Trajetória da análise de acidentes: o paradigma tradicional e os primórdios da ampliação da análise*

Trayectoria del análisis de accidentes: el paradigma tradicional y los primordios de la ampliación del análisis

Ildeberto Muniz de Almeida¹

Department of Public Health, Faculty of Medicine of Botucatu, State University of Sao Paulo, Julio de Mesquita Filho - FMB/UNESP, SP. ialmeida@fmb.unesp.br

Translated by James Richard Welsh ]]> Translation from Interface - Comunicação, Saúde, Educação, Botucatu, v.10, n.19, p.185-202, Jan./June 2006.

ABSTRACT

The traditional approach to accidents assumes that compliance with procedures and norms protects the system from accidents and that these events are caused by the faulty behavior of workers, which results partly from personality aspects. Identification of these behaviors can be based on comparing them with the standard "safe working practices", which safety experts are aware of ahead of time. In recent decades, new alternative views have expanded the perimeters of accident analyses and opened the way to questioning the assumption of the traditional approach to the concepts of the human being and work. These new approaches help to highlight the sterile results of traditional practices: blaming and punishing victims, recommending training, and proposing norms without changing the systems in which the accidents took place. The new approaches suggest that the traditional approach is totally worn out and emphasize the importance of operator contribution for system safety.

Key words: accidents occupational. accident prevention.

RESUMO

A abordagem tradicional de acidentes pressupõe que a obediência a procedimentos e normas protege o sistema contra acidentes e que esses eventos decorrem de comportamentos faltosos dos trabalhadores, originados, em parte, de aspectos de suas personalidades. A identificação desses comportamentos baseia-se em comparação com o padrão que toma por base o "jeito seguro de fazer", conhecido por antecipação pelos especialistas em segurança. Nas últimas décadas, surgem visões alternativas à abordagem tradicional, ampliando o perímetro das análises de acidentes e abrindo caminho para questionamentos de seus pressupostos relativos às concepções de ser humano e de trabalho. Os novos enfoques ajudam a evidenciar os resultados estéreis das práticas tradicionais: culpar e punir as vítimas, recomendar treinamentos e normas mantendo inalterados os sistemas em que ocorreram os acidentes. As novas abordagens sugerem o esgotamento do enfoque tradicional e ressaltam a importância da contribuição dos operadores para a segurança dos sistemas.

Palavras-chave: acidentes de trabalho. prevenção de acidentes.

RESUMEN

Palabras clave: accidente de trabajo. prevención de accidentes.

Introduction

How have accidents and disasters been analyzed through the course of history? This review exposes, summarily, a form of thinking of or organizing different approaches generated in this respect.

In the origin of the present work is the verification that a large number of analyses of accidents, conducted in the scope of enterprises and even of official agencies, are concluded in a manner to attribute responsibility and blame for what occurred to the victims of the accident or to their colleagues that operated in the vicinity (Vilela et al., 2004; Almeida, 2001; Reason, 1999). In the literature, approaches that culminate in this manner have come to be denominated the traditional or classic paradigm of security (Cattino, 2002; Dwyer, 2000).

This review seeks, among others, the following objectives:  to contribute to the deconstruction of the traditional security paradigm; to furnish subsidies for the systematization of approaches currently adopted for the analysis of accidents; to supply incentives to the explicitation of assumptions adopted in practices of analyses of accidents, especially of those based on the traditional paradigm or approach; to contribute to the clarification of existent differences between positions of defenders of the traditional paradigm and of systemic security.

In a complementary manner, it intends to describe characteristics of different principles adopted in usual practices of accident analyses, so as to show that blame-attribution practices are also associated with non-utilization, or with distorted use, of principles that are being suggested in the systematization of analyses of accidents in the last thirty years. To conclude, the work shows that, more recently, the exploration of aspects of a subjective dimension of accidents benefits from the incorporation of rereading of aspects identified in data collection with the support of concepts of Cognitive Psychology, Cognitive Ergonomics, Anthropology, Systems Engineering, among others. This conceptual expansion of analysis reveals other facets of the insufficiency of traditional approaches for explaining human behaviors in work.

In a preliminary manner, it seems important to remember that a primary comprehension of the origins of and reasons for these phenomena is rooted in the beliefs that they attribute to divine will, punishment or other forms of expressing occurrences deserved by the victims. This vision has taken root in many cultures of different societies and, until today, influences said ingenuous perceptions or visions (Kouabenan, 1998).

A prehistory of analysis of accidents

Establishing a rough parallel with historical periodization, it can be defined as a prehistory of analysis de accidents arising from the contribution of Heinrich (1959), that developed a theory of dominos, representing the occurrence of an accident as a linear sequence of events or "stones". The third stone represents the occurrence of unsafe conditions and acts that are in the origin of the dichotomous vision prevalent in Brazil.

For some years, this was the only approach to accident causality studied by work safety (SST) and health professionals in Brazil.

This was also the understanding present in the "educative" material most frequently used, such as prevention brochures and posters, theatrical plays, etc. (Almeida, 2001). Subsequently, under the influence of ideas of the Scientific Organization of Work, two classes of causal factors in accidents have arisen that, in practice, are equivalent to the acts and conditions cited:  technical factors and human factors (Neboit, 2003).

And how should these acts be identified? The most widespread practice assumes the presupposition of the existence of a correct form of work execution, called "safe", defined in legal or administrative norms and procedures. To identify unsafe acts, it would be sufficient for the "investigator" to compare the occurrence with this standard . And how can they be prevented? Stimulating changes in the behaviors of victims. To do this, the analyses recommend punishing inaccurate assessments, bad judgments and wrong decisions and actions, while rewarding desired ones. It is the strategy of the carrot and the stick.

This form of conceiving the accident understands the actions and omissions occurring in work as products of conscious choices of workers, taken in situations in which they would have different alternatives among an array of options, in conditions of absolute control of the situation in its course. In synthesis, the outcome of the action is used as a criterion to judge the decision taken, not considering, among others, the following aspects of the work situation:  context, nature of the demands of the task, variability and history of the usual forms of execution of the work, adequacy of the "standard" in the validity of this variability, and even the associated psychic processes, for example, the stress, the incomprehensions, etc.

The technical fragility of this approach would not be sufficient; its diffusion shows it to be associated with practices that aggravate its consequences such as attributing blame to the victims, which would inhibit effective practices of prevention.

A traditional approach of analysis of accidents

Nevertheless, structuring of the process with these four stages does not represent effective rupture with the essence of the model described above. The essence of the approach or traditional paradigm of security was summarized by Dwyer (2000) and Cattino (2002) in the following characteristics: a) improvement in levels of Health and Safety will be followed with technological improvements, disciplinary sanctions, reinforcement of the creation of new norms and controls derived from actions of specialists; b) the human being is an unreliable part and is the origin of unsafety into systems; c) the error is seen as a "failure" or "defect" originating from negligence of operators.

Other authors refer to this approach as anticipationism(Hood & Jones, 1996), to emphasize the fact that the risk factors that can originate an accident or disaster are considered to be known a priori. This knowledge is reflected in the instruments used in analysis of accidents that take the form of verification lists or checklists of "causes", to be used by safety teams.

The analysis practices that result in attribution of blame to victims are shown to be profoundly influenced by the ideas presented up to this point. Chart 2 begins with a summary of the notion of accident and of paths assumed by the analysis in accord with this approach.

In safety situations characterized by elevated rates of accident occurrences associated with classic problems of Safety Engineering, the adoption of this model was shown to be useful as an auxiliary tool of safety policies.

Preparing the process and expansion of targets of analyses

The periodization proposed herein takes as its conductive thread the stages of the model described in the previous item. In the first steps of their expansion, the stage of preparation of analyses comes to include definition of safety policy with diverse components, one of which is the subsystem of analysis of accidents. In these systems there comes to exist the previous definition of human resources and materials to be utilized, such as structuring of information systems that serve as a base for the definition of priorities to be addressed by safety teams, etc.

The events to be analyzed are also reviewed. In the case of Brazil, systems maintained in the anterior stage become attached to the legal concept of accident centered in the notion of the existence of victims linked to the enterprise according to the specific type of work contract. In the first steps of expansion the importance of detection and eventual analysis of other types of adverse events was discussed as incidents, quasi-accidents and material losses as an auxiliary tool of a safety policy.

Expansion of analysis per se.

Rethinking the analysis: to find blame or to seek prevention?

With regard to analysis of events per se, important contributions appear, of which the following deserve to be highlighted (Almeida, 2001; Johnson, 2002; 2003; Livingston, Jackson & Priestley, 2001): a) explicitation of differences of objectives between analyses directed toward identification of those responsible and those that aim to identify causes and subsidize prevention practices of accidents with similar aspects; b) explicitation of notions of analyses of changes and of analyses of barriers as fundaments of accident analyses, and the appearance of techniques based on these principles, isolated or in association. The notion of assumed risk expands the frontiers of this approach; c) explicitation of strategies of formulation and of choice criteria of preventive measures to be recommended and implemented.

With respect to objectives of the analyses, it becomes evident that, when a team limits the search to those responsible or blamed, the process tends to be restricted to the vicinity of the consequences of the event. In the jargon of the area, the search is restricted to the identification of direct causes of the accident. Finally, the less that is known about the accident, the greater the probability of a conclusion that results in attribution of cause and responsibility to operator error. Also it is possible to verify that, the more complete the analysis, the greater the probability of identification of other types of causal factors and of limits of the prior conclusion.

One of the definitions adopted for direct or immediate causes of an accident is "the most obvious reason for which the adverse event occurs". Beyond these, there are also basic or root causes, and the underlying or contributive causes. Root causes are events, failures that give origin to all the rest. They are of a managerial nature, such as planning or organizational failures. The underlying causes are less obvious organizational or systemic reasons for the origins of accidents. For example: the non-realization of pre-use inspection of a machine, on the part of supervisors, or an increase in production pressures (Health and Safety Executive, 2004).

The reasons for the adoption of this differentiation among types of causal factors are not very clear. Despite this, its utilization gained great diffusion, being incorporated into different techniques of analyses of accidents. Nevertheless, although the necessity for exploration of the origins of human behaviors indicated as immediate causes of an accident is explicit, studies show that the interpretation of these findings continues to be based on the same conception of the human being adopted in the traditional paradigm (Vilela et al., 2004; Baumecker, 2000; Llory, 1999).

This model of analysis tends to be complemented with lists of each of the groups of causes, so as to "help" the analysis team in its work. The lists of causes are not merely innocent tools in support of prevention. Despite being elaborated with the best of intentions, they internalize a worldview of safety strongly influenced by presuppositions of the traditional approach. Security norms, practices prescribed or specified, services orders, the presence of technical devices that can be used as measures of protection or barriers to release of different energy flows during an accident etc., tend to be adopted as standards of comparison with the actions identified in the accident. The verification of differences tends to be taken as proof of identification of the accident cause. It deals with a model of anticipatory inspiration, that is revealed to be useful if evidencing material and environmental conditions and also of behaviors indicated as associated with increase in the risk of accidents. The highlighted actions and omissions tend to be judged per se. Their occurrence and, at times, the mere supposition of occurrence are interpreted as proof of operator failure, implicating judgement of his responsibility and of his guilt.

Adoption of analyses of changes, barriers and concepts like system, activity and their components, rules of logic etc., in new techniques of analyses of accidents, aids in systematizing them at the same time in which it expands the perimeters of these investigations.

Change Analysis

In accord with the notion of analysis of changes, if the system were to function in the same manner as in a normal situation or one without accidents, these would not occur. The occurrence of an accident always demands the appearance of some change or variation in functioning of the system without accidents. As a consequence, to analyze an accident is to identify these changes and the conditions of this system that permitted its origins (Binder, 1997; Monteau, 1979).

What is the definition of a normal situation or comparison standard necessary for the identification of changes? In the traditional approach, the definition used most often refers to a restricted concept of deviation, understood as "every action or condition that is not in accord with the norms of work, procedures, legal or normative requisites, system requisites of management, good practices, etc., that can, directly or indirectly, bring damage to the person, to the environment, or to one's own property or to that of a third party, or a combination of these" (DuPont do Brasil, 2003).

Discussing change analyses, Johnson (2002) affirms that the different standards can be taken as an ideal condition: descriptions contained in documents, such as routines, step-by-step, operational norms ("guidelines"), contracts, accords or conventions; safety norms etc., according to the case. An ideal condition also could be that which existed before  the accident. This distinction is considered important because in the origins of an accident could be "inadequate practices maintained for much" time. In these circumstances, the focus of analysis should be much more on the reasons for the presence of these practices.

From the operational point of view, the conduction of analyses based on this principle tends to show differences in relation to choice of comparison standard. In the case of the tree of causes technique, it is recommended that the safety team adopt as the standard the knowledge of the routine or habitual situation of work, that will be compared with the findings of the situation present in the accident, in a manner to permit the identification of variations (Binder, 1997; Monteau, 1979). Applying current language concepts of Ergonomics, in these methods emphasizes that the comparison standard would be the real work, the activity, and not the prescribed work (Guérin et al., 1997). More recently, Rasmussen (1997) refers to these same concepts using the expressions established practices and specified practices.

For practical reasons, techniques of analyses based on this notion, like the tree of causes method, recommend the initiation of reconstruction of the event by its ultimate happenings. The existence of an injured worker or of a damaged product is an easily identifiable change that serves perfectly the proposals of this type of analysis (Binder, 1997; Monteau, 1979).

One of the differences established by the use of this notion in accident analysis practices is the emphasis of explication of what really happened, instead of more reports that explained the occurrence with the indication of a supposedly unexecuted norm or rule, or of an action that was not carried out by workers, or even of non-existent protection that should exist, etc.

This approach introduces into the system a discussion on the stop rule to be adopted in analyses. In practice, the process leads the team in search of causes of causes, and so on, successively. The changes identified associated with rules of logic are utilized as a guideline for elaboration of diagrams of changes having occurred and of the "causes" of their origins. Each of the aspects represented aims for the continuity of the design and so on, successively. Subsequently, the scheme is completed with the representation of habitual conditions of the system that participated in the accident. One of the manners of doing this is to associate an analysis of barriers with an analysis of changes.

Taken seriously, this process flows into the identification of managerial practices and choices of diverse subsystems, and even of the high hierarchy of the enterprise, habitually not discussed by the security team, whose exploration can represent a potential source of embarrassments in the organization. In enterprises that are not prepared to accept such questioning, they tend to be restrained and the analyses tend to be concluded in early stages of the questioning process. Sometimes they explore aspects of a technical dimension involved in the accident, countering the presupposition of methods of analyses that consider enterprises as open socio-technical systems (Lima & Assunção, 2000).

Chart 2, already presented, includes a summary of the notion of an accident and of forms assumed in techniques of investigation based on analysis of changes.

Barrier Analysis and Assumed Risk

In accord with the notion of analysis of barriers, the accident always involves the release of an energy flow, potentially dangerous, that was controlled by barriers, or preventive measures, existent in the system. Eventually, the system could not have the indicated barriers, even to contain that energy temporarily. The barrier analysis consists of identification of the energy forms released in the accident and of the reasons that explain their release. Emphasis is placed on exploration of barriers that existed or should have existed in that system and in evidence of the potential contribution of each one of them in that scenario. Could one barrier that was not present have avoided the accident or minimized its consequences? In the affirmative case, how can its absence be explained? Did some existent barrier fail? Why? And so on, successively.

Although, in safety practices, the notion of technical barriers of protection would be better known, the analysis of barriers adopts a more inclusive comprehension. Thus all types of possible barriers must be explored. For example, the definition of criteria for purchases of materials or for intervention decisions in cases of detection of failures in the functioning or management of a determinate subsystem; training implementation; development of practices to stimulate the creation of a culture of security; the (non) contracting of specialized counselors; restrictions on overtime hours, etc.

From a practical point of view, different forms of conducting analyses of barriers appear. The method management oversight risk tree (MORT), developed in the 1970s by Johnson (1975), begins with an organization of the temporal sequence of events, so as to identify the different energy flows released in the accident. They are represented in the initial column of the Chart, beside which is the specification of agents or materials vulnerable before the release of that form of energy. The third column of the same Chart must be filled in with barriers known as protections capable of avoiding the flux, diminishing the quantity of energy released or minimizing consequences for living organisms or vulnerable materials (The Noordwijk Risk Initiative Foundation, 2002).

Another form of conducting analysis of barriers is associated with development of models of accidents. The models tend to adopt graphic representation of elements present in an accident. The model of Dumaine (1985) defines accident as an encounter between a susceptible living organism and energy released from potential danger present in the system. It also includes factors unleashed from the energy release that had been previously controlled in the system and factors generating the presence of potential danger. The analysis seeks to identify barriers known as protectors capable of avoiding the encounter, the appearance of factors unleashed from the energy flow, the generation of danger, etc. Many checklists used in analyses of accidents are inspired by the notion de analysis of barriers.

The notion of barriers is adopted by Reason (1997) in the organizational accident model, which denominates active errors the contribution of human behaviors to the release of energy flow occurring in the accident. According to him, the analysis must be extended to the search for causes of causes, in other words, of so-called latent or non-proximal reasons for accidents that, in general, are managerial or organizational.

Supported in concepts such as those described above, the analyses tend to assume determinate systematization, although the degrees of liberty of the team in the conduction process would be relatively elevated, explaining differences in conclusions of analyses of the same type of event, by different teams that use the same technique. Another source of differences in results of analyses is in the degree of mastery of the technique and in the conception of the accident on the part of members of the teams. The form in which each understands notions of the accident, of analyses of changes and of barriers, of the open sociotechnical system, of human behaviors in the system etc., influences the conclusions of the analysis.

One of the basic differences between analysis of barriers and analysis of changes is that the latter is shown to be more refined with information collection practices based on open-ended questions.  In this manner previously unanticipated reasons can be identified and foment discussion about their eventual role in the origins of an accident. Furthermore, to conduct a search of the causes of causes and decide on the endpoints of the analysis, the team must discuss and explain the reasons associated with the choice of these points. In the analysis of barriers, the list of causes tends to overlap. In turn, realized as a complement to analysis of changes, the analysis of barriers can contribute to an expansion of analysis and indication of other prevention strategies.

Another concept that comes to be associated with these two is that of assumed risk or residual risk. It deals with risk identified in previous analysis and assumed after technical evaluation. The decision to assume it is conscious, for example, because the adoption of corrections would be impractical. The authors involved in this type of decision need to prove that it was taken in a satisfactory manner (The Noordwijk Risk Initiative Foundation, 2002).

Considering that systems must be conceived incorporating analyses of barriers based on the most current scientific knowledge; and that, at the same time, from its conception to installation and operation these systems pass through changes that need to be considered in SGSST, so as to avoid losses and accidents, the idea grows that the acceptable risk in the operation of any system is that associated with aspects that cannot be controlled with the resources offered in light of more current knowledge.

In other words, the systems need to demonstrate that they stem from the best and most current practices and prevention tools for the control of dangers and risks.  To do this, they would also be assuming the risk of occurrence of unanticipated and uncontrolled events with these better resources:  the assumed or residual risk of the system. Among these uncontrollable risks, are those still unknown, such as those associated with unexpected interactions between system components that, in the majority of situations, present mutually independent behavior.

One of the advantages attributed to the use of these techniques is the possibility of systematization of analyses:  of data collection to ascertain the impact of measures implemented. This process tends to diminish the number of unexplored aspects, of bias originated in the formation of analysis team members, and reinforces the necessity of crosschecks with the use of different information sources. Other advantages attributed to this model of analyses are:  identification of patterns of accidents and of organizational aspects present in accidents. The identification of similar aspects in accidents uses a notion equivalent to that of saturation:  "phenomenon by which, past a certain number of interviews, [...] the researcher or team has the impression of not acquiring new knowledge relative to the sociological object of inquiry" (apud Bertaux, 1980, p.205).

Chart 2 also includes a summary of the accident notion and of the paths assumed by investigations based on analyses of barriers.

Discovering the subjective dimension of accidents

Although techniques based on the theory of systems harshly criticize narrow behaviorist approaches and the reductionism of "analyses" of accidents that attribute blame to victims of these events, in many cases, they also do not respond adequately to questioning arising around the subjective dimension of accidents. In a certain manner, exploration of aspects of the organizational dimension of these accidents appears to be taken as negation of the antecedent.

The critique of Goguelin centers on the absence of exploration of cognitive aspects, whose approach gained impetus with the development of the cognitive approach in psychology and in ergonomics. It seems important to establish the fact that, at the beginning of the 1970s, when the ADC method was developed, the utilization of concepts from the cognitivist school in studies on the work world occurred in an embryonic manner.

In the experience of the author, in many situations of use of the causal tree method, the lack of a distinction between ADC tree and analysis and, in particular, the lack of an explicitation of the necessity of the complementary conceptual approach of aspects represented in the scheme had contributed to the occultation of invisible aspects of work, impoverishing interpretations and conclusions of analyses.

Nevertheless, parallel to the development of techniques based on analyses of changes, of barriers and in the idea of assumed risk, there also appeared new forms of analyses of accidents inspired by concepts of sociology, anthropology, social and cognitive psychology, and of ergonomics of activity, indicating new paths for the collection, organization and interpretation of data relative to the origins and prevention of accidents. These contemporaneous approaches will be presented in another text.

Formulation and selection of prevention measures

The different techniques of analyses commented upon associate orientations of systematization of the formulation process and the selection of prevention recommendations.  The causal tree method recommends that the participants be stimulated to suggest the direct elimination of determinate factors, the creation of barriers that impede the origins of these same factors and the suppression of elements necessary to their origins. Whenever possible, the initial list of recommendations should include proposals of these three types for each of the factors represented in the scheme, and also for the potential problems or factors formulated during the interpretation of the scheme. The utilization of selection criteria of proposals elaborated also is emphasized. Among the criteria that would assist the systematization of analysis and choice of priorities, the following stand out:  1.) stability of the measure in time; 2.) additional cost - physical, cognitive or affective - of the measure for the operators; 3.) possibility of dislocation of risk to other parts or even to other systems; 4.) is the reach of the measure - localized or capable of extending its benefits to other parts of the system? 5 is the time necessary for its application - immediate or does it demand long-term maturation? (Binder & Almeida, 2003)

In turn, after dividing the accident into ten phases, going from pre- to post-lesion, Haddon (1973) proposed ten types of preventive strategies, shown in Chart 3.

The appearance of criteria of evaluation of preventive measures aggregates another type of criticism to traditional approaches of accidents that, in Brazil, resulted almost always in suggestions for changes of behavior of accident victims and their colleagues. This type of suggestion is described as ineffective when adopted in isolation, and as presenting the lowest stability in time, above all, if not conceived with an adequate program of periodic reinforcements.

In psychology, studies appear that show other limits and fragilities of training proposals supposedly directed toward behavioral changes (Kouabenan, 1999; Rogers & Mewborn, 1976; Levanthal et al., 1965). A large portion of the proposals destined for prevention of accidents is based on fear stimulus. Studies show that fear or shock provoked by terrifying messages is an emotion that disperses before the time necessary for behavioral change to occur. This is one of the reasons that explains differences found among declarations of attitudes favorable to changes in behavior and effective changes of behaviors of persons interviewed after exposure to this type of stimulus (Kouabenan, 1999; Rogers & Mewborn, 1976; Levanthal et al., 1965).

The expressions passive and active prevention were utilized generically to designate, respectively, measures that demand the active participation of those involved, such as the utilization of equipment of individual protection, and measures that dispense this participation, such as automatic blocking devices that stop movements of machines when there are worker body parts nearby (Gielen, 1992; Baker et al., 1982). The notion of safe failure appears in association with these ideas (Baker et al., 1982; Haddon & Baker, 1981) to indicate that the systems must be conceived so as to tolerate the occurrence of failures.

Questions appear on appropriate techniques for the approach of this new type of "risk factors" and with respect to the profile of professional formation necessary for security teams. There also appear lines of questioning on the characteristics of organizations favorable or unfavorable to the development of health and security policy advances an active and permanent manner to address this type of questions.

The response given to these lines of questioning, in marks of the traditional approach, is the exacerbation of behaviorist practices. Insisting on the idea that the principal causes of accidents on unsafe or similar acts, behavioral security proposals appear. Some of them refer to the necessity for changes, also, in behaviors of their managers and intermediate bosses, although in practice this aspect persists neglected.

Implantation of corrections and their follow-up

The subsystem of analysis of accidents organizes a process of evaluation of prevention recommendations originated in its activities, as well as the implementation and follow-up of the measures chosen, demanding a formal definition of flow for transaction of reports, definition of those responsible for taking decisions, for their implementation and for checking their respective chronogram.

Another important aspect is the necessity of follow-up of the impact of measures implemented in which the occurrence of accidents is referenced that include similar aspects, almost equal to those it intended to control with the measures adopted. In case this occurs, especially in a frequent manner, it is very probable that the team is faced with signals that permit it to think of failure of previous effort and of the necessity of reanalysis of the situation. Unfortunately, in many cases, in these hours, resistance originating from the traditional approach comes to the surface. The signals that the situation sends are interpreted as confirmation of the fallibility of the human component of the systems, presenting an opportunity for and reinforcing normative recommendations, new rules, procedures and even the punishment of  "indisciplined" or "deviant" persons.

Feedback from the system

The process of systematization of accident analysis is completed with the development and implantation of practices of feedback from the system with the results obtained.

In the initial phases of this process, it aims to share immediate findings with the other members of the system. One of the motors of this practice is the idea of informing, at which they participated in the analysis process, the conclusions obtained so as to highlight the importance of their contributions to the perfecting of the system. In this way, it strengthens the possibility of future contributions, especially in systems that effectively implement recommendations of impact on improvement of their security and reliability and they show plenary recognition of contributions of diverse participants. Subsequently, associated with the notion of SGSST, feedback incorporates new objectives, such as that of becoming the source of updating and continuous improvement of the risk evaluations present in the system.

With the advent of the Internet, the forms used to test this feedback gain new possibilities and greater agility.

Final commentaries

This text rescues aspects of the trajectory of accident analysis, aiming to show that, from the technical point of view, there are already elements that justify the diminution of the occurrence of analyses circumscribing behaviors of victims close to the lesions. Among these are highlighted:  the appearance of notions of direct causes and basic causes; the introduction of analyses of changes, above all in cases in which the standard definition of deviation is based on real work and in which there is explicitation of stop rules of the analysis, and the practices of analyses of barriers used in association with models that include the exploration of the organizational origins of accidents and as a complement to analyses of changes.

The fact of concentrating on recommendations of prevention classified as low stability in time or isolated use of active measures also calls attention to the persistence of the traditional approach. In situations in which the work system remains unaltered, the follow-up of the implantation of these measures can reveal a recurrence of accidents with similar aspects, in other words, the exhaustion of the reach of these recommendations.

Unfortunately, in a large number of analyses, the identification of behavior classified as lacking continues to be interpreted as a sign of failure or low reliability of the human component of the system, capable of being corrected with punishment of "deviation". In synthesis, not even the introduction of techniques of analysis of socio-systemic inspiration breaks with the marks of the traditional approach. In some cases, analyses of this type of accidents indicate, as the "basic cause", the existence of failure of supervision of compliance to prescribed behaviors.

A recent study, elaborated at the request of the Health and Safety Executive in the United Kingdom, points out requirements of a successful incident investigation (Health and Safety Commission, 2001): 1.) A causal model that represents a system-based approach to incident investigation; 2.) Involvement of relevant individuals within the investigation; 3.) The identification of both immediate and underlying causes; 5.) The development of recommendations that address both immediate and underlying causes; 6.) The implementation of these recommendations and the updating of relevant risk assessments; 7.) Follow up to ensure that actions taken are successful in reducing the risk of further incidents; 8.) Feedback to relevant parties to share immediate learning; 9.) The development of an accessible database.

As can be seen, part of the limits and lines of questioning already commented upon remains absent from the list above. Nevertheless, some of the characteristics listed, such as that at number two, the updating of evaluations of risks cited at number six, and at number nine (that deals with the notion of databases as a component of a system of vigilance against accidents), already reflect aspects of a conceptual expansion of analysis of accidents.

What is understood by conceptual expansion? The expression is used to designate the incorporation of concepts in the analysis process. Its utilization opens new paths for the comprehension and analysis of accidents. With the use of concepts, starting from the same material, the analysis team can arrive at understandings vastly different from those obtained without their use.

The notion of error trap, developed by Reason (1997) and used by Almeida & Binder (2004), enables the identifying of tasks organized with sequences of steps that increase the chances of omissions in situations initially interpreted as lack of attention by the operators. The concepts of Rasmussen (1982), Reason (1999; 1997) and Reason & Hobbs (2003), as well as those of activity, regulations, competencies, situated cognition, systematic migration to the accident, indicate new routes for analyses of human behaviors in work accidents. Differently from traditional approaches, in the new approaches the accident is organizational and the origins of behaviors are sought in material and social circumstances of the work context understood as circumstances that influence the ways of psychic management used by operators in work (Vidal-Gomel & Samurçay, 2002; Lima & Assunção, 2000; Rasmussen, 1997).

In what direction will the analysis of accidents go? The contemporary debate is shown to be divided into two great currents: behavioral safety versus systemic safety. The behavioral approach defends the idea that the principal causes of accidents are "unsafe acts" that equate to active errors of operators. Therefore, the English abbreviation for behavioral security programs, BS, ("behavioral safety"), comes to be used for workers' movements as an abbreviation for programs of blame attribution ("blame-the-worker safety programs").

The systemic approach contains models of accident psycho-organizational dictums and rejection of the negative idea of human error present in the traditional approach. The following gain prominence: a) the recognition of the contribution of the social or human subsystem for the safety of systems; b) the contribution of structural characteristics and of the material and social circumstances of the system, especially of responses to environmental pressures for the origins of safety and of risks in the work situation. This approach introduces new challenges to those interested in exploration of the human dimension in open socio-technical systems. Among the most important appear to be:  how are situations identified in which "their" system could benefit from the use of conceptual expansion? How can it be known which concepts will be useful in each situation? These aspects will be reevaluated in another text.

Acknowledgements: Professor Chris W. Johnson, Accident Analysis Group of Glasgow, Department of Computer Engineering, University of Glasgow; Research Support Group, Faculty of Medicine of Botucatu, UNESP.

References

ALMEIDA, I.M. Construindo a culpa e evitando a prevenção: caminhos da investigação de acidentes do trabalho em empresas de município de porte médio. 2001. Tese (Doutorado) - Faculdade de Saúde Pública, Universidade de São Paulo, São Paulo.

Almeida, I. M.; Binder, M. C. P. Armadilhas cognitivas: o caso das omissões na gênese dos acidentes de trabalho. Cadernos Saúde Púb., v.20, n.5, p.1373-8, 2004.

BAKER, S. P.; SAMKOFF, J. S.; FISCHER, R. S.; VAN BUREN, C. B. Fatal occupational injuries. JAMA, v.248, n.6, p.692-7, 1982.

BAUMECKER, I. C. Accidentes do trabalho: revendo conceitos e pré-conceitos com o apoio da Ergonomia. 2000. Dissertação (Mestrado) – Engenharia de Produção, Universidade Federal de Minas Gerais, Minas Gerais.

BERTAUX, D. L'approche biographique: sa validité méthodologique, sés potentialités. Cah. Int. Sociol., v.49, p.197-225, 1980.

BINDER, M.C.P. O uso do método de árvore de causes na investigação de acidentes do trabalho típicos. Rev. Bras. Saúde Ocup., v.23, n.87/88, p.69-92, 1997.

BINDER, M. C. P.; ALMEIDA, I. M. Acidentes do trabalho: acaso ou descaso. In: MENDES, R. Patologia do trabalho. São Paulo: Atheneu, 2003. p.769-808.

BINDER, M. C. P.; ALMEIDA, I. M. Estudo de caso de dois acidentes do trabalho investigados com o método de árvore de causes. Cad. Saúde Pública, v.13, n.4, p.749-60, 1997.

CATTINO, M. Da Chernobyl a Linate. Incidenti tecnologici o errori organizzative? Roma: Ed. Carocci, 2002.

DUMAINE, J. La modélisation du phénomène accident. Accidentologie et recherche a priori des risques graves. Sécur. Méd. Trav., n.71, p.11-22, 1985.

DUPONT DO BRASIL S.A. Técnicas de gestão em SMS com treinamento em auditoria comportamental. Manual do Participante. Barueri, 2003.

DWYER, T. A study on safety and health management at work: a multidimensional view from a developing country. In: FRICK, K.; JENSEN, P.L.; QUINLAN, M.; WILHAGEN, T. Systematic occupational health and safety management. Amsterdam: Pergamon, 2000. p.149-74.

GIELEN, A. C. Health Education and injury control: integrating approaches. Health Educ. Q., v.19, n.2, p.203-18, 1992.

GOGUELIN, P. La prévention des risques professionnels. Paris: Presses Universitaires de France, 1996.

GUÉRIN, F.; LAVILLE, A.; DANIELLOU, F.; DURAFFOURG, J.; KERGUELEN, A. Comprender o trabalho para transformá-lo: a prática da ergonomia. São Paulo: Edgard Blücher, Fundação Vanzolini, 2004.

HADDON JR., W.; BAKER, S. P. Injury control. In: CLARK, D. W.; MACMAHON, B. Preventive and community medicine. Boston: Little, Brown and Company, 1981. p.109-40.

HADDON JR., W. On the scape of tigers: an ecologic note. J. Trauma, v.13, p.321-31, 1973.

HEALTH AND SAFETY COMISSION. Proposals for a new duty to investigate accidents, dangerous occurrences and diseases. London: Health and Safety Executive, 2001. Disponível em: <www.hse.gov.uk>. Acesso em: 12 jan. 2005.

HEALTH AND SAFETY EXECUTIVE. Investigating accidents and incidents: a workbook for employers, unions, safety representatives and safety professionals. London: Her Majesty's Stationery Office, 2004.

HEALTH AND SAFETY EXECUTIVE. Root causes analysis. Norwich: Her Majesty's Stationery Office, 2001.

HEINRICH, H. W. Industrial accident prevention: a scientific approach. New York: McGraw-Hill Book Company, 1959.

HOOD, C.; JONES, D. K. C. Anticipation in risk management: a stitch in time? In: HOOD, C.; JONES, D. K. C. (Ed.) Accident and design: contemporary debates in risk management. London: University College of London, 1996. p.10-3.

JOHNSON, C. W. Failure in safety-critical systems: a handbook of incident and accident reporting. Glasgow: University of Glasgow, 2003. Disponível em: <http://www.dcs.gla.ac.uk/~johnson/book/>. Acesso em 27 ago. 2004.

JOHNSON, C.W. A brief overview of causal analysis techniques for electrical, electronic or programmable, electronic systems. Glasgow: University of Glasgow, 2002. Disponível em: <www.dcs.gla.ac.uk/~johnson>. Acesso em 12 fev. 2004.

JOHNSON, W. G. MORT: Management Oversight and Risk Tree. J. Saf. Res., v.7, n.1, p.4-15, 1975.

KOUABENAN, D. R. Explication naïve de l' accident et prevention. Paris: Presses Universitaires de France, 1999.

LEVANTHAL, H.; SINGER, R.; JONES, S. Effects of fear and specificity of recommendation upon attitudes and behavior. J. Pers. Soc. Psychol., n.2, p.20-9, 1965.

LEVESON, N.G. A new accident model for engineering safer systems. Saf. Sci., n.42, p.237-70, 2004.

LIMA, F. P. A.; ASSUNÇÃO, A. A. Análises de acidentes: Cia. de Aços Especiais Itabira. Belo Horizonte: Laboratório de Ergonomia DEP/UFMG, 2000.

LIVINGSTON, A. D.; JACKSON, G.; PRIESTLEY, K. Root cause analysis: literature review. London: Health and Safety Executive, 2001. Disponível em: <www.hse.gov.uk/research/>. Acesso em: 14 abr. 2004.

LLORY, M. L'accident de la centrale nucléaire de Three Mile Island. Paris: L'Harmattan, 1999.

MONTEAU, M. Bilan des méthodes d'analyse d'accidents du travail. Nancy: France, 1979. [Rapport nº 456 / RE, INRS].

EBOIT, M. Abordagem dos fatores humanos na prevenção de riscos do trabalho. In: ALMEIDA, I.M. (Org.) Caminhos da análise de acidentes do trabalho. Brasília: Ministério do Trabalho e Emprego, 2000. p.85-98.

RASMUSSEN, J. Risk management in a dynamic society: a modelling problem. Saf. Sci., v.27, n.2/3, p.183-213, 1997.

RASMUSSEN, J. Human errors: a taxonomy for describing human malfunctions in industrial installations. J. Occup. Accid., n.4, p.311-35, 1982.

RASMUSSEN, J.; SVEDUNG, J. Proactive risk management in a dynamic society. Karlstad: Räddningsverket Swedish Rescue Services Agency, 2000.

REASON, J. Human error. 2.ed. Cambridge: Cambridge University Press, 1999.

REASON, J. Managing the risks of organizational accidents. Aldershot: Ashgate, 1997.

REASON, J.; HOBBS, A. Managing maintenance error. Aldershot: Ashgate. 2003.

ROGERS, R. W.; MEWBORN, C. R. Fear appeals and attitude change: effects of a threat's noxiousness, probability of ocurrence, and the Efficacy of Coping Responses. J. Pers. Soc. Psychol., n.34, p.54-61, 1976.

THE NOORDWIJK RISK INITIATIVE FOUNDATION. NRI mort user's manual. Netherlands: the Noordwijk Risk Initiative Foundation, 2002. Disponível em: <http://www.nri.eu.com/toppage3.htm>. Acesso em: 15 jul. 2004.

VIDAL-GOMEL, C.; SAMURÇAY, R. Qualitative analysis of accidents and incidents to identify competencies. The electrical systems maintenance case. Saf. Sci., n.40, p.479-500, 2002.

VILELA, R. A. G.; IGUTI, A. M.; ALMEIDA, I. M. Culpa da vítima: um modelo para perpetuar a impunidade nos acidentes de trabalho. Cad. Saúde Pública, v.20, n.2, p.570-9, 2004.

Recebido em: 12/04/05. Aprovado em: 30/10/05.

* Trabalho produzido com apoio da Fundação de Amparo à Pesquisa do Estado de São Paulo, Fapesp (proc. nº 0302475-4).
1 Departamento de Saúde Pública (FMB/Unesp)
Caixa Postal: 549 Botucatu, SP
Brasil - 18618-970.