Episode 5: Mapping Systemic Failure: Jens Rasmussen's AcciMap

Theo Ashworth

Walkerton, Ontario, May 2000. The drinking water is contaminated with E. coli. An estimated 2300 people become seriously ill and seven die. The investigation finds that the operators ran the chlorination improperly and falsified records. That's real, and it matters. But if the story stops there, we've learned how to discipline two men and almost nothing else.

Nell Harding

And that's exactly where a 5 Whys would happily stop, isn't it? Why was the water contaminated? Chlorination failed. Why? The operators did it wrong. Why? They falsified records. You end up with a tidy chain and a name at the bottom of it.

Theo Ashworth

Right, one straight line, and you only ever follow the one branch you happened to pick. Last episode we went further with ICAM and James Reason's Swiss cheese model. That brought in latent conditions and organisational defences, so you could ask what company management did to leave those holes lined up. But ICAM tends to stop at the edge of the company. The regulator, the government, the market the company operates in, those are treated as the weather. Background. Givens.

Nell Harding

So AcciMap's pitch is that the weather is part of the system.

Theo Ashworth

Exactly that. Jens Rasmussen, the Danish safety scientist and cognitive systems engineer, introduced it in his 1997 paper, Risk Management in a Dynamic Society: A Modelling Problem. He refined it with Inge Svedung around 2000 and 2002. His core argument is that major accidents in complex sociotechnical systems are rarely one front line error or one broken component. They're system wide failures that build up over time.

Nell Harding

Built up how, though? Nobody sets out to design a disaster.

Theo Ashworth

No, and that's his dynamic safety model. Think of a path through a field with a cliff edge somewhere you can't see. Financial pressure pushes everyone one way, competition pushes them another, workload pushes a third, and each little step towards the edge looks sensible at the time. Organisations drift towards the boundary of safe performance, and the accident is just the day the drift runs out of field.

Nell Harding

Okay, so how do you lay that out on paper without it turning into soup?

Theo Ashworth

With levels. Rasmussen originally outlined six, and you can adapt them. Government policy and budgeting at the top: legislation, political priorities, funding cuts. Then regulatory bodies and industry associations, so inspection regimes and standards and whether anyone has the capacity to enforce them. Then company management and culture. Then technical and operational management, meaning supervision, maintenance programmes, training. Then physical processes and actor activities, which is what people actually did on shift. And at the bottom, equipment and surroundings. Kate Branford's standardised versions often work with fewer, four to six.

Nell Harding

And the thing that connects them?

Theo Ashworth

Vertical integration. For a system to stay safe, decisions and constraints have to cascade down the levels, and honest information about real operating conditions has to flow back up. Accidents happen when that loop breaks and the upper levels lose sight of ground reality. So the question isn't only who did what at the bottom. It's what did the people above know, and what were they deciding without knowing it.

Nell Harding

Here's my worry, though. Once you're allowed to draw lines from a government budget to a man at a chlorine dosing station, it sounds like you can blame anyone for anything. Where's the discipline?

Theo Ashworth

That's the right worry, and the method answers it directly. In the guidelines by Branford, Naikar and Hopkins, every node and every connecting link has to be grounded in documented evidence from the investigation. A node is an event, a condition or a decision, and it sits in its level. Directed arrows show what contributed to what. If you can't point to a document, a witness statement, a record, then you don't get to draw the arrow. No hypothetical lines across the organisation just because they feel plausible.

Nell Harding

So the map is only as good as the paper trail behind it. Which means gaps in the map are honest information too.

Theo Ashworth

Yes. A gap tells you where to go and ask the next question. Now, back to Walkerton, because Vicente and Christoffersen built the AcciMap for it. The operators' actions are on the map, at the actor level. But so is what sat above them: provincial government budget cuts, the privatisation of testing laboratories without mandatory reporting rules, and dismantled regulatory oversight. Their finding was that these had eroded safety margins over about 20 years. So when the operators falsified records, the question changes. Why did nobody above them have a way to see it?

Nell Harding

Which is vertical integration failing in the real world. The information that should have gone up had no route to go.

Theo Ashworth

And there's a second case that makes it sharper. Woo and Vicente compared Walkerton with the North Battleford outbreak of April 2001, also a drinking water failure. The low level physical and individual factors differed between the two. The high level governmental and regulatory factors tended to be the same.

Nell Harding

Hang on. Different plant, different people, same top of the map?

Theo Ashworth

That's the claim from their comparison. And if it holds, you can retrain every operator in the province and still be waiting for the next one. That's what none of our earlier methods could show us.

Nell Harding

So when do you reach for it? Because I can't imagine doing this for a trolley that clipped a doorframe.

Theo Ashworth

Fair. A 5 Whys in a team meeting is still the right tool for a contained fault. A fishbone helps when you need to brainstorm categories, but it won't show you power structures or regulatory influence. And ICAM suits an investigation inside the enterprise. AcciMap earns its effort when the outcome is serious, when several organisations were involved, and when you suspect the front line was operating inside conditions someone else created. It's been applied to the Esso Longford gas explosion, to rail disasters like Ladbroke Grove, Waterfall and Grayrigg, and to healthcare systems.

Nell Harding

And the price is time and evidence. You need the documents before you draw.

Theo Ashworth

Always. So the habit to take away is simple. When your analysis lands on an operator, ask which level above them made that moment likely, then ask what evidence you have for it. If you've got the evidence, draw the arrow. If you haven't, write down what you need to find.