Published On-line 10/12/20


The Institute per se has no philosophy on causation but does, of course, maintain a deep, multi-disciplined understanding of it. Naturally, therefore, we will respond to claims or findings that could potentially impact a discipline’s understanding, and act accordingly. As a result of a Safety Differently article, I posted my intention in February 2017 to pass certain questions to the Research & Development Centre (RDC). Over a 14 month period, a collection of interrelated research reports were produced, and progressively placed into the public area of the IIAI web site. The collection remained in its entirety for 24 months from February 2018 and was then archived for RDC and Corporate sponsor use.

Following numerous requests from amongst the International community, I asked the RDC to re-upload certain elements as time permits. For now, Parts 1. and 2. below summarise some of the findings that led to the RDC’s current position. That position statement arises, not least, from the following areas of concern in the article. At each point of concern, I have raised specific questions to be answered by the RDC in their Part 1. summary below.

At page. 21., John Green (then Health & Safety Director for Laing O’Rourke) says Safety Differently is the “new safety paradigm”, “the new gospel”. Questions: a). what is the current or prevailing paradigm, and b). how is it different to the ‘new one’?

Within the article’s inset piece on Dekker’s (2015) book, Safety Differently, we find professors Hollnagel, Dekker and Reason claiming that “Domino theory” (targeted at Heinrich) is a fundamental article of faith of the safety profession. Linked to that, the science of ‘cause and effect’ and linear thinking come under fire at p.22., along with calls to reject science and Heinrich. Questions: a). is the statement regarding Heinrich valid, b). what, according to the cited professors, is wrong with the science of cause and effect, c). what alternative approach to causation do they propose, and d). is the professors’ causal thinking based on ‘cause and effect’ (i.e. linearity), emergence/complexity (i.e. non-linearity), or something else?

As a primary theme of the article, Green blames Laing O’Rourke’s (LoR) version of ‘zero harm’ for three fatalities experienced by the company in November 2013, and July and October 2014. Amongst other things, at p.21., he says the fatal accident sites showed “no early warning signs of a lax safety culture”. No questions arise here since Part Two deals fully and separately with zero harm and the fatalities.

At page 20., Green says LoR are moving away from the “notion that minor accidents are the predictors of major ones”. At page 21., he adds that the fatal accident sites did not “send up the early warning flags that ‘Heinrich’s triangle’ would suggest”. Question: what is the basis of Green’s expectation for warning or prediction?

Despite its claims and criticisms, solutions seem scant for Safety Differently. Indeed, as Green puts it on page 21., each project will be “trying out different ideas in a different way”. However, those ‘ideas’ will be based on assumptions that the above claims and criticisms have some sort of empirical or scientific validity. If, however, any turn out to be suspect or invalid, Safety Differently could be part of the problem, not the solution.

Alan Dell MBE Hon FIIAI, Executive Committee Chairman


The RDC Position

We find no evidence that Safety Differently (either the article or the book) represents a paradigm shift in the cited professor’s (i.e. Dekker, Reason and Hollnagel) philosophy on causation. On the contrary, we found paradigm paralysis insofar as the problematic latent condition has been retained, albeit under the guise of complexity, emergence and non-linearity. We also found the philosophy to be in crisis from repeated failures on two key fronts. 1., the inability to show a causal link between latent conditions and fatal accidents. 2., the inability to derive predictive capability from either accident investigation or accident data. En route, we continued to find Heinrich’s so-called Common Cause Hypothesis to be valid in all settings.

Unrelated to our position statement, Pt.2. contains a focus on the LoR fatalities. That focus arises due to the article identifying the deaths as the reason LoR “rejected its “Mission Zero” campaign”; and, the findings of an allied study into ‘zero harm’ by Sherratt & Dainty (2017) that, we believe, includes LoR and the three deaths amongst its data.

As regards ‘zero harm’ initiatives, the Institute per se normally remains silent on such matters. Given, however, the stance of the article (which many saw as an ill-informed advertisement), the RDC findings are aired to assist IIAI sponsoring organisations genuinely embracing zero. Those findings are also warranted in the interests of safety and risk management generally since we find Sherratt & Dainty’s conclusions to be in error, and misleading.



Safety Differently – Yet Another Attack on Common Cause – by way of the Triangle
Whilst this section starts with ‘the triangle’, the focus turns quickly to Heinrich’s (1941) Common Cause Hypothesis, since ‘attacks’ on the former, inevitably end up with the latter.

As regards its comments on a ‘triangle’, the Safety Differently article expresses the same confusion that led Petersen (1971) to reject Heinrich’s Common Cause Hypothesis. Having seen the number of minor injuries reduce in National reports (i.e. mass, general data), Petersen noted that the number of major and fatal injuries had not reduced in proportion; indeed, some had increased. However, accident data of the sort considered by him represents nothing more than a retrospective (historic) view of accident numbers; i.e. it says nothing about causation, or, incidentally, future risk [1]. Nonetheless, and whilst Heinrich (1941) has never suggested that such injury numbers should fall in proportion to one another (a point we take further in our next report), Petersen believes the data contradicts ‘the triangle’. Consequently, and based solely on the numbers, he concludes that minor injury accidents must have different causes to major and fatal injury accidents, and erroneously rejects the Common Cause Hypothesis [2]. However, already noted, the Common Cause Hypothesis (CCH) is concerned with causation, not numbers. On the other hand, mass data (or ‘the triangle’) involves numbers, not causation.

Before continuing, it may assist to put Petersen’s rejection of the CCH into some sort of context. In effect, he is saying that the cause of, for instance, a scaffolder dropping a scaffold pole into a busy street below, varies according to the injury that results. That is, if the pole misses a pedestrian by, say, 25mm, and no injury results, the cause of the dropped pole is ‘X’. If, however, the pedestrian had been 25mm closer, and been struck and killed by the pole, the cause of it being dropped is now, according to Petersen, different.

Unfortunately, the same confusion persists in Resilience Engineering [3] via Barnett & Wang [4], and in Safety Differently [5] via Barnett & Wang and Saloniemi & Oksanen [6]. In short, and also from mass data, Saloniemi & Oksanen believed they had made a paradoxical discovery regarding safety on Finnish construction sites. According to their data, Finnish construction companies with low numbers of non-fatal accidents, had a higher risk of fatal accidents; and vice versa. In consequence, they offer that this supports the view that fatal accidents and non-fatal accidents have different causes. Similarly, Barnett & Wang, having also considered mass data, offered that the risk of a fatal air accident is lower for a passenger flying with an airline that has high numbers of non-fatal accidents; and, vice versa. For many, Saloniemi & Oksanen’s findings flew in the face of commonsense since, taken literally, a construction company whose employees are having minor to serious injury accidents daily, should never experience a fatality. Similarly, the Federal Aviation Administration were advised that professor Barnett’s findings “should not, of course, be taken literally” [7].

Nonetheless, Dekker et al take the findings as confirmation that ‘triangles’ [8] are flawed and, relying also on Amalberti [9], make three extraordinary leaps of faith. 1., the best a near-miss investigation can do in an ultra-safe system (e.g. commercial aviation), is predict the next near-miss – not the accident. 2., investigations within those systems are of limited use. 3., accidents in ultra-safe systems are emergent, they do not conform to the Common Cause Hypothesis.

From just the above, ‘attacks’ on the triangle or numbers appear to turn quickly to the CCH, even though the two are unrelated. However, when we reduce things to their bare bones, the professors views appear less than coherent, if not somewhat confused. According to Dekker et al (2008), common causes are both obvious and valid (i.e. they also have predictive capability) in “simple systems”, and even in “more complex” ones, such as “commercial aviation”. Despite which, and relying on Barnett & Wang, they then offer that accidents in ultra-safe systems such as “commercial aviation”, do not have common causes! Dekker [5] attempts to clarify the confusion by offering that the Common Cause Hypothesis might only be “probably wrong” at “10-7 and beyond”. However, that only adds to the confusion since 10-7 is a level of safety that, according to Dekker et al [10] themselves, no system has ever achieved (to assist, Amalberti might place the best commercial airlines at 10-6). As for the belief that a near-miss investigation can only predict the next near-miss, that statement cannot be made without the existence of a common cause. As for point 2., the professors’ views, apart from being surprising, are contrary even to those of Barnett & Wang in the very text upon which they rely. Furthermore, and in keeping with a point made decades earlier by Heinrich, Barnett & Wang simply ‘re-confirm’ that there is no relationship between statistics (e.g. numbers in a ‘triangle’), and current safety performance or future mortality risk (hence, the basis of the sort of predictive capability assumed/expected by Green and many others is unknown). That said, and to be clear, the Barnett & Wang study was not concerned with either causal analysis or the CCH; indeed, they made no mention whatsoever of the latter. Despite which, many attempt to rely on their study as support for its rejection.

Unfortunately, the prevailing paradigm may, indeed, be deciding what data is relevant, and how it is gathered, questioned, analysed and interpreted [11]. Nonetheless, and not least for the above, we continue to find the Common Cause Hypothesis to be valid in all settings. Whilst the prevailing paradigm might like the CCH to be invalid, it awaits refutation. Consequently, a founding premise of Safety Differently (i.e. its inbuilt rejection of the CCH) reveals itself to be flawed. Indeed, in respect of ‘the triangle’ and Heinrich in general, academic confusion will continue to reign supreme, to the detriment of many.

[1]. Barnett & Wang (2000).

[2]. Davies et al (2003): Wright & vandershaff (2004).

[3]. Dekker, Hollnagel, Woods & Cook (2008).

[4]. (2000).

[5]. Dekker (2015).

[6]. (1998).

[7]. GRA Inc (1997).

[8]. e.g. Heinrich (1941).

[9]. (2001).

[10]. Dekker, Hollnagel, Woods & Cook (2008) p.41, citing Amalberti (2001).

[11]. Barber (1976).


Regarding ‘Dominos’, Linear Thinking, and Cause and Effect

As for “Domino” theory being a fundamental article of faith of the safety profession, that is an odd and unusual way to put things. In their reviews, the cited professors [1] make only a passing reference to Heinrich. Instead, they focus on the linear models of others [2], which includes, of course, Reason’s Swiss cheese model [3]. Indeed, Dekker [4] makes no mention whatsoever of Heinrich or dominos; he refers to “linear” defences in depth, the Swiss cheese model and Reason (1997). In short, any notion that ‘Dominos’ are the problem is, surely, contrary to everything the cited professors know [5]. The focus on Heinrich is also odd given Dekker & Woods’ [6] observation that “sequences of events that lead one time to an incident and another time to an accident are virtually identical – the signature of human-automation breakdown is the same”. Given its context of commercial aviation, that statement, depicting linearity (and, as it happens, common cause), is also out of step with beliefs that ’cause and effect’ operates differently in complex systems. Similarly, and despite stating that a “condition is not a cause”, Reason et al [7] offer that accidents in complex systems arise from the linear connection of multi-causal conditions.

From a ‘school’ so critical of cause and effect or linearity, it is difficult to see anything but linearity in the above. Nonetheless, the professors are obviously struggling with an aspect of it. Consequently, we took their own lead [8], and considered their causal explanations relative to the philosophy that determines their search strategies. When we did, a multifactorial, organizational accident approach emerged. That approach, totally unconnected to Heinrich, and certainly nothing new, comes complete with historically problematic latent condition [9], and inbuilt inability to show a causal link to fatalities [4]. Indeed, the end result is a relentless pursuit of conditions, not causes [10]. As such, their problems, self made, are rooted in 1990 (i.e. the Swiss cheese model), not 1941 (i.e. not dominos). That said, linearity is, of course, scientifically valid; but, it is contradicted when attempts are made to combine, as the professors do, the science of ’cause and effect’ (i.e. linearity) with confused notions of non-linearity or complexity. In stark contrast, Heinrich employed science and the CCH (i.e. ‘simplicity of explanation’). In short, with dominos, linearity and triangles being mere distractions, Safety Differently now embraces a number of known problems.

For a moment, calling for a “saner”, “common-sensical approach”, Dekker [11] appeared to reject the Swiss Cheese Model for its causally irrelevant conditions. However, subsequent descriptions of emergence indicate that the latent condition, hence, the general over-riding philosophy, is still in place.

[1]. Hollnagel (2004): Reason (2008).

[2]. Green, A.E. (1988): Svenson, O. (2001).

[3]. Reason (1990).

[4]. (2014).

[5]. Reason 1990/1997/2008: Arnold (2009): Reason, Hollnagel & Paries (2006).

[6]. in eds Dekker & Hollnagel (1999).

[7]. Reason, Hollnagel & Paries (2006).

[8]. Dekker et al (2008): Lundberg et al (2009).

[9]. Reason (1990: 2016).

[10]. Young et al (2004).

[11]. (2014 p.355).


Safety Differently – New Safety Paradigm – or Revealing Plea to Emergence?

Before getting into this section fully, we might recall that the science of ’cause and effect’ sees accidents as resultant, not emergent. That is, accidents can be broken down, and explained and predicted from the system’s constituent parts. As such, causal relationships can be described logically, by way of linear connections, and recommendations for prevention and/or system improvement fall naturally from investigation and analysis. Emergence, on the other hand, ‘sees’ accidents arising out of numerous, complex, inter-twined, dynamic networks (further confused by causal nets and feed-back loops) and, as such, not amenable to ‘simple’ or scientific explanation. In fact, a label of emergence, if it were applicable, would mean that accidents cannot be explained at all; and so, to continue.

The prevailing paradigm has always hinted at emergence [1]; which, according to Hollnagel [2], “forces” its way to the fore “when it is impossible to find an acceptable single (or root) cause”. Of course, given Dekker’s [3] insistence that there is no such thing as a single, root cause, forcing is the default (hence, persistent causal overdetermination occurs). Still with emergence, Hollnagel et al (2015) believe that ‘causes’ are “inferred” and may be impossible to eliminate in “the usual manner”. Nonetheless, they think it may be possible to control “the conditions” that created them, even though emergent outcomes are not “decomposable” into those conditions. That is, they more or less ‘accept’ that the cause of an accident is impossible to eliminate by way of conditions; but, they then offer that it may be possible to control the conditions that caused the cause, despite knowing that a). conditions are neither causes [4] nor causally relevant [5], and b). no component of an accident so defined (i.e. as emergent, and non decomposable) would be capable of being broken down to identify any sort of causal relationship (in the scientific sense) with any other component.

Unfortunately, in attempting to explain what is, for them, unexplainable, the professors have simply re-submitted conditions as causes (indeed, conditions are now causes of causes) and, by virtue of their definition, they have no need to explain, let alone claim to understand, how any such causal relationships might arise. Disappointingly, the prevailing paradigm has re-labelled latent conditions as emergence and, amongst other things, will still be unable to conceptualise the accident, or predict future occurrence.

Obviously, complexity can be a simple result of the search strategy [6]. Or, it can be forced, as above, when what is looked for cannot be found. Negating that, it is difficult to see how any could agree on, let alone make sense of, the above as an expression of emergence in context [7]. It does, however, make sense (as a plea of sorts) when we realise, due solely to its own assumptions, the philosophy is being frustrated by accidents that appear to have no ‘cause’. Or, more correctly perhaps, their assumption that there is never a “single cause” [8] is repeatedly contradicted. Nonetheless, the critical problem (i.e. the non-conforming latent condition) is retained and, displaying the classic symptoms of paradigm paralysis [9], a restatement of the old emerges. Indeed, within his review of Hollnagel’s views on systemic models, Reason (2008) makes his own position clear. For him, a system perspective (which incorporates Hollnagel’s notion of emergence) is “any accident explanation that goes beyond the local events to find contributory factors in the workplace, the organization and the system as a whole” [10]. Noting that such an approach does not, of course, explain anything, emergence in context reveals itself to be the multifactorial, organisational accident approach of old. Indeed, Hollnagel [11] himself says that accidents arise “out of the complex of conditions” (or “aggregation of conditions”), “but cannot be predicted” from them. Consequently, having (r)evolved from Swiss cheese model, to resilience engineering, Safety-II and back to Swiss cheese, the prevailing paradigm currently resides under the label of Safety Differently. Differently may, of course, be inapt; the same approach will continue to seek the same multiple conditions, fully aware they have no causal relevance. Indeed, beneath the cloak of complexity and emergence, we find neither explanatory loss nor gain [12], a refusal to renounce, and crisis [13]. Perhaps the oft cited phrase, “what you look for is what you find” [14], needs a slight revision, ‘one way or another’.


Prediction and Prevention awaits Simplicity of Explanation

In closing here for now, we earlier indicated support for ‘simplicity of explanation’ regarding scientific, operationally informed approaches such as Heinrich’s. However, as one of science’s great virtues, simplicity of explanation does not mean simple or simplistic. It means a scientifically valid explanation, that leaves fewer things unconnected, and explains more things with fewer principles [12]. Tragically, the prevailing paradigm forces the exact opposite. In consequence, and due solely to the fact that conditions, not causes, were addressed, accidents that were presumed remedied, ‘mysteriously’ repeat. Similarly, and inextricably linked, the academic confusion surrounding Heinrich’s triangle prevents many from realising their full, predictive and preventive capability. Points to which we will turn in our next report.

[1]. Reason (1990b: 2008): Cook (1998): Dekker (2001).

[2]. (2014).

[3]. Dekker (2002. p.31).

[4]. Reason, Hollnagel & Paries (2006).

[5]. Dekker (2014).

[6]. Davies et al (2003).

[7]. Goldstein (1999): Corning (2002): Christen & Franklin (2002).

[8]. Woods et al (2010).

[9]. Barker (1993).

[10]. Reason (2008, p.93).

[11]. (2004). p.61. and p. xv. respectively.

[12]. Weinert (2009).

[13]. Kuhn (1970).

[14]. Hollnagel (2008).





Mission Statement

The Institute is committed to the furtherance of Industrial Accident Investigation as a unique and distinct discipline supporting the International Risk Management process.

Become a Member

Apply online for membership.

Contact Us

T: +44 (0)1726 832695