The past two decades have seen a significant number of large-scale disasters in a wide range of hazardous, well-defended technologies. Despite their differences, the root causes of these accidents have been traced to latent failures and organizational errors arising in the upper echelons of the system in question. A model of the aetiology of these organizational accidents is outlined. The model describes two interrelated causal sequences: (a) an active failure pathway that originates in top-level decisions and proceeds via error-producing and violation-promoting conditions in the various workplaces to unsafe acts committed by those at the immediate human-system interface and (b) a latent failure pathway that runs directly from the organizational processes to deficiencies in the system's defences. The paper goes on to identify two sets of dependencies associated with latent failures and violations. Organizational errors increase the likelihood of operator error through the active failure pathway and, at the same time, enhance the possibility of adverse outcomes through defensive weaknesses. Violations have a narrower range of-consequences. Non-compliance with safe operating procedures increases the likelihood of error by taking perpetrators into regions of operation in which neither the physical regime nor the hazards are well understood. Violations, by definition, also take perpetrators 'closer to the edge,' and thus increase the chance that subsequent errors will have damaging outcomes. The paper concludes by indicating two ways in which the model has been applied in industrial settings: (a) through the development of proactive measures for diagnosing and remedying organizational processes known to be implicated in accident causation, and (b) an accident investigation technique that guides investigators and analysts to the organizational root causes of past accidents.
