In 1971 an accident investigation exposed major problems with safety training that contributed to 40 casualties in a railroad hazardous materials accident. The instructor died in the accident. The immediate problem was the content of the training, which raised risks instead of reducing them. The flawed training contents flowed from misdirected safety objectives, major flaws in the curriculum development process, and an ineffective instructional performance feedback process that would have disclosed the other flaws.

Subsequent personal experiences with safety training course development in other fields has disclosed that the 1971 situation was not unique. Once the issues are recognized, misdirected safety objectives, flawed course content development processes, and ineffective feedback can be observed in most safety courses. These experiences suggest that, at the least, safety instructors need to 1) acknowledge these problems, 2) invest the time needed to gain the knowledge and skill needed to overcome them, and 3) insist on performance feedback systems to help improve their safety training effectiveness.

Special Acknowledgment

The author wishes to acknowledge the contributions of the National Fire Protection Association, which in 1978 compiled a very useful record of the developments during the early part of the period discussed in this paper (NFPA 1978). Many historical developments are reported in that document. The interpretations of the history recorded in that and other documents, however, are solely those of this author.

BACKGROUND

Instructors[1] are very special persons. Society relies on instructors to acquire, interpret and teach others the knowledge, skills and practices offered by earlier experience and study. Persons who teach or train others do so in various roles. Roles range from faculty in formal teaching environments such as universities, to parents in the home, to supervisors in the workplace.

Safety instructors and trainers occupy a special niche in society. Their role is to convey the knowledge and skills needed to function safely in our environment Everyone is a safety instructor at one time or another during a lifetime. The matters we elect to try to teach depend in large measure upon our perceptions of the needs of our ”learners” [2] and the knowledge, skills or practices we decide to teach them. Safety instruction may range from a simple “be careful!” to advanced university-level safety curricula. Whatever the level, the instructor’s role is similar: conveying to the learners an ability to function safely in their environment, now and in the future.

Instructors try to add information to a “learner’s” state of knowledge, on which the learner will presumably act. Safety instructors usually offer information to try to change the learner’s behavior. Safety professionals are interested in behavior change because a human being is the most adaptive, imaginative element of any system. That adaptive knowledge and skill are essential to safe performance in the face of dangers or safety risks. An underlying assumption is that safe behavior must be learned, and is not intuitive. Instructors thus play an important role in achieving safety performance. [3]

Some instructors use course materials developed by others, and some instructors develop their own materials. For most safety instructors, “accident prevention” is the main objective of the instruction. Accidents traditionally have been perceived as useful instruments to identify needed changes in behavior, probably reflecting the conventional wisdom that “experience is the best safety teacher.” How does the process work?

The author has had the unusual experience of developing and teaching safety courses, and also investigating scores of accidents and reviewing thousands of accident records that are relevant to the teaching efforts. The investigations disclosed a wide range of accident outcomes which safety instructors influenced. Further observations and analyses of the related safety instruction disclosed that course developers have a pivotal but unrecognized role in safety instruction.

Instructional considerations and methods are extensively documented in behavioral literature. However, few proven safety concepts, principles and procedures are comparably illuminated for course developers.

The experience disclosed two major issues:

Presently, safety course developers’ vital roles in accident processes are not adequately recognized and documented. Documentation of accidents offers course developers inadequate feedback.

Safety trainers typically assume the course developer knew and used proper safety knowledge tools and practices which the learner should use to achieve “safe” behavior and outcomes in a risky situation. This, in turn, presumes a course developer possesses, uses and conveys the “proper” knowledge to learners. If the intellectual content of the instruction is inadequate, other good attributes of the safety instructor or the teaching methods can not be expected to program safe behavior reliably or with substantial confidence. A good accident investigator will inquire into these presumptions, and be able to provide instructors with feedback about them. If the investigator finds the intellectual content of the instruction deficient, using proper investigative methods, feedback should enable the instructor to define what changes should be introduced into the instruction.

This paper discusses safety instruction involved in one accident, what safety instructors were taught to teach about that kind of accident, and the role of their instruction in that accident. It then examines other indications of the problems

observed, and indicates the significance of those experiences on the general role and responsibilities of safety instructors in achieving safe performance.

A CASE HISTORY

At about 1:44 in the afternoon of October 19, 1971, a railroad train moving many large freight cars of bulk hazardous materials began to derail about two miles inside the city limits of Houston, one of the largest cities in the state of Texas. Before the accident ended, one firefighter died, 50 other persons — including 39 other firefighters — were injured, and extensive property was damaged. Within hours, an official investigation of the accident was launched.

Of special interest were the firefighter casualties. Most of the casualties were functioning in a fire emergency environment when they were injured. The firefighter who died was a member of the fire department training staff, which trained the fallen firefighters in what to do in those circumstances.

During the investigation and a subsequent public hearing, the Chief of the fire department and the on-scene Deputy Chiefs present during the emergency response related what they did and why they took the actions they did. As their testimony unfolded, an awareness of a situation with grave implications began to grow in the minds of listeners. Without exception, the fire officers and the injured firefighters were responding exactly the way they had been trained. In other words, they did what they were programmed to do, and relied on that training to produce a safe outcome. Instead, their training led to their injury. It soon became clear that the safety problem in this accident was not what the firefighters did, but what they had been trained to do.

Further investigation into the training disclosed that the fire department safety instructors taught the “conventional wisdom” at the time. This finding and its consequences was to be observed again in many subsequent investigations. However, in most instances, this underlying safety problem was concealed by investigators who found it more fashionable to conclude the loss was “caused” by human error rather than probing for the less obvious underlying issue of safety training content.

The National Transportation Safety Board found that fire-fighting practices taught at that time were unsatisfactory in other accidents (NTSB 1972). They were promulgated with no requirement for technical analysis during their development, and with no documented technical quality standards. Simply stated, the course content for training the safety instructors was based on views and opinions, not tested by rigorously disciplined, documented technical analysis. No previous investigations in this field had raised this course content issue.

Since the course content formed the basis for all such training at the time, another conclusion was inescapable: The thousands of persons trained in that course content were trained to behave incorrectly. Similar losses were inevitable until that mis-training could be corrected. Further, since the methods by which the content evolved were widely used, it was likely that other safety courses were similarly flawed.

A further unsettling aspect of that investigation was the discovery that the errors in the training materials could have been observed in earlier accidents had they been properly investigated, analyzed and interpreted by some of the “safety experts” who had developed the course content. Why did that not occur?

The answer disclosed yet two other surprises. First, the underlying concepts, assumptions and principles on which the existing investigation practices and course content were based, when contrasted with what actually happened in accidents, were found to be seriously flawed by omissions and misconceptions. Secondly, nobody was asking for better feedback from investigations. Based on the outcomes observed, the intellectual foundation for the training had to be judged “inadequate.”

Those discoveries posed still another dilemma. If the intellectual foundation that existed was inadequate,

• What intellectual foundation would be adequate?
• What intellectual foundations should future course developers use, and how could they be derived?
• What should be taught?
• How should any new, improved course content be developed, and
• By whom should it be developed?

The traditional answers —consensus standards formulated by “experts” and validated primarily by an adversarial consensus-building process —permitted the existing situation to occur. What would be better?

Intellectual knowledge base development options were available, including methodologies borrowed from other disciplines and the newer system safety analytical and safety management technology. The latter was emerging at that time from the aerospace industry, and appeared to hold the greatest promise, because of its productive analytical capabilities. The time had come to try to apply that technology.

The Safety Board recommended such steps. (NTSB 1971) Action was initiated. Major changes in the intellectual foundation, analytical methods, course contents and performance results followed.

In retrospect, the effort was the beginning of an attempt to redefine the traditional view of’ ‘human error in accidents, in a way that action could be initiated to improve personal day to day safety behavior and safer performance to show the new lessons learned from those events. A review of subsequent events from one participant’s perspective may be instructive.

EVENTS AFTER THE INVESTIGATION

The NTSB’s report of its investigation of the Houston accident was released in 1972. With a few notable exceptions, it was widely viewed as misdirected by much of the firefighting community because the NTSB didn’t understand firefighting traditions, etc. Others dismissed it out of hand as missing the mark because it did not offer their solutions. Still others resisted or dismissed the issues because it was perceived as someone else’s problem.

The 1971 Houston accident was one of a series of serious accidents that had occurred in transportation, and in the transport of hazardous materials particularly, taking numerous lives.

The problems were considered sufficiently significant that the chemical industry established a chemical transportation emergency center (called CHEMTREC) to provide emergency response information at a single point of contact that could be reached toll-free by anyone with a chemical emergency. This service was begun in September 1971 — about 6 weeks before the Houston accident.

For the purposes of this discussion, it is important to understand that the main purpose of the center was to provide written “information” (not direction) to emergency response personnel who were at the scene of one of these accidents, on the assumption that local personnel would know what to do with that information. Controlling emergencies was their role; therefore, with better information, they could perform better. That information was made available from written cards, prepared by an industry committee and reflected the committee members’ view of the responders’ needs.

The safety problem needs were not perceived as involving training course content at that time. Significantly, as late as November 1971, in a widely read article (Haessler 1971) published as the NTSB hearings were being readied for the Houston accident, the “four problems” associated with hazardous materials transportation were represented as being:

outdated codes; (“a plethora of laws, regulations, and codes, full of exceptions, biases, unproven judgments, and massive inertia to resist change.”) a frightening increase in traffic and accident rates; intermodal shipping; and growing concern for the impact of shipping accidents on other elements of society.

The proposed remedies reflected the predominant thinking of the time:

[ ] better container crashworthiness,

[ ] improved regulations, and

[ ] the tempering of codes with broader safety criteria

Another frequently expressed view, especially in the media, focused on the safety inadequacy of the carriers who experienced the accidents. The course content or teaching issue was not mentioned in publications of that time.

When the NTSB raised the teaching issue in its report, a few experts concurred with this view. One was Martin Grimes, of the National Fire Protection Association (NFPA), who thoughtfully considered the report, and acted on it. He and his colleagues at the National Fire Protection Association initiated a methodical, step-by-step analysis of the decision-making process involved in the response to hazardous materials transport emergencies. The work papers used to record the analysis reportedly “covered the walls” in the NFPA offices, as Grimes put it. One of the results of that work deserved special notice.

The group’s rigorous analysis showed specific programs with existing practices, resulting in previously unanalyzed risks to firefighters when they were faced with tanks or vehicles exposed to fire following transportation accidents. Grimes and his colleagues succeeded in getting a “Progress Report” published in an NFPA publication (Grimes 1974) that asserted:

. . . most of the information is in a negative vein, because so far the study has brought to light practically nothing very encouraging and positive.”

The report also stated that there appears to be a very strong case for departure from the firefighters traditional ”attack and extinguish” code.

In the author’s view this was courageous action by the NEPA at the time. It challenged, for the first time since an exception for fires involving explosives was adopted, the traditional firefighting norm of ”attack and extinguish” — the conventional wisdom underlying emergency response training for that period. [4] Largely as a result of that report from within the firefighters’ own community, firefighters began to earnestly question traditional concepts in hazardous materials emergency response training, and what they were being taught!

However, many traditionalists resisted the view that it was “socially acceptable” for firefighters to retreat from a liquefied flammable gas and other hazardous materials fires for many years, despite the evidence from accidents. As late as 1978 the author was personally berated for his participation in introducing the new performance norm by a state official.

On a personal note, the Houston accident had other repercussions for those who investigated it. A noted fire expert, Frank Brannigan (at the time head of the Fire Science Department at Montgomery College), was among those who took the report and its course development challenge seriously. He telephoned the author, shortly after the report was issued, and laid down a challenge of his own. His verbatim challenge: “If you’re so damn smart about what firefighters need, get up here and start teaching it!” The challenge triggered a 5-year research, analysis and development effort with many contributions by a lot of active firefighters in the Montgomery County (Maryland) area. Their insights and support produced numerous changes in the conceptual and technical basis for safety training in the hazardous materials emergency response area, and in course contents.

Additional changes included new perspectives about the nature of an emergency and emergency response objectives that changed the framework for thinking about and teaching response actions (Benner 1975). Another major change was the shift from a ”cookbook” or ”if/then” mode to a diagnostic approach to instruction, focused on the accident and resulting emergency as parts of an ongoing process, with the need being to influence that process to improve the accident outcomes. By 1975, those changes, with the cooperation and support of many learners, led to new teaching models of the emergency response process, the decision-making process within the emergency response process, and a general teaching model of the behavior of hazardous materials in emergencies.

Those models in turn led to numerous new programs, including a new training program instituted by a cooperative inter-industry task force that introduced new emergency response concepts and training to 150,000 firefighters in the United States (FEMA 1985). Other new programs applying some of the ideas and resultant methods for real time mishap analysis were introduced by the National Emergency Training Center in its fire service training (FEMA 1985 B). Still others introduced new hazardous materials behavior models that could be used to predict the risks facing emergency personnel in accidents. New courses in 1988 and 1989 continued to build on those developments (Noll 1988, Ericksen 1989).

Part of the feedback during the course development was provided by the learners in subsequent mishaps. Other feedback flowed from investigations of additional accidents during which the teaching models were refined (NTSB 1981). An additional assessment method called Time/Loss analysis was developed about 1980 (Driver 1980) to permit assessment of safety performance in these accidents, as part of the feedback activity. In this field, little attention has been paid to this need since that time.

Did the course changes improve safety performance? As this is written, the author knows of no person trained properly in these new courses who has lost his or her life responding to this kind of transportation accident.

WHAT THE EXPERIENCE SUGGESTS

This personal experience offered many lessons as it was evolving. More lessons were subsequently learned about safety training and other issues, but for the purposes of this paper, at least four major issues merit discussion.

SAFETY CONCEPTS drive the selection of the SAFETY OBJECTIVES for safety training. They also drive the selection of the ANALYTIC PROCESSES used to define the KNOWLEDGE AND SKILL NEEDS that must be met to achieve the desired safety performance. If the safety concepts are defective, everything that follows will be defective. Defective safety OBJECTIVES and behavioral needs analyses lead to misdirected, incomplete or ambiguous instructional OBJECTIVES and DESIRED BEHAVIORS. Defective objectives and behavioral needs will be followed by ineffective safety COURSE CONTENTS and Safety TRAINING. Traditional ACCIDENT INVESTIGATIONS can not be relied on to discover, define and suggest solutions to problems with the content of safety training.

Experiences in the 1971 case and subsequent investigations, developing and teaching safety and risk assessment courses and system safety program development and implementation activities all support the existence of these issues.

Safety concepts driving course contents.

During the analysis of the 1971 case, the contents of the training were carefully reviewed to determine, if possible, what concepts provided the bases for the instructional materials being analyzed. No clearly stated safety concepts were specified in the materials.

From the information developed during the investigation, and from subsequent discussions with active firefighters at Montgomery College, it became apparent that Heinrich’s “domino” concept of accidents was driving the selection of course contents. That in turn led to further research and eventual understanding of at least five different perceptions of the accident phenomenon that seem to drive safety programs.

However, the domino concept couldn’t be adapted to fit the events during the 1971 accident, because several events were usually occurring at the same time. That observation led to a search for other concepts which might lend themselves to more complete descriptions of the process that unfolded at Houston. Those efforts, in turn, eventually resulted in research in to various models of the accident phenomenon that were in use. Even during the earliest days of that work, it was evident that limitations of the then current safety concepts prevented adequate determination of the safety instruction needs for firefighters faced with these kinds of accidents. Those limitations included,

the ambiguity of the accident emergency” that the course materials were intended to address. the ambiguities and variations in judgments about “the accident cause” and how to eliminate the cause. the inability to use the concepts to analyze accidents predictively before they happened, and ”test” teaching materials on paper or in drills without putting the users at risk. the amount of judgment required to select the data that would be reported for purposes of assessing the teaching materials. the lack of understanding and documentation of the decision-making process and influences on that process.

Course objectives.

Given the emphasis on accident cause, course objectives for safety training focused on accident causes and their elimination. Unfortunately, determinations of cause were judgment calls, and not physical phenomena with which behavioral changes could be identified.

The overwhelming view encountered among the participating parties at the time was that most accidents were caused by human error or non-compliance. In other words, course content was determined by people holding the view that the persons involved were either not using good judgment in interpreting the instructional materials, or that they didn’t comply with the instructions. That view led to strong emphasis on motivational training and compliance in safety instruction. Decision-making training was not addressed by course developers.

Additional research disclosed that most of the ideas about safety had been borrowed from other fields like medicine, engineering, psychology, physics and so forth. The ideas flowing from new developments in the System Safety field, though used in safety practice, were not being utilized in safety course development.

Both situations — the borrowed technology, the inadequacy of the Heinrich concepts, and the conclusion that the people involved did something wrong to cause the accidents, precluded predictive analyses that would allow the decisions

and actions to be analyzed effectively. Most importantly, there was no demand to improve the situation until the problems were publicly aired after serious accidents.

Now, since either Heinrich’s or borrowed concepts (like epidemiological methodologies) drove the analysis and data collection on which the teaching materials were based, it is little wonder that their limitations, including those listed above and others, resulted in ineffective instruction objectives and course content.

From an instructor’s perspective, the use of past accidents or war stories” to make specific points about how to prevent accident causes from recurring was perceived to be the main task at hand. Talk about past accident causes or cause factors and what the learner should do about each and you were programming safe performance.

Unfortunately this “if/then”-based instruction did not prepare the learners for new situations when they encountered them. In the hazardous materials transportation field, this was the fatal flaw with the if/then approach. Until mishaps involving any one of literally thousands of different dangerous materials were predictable, the responders had to be left to their “best judgment” to diagnose the problem and devise measures to control the risks adequately. If it turned out badly, the second-guessers would move in and critics were willing to offer only generalized criteria for decision making, because of conceptual limitations that precluded the setting of performance objectives. Sound familiar?

Not unexpectedly, it appears that the trainers and training material designers started with the assumption that their experimental objectives and training contents were satisfactory. That meant the problems always arose in the execution of those contents — other people’s errors. Since they were defending their own work and they were the experts who knew best how to design the materials, that position is easy to understand. The obvious weakness in that view (from the perspective of the responders) is readily apparent now.

The lesson: Document your safety concepts and safety assumptions if you are analyzing safety needs and developing safety objectives for instructional purposes.

New Instructional Objectives.

The principal safety objective of the training materials of that time was to prevent future accidents. However, this didn’t quite fit the response to emergencies, so the prevailing objective was to save lives and property for that function. It wasn't until questions about whose lives and what property, and what is worth saving, what trade-offs were involved, and similar questions were raised that the ambiguity and excessive dependence on judgment without offering judgment training was recognized. A better answer was to focus on changing the outcomes of emergencies, to reduce the losses that were predicted to occur. That immediately brought into focus the prediction problems that had plagued the actual responders.

Before Houston, the safety objective for this kind of material was to protect lives and save property by extinguishing or controlling fires. The instruction goals were functional: if this, do that. They did not address a framework within which to perform the functions. After Houston, the safety objective in such accidents was to produce a more favorable outcome

than would occur without intervention, and the instructional goal was to provide the understanding of the accident processes needed to enable persons directing intervention efforts to achieve those outcomes.

The lesson: Focus your instruction on achieving desired outcomes rather that the performance of functions to achieve “safety.”

Behavioral outcomes for the instruction

Once the objectives were cast into outcome terms, progress could be made toward documenting and formalizing the task requirements for achieving those outcomes. In time, these efforts led to the kinds of analyses performed by Grimes and all at NFPA and Wright at Western Kentucky in the mid and late 1 970s, and by others elsewhere.

A significant shift began to occur about that time. For the first time, the potential mishaps were analyzed and the analyses were documented in a way that produced a baseline for monitoring what happened in the future. A second noteworthy aspect was the application of analytical technology developed from within the safety field to produce models that have helped determine what behavioral objectives and task skills were needed (Heinrich 1990).

Course Contents

Once the new safety and instructional objectives had been identified, the specific materials for the new training began to emerge. It was noteworthy that these materials were derived systematically and analytically, in a form that provided constructive guidance for decision-making training. Attention was focused on the behaviors of hazardous materials in spills and releases, and how they could be predicted and controlled to produce the safest outcomes. In other words, the analyses could be used for the training!

The results?

While not perfect, even now, the new guidance produced a major improvement in safety performance since it was broadly instituted in 1979. It has almost totally supplanted the previous training because it has proven effective in terms of safer outcomes.

Feedback

The analyses also changed the thrust of more advanced accident investigations and research into emergency responses and the information that is gathered from accidents. Some general models of the decision-making process, the behavior of hazardous materials in emergencies, and risk assessment models have been deployed and are used in investigations to guide data acquisition and reporting (Hendrick 1987). Before Houston, the safety objective for this kind of accident was to protect lives and save property by extinguishing or controlling fires. The instructional goals were functionally actions. After Houston, the safety objective in such accidents was to produce a more favorable outcome than would occur without intervention. Investigators have predictions against which to measure performance: the programming of the responders, the equipment and the cargoes in hazmat accidents.

The lesson: Using the wrong objectives in safety training courses can have adverse consequences in investigations.

CONCLUSIONS

In summary, what should be done?

1. The experiences offer several lessons relating to the power of concepts communicated by trainers for the prevention of accidents. These varying concepts, their influence on the course content of safety (accident prevention) programs, and their influence on the effectiveness achieved by instruction programs dictate that instructors should explicitly consider underlying concepts in the selection of any safety, accident prevention or loss control courses.

2. Accident investigation has shown that safety instructors influence safety performance levels by the course content of their safety instruction. Instructors should demand that accident investigations address the role of safety instruction course content in descriptions of the accident process that actually occurred. Instructors should be prepared to accept investigation finds as apart of the feedback about the results their safety instruction.

3. Since the persons who teach safety instructors and present tests for safety instructors seem to offer few options and little proven accident model selection guidance in this area, individual safety instructors must take the initiative in this matter. Safety instructors should analyze the texts they used to ensure that, at the very least, the accident concepts are consistent throughout the text. Instructors using models that pose ethical problems should carefully reconsider their choice.

4. Instructors offering safety instruction should begin to consider accidents as possible indicators of shortcomings in their instruction. If they accept that responsibility, safety instructors should establish performance criteria for their instruction, and measure the safety performance achieved by that instruction.

5. Initial observations using system safety methods, such as multilinear events sequencing displays of expected vs. actual performance in past accident investigations, indicate their capability merits further development. Researchers should determine quantitatively what consequences the selection of particular models for a course of instruction have on future learner safety performance levels.