安全研究的光譜與地圖2(Why)

Why Safety (or Accident Causality Theory)

為什麼需要安全或事故因果的理論? 

安全或事故因果理論的用途與用法?

人就是會問Why? 科學理論就是回答解釋與安撫人的疑問與好奇心(探索真理與自然法則，進而掌控塑造自己的命運與發展)

兩種運用邏輯與數學來認識世界的科學方式與觀點：

• 形式分析Formal Analysis: 用符號、邏輯與模型來proxy問題與世界的規律
• 實證分析Empirical Analysis：用觀察與實驗的方式來發現運作的規律 

各種安全與事故理論≒形式分析Formal Analysis：

• 理論=一種說明而非證明、一種詮釋而非解釋，用於proxy真實問題與現實世界的規律
• 人所能理解的不是問題與世界的真實全貌，而是自己腦中的那套因果邏輯與理論(≠真實)

Kristian González Barman 2023

Accident Causation Models: The Good the Bad and the Ugly

Engineering Studies

What is the good of accident causation models?

The Benefits of Accident Causation Models

Accident Causation Models (ACMs) play a crucial role in understanding and preventing accidents. Here are some of the key benefits:

• Understanding Complex Systems: ACMs, particularly systemic models, allow for a comprehensive understanding of complex interactions within systems. They represent non-linear causal relationships, which can lead to better safety (re)design information and suggest effective countermeasures 
• Proactive Prevention: These models aim to proactively prevent accidents by identifying potential hazards and weaknesses in safety systems. By analyzing how different factors contribute to accidents, ACMs help in designing interventions that can mitigate risks before incidents occur 
• Counterfactual Inferences: ACMs are valuable for producing relevant counterfactual information, which is essential for improving safety. This means they can help in understanding what could have been done differently to prevent an accident, thus providing insights for future safety measures 
• Assigning Blame: In situations where it is necessary to determine accountability, linear models are particularly effective. Their semantic simplicity allows for clearer identification of causes and responsibilities, which can be important in legal and organizational contexts 
• Effective Communication: Epidemiological models excel in audience communication. They provide cognitive salience, making it easier for stakeholders to understand the risks and safety measures involved. This is crucial for training and informing personnel about safety protocols 
• Evolution of Understanding: The evolution of ACMs reflects a shift from simplistic models to more sophisticated approaches that consider the entire system. This evolution enhances the epistemic value of these models, allowing engineers and safety scientists to better evaluate and improve safety practices 

In summary, the good of Accident Causation Models lies in their ability to enhance safety through understanding complex systems, preventing accidents, providing valuable insights, and facilitating effective communication among stakeholders.

What is the bad of accident causation models?

While Accident Causation Models (ACMs) offer several benefits, they also have notable drawbacks. Here are some of the key issues associated with these models:

• Oversimplification: Many traditional ACMs, particularly linear models, can oversimplify complex systems by reducing them to a single causal chain. This reductionist approach may overlook critical interactions and emergent phenomena that contribute to accidents, leading to incomplete analyses and ineffective safety measures 
• Limited Applicability: Some models may not be suitable for all types of accidents or industries. For instance, linear models are better for blame assignment but may not capture the complexities of modern systems, which can result in inadequate safety assessments 
• Cognitive Bias: The reliance on certain models can lead to cognitive biases in understanding causality. For example, stakeholders may focus too heavily on blame assignment rather than on systemic improvements, which can hinder the development of comprehensive safety strategies 
• Neglect of Human Factors: Many ACMs, especially older models, tend to downplay the role of human error and organizational culture in accidents. This can lead to a lack of focus on training and human factors engineering, which are essential for improving safety in complex environments 
• Inadequate Communication: While some models are designed for effective communication, others may fail to convey the necessary information to stakeholders. This can result in misunderstandings about risks and safety protocols, ultimately undermining safety efforts 
• Resistance to Change: The evolution of ACMs has led to more sophisticated models, but there can be resistance to adopting these newer approaches. Organizations may cling to outdated models due to familiarity, which can prevent the implementation of more effective safety practices 

In summary, the bad aspects of Accident Causation Models include their potential for oversimplification, limited applicability, cognitive biases, neglect of human factors, inadequate communication, and resistance to change. These issues can hinder the effectiveness of safety interventions and the overall understanding of accident causation.

What is the ugly of accident causation models?

Accident Causation Models (ACMs) have several "ugly" aspects that can significantly impact their effectiveness and the safety outcomes they aim to achieve. Here are some of the critical issues:

• Misleading Conclusions: Some ACMs can lead to misleading conclusions about the causes of accidents. For instance, if a model focuses too heavily on linear causation, it may ignore the complex interactions within a system, resulting in a false sense of security or misdirected safety efforts 
• Inflexibility: Many traditional models are rigid and do not adapt well to the dynamic nature of real-world systems. This inflexibility can prevent organizations from effectively responding to new challenges or changes in operational environments, leading to outdated safety practices 
• Overemphasis on Blame: Certain models, particularly linear ones, can foster a culture of blame rather than a culture of learning. This focus on assigning blame can discourage open communication about safety issues and hinder the identification of systemic problems that need addressing 
• Neglect of Systemic Interactions: The evolution of ACMs has shown a shift towards recognizing systemic interactions, yet many models still fail to adequately represent these complexities. This neglect can result in a lack of understanding of how different components of a system interact, which is crucial for effective safety management 
• Philosophical Limitations: The philosophical underpinnings of some ACMs may not align with contemporary understandings of causality and complexity. This can lead to models that are not only outdated but also philosophically flawed, limiting their utility in modern safety science 
• Potential for Misuse: ACMs can be misused to justify poor safety practices or to downplay the significance of certain risks. This misuse can occur when stakeholders selectively interpret model outputs to support their agendas, rather than using them as tools for genuine safety improvement

事故因果模型的用處與用途

不外乎以下幾點：

• 事故分析： 事故因果模型提供了一個系統化的框架，可以幫助分析人員更全面地了解事故發生的原因、過程和 contributing factors。 模型可以引導分析人員關注系統中不同的層面，例如技術、組織、人員和環境等，避免僅關注單一原因或歸咎於人為疏失。
• 識別潛在風險與導致事故發生的因素： 通過事故調查，分析發生的原因和 contributing factors，事故因果模型可以幫助識別系統中潛在的風險因素。 這有助於組織採取主動 proactive 的安全管理措施，降低事故發生的可能性。
• 系統改進(不要頭痛醫頭/打補釘)： 事故因果模型可以幫助識別系統中的設計缺陷、管理漏洞和操作問題。 基於分析結果，組織可以針對性地改進系統，例如更新設計、完善流程、加強培訓等，以提升系統的安全性。
• 累積經驗、知識管理： 通過分析事故案例，組織可以從中吸取教訓，避免重蹈覆辙。 事故因果模型可以幫助組織將事故分析的結果與相關數據轉化為可學習的經驗與資訊資料庫，並將這些經驗、知識與資訊應用於日後的安全管理中。
• 溝通和決策： 事故因果模型可以提供一個共同的語言和框架，方便不同領域的專家和管理人員進行溝通和交流。 模型可以幫助組織更有效地傳達安全資訊，並制定更科學的決策。

不同的事故因果模型適用於不同的情境，需要根據具體的分析目標和系統特點來選擇。 例如，瑞士乳酪模型適用於分析簡單的事故，而 STAMP 模型則更適合分析複雜系統中的事故。

事故因果模型僅僅是分析和預防事故的工具之一，不能完全依賴模型來解決安全問題。 組織需要將模型的應用與其他安全管理措施相結合，才能有效地提升系統的安全性與落實意外與事故。

安全與事故理論的誤導

潛在問題和挑戰：

• 過度簡化事故成因：各種方法與因果邏輯依賴結構化的分析，而忽略了複雜的人為因素、組織文化、以及管理決策等在事故中扮演的角色。事故描述可能因為資訊不足，無法全面了解事故發生的根本原因，或是過度聚焦於直接的行為，而忽略了潛在的系統性問題。
• 引導依賴「屏障(硬體防護機制)」：屏障的概念能激發人們思考各種安全措施+硬體防護機制比人可靠，但過度依賴屏障與硬體機制所導致的虛假安全感是另一種風險。如果屏障設計不良、未能有效執行或被錯誤使用，乃至於各種硬體防護機制其實可靠度不如預期，遭遇意外與出錯反而會導致嚴重的事故。
• 安全與管理都是系統與組織運作的一部份：各種研究分析把安全或管理機制當成獨立的可控變因，實際上安全或管理機制的良莠往往受組織運作所制約(The richer the safer)，各種安全文化理論訴求管理階層的決策和資源分配對安全至關重要，但正因管理高層與組織資源分配忽視安全，所以才導致組織安全績效不彰，安全文化理論的訴求落入緣木求魚與雞生蛋蛋生雞的邏輯誤謬。
• 人是最大的變異(不可控)因素：事故因果描述中，往往提及「未辨識危害」、「不了解原因」等，這暗示了人的認知、判斷、以及決策在事故中的重要性+提升的可能性。然而「人」的行為、認知限制、以及決策過程，就是不受控、無法預料；訴求制定標準作業程序、硬體防呆機制與訓練宣導，某個層次而言，也是主事者的一廂情願/自我感覺良好+訴諸應為能為而不為的獵巫。
• 找出問題原因=「改善」，是一種誤解：問題的發生往往有如冰凍三尺非一日寒，「持續改善」一詞意味著：「改善」並非一次到位+藥到病除，而是持續的過程。如果對「系統」運作與系統動力的理解不夠深入，所謂的改善也可能是逆行倒施+助紂為孽，導致更大的風險潛勢蓄積+直到爆發更重大(無法掩蓋)的問題重複。因果循環相生相依。

不需安全或事故因果理論的對立觀點

1. 命中注定(宿命論)
2. 隨機無常(是自然法則，人無能為力)
3. (已經盡力了)事情(還是)發生了就發生了，(記取教訓)向前走往前看(殺不死我的使我更強大)
4. 了解了(複雜的來龍去脈與因果關係)又如何？(無法保證事故不會發生，零災害是個不可能達成的願景夢想+不可能完美掌控各項變因)
5. 各種安全或事故因果理論，有如讓人帶上各種有色眼鏡或濾鏡：讓人看清楚某些變因也忽視遮蓋掉另一些變因；誤用這些理論觀點有如吃錯藥造成更大的傷害
6. 各種安全或事故因果理論如同各種科學理論(存在缺陷與難以相容兼顧：橫面斷與縱斷面、微觀與宏觀、越複雜詳盡看似完備，但卻越難用)