ABSTRACT
Accident - and incident - analyses are usually aimed at finding the set of causes that is necessary and sufficient to explain what happened. In many cases the determination of the cause, however, reflects the interests of the stakeholders as much as what actually happened. As Perrow (1986) noted:
Formal accident investigations usually start with an assumption that the operator must have failed, and if this attribution can be made, that is the end of serious inquiry. Finding that faulty designs were responsible would entail enormous shutdown and retrofitting costs; finding that management was responsible would threaten those in charge, but rmding that operators were responsible preserves the system, with some soporific injunctions about better training. (p. 146)
Even if the investigation into what caused the accident is more open-minded than Perrow assumes, focussing on finding the cause easily detracts interest from the other conditions that contributed to the accident. A proper accident analysis should not only look for possible specific causes, but also for the general system conditions at the time of the accident, specifically the barriers that may have failed. An understanding of the nature of barriers and defences, and a method for analysing and classifying their functions and failures, is important as a basis for being able effectively to prevent future accidents.
