Abstract

History reveals an ever-increasing caboodle of protective measures for assuring an acceptable level of safety for both new product designs and for the remediation of man-made and natural hazards. Some seventy years ago, safety professionals began to functionally categorize these safety tools and rank the categories according to their perceived effectiveness. At first, the resulting hierarchies were designated Safety Hierarchies; later updated versions are now referred to as Hierarchies of Controls. To characterize Hierarchies, sixty-six references were surveyed that were published after 1952. Each of these design recipes begin with the admonition “Eliminate the hazards.” All of the hierarchies were created using consensus or speculation, not research. We establish that the Safety Hierarchies and the Hierarchies of Controls are merely rules of thumb, not theorems. Generally, different hierarchies give rise to different designs. The principal strength of both Hierarchies is their replacement of the myth of colloquial safety as “freedom from harm” with a realistic technical definition of safety as an “acceptable level of risk” that is systematically achievable however tortuous.

1. Introduction

A set of Safety Hierarchies and Hierarchies of Controls has been collected for this paper that includes 66 documents that were published after 1952. A typical hierarchy, taken from the National Safety council (NSC), is presented in Exhibit 1 ¹. Some have as few as three elements; others have four, five, or six.

Every agency presenting a Hierarchy has included a discussion that illuminates the contents of each element or category. For example, the NSC has a very extensive discussion of Exhibit 1. Authoritative presentations may also be found in the following standards:

• ANSI B11.TR3-2000

Risk Assessment and Risk Reduction - A Guide to Estimate, Evaluate and Reduce Risks Associated with Machine Tools, pp. 10-12.

• ANSI/AIHA Z10-2005

American National Standard - Occupational Health and Safety Management Systems, p. 11.

• MIL-STD-882D

Department of Defense Standard Practice For System Safety, pp. 3-4.

Our study focuses on a handful of properties that these hierarchies hold in common. It is not the mission of our paper to wring out the detailed make-up of the various design hierarchies.

A. Brief Safety Lexicon

The most important concepts in the field of safety have commonplace dictionary definitions that are unrelated to their technical definitions. This undesirable circumstance is exacerbated by the existence of multiple definitions for identical lynchpin concepts in the technical arena. Colloquial “safety” is used throughout this paper. When encountered, technical safety will be designated as such.

1. Consensus…General agreement. Not necessarily unanimous agreement.

2. Consensus Standards…When there is consensus among stakeholders in a given safety area, this may result in the formulation of a standard, code, regulation, principle, or rule-of-thumb.

3. Hazard…A hazard is a physical entity which presents a potential for injury or harm.

4. Mishap…An unplanned event or series of events resulting in death, injury, occupational illness, damage to or loss of equipment or property, or damage to the environment.

5. Protective Measures…Design, Guards, Safeguarding Devices, Awareness Barriers, Safeguarding Methods, Safe Work Procedures, Administrative Controls, Warnings, Training, and Personal Protective Equipment Used to Eliminate Hazards or Reduce Risks.

6. Residual Risk…Risk remaining after protective measures have been taken.

7. Risk…See Section 1, D.

8. Safe…Colloquial definition: free of harm or injury.

9. Safeguarding… Guards, safeguarding devices, awareness devices, safeguarding methods, and safe work procedures.

10. Tolerable Risk…Risk that is accepted for a given task and hazard combination [hazardous situation].

B. Reasonably Foreseeable Use

Reasonably Foreseeable Use is an act or practice that must meet three necessary conditions, ²

• It must be possible.

• There must be a use pattern that enables the prediction of an occurrence.

• It must occur with reasonable frequency.

This amazingly important legal doctrine allows one to dismiss risks that are not reasonably foreseeable, e.g., being hit by a meteorite. All intended uses of a product are reasonably foreseeable; extended uses or misuses may or may not be.

C. Safety Theorem

Supporting a hypothesis formulated by many scholars and safety professionals, inductive inference was used to establish the following theorem:

Safety Theorem

“Every physical entity created by man or nature is a hazard capable of causing harm.”

Some of the relevant implications that flow from this theorem are summarized by Barnett ³,

• The colloquial notion of safety as the absence of harm is a myth in the world of reality.

• All physical entities present an infinite number of hazards.

• No hazard implies no harm and no risk.

D. Risk

The technical definition of Risk is a combination of hazard severity and hazard exposure ⁴. Its antonym is Technical Safety and its reciprocal, 1/Risk, is the technical definition of Technical Safety. Any mishap, such as a vehicle crash, is measured by its Risk. This vague definition of Risk has currently been represented by a Risk-Matrix such as shown in Exhibit 2 that was taken from ANSI/AIHA Z10-2005 ⁵. Observe that the two independent variables, severity and exposure, define four levels of Risk in the matrix; High, Serious, Medium, and Low. If this crude approximation of Risk is unacceptable, it may be mitigated by applying the Hierarchy of Controls presented at Exhibit 1.

After Risk has been reduced by the application of protective measures associated with the hierarchies, the remaining risk is called “Residual Risk.” It should be noted that the hierarchies do not assure that all protective measures have been implemented. Also, some protective measures may reduce the Risk further than the tolerable risk.

E. Rule-of-Thumb

History

It is widely held that the phrase “rule of thumb” is derived from the English common law which restricted a man to beating his wife with “a whip or rattan no bigger than the width of his thumb (circa 1600’s.)” Rich ⁶ takes issue with this historical notion and suggests instead that the derivation of the phrase is based on the practice of brewers using their thumbs to measure the temperature of their beverage.

Definition… “A method of procedure or analysis based upon experience and common sense and intended to give generally or approximately correct or effective results (seems to have run the ship by rule of thumb and word of mouth.)” ⁷

Insight into the value and construction of a rule of thumb is provided by the Exception Principle. The following has been excerpted from the book “The Society of Mind” by Marvin Minsky ⁸:

“The Exception Principle: It rarely pays to tamper with a rule that nearly always works. It’s better just to complement it with an accumulation of specific exceptions.”

“All children learn that birds can fly. So what should they do when told that penguins and ostriches are birds that cannot fly? What should children do with rules that no longer work so well? The Exception Principle says: Do not change them too hastily. We should never expect rules to be perfect but only to say what is typical. And if we try to modify each rule, to take each exception into account, our descriptions will become too cumbersome to use. It’s not so bad to start with Birds can fly and later change it into Birds can fly, unless they are penguins or ostriches. But if you continue to seek perfection, your rules will turn into monstrosities:

Birds can fly unless they are penguins and ostriches, or if they happen to be dead, or have broken wings, or are confined to cages, or have their feet stuck in cement, or have undergone experiences so dreadful as to render them psychologically incapable of flight.”

We observe that the rule approaches a law when exceptions are continually appended.

Remarks ⁹

1. Rules of thumb are good servants but bad masters.

2. Without research to give us physical laws, the rule of thumb provides the primary guidance for safety practitioners.

3. The fact that contrivances or behavior violate rules of thumb does not mean they are unreasonable per se. Negligent behavior or design cannot be determined by rules of thumb; other corroborating extrinsic factors must be employed.

2. Hierarchies

Safety technology is preoccupied with the task of mitigating mishaps. Since mishaps only occur in the presence of a hazard, the first mitigation step must be identification of hazards. Theoretically, this is an impossible undertaking because the Safety Theorem imputes that the number of hazards is unbounded ³. Fortunately, only a finite number of hazards must be confronted; those that are Reasonably Foreseeable ². Different agencies may further reduce the number of “hazards of interest;” e.g., C-type standards that provide specifications for a given category of machinery like power presses.

Once the hazards for a given system are identified, it is incumbent upon a designer to assure that its risk is tolerable. If not, the risk must be reduced using tools found in the metaphorical safety toolbox. The efficiency of this mitigation has been streamlined by grouping safety concepts into categories or elements which are invoked sequentially to reduce the system risk to the lowest acceptable or tolerable level by applying an order of precedence to the elements. This mitigation strategy applies to the elements in order of decreasing effectiveness. The process usually terminates before the lower elements are required.

A. Safety Hierarchy

Table 1 presents a survey of forty-five hierarchies that were published in the years 1953 through 1984. The following observations characterize this collection:

1. None of the hierarchies display elements that reflect a complete set of safety concepts (protective measures).

2. Various orderings of the elements are displayed. This implies that each hierarchy is a rule of thumb, not a theorem or scientific law.

3. Each hierarchy is the result of consensus or speculation; no research is presented to justify the hierarchy.

4. It is remarkable that the first admonition in each hierarchy is “eliminate the hazard.”

B. Hierarchy of Controls

Table 2 describes a set of twenty-one hierarchies that were published in the years 1980 through 2014. These are called Hierarchies of Controls. Their global properties are summarized as follows:

1. All of the hierarchies present the complete set of protective measures.

2. Various orderings of the elements can be found among the hierarchies. Furthermore, elements with the same name may include different safety concepts, e.g., Design. Once again, this implies that each hierarchy is a rule of thumb as opposed to a theorem. Different hierarchies will produce designs using different safety concepts.

3. Each hierarchy is the result of consensus or speculation; no research is presented to justify the hierarchy. Yet, all modern Risk Reduction strategies rest on the fidelity of Hierarchies of Controls.

4. Like the Safety Hierarchies, the first admonition in each Hierarchy of Controls is “eliminate the hazard.”

3. Hazard Elimination

According to the Safety Theorem, every physical entity presents an infinite number of hazards. Every safety device added to the entity increases the number of hazards. Because every hazard has a physical manifestation it presents, under some circumstance, an exposure to a human interface. Given that Risk is a combination of hazard severity and hazard exposure, there is a Risk associated with every hazard. Thus, by definition, only the removal of a hazard will eliminate the associated risk.

If every hazard in a subsystem is removed, the Risk of the subsystem is zero. Other than “eliminating the hazard,” all other remediation strategies continue to exhibit hazards, albeit, protected hazards.

Consider a subsystem containing the chemicals A, B, and C,

A. Asbestsos

B. Beryllium

C. Carbon monoxide

Complete removal of the ABC hazard is the only mitigation strategy that provides a Risk-Free subsystem. When the Elimination Theorem is applied to the Safety Hierarchy or the Hierarchy of Controls, only the step “eliminate the hazard” is a theorem; all other steps are rules of thumb.

In American jurisprudence, should non-compliance with a rule of thumb, given its exceptions, constitute negligent behavior? On the other hand, violation of a safety theorem may give rise to a fair cause of action.

4. Comments

The importance of the Hierarchies of Control as a building block in the modern safety world of risk assessment and risk reduction cannot be overstated. Further, the compliance or noncompliance of this protocol as a method of assigning liability in a product liability contest is a persistent source of nincompoopery. If the development of our future safety concepts is going to depend on Hierarchy of Controls, what criteria should be used to judge their veracity? As an example, for federal agencies, the National Institute of Standards and Technology (NIST) of the U.S. Department of Commerce, requires that NIST guidelines maintain a high level of quality in their disseminated information. Among other things, this requires “a focus on ensuring accurate, reliable, and unbiased information. In scientific, financial, or statistical context, the original and supporting data will be generated, and the analytic results will be developed, using sound statistical and research methods. ⁷⁵

In the 66 documents reviewed on hierarchies, no research was cited. Our literature collection revealed no explanation for the many versions of the hierarchies. An examination of the hierarchies raises many questions about their order of precedence. For example, in many of the formats the application of warnings proceeds the application of training. In complex systems this is clearly contradicted by communication theory; only limited information can be transferred by warnings (e.g. Rule of 7±2) whereas training can easily embrace 100 safety procedures. Can a warning on a modern hammer to avoid striking hardened materials, provide the same level of safety obtained by safety eyewear? As a universal notion, is it always better to reduce the hazard severity by design as opposed to minimizing hazard exposure with a barrier guard?

Other challenges to hierarchy precedence should include a consideration of known sophisticated and subtle safety doctrines including the following:

• The Dependency Hypothesis ^{76, 77}

The hypothesis states, “Every safety system gives rise to a statistically significant pattern of user dependence". The overall implication of the hypothesis is the recognition that people will transfer their personal vigilance to dependence on safety devices. This can lead, for example, to misuses of safety devices as control systems such as the edge contacts and the electric eyes that reverse or freeze elevator doors when patrons insert their hands into the closing doors.

• On Classification of Safeguard Devices ^{78, 79}

With reference to reasonably foreseeable hazards, safety devices may help you, may hurt you, or may do nothing. Combinations of these three notions give rise to categories that contain the introduction of new hazards. There is a universally accepted safety principle which prohibits the insertion of additional safety hazards while trying to be helpful.

• Compatibility Hypothesis ⁸⁰

The compatibility hypothesis states, "the larger the perceived improvement in utility compared to the perceived increase in risk, the greater will be the motivation to circumvent a machine’s safeguarding system.”

• Decoupling Theory ⁸⁰

The notion of decoupling is that a designer should not require an operator or maintenance person to place his well-being in the hands of another person. This should be avoided when possible.

• Principle of Uniform Safety ⁸¹

The principle of uniform safety states, "Similarly perceived dangers should be uniformly treated". For example, the overall safety of a collection of machines can be compromised by adding new machines with modern safety devices. When workers are transferred to the older machines without these new safety systems their personal vigilance is inadequate for the new challenge.

• Doctrine of Manifest Danger ⁸²

This doctrine defines a design concept that uses direct cues or indicator devices to communicate to the community of users that the safety of a system has been compromised before injuries occur.

• Lockout/Tagout (LOTO) ⁸³

LOTO is primarily a maintenance philosophy which requires workmen to isolate or block the energy sources that are both internal and external to a machine before exposing themselves to its operating hazards.

System Safety standards are mindful of these subsidiary design constraints; however, they are saddled with the efficacy issues associated with the definition of Risk, the Risk Matrix, the Doctrine of Reasonably Foreseeable Use, and the Hierarchy of Controls.

Acknowledgments

This is the third and final paper reflecting Triodyne’s research into fundamental concepts of safety philosophy. Our gratitude for the support of the Robert Clifford Law Firm cannot be overstated.

References