lives and their ad-

workers, more and more numer- ous and exploited with no consideration for their health, their family

vancement, was less and less acceptable. This preoccupation appears clearly in the Pre- amble of the Constitution of the ILO, where it is stated, "conditions of labour exist involving injustice, hardship and privation to large numbers of people."

The second motivation was political. Without an improvement in their condition, the work- ers, whose numbers were increasing as a result of industrialisation, would create social unrest, even revolution. The Preamble notes that injustice produces "unrest so great that the peace and harmony of the world are imperilled." The third motivation was economic. Because of its inevitable effect on the cost of produc- tion, any industry or country adopting social reform would find itself at a disadvantage vis- à-vis its competitors. The Preamble states that "the failure of any nation to adopt humane conditions of labour is an obstacle in the way of other nations which desire to improve the conditions in their own countries." Another reason for the creation of the International Labour Organisation was added by the participants of the Peace Conference, linked to the end of the war to which workers had contributed significantly both on the battlefield and in industry. This idea appears at the very beginning of the Constitution: "universal and lasting peace can be established only if it is based upon social justice." The ILO accomplishes its work through three main bodies, all of which encompass the unique feature of the Organisation: its tripartite structure (government, employers and workers).

1. International Labour Conference: The member States of the ILO meet at the Interna-

tional Labour Conference in June of each year, in Geneva. Each member State is repre- sented by two government delegates, an employer delegate and a worker delegate. They are accompanied by technical advisors. It is generally the Cabinet Ministers responsible for labour affairs in their own countries who head the delegations, take the floor and present their governments' points of view. Employer and worker delegates can express themselves and vote according to instruc- tions received from their organisations. They sometimes vote against each other or even against their government representatives.

The Conference plays a very important role. It establishes and adopts international labour standards. It acts as a forum where social and labour questions of importance to the entire world are discussed. The Conference also adopts the budget of the Organisation and elects the Governing Body.

2. The Governing Body is the executive council of the ILO and meets three times a year in

Geneva. It takes decisions on ILO's policy. It establishes the programme and the budget which it then submits to the Conference for adoption. It also elects the Director-General.

It is composed of 28 government members, 14 employer members and 14 worker mem- bers. Ten of the government seats are permanently held by States of chief industrial im- portance. Representatives of other member countries are elected at the Conference every three years, taking into account geographical distribution. The employers and workers elect their own representatives respectively.

3. The International Labour Office is the permanent secretariat of the International Labour

Organisation and focal point for the overall activities that it prepares under the scrutiny of

the Governing Body and under the leadership of a Director-General, who is elected for a five-year renewable term.

The Office employs some 1,900 officials of over 110 nationalities at the Geneva headquar- ters and in 40 field offices around the world. In addition, some 600 experts undertake mis- sions in all regions of the world under the programme of technical co-operation. The Office also constitutes a research and documentation centre and a printing house is-

of technical co-operation. The Office also constitutes a research and documentation centre and a printing house

suing a broad range of specialised studies, reports and periodicals.

The ILO Convention and the ILO Code of Practice that are relevant to this element on identifying hazards, assessing and evaluating risk are:

ILO Labour Standards, Prevention of Major Industrial Accents Convention C174 ILO Prevention of Major Industrial Accidents ILO Code of Practice

Question 1. Under the current administration, which organisation is following on the three strategies: 1)
Question 1.
Under the current administration, which organisation is following on the three strategies: 1)
strong, fair and effective enforcement; 2) outreach, education and compliance assistance;
and 3) partnerships and cooperative programs?
Multiple Choice
Answer 1:
Response 1:
Jump 1:
This page
Answer 2:
Response 2:
Jump 2:
Next page
Answer 3:
Response 3:
Jump 3:
This page
1.9 International Labour Office, Prevention of Major Industrial Accidents, an ILO
Code of Practice, ILO, Geneva, 1991
International Labour Office, Prevention of Major Industrial Accidents, an ILO Code of
Practice, ILO, Geneva, 1991
The Code of Practice is available as a pdf download:
The potential for major accidents identified a need for a clearly defined and structured
approach to the control of hazardous substances. Following decisions taken by the
governing body of the ILO at its 244th session on November 1989, a meeting of seven
experts drew up a code of practice on the prevention of major hazards. The Code of
practice is titled Prevention of major industrial accidents and is intended for the use of
those who have responsibility for the prevention of major industrial accidents, drawn up to provide
those who have responsibility for the prevention of major industrial accidents, drawn up to
provide guidance. Also offer guidelines to employers’ and workers’ organisations. The
prevention of Major industrial accidents is the outcome of a PIACT project.
What is PIACT ?
PIACT is an acronym for progamme developed by the International Labor Organization for
improvement of occupational health and safety. The acronym is derived from its French
name Programme international pour l'amélioration des conditions et du milieu de travail
(PIACT), but it is also widely known under its English name Programme for the Improve-
ment of Working Conditions and Environment.The programme was launched by the Inter-
national Labour Organisation in 1976 at the request of the International Labour Confer-
ence. PIACT is designed to promote or support actions aiming at "making work more hu-
man". The programme is concerned with improving the quality of working life in a broad
interpretation. This includes prevention of occupational accidents and diseases, wide ap-
plication of principles of ergonomics, enhancement of organization of work and "a greater
concern for human element in the transfer of technology. To achieve these aims, PIACT
makes use of and co-ordinates the traditional means of ILO action, including:
the preparation and revision of international labour standards;
operational activities, including the dispatch of multidisciplinary teams to assist member
States on request;
tripartite meetings between representatives of governments, employers and workers, in-
cluding industrial
committees to study the problems facing major industries, regional meetings and meetings
of experts;
– action-oriented studies and research; and
– clearing-house activities, especially through the International Occupational Safety and
Health Information Centre (CIS) and the Clearing- house for the Dissemination of Informa-
tion on Conditions of Work.
What is tripartite?
The ILO is based on the principle of tripartism - dialogue and cooperation between
governments, employers, and workers - in the formulation of standards and policies
dealing with labour matters
1.10 Overview of The Prevention of Major Industrial Accidents an ILO Code of
Overview of The Prevention of Major Industrial Accidents an ILO Code of Practice
Chapter 1 General Provisions
Chapter 2 Components of a major hazard control system
Chapter 3 General Duties
Chapter 4 Prerequisites for a major hazard control system
Chapter 5 Analysis of hazards and risks
Chapter 6 Control of the causes of major industrial accidents
Chapter 1 General Provisions
1.1 Objective
1.1.1. The objective of this code of practice is to provide guidance in the setting up of an
administrative, legal and technical system for the control of major hazard installations.
It seeks to protect workers, the public and the environment by
(a) preventing major accidents from occurring
(b) Minimising the consequences of a major accident on site and off site by

(i) arranging appropriate separation of major hazard installations and populations

(ii) appropriate emergency planning

Chapter 2 Components of a major hazard control system

Competent authorities should make arrangements for both existing and proposed new ma- jor hazard installations to be clearly defined and identified by a list of hazardous sub- stances or categories of substances and associated threshold quantities, which should in- clude;


very toxic chemicals toxic chemicals flammable gases and liquids explosive substances

Safe operation of major hazard installations The primary responsibility for operating and maintaining the installation safely should lie with works management.

Emergency planning

Emergency planning should be regarded by works management and the competent au- thorities as an essential feature of a major hazard control system.The objectives of emer- gency planning should be:


to localise any emergencies that may arise and if possible contain them;


to minimise the harmful effects of an emergency on people, property and the environ-

ment. Separate plans should be established for possible emergencies on site and off site.

(b) (c) (d) Information about installations Works management of all hazard installations should notify details
Information about installations
Works management of all hazard installations should notify details of their activities to the
competent authorities. Works management should prepare a safety report which should
include technical information about the design and operation of the installation, details of
the management of its safety, information about the hazards of the installation and infor-
mation about the safety precautions taken to prevent major accidents and the emergency
provisions that should reduce the effects of such accidents. The information should be
made available by the works management to all parties concerned in major hazard control
systems. The Code of Practice is specific about the type of information that should be
made availabe to each party.
Assessment of Major Hazards
Major hazard installations should be assessed by works management and, depending on
local arrangements, by the competent authorities.This assessment should identify uncon-
trolled events which could lead to a fire, an explosion or release of a toxic substance. This
should be achieved in a systematic way, for example by means of a hazard and operability
study or by checklists,
and should include normal operation, start-up and shut-down.
Control of the causes of major industrial accidents
Works management should control major hazard installations by sound engineering and
management practices. Works management should consider the possible causes of major
accidents including:
component failure;
deviations from normal operation;
human and organisational errors;
accidents from neighbouring plant or activities;
natural occurrences and catastrophes, and acts of mischief

Siting and land-use planning Competent authorities should make reasonable attempts to ensure that there is appropri- ate separation between major hazard installations.

Inspection of major hazard installations Major hazard installations should be regularly inspected in order to ensure that the installa- tions are operated according to the appropriate level of safety.Inspection should be carried out by a safety team.

Chapter 3 General Duties

Competent authorities should define appropriate safety objectives, together with a major hazard control system for their implementation.The major hazard control system should be set up by the competent authorities in consultation with all interested parties.Such a sys- tem should include:

Determination of causes of major industrial accidents An analysis of hazards should:

(a) lead to the identification of potential hardware and software failures, process and de-

sign deficiencies and human error;

(b) determine what action is necessary to counteract these failures.

Chapter 4 Prerequisites for a major hazard control system

The prerequisites for the operation of a major hazard control system are:

(a) manpower, within industry as well as within the competent authorities, including exter-

nal expertise if necessary;

(a) the establishment of an infrastructure; (b) the identification and inventory of major hazard installations;
the establishment of an infrastructure;
the identification and inventory of major hazard installations;
receipt and evaluation of safety reports;
emergency planning and information to the public;
siting and land-use planning;
(f) inspection of installations;
reporting of major accidents;
investigation of major accidents and their short- and long-term effects.
Responsibilities for works management
Works management operating a major hazard installation should:
provide for a very high standard of safety;
organise and implement the on-site component of the major hazard control system;
contribute to the drawing up and implementation of an off site emergency plan
Works management should carry out a hazard analysis of the major hazard installation.
This hazard analysis should be sufficient to enable:
the safety system to be analysed for potential weaknesses;
the residual risk to be identified with the safety system in place;
optimum measures to be developed for technical and organisational protection in
the event of abnormal plant operation.
To carry out a hazard analysis, a suitable method should be applied, such as:
– preliminary hazard analysis (PHA);
– hazard and operability study (HAZOP);
– event tree analysis;
– fault tree analysis;
– accident consequences analysis;
– failure modes and effects analysis;
– check-list analysis.

(b) equipment;

(c) information sources.

Chapter 5 Analysis of hazards and risks

Hazard analyses should be carried out primarily by works management, but the same technique may also be applied to the evaluation of safety systems by the competent au- thorities.

To analyse the safety of a major hazard installation as well as its potential hazards, a haz- ard analysis should be carried out covering the following areas:

which toxic, reactive, explosive or flammable substances in the installation constitute a


natural forces;

acts of mischief and sabotage.

(for a detailed explanation of the points made above, please refer to the Code of Practice).

major hazard; (b) which failures or errors could cause abnormal conditions leading to a major
major hazard;
which failures or errors could cause abnormal conditions leading to a major accident;
the consequences of a major accident for the workers, people living or working outside
the installation, or the environment;
prevention measures for accidents;
mitigation of the consequences of an accident.
The hazard analysis should follow a formalised method to ensure reasonable complete-
ness and comparability.
Preliminary hazard analysis (PHA)
As a first step in hazard analysis, a PHA should be carried out.
Hazard and operability study (HAZOP)
A HAZOP study or its equivalent should be carried out to determine deviations from normal
operation in the installation, and operational malfunctions which could lead to uncontrolled
Other methods of analysis
Where necessary, a more sophisticated method should be applied to individual parts of an
installation, such as the control system or other components that are very sensitive.
The following methods should be applied where necessary:
– event tree analysis;
– fault tree analysis.
Chapter 6 Control of the causes of major industrial accidents
The primary responsibility for the control of the causes of major industrial accidents should
lie with works management.
A hazard analysis should lead to the identification of a number of potential hardware and
software failures and human errors in and around the installation, which need to be con-
trolled by works management.In determining which failure may be of importance for an in-
dividual installation, the following list of possible causes should be included:
– component failure;
– deviations from normal operating conditions;
– human and organisational errors;
– outside accidental interferences;
Question 2. The principle of tripartism is the dialogue and cooperation between governments, employ- ers,
Question 2.
The principle of tripartism is the dialogue and cooperation between governments, employ-
ers, and workers - in the formulation of standards and policies dealing with labour matters

True/False (HP)

Answer 1:


Response 1:


Jump 1:

Next page

Answer 2:


Response 2:


Jump 2:

This page

Question 3. Which of the below is the specialised agency which seeks the promotion of
Question 3.
Which of the below is the specialised agency which seeks the promotion of social justice
and internationally recognised human and labour rights?
Multiple Choice
Answer 1:
Response 1:
Jump 1:
This page
Answer 2:
Response 2:
Jump 2:
This page
Answer 3:
Response 3:
Jump 3:
Next page
Answer 4:
European Agency for Safety and Health at Work
Response 4:
Jump 4:
This page
1.11 ILO Labour Standards, Prevention of Major Industrial Accidents Convention
ILO Labour Standards, Prevention of Major Industrial Accidents Convention C174
The convention is made up of 7 parts and 30 articles.
The purpose of this Convention is the prevention of major accidents involving hazardous
substances and the limitation of the consequences of such accidents. This Convention ap-
plies to major hazard installations. The Convention does not apply to nuclear installations
and plants processing radioactive substances except for facilities handling non-radioactive
substances at these installations, military installations or transport outside the site of an
installation other than by pipeline.
PART II. GENERAL PRINCIPLES (articles 4, 5 & 6)
Article 4 In the light of national laws and regulations, conditions and practices, and in con-
sultation with the most representative organizations of employers and workers and with
other interested parties who may be affected, each Member shall formulate, implement

and periodically review a coherent national policy concerning the protection of workers, the public and the environment against the risk of major accidents.

Article 5 The competent authority, or a body approved or recognized by the competent au- thority, shall establish a system for the identification of major hazard installations based on a list of hazardous substances or of categories of hazardous substances or of both, to- gether with their respective threshold quantities, in accordance with national laws and regulations or international standards.

Article 6 The competent authority, after consulting the representative organizations of employers and workers concerned, shall make special provision to protect confidential information transmitted or made available to it in accordance with Articles 8, 12, 13 or 14, whose dis- closure would be liable to cause harm to an employer's business, so long as this provision does not lead to serious risk to the workers, the public or the environment.

cles 20 & 21)
Students are encouraged to refer to the Convention in full, link below:
1.12 The Institution of Occupational Safety and Health
What is IOSH?
The Institution of Occupational Safety & Health (IOSH) is Europe's leading body for health
and safety professionals. As an independent and not-for-profit organisation, it aims to
regulate and steer the profession, maintaining standards and providing impartial, authorita-

tive guidance on health and safety issues.

What does IOSH do? Influencing the profession IOSH believes that offering communicated expert advice from competent safety and health

practitioners is an essential component in defining the safety, health and welfare policies of employers. By encouraging, facilitating and leading communication of good practices and expertise, it aims to promote awareness of health and safety matters in the workplace and ensure that high standards are achieved, and maintained. Working with UK governments IOSH is the conduit for knowledge, opinion and research on many important matters af- fecting the health and safety profession, and is often consulted by government depart- ments for members' views on draft legislation, codes of practice and other government ini- tiatives. IOSH aims to ensure that its members have a strong and effective voice which influences health and safety related issues with governments, employers and trades unions. Working with Europe IOSH aims to increase its contribution within the European Community and explore ways

in which it can more directly influence European directives and guidance.

It also aims to work with committees of national and international standards-making bod- ies, advancing research and pro-actively assisting the dissemination of knowledge throughout the wider European community and accession states.

Membership - why join? With membership totalling over 28,000 and growing fast IOSH is a focal point for pro- fessionals working in a diverse range of industrial, commercial and public sector organisa- tions. Membership is increasingly being used by employers as a standard for recruitment and remuneration, so joining IOSH will help your career.

Benefits of membership

A huge range of benefits are available:

free technical information service find the facts and figures that you need quickly; free health and safety lawline - help with interpreting legislation and case law; free best practice guides; free Safety and Health Practitioner the profession's leading monthly magazine, with the biggest recruitment section; discounted subscription to the biannual academic journal, Policy and Practice in Health and Safety; online Continuing Professional Development programme free to members; more than 80 professional development courses at discounted rates; over 300 free or low-cost events every year; member consultation the chance to have your say on proposed new regulations and legis- lation; online discussion forums for professional issues, careers and study support; networking activelocal branches plus sector-specific groups; funding to support research and development; free career counselling and performance coaching service.

free career counselling and performance coaching service. 1.13 The International Institute of Risk and Safety

The IIRSM is a professional body for health and safety practitioners. It was created to advance professional standards in accident prevention and occupational health throughout the world. Membership is open to all individuals who have an interest in occupational health, safety and risk management.

Mission Statement "The International Institute of Risk and Safety Management will strive to provide its mem- bers with support and information to help them practice and promote the highest profes- sional standards in risk and safety management in the workplace. The Institute will also continually endeavour to enhance the reputation of its members and to champion the cause of the risk, safety and health management profession."

About the Institute The Institute was established in 1975, has the status of a company limited by guarantee and is registered with the Charity Commissioners. It has over 7,500 individual members in the UK, Eire, and the Channel Islands, and in over 60 other countries throughout the world. Over the past five years, membership has increased by 40%, making IIRSM the fastest- growing professional health and safety body in the UK. Between November 2003 and No- vember 2004 membership increased by 7%.

The Institute's Objectives The Institute's main objective is to advance the public education in accident prevention and occupational health industry. To achieve this, the Institute:

promotes research into accident prevention and occupational health and publishes the re- sults; encourages individuals to adopt health and safety best practice and help prevent acci- dents; advises anyone entering the health and safety field to undertake training and obtain pro- fessional qualifications; exchanges information with equivalent bodies throughout the world. IIRSM's Health and Safety Practices IIRSM is committed to best practice in health and safety. The Board of Governors reviews annually the Safety Health and Environmental Policy, which is signed by the Chairman. A report on health and safety matters is received at each Board meeting, risk assessments are undertaken, staff health and safety training is provided and a positive health and safety culture is promoted. Designatory Letters If you join the IIRSM as a Member (MIIRSM) or Associate (AIIRSM), or are accepted as a Fellow (FIIRSM), you will be able to use the appropriate designatory letters after your name - a mark of full professional status. Information Service All members of IIRSM have free access to an extensive Safety Information Service. Your enquiry will be dealt with by a team of qualified health and safety professionals, who offer detailed and impartial advice. Their expertise is supported by national and international databases. You can call, fax or e-mail with any queries and receive a fast response. You can use this neutral and independent source to check the interpretation of health, safety and environmental law, saving time and helping avoid injuries and ill-health.

check the interpretation of health, safety and environmental law, saving time and helping avoid injuries and

Health and Safety Manager's Newsletter The IIRSM keeps its members up-to-date with new developments in health and safety through a monthly newsletter. It informs members of changes in legislation, and gives them the opportunity to express their views and comments. Every issue includes news, features, profiles, guidance, further contacts and a recruitment network.

Safety Management Magazine It also sends its members the British Safety Council's Safety Management magazine, con- taining reports on the key news stories, accidents and incidents that make an impact on the safety world, articles that focus on topics of current concern and company profiles that examine specific areas of industry. Every issue includes environmental news reports, ex- clusive coverage of health and safety prosecutions and updates on the latest safety prod- ucts and services available. Legal advice (UK only) All IIRSM members who are resident in the UK, Channel Islands and Isle of Man can ob- tain confidential free legal advice by telephone. This service is available 24 hours a day for personal or business legal problems.

Job Network All IIRSM members have access to an extensive job network through the Institute's News- letter. Through its recruitment pages, you can stay abreast of the job market and publicise your vacancies free of charge. Individual Membership:

Member (MIIRSM) Applicants with relevant experience who hold:

the British Safety Council Diploma in Occupational Safety and Health, NEBOSH Diploma Part 2, NEBOSH National Diploma (Level 6 Diploma in Occupational Health and Safety Practice), post-graduate Diploma in Health and Safety, NVQ Level 4 or 5 in Occupational Health and Safety, or an equivalent qualification accepted by the Membership Committee. Applicants with qualifications accepted in their home countries and/or with experience and specialist qualifications in the field of Health/Safety/Environmental/Fire Prevention/Risk Management may also be approved for acceptance. Associate (AIIRSM) Applicants with relevant experience who hold:

the British Safety Council Certificate in Occupational Safety and Health, NEBOSH National General Certificate (Level 3 Certificate in Occupational Health and Safety), NEBOSH National Certificate in Construction Safety and Health, NVQ Level 3 in Occupational Health and Safety, or an equivalent qualification accepted by the Membership Committee. Applicants with qualifications fully accepted in their home countries and with considerable experience and certain specialist qualifications in the field of Health/Safety/Environmental/Fire Prevention/Risk Management may also be approved for acceptance.

Affiliate Applicants who are involved in accident prevention and occupational health and safety, but who do not qualify for a designated grade of membership. Applicants whose interest in accident prevention and occupational safety and health is likely to assist in the development and interchange of information of a scientific, technical, promotional or educational nature.

to assist in the development and interchange of information of a scientific, technical, promotional or educational

Student Applicants following a recognised course of study in preparation for qualifications in health, safety or risk management. Applicants in full-time education or the Armed Forces, who are considering a career in Safety Management.

1.14 Sources of Internal Information.

Hazard Data Sheets. When dealing with chemicals, the Hazard Data Sheets are a vital source
Hazard Data Sheets.
When dealing with chemicals, the Hazard Data Sheets are a vital source of information.
Books, films, periodicals etc.
Subscription services are available so as to build up a library of case studies and informa-
tion on specific topics i.e. manual handling good practice.
Interviews and discussions.
Talking to and interviewing workers or others with similar experience may throw up some
new information.
Direct observation.
By observing the work that is being carried out, we can learn and find less hazardous
Work Study Techniques.
Such as sampling, surveys of the workforce etc.
Manufacturers' Information.
Manufacturers' instructions should be sought when using or buying in new machinery, as
they will be able to provide a wealth of safety information.
Analysis and use of damage, injury, and ill-health data, near-miss information and mainte-
nance records.
Maintenance records.
Maintenance records will hold details of damage caused and also suggest possible rea-
sons as to why the damage occurred, and what needs to be done to prevent repetition of
the damage.
Maintenance records are a vital source of information and help to:-
ensure proactive safety management takes place.
provide a source of information in the event of an accident.

Injury Data. Injury Data information can be found when looking through the accident records of the or- ganisation. These records should detail frequency of accidents and injury or damage types. They will also identify trends that need to be further investigated. Ill-Health Data. Ill-health data may not be easy to access as there are rules and legal practice that covers its use (i.e. Data Protection, Human Rights). However, the information can be useful in identifying areas of the organisation that require further investigation and risk manage- ment.

Near-Miss Data.

A 'near-miss' as the name suggests is an unplanned event that could have resulted in in-

jury or property damage. This type of information is important if your organisation is to be

pro-active in its health and safety management.

If several near-miss reports identify a common trend, then it is only a matter of time before

the near-miss becomes a real accident. Acting on the information before this is the key to

the process

1.15 Uses & Limitations of External & Internal Information Sources

Enforcement Agencies

The Health and Safety Executive and Local Authority Environmental Health Office

Government departments and bodies

Her Majesty's Stationery Office. Department for Work and Pensions. Department of Health.


To gain information on products purchased or possibly to be purchased.

Trade Associations

Handbooks. Members advice.

Information comes in a variety of sources and can be used (or abused) for a
Information comes in a variety of sources and can be used (or abused) for a variety of dif-
ferent reasons. The information needs to be up to date and of a certain level of quality.
You may need the information for research into a new idea you would like to put forward, a
risk assessment you are completing or to help write a policy or training manual.
Information is a term with many meanings depending on context, but is as a rule closely
related to such concepts as meaning, knowledge, instruction, communication, representa-
tion, and mental stimulus.
"Information" is defined as:
a message received and understood;
data: a collection of facts from which conclusions may be drawn; "statistical data";
knowledge acquired through study or experience or instruction (communication theory), a
numerical measure of the uncertainty of an outcome; "the signal contained thousands of
bits of information".
As mentioned, there are different sources of information; however, they fall in to two dis-
tinct categories:
Primary Sources
Secondary Sources
Examples would be:
Primary Sources
Secondary Sources
Authoritative guides on particular topics
The collected references to authoritative
guides and include:
reading lists;
bibliographies etc.
Where to acquire information:
Company Safety Policy
Gives vital information on policy, direction,
responsibilities of personnel etc.
In company safety services

Use your existing safety department or human resources unit.

Standards organisations British Standards Institution. International Organisation for Standardisation. Subscription
Standards organisations
British Standards Institution.
International Organisation for
Subscription services
Legal Help lines.
Information and Advice.
Voluntary Safety Bodies
British Safety Council.
Professional Bodies
International Safety Bodies
Educational Institutions
Universities and colleges.
1.16 The Internet
The internet has grown into an essential in most offices (and homes) - and there are more
and more people who can use the information on the internet to great effect.
Search engines such as Google are used by millions of people throughout the world every
day as a means of accessing all manner of information. The information can be brought to
the users' attention in a matter of milli-seconds. The user is then able to sift through the
information on the screen to find what they are looking for.
As well as websites, there are also discussion forums on many issues involving Health and
Safety and the rise of the blogosphere means that individuals can establish a significant
web-presence through their blogs. As they often allow followers and what are known as
blogrolls, or lists of other blogs that they find of interest, a single blog can serve as a nexus
of communication and resources on the internet.
When using the internet and email systems however, it is important to use virus software
along with firewalls and anti-spam filters. Along with the vast amounts of research material
available on the internet, there is also an increasing risk of being vulnerable to either mali-
cious virus programmes or having identities stolen. In order to prevent this, steps need to
be taken to ensure your online safety and privacy remains a constant high priority.

2.0 Hazard Identification.

Outline of the detection of hazards by techniques including task analysis, checklists, ob- servation and incident reports.


The Concise Oxford Dictionary defines risk (noun) in terms of a hazard, chance, bad con- sequences, loss, etc., exposure to mischance.

It defines risk (verb) in terms of: expose to chance of injury or loss, venture on, accept the chance of.

The dictionary definitions do not correspond entirely with what professionals in the field of Occupational Health and Safety would understand these terms to mean.

Hazard is not deemed to be synonymous with risk, although it can be an important deter- minant of risk. Although risk may be related to a chance event and expressed as a prob- ability, there is much more to it than that. Probability is not an entirely haphazard one of course, but relates to a number of factors which will be discussed further.

However in safety management terms, a better definition would be:

Hazard is the potential to cause harm;

Risk on the other hand is the likelihood of harm (in defined circumstances, and usually qualified by some statement of the severity of the harm).

The relationship between hazard and risk must be treated very cautiously. If all other fac- tors are equal - especially the exposures and the people subjected to them, then the risk is proportional to the hazard. However, all other factors are very rarely equal.

2.1 Examples. Consider the following examples: 1. Potassium Dichromate is a highly toxic, carcinogenic chemical.
2.1 Examples.
Consider the following examples:
1. Potassium Dichromate is a highly toxic, carcinogenic chemical. It is used in some tech-
niques to analyse exhaled breath for alcohol content. However for this purpose it is sealed
in a tube, and does not become airborne when air is drawn over it. Therefore, although it is
a highly hazardous substance, its use as described does not present any risk to the sub-
2. Flour would not be considered by many to be a hazardous substance. A jar of it on a
shelf would not have a skull and crossbones depicted on it together with other hazard
warnings, as might have been the case for a bottle of potassium dichromate. However, if a
baker was exposed over a period of time to airborne flour dust and/or dust by skin contact,
he/she could develop dermatitis (an inflammation of the skin), conjunctivitis (inflammation
of the eyes), rhinitis (information of the nose) and even asthma - an inflammatory disease
of the lungs which can cause a great deal of distress and may even be life threatening.
Risk and the quantification of probability.
The following account is intentionally simplified. In order to achieve this, a few corners
have been cut. Let us consider the risk to a man dying of lung cancer in any one year, and
relate it to moderate and heavy smoking.
Let us assume the following statistics based on 100,000 men in any one year.

If all of these men were non-smokers, one could assume that 10 of them would die of lung cancer.

If all of these men were moderate smokers, let us assume that 100 of them would die of lung cancer in that one year.

If all of them were heavy smokers let us assume that 200 of them would die of lung cancer in any one year.

The absolute risk of dying of lung cancer in moderate smokers would be of 100 men per 100,000 men per year. However 10 men per 100,000 per year would have died even if they hadn't smoked.

Therefore the attributable risk in relation to moderate smoking is 90 per 100,000 men per year.

Risk could also be expressed in a relative way. In this example the relative risk of dying of lung cancer for moderate smoking (when compared to no smoking at all) would be 100 di- vided by 10 equals 10 (simply stating that a moderate smoker had a 10 times higher risk of dying of lung cancer in any one year than a non-smoker.

Could you now calculate the attributable risk of lung cancer deaths for heavy smoking, and the relative risk for heavy smoking?

Tolerability and Acceptability of Risk and what to do about it.

The scientific community has a very important role to play in measuring risks and present- ing this information in as clear a manner as possible, with appropriate cautions about un- certainty.

It is then a responsibility of society as a whole, with no particular group having a more

privileged position by right, to determine what is tolerable and acceptable based on social, political, cultural and even economic considerations.

Clearly, there are areas where the risk is so high as to be manifestly unacceptable and others where it is so low as to be negligible. Of course, most of the debate is in the grey area in between.

Legislation and attitude and hence behavioural change are important channels for reduc- ing the risk. Many hazards cannot be abolished in the sense that they are completely got rid of. Therefore, to reduce risk is, more often than not, a question of reducing exposure.

For example, in the UK the logic for reducing occupational risks to health is to achieve a situation whereby "exposure should be controlled to a level to which nearly all the popula- tion could be exposed day after day, without adverse affects to health".

2.2 Safety Inspections. Safety inspections are strongly recommended in any organisation and are an excellent
2.2 Safety Inspections.
Safety inspections are strongly recommended in any organisation and are an excellent
way for the employer to reference the commitment to safe work practices, provide practical
training in safety awareness and minimise hazards in the workplace.
Safety inspections provide a systematic method for involving supervisors, employees,
safety co-ordinators, and/or safety committees in the process of eliminating workplace
Types of Safety Inspections
There are several ways to perform safety inspections of a workplace, task or job. The most
popular ways include using checklists, general knowledge, and risk mapping. To be effec-
tive, safety inspections must be individualised or tailored to meet the needs of a specific
work site, task or job.
Safety Checklist Inspections
A checklist is very good for the regular inspection of specific items. However, they may not
be as useful in identifying previously unrecognised hazards.
Many different checklists are available from a variety of sources. Unfortunately, since
these ready-made checklists are generic, they rarely meet the needs of a specific work-
place, task or job. However, you may find them useful to inspect a part of the organisation
you work for. For instance, the owner's manual for a table saw may have a checklist that
works perfectly for inspecting the saw in a department shop.
Taking parts of several ready-made checklists and putting them together may be an easy

method of beginning the development of your customised checklist.

General Knowledge Safety Inspections

Another way of conducting inspections is to use the information you have in your head and just walk around looking at what is going on. You do not use a pre-made checklist for this type of inspection. This method keeps you from getting stuck looking at the same things every time.

However, the effectiveness of this inspection method is dependent on the individual's level of knowledge about workplace-related safety practices. It is important to document the re- sults of the inspection and any action taken in resolving or addressing safety hazards.

Risk Mapping Safety Inspections The third inspection method is called risk mapping. It is a
Risk Mapping Safety Inspections
The third inspection method is called risk mapping. It is a good method to use at a safety
meeting where everyone there is familiar with the workplace or process.
This technique uses a map/drawing of the workplace (like a floor plan) or a list of steps in a
process. People in the group then tell the leader the hazards they recognise and where
they are located in the workplace or process. The leader uses different colours or symbols
to identify different types of hazards on the map or list of steps.
This type of inspection is valuable for involving all employees in identifying and resolving
safety hazards.
2.3 What Should you Include in your Inspections?
When you do your inspections, make sure you are looking at your entire operation's safety
programme. Remember to evaluate:
• processes;
• tools and equipment (some will require a different inspection before each use);
• chemicals;
• workplace environment;
• employee training;
• personal protective equipment;
• emergency plans.
How often should you do inspections?
Giving a recommendation on the frequency of inspections is difficult. The frequency is very
dependent on how often things change and on the hazard level at the workplace. Perhaps
the best method is to begin with frequent inspections until there have been several inspec-
tions where no new hazards are found, and then reduce the frequency. However, if you
are always finding items that need work, you can decrease the frequency.
Who should do the inspections?

It has to be someone who is familiar with the workplace, task or job. The best way is to have a supervisor and an employee from the area inspect together.

What should you do with your inspection findings?

You have to follow up on your findings. It does little good to do inspections if nothing gets corrected. Someone should be assigned to develop a correction for each problem that was found. Attaching a deadline for the correction of each problem is helpful. Don't let correc- tions get drawn out.

Review your inspection reports for trends. Is the problem showing up again and again? There may be something that encourages this problem to exist. That also needs to be ad-


2.4 Systematic Thinking - Using Checklists.

Consider: The secretary asks you what stationery and office equipment you will need next year. You are busy so you jot down a few things. Next year, you realise that you do not have any felt pens. You get angry with the secretary and she says, "But you didn't ask".

How much easier, quicker and more efficient it would have been if she had given you a comprehensive list of what you might need so that you could tick the ones which you did need. This is the basis of systematic thinking using checklists.

Three Types of Checklists 1. The simplest type of checklist, as in the above example,
Three Types of Checklists
1. The simplest type of checklist, as in the above example, is made up of a list of 'things'
that might be needed for a particular activity.
2. Another kind of checklist gives a systematic list of 'procedures' to be followed to perform
a particular task. An 'Organising a School Trip' checklist would tell you all the things you
need to do, and in what order, to organise a school trip. A 'How to Write an Essay' check-
list would help students to be organised and systematic when engaging in this important
3. The third type of checklist deals with events which are 'fixed in time' and it systematically
lists who should do what and when. The most obvious example is a master timetable but
there is also the examination timetable which could state, amongst other things, when
drafts exams have to be with the secretary for typing.
If you do not have checklists, then you will begin with a blank sheet of paper and the
chances are that you will forget something. This is not systematic, not easy and usually not
very effective.
Producing Checklists
All checklists begin as a blank sheet of paper. Either an individual or a group of people
mind-map ideas to put on a list. This can then be circulated to other people to see if they
can think of anything that is missing.
Other missing things might be noticed when people begin to use the list. This is not a prob-
lem - add them. Some items on the list might never be used. This is not a problem - re-
move them. Thus, in time, some very useful lists evolve to help your company run more
easily and systematically.
Check-list Analysis
Check-list analysis is defined in the ILO Prevention of Major Industrial Accidents ILO Code
of Practice as: “A method for identifying hazards by comparison with experience in the
form of a list of failure modes and hazardous situations”.
Chapter 3 of the Code covering general duties states: To carry out a hazard analysis, a suitable method should be applied,such as:

preliminary hazard analysis (PHA);

hazard and operability study (HAZOP);

event tree analysis;

fault tree analysis;

accident consequences analysis;

failure modes and effects analysis;

check-list analysis.

2.5 Risk Factor Checklists.

Recognising risk factors for musculoskeletal disorders (MSDs) like force, awkward posture, and repetition can be a cost-saving endeavour for companies.

But how do you identify and document the presence of risk factors?

One way to start is through the use of checklists. For example, risk factors can be listed in

a checklist format and identified as existing in a workplace with a Yes or No response.

Expanded checklists may include additional information, such as an estimate of force or body angles, but usually the purpose of a checklist is to quickly and non-intrusively record job information during a facility walk-through.

Checklists are typically very qualitative in nature. That is, they will not provide quantitative risk
Checklists are typically very qualitative in nature. That is, they will not provide quantitative
risk assessment, but rather will document the existence of particular risk factors. Where
more detailed risk assessment is desired, the evaluator should utilise job/task analysis
methods that provide more detail and are more quantitative in nature.
Checklists can be useful as a first pass snapshot of potential risk in a job or task. For ex-
ample, a risk factor checklist might include questions like:
 are there awkward postures?
 as there static muscular work?
 are there repetitive motions at a high rate?
 are there heavy tools/parts that must be handled?
A "Yes" answer to a question does not mean that there is high risk of injury/ illness, rather
the analyst's attention is drawn to that feature of the job/task for further review.
Risk factor checklists have certain advantages, including:
 they can be tailored to a specific workplace, job, or task type;
 they can be used to identify higher priority jobs in terms of ergonomics concerns;
 they are usually fast, simple to administer, and easy to understand;
 they usually don't require special equipment or tools.
Risk factor checklists also have some disadvantages. Not having a comprehensive under-
standing of ergonomics, it may be easy to oversimplify a task or operation believing that a
"simple checklist" will identify and control areas of concern. In fact, quite the opposite is
A checklist will not comprehensively evaluate a work area, and usually provide little assis-
tance in controlling identified concerns. These tasks are still the responsibility of the
evaluator or ergonomist. A checklist can, however, aid the evaluator by helping to identify
and prioritise tasks that may need further analysis or interventions.


Task Analysis.

What Is Task Analysis?

Task analysis is any process of assessing what a worker does and why, step by step, and using this information to design a new system or analyse an existing system.

The term 'task analysis' refers to a methodology that can be carried out by many specific techniques. These techniques are used to describe or evaluate the interactions between the humans and the equipment or machines. They can be used to make a step-by-step comparison of the capabilities and limitations of the operator with the requirements of the system. The resulting information is useful for designing not only equipment, but also pro-

cedures and training.

Why Should Task Analysis Be Used?

Evaluation and design of a task or job using task analysis more effectively integrates the human element into the system design and operations.


Observe and record information about the worker performing the job. First observe the worker and subsequently ask the worker to provide verbal explanation while walking through the steps.


Ask the operator questions about the job. Questions can be open-ended to learn more about the job. The interview may be conducted while the worker is performing the job or it can be done away from the job site. The worker must know that the information collected will remain confidential and anonymous.

Focus group

A discussion with a group of typically eight to twelve people, away from their place of work. A moderator is used to focus the discussion on a series of topics or issues. It is useful for collecting exploratory or preliminary information that can be used to determine the ques- tions needed for a subsequent structured survey or interview.

Existing documentation

Review any existing operating manuals, training manuals, safety reports, and previous analyses.


Use a structured checklist to identify particular components or issues associated with the job. Available for a range of ergonomic issues, including workplace concerns, human- machine interfaces and environmental concerns.


Use to collect systematically an individual's views of a system or task. Questions should be structured, although they can be open-ended.


Tape the worker performing the job or specific tasks. This provides a record of the job and enables repeated study of the tasks.

Question 4. risk assessment is a method of estimating the magnitude of risk. It provides
Question 4.
risk assessment is a method of estimating the magnitude of risk. It provides a de-
gree of objectivity and a facility for ranking risks and priorities.
Multiple Choice (HP)
Answer 1:
Response 1:
Jump 1:
Next page
Answer 2:
Response 2:
Jump 2:
This page

2.7 Job Safety Analysis.

What is a job safety analysis?

Job safety analysis (JSA) is the systematic examination of a job intended to identify haz- ards, assess the level of risk, and evaluate practical measures to control the risk.

It must be kept in mind that JSA is not a workplace inspection or an audit procedure.

Workplace inspection is a systematic examination of workplace conditions and practices to determine their conformity with company procedures and compliance with prescribed health and safety regulations.

An audit process is a systematic examination of the safety management system to deter- mine if work activities and related results comply with planned prevention policies and es- tablished programs. As well, an audit evaluates whether the program is effective in achiev- ing the goals and objectives set out in the policy.

A JSA should be proactive, although it may be used in response to a rising
A JSA should be proactive, although it may be used in response to a rising rate of injuries
and illnesses. Hazards should be recognised and preventive measures implemented at the
planning and organising stages of the work. It should be emphasised that the focus of JSA
is to examine the job and not the person who is doing the job.
Job safety analysis is an important element of a risk management system. It involves ana-
lysing each basic task of a job to identify potential hazards and to determine the safest way
of doing the job. This procedure is sometimes referred to as job hazard analysis.
Experienced workers and supervisors may perform a JSA by analysing jobs through dis-
cussion and observation. This approach has two distinct advantages. Firstly, it involves
more people and this allows for a wider base of experience. Secondly, the participation of
many stakeholders promotes faster acceptance of the resulting work procedure.
Health and safety committee members and representatives play an important role in the
JSA and have a legal obligation to participate in the JSA process. They also provide prac-
tical work experience related to the risk evaluation and the feasibility of appropriate con-
Health and safety specialists may participate in the JSA to eliminate any oversight in ac-
counting for hazards and related preventive measures.
Some individuals prefer to expand the analysis into all aspects of the job, not just safety.
This approach is known as total job analysis or task analysis.
The total job analysis is based on the concept that safety is an integral part of every task
performance and not a separate entity.
In this document, only health and safety aspects will be considered; however, it is recog-
nised that this material could be used to conduct a total job analysis.
2.8 How to Perform a Job Safety Analysis.
A job safety analysis involves five steps:
 Selecting the job to be analysed.
 Breaking the job down into a sequence of tasks.
 Identifying potential hazards.
 Determining preventive measures to control these hazards.
 Communicating the information to others.
Step 1:

What important factors should be considered in selecting a job for JSA?

Ideally, a JSA should be performed for all jobs. However, there are practical constraints on time and resources. Another consideration is that each JSA may require revision when changes occur in equipment, raw materials, processes or the environment. For these rea- sons, it is usually necessary to set priorities. Factors to be considered in assigning priori- ties include:

accident, injury and illness statistics: jobs where accidents occur frequently or where they result in disabling injuries or illnesses;

absenteeism: jobs where employees take frequent sick leave or other leaves of ab- sence;

signs and symptoms of harmful exposures: the nature of the job poses a danger of harmful exposure;

potential for severe injuries or illnesses: the consequences of an accident, hazard- ous condition, or exposure to a harmful substance are potentially severe;

modified jobs: new hazards may be associated with changes in job proce- dures/processes;

infrequently performed jobs: employees may be at greater risk when undertaking non-routine jobs;

jobs with frequent work interruptions due to technical difficulties;

jobs with excessive waste generation and production losses;

jobs where employees are required to work alone in isolated workplaces;

jobs with the potential for violence in the workplace.

2.9 Step 2. How are basic tasks of a job established? A task is a
2.9 Step 2.
How are basic tasks of a job established?
A task is a segment of an overall job. Completion of each operational task in proper se-
quence leads to the completion of the job. It is important to keep the tasks in their correct
sequence. Any task which is placed out of sequence may cause potential hazards to be
missed or introduce hazards, which would not otherwise exist.
When conducting a JSA, each task is recorded in its proper sequence. Notes should be
made of what is to be done rather than how it is done. Each item is started with an action
Dividing a job into tasks requires a thorough knowledge of the job. If the tasks are made
too general, specific operations and related hazards may be missed. On the other hand,
too many tasks may make the JSA impractical. A rule of thumb is that most jobs can be
described in fewer than ten tasks. If more operational steps are required, it is advisable to
break the job into two segments, each with a separate JSA. As an example, Table 1 pre-
sents the tasks involved in changing a flat tyre.
This part of the analysis is usually prepared by watching the employee do the job. The
employee being observed should be experienced and capable of performing all parts of
the job. The observation team may include the immediate supervisor, a health and safety
professional, and a member of the health and safety committee or the health and safety
representative. Key points are less likely to be missed in this way.
Table 1. An example of JSA applied to changing a flat tyre.
JOB: Changing tyre on a vehicle
Analysed by: John Supervisor and Tom Worker Date: 29 May 2002

Reviewed by: Joe Expert Date: 1 June 2002

Approved by: Co-Chairs Health and Safety Committee Date: 5 June 2002

Sequence of Tasks Potential Hazards Preventive Measures

1. Park vehicle.

2. Get spare tyre and tool kit.

3. Pry off hub cap.

4. Loosen lug bolts (nuts).

5. And so on

Helpful Tips for Performing a JSA.

EXPLAIN the purpose of the JSA to ensure full co-operation and participation of the em- ployee.

ASSURE the employee that the purpose of the JSA is to make the job safer by identifying hazards and making changes to eliminate or reduce accidents, injuries, and illnesses.

CLARIFY that the JSA is neither a time and motion study in disguise, nor an attempt to un- cover individual unsafe acts.

ENSURE the employee understands that the JSA is an evaluation of the job, not the indi- vidual.

RESPECT the employee's experience and use it as an important input in making im- provements.

OBSERVE jobs during normal working hours and situations. For example, if a job is rou- tinely carried out at night, perform JSA at night. Similarly, only regular tools and equipment should be used. The only difference from normal operations should be the fact that the job performance is being observed.

DISCUSS with the employee:

tasks of the regular process;

any incidents;

communication problems;

difficulties in performing the tasks;

training provided in the use of equipment and safety procedures; and need for improvements.

DISCUSS the breakdown of tasks with all the participants (including the employee).

ENSURE that all basic tasks have been noted and are in the correct order.

2.10 Step 3. How are potential hazards identified? Two commonly-used techniques for identifying potential hazards
2.10 Step 3.
How are potential hazards identified?
Two commonly-used techniques for identifying potential hazards are:
A) Kepner and Tregoe method based on change analysis;
B) Gibson and Haddon approach based on unwanted energy flow and energy barrier.
A. Change analysis (Kepner and Tregoe)
Change analysis helps establish the significance of changes in causing accidents and
losses. It also helps determine counter-changes to prevent these accidents and losses.
Change is needed for improvement, but the change may have unwanted side effects.
Changes can be planned or unplanned. Sometimes, preventive changes can cause prob-

lems if not introduced properly.

In planned changes, potential problems can be identified and controlled. Change analysis offers a powerful safety analysis methodology for the unplanned and anticipated changes in the operation of equipment, material, or process. Any unplanned changes may result in accidents and losses unless preventive measures (counter-changes) are implemented.

First introduced by C.H. Kepner and B.B. Tregoe in 1965 as a managerial tool to solve production problems, the change analysis technique was eventually adapted to occupa- tional health and safety issues.

In the 1970s, the "What if" procedure was developed to identify possible accident event sequences. Once these sequences are established, it is easier to pinpoint the hazards, consequences, and potential methods for risk reduction.

The "What if" analysis involves conducting a thorough and systematic examination of each task by asking questions that begin with "What if?" The formulation of the exact questions is left up to those conducting the examination.

Helpful Tips for Change Analysis

For a specific task, identify the task or process parameters to be investigated for changes (normally one parameter).

Apply the guide words to this parameter in order to qualify or quantify the changes.

Identify and assess the consequences of the changes in terms of risk.

Task parameters are easy to find. Look at the task and find parameters to be controlled in order for the task to be performed normally.

Such parameters can be:

a sensory signal: e.g. colour, shape of object, emitted sound, odour, light level, po- sition of handle, height of pedal.

a process specification: e.g. pressure, temperature, concentration, flow rate.

a dynamic component: e.g. motion, sequence, pace, speed change, friction.

a force or mass: e.g. electrical power, chemical energy, torque, impulse, impact.

a geometric value and time: e.g. location, dimensions, rate.

a piece of equipment: e.g. protective devices, position of a part, part in motion.

an environmental or external condition: e.g. weather, snow, rain, nuisances from neighbourhood.

When the parameter has been identified, apply the "What if" questions to it by using the guide words described in Table 2. All questions have the following format:

What if the (parameter) is not, more, less, as well as, part of, reverse, other than the one described in the task?

As an example, change analysis can be applied to the "changing a flat tyre" scenario. The first task "park vehicle" insists on the "location" of the vehicle as a specific parameter. Normally, the vehicle must be parked off the road on stable ground before removing any wheel. Table 3 presents examples of applying "What if" questions to this situation.

If the job is well-defined, the employee's workstation is geographically limited, or his activi- ties are repetitive in nature, the energy-barrier approach is an alternative.

Table 2. Guide words for "What if" questions.

Guide Word Meaning Examples: What if

No or not - Negation of the operation - The operation is stopped and nothing else is pro- duced.

More - Quantitative increase

not - Negation of the operation - The operation is stopped and nothing else is pro-
Sooner (time).  Higher (height, T, P).  Temperature is higher than normal.  Exposure
Sooner (time).
 Higher (height, T, P).
 Temperature is higher than normal.
 Exposure time is greater than regular.
 Temperature and/or pressure is increased.
 Less - Quantitative decrease
Later (time).
Lower (height, T, P) - Quantity produced is less than usual.
Shutdown time is greater than normal.
Temperature and/or pressure is decreased.
As well as - Qualitative increase
At the same time as - An unwanted product is produced at the same time as the wanted
product (contamination).
A product is transferred from one tank to another with environmental release.
A product is boiling during transfer with splashes.
Part of - Qualitative decrease
Lack of - A product is not added during production.
An operation is unachieved or interrupted.
Reverse - Logical opposite of the operation - Tank is being emptied instead of being filled.
Other than - Complete substitution of one operation by another - A product is heated in-
stead of being evacuated.
Table 3. Applying "What if" questions for changing a flat tyre.
Guide Word Example of "What if" Question
 No or not - What can happen if employee lost the control of his/her vehicle and
cannot park?
 More - What can happen if the vehicle is parked on the road (on a bridge, obstruc-
tion by snowdrift)?
 Less - What can happen if employee cannot stop the vehicle rapidly?
 As well as - What can happen if employee cannot find a location in the dark?
 Part of - What can happen if the vehicle is on a soft shoulder?
 Reverse - Not applicable.
 Other than - What can happen if towing is mandatory on a road?
B. Unwanted energy flow and energy-barrier approach (Gibson and Haddon)
The energy-barrier approach was developed by J.J. Gibson in 1961 and structured by
W.C. Haddon in 1966. This approach of accident prevention is very popular because it is
simple to apply and easy to understand.
We all use energy to perform work. Power is the rate of energy use. In classic industrial
processes, high power sources produce large amounts of energy in a short time and are
key to high production rates. Controlled energy is essential to accomplish work. Uncon-
trolled energy flow has the potential to cause accident, injury, equipment damage, or prop-
erty losses.
For example, controlled flow of electrical energy will run motors, power lighting and heating
systems, and energize many other desirable operations.
Uncontrolled electrical flow can cause electrocution or electric shocks to people, destroy
machines, and pollute our environment. If a person comes in contact with a live electrical
machines, and pollute our environment.
If a person comes in contact with a live electrical wire, the electrical current will flow
through his body causing electrocution, or in a less severe case, electric shock.
In the same way, a moving belt drive possesses kinetic (motion) energy. If the belt breaks
while moving, it can hit a person and cause physical injury, or damage a piece of equip-
ment and cause physical loss.
In the energy-barrier approach, hazard is defined as uncontrolled energy flow and the pos-
sible contact between the energy and a person or equipment, resulting in:
injury to persons;
damage to equipment and property;
reduction in the ability of persons to perform work; and
harm to the environment.
The procedure for the energy-barrier approach is to look at each task and:
 identify the energy sources producing a risk (Table 4);
 describe the way the energy can come in contact with employee(s) (i.e. the energy
flow) (Table 5);
 find adequate barriers to eliminate or reduce the chances of this contact (i.e. con-
trolling the energy flow).
For each task, the observers use Table 4 to determine all the possible types of energy
present in the process, and Table 5 as a checklist to cover all the possible ways in which a
person may come in contact with these energies.
For example, for the task "park vehicle", the energy types and corresponding ways of con-
tact are:
Kinetic energy:
 From the employee's vehicle: struck against objects in the environment (tree,
snowdrift), caught in motor vehicle.
 From passing traffic: struck by the oncoming vehicle, caught between oncoming
vehicle and employee's car.
Gravitational energy:
From the employee's vehicle: sliding of the car into a ditch, fall of the vehicle
caused by soft shoulder, rolling down a hill.
Hazards identified using the energy-barrier approach are listed in the middle column of the
worksheet (Table 6), numbered to match the corresponding job task.
Table 4. Types of energy.
Examples of contact:
 Gravitational Falls from same level, falls from different level, falling objects.
 Kinetic Human energy: repetitive motion, overexertion, awkward posture.
 Machine energy: struck by moving object, projectiles, airborne particulate, motor
vehicle, caught between, caught in, cut by.
 Thermal Burns (hot and cold), hypothermia, heat stress, solar heat.

Biological Contact with infections resulting in diseases (of the lungs, blood, skin, etc.).

Contact with pathogens.

Chemical Corrosion: degradation of materials.

Reactions: exothermic, endothermic, explosive, toxic, corrosive.

Fumes, gases, dusts.

Hydraulic Asphyxiation (drowning), motive force (resulting in crushing, caught be- tween, etc.).

Electrical Electric shock, electrical burns, electrocution.

Ionising radiation exposure from: radioactive material, cosmic rays, natural radioac- tive materials in the earth, x-ray machines.

Repetitive motion.

Sustained viewing.

Static posture without the application of force to an object.

Static posture with the application of force to an object.

Bodily conditions.

Exposure to caustic, noxious, or allergenic substances.

Exposure to noise.

Exposure to radiation.

Exposure to traumatic or stressful event.

Oxygen deficiency.

Exposure to harmful substances or environments.

 Electromagnetic radiation exposure from: microwave ovens, radio and TV anten- nas.  Ultraviolet radiation
 Electromagnetic radiation exposure from: microwave ovens, radio and TV anten-
 Ultraviolet radiation from: the sun, UV lamps.
 Infrared radiation from: the sun, heat sources.
 Electromagnetic field from: electrical power lines, power transformers, electrical
 Animal Attacks, bites, stings.
 Stored potential energy.
 Motive force from: coil springs, flexed objects.
 Pressure: steam, compressed gases.
 Noise: machine noise, human noise, environmental noise (wind, animals, etc.).
 Multiple kinds of energy
The interaction of two or more kinds of energy frequently causes accidents. This complex-
ity can be best described or classified by the sequential listing of energies: for example,
electrical shock resulting in fall from heights, bee sting resulting in motor vehicle accident.
Table 5. Examples of contact with uncontrolled energy sources.
Types of contact:
 Contact between objects and equipment.
 Struck against object.
 Struck by object.
 Caught in or compressed by equipment or objects.
 Caught in or crushed in collapsing materials.
 Rubbed or abraded by friction or pressure.
 Rubbed, abraded, or jarred by vibration.
 Fall to lower level.
 Jump to lower level.
 Fall on same level.
 Bodily reaction and exertion.
 Bodily reaction.
 Overexertion.

Contact with electric current.

Contact with temperature extremes.

Exposure to air pressure changes.

Transportation accident.

Highway accident.

Non-highway accident (except rail, air, water).

Pedestrian, non-passenger struck by vehicle, mobile equipment.

Railway accident.

Water vehicle accident.

Aircraft accident.

Transportation accident.


Can be hit by vehicle on uneven, soft ground.


Vehicle may roll onto the driver.


Get spare tire and tool kit.


Lifting spare may cause strain.

 Fire and explosion.  Fire: unintended or uncontrolled.  Explosion.  Assault and violent
 Fire and explosion.
 Fire: unintended or uncontrolled.
 Explosion.
 Assault and violent act.
 Assaults and violent acts by person(s).
 Self-inflicted injury.
 Assaults by animals.
Table 6. Identifying potential hazards for changing a flat tyre.
JOB: Changing tyre on a vehicle
Analysed by: John Supervisor and Tom Worker Date: 29 May 2002
Reviewed by: Joe Expert Date: 1 June 2002
Approved by: Co-Chairs Health and Safety Committee Date: 5 June 2002
Sequence of Tasks Potential Hazards
(Energy type & contacts) Preventive Measures
1. Park vehicle.
a) Can be hit by passing traffic.


Pry off hub cap.


Hub cap may pop off and hit the driver.


Loosen lug bolts (nuts).


Lug wrench may slip and hurt the driver.


And so on

2.11 Step 4. How are preventative measures determined? The fourth step in a JSA is
2.11 Step 4.
How are preventative measures determined?
The fourth step in a JSA is determining ways to eliminate or mitigate the hazards identified.
There are two approaches for doing this:
A. Hazard control strategies.
B. Energy-barrier approach involving controls:
 at the source;
 along the path; and
 at the person.
The objective of both approaches is the same: the prevention of injuries, illnesses, and
other losses.
Preventative measures depend on the findings of the JSA and not the method to perform it
(i.e. the change-analysis technique or the energy-barrier approach).
The following are common hazard control strategies, in order of preference:
 Eliminate the hazard.
 Substitute the hazard with less hazardous or non-hazardous options.
 Minimise the risk due to the hazard.
 Reduce the exposure.
 Isolate the hazard.
 Provide personal protective equipment and clothing.
 Implement administrative controls.
 Have an emergency plan in place.
 Adopt measures to reduce damage following an accident or emergency.


This is the most effective measure because the risk is eliminated. Examples of options in this category are:

Eliminate the hazard.

choose a different process;

modify an existing process by changing the energy type;

modify or change equipment or tools;

lock out energy sources.

2. Substitute the hazard with less or non-hazardous options.

This measure is very effective, especially for hazardous substances, and its application in the safety field is practicable. Here are some examples:

replace solvents by water solutions;

substitute vapour heating by electric devices;

use electronic controls instead of pneumatic ones;

crush explosive dusts in inert gas atmosphere instead of air;

use a non-sparking hammer in a flammable atmosphere in lieu of steel hammer.

3. Minimise the risk due to the hazard.

Evaluate employee's physical, mental and emotional capacity before a job place- ment.

Ensure that the employees can perform work without endangering their own health and safety or that of others.

Institute medical controls and examinations.

4. Have an emergency plan in place.

Fires and emergencies may and do happen. Workplaces must have an emergency plan in place to protect people, property, and business in case of such emergencies.

5. Adopt measures to reduce damage following an accident or emergency.

Workplaces must have plans in place to deal with the after-effects of accidents and emer-

If the hazard cannot be eliminated or substituted, efforts should be made to minimise the
If the hazard cannot be eliminated or substituted, efforts should be made to minimise the
risk to the employee due to injurious contact with the hazard. This is achieved by using
one or a combination of the following methods of control:
Reduce the exposure:
 Change the design of the workstation.
 Improve environment (e.g. ventilation).
 Implement emission controls.
 Add safety and alert devices.
 Develop safety procedures.
 Train the workers to perform the task safely.
 Provide health and safety education.
Isolate the hazard:
 Build enclosures to contain the hazard.
 Group noisy machinery in a room.
 Isolate the worker operations in a control room.
 Put a cabin on a lift truck.
Provide personal protective equipment and clothing:
 Use respirators in hazardous atmosphere.
 Select appropriate gloves corresponding to the type of solvent.
 Protect fingers with wire mesh to prevent cuts by knife.
 Wear a wide brim cap to prevent exposure to sunlight.
 Use fall protection when working at height.
Implement administrative controls:
Implement job rotation schedule.
Reduce time or frequency of exposure to a hazardous substance.

gencies. These include plans for:

rescue of the victims;

emergency medical assistance for the injured;

repair and restoration of the damage; and

compensation and insurance.


The basic concept in this approach is that accidents occur because of the lack of barriers to control unwanted energy flow. Whether or not a form of energy produces an injury or loss in a given situation depends on the:

Table 8. Suggested preventative measures for changing a flat tyre using the energy-barrier approach.


JOB: Changing tyre on a vehicle

Analysed by: John Supervisor and Tom Worker Date: 29 May 2002

 magnitude of energy and rate of release;  duration and frequency of contact; and
 magnitude of energy and rate of release;
 duration and frequency of contact; and
 concentration of forces: force per unit area.
The harmful effects of uncontrolled energy transfer can be prevented or reduced by a suc-
cession of countermeasures or energy barriers (see Table 7).
Table 7. Examples of energy barriers (in order of efficiency).
Barrier Type Examples
1. Limit energy - Lower speed, lower voltage, limit quantity.
2. Substitute safer energy from safer chemicals.
3. Prevent build-up - Fuses, floor loading.
4. Prevent the release - Containment, insulation.
5. Provide slow release - Safety valves, seatbelts.
6. Channel the release (separate in time and space) - Electrical grounding, lockouts, inter-
7. Apply energy barrier on the source - Acoustic enclosures, sprinklers.
8. Apply energy barrier between source and target - Fire doors, welding curtains.
9. Apply energy barrier on person or object - Personal protective equipment, machine
10. Raise the injury or damage threshold - Selection, acclimatisation.
11. Limit injury or damage from worsening - Emergency medical aid, emergency showers.
12. Rehabilitate - Persons regain health, equipment repaired, special insurance, victim
The energy barriers can then be used to describe the preventative measures that can be
implemented to reduce and, hopefully, eliminate the potential hazard associated with the
task (see Table 8).

Reviewed by: Joe Expert Date: 1 June 2002

Approved by: Co-Chairs Health and Safety Committee Date: 5 June 2002

Sequence of Tasks Potential Hazards

(Energy type & contacts) Preventative Measures


1. Park vehicle.

a) Can be hit by passing traffic.

b) Can be hit by vehicle on uneven, soft ground.

c) Vehicle may roll onto driver.

a) Drive to area well clear of traffic. Turn on hazard lights.

b) Choose a firm, level area.

c) Apply the hand brake, leave car in gear, place blocks in front and back of the wheel di-

agonally opposite to the flat.

2. Get spare tyre and tool kit.

a) Lifting spare may cause strain - turn spare into upright position in the wheel well. Using

your legs and standing as close as possible, lift spare out of boot and roll to flat tyre.


Pry off hub cap.


Hub cap may pop off and hit the driver - pry off hub cap using steady pressure.


Loosen lug bolts (nuts).



Lug wrench may slip and hurt the driver - use proper lug wrench; apply steady pressure

5. And so on

use proper lug wrench; apply steady pressure 5. And so on 2.12 Step 5. How should
2.12 Step 5. How should I communicate the JSA information to everyone else?
2.12 Step 5.
How should I communicate the JSA information to everyone else?

Once the preventative measures are selected, the results must be communicated to all employees who are, or will be, performing that job. The side-by-side format used in JSA worksheets is not an ideal one for instructional purposes. Better results can be achieved by using the results of JSA to develop a work procedure in a narrative-style format. For example, the work procedure for changing a flat tyre might start out like this:

1. Park vehicle

Drive vehicle off the road to an area clear of traffic, even if it requires rolling on a flat tyre. Turn on the hazard lights to alert passing drivers so that they will not hit you.

Park on a firm, level area so that the vehicle does not roll when you jack it up.

Apply the hand brake, leave the car in gear, and turn off the engine.

Place blocks in front and back of the wheel diagonally opposite the flat tyre to prevent the vehicle from rolling.

2. Get a spare tyre and tool kit

Turn the spare tyre up into an upright position in its well. Stand as close to the boot as possible and slide the spare close to your body. Lift out and roll to flat tire.

3. Pry off hub-cap

Pry off hub-cap slowly with steady pressure to prevent it from popping off and striking you.

4. Loosen lug bolts (nuts)

Using the proper lug wrench, apply steady pressure slowly to loosen the lug bolts (nuts), so that the wrench will not slip and hurt your knuckles.

5. And so on

If a written work procedure already exists, it should be revised to include health and safety items identified by the job safety analysis process.

2.13 How and When to Use Job Safety Analysis. A completed JSA serves as an
2.13 How and When to Use Job Safety Analysis.
A completed JSA serves as an excellent tool for:
 compliance with health and safety legislation;
 employee training;
 workplace inspection;
 safety observation;
 accident investigation.
Follow-up and Review of a Job Safety Analysis
is essential to establish a follow-up and review process for monitoring the effectiveness
the preventive measures implemented following JSA. This is done to:
 ensure new hazards have not been created;
 seek feedback from employees performing the job;
 ensure employees are following the procedures and practices required by the JSA;
 assess need for a repeat JSA; and
 implement continuous improvement.
Periodic review (e.g., annually) is useful to ensure components of the JSA remain current
and functional, and that employees are following the procedures and practices as recom-
mended by the JSA.

A need for a repeat JSA may arise when:

a new job is created;

an existing job is changed; or

equipment or process is changed.

The economic benefits of JSA include:

reduced direct/indirect costs of accidents;

improved quality and productivity; and


d) Extreme weather and wind conditions.

Falling objects from a damaged tower.


a) De-energise the tower unless tests have been made which show that no significant

electric charge is induced in the equipment and materials. Use grounded equipment mate-

rials while working near energised towers.

b) Do not bring flammable and combustible materials near towers.

c) Locate people and materials away from areas of falling objects.

 increased employee morale and pride. The time and effort involved in JSA is an
increased employee morale and pride.
The time and effort involved in JSA is an investment to control injury, property damage,
and loss of production.
JSA Example. Working at heights on communication towers.
(Using the energy-barrier approach)
JOB: Working at heights on communication towers.
Analysed by: John Supervisor and Marie Worker Date: 5 May 2002
Reviewed by: Kate Expert Date: 1 June 2002
Approved by: Co-Chairs Health and Safety Committee Date: 5 June 2002
Sequence of Tasks Potential Hazards
(Energy type & contact) Preventative Measures
1. Assess and prepare work site.
a) Burns and electric shocks from induced electrical charge in equipment and materials by
electromagnetic field (EMF) from the antenna.
b) Fire hazard from sparks caused by EMF.

d) Snow, strong winds and rain add additional hazards. Postpone non-emergency work

during such weather.

2. Climb up the tower.


a) Potentially fatal falls from great heights.

b) Exposure to cold/rain.

c) Being hit by the repair equipment and material hoisted by the crane.


a) Use adequate fall protection and work positioning system, i.e., harness, belt, safety


b) Wear adequate clothing to protect from cold and rain.

c) Stay away from materials being hoisted.

Develop procedures for bad weather conditions.

3. Climb down the tower.


a) Being hit by falling objects left on the tower by mistake.


a) Ensure that all tools, equipment and materials are secured before coming down the


2.14 Task Analysis. Summary Task analysis is what a user is required to do in
2.14 Task Analysis.
Task analysis is what a user is required to do in terms of actions and/or cognitive proc-
esses to achieve a task.
A detailed task analysis can be conducted to understand the current system and the infor-
mation flows within it. These information flows are important to the maintenance of the ex-
isting system, and must be incorporated or substituted in any new system.
Task analysis makes it possible to design and allocate tasks appropriately within the new
system. The functions to be included within the system and the user interface can then be
accurately specified.
Provides knowledge of the tasks that the user wishes to perform. Thus it is a reference
against which the value of the system functions and features can be tested.
Task decomposition
The aim of 'high level task decomposition' is to decompose the high level tasks and break
them down into their constituent subtasks and operations. This will show an overall struc-
ture of the main user tasks. At a lower level, it may be desirable to show the task flows,
decision processes and even screen layouts (see task flow analysis, below).
The process of task decomposition is best represented as a structure chart (similar to that

used in Hierarchical Task Analysis). This shows the sequencing of activities by ordering them from left to right.

In order to break down a task, the question should be asked 'how is this task done?' If a sub-task is identified at a lower level, it is possible to build up the structure by asking 'why is this done?'

The task decomposition can be carried out using the following stages:

1. Identify the task to be analysed.

2. Break this down into between four and eight subtasks. These subtasks should be speci-

fied in terms of objectives and, between them, should cover the whole area of interest.

3. Draw the subtasks as a layered diagram, ensuring that it is complete.

4. Decide upon the level of detail into which to decompose. Making a conscious decision at

this stage will ensure that all the subtask decompositions are treated consistently. It may

be decided that the decomposition should continue until flows are more easily represented as a task flow diagram.

5. Continue the decomposition process, ensuring that the decompositions and numbering

are consistent. It is usually helpful to produce a written account as well as the decomposi- tion diagram.

6. Present the analysis to someone else who has not been involved in the decomposition

but who knows the tasks well enough to check for consistency.

2.15 Task Flow Diagrams. Task flow analysis will document the details of specific tasks. It
2.15 Task Flow Diagrams.
Task flow analysis will document the details of specific tasks. It can include details of inter-
actions between the user and the current system, or other individuals, and any problems
related to them.
Copies of screens from the current system may also be taken to provide details of interac-
tive tasks.
Task flows will show not only the specific details of current work processes but also areas
where task processes are poorly understood, are carried out differently by different staff, or
are inconsistent with the higher level task structure.
Many of the day-to-day behaviours in which we engage without even thinking about them
are really quite complex, comprising many smaller, discrete, singular, specific sub-
behaviours that we perform in a certain order.
Consider one behaviour done easily even when you are tired and distracted: Brushing your
When you think about it (which we rarely do), brushing is really a series of distinct simple
behaviours performed one after another:
Pick up the tooth brush.

Wet the brush.

Take the cap off the tube.

Put paste on the brush.

Brush the outside of the bottom row of teeth.

Brush the outside of the top row of teeth.

Brush the biting surface of the top row of teeth.

Brush the biting surface of the bottom row of teeth.

Try to make yourself understood while answering the question of someone outside the door.

Brush the inside surface of the bottom row of teeth.

Brush the inside surface of the top row of teeth.


Rinse the brush.

Replace the brush in the holder.

Grasp cup.

Fill cup with water.

Rinse teeth with water.


Replace cup in holder.

Wipe mouth on sleeve.

Screw cap back on tube.

Place tube back in room mate's toiletry/shave kit so s/he doesn't realise that you forgot to bring toothpaste on the trip.

While you may brush your teeth in a different order (and leave out the sleeve part), you get the idea.

For example, the first step, "picking up the toothbrush" requires the behaviours of locating the toothbrush, reaching toward it, grasping it, turning the bristles upward, etc.

How small you decide to make the steps will depend on your best guess as to how well the student/employee will be able to understand the Task Analysis process and the sequential steps. Some individuals will display the desired behaviour after only five steps being pro- vided for them to follow. Others would need twenty increments in order to become compe- tent in that action.

The process of breaking a complex behaviour (a chain of simple behaviours that follow one another) down into its component parts takes a little practice, but soon you'll be able to construct behaviour chains for the easier-to-analyse motor skills, followed by the more dif- ficult-to-delineate academic and social behaviours.

2.16 HTA (Hierarchical Task Analysis). Hierarchical Task Analysis is a task analysis technique that breaks
2.16 HTA (Hierarchical Task Analysis).
Hierarchical Task Analysis is a task analysis technique that breaks down complex tasks in
a hierarchical manner.
The idea behind this is that complex tasks can be broken down into their constituent ele-
ments in an ordered fashion.
Hierarchical Task Analysis separates the steps of a task (process) performed by a user,
viewed at different levels of detail. Each step can be decomposed into lower-level sub-
steps, thus forming a hierarchy of sub-tasks.
The highest level of detail might be something like:
open the word processor -> type your document -> print it -> quit.
However, opening a word processor is not a one-step process. It might break down into
something like:
locate the word processing application icon -> click on the icon -> select Open from the

File menu.

The resultant task description can be used to help understand user requirements regarding interface design, allocation of duties, development of user support documentation and training.


The figure below distinguishes three types of risk that require very different approaches to risk management:

Virtual risks are products of the imagination that work upon the imagination. They may or may not be real, but they have real consequences.

Directly Perceived Risks. Directly perceptible risks, such as climbing a tree, riding a bike, driving
Directly Perceived Risks.
Directly perceptible risks, such as climbing a tree, riding a bike, driving a car, or crossing
the road, are examples of risks that we deal with instinctively.
The ability to manage risk effectively is an attribute that is rewarded by evolution - and in-
tuitively, we do not undertake a formal risk assessment before we cross the road.
Risks Perceived Through Science.
Risks perceived through science are risks that cannot be seen by the naked eye. Cholera,
for example, can only be seen through a microscope by someone with a scientific training
that enables them to understand what they are looking at.
A wide range of sciences, pure and applied, is involved in the perception and management
of risks in this category.
Epidemiology and actuarial science assist both in the identification of probable causes of
disease and accidents, and in devising strategies for containing them.
Astronomers, meteorologists, mathematicians, geneticists, statisticians, engineers and
general practitioners are amongst the many science-based professions that have played a
significant role in risk detection and management. They have considerable achievements
to their credit. The Health and Safety Executive relies upon them heavily.
Virtual Risk.
Virtual risks are risks about which scientists are perceived or portrayed to be in dispute.
They range from unconfirmed scientific hypotheses derived within conventional science,
through speculations by "alternative" specialists (e.g. various dietary theories of illness),
popular fears (e.g. living under power lines causes cancer), superstitions (e.g. ladders and
black cats), to theological speculations (e.g. misfortune is punishment for sin).
A few of these perceived risks obdurately persist in the face of refutation by conventional
science. However, there are some who, for whatever reason, choose either to disregard or
disbelieve available evidence on risk and it is these people who cause the greatest difficul-
ties for regulators such as the HSE. If people do not believe that the scientfic method can
settle the issue, their attitude frees them to argue from their established beliefs, convic-
tions, prejudices and superstitions.

Question 5.


Job Safety Analysis, change analysis helps establish the significance of changes in

causing accidents and losses. It also helps determine counter-changes to prevent these

accidents and losses.

Change is needed for improvement, but the change may have unwanted side effects. Changes can
Change is needed for improvement, but the change may have unwanted side effects.
Changes can be planned or unplanned. Sometimes, preventive changes can cause prob-
lems if not introduced properly.
But whose theory is this?
Multiple Choice
Answer 1:
Kepner and Tregoe method
Response 1:
Jump 1:
Next page
Answer 2:
Gibson and Haddon approach
Response 2:
Jump 2:
This page
3.0 Evaluation of Risk
Types of Risk Assessment
Risk assessment is a process in which hazard, and risk exposure are evaluated. These
evaluations determine whether an exposed population is at greater-than-expected risk of
injury, and/or ill-health, or whether there will be equipment and machinery damage that
leads to lost production etc.
Once this is established, the magnitude and nature of the increased risk can be explored
further, using either qualitative or quantitative approaches.
Qualitative risk assessments are generally descriptive and indicate that disease or injury is
likely or unlikely under specified conditions of exposure. On the other hand, quantitative
risk assessments provide a numerical estimation of risk based on mathematical modelling.
For example, under specific exposure conditions, it is expected that one person per 1,000
would develop an occupational disease or injury.
Quantitative Risk Assessment

Quantitative Risk Assessment (QRA) is a formalised, specialist method for calculating nu- merical individual, environmental, employee and public risk level values for comparison with regulatory risk criteria. Satisfactory demonstration of acceptable risk levels is often a requirement for approval of major hazard plant construction plans, including transmission pipelines, offshore platforms etc. Each demonstration must be reviewed periodically to show that risks are controlled to an acceptable level according to applicable legislation and internal company governance re- quirements.

Quantitative risk assessment is a method of estimating the magnitude of risk. It provides a degree of objectivity, and a facility for ranking risks and priorities. It does however involve some degree of subjectivity as they rely to a certain extent on past events and/or experi- ence.

An example is the hazard rating number system, which involves quantifying:

1. the probability of exposure to the hazard; 2. the frequency of exposure to the hazard;

3. the number of persons at risk;

4. the maximum probable loss.

For each of these factors a short table assigns numerical values to various descriptive phrases i.e. the probability of exposure to/contact with hazard factor has a table which ranges from 0 (impossible) to 15 (certain). The values assigned to each factor are also weighted depending on their relevancy, and the hazard rating number is arrived at by multiplying the four figures together. The answer (hazard rating number for that risk) is then related to a table which ranges from acceptable risk to unacceptable risk.

Qualitative Risk Assessment

Qualitative risk assessment has its roots in the beginning of human history. For example, people
Qualitative risk assessment has its roots in the beginning of human history.
For example, people observed that human exposure to particular plants, such as hemlock,
led to adverse health effects. In addition, they noted that some beneficial materials, such
as wine, had adverse effects when taken in excess.
As a result, they recognised both qualitatively and quantitatively that some products of the
environment posed risks. In the main, the effects they noted were those that occurred al-
most immediately. Long-term effects were difficult to discern, especially when life spans
were short and other health problems, particularly infectious diseases, were more preva-
3.1 Grouping Hazard Effects.
Hazard Effects can be grouped as such:
Immediate Physical Danger…
…can manifest itself through very short
term injury accidents. The result of
immediate physical danger will inevitably be
immediate physical injury.
Long term Physical Danger…
…is more cumulative or chronic than acute
or short term. Cumulative back strain
caused by poor handling techniques is an
Immediate Chemical Danger…
…may be caused by strong acids and
alkalis being poorly stored and handled and
therefore leading to risk of skin cancer or
corrosive burns etc.
Long Term Chemical Exposure…
…is again chronic or cumulative, for
example, lead poisoning or exposure to
asbestos fibres.
Immediate Biological Danger…

…may be caused by the presence of contagious diseases or via genetic manipulation resulting in some form of occupational disease.

Long Term Biological Danger…

…is usually cumulative in nature, such as noise-induced hearing loss.

Immediate Psychological Danger…

…is linked to short term trauma (i.e. domestic illness, social or family problems) which impact upon the work performance through loss of concentration or stress- related symptoms.

Long Term Psychological Danger… …may be linked to fears connected with fear of failure or
Long Term Psychological Danger…
…may be linked to fears connected with
fear of failure or lack of job security which
result in symptoms such as loss of
concentration or stress related symptoms
which become more apparent over a longer
period of time.
Incident data are collected by the Health and Safety Executive under the Reporting of Inju-
ries Diseases and Dangerous Occurrence Regulations 1995, and is used to collate statis-
tics for the year. The Health and Safety Executive compiles an annual report that details
the year's reportable incidents in a number of ways.
The following can be found on the Health and Safety Executive website and details the
statistical breakdown of the accidents and incidents etc for the year 2004/2005:
"The Health and Safety Commission (HSC) has today published the latest statistics on
workplace injury and work-related ill-health in Great Britain.
'Health and Safety Statistics 2004/05' presents the top-level statistics, including reports on
progress against the targets set in the 'Revitalising Health and Safety' strategy.
Workplace fatal and non-fatal injury
For workplace injuries, the new figures include 2004/05 data on non-fatal injuries reported
by employers and others under RIDDOR ( Reporting of Injuries, Diseases and Dangerous
Occurrences Regulations), supplemented by self-reported injury statistics from the Labour
Force Survey (LFS).
Question 6.
which type of risk assessment is a formalised, specialist method for calculating numerical
individual, environmental, employee and public risk level values for comparison with regu-
latory risk criteria?
Multiple Choice
Answer 1:
Qualitative Risk Assessment
Response 1:
Jump 1:
Next page
Answer 2:
Quantitative Risk Assessment
Response 2:
Jump 2:
Next page
3.2 Main Features of the Injury Statistics.
The main features of the injury statistics are as follows:
Fatal injuries to workers
There were 220 fatal injuries to workers in 2004/05, a decrease of 7% on the 2003/04 fig-
ure of 236.
Around half occurred in two industries, construction (71) and agriculture, forestry and fish-
ing (42).
The rate of fatal injury to employees declined throughout the 1980s and 1990s. The rate
rose by 30% in 2000/01 and has dropped since then.

Reported non-fatal injuries 30,213 major injuries to employees were reported in 2004/05, a rate of 117.7 per 100,000. This was down 2% on the previous year. Over a third were caused by slipping and tripping. There were 120,346 other injuries to employees causing them to be off work for over 3 days, down 8% on 2003/04. Two-fifths were caused by handling, lifting or carrying.

Labour Force Survey and reporting of injuries The rate of reportable injury estimated from the Labour Force Survey (LFS) was 1330 per 100 000 workers in 2003/04 (3-year average), down by 7% on the previous year. Comparing this with the RIDDOR rate of reported major and over-3-day injuries, the level of reporting by employers was 47.6%, up from 43.0% in 2002/03.

Injuries to members of the public There were 361 fatal injuries to members of the public in 2004/05, down by 3% on the pre- vious year. Around two-thirds were due to acts of suicide or trespass on the railways. There were 14,321 reported non-fatal injuries to members of the public, an increase of 5% on 2003/04.

Work-related ill-health For work-related ill-health, there are new results from the Self-reported Work-related Ill- ness (SWI) Survey 2004/05. The statistics also draw on surveillance data from specialist doctors in The Health and Occupation Reporting network (THOR), claims for disablement benefit under the Department for Work and Pensions' Industrial Injuries Disablement Bene- fit (IIDB) Scheme, and deaths from mesothelioma and other occupational diseases.

The main features of the ill-health statistics are as follows:

Self-reported ill-health In 2004/05 an estimated two million people suffered from ill-health which they thought was work-related, lower than the level in 2003/04 (2.2 million).

Around three-quarters of the cases were musculoskeletal disorders (e.g. upper limb or back problems) or stress, depression or anxiety. Ill-health seen by specialist doctors

Each year between 2002 and 2004, an estimated 23,000 new cases of occupational or work-related illness were seen by disease specialist doctors and occupational physicians who reported to the THOR surveillance scheme. As with self-reported cases, mental ill-health and musculoskeletal disorders were the most common types of illness: each accounted for just under a third of the total.

Ill-health assessed for industrial injuries disablement benefit (IIDB) In each of the latest three years, an average of over 7,500 cases were assessed for IIDB. The largest categories were vibration white finger, carpal tunnel syndrome and respiratory diseases associated with past exposures to substances such as asbestos and coal dust. Asbestos-related and other fatal diseases Several thousand people die each year from diseases caused by past work exposures, including nearly 1,900 deaths in 2003 from mesothelioma, a cancer related to asbestos exposure.

by past work exposures, including nearly 1,900 deaths in 2003 from mesothelioma, a cancer related to

3.3 Progress on Fatal & Major Injuries

The Revitalising Health and Safety target for 2004/05 was to reduce the incidence rate of fatal and major injury by 5% from 1999/2000. The available sources indicate no clear change since the base year in the rate of fatal and major injury to employees. The target has therefore not been met.

Progress on work-related ill-health incidence

The Revitalising Health and Safety target for 2004/05 was to reduce the incidence rate of work-related ill-health by 10% from 1999/2000.

The evidence suggests that incidence has fallen for most major categories of work-related ill-health. Overall,
The evidence suggests that incidence has fallen for most major categories of work-related
ill-health. Overall, the 10% target has probably been achieved.
Progress on working days lost
The Revitalising Health and Safety target for 2004/05 was to reduce the number of working
days lost per worker due to work-related injury and ill-health by 15% from 2000-02.
There has been a significant fall in working days lost since the base period, possibly
enough to meet the 15% target''.
As you can see, the text shows a number of different ranges of statistical data on a na-
tional scale - some more shocking than others.
It is also important that you can obtain the incident rates applicable to your own organisa-
tion, as this too provides you with a more realistic and local view of the types of accidents
and incidents happening in your organisation - and in turn where your efforts, time and
money would be best served.
Accident Frequency Rate:
The formula below can be used to determine the Accident Frequency Rate for any time
period (month, year):
Number of lost time accidents x 100,000 / Number of man hours worked.
Incidence Rate
The formula below can be used to determine the Incidence Rate for any time period
(month, year):
Number of work related injuries x 100,000 / Average number of persons employed
Question 7.
Number of lost time accidents x 100,000 / Number of man hours worked.
What is the above calculation used to determine?
Multiple Choice
Answer 1:
Incident Rate
Response 1:
Jump 1:
This page
Answer 2:
Accident Frequency Rate
Response 2:
Jump 2:
Next page

3.4 The Balancing Act.

The Risk Thermostat The figure below presents a model of the risk-management balancing act:

Everyone has a propensity to take risks.

This propensity varies from one individual to another.

This propensity is influenced by the potential rewards of risk-taking.

Perceptions of risk are influenced by the experience of accident losses - one's own and others'.

Individual risk-taking decisions represent a balancing act in which perceptions of risk are weighed against propensity to take risk.

 Accident losses are, by definition, a consequence of taking risks; to take a risk
 Accident losses are, by definition, a consequence of taking risks; to take a risk is to
do something that has a probability of an adverse outcome; the more risks an indi-
vidual takes, the greater, on average, will be both the rewards and losses he or she
The model characterises risk-taking behaviour as governed by a risk thermostat, with
propensity to take risks representing the setting of the thermostat.
Some like it hot – racing car drivers, dangerous sports enthusiasts - and some like it cool –
a timid and cautious little old lady – but it is doubtful, for risks voluntarily assumed, that
anyone aspires to absolute zero – acknowledging both reality and the fact that a life
without risk would be unutterably boring.
Risk management, as represented by this model, is a form of cost-benefit analysis without
the £ signs. Both rewards and accidents come in a wide range of incommensurable
variables that resist reduction to a common denominator.
Institutions, however, also have risk thermostats, and their settings are frequently in
conflict with those of the people they seek to regulate. Imposed safety can be resented as
strongly as imposed risk.
3.5 Risk Assessment Process.
The Health and Safety at Work Act 1974, which spells out the HSE's obligations, con-
strains it to enforce a level of risk which is also in conflict with the risk levels that govern
societal concerns or the behaviour of most people.
Its guiding principle, ALARP (As Low As Reasonably Practicable), has been enshrined in
numerous legal precedents as follows:
"'Reasonably practicable' is a narrower term than 'physically possible', and implies that a
computation must be made in which the quantum of risk is placed in one scale and the
sacrifice involved in the measures necessary for averting the risk (whether in money, time
or trouble) is placed in the other, and that, if it be shown that there is a gross disproportion
between them – the risk being insignificant in relation to the sacrifice – the defendants dis-
charge the onus upon them. Moreover, this computation falls to be made by the owner (i.e.
defendant) at a point in time anterior to the accident."
(Judgement of Lord Justice Asquith in Edwards vs. National Coal Board, 1949, quoted in
(Barret & Howells 1993).
This judgement, with its reference to the placing of risk and sacrifice in scales, suggests
that for risk management to comply with the law, it must pursue a judicious balance. But
the legal requirement that the sacrifice, or the "benefits foregone" must be grossly dispro-

portionate to the quantum of risk incurred, is difficult to reconcile with the idea of risk man- agement as a balancing act.

3.6 The Balancing Act and Directly Perceptible Risks.

Attempts to regulate directly-perceptible risks voluntarily undertaken commonly encounter resistance from those whose behaviour they seek to regulate. Attempts to compel people to be safer than they voluntarily choose to be by criminalising self-risk can provoke a vari- ety of responses e.g. resentment, widespread flouting of the law, or risk transfer.

Seat belt laws provide examples of all three. They have infuriated civil libertarians, been widely
Seat belt laws provide examples of all three. They have infuriated civil libertarians, been
widely ignored in many jurisdictions, and in Britain, which has one of the highest compli-
ance rates in the world, shifted the risk of accidents from motorists to cyclists and pedes-
This is a most unpromising area for regulation.
Directly perceptible involuntary risks present a different problem. Motorists speeding
through residential areas clearly create a directly perceptible danger.
Risk, however, is a reflexive phenomenon. People living in such areas respond to the dan-
ger. In these areas, children are forbidden to cross the street, old people are afraid to
cross the street, and fit adults cross it quickly and carefully. The result is that these streets
often have good accident records – purchased at the cost of community severance. Peo-
ple on one side of the road do not know their neighbours on the other. And the good acci-
dent records are still interpreted by many road safety regulators as evidence that the roads
are safe, and therefore in need of no measures to calm the traffic. The reaction of local
residents can often be described as impotent rage.
Societal concerns about directly perceptible risks such as traffic are often highly polarised
– the freedom of motorists to drive as fast as they want is in direct conflict with the freedom
of children to play safely in the neighbourhoods where they live.
The freedom to control events in one's life is itself a jealously-guarded reward. Impositions
that infringe this freedom – whether in the form of regulations (imposed on the motorists)
or risks (imposed on children) are likely to encounter opposition.
In the workplace, the distinction between voluntary and involuntary risk is frequently
blurred, especially in intrinsically hazardous occupations such as fishing, scaffolding, deep-
sea diving or construction.
The job can be seen to impose risks, but except in conditions of slavery or dire economic
necessity, the job is voluntarily chosen, and within the job there is a certain amount of
choice about how best to meet its requirements.

A further complication is that hazardous jobs acquire a macho image and attract risk- seeking, or certainly not risk-averse, personalities.

Understanding risk-taking behaviour in such circumstances requires the deconstruction of the "safety cultures" of all the participants workers, employers, and regulators.


The Balancing Act and Risks Perceived Through Science.

Science can be brought to bear on problems of risk in two different ways:


directly, by seeking to explain the connections between cause and adverse effect,


actuarially, by projecting past accident histories into the future.

Both have their limitations. Where science is completely successful, it removes issues from debates about risk by converting probabilities into certainties. Genetic counsellors, for ex- ample, currently inform prospective parents about the probabilities of their progeny having certain genetic defects. Further progress in genetic science appears likely to turn many of these probabilities into certitudes. It can also shift risks into the directly perceptible category; if science discovers that a well is contaminated by cholera, it becomes possible to place a warning notice on it.

Where the best that science can do is estimate the probabilities attaching to future events, risk managers are still left with the job of converting them into judgements about what to do, and judgements involve values.

Being informed that there is a 1 in X probability of some complication arising if a pregnancy continues will lead some to choose abortion and others to continue.

At the time of the BSE-beef-on-the-bone crisis, the Government's decision to ban the sale of beef on the bone was accompanied by calculations that the ban would reduce the risk of CJD by one in many billions. The ban provoked vehement public debate.

The actuarial approach, while useful to insurance companies calculating next year's car insurance premiums, also settles few policy arguments.

Dose-response studies of the effect of toxins are a type of actuarial exercise in which evi- dence is gathered about the effects of different levels of exposure and projected as esti- mates of the effects of similar doses in the future.

In societies that can afford clean water, this kind of evidence is used to set water purity standards. But water with zero impurities piped to every home and garden would be unaf- fordable, and in poor societies standards are lower. Science permits better-informed de- bates about values, but is not a substitute for them.

Disputes amongst scientists about "safe" levels of everything from vitamins to radiation are common. Most remedies sold by modern pharmacies are therapeutic at some low level and toxic at much higher levels, and some scientists argue that this hormesis effect even applies to radiation.

Whenever we encounter such disputes amongst scientists, we enter the realm of virtual risk.

3.8 The Balancing Act and Virtual Risk. We do not respond blankly to uncertainty; we
3.8 The Balancing Act and Virtual Risk.
We do not respond blankly to uncertainty; we impose meanings upon it. These meanings
are virtual risks. Whenever scientists disagree or confess their ignorance, the lay public is
confronted with uncertainty. We all, scientists included, view risks through perceptual fil-
Even when uncertainty can be plausibly bounded by probabilities and error bands, different
people will perceive the probable consequences (the potential rewards and accidents re-
sulting from their choices) differently.
The greater the degree of uncertainty, the more influential become the filters.
These filters are the product of all previous experience. In science, virtual risks are often
referred to as unconfirmed hypotheses, and the perceptual filters are sometimes called

The delayed discovery of the Antarctic ozone hole provides an example of the effect of such filters. The existence of the hole was masked by a computerised perceptual filter. US satellites failed to pick up early indications of the hole because programmers had in- structed the satellite computers to reject data outside a specified range as errors.

As a result, evidence of the hole was discarded as untrustworthy data (Benedick 1991). What people, scientists and non-scientists alike, believe about virtual risks depends on whom they believe and whom they believe depends on whom they trust.

Our filters help us make sense of the world by reducing its uncertainty and complexity to manageable proportions.

The construction and operation of our filters are influenced by:

psychology (personalities vary in the amount of risk they seek or tolerate),

economics (monetary costs and benefits can be powerful motivators),

ideology (conceptions of fairness influence judgements about risk)

biology (hormones are often invoked to explain male/female differences in risk aversion), and

culture (the influence exerted on your beliefs by the people with whom you associ- ate).

In our attempt to understand societal concerns about risk, we will focus on the role of cul- ture in the shaping of perceptual filters.

3.9 A Typology of Perceptual Filters. The figure below presents a typology of perceptual filters.
3.9 A Typology of Perceptual Filters.
The figure below presents a typology of perceptual filters. This typology brings a degree of
order and understanding to debates about risk, which otherwise appear to be incoherent
Firstly, the above figure presents a typology of four "myths of nature" that encapsulates
various preconceptions about the world that guide decisions made in the face of uncer-
Each of the four myths is illustrated by the behaviour of a ball in a landscape, and each
myth is associated with a distinctive risk-management style.
Nature benign is represented by a ball in a cup: nature, according to this myth, is predict-
able, bountiful, robust, stable, and forgiving of any insults humankind might inflict upon it.
However violently it might be shaken, the ball comes safely to rest in the bottom of the ba-

Nature is the benign context of human activity; it is resilient and able to recover from hu- man exploitation, not something that needs to be carefully managed. The risk manage- ment style associated with this myth is relaxed, exploitative and laissez-faire.

Nature ephemeral is represented by a ball balanced precariously on an over-turned cup:

here, nature is fragile, precarious and unforgiving. It is in danger of being provoked by hu- man greed or carelessness into catastrophic collapse. The objective of management is the protection of nature from Man. People, the myth insists, must tread lightly on the earth. The guiding risk-management rule is the precautionary principle.

Nature perverse/tolerant: this is a combination of modified versions of the first two myths. Within limits, nature can be relied upon to behave predictably. It is forgiving of modest shocks to the system, but care must be taken not to knock the ball over the rim. It needs scientific expertise to determine where the limits are, and regulation to ensure that they are

not exceeded, while leaving the system to look after itself in minor matters. This is the ecologist's equivalent of a mixed-economy model. The risk-manager's style is intervention- ist.

Nature capricious: nature is unpredictable. The appropriate management strategy is again laissez-faire, in the sense that there is no point to management.

Where adherents to the myth of nature benign trust nature to be kind and generous, the believer in nature capricious is agnostic; the future may turn out well or badly, but in any event, it is beyond his control.

These myths of nature, together with the distinctive management styles they justify and render "rational", are supportive of characteristic social solidarities.

Individualists are enterprising "self-made" people, relatively free from control by others, and who strive to exert control over their environment and the people in it.

Their success is often measured by their wealth and the number of followers they com- mand. They are enthusiasts for equality of opportunity and, should they feel the need for moral justification of their activities, they appeal to Adam Smith's Invisible Hand that en- sures that selfish behaviour in a free market operates to the benefit of all.

The self-made Victorian mill owner or present-day venture capitalist would make good rep- resentatives of this category. They oppose regulation and favour free markets. Nature, ac- cording to this perspective, is to be commanded for human benefit.

Egalitarians have strong group loyalties but little respect for externally imposed rules, other than those imposed by nature. Human nature is or should be co-operative, caring and sharing. Trust and fairness are guiding precepts and equality of outcome is an important objective. Group decisions are arrived at by direct participation of all members, and lead- ers rule by the force of their arguments.

The solution to the world's environmental problems is to be found in voluntary simplicity. Members of religious sects, commands, and environmental pressure groups all belong to this category. Nature is to be obeyed.

Hierarchists inhabit a world with strong group boundaries and binding prescriptions. Social relationships in this world are hierarchical, with everyone knowing his or her place. Mem- bers of caste-bound Hindu society, soldiers of all ranks and civil servants are exemplars of this category. The hierarchy certifies and employs the scientists whose intellectual author- ity is used to justify its actions. Nature is to be managed.

Fatalists have minimal control over their own lives. They belong to no groups responsible for the decisions that rule their lives. They are non-unionised employees, outcasts, refu- gees, untouchables. They are resigned to their fate and see no point in attempting to change it. Nature is to be endured and, when it's your lucky day, enjoyed.

3.10 Robust Risk Management. The Insightful Hierarchist The HSE, by statutory definition, plays the role
3.10 Robust Risk Management.
The Insightful Hierarchist
The HSE, by statutory definition, plays the role of hierarchist in the typology set out in the
previous section.
It is charged with safeguarding the collective welfare, and its behaviour is prescribed by
legislation. But this prescription gives it considerable discretion.
The legislation does not define the words in its central mantra "As Low As Reasonably
Practicable'' (ALARP). In the exercise of its prescribed duties, it must cope with the other
perspectives. It must deal with groups and individuals who define these words in very dif-
ferent ways. If it were to behave in a rigidly autocratic and top-down fashion, it would an-
tagonise these other perspectives. If it were to ally itself to only one, to the exclusion of the

others, the antagonism of those excluded would be likely to be even stronger.

The HSE cannot escape its hierarchical obligations, but if it is to exercise them effectively and efficiently it must seek to maximise the goodwill and co-operation of all whose activi- ties it is charged with overseeing.

It must, in graphic terms, rise as high as possible on the insight axis above.

On the surface of this diagram, especially in the presence of virtual risks, one encounters mutually uncomprehending dogma.

The higher participants in a risk debate can rise above the fray on the ground, the better understanding they will have of the beliefs and convictions of the other participants, and the better equipped they will be to engage in a mutually comprehending discussion.

Incorporating Societal Concerns into Risk Management

The HSE's interest in "societal concerns" - what they are, and how they can be taken into account - parallels the growing consensus that public perceptions should be included in the assessment of risk.

This is a major (indeed, paradigmatic) shift. It signals the prospect of reconciliation, after 30 or so years of mutual repulsion, between two schools of risk thought: the objectivists and the constructivists.

Each school used to keep itself pure and united by its steadfast rejection of the other. Now both face a quite different challenge: to understand just what is entailed in the "growing consensus" to which they are increasingly committing themselves.

There have been two responses to the proposition that public perceptions should be in- cluded in the assessment of risk. The first response suggests elements of the old debate linger on. It argues that "societal concerns", once understood, can somehow be "factored in'' or "bolted on'' to existing methodologies and policy practices (by the introduction of various "weighting factors'', for instance).

3.11 The Required Change of Approach. A new consensus about how to manage risks will
3.11 The Required Change of Approach.
A new consensus about how to manage risks will require the abandonment of objectivism -
the idea that we can clearly distinguish between what the risks really are and what people
variously and erroneously believe them to be.
It will have to give way to constructivism – the idea that risk is inherently subjective: some-
thing that we project onto whatever it is that is "out there".
Risk is a word that refers to the future. It exists only in our imaginations – informed of
course by experience. Sometimes, there may be little divergence between projections of
past experience and actual outcomes – in which case, actuarial or science-based ap-
proaches to risk management can be helpful.
Two careful steps are involved.
First, we need to recognise that the imposition of a single definition of what the problem is,
which is what so much of policy analysis and science-for-public-policy does, is to exclude
all those who happen not to share that way of framing things.
Since people are unlikely to be whole-heartedly in favour of a policy that is aimed at solv-
ing what they do not see to be the problem, approaches that insist on singularity will inevi-
tably be low on consent, surprise-prone, trust-sapping, brittle, erosive of technological
flexibility, undemocratic, and unreflective.
Second, we need to recognise that to embrace constructivism is not to reject science. In-

deed, the proponents of each diagnosis would soon lose credibility if they did not support their arguments with good science, or, in the case of virtual risks, with plausible, scientifi- cally-framed hypotheses. Nor does this embracing of constructivism lead us into the rela- tivistic morass of post-modernism, in which anything goes (and in which anything that goes can go with anything else that goes).

Each of the four perceptual filters is supportive of a particular form of social solidarity and,

at the same time, undermining of the other three. Put another way, those solidarities are

self-organising, in the sense that each is all the time defining itself against the others.

3.12 Typology-Based Discourse Analyses. If people were to be unresponsive to risk-management measures, when a
3.12 Typology-Based Discourse Analyses.
If people were to be unresponsive to risk-management measures, when a policy interven-
tion is made, they would simply carry on as before, with the intervention modifying the ex
ante outcomes.
This assumption of unresponsiveness underlay, for instance, the now notorious claim prior
to the introduction of seat-belt legislation in Britain that the measure would save "1,000
lives a year". The new risk compensation phenomenon suggests that we should expect a
behavioural response to any measure that alters either the costs or the benefits of risk-
taking decisions.
Risk compensation is an effect whereby individual people may tend to alter their behaviour
in response to perceived changes in risk. It is seen as self-evident that people will tend to
behave in a more cautiously if their perception of risk or danger increases. The converse
is, of course, true – with an increased feeling of safety or protection, the perceived need for
caution decreases and riskier behaviour can be expected.
The Peltzmann effect is a hypothesised tendency of people to react to a safety regulation
by increasing other risky behaviour, offsetting some or all of the benefit of the regulation. It
is named after Sam Peltzmann, a professor of economics at the University of Chicago
Booth School of Business, who has conducted studies into risk compensation.
It is not just the field of road safety that abounds with examples, although that area yields a
good supply of examples. For instance, when bends in the road are straightened and sight
lines lengthened, traffic goes faster; there is suddenly no longer a need to apply care and
attention since the hazards have, apparently, been removed.
When antilock brake systems (ABS) first appeared, insurance companies acknowledged
their superior stopping power with reduced premiums. But, as the claims experience ac-
cumulated, the reduction in accidents expected by the underwriters failed to materialise,
and the discounts were withdrawn.
In three experiments – one with a fleet of taxis in Munich (Sageberg, Fosser and Saetermo
1997), another for the Canadian ministry of Transport (Grant and Smiley 1993) and a third
carried out in Denmark (Aschenbrenner and Biehl 1994), the cars fitted with ABS brakes
were driven not as safer cars but as higher-performance cars.

These studies show that drivers' response to antilock brakes is to driver faster, follow closer and brake later, accounting for the failure of ABS to result in any measurable im- provement in road safety.

A study published in the March 2007 issue of Accident Analysis and Prevention stated that

drivers drove an average of eight and a half centimetres closer and came within one metre

23% more often when a cyclist was wearing a helmet.

Ski helmets have been shown to bestow no additional safety benefit; despite the wearing of helmets increasing to 40% of all skiers by 2008, the statistics showed that there had been no change in fatalities over the preceding ten years. In fact, there is evidence to

show that helmeted skiers tend to go faster.

When the offsetting risky behaviour encouraged by the safety regulation has negative ef- fects, the Peltzmann effect can result in redistributing risk to innocent bystanders who would behave in a risk-averse manner even without the regulation. For example, if some drivers with a high tolerance for risk who would not otherwise wear a seatbelt respond to a seatbelt law by driving less safely, there will be more total accidents. Overall injuries and fatalities may still decrease due to a higher percentage of drivers involved in accidents wearing seatbelts, but drivers who would wear seatbelts regardless will see their overall risk increase. Similarly, safety regulations for cars may put pedestrians or cyclists in more danger by encouraging risky behaviour in drivers without offering additional protection for pedestrians and cyclists.

In 1981, John Adams published a paper that studied road accident fatality statistics from eighteen countries, and this showed that in the countries studied, which included states with and without seatbelt laws, there was no correlation between the passing of seatbelt legislation and reductions in injuries and fatalities. This paper was published at a time when Britain was considering a seatbelt law, so the Department of Transport commissioned a report which broadly agreed with that of Adams. The law was passed and subsequent figures showed some reduction in fatalities; however, no conclusions could be drawn from this as it coincided with the introduction of evidential breath testing.

Studies into the effect on driving styles of belted and unbelted drivers have shown that drivers tended to drive faster and less carefully when belted.

However the parliamentary debate that preceded the passage of Britain's seatbelt law shows that people reacted very differently to the proposed legislation in ways neatly cap- tured by the cultural theory typology. In other words, they were plurally responsive.

Prior to the passage of the law in 1981, there had been numerous debates in parliament. The principal protagonists were individualists who opposed the criminalisation of self-risk and saw the proposed law as an infringement of personal freedoms, and hierarchists who argued that preservation of life should take precedence over the preservation of freedom.

The hierarchists dubbed their opponents "loony libertarians" and they returned the compli- ment by referring to their opponents collectively as "the Nanny State."

The egalitarians did not see an issue that interested them until, rather late in the day, evi- dence emerged that after the passage of seatbelt laws in a number of countries, more pe- destrians and cyclists were being killed; the extra protection that seatbelts afforded motor- ists was producing a change in driving behaviour that was shifting the burden of risk from the well-protected motorist onto the most vulnerable road users. Belatedly too late to make a difference to the legislative outcome - cycling and pedestrian lobbies joined the debate on the side of the libertarians.

Plural responsiveness to risk requires one to set aside the economist's objective functions and search for optimisation, and focus instead on discourses and negotiation between the inherently incompatible sets of values and beliefs that are part-and-parcel of those dis- courses.

The Brent Spar saga provides another example.

Above:The Brent Spar oil storage buoy

Shell (the individualist actor) left to its own devices, would simply have weighed the differ- ent options and then gone ahead with the oil storage structure's burial at sea, the assump- tion being that the deep ocean can take pretty well anything we throw at it: the myth of Na- ture Benign.

sea, the assump- tion being that the deep ocean can take pretty well anything we throw

But Shell was subject to regulation and had first to satisfy the British government (playing the hierarchist) that this option did not threaten to push the ocean ecosystem beyond its stability limits: Nature Perverse/Tolerant.

In the event, both actors were able to agree that this option was innocuous, only to be met, at the eleventh hour, by Greenpeace (acting the part of the egalitarian) which saw this ecosystem as much more precarious than did either Shell or the British government, and was therefore unwilling to allow any safe limits: Nature Ephemeral.

Those the fatalists who found themselves marginalised by all three of the other forms of solidarity (totally convinced by whoever they happened to last see arguing the case on television), were not able to take up any position. And, anyway, what would have been the point if nature operates without rhyme or reason?

3.13 Nature Capricious? Nature, in consequence, is not something neutral "out there" that science steadily
3.13 Nature Capricious?
Nature, in consequence, is not something neutral "out there" that science steadily uncov-
ers for us all. Rather, it is a moral resource that each solidarity both constructs and ex-
ploits. And each of the Brent Spar actors (apart from the fatalists, who had better things to
do) was supported by its serried ranks of PhDs, each platoon uncovering a different nature
and publishing their findings in the respectable, peer-reviewed journals.
The British government, caught off balance by the vehemence of the environmentalist pro-
test, sought to re-impose its authority by conceding that its original scientific advice had
been flawed (in not taking account of the subsequent deep-sea disposals that this initial
decision had opened the way for) thereby bringing the reality (Shell had cancelled the
agreed-on disposal plans once motorists, in Germany in particular, had stopped buying its
petrol) back into line with its model of stability and change in nature (the subsequent dis-
posals, it argued, would have pushed things beyond the limits).
And, in the subsequent negotiations between Shell and Greenpeace (which ultimately re-
sulted in their agreeing to the Brent Spar being cut up into cylindrical sections to form a
pier extension in Norway), each clung ferociously to its myth of nature: Shell insisting that
deep-sea disposal be included in the list of options to be negotiated and Greenpeace in-
sisting that it not be entertained at all.
With myths of nature linked to forms of social solidarity in this way, all sorts of other crucial
(and moral) concerns – harm, blame, consent, discount rate, to mention but a few – shape
up very differently: pitting the solidarities against one another and ensuring that, even
when agreement is reached (as it was with the Brent Spar), disagreement does not disap-
pear. And nowhere is this disagreement more evident than in the definitions of what is fair.

Market actors believe in equality of opportunity (which distances them from hierarchical actors, who are anxious that status differences not be equalised) but then insist, like the little red hen, that it is only fair that those who put most in should get most out (which dis- tances them from the egalitarian actors, who believe in equality of outcome: fair shares are equal shares). "Not on this earth!" the fatalistic response to voiced concern about fair- ness helps to ensure that solidarity's voicelessness and, at the same time, distances it from the three active solidarities, each of which is exasperated by this refusal to be roused to the pursuit of justice (as defined by that solidarity).

With each solidarity insisting on its model of stability and change in nature, and with each crying `unfair´ to arguments that the others see as being suffused with justice, the deeply political debate is set to run and run.

Specific events the Brent Spar´s disposal, for instance may crop up and be sorted out but the discourses, each shaped in response to the viability requirements of the form of solidarity that generates it, and each honed by its daily contention with the others, are al- ways with us.

Discourse, therefore, is the key, and the policy challenge is, first, to understand its under- pinnings in the complex dynamics of the contending forms of social solidarity and, second, to harness that essential plurality into the design and redesign of our institutions.

Two new and crucial questions now arise.

First, what happens to our understanding of policy, and to our conventional and much re- lied-upon policy tool-kit, once we realise that it is discourse (and not the long-espoused single-metric rationality) that is the key?

Second, what sort of design criteria do we use in the harnessing of the plurality of rationali- ties that is revealed by our discourse analysis? The first question leads us to what is called the "argumentative turn"; the second brings us to "clumsy institutions".

3.14 The Argumentative Turn. The Argumentative Turn (Fischer & Forester 1993) is the title of
3.14 The Argumentative Turn.
The Argumentative Turn (Fischer & Forester 1993) is the title of a book which describes
the re-orientation of policy analysis and design required to make it "open to a variety of so-
lutions and scenarios that would give more weight to social priorities and local potentials"
(Hajer & Fischer 1999).
Modest though this aim might seem, it presents a serious challenge to the orthodox ap-
proach. This challenge would be strengthened if it were possible to specify the variety of
solutions and scenarios that must be entertained, and this is precisely what our approach
seeks to do.
Conventional models of the policy-process would have us believe that policy-making is a
rational activity. Policy-makers identify and select issues, filter out some and promote oth-
ers to the agenda, review all possible solutions, decide on the most efficient policy re-
sponse and, finally, implement this response.
Such a model (usually referred to as the 'synoptically rational' approach) tells us very little
about the overt and covert conflicts, the shifting alliances, and the creative uses of knowl-
edge and facts - about the politics we observe in real life policy-making.
Policy processes, apart from being rational approaches to solution design, are also social
processes. As such, politics and policy-making are also about the purposive manipulation
and deployment of symbols, claiming and blaming, persuasion and communication.
Policy-making does not take place in a social vacuum but rather emerges from a highly
complex web of social relations. Regardless of whether these are the relationships be-
tween individual politicians, within interest groups, between party members, or across
party divisions, policy actors are situated in a trellis of social ties that make up the political
The social networks both constrain and facilitate political action. On the one hand, policy
actors are limited by the formal and informal rules; on the other hand, it is precisely these
social structures that make policy action possible.

Policy-making, then, is a process based on shared values and norms that emerge from the social interaction of policy actors. These systematically and symbolically structured sets of ideas provide policy actors with the means to understand and make sense of policy events: policy actors evaluate political events by referring to these shared ideas, values and symbols.

Perception of policy issues is thus filtered through the different perceptual lenses our "cultural filters" that are provided by social relations. What is to count as political or non- political, as fact or value, as a key issue or a non-issue, is not an objective reality out there.

Rather, the significance of any political event, any particular issue, or even any political structure, emerges from policy actors' interpretations of political reality.

In short, policy actors socially construct the political world in which they operate: running

the maze and building it (in contrast to the behaviourists' rats that simply run the maze in which they are put). What is more, policy actors will use these social constructions to ex- hort, cajole, and persuade potential allies as well as to antagonise, scandalise, and intimi- date political rivals.

On this politics-accepting view, policy-making is an inherently communicative endeavour that follows a different logic from the synoptic rationality models. Communicative and sym- bolic resources are thus important elements of the policy process, and this realisation poses the question: how can we go about analysing them?

3.15 What is a Policy Argument? If communication, persuasion and the use of symbolism are
3.15 What is a Policy Argument?
If communication, persuasion and the use of symbolism are integral parts of the policy
process, understanding policy-making implies looking at its argumentative aspects.
There is now a substantial literature on this subject; contemporary theorists of the policy
process, such as (Dryzek 1997), (Majone 1985), (Fischer & Forester 1993), have pointed
to the argumentative, rhetorical and justificatory content of much of policy-making.
Policy formulation, policy planning, and even policy implementation, they maintain, emerge
from argumentative processes that conventional policy analysis has thus far ignored.
Paying attention to these communicative processes means taking seriously "the actual
performances of argumentation and the practical rhetorical work of framing analyses, ar-
ticulating them, [and] constructing senses of value and significance" (Fischer & Forester
1993). And this, we are arguing, is what we will have to do if we are to understand, and
take adequate account of, "societal concerns".
Rather than understanding policy-makers as problem-solvers who apply objective, scien-
tific, and value-free methods to cure society's ills, advocates of the argumentative turn
suggest we think of policy-makers as performers who seek to persuade an audience. In
order to convince other policy-makers and the public, participants in the policy process use
political symbols to construct credible and persuasive policy arguments.
A policy argument, in consequence, tells a story: it provides a setting, points to the heroes
and villains, follows a plot, suggests a solution, and, most importantly, is guided by a
Since policy arguments are designed to persuade, they are necessarily value-oriented. Yet
this does not mean that policy arguments are mere opinion. Policy arguments explicate
problems by recourse to rational methods: logic, consistency, and objectivity in terms of
argumentative performance.
Policy arguments are successful, not because they are based on an objective standard,
but because they persuade. Of course, the fact that some policy arguments are based on
a method that is widely viewed as credible may itself be compelling: economic forecasts

based on sophisticated econometric models are at present more plausible than financial predictions based on astrological star-charts.

The policy argument approach looks at the effects of discourse on policy-making.

In doing so, it introduces both a reflexive and a critical element into policy analysis. Focus-

ing on the rhetorical performance of the policy argument enables the analyst to step back from substantial policy-issues to move up the insight axis and discern how and why a policy argument accrues credibility. It allows us to understand why certain types of policy argument are marginalised and why others achieve dominance: a policy argument that can muster sufficient levels of credibility will be able to dominate a policy debate.

Once the notion of credibility is thematised, the analyst can raise issues of political legiti-

macy: this is the element of criticism in argumentative analysis.

The argumentative approach recognises that credible policy arguments are not necessarily legitimate: rationality and objectivity are not sufficient conditions for a policy argument to secure credibility, nor are they always necessary.

Credibility is not an absolute quality of a policy argument; it depends on the rhetorical per- formance of policy-actors, the internal logic of the policy storyline, the normative orienta- tions of the policy audience, and actual power relations in the public sphere.

By teasing out policy arguments, we are able to scrutinise both the cognitively rational (ob- jective) and the communicatively rational (normative) components of policy debates.

The policy argument approach implies that every policy story not only gives us an interpre-
The policy argument approach implies that every policy story not only gives us an interpre-
tation of the "facts" concerning any given issue complex but also is guided, implicitly or ex-
plicitly, by a particular vision of the world: policy arguments always follow a moral agenda,
a set of "societal concerns".
3.16 A Typical Example - Global Climate Change.
An analysis of the global climate change policy debate in the mid-1990s reveals three pol-
icy stories. Each policy story provides a setting (the basic assumptions), villains (the policy
problem), heroes (policy protagonists), and, of course, a moral (the policy solution). De-
pending on the socio-institutional context of the particular policy actor, each story empha-
sised different aspects of the climate change issue.
What is more, each story defined itself in contradistinction to the other policy stories.
Profligacy: an egalitarian story. This story begins by pointing to the profligate consumption
and production patterns of the North as the fundamental cause of global climate change.
Rich industrialised countries, so the argument goes, are recklessly pillaging the world's re-
sources with little regard to the well-being of either the planet or the peoples of its poorer
regions. Global climate change is more than an issue that is amenable to quick technical
fixes; it is a fundamentally moral and ethical issue.
The setting for this story is a world in which everything is intricately connected with every-
thing else: Nature Ephemeral. Whether this concerns human society or the natural world,
this story urges us to think of Planet Earth as a single living entity.
Environmental degradation, then, is also an attack on human well-being. Humans, so the
argument goes, have, until now, successfully deluded themselves that they can live apart
from the natural environment. In reality, however, there is no place for humans outside na-
ture and thus no particular reason for considering humans as superior to nature. In short,
this story is set in an ecocentric world.

The villain in the profligacy story is the fundamentally inequitable structure of advanced industrial society. In particular, the profit motive and the obsession with economic growth the driving forces of global capitalism have not only brought us to the brink of ecological disaster, but aslo have distorted our understanding of both the natural and the social world.

Global commerce and the advertising industry lead us to desire environmentally unsus- tainable products (bottled water, fast cars, or high protein foods, for example) while our real human needs (living in harmony with nature and with each other) go unfulfilled. What is more, advanced capitalism distributes the spoils of global commerce highly inequitably.

This is true within countries (the increasing gap between the rich classes and the poor classes) and among countries (the increasing gap between the affluent countries of the North and the destitute countries of the South). In short, prevailing structural inequalities have led to increasingly unsustainable patterns of consumption and production.

Since everything is connected to everything else, this story continues, we cannot properly

understand environmental degradation unless we see it as a symptom of this wider social malaise.

The way humans pollute, degrade, and destroy the natural world is merely a very visible indicator for the way they treat each other and particularly the weaker members of society. The logic that allows us to fell thousands of square kilometres of rainforests, to dump tox- ins in waterways, or pollute the air is precisely the same logic that produces racism, mi- sogyny and xenophobia. Tackling one problem inevitably implies tackling all the others.

The heroes of the profligacy story are those organisations and individuals who have man- aged to see through the chimera of progress in advanced industrial society. They are those groups and persons that understand that the fate of humans is inextricably linked to the fate of Planet Earth.

The heroes understand that, in order to halt environmental degradation, we have to ad- dress the fundamental global inequities. In short, the heroes of the profligacy policy argu- ment are those organisations of protest such as, most prominently, Greenpeace or Friends of the Earth.

These organisations, we need hardly point out, are strongly biased towards the egalitarian social solidarity. What, then, is the moral of the profligacy story? Its proponents point to a number of solutions. In terms of immediate policy, the profligacy tale urges us to adopt the precautionary principle in all cases: unless policy actors can prove that a particular activity is innocuous to the environment, they should refrain from it. The underlying idea here is that the environment is precariously balanced on the brink of a precipice.

The story further calls for drastic cuts in carbon dioxide emissions; since the industrialised North produces most of these emissions, the onus is on advanced capitalist states to take action. Of course, this policy argument calls for a total and complete ban on chlorofluoro- carbons (CFCs).

Yet none of these measures, the story continues, is likely to be fruitful on its own. In order to really tackle the problem of global climate change, we in the affluent North will have to fundamentally reform our political institutions and our unsustainable life-styles.

Rather than professionalised democracies and huge centralised administrations, the advo- cates of the profligacy story suggest we decentralise decision-making down to the grass- roots level.

Rather than continuing to produce ever-increasing amounts of waste, we should aim at conserving the fragile natural resources we have: we should, in a word, move from the idea of a waste society to the concept of a conserve society. Only then can we meet real human needs.

What are real human needs? Simple, they are the needs of Planet Earth.

Population: a hierarchist story. This policy argument tells a story of uncontrolled population growth in the poorer regions of the world. Rapidly increasing population in the South, this story argues, is placing local and global eco-systems under pressures that are fast becom- ing dangerously uncontrollable: more people means more resource consumption which inevitably leads to environmental degradation.

The setting of the population policy story differs slightly, but significantly, from the settings in the other two diagnoses. Like the protagonists of the profligacy story, the population pol- icy argument maintains that global climate change is a moral issue.

Human beings, due to their singular position in the natural world, are the custodians of Planet Earth; since civilisation and technological progress has allowed us to understand the natural world more than other species, we have a moral obligation to apply this knowl- edge wisely.

Unlike the profligacy story, the population tale assumes that humans have a special status outside natural processes. The population story, like that of the proponents of the pricing

humans have a special status outside natural processes. The population story, like that of the proponents

argument (see next story), contends that human actions are rational.

However, unlike the pricing argument, the population story tells us that the sum of individ- ual rational actions can lead to irrational and detrimental outcomes. The population tory, then, is set in a world that needs rational management in order to become sustainable. Yet, while the motive of rational management is an ethical duty to preserve the planet, the means of management are technical.

Economic growth, and the socio-economic system that underpins that growth, are neces- sary components in any global climate change policy response.

However, economic growth in itself is no solution: it must be tempered, directed, and bal- anced by the careful application of knowledge and judgement.

Economic growth, far from being a problem, is the sole source of salvation from environ- mental degradation. Environmental protection, the proponents of this policy argument con- tend, is a very costly business. In order, then, to be able to foot the huge bill for adjusting to a more sustainable economy, societies will have to command sufficient funds. These funds, in turn, will not materialise from thin air: only economic growth can provide the nec- essary resources to tackle the expensive task of greening the economy.

In sum, the prices tale takes place in a world determined by the Invisible Hand. Here, indi- viduals know and can precisely rank their preferences. In the world of the prices story, in- dividual pursuit of rational self-interest (economic utility) leads, as if by magic, to the opti- mal allocation of resources.

If market forces are allowed to operate as they should, then resource prices will accurately

The villain in the population tale is uncontrolled population growth. Since each individual has a
The villain in the population tale is uncontrolled population growth. Since each individual
has a fixed set of basic human requirements (such as food, shelter, security, etc.) as out-
lined in Maslow's Hierarchy of Needs, and these needs are then standardised at every
level of socio-economic development, population increase - other things being equal -
must lead to an increase in the aggregate demand for resources.
Humans, the story insists, satisfy their basic human needs by consuming resources. It fol-
lows that population growth must lead to an increase in resource consumption: more peo-
ple will produce more carbon dioxide to satisfy their basic needs. Given the limited nature
of most resources, population growth must invariably lead to over-consumption and degra-
dation of natural resources.
The heroes of the population story are those institutions with both the organisational ca-
pacities (that is, the technical knowledge) and the "right" sense of moral responsibility. In
short, the global climate change issue should be left to experts situated in large-scale,
well-organised administrations. In terms of our typology of organisational types, the popu-
lation story emerges from hierarchically-structured institutions.
The moral of the population story is to rationally control population growth. In particular,
this means the introduction of family planning and education in the countries most likely to
suffer from rapid population growth. Here, the onus for action is quite clearly on the coun-
tries of the South. Rapid population growth has eroded societal management capacities; if
we are to tackle the global climate change issue, we must first establish the proper organ-
isational preconditions.
Prices: an individualist story. This story locates the causes of global climate change in the
relative prices of natural resources. Historically, prices have poorly reflected the underlying
economic scarcities; the result, plain for all to see, is a relative over-consumption of natural
The setting of the prices tale is the world of markets and economic growth. Unlike the prof-
ligacy story, the prices diagnosis sees no reason to muddy the conceptual waters with ex-
traneous considerations of social equality. Yes, it says, global climate change is an impor-
tant issue, but it is an issue that is amenable to precise analytical treatment. It is, in short,
a technical issue to which we can apply a technical discourse.

reflect underlying scarcities; the price mechanism then keeps environment-degrading con- sumption in check. However, if someone (usually the misguided policy-maker) meddles with market forces, prices cannot reflect real scarcities; this gives rise to incentives for ra- tional economic actors to over- or under-consume a particular resource.

The villain in the prices story is misguided economic policy. Barriers to international trade, subsidies to inefficient national industries, as well as price and wage floors, introduce dis- tortions to the self-regulatory powers of the market. These distortions have historically led markets to place a monetary value on natural resources that belies the true market value. The result, the protagonists of this policy argument maintain, has been wholesale over- consumption and degradation of the natural world.

The heroes of the prices story are those institutions that understand the economics of re- source consumption. In the global climate change debate, these institutions comprise players such as the Global Climate Coalition and trans-national energy companies. In terms of the cultural theory typology, the heroes of this story are those institutions that are strongly permeated by the individualist solidarity.

The moral of the prices story is as simple as its prognosis: in order to successfully face the challenge of global climate change, we have to "get the prices right". Unlike the profligacy story, the prices tale sees no necessity to restructure existing institutions. If it is the distor- tions of global, national and regional market mechanisms that undervalue natural re- sources then any climate change policy that fails to remove these distortions is "fundamen- tally flawed". Policy responses must work "with the market". Here, concrete policy propos- als consist of both general measures, such as the liberalisation of global trade, as well as more specific measures, such as carbon taxes or tradable emission permits.

There is, one should say, an alternative, rosier, version of the individualist's story that maintains that prices and markets are already working, and that either significant warming is not occurring or, if it is, that a free market's adaptive capacities will be able to cope.

In the present state of scientific knowledge, global warming is a virtual risk.

But even where there is agreement that it is taking place, there is no consensus about the seriousness of the problem or the policy prescriptions for dealing with it.

While the problem of global warming is not one that the HSE is expected to address, the global warming stories summarised above exemplify the societal concerns commonly found in the company of less grandiose risks.

Consequently, it is only by a teasing out of these sorts of policy arguments and their ad- herents that we can understand "societal concerns": how they are generated, how they are reproduced and transformed, and how they shape the policy process. This understanding has some important implications.

The three stories tell plausible but conflicting tales of climate change. All three tales use reason and logic to argue their points. None of the tales is "wrong", in the sense of being implausible or incredible. Yet, at the same time, none of the stories is completely "right"; each argument focuses on those aspects of climate change for which there is a suitable solution cast within the terms of a particular form of organisation.

These three policy discourses are not reducible to one another. No one of the policy argu- ments is a close substitute for the others. Nor are any of the stories proponents ever likely to agree on the fundamental causes of - and solutions to - the global climate change issue. And, since these stories implicitly convey a normative argument, namely that of the good life (either in enclaves, in hierarchies, or in markets), they are curiously immune to enlight- enment by "scientific" facts: we cannot, in any scientific sense, prove or falsify policy sto- ries.

These stories also define what sort of evidence counts as a legitimate fact, and what type of knowledge is credible. The profligacy story discounts economic theory as the obfusca- tion of social inequalities, and dismisses rational management as the reification of social

theory as the obfusca- tion of social inequalities, and dismisses rational management as the reification of

relations. The tale of prices views holistic eco-centrism as amateur pop-science and pours scorn on the naïve belief in benign control. Last, the population story rejects laissez-faire economic theory as dangerously unrealistic and questions the scientific foundations of more holistic approaches.

This leaves us with a dynamic, plural and argumentative system of policy-definition and policy-framing that policy-makers can ignore only at their cost, for two reasons.

First, each policy story, as we have seen, thematises a pertinent aspect of the climate change debate; very few would argue that Northern consumption habits, distorted prices, or population growth have no impact on global climate change at all. However, as we have seen, each story places a different emphasis on each aspect. Any global climate change policy, then, based on only one or two of these stories, will merely provide a response to a specific aspect of the global climate change problem. It will, in short, provide a partially ef- fective response.

This is a structural argument that concerns the implicit and explicit "rules" that govern pol- icy deliberation in a polity. If the "rules of the game" permit or even force policy actors to take seriously different types of stories, then what Sabatier and Jenkins-Smith call "policy- oriented learning" can take place. If this is not the case, then the policy debate will be an unconstructive dialogue of the deaf (Sabatier, Jenkins-Smith, & eds 1993).

Summarising all of the above, we have at one extreme an unresponsive monologue and at

the other a shouting match amongst the totally deaf. Between these extremes, we occa- sionally find a vibrant multivocality in which each voice puts its view as persuasively as possible, sensitive to the knowledge that others are likely to disagree, and acknowledging

a responsibility to listen to what the others are saying.

Second, and more significantly, each of the stories represents a political voice in the policy
Second, and more significantly, each of the stories represents a political voice in the policy
process. Ignoring any of these voices means excluding them from policy-making. Within
democratic polities, this inevitably leads to a loss of legitimacy. What is more, in democra-
cies, dissenting voices will, eventually, force their way into the policy process (as we have
seen for instance, with the Brent Spar and, more recently with the World Trade Organisa-
tion and the G8 and G20 riots).
Neither the cost of acrimonious and vicious political conflict, nor the loss of public trust ex-
perienced by those who (perhaps inadvertently, perhaps not) suppress dissenting voices,
are particularly attractive. The former often leads to policy deadlock; the latter may well
result in a legitimacy crisis in the polity as a whole. So these three policy stories have im-
portant implications, not just for global climate change policy-making, but for policy, and for
risk management, generally.
Endemic Conflict: In a policy process where politics matters (that is, in any policy process)
there will always be at least three divergent but plausible stories that frame the issue, de-
fine the problem, and suggest solutions. Thus conflict in policy-making processes is en-
demic, inevitable and desirable, rather than pathological, curable or deviant. Any policy
process that does not take this into account does so at the risk of losing political legiti-
Plural Policy Responses: We have seen that each story tells a plausible, but selective,
story. Any policy response modelled solely in terms of just one or two of these tales will be,
at best, partial and, at worst, irrelevant.
Quality of Communication: Since policy-making is inherently conflictual, and since effective
policy responses depend on the participation of all three voices, policy outcomes crucially
depend on the quality of communication within the debate.
A policy debate that can harness the inherent communicative and argumentative conflict
between different story-tellers will profit most from the potentially constructive interaction
between different proponents. Conversely, a policy debate in which all three positions are
sharply polarised will probably lead to policy deadlock.

This is the condition for which we must strive if we value democracy or, as is the case with the HSE, we are mandated to develop and implement policy on behalf of a democracy. Getting there and staying there is, of course, not easy.

At the monologue end of the spectrum, the policy process is seductively elegant and reas- suringly free (it would seem) from the defiling intrusion of politics. Here we find the mind- set characterised by single-metric rationality. At the other extreme, we wallow in the inco- herence of complete relativism.

The cultural theory typology presented here suggests that between these extremes, there is the possibility of constructive dialogue. It will often be a noisy, discordant, contradictory dialogue, but this is the clumsy beast that democratic policy makers and regulators must seek to harness and ride.

3.17 Clumsy Institutions. The term "clumsy institution" was coined by Michael Schapiro (Schapiro 1988) as
3.17 Clumsy Institutions.
The term "clumsy institution" was coined by Michael Schapiro (Schapiro 1988) as a way of
getting away from the idea that, when we are faced with contradictory definitions of prob-
lems and solutions, we must choose one and reject the rest. It is now established in the
literature as the precondition for decision-making arrangements that embody sufficient es-
sential contestation.
It is a tongue-in-cheek label that thumbs its nose at the hubris of the advocates of single-
metric optimisation. How might the HSE know if its policy-making procedures were suffi-
ciently clumsy?
It is important to specify the various positions that need to be acknowledged and listened
to if we are to have high-quality communication.
There are two ways in which this might be done: empirically (by the sort of discourse
analysis that, for example, has revealed the various storylines that animate the global cli-
mate change debate) and theoretically (with the hypotheses, and in particular the fourfold
typology of forms of social solidarity, that have been used as the basis for the explanation
of "societal concerns").
Our confidence in the validity of this approach will be strengthened if predictions from the
theory are matched by empirical findings, and there is now considerable confirmation of
that, from both qualitative and quantitative research.
Clumsy institutions, we can now say, are those institutional arrangements in which none of
the voices – the hierarchists calling for "wise guidance and careful stewardship", the indi-
vidualist's urging us to "get the prices right", the egalitarians insisting that we need "a
whole new relationship with nature", and the fatalist's asking "why bother?" – is excluded,
and in which the contestation is harnessed to constructive, if noisy, argumentation.

Clumsiness is also closely linked to democracy. Indeed, each of the three "active" solidari- ties has its distinctive model of democracy "the guardian" (hierarchy), "protective" (indi- vidualism), and "participatory" (egalitarianism) all of which (together with the fatalists "it doesn't matter who you vote for, the government always gets in") have to be present, and in vigorous contention, in the public sphere if we are to have democracy.

From a vantage point high up in the crow's nest of the insight axis, and with the benefit of hindsight, it can be seen that many of our public institutions - Britain's former Ministry of Agriculture, Fisheries and Food, the World Trade Organisation, the Intergovernmental Panel on Climate Change, and most national overseas aid agencies - are insufficiently clumsy and, in consequence, erosive of democracy.

Most policy tools (all single metrics such as cost benefit analysis, probabilistic risk as- sessment, quality-adjusted life-years, general equilibrium modelling) and policy precepts (the insistence on a single agreed definition of the problem, the clear separation of facts

and values, and the focus on optimisation) are similarly flawed.

3.18 Differences in Risk Perception.

Whether risks are perceived as voluntary or imposed influences enormously the response to them. The (very small?) radiation exposures associated with mobile phone handsets, for example, are much larger than the exposures associated with base stations. But while people volunteer, in their millions, to take the hand-set risk, the imposed risks associated with base stations have become the focus of much opposition.

Where risks are voluntary, people appear to resent imposed safety almost as much as im-
Where risks are voluntary, people appear to resent imposed safety almost as much as im-
posed risk, and behave in ways that frustrate the intentions of those who seek to make
them safer than they voluntarily choose to be. The widespread flouting of speed limits is an
obvious example.
'Risk' in common parlance - the parlance we recommend for purposes of communicating
with lay public - embraces both the probabilities and magnitudes of adverse events. Where
risks are directly perceptible, these probabilities and magnitudes are estimated instinctively
and intuitively; we do not undertake formal probabilistic risk assessments before crossing
the street.
Science can inform speculations about probabilities with the help of actuarial evidence, or
cause-and-effect reasoning, but is rarely of assistance in estimating the magnitudes - the
values - of the costs and benefits of risk taking. Where the science is contested or incon-
clusive, scientists argue with scientifically-framed hypotheses and the rest of us are liber-
ated to argue from prejudice and superstition.
Risk Management is a balancing act
Risk management is an exercise in cost-benefit analysis without the £ or $ signs. Money is
but one of the elements that make up the contents of the rewards and accidents boxes. It
is usually not the most important one, and the rest, despite the strenuous efforts of many
economists over many decades, usually defy transformation into money.
Attempts to reduce the various consequences of risk-taking to a single common denomina-
tor will inevitably exclude legitimate voices. The various participants in debates about risk
(see discussion of social solidarities below) bring different value systems to the table. Even
if the possessors of these different value systems could reduce all their concerns to money
- which they cannot - attempting to measure societal concerns by an average value would
obscure precisely those value-differences which distinguish the solidarities from each
The HSE's attempts to reduce risks to levels that are ALARP (As Low As Reasonably
Practicable) encounter the difficulty that 'low', 'reasonable', and 'practicable' are what
Habermas has called empty words, i.e. words that different people fill with different mean-

The Risk Thermostat has a top loop - the rewards loop. This is widely disregarded by insti- tutional risk managers and safety professionals and campaigners, who commonly define risk management as risk reduction, without regard to the opportunity costs (the rewards foregone) of restricting risky activities.

The formal procedures for managing institutional, as distinct from individual, risk commonly have no top loop and where they do, there is often a 'gross disproportion' between risk and rewards.

The ALARP (As Low As Reasonably Practicable) principle provides a means for assessing the tolerability of risk. In essence, it says that if the cost of reducing a risk outweighs the benefit, then the risk may be considered tolerable. However, although it appears simple, the ALARP principle requires significant interpretation and can be very difficult and costly

to apply.

The tolerability of risk is discussed in the HSE publication: Reducing Risks, Protecting people available as a free pdf download:

not quickly be shown to be ALARP, either because they probably aren't or because they are marginal, are then subject to the second stage of the process, which involves detailed costing and risk analyses.

Introduction. The definition of ALARP can be taken to be: A risk is ALARP if
The definition of ALARP can be taken to be:
A risk is ALARP if the cost of any reduction in that risk is grossly disproportionate to the
benefit obtained from the reduction.
This simple statement of the principle hides the philosophical and ethical contentiousness
of the principle as well as the practical difficulties in applying it meaningfully and effectively.
Why is the ALARP relevant?
In spite of its widespread adoption in the UK as a means of assessing the tolerability of
risk, the ALARP principle is not enshrined in UK law. However, the obviously similar
SFAIRP (So Far As Is Reasonably Practicable) principle does appear in the Health and
Safety at Work Act.
Usually, ALARP and SFAIRP are considered to be equivalent, e.g. by the Health and
Safety Executive (HSE), though it is not clear that this equivalence has been demonstrated
in law.
The Difficulties of Applying the ALARP Principle
There are significant practical difficulties in applying the ALARP principle. Firstly, to dem-
onstrate that a risk is ALARP, it is necessary to demonstrate that all credible risk reduction
methods are impracticable.
To do this, it is clearly necessary to first identify all credible risk reduction methods. It is
unlikely that a single individual working alone, even with the benefit of peer review, will
have the necessary expertise and breadth of thinking to do this. Hence, the identification of
risk reduction methods is considered a group activity.
The second significant problem is that applying the ALARP principle fully and accurately
can be expensive (this is just to determine the ALARP status of risks, not to actually re-
duce risks, e.g. by system redesign). This is because accurately determining the cost and
benefit of risk reduction can be difficult and time-consuming. To counteract this, the proc-
ess is designed in two stages.
The first stage is intended to be a relatively inexpensive and quick assessment, designed
to identify risks that can quickly and clearly be shown to be ALARP. Those risks that can

3.20 The ALARP Process.

For each risk, the following process is followed. This is just a summary of the process; there are many details and complications, some of which are considered below.

First stage (inexpensive and approximate)

1. Calculate detriment of risk.

2. Brainstorm risk reduction methods.

3. For each risk reduction method, ask does the cost of this risk reduction method clearly

exceed detriment calculated in step 1? If yes, discard risk reduction method. If no, add risk

reduction method to list of potentially feasible methods.

4. Are there any potentially feasible risk reduction methods? If yes, go to step 5. If no, then

risk is ALARP (and process ends).

Second stage (detailed and costly)

5. Determine accurate costs and benefits of feasible risk reduction methods.

To regulate a business in a logically defensible way, one must consider all its conse- quences, i.e. both risks and benefits. To regulate in an ethically defensible way, one must consider its impact on individuals, as well as on society as a whole.

No reasonable individual would want his or her personal life to be governed by a rigid ac- ceptable level of risk. Nor should a reasonable society want a single level of risk to govern all technologies, regardless of their other features, including the benefits that they bring.

6. Perform accurate cost benefit analysis to determine risk reduction methods to be im- plemented.
6. Perform accurate cost benefit analysis to determine risk reduction methods to be im-
7. Implement indicated risk reduction methods and reassess risk.
8. Is the risk ALARP? If NO, go to step 1. If YES, then the risk is ALARP (and process
Acceptable Risk.
Perhaps the most widely-sought quantity in management is the acceptable level of risk.
Organisations whose risks fall below that level could go about their business, without wor-
rying further about the risks that they impose on others.
Riskier organisations would face closure if they could not be brought into compliance. For
designers and operators, having a well-defined acceptable level of risk would provide a
clear target for managing their technology.
For regulators, identifying an acceptable level of risk would mean resolving value issues at
the time that standards are set, allowing an agency's technical staff to monitor compliance
mechanically, without having to make case-specific political and ethical decisions.
For the public, a clearly-enunciated, acceptable level of risk would provide a concise focus
for evaluating how well its welfare is being protected -- saving it from having to understand
the details of the technical processes creating those risks.
The acceptability of risk is a relative concept and involves consideration of different factors.
Considerations in these judgements may include:-
 the certainty and severity of the risk;
 the reversibility of the health effect;
 the knowledge or familiarity of the risk;
 whether the risk is voluntarily accepted or involuntarily imposed;
 whether individuals are compensated for their exposure to the risk;
 the advantages of the activity; and
 the risks and advantages for any alternatives.

Introduction to probability

One step in protecting and improving public health and safety is determining the risks in- volved with activities and technologies etc. To be able to discuss and compare risks, a common language is needed. For this reason, scientists and decision makers quantify re- lationships among risks by developing number values called mathematical probabilities.

Everyday Use of Probability

How "likely" something is to occur is known as "probability."

Most people, including you, use probability in their everyday lives. For example, a local weather forecaster (or meteorologist) may forecast rain. The forecast is made by compar- ing scientific knowledge gained from observing similar conditions in the past to the existing weather conditions. Through this comparison, the meteorologist can tell us what percent- age chance of rain there is. Then you can decide whether or not to carry an umbrella. If you are cautious, you may decide to carry an umbrella if there is only a 30 percent chance of rain. Or you may wait until a 70 percent chance of rain is forecast.

Figuring Probability

Suppose there are a certain number of possible outcomes to an event, and each event has an equal chance of happening. Then the probability of each outcome is 1 divided by the number of possible outcomes.

For example, the probability of drawing the ace of spades from an ordinary deck of cards is 1/52. Now, if we want to know the probability of drawing any ace on one draw, we add the probabilities of getting a particular ace together. There are four aces out of the 52 cards, or one ace per suit. The probability of drawing any of the four aces on a single draw is 1/13.

Other probabilities, including those for health and safety risks to humans, are harder to de-

Percentages and probabilities are related but not the same. Percentages are a mathematical statement of
Percentages and probabilities are related but not the same.
Percentages are a mathematical statement of how many times out of 100 something hap-
Probabilities refer to just one happening. For example, a 30 percent chance of rain at a
particular weather station means that, given these same weather conditions for 100 differ-
ent days, it is expected to rain 30 of those days. The probability of rain for any one of those
days is 30 divided by 100, which equals 30/100 or 0.30.
Repeated Observations and Experiments
Most of the probabilities we use in every day life are determined from simply observing
what happens every time certain conditions arise, or from repeating an experiment many
times. The number of times that a specific outcome occurs, divided by the total number of
times the experiment is repeated, is the probability that the specific outcome will occur.
This is useful for making predictions about what will happen in the future.
Let's use an example similar to the one above. The same weather conditions were ob-
served and recorded for 100 days during the past two years. Forty of those 100 days were
sunny and warm. This Tuesday, we expect the weather conditions to be very similar to
those 100 days observed in the past two years.
What is the probability that this Tuesday will be sunny and warm?
40 sunny days = 40
100 repetitions 100
Common Sense
Some probabilities are common sense. For example, we know that when we flip a coin,
there are only two possible outcomes - heads or tails. So there is a 50 percent chance (a
0.50 probability) that the coin will land heads up. There is also a 50 percent (0.50 probabil-
ity) chance that it will land tails up.

termine. A lot of information may be needed to make a prediction. Testing the whole sys- tem may not be possible. However, once the basic probability for each possible outcome is known, the same rules apply and can be used to make reasonable predictions. For in- stance, suppose that, by law, a company cannot distribute a machine until certain safety standards are met.

The company knows the machine will not operate safely if two particular parts break down at the same time. This situation could exist if one part is a backup for the other. The com- pany couldn't wait until after the machines were distributed to see how many times out of 100 the two parts would break down at the same time.

However, the company could conduct tests on each part to find the probability for each part breaking down. Then these probabilities could be multiplied to determine the probabil- ity of both parts failing at the same time.

For example, suppose tests determined that the probability of part A breaking down was 0.05
For example, suppose tests determined that the probability of part A breaking down was
0.05 and the probability of part B breaking down was 0.02. Then the probability of both
parts breaking down is 0.05 x 0.02. This equals 0.001 or 1/1,000 (one in a thousand). If
that level of risk is acceptable to the company and meets industry regulations, then the
company could distribute the machine.
3.22 One in a Million.
In the case of human health risks, a rule used in some cases by regulators is that a tech-
nology (new chemical, new industrial plant, etc.) is 'safe' if it does not increase the health
risk of the population by more than 1 chance in 1 million.
This is about the same chance each of us has of being struck by lightning or a meteorite.
One problem is that to know if risk increases, we have to know what the risk is before the
'new risk' is introduced. Also, often increased risk is based on laboratory experiments using
large numbers of animals. Large numbers of subjects are helpful, but the biological differ-
ences between the test population (often rats or mice) and humans introduce more uncer-
Probabilities do give us a way to determine a level of risk that is at least to some degree
not subjective. But it is important to understand that personal judgement is still involved.
For example, choosing what to consider in an experiment requires some judgement.
Consequences and Values
Determining the acceptability of risk involves both the consequence of the action in ques-
tion and values. If you decide not to carry an umbrella, the consequence may be that you
get wet if it rains. How much risk you are willing to accept depends on whether you mind
getting wet.
Human Health Risks

Of course, in situations involving technologies, decision making is much more complicated. Difficulties can arise in determining an acceptable level of risk when the consequences could involve risk to human health or life.

Still, since risk cannot be eliminated but may be reduced, it makes sense to quantify the risk in complex technologies. By identifying the risks of each event in the technology, events where risk can be reduced can be identified.

This may reduce the overall risk of the technology. In some cases, the costs of reducing risk to very low levels may be very expensive. A value judgement is then required to de- termine the level of risk considered acceptable.

Making Societal Decisions

Using probability as a tool for discussing risk is useful, but it is important to recognise that there are limitations in using probability for making decisions about the acceptability of risk.

For example, most societal issues in which risk is a factor are complex. A significant prob- lem may be discounted or underestimated. Also, many probabilities are estimated because it is not possible to perform controlled experiments to measure them. Furthermore, human behaviour and human error are even less predictable than physical or biological events.

3.23 Other Aspects of Risk. Probability is only one aspect of risk. Societal risk decisions
3.23 Other Aspects of Risk.
Probability is only one aspect of risk. Societal risk decisions also involve consequences
and values.
 What is the consequence of a failure - loss of money, illness, death?
 How large are the consequences?
 Do the risks and benefits fall on different people?
 Do the risks fall on the decision-makers or on others?
 How are decisions made?
 What are the alternatives?
4.0 Failure Tracing Methods.
Hazard and operability study (HAZOP) is defined in the ILO Prevention of Major Industrial
Accidents ILO Code of Practice as:
"A study carried out by application of guide words to identify all deviations from design in-
tent having undesirable effects on safety or operability, with the aim of identifying potential
The technique of Hazard and Operability Studies, or in more common terms HAZOPS, has
been used and developed over approximately four decades for 'identifying potential haz-
ards and operability problems' caused by 'deviations from the design intent' of both new
and existing process plants.
The ILO Prevention of Major Industrial Accidents ILO Code of Practice in relation to the
Assessment of Major Hazards is specific about the use of HAZOPS:
Chapter 2. Components of a major hazard control system
2.3.2. This assessment should identify uncontrolled events which could lead to a fire, an
explosion or release of a toxic substance. This should be achieved in a systematic way, for
example by means of a hazard and operability study or by checklists, and should include
normal operation start-up and shut-down.

Chapter 3. General Duties To carry out a hazard analysis, a suitable method should be applied,such as:

preliminary hazard analysis (PHA);

hazard and operability study (HAZOP);

event tree analysis;

fault tree analysis;

accident consequences analysis;

failure modes and effects analysis;

check-list analysis.

Chapter 5. Analysis of Hazards and Risks 5.3. Hazard and operability study (HAZOP) 5.3.1. A
Chapter 5. Analysis of Hazards and Risks
5.3. Hazard and operability study (HAZOP)
A HAZOP study or its equivalent should be carried out to determine deviations from
normal operation in the installation, and operational malfunctions which could lead to un-
controlled events.
A HAZOP study should be carried out for new plant at the design stage and for ex-
isting plant before significant modifications are implemented or for other operational or le-
gal reasons.
A HAZOP study should be based on the principles described in the relevant litera-
The examination should systematically question every critical part of the design, its
intention, deviations from this intention and possible hazardous conditions.
A HAZOP study should be performed by a multidisciplinary expert group, always in-
cluding workers familiar with the installation.
The HAZOP study group should be headed by an experienced specialist from works
management or by a specially trained consultant.
Industries in which the technique is employed
Hazops were initially 'invented' by ICI in the United Kingdom, but the technique only
started to be more widely used within the chemical process industry after the Flixborough
disaster in 1974. This chemical plant explosion killed twenty-eight people and injured
scores of others, many of those being members of the public living nearby.
Through the general exchange of ideas and personnel, the system was then adopted by
the petroleum industry, which has a similar potential for major disasters.
This was then followed by the food and water industries, where the hazard potential is as
great, but of a different nature, the concerns being more to do with contamination rather
than explosions or chemical releases.
The reasons for such widespread use of Hazops
Safety and reliability in the design of plant initially relies upon the application of various
codes of practice, or design codes and standards. These represent the accumulation of
knowledge and experience of both individual experts and the industry as a whole.
Such application is usually backed up by the experience of the engineers involved, who
might well have been previously concerned with the design, commissioning or operation of
similar plant.
However, it is considered that although codes of practice are extremely valuable, it is im-
portant to supplement them with an imaginative anticipation of deviations which might oc-
cur because of, for example, equipment malfunction or operator error.
In addition, most companies will admit to the fact that for a new plant, design personnel are
under pressure to keep the project on schedule. This pressure always results in errors and
The Hazop Study is an opportunity to correct these before such changes become too ex-
pensive, or 'impossible' to accomplish.
Although no statistics are available to verify the claim, it is believed that the Hazop meth-
odology is perhaps the most widely-used aid to loss prevention.
The reason for this can most probably be summarised as follows:
 It is easy to learn.
 It can be easily adapted to almost all the operations that are carried out within
process industries.

No special level of academic qualification is required. One does not need to be a university graduate to participate in a study.

4.1 The Basic Concept.

Essentially, the Hazops procedure involves taking a full description of a process and sys- tematically questioning every part of it to establish how deviations from the design intent can arise.

Once identified, an assessment is made as to whether such deviations and their conse- quences
Once identified, an assessment is made as to whether such deviations and their conse-
quences can have a negative effect upon the safe and efficient operation of the plant. If
considered necessary, action is then taken to remedy the situation.
This critical analysis is applied in a structured way by the Hazop team, and it relies upon
them releasing their imagination in an effort to discover credible causes of deviations. In
practice, many of the causes will be fairly obvious; for example a pump failure causing a
loss of circulation in a cooling water facility.
However, the great advantage of the technique is that it encourages the team to consider
other, less obvious ways in which a deviation may occur, however unlikely they may seem
at first consideration. In this way, the study becomes much more than a mechanistic
check-list type of review.
The result is that there is a good chance that potential failures and problems will be identi-
fied which had not previously been experienced in the type of plant being studied.
An essential feature in this process of questioning and systematic analysis is the use of
keywords to focus the attention of the team upon deviations and their possible causes.
These keywords are divided into two sub-sets:
 Primary Keywords, which focus attention upon a particular aspect of the design in-
tent or an associated process condition or parameter.
 Secondary Keywords which, when combined with a primary keyword, suggest pos-
sible deviations.
The entire technique of Hazops revolves around the effective use of these keywords, so
their meaning and use must be clearly understood by the team.
4.2 Examples of Often Used Keywords are Listed Below.
Primary Keywords
These reflect both the process design intent and operational aspects of the plant being
studied. Typical process oriented words might be as follows. The list below is purely illus-
trative, as the words employed in a review will depend upon the plant being studied.
Separate (settle, filter, centrifuge)

Reduce (grind, crush, etc.) Absorb Corrode Erode

Note that some words may be included which appear at first glance to be completely unre- lated to any reasonable interpretation of the design intent of a process. For example, one may question the use of the word Corrode, on the assumption that no-one would intend that corrosion should occur.

Bear in mind, however, that most plant is designed with a certain life span in mind, and im- plicit in the design intent is that corrosion should not occur, or if it is expected, it should not exceed a certain rate. An increased corrosion rate in such circumstances would be a de- viation from the design intent.

Also = The design intent is completely fulfilled, but in addition some other related activity occurs (e.g. Flow/Also indicating contamination in a product stream, or Level/Also meaning material in a tank or vessel, which should not be there).

Other = The activity occurs, but not in the way intended (e.g. Flow/Other could indicate a leak or product flowing where it should not, or Composition/Other might suggest unex- pected proportions in a feedstock).

Fluctuation = The design intention is achieved only part of the time (e.g. an air-lock in a pipeline might result in Flow/Fluctuation).

Early = Usually used when studying sequential operations, this would indicate that a step is started at the wrong time or done out of sequence.

Late = As for Early.

Remembering that the technique is called Hazard & Operability Studies, added to the above might
Remembering that the technique is called Hazard & Operability Studies, added to the
above might be relevant operational words such as:
This latter type of Primary Keyword is sometimes either overlooked or given secondary
importance. This can result in the plant operator having, for example, to devise impromptu
and sometimes hazardous means of taking a non-essential item of equipment off-line for
running repairs because no secure means of isolation has been provided.
Alternatively, it may be discovered that it is necessary to shut down the entire plant just to
re-calibrate or replace a pressure gauge. Or perhaps during commissioning, it is found that
the plant cannot be brought on-stream because no provision for safe manual override of
the safety system trips has been provided.
Secondary Keywords
As mentioned above, when applied in conjunction with a Primary Keyword, these suggest
potential deviations or problems. They tend to be a standard set as listed below:
No = The design intent does not occur (e.g. Flow/No), or the operational aspect is not
achievable (Isolate/No).
Less = A quantitative decrease in the design intent occurs (e.g. Pressure/Less).
More = A quantitative increase in the design intent occurs (e.g. Temperature/More).
Reverse = The opposite of the design intent occurs (e.g. Flow/Reverse).

4.3 HAZOP Study Methodology.

In simple terms, the Hazop study process involves applying - in a systematic way - all rele- vant keyword combinations to the plant in question in an effort to uncover potential prob- lems. The results are recorded in columnar format under the following headings:





In considering the information to be recorded in each of these columns, it may be helpful to take as an example the simple schematic below. Note that this is purely representational and not intended to illustrate an actual system.

Deviation The keyword combination being applied (e.g. Flow/No). Cause Potential causes which would result in
The keyword combination being applied (e.g. Flow/No).
Potential causes which would result in the deviation occurring. (e.g. "Strainer S1 blockage
due to impurities in Dosing Tank T1" might be a cause of Flow/No).
The consequences which would arise, both from the effect of the deviation (e.g. "Loss of
dosing results in incomplete separation in V1") and, if appropriate, from the cause itself
(e.g. "Cavitation in Pump P1, with possible damage if prolonged").
Always be explicit in recording the consequences. Do not assume that the reader at some
later date will be fully aware of the significance of a statement such as "No dosing chemi-
cal to Mixer". It is much better to add the explanation as set out above.
When assessing the consequences, one should not take any credit for protective systems
or instruments which are already included in the design. For example, suppose the team
had identified a cause of Flow/No (in a system which has nothing to do with the one illus-
trated above) as being spurious closure of an actuated valve. It is noticed that there is
valve position indication within the Central Control Room, with a software alarm on spuri-
ous closure. They may be tempted to curtail consideration of the problem immediately, re-
cording something to the effect of "Minimal consequences, alarm would allow operator to
take immediate remedial action". However, had they investigated further they might have
found that the result of that spurious valve closure would be over-pressure of an upstream
system, leading to a loss of containment and risk of fire if the cause is not rectified within
three minutes. It only then becomes apparent how inadequate is the protection afforded by
this software alarm.

Safeguards Any existing protective devices which either prevent the cause or safeguard against the adverse consequences would be recorded in this column. For example, you may consider recording "Local pressure gauge in discharge from pump might indicate problem was aris- ing". Note that safeguards need not be restricted to hardware. Where appropriate, credit can be taken for procedural aspects such as regular plant inspections (if you are sure that they will actually be carried out).

Action Where a credible cause results in a negative consequence, it must be decided whether some action should be taken. It is at this stage that consequences and associated safe- guards are considered. If it is deemed that the protective measures are adequate, then no action need be taken, and words to that effect are recorded in the Action column.

1. Actions that remove the cause. 2. Actions that mitigate or eliminate the consequences. Whereas
1. Actions that remove the cause.
2. Actions that mitigate or eliminate the consequences.
Whereas the former is to be preferred, it is not always possible, especially when dealing
with equipment malfunction. However, always investigate removing the cause first, and
only where necessary mitigate the consequences. For example, for the "Strainer S1 block-
age due to impurities etc." we might approach the problem in a number of ways:
Ensure that impurities cannot get into T1 by fitting a strainer in the road tanker off-
loading line.
Consider carefully whether a strainer is required in the suction to the pump. Will
particulate matter pass through the pump without causing any damage, and is it
necessary to ensure that no such matter gets into V1?. If we can dispense with the
strainer altogether, we have removed the cause of the problem.
Fit a differential pressure gauge across the strainer, with perhaps a high dB alarm
to give clear indication that a total blockage is imminent.
Fit a duplex strainer, with a regular schedule of changeover and cleaning of the
standby unit.
Three notes of caution need to be borne in mind when formulating actions.
Do not automatically opt for an engineered solution, adding additional instrumentation,
alarms, trips, etc. Due regard must be given to the reliability of such devices, and their po-
tential for spurious operation causing unnecessary plant down-time. In addition, the in-
creased operational cost in terms of maintenance, regular calibration, etc. should also be
considered (the lifetime cost of a simple instrument will be at least twice its purchase price
- for more complex instrumentation, this figure will be significantly greater). It is not un-
known for an over-engineered solution to be less reliable than the original design because
of inadequate testing and maintenance.
Finally, always take into account the level of training and experience of the personnel who
will be operating the plant. Actions which call for elaborate and sophisticated protective
systems are wasted, as well as being inherently dangerous, if operators do not, and never
will, understand how they function. It is not unknown for such devices to be disabled, either
deliberately or in error, because no one knows how to maintain or calibrate them.
Considering all Keywords - The Hazop procedure
Having gone through the operations involved in recording a single deviation, these can
now be put into the context of the actual study meeting procedure. From the flow diagram
below, it can be seen that it is very much an iterative process, applying - in a structured
and systematic way - the relevant keyword combinations in order to identify potential prob-
4.5 Full Recording versus Recording by Exception. In the early days of Hazop Studies, it
4.5 Full Recording versus Recording by Exception. In the early days of Hazop Studies, it
4.5 Full Recording versus Recording by Exception. In the early days of Hazop Studies, it
4.5 Full Recording versus Recording by Exception.
In the early days of Hazop Studies, it was usual to record only the potential deviations that

carried with them some negative consequence. This might well have been because such studies were only for internal use within a company. Also, with manually hand-written re- cords, it certainly reduced the time taken, both in the study itself and the subsequent pro- duction of the Hazop Report. Such methodology is classed as "Recording by exception", where it is assumed that anything not included is deemed to be satisfactory.

Latterly, it has become more the accepted practice to set down everything, stating clearly each keyword combination applied to the system. Where applicable, this would be followed by a statement indicating either that no Cause could be identified, or alternatively that no Consequence arose from the Cause recorded. This is classified as "Full recording", and it results in a Hazop Report which demonstrates unambiguously to outside parties that a rig- orous study has been undertaken. In addition, it produces a comprehensive document which will greatly assist in the speedy assessment of the safety and operability of later plant modifications (do they impinge upon a potential deviation which was originally recog- nised as being credible, but which involved at that time no negative consequences?).

Bearing the above in mind, it is recommended that "Full recording" is instituted. With the use of a computer, the previous concern regarding time, both in the study and the report- ing, is all but eliminated. To make this methodology easier to handle efficiently, text mac- ros should be set up as follows:

1. No potential causes identified.

2. No significant negative consequences identified.

3. No action required - existing safeguards considered adequate.

These macros can be used in the appropriate circumstances to quickly set down the rea- son for not pursuing a keyword combination.

In addition to the above, the pseudo-Secondary words 'All' and 'Remainder' are often used. These are employed in the following circumstances:

For a particular Primary Keyword (e.g. Flow), some combinations have been identified as having credible Causes (e.g. Flow/No, Flow/Reverse). Having explored all other relevant combinations (Flow/Less, Flow/More, Flow/Other, etc.), no other Causes could be identi- fied. The combination "Flow/Remainder" is therefore used, with the macro in (1) above. Having explored all relevant combinations for a particular Primary word, no potential devia- tions could be identified. The combination "Flow/All" is therefore used, with the macro in (1) above. Use of these pseud-Secondary Keywords greatly improves the readability of the final re- port, as it eliminates countless repetitive entries, all with a similar format (i.e. Keyword combination with "No potential causes identified"). However, to make it a robust system, the introduction to the Hazop Report must list clearly the Secondary Keywords which were globally applied to each Primary Keyword; in other words, the 'relevant combinations'. This will give an unambiguous meaning to the words 'All' and 'Remainder'.

Note that such an approach should only be adopted where no credible Cause is identified. In cases where the potential deviation is considered possible, but no significant conse- quence ensues, then both keywords should be recorded, together with the actual Cause identified, and macro (2) in the Consequence column.

Cause identified, and macro (2) in the Consequence column. 4.6 Failure Modes and Effects Analysis. Introduction

4.6 Failure Modes and Effects Analysis.


Consumers and customers are placing increased demands on companies for high-quality, reliable products/services. The increasing capabilities and functionality of many prod- ucts/services are making it more difficult for manufacturers to maintain quality and reliabil-


Traditionally, reliability has been achieved through extensive testing and use of techniques such as probabilistic reliability modelling. These are techniques done in the late stages of development. The challenge is to design in quality and reliability early in the development cycle.

ILO Prevention of Major Industrial Accidents an ILO Code of Practice states: To carry out a hazard analysis, a suitable method should be applied, such as:

preliminary hazard analysis (PHA);

hazard and operability study (HAZOP);

– event tree analysis; – fault tree analysis; – accident consequences analysis; – failure modes
– event tree analysis;
– fault tree analysis;
– accident consequences analysis;
– failure modes and effects analysis;
– check-list analysis.
The Code Defines Failure Modes and Effects Analysis as: "A process of hazard identifica-
tion where all known failure modes of components or features of a system are considered
in turn and undesired outcomes are noted".
Failure Modes and Effects Analysis (FMEA) is methodology for an