This paper has diverse origins. The need for a theory reflects difficulties experienced by the author during the investigation and reporting of accidents involving all modes of transportation. The discussion of accident theory and charting methods is an extension of ideas presented in a paper titled "Accident Investigation: Multilinear Events Sequencing Methods"[1] recently republished in the Fall, 1975 Journal of Safety Research. The application of the theory and methods described has produced promising results.

Accident Theory: Why Bother?

Members of The Society of Air Safety Investigators consider themselves to be members of a profession. Let us examine that assumption for a moment. A profession has been defined as

a calling requiring specialized knowledge and often long and intensive preparation, including instruction in skills and methods as well as in the scientific, historical or scholarly principles underlying such skills and methods, maintaining by force of organization or concerted opinion high standards of achievement and conduct, and committing its members to continued study and to a kind of work which has as its prime purpose the rendering of a public service.[2]

Note the emphasis on scientific, historical or scholarly principles. Note also the purpose of the calling. Let us focus today on the principles first, then the purpose. We'll save the other points for a future meeting.

If you are a practicing professional, what are these scientific, historical or scholarly principles underlying the accident investigation methods you practice? One of the most frequent things you investigate are aircraft accidents. Yet if someone were to poll a random sample of your membership to determine what an accident is----in greater detail than the ICAO definition----widespread differences in individual perceptions of the accident phenomenon would become evident. If one were to ask when an accident begins and ends, and what the criteria are for establishing the beginning and the end of an accident, the range of view would increase. If you need further evidence of the lack of underlying principles in the field of accident investigation, try to apply scientific rigor to the investigator's jargon----words like human or pilot error, accident proneness, near miss, hazard, etc. Each example is a symptom of the lack of a sound theoretical basis of accident investigation.

By theoretical basis I mean that theory guides or shapes your investigative activities. Reflect on what a theory is:

"systematically organized knowledge applicable in a wide variety of circumstances; especially, a system of assumptions, accepted principles, and rules of procedure devised to analyze, predict, or otherwise explain the nature or behavior of a specified set of phenomena."[3]

The most persuasive argument for developing an accident theory for SASI members is that assumptions, principles and rules of procedure are nowhere systematically organized, and that generally accepted rules of procedure for analyzing, predicting or explaining the accident phenomenon are not available to the accident investigator. The ICAO manual contains procedures for organizing the investigation, its coordination and the reporting of investigative findings. But the contents do not address the underlying scientific principles, nor reflect scientific method. Knowledge of these principles is assumed to be the province of the investigators. Each investigator has specialized knowledge and technique which he brings to an investigation. In a large accident, where investigative groups are formed, the coordination of these individual skills compensates to some extent for the absence of professional principles and theories, because interactions among the group members generate hypotheses that are subject to vigorous debate. However, the principles governing the scope and development of the hypothesis are not well organized or documented. Accident investigation methods for establishing their validity are even less rigorous, and almost totally undocumented, in most modes of transportation. In small accident investigations, conducted by one investigator, even this compensating mechanism is absent.

The result is that the investigative effort is often inefficient, and may be incomplete, or may leave unresolved significant points of controversy. Furthermore, it usually does not provide scientifically rigorous contributions to the body of data from which future assumptions, principles or rules of procedure can be discovered and practiced by others in the profession.

To elaborate on this latter point, each accident can be viewed as an unscheduled and largely uninstrumented scientific experiment performed to test a hypothesis (or theory.) In this context, the experiment and all the costs of performing it----the injuries, damage, anguish, monetary loss, delays, disruptions----are wasted if the investigator has no hypothesis or theory to evaluate.

As an investigator, how do you establish the scope of your investigation? How far back in time must you delve----an hour, a day, a year, two years, five? What rules of procedure or what principles establish the beginning or end of the accident? How is one assured of enough facts in an investigation, and how are the facts to be reported distinguished from the facts that are not reported? What rules or principles govern these decisions?

Still other problems attributable to the lack of theory could be cited, including research difficulties, training deficiencies, inequitable litigation, popular misconceptions about the nature of accidents and others, but this would be redundant. The point is that if we are to be professional investigators of accidents, we need to organize the principles on which our work is based in a professional manner.

What Theories Exist Now?

Some rules and principles do exist now for the accident investigator. However, they are fragmented, occasionally contradictory, often privately communicated, usually not scientifically tested, and sometimes wholly without merit. Their systematic organization has not yet been achieved. When this organization is accomplished, the contradictions and fallacious assumptions will become evident, and gaps can be remedied.

A brief review of some of the most influential historical assumptions, principles and rules discloses the present state of accident theory.

The statistical work of Greenwood and Woods in 1919[4] and Newbold[5] suggested the "accident proneness" concept. Their work still influences some accident investigation, particularly in the police accident investigation field with its focus on license revocation or suspension proceedings which reflect this concept. Investigators still look for data in accidents that will support the idea that "conditions" such as attitudes, attentiveness and so forth "cause" accidents. This statistical work focused on static conditions and set the pattern for untold man years of research into "unsafe conditions" as causes of accidents. In aviation, Ames contributed much to perpetuation of this view.[6]

In 1936,' Heinrich[7] suggested the "domino" theory of accidents. His idea was that accidents are a sequence of events in a predetermined proceed/follow relationship, like a row of falling dominos. This view changed the thrust of investigations toward the events involved, rather than the conditions. It represented a redirection of the search for understanding of the accident phenomenon on the basis of a "chain-of-events" that had occurred.

An accident "reconstruction" approach emerged not long thereafter[89] which was refined extensively in the highway accident investigation field by Baker. The reconstruction focused on identification of the linear chain of events theory of the accident phenomenon.

About 1960, work at Bell Laboratories in missile system safety produced another breakthrough in the field.[10] This was the "fault tree analysis" method, generally credited to H. A. Watson.[11] This is a method for arraying events in a flow chart with a proceed! follow logic pattern. It provided an objective for the analytical effort in the sense of management by objectives, and it provided a procedure by which informed speculations about accident events sequences were organized in a visible, easily criticized and readily understood display. This work introduced a "branched events chains" concept of accidents through use of the "and/or" logic gates.

About the same time, air safety investigators contributed another milestone in the accident investigation field. The Civil Aeronautics Board published the first chart on which were plotted the flight data recorder (FDR) data.[12] This chart was the first display of the parallel events along a time scale, showing what can be viewed as a "multi-- linear events sequence" on which the findings were partially based. It appears to be the first to use the time_o term, about which more will be said shortly. It also is the predecessor of the "multilinear events sequence theory" for the accident phenomenon.

In the latter 1960's, a medical doctor changed accident investigation approaches significantly with his insistence on an etiologic basis for looking at accident trauma.[13] Haddon also introduced a matrix of accident phases and components of the accident events sequence. This work was influenced by DeHaven's research in 1942, but it was Haddon who brought about the directions in accident research which now largely dominate the highway accident field at the Federal level.

Attempts by Surry[14] and others to organize these and other related concepts into a general accident model are indicated in the SASI Forum article. The concept of homeostasis is an essential theory for the understanding of accidents. The term is generally applied in medicine to a state of physiological equilibrium produced by a balance of functions and chemical composition in an organism. I propose this concept be extended to "activities," in the sense that an operational equilibrium is produced by a balancing of interrelated functions and capabilities in response to varying influences arising as the activity progresses toward its intended outcome.

The principal conclusion suggested is that an accident is not a single event, but rather an accident is the transformation process by which a homeostatic activity is interrupted with accompanying unintentional harm. The critical point is that an accident is a process involving interacting elements and certain necessary or sufficient conditions.

The objective of an accident investigation should be to isolate this process and prepare a description of the entire process by which the activity was transformed.

Expansion of some of the elements of my earlier accident process chart may be helpful. Maintenance of homeostasis during an activity requires a continuing series of adaptive responses to perturbations which arise as the activity progresses. To achieve the intended outcome, these perturbations must be accommodated without injury to any of the "actors" and without discontinuing the activity. For example, an aircraft crew makes many adaptive responses to external and internal influencing events during the course of a flight from one point to another, to maintain a stable flight activity within prescribed operational bounds. This is accomplished through a process of detecting the perturbation or indications of its presence or occurrence; of predicting the significance of the data detected; of identifying the adaptive action choices that would maintain homeostasis; of selecting the best adaptive action; of implementing the action selected; of monitoring the effects of the action implemented; and of deciding whether or not the adaptive response countered the perturbation sufficiently to maintain homeostasis without further adaptive response. Each step is an element of an accident process chart if the adaptive response is unsuccessful. Any breakdowm in the adaptive process described can be used to identify the beginning (t_o) of the transformation from homeostasis into the accident being investigated.

This approach differs from the "last clear chance" doctrine in law, from the key event approach of Baker[15] and the "critical event" approach of Perchonok[16] in that they characterize different events in a linear events sequence. The last event in the process must be the last injurious event directly linked to one or more of the preexisting actors in the activity. The problem of secondary harm can be treated by considering the impinged activity in the accident sequence.[17]

The product of the process' charting effort could take two forms. First, a detailed chart with all the actions by all the actors who acted in the specific accident would be generated, for all immediate users in need of a complete technical description of the accident. The second output could be an abbreviated, more generalized model, such as is found in an NTSB surface accident report[18] or in the hazardous materials field.[19] Criteria for entries on such a general process chart would depend on its use; reference 19 describes possible use for development of countermeasure strategies.

Applications of Accident Theory.

The accident process flow chart preparation seems most nearly available in air carrier investigations. The FDR charts, now routinely slotted, are often correlated with the cockpit voice recorder (CVR) data in a linear form[20] which could readily be converted to a multilinear events chart. Actions of others such as air traffic controllers, as indicated by the ATC tapes, could be added. Any gaps in the events sequence discovered by the application of the proceed/follow logic tests for any of the actors could be bridged by the use of logic tree analysis methods. On a linear scale, the same technique can be used in light aircraft accidents.

To provide an indication of the work effort involved, the following procedural steps are presented; they reflect the approximate order to be followed to produce the detailed chart.

1. Determine, in gross terms, the apparent events sequence that describes what happened, and sketch it in events chart form.

2. From this gross description, delineate the actors (animate and inanimate) who probably were involved in the accident process, i.e., the pilot, an aircraft component, the controller, wind currents, passengers, etc.

3. Using the general process model described above, tentatively assign t_o to the point in the flight when the perturbation which transformed homeostasis occurred.

4. In a vertical column ahead of t_o list on a large chart each actor so the actions of each actor can be listed chronologically across the chart according to the time the action occurred (approximately, if necessary.)

5. Begin to record the "actions" of each actor for which supportable evidentiary data is developed. Add to these entries as new evidence is developed. Note that the search for evidence is guided by the gaps which become visible in the action sequence and the general process model.

6. Test each event pair entered on the chart against its temporal and spatial proceed/follow logic, both vertically for its relationship with actions of other actors and horizontally for its relationship to prior or subsequent actions (chronology) by that actor. This is the key method of validating assumed events or time/space relationships.

7. Where evidence of missing actions, suggested by the logic tests in step 6, can not be located, for whatever reason, construct a logic tree to identify possible predecessor events or actions, using the event or action to the right of the gap as the "top" event for the tree.[21] It is likely that evidence of one or more of the hypothesized events placed on the tree can be found to identify a "critical path." Alternatively, the use of simulators has helped to discover missing actions, or establish informed judgments about the comparative likelihood of alternative critical paths through the logic tree.

8. Insert the most likely events sequence for each actor and then test the vertical chronological or spatial relationships. Repeat the cycle if logic errors appear.

9. Compare the refined multilinear events sequence logic chart against the general accident process model, and verify t₀ and t_end. Note that the cascading events or actions as harm cascades, either in series or parallel, may become very complex. These events usually progress naturally according to physical laws. The value of detailing this phase of the process may or may not warrant the level of detail if catastrophes are analyzed and the injury mode is repeated frequently.

10. Prepare a refined process chart of the entire accident.

11. Depending on the purpose of the investigation, a companion chart on which the path of correctable events flows is shown, and to which the necessary and sufficient conditions for the events to occur are added, can be prepared. This procedure provides an approach for identifying corrective actions which might be taken to reduce future risk.

Rules to govern the description and coding of the process charts have not yet been developed. Codes denoting precise events sequence pairs or sets or patterns seem to be feasible. The development of libraries of accident "process patterns" by professional investigators also seems feasible.

Such descriptions of accidents should help to dispel semantic difficulties in the accident investigation and safety field. For example, if the time required to adapt to a perturbation is less than the time it takes for the human organism to process the data and go through the physical motions of implementing the action selected, how should this be described? As human error, or human perception, diagnostic, or muscular limitations? A narrative is not very informative compared to a process chart which displays these relationships.

Expectations of an Accident Theory.

What can the application of this theory and the related charting procedures do for the professional accident investigator? Since both the theory and methods are essentially untested, prediction of the effects of their use is highly speculative. However, based on the author's experience, the following expectations appear reasonable.

1. The efficiency of accident investigations will be significantly enhanced. This will be accomplished by reducing the quantity of data needed to explain the accident, and by introducing "objectives" toward which the investigator is able to narrow his search for facts. No longer need the investigator "get all the facts" and then come home for the analysis, hopeful that he has all the data he needs.

2. It appears that "templates" of accident processes could be developed so each accident does not constitute a mystery for the investigator.[22] Accumulation of accident data in chart form would make available a "library" of accident processes for numerous purposes such as training, design, safety regulations, etc.

3. Development and adoption of systematically organized assumptions, principles and procedures by accident investigators would elevate their activities to professional status, if other considerations of a profession were met.

4. The availability of process charts would probably have a profound effect on safety research, and probably would permit the development of risk analyses based on the resultant data base and process research.

5. The visualization of the processes would be likely to change the public's concept of the nature of accidents, and changes in liability and tort concepts would be likely to follow as the nature of accidents is clarified.

What Can You Do?

Now, let us consider the purpose of a profession----the rendering of a public service. If you concur with the contention that the accident investigation field would benefit by the development of accident theory and systematically organized rules of procedure, then you can make some specific contributions.

One approach is to take the theory and procedures advanced in this paper, apply them in your work, and help to correct or refine them. Make an effort to identify----and chart---- the t₀ and the perturbing, adaptive, stressing, injurious, cascading and subsiding events in the accident.

Secondly, review past accidents that you have investigated, as time permits, and identify these same events sequences in these accidents. Chart them, too. In other words, help to build the data base to support the process theory and methods.

Third, share the results of your experience, through the SASI FORUM or perhaps, through SASI, establish a mechanism for the exchange of professional criticism of these process `templates." This assumes you are not inhibited from such exchanges by your work or position. If you are so inhibited, start to try to change the constraints. Suppression of such exchanges seems contrary to one's professional interests.

Lastly, if the theories which have been suggested are unsatisfactory to you, propose your alternatives for testing by your fellow SASI members. In my view, air safety investigators are in a unique position to exercise leadership in this effort, because of the FDR, CVR and other records of actions by most of the actors involved in accidents. If you have the will, yours can become an outstanding contribution in the safety field.

REFERENCES

[1] Benner, L., 1975: Accident Investigation: Multilinear Events Sequencing Methods, Journal of Safety Research, 7:2, June 1975.

[2] Webster's Third New International Dictionary, 1971, G & C Merriam Company, Springfield MA.

[3] ibid.

[4] Greenwood, M. and H.M. Woods, 1919: A Report on the Incidence of Industrial Accidents Upon Individuals With Special Reference to Multiple Accidents. British Industrial Fatigue Research Board, No. 4.

[5] Newbold, E.M., 1926: A Contribution to the Study of the Human Factor in Causation of Accidents. British Industrial Health Research Board, No. 34.

[6] Ames, J.S., 1928: First National Aeronautical Safety Conference, 17th Annual Safety Congress, National Safety Council Transactions, Chicago, IL.

[7] Heinrich, H.W., 1936: Industrial Accident Prevention, McGraw Hill, New York, NY.

[8] Kreml, F. (ed.), 1940: Accident Investigation Manual, Traffic Institute, Northwestern University, Evanston, IL.

[9] Baker, J.S., 1963: Traffic Accident Investigator's Manual for Police, Northwestern University, Evanston, IL.

[10] Driessen, G.J., 1970: Cause Tree Analysis, Measuring How Accidents Happen and the Probabilities of Their Cause. Presented to American Psychological Association, September, 1970, Miami, "FL.

[11] U.S. Army Materiel Command, 1971: Fault Tree Analysis as an Aid to Improved Performance, AMC Safety Digest, May 1971, Washington, D.C.

[12] Civil Aeronautics Board, 1962: Aircraft Accident Report SA 361, United Airlines, Inc. DC-8 N 8013 U, and Transworld Airlines, Inc.

Constellation 1049A N 6907 C, Near Staten Island, NY, December 16, 1960.

[13] Haddon, W., Jr., 1968: The Changing Approach to Epidemiology, Prevention and Amelioration of Trauma; the Transition to Approaches Etiological Rather than Descriptively Based, American Journal of Public Health, 58:8.

[14] . Surry, J., 1969: Industrial Accident Research, University of Toronto, Toronto, Canada.

[15] Baker, ~. cit.

[16] Perchonok, 5., 1969: Multidisciplinary Investigation to Determine Automobile Accident Causation, Report No. 5, Cornell Aeronautical Laboratory, Inc., October, 1969.

[17] 17. Benner, L., 1975: D.E.C.I.D.E. in Hazardous Materials Emergencies, Fire Journal, 69:4, July, 1975.

[18] U.S. National Transportation Safety Board, 1971: Highway Accident Report HAR 71-6, Liquefied Oxygen Tank Explosion Followed by Fires in Brooklyn New York, May 30, 1970.

[19] Benner, L., 1975: D.E.C.I.D.E. in Hazardous Materials Emergencies, Fire Journal, 69:4, July, 1975.

[20] U.S. National Transportation Safety Board, 1973: Aircraft Accident Report AAR 73--16, United Air Lines, Inc. Boeing 737, N9031U Chicago--Midway Airport, Chicago, IL.

[21] U.S. National Transportation Safety Board, 1971: Marine Casualty Report Loss of the Motor Towing Vessel Marjorie McAllister in the Atlantic Ocean, November 2, 1969.

[22] Benner, L., 1975: Risk, Responsibility and Research, presentation to the Council Committee on Chemical Safety of the American Chemical Society, Chicago, IL, August 20, 1975