I’m grateful to David Skegg for assisting with the writing of this explanatory document.
Using the Energy Damage Model (EDM) and the Time Sequence Model (TSM) requires discipline
The EDM draws our attention primarily to the fact that damage involves exposure of the Recipient to energy. As there is only a finite (and quite small) number of energy forms in the world around us it is clear there are only a few distinctly different types of Occurrence. This fact assists us to make sense of the otherwise apparently chaotic and complex subject of ‘accidents’.
The EDM and the TSM are two slightly different models that help us to understand the structure of the process of damage, the Occurrence.
The TSM draws our attention primarily to the fact that the Occurrence process takes time to unfold. This helps us understand the structure of the process and recognise sensible control measures.
If people are to apply these models in a uniform way, they must all adhere to the same discipline – a set of rules that cover how to start and how to continue. The rules need to tell us how to classify the three components of the damage process.
Is it worth the effort?
Yes, very much so. How we frame a problem in our minds determines how we approach it. What we think comes out in written or spoken words. An illogical framework results in pointless and ineffective effort to control risk.
The insight that arises from this effort is useful because:
- It makes it possible to see patterns in our experience and hence to learn from it.
- It makes it possible to predict what has not been seen before.
- It makes it possible to classify Occurrences by type. This is needed when looking at bulk injury/damage data.
- It makes it possible to understand Mechanism and Outcome possibilities without having to wait for a trail of bodies to show us: to understand risks in an entirely new situation.
- It makes it possible to identify detailed control measures.
- It provides a guide to ‘investigation’: the forensic review of a case after it has happened.
What discipline is needed?
Differences of interpretation of the models can be avoided or minimised by the use of rules.
The botanical, zoological and geological sciences have much experience of classifying the processes that give rise to the phenomena they study. Rules for use of the zoological and botanical classification systems have been under discussion by scientists ever since these classifications were first proposed by Carl von Linne (see text page 30).
The same can be said of library science. The Dewey Decimal System is used internationally for cataloging (classifying) books. How would you classify a book on the economics of the bicycle industry in Mongolia without knowledge and rules? In the economics area of the catalogue, in the transport or sports area (for bicycles) or in the geography (for Mongolia) area, or in all three? You may imagine the importance of principles giving rise to rules in order to avoid chaos in library catalogues.
If the study of Risk was a mature science (which it is very much not), we would therefore expect the principles and associated rules for classification of Occurrences (and Consequences) to also be under discussion. The need for discussion does not negate the value of the classifications, it simply reflects the difficulty of making a complex reality fit an artificial structure and the fact that rules are needed to guide people using the system.
What does this mean for us?
Our problem is that the science of risk is still in gestation, not even in infancy and there is no internationally or even nationally agreed set of rules. Moreover, there are very, very few scientists looking at this field and there is no discussion of these fundamental points. Worse still, there is no coherent set of terms used in this field. We are at the beginning. However, the EDM and TSM express fundamental realities, so no matter in what direction the science of risk develops, the meaning and application of the models should not change.
The discussion that follows is for energy sources with the potential for damage. The same principles can be applied to non-energy Threats.
Guidance and rules for use of the models
NOTE: Damage, Injury and Loss arise in Time Zone 3 of the TSM. They arise from what happens at the end of Time Zone 2, the end of the Outcome. The energy forms at the end of Time Zone 2 are often not the same as the original energy form that made Time Zone 2 possible in the first place.
Step 1: Identify the energy source
The energy source is that which is capable of producing the damage of interest. We are doing this because we recognise a potential for damage exists in a situation. Damage is the phenomenon of interest to us and hence we are interested in the energy source that is capable of inflicting this damage. The energy involved is therefore capable of being objectively recognised.
Step 1 is to identify the form of energy that is capable of creating the damage of interest, for example:
- The pressure in a tyre. The unit of pressure is a direct expression of the stored energy content per unit of volume: the total energy stored is the product of pressure and volume. Pressure could reach a point where the tyre ruptures or the rim holding it on the wheel fails. The energy of interest is not the action of a tyre fitter (even though this requires energy) in holding open the inflation valve nor is it the kinetic energy of flying particles or the energy in the pressure shock wave.
- The chemical bonding energy of a bullet fired by a person intent on murder. The muscle energy of the gunman’s fingers are not the energy of interest nor is the kinetic energy of the bullet when fired.
- The gravitational potential energy of a group of people walking onto a balcony, the structure of which subsequently fails. The decision made by the people to stand on the balcony is not the ‘energy’ of interest, nor is the muscle energy used to walk or climb to the balcony. Similarly, the energy of interest is not the kinetic energy of the falling people.
- A person pushing a rock perched on hill-side and dislodging it to roll down the hill and into a car park. The energy of interest is the Gravitational Potential Energy of the rock. The muscle energy exerted by the person in pushing the rock is not the energy of interest, nor the kinetic energy of the rock as it rolls down the hill.
Step 2: Define/describe the Event
The term Event originates in the work of William Rowe. Rowe did not define it explicitly – he said the Event is what precedes the Outcome and the Outcome is what comes after the Event. Obviously this is circular. However, he made its significance in the damage process very evident. I define the Event in terms of Energy and this makes a needed connection between Rowe’s work and that of those who first drew attention to the fact that energy is required in order to produce damage: Gibson, Haddon, Klein, Suchman. See the text for citations.
I developed the TSM from the model used by Rowe. It differs from his only in including Mechanisms and the pre-cursors to them, the Preconditions. The TSM is a structural summary, if you like, of the models used by risk engineers (fault tree analysis, outcome (event) analysis).
In the TSM my Event definition “the point in time when control is lost over the potentially damaging properties of the energy source” implies there is a time before control is lost. That is, the energy source is not constantly impinging on recipients.
It is therefore necessary for us to understand what normally keeps the potentially damaging properties of the energy source under control. The Event is the point in time when these fail to do that. It is useful to describe the Event in a way that means something in the particular situation being considered, rather than laboriously using the necessarily lengthy formal definition.
The Event is something that is necessarily very close to the time when control is lost over the damaging properties of the energy. It is not a point in time (all ‘small e’ events are by definition of the word something at a point in time) that is remote from the point in time when the energy is released.
Class A control measures (see Chapter 7) are either physical or behavioural (human action or the action of a more or less automated control system). For example, a car can be restrained on a slope by the hand brake (the application of which is behavioural), by an automatic brake (a set of physical components and quite common these days) or by me holding it back while someone looks for a chock to hold the wheels. If I just walk away from the task before the chock is in place or my feet or hands slip etc. then the Event involves a human action failure.
Organisational systems as support for Class A controls and as Class B controls don’t have the ability to actually exert control over the damaging properties of an energy source.
In the examples the Event is:
- The failure of the structure of the tyre or wheel that otherwise enables it to hold pressure (control of pressure is lost when the structure fails and compressed gas begins to escape)
- The ignition of the charge in the bullet (control of chemical bonding energy of the charge is lost when the firing pin strikes the cartridge and the bullet begins its flight)
- The failure of the structure supporting the balcony (control of the gravitational potential energy is lost when the balcony structure fails and it and the people on it begin to fall)
- The loss of equilibrium of the forces acting on the rock (control of the gravitational potential energy is lost when the rock begins to roll/fall)
Step 3: Determine the or the possible Hazard Control Failure Mechanism(s)
In the EDM, the Event results from the Hazard Control Failure Mechanism (pictorially this is the point when the damaging properties of the energy source fail to be ‘contained’).
In the TSM the term is simplified to just Mechanism – the reason for the loss of control.
Mechanisms are the way in which this control is lost (the reasons for loss of control). Mechanisms can be interrupted and so fail to produce an Event.
In the examples:
- (Assumed) unintentional overpressure of the tyre or a normal pressure acting on a damaged tyre
- Intentional use of the trigger to fire the bullet
- Overload of a healthy structure supporting the balcony or a normal load on an unhealthy structure
- Intentional application of force to the rock
Note that none of these are ‘causes’ for the ‘accident’. Mechanisms are physical possibilities, not value judgements about motivation of thoughtless or criminal people, management systems, lack of maintenance etc.
Step 4 EDM Space Transfer Mechanism. TSM Outcome
In the EDM a physical means of taking the energy from one point to another (the Recipient) is obviously needed if these are remote in space and/or time. In the EDM when the energy reaches the victim (Recipient) damage starts. This is so unless the energy source is contained in the recipient, such as the gravitational potential energy of a person. In this case a space transfer mechanism is not needed.
Outcome pathways can be reacted to in order to minimise Consequence Values.
In the TSM, this space transfer mechanism is given the name Outcome (or the Outcome pathway). The reason for the slight change in terms is that Outcome is the term Rowe used to name what happened after the Event. In the TSM when the Outcome path ends the damage starts. The two models say a similar thing, giving slightly different perspectives on the real thing of interest – the stage of the process leading from the Event to damage.
The insight given by the EDM is somewhat limited. If the energy source and the recipient are in one and the same place then no space transfer mechanisms is needed. However, for example, the person still falls and the nature of the fall is significant in determining the extent of injury and damage. The TSM is not limited in its view as it invites us to describe in detail what actually happened or could happen.
The Outcome (real or potential) is a complete description of the way in which the process unfolds after the Event and up to the point of Damage.
In the examples:
- The tyre: rapid pressure release, with probable accompanying kinetic energy of parts of the rim and tyre subsequently possibly hitting Recipients.
- The bullet speeds (kinetic energy) through space, losing energy due to air drag and hits a person.
- The balcony either slumps and the people slide off it or the balcony and the people fall to hit the ground.
- The rock rolls down the hill, gathering kinetic energy as it does so but also losing energy overcoming rolling resistance and as it hits obstacles in its path.
Energy form changes in the Outcome
It is not uncommon for the Outcome path to involve other forms of energy derived from the original energy source, as evident in the examples above. For example:
- Pressurised fluids (eg. in pipes or tanks) when escaping from containment change pressure into kinetic energy. When this happens explosively the results are similar to that of a chemical explosion.
- Escaping pressurised fluids commonly contain other forms of energy: steam contains heat; liquids and gases contain chemical bonding energy.
- A chemical explosion (chemical bonding energy being released very rapidly) commonly results in sound energy (the bang), heat energy (heat shock wave), pressure energy (pressure shock wave) and kinetic energy of flying particles.
- Gravitational potential energy commonly (but not always) becomes kinetic energy during a fall.
Occurrence is the name given to the combined Mechanism, Event and Outcome. The Outcome and/or Damage of one Occurrence can become the Mechanism triggering a second Occurrence and so one with no limitation in theory to the number of chained Occurrences.
The well-known crash of the Air France Concorde can serve to illustrate this. In brief, this is what happened. The source of information is the accident report by the French aircraft accident investigation authority, the BEA (undated) Accident on 25 July 2000 at La Patte d’Oie in Gonesse (95) to the Concorde registered F-BTSC operated by Air France
Occurrence 1: A significant maintenance omission resulted in the left hand undercarriage tracking incorrectly so that during the take-off run the aircraft tracked significantly towards the left of the runway centre line. The left hand undercarriage hit a piece of metal on the runway that had fallen from the engine of the aircraft that departed previously.
Mechanism – Undercarriage tracking error
Event – Loss of directional control on the runway. The energy source of interest is the kinetic energy of the aeroplane
Outcome – A space time coincidence. The wheel hits a piece of metal
Consequence – The tyre ruptures
Occurrence 2: The impact with the metal ruptured a tyre and pieces of tyre hit the wing skin in the undercarriage bay.
Mechanism – Outcome and Consequence from Occurrence 1.
Event – Loss of containment of tyre pressure and rotational kinetic energy of the tyre (there are two significant energy sources here)
Outcome – Pieces of tyre strike the skin of the wing in the undercarriage bay
Occurrence 3: The impact of the pieces of tyre are believed to have energised a pressure wave in the fuel contained in that bit of wing. This led to a rupture of the skin, which formed the fuel tank wall, and a leak of fuel.
Mechanism – Outcome from Occurrence 2, resulting in a significant pressure wave in the fuel
Event – Rupture of the tank skin and a loss of containment of fuel. The energy source of interest is the chemical bonding energy of the fuel.
Outcome – Fuel leaks from the tank, mixing with air and streaming back behind the wing.
Occurrence 4: The leaking fuel ignites, possibly due to an electrical spark (the cables in the undercarriage bay had not been provided with protective conduit) and a large flame trailed out behind the aircraft.
Mechanism – Outcome from Occurrence 3 plus contact with an ignition source
Event – Fuel fire begins. The energy source of interest is the chemical bonding energy of the fuel/air mixture.
Outcome – A large flame extends behind the wing. The control tower advise the pilots of a fire under the wing. This is interpreted as an engine fire.
Occurrence 5: Believing the engines to be on fire (the two engines under a wing share a common nacelle), which they were not in fact, the pilots operated extinguishers and reduced power in contravention of the standard rule that power was never to be reduced for any reason below (from my memory) 500 ft above ground level. This action resulted in the loss of roll control of the aircraft (which was at low airspeed and high weight) and of its ability to maintain a climb. The aircraft hit the ground and a hotel.
Mechanism – Outcome from Occurrence 4. Reduction in engine power by the pilots.
Event – Loss of roll control and climb capability. The energy source of interest is the ‘flight energy’ (combined gravitational potential energy and kinetic energy) of the aeroplane.
Outcome – the aeroplane rolls to the left and height above ground level reduces.
Consequence – impact with the ground (and a hotel), rupture of fuel tanks.
Occurrence 6: The large fuel load of the aircraft was no longer confined as a result of the impact with the ground and a large fire developed.
Mechanism – Outcome from Occurrence 5.
Event – Loss of containment of fuel. The energy source of interest is the chemical bonding energy of the fuel.
Outcome – Ignition of the fuel and a major fire develops.
Other influences on the course of events are:
- The aircraft was overweight for the runway in use, because of a shift in wind direction that occurred just before take off.
- As the aircraft tracked to the left of the runway it was heading towards an Air France Boeing 747 that was waiting to cross the runway. This may have led the Concorde pilots to lift off earlier than intended and hence at a lower airspeed than planned to avoid hitting the waiting plane.
In this chain of Occurrences there are two significant energy sources of interest – the chemical bonding energy of the fuel (Occurrences 3, 4 and 6) and the flight energy of the aircraft (Occurrence 5).