Safety Science 49 (2011) 764–777

Contents lists available at ScienceDirect

Safety Science

journal homepage: www.elsevier .com/locate /ssc i

Review

Safety in the mining industry and the unfinished legacy of mining accidents:Safety levers and defense-in-depth for addressing mining hazards

Joseph H. Saleh ⇑, Amy M. CummingsSchool of Aerospace Engineering, Georgia Institute of Technology, Atlanta, GA 30332, USA

a r t i c l e i n f o

Article history:Received 27 May 2010Received in revised form 12 February 2011Accepted 28 February 2011Available online 29 March 2011

Keywords:Mining industryAccidentsDefense-in-depthExplosions

0925-7535/$ - see front matter � 2011 Elsevier Ltd. Adoi:10.1016/j.ssci.2011.02.017

⇑ Corresponding author. Tel.: +1 404 385 6711.E-mail address: jsaleh@gatech.edu (J.H. Saleh).

a b s t r a c t

Mining remains one of the most hazardous occupations worldwide and underground coal mines areespecially notorious for their high accident rates. In this work, we provide an overview of the broadand multi-faceted topic of safety in the mining industry. After reviewing some statistics of mining acci-dents in the United States, we focus on one pervasive and deadly failure mode in mines, namely explo-sions. The repeated occurrence of mine explosions, often in similar manner, is the loud unfinished legacyof mining accidents and their occurrence in the 21st century is inexcusable and should constitute a strongcall for action for all stakeholders in this industry to settle this problem. We analyze one such recent minedisaster in which deficiencies in various safety barriers failed to prevent the accident initiating eventfrom occurring, then subsequent lines of defense failed to block this accident scenario from unfoldingand to mitigate its consequences. We identify the technical, organizational, and regulatory deficienciesthat failed to prevent the escalation of the mine hazards into an accident, and the accident into a ‘‘disas-ter’’. This case study provides an opportunity to illustrate several concepts that help describe the phe-nomenology of accidents, such as initiating events, precursor or lead indicator, and accident pathogen.Next, we introduce the safety principle of defense-in-depth, which is the basis for regulations andrisk-informed decisions by the US Nuclear Regulatory Commission, and we examine its relevance andapplicability to the mining system in support of accident prevention and coordinating actions on all thesafety levers, technical, organizational, and regulatory to improve mining safety. The mining systemincludes the physical confines and characteristics of the mine, the equipment in the mine, the individualsand the organization that operate the mine, as well as the processes and regulatory constraints underwhich the mine operates. We conclude this article with the proposition for the establishment ofdefense-in-depth as the guiding safety principle for the mining industry and we indicate possible benefitsfor adopting this structured hazard-centric system approach to mining safety.

� 2011 Elsevier Ltd. All rights reserved.

Contents

1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7652. Brief overview of mining safety statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7653. Health and safety issues in the mining industry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7684. Case study: the Jim Walter Resources (JWR) NO. 5 mine disaster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7695. Defense-in-depth and safety levers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7716. Defense-in-depth and the mining industry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7737. Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 775Appendix A. Brief discussion of select mining disasters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 775

A.1. Sago mine disaster, United Sates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 775A.2. Aberfan disaster, United Kingdom . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 775A.3. Buffalo Creek disaster, United Sates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776A.4. Chasnala mine disaster, India. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776A.5. Coalbrook North mine disaster, South Africa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776A.6. Sunshine mine disaster, United Sates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776

ll rights reserved.

1 Parmost s(Hopkin

J.H. Saleh, A.M. Cummings / Safety Science 49 (2011) 764–777 765

A.7. Crandall Canyon disaster, United Sates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776A.8. Farmington mine disaster, United Sates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776

References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776

1. Introduction

Mining remains one of the most hazardous occupations world-wide, and underground coal mines are especially notorious fortheir high accident rates. Recent media coverage of major fatalaccidents in Ukraine, China, South Africa, and the United Stateshighlight a growing public awareness of the dangers of mining.Unfortunately these reported events constitute only the tip of the‘‘safety iceberg’’ in an industry that remains significantly importantin many parts of the world and constitutes an essential economicactivity for many communities.

In mining as well as in other hazardous industries, varioussafety levers can be acted upon to modify the exposure to theinherent risks involved, to minimize their likelihood of occurrence,and to contain or mitigate the consequences of accidents shouldthey unfold. Decision-makers can adopt different attitudes andchoices with respect to the conditions in these industries. Considerthe following episode in which the comments of the protagonistsare particularly revealing of different ‘‘archetype’’ attitudes typi-cally adopted in the face of hazardous conditions. In November2007, a major explosion occurred in a mine in Ukraine killing 90miners. The Prime Minister at the time, Viktor Yanukovych was re-ported as saying, ‘‘this accident has proven once again [emphasisadded] that a human is powerless before nature’’ (BBC News,2007a,b). The Ukrainian President Viktor Yushchenko adopted adifferent attitude and charged that ‘‘the government had madeinsufficient efforts to re-organize the mining sector, particularlythe implementation of safe mining practices.’’ One finds in thesecomments on the one hand a resigned attitude to accept the inher-ent hazards of the industry (in this particular case it was a build-upof methane), on the other hand, a recognition that some safety le-vers exist, and that they can be acted upon to modify the exposureto the risks of mining (in this case, improved government oversightand regulation, and restructuring of the industry).

These two attitudes reflect typical perspectives on accident cau-sation and system safety, and they are not unfamiliar to the aca-demic safety community. For example, the Normal AccidentTheory (NAT), developed by Perrow (1984), contends that in somesystems, accidents are ‘‘normal’’ and unavoidable. Perrow com-mented that the nuclear incident at Three Mile Island in Pennsyl-vania1 was ‘‘unexpected, incomprehensible, uncontrollable andunavoidable; such accidents had occurred before in nuclear plants,and would occur again, regardless of how well they were run.’’ Theunderlying fatalistic mindset in this comment finds echo in theUkrainian Prime Minister’s statement about human powerlessnessin the face of certain hazards. By contrast to NAT, the High ReliabilityOrganization (HRO) paradigm was proposed by a group of research-ers (Roberts, 1990a,b; La Porte, 1996; LaPorte and Consolini, 1991;Weick and Roberts, 1993; Weick and Sutcliffe, 2001) who analyzedorganizations with high safety records and emphasized not howaccidents happen, but what successful organizations do to promoteand ensure safety. These contributions find echo in the UkrainianPresident’s statement, or more precisely, its underlying mindset thatvarious actions can be taken (but in this case they were not) to im-prove safety and decrease the risks to the miners.

tial core meltdown of a nuclear power plant (March 1979); considered theignificant event in the history of the American nuclear power industrys, 2001).

In essence, the distinctive feature between the two commentsreported previously is with respect to attitudes and choicesadopted in the face of hazardous conditions: (1) forfeiting actionto improve safety, the resigned attitude to accept hazardous condi-tions as they are; and (2) devising approaches and acting on vari-ous safety levers to modify the exposure to these inherent risks,decrease their likelihood of occurrence, and contain or mitigatethe consequences of accidents should they unfold.

There is an economic and a moral argument in support of thestatement that the most important resource that comes out ofthe mine every day is the miner. It is thus unacceptable to forfeitaction to improve safety in the mining industry and be contentwith its current safety track record worldwide. But how to go aboutdevising strategies and executing on them to improve safety in themining industry? First, it is important for the stakeholders in-volved in this industry to have the proper tools, frameworks, andunderstanding of various hazards for dealing with system safetyand accident causation. In this work, we introduce the safety prin-ciple of defense-in-depth to the mining community and propose itas a guiding principle for coordinating actions on various safety le-vers, technical, organizational/managerial, and regulatory to im-prove mining safety. Our purpose is to contribute one small stepin supporting mining operators and regulators improve on the cur-rent safety conditions in this industry and sustainably reduce itscasualty rate.

The remainder of this paper is organized as follows. In Section 2,we provide a brief overview of safety statistics in the mining indus-try and highlight the historical evolution of the number of fatalitiesand fatality rates. In Section 3, we distinguish between health andsafety issues in the mining industry. In Section 4, we focus, beyondmining statistics, on a particular and pervasive failure mode inmines, namely mine explosion, and we analyze one such accident,the Jim Walter Resources No. 5 mine disaster. In Section 5, weintroduce the safety principle of defense-in-depth and the conceptof safety levers, and apply these ideas to mining hazards in Sec-tion 6. We conclude this work in Section 7 and offer some recom-mendations for pursuing this preliminary work and broad miningsafety agenda.

2. Brief overview of mining safety statistics

This section provides an overview of the safety record of themining industry. The focus is on the US mining industry for whichextensive data is available from the Mining Safety and HealthAdministration (MSHA).

Fig. 1a shows the evolution of the number of fatalities in the USmining industry between 1999 and 2008. A decreasing trend isnoticeable in the figure, from 90 fatalities in 1999 to 53 in 2008.This local trend however should not be considered a robust indica-tion of safety improvements in this industry; such a conclusionwas already challenged by the Sago mine and the Crandall Canyonmine disasters in 2006 and 2007 respectively (see Appendix A for abrief discussion of these accidents), and whose statistical effectscan be seen in Fig. 1a. A temporary decrease in the number of fatal-ities (or fatality rate) should not invite a decrease in safety vigi-lance as complacency in the mining industry will inevitablycompromise safety and create latent conditions that will developinto accidents.

2735

2633

23

2823 47 34

30

53

6773

5855

0

10

20

30

40

50

60

70

80

90

100

2004 2005 2006 2007 2008

Year

Metal/Non-metal Coal Series1

Fig. 1b. US fatalities by mining sector. Source: US Mining Safety and HealthAdministration.

16,0

53

15,8

55

14,6

16

13,2

97

11,9

39

11,9

78

12,3

17

11,9

16

11,4

30

0

2,000

4,000

6,000

8,000

10,000

12,000

14,000

16,000

18,000

20,000

1999 2000 2001 2002 2003 2004 2005 2006 2007

Non-fatal injury Occupational illness

Fig. 2. All US mining injuries and illnesses. Source: US Mining Safety and HealthAdministration

9085

7269

56 5558

7367

53

0

10

20

30

40

50

60

70

80

90

100

1999 2000 2001 2002 2003 2004 2005 2006 2007 2008Year

Fig. 1a. All US mining fatalities. Source: US Mining Safety and HealthAdministration.

766 J.H. Saleh, A.M. Cummings / Safety Science 49 (2011) 764–777

Fig. 1b provides a breakdown of the fatalities by mining sector, atypical classification of the mining industry between coal on theone hand, and metal/non-metal on the other hand.

Fatality numbers tell one part of the safety record of an indus-try; another important dimension of this safety record is the num-ber of injuries and illnesses associated with said industry. Fig. 2shows the evolution of the number of injuries and illnesses inthe US mining industry between 1999 and 2007. The number ofnon-fatal injuries is significantly high, more than two orders ofmagnitude the number of fatalities, but it shows a steady decreasefrom roughly 16,000 in 1999 to over 11,000 in 2007. The number ofoccupational illnesses was significantly lower over this same peri-od and varied between roughly 900 and 300.

It is informative to look at broader historical trends in the evo-lution of fatalities and fatality rates in the mining industry. Fig. 3ashows the evolution of the number of fatalities in the US miningindustry a century ago, between 1909 and 1918. The industry backthen claimed the lives of a sobering 2600 miners on average everyyear, probably a result of a deadly combination of technical igno-rance (of hazardous conditions, especially methane build-up andexplosions), organizational recklessness, and lack of governmentoversight.

Fifty years later, between 1959 and 1968, the US coal miningfatalities, shown in Fig. 3b on the same scale as that in Fig. 3a forcomparative purposes, show a dramatic decrease from the earlierlevels, to a yearly average of roughly 270 fatalities per year. The to-tal number of workers in the US coal mines decreased roughly byhalf between these two periods (see Fig. 4b), therefore the orderof magnitude decrease in the number of fatalities between 1909–1918 and 1959–1968 reflects a fivefold decrease in the fatality rate,a smaller (than the absolute value decrease) but significant safetyimprovement nonetheless.

This discussion invites a reconsideration of the statement by theUkrainian Prime Minister quoted earlier, that ‘‘this accident hasproven once again that a human is powerless before nature.’’Figs. 3a and b illustrate that people are neither powerless noromnipotent before nature, that safety levers do exist and can beacted upon to modify the exposure to the inherent risks in the min-ing industry, and thus in the long run improve the industry’s safetyrecord.

Since employment and fatalities data in the US coal miningexist dating back for over a century, fatality rates can be com-puted and their evolution over a long period of time displayedfor (qualitative) visual assessment. Fig. 4a shows the evolutionof the US coal mining fatality rate between 1900 and 2008. Dis-played next to the fatality rate graph is the evolution of thenumber of workers in the US coal mines over the same period(Fig. 4b).

Fig. 4a shows several important trends in the evolution of thefatality rate. Three periods can roughly be distinguished as follows:

� 1900 – Late 1940s: In this period, a significantly high fatalityrate plagued the industry starting with roughly 0.4% a centuryago or 400 fatalities per 100,000 miners. A slow downwardtrend is visible in Fig. 4a during this period, with the fatalityrate dropping from 0.4% in 1910 to roughly 0.2% in the late1940s. It is worth pointing out that the US Bureau of Mines(USBM) was established in 1910 with the task of reducingmining accidents and improving conditions under which min-ing operations are conducted. The USBM is identified as hav-ing played a significant role in reducing these fatality rates(National Research Council, 2007), and the downward trendin the fatality rate during this period is indicative that carefulgovernment involvement and regulatory efforts can help makea difference in the safety record of a hazardous industry.Another important trend during this time period is the signif-icantly high variability of the fatality rate, in sharp contrast

293 325 294 289 284 242 259 233 222 311

0

500

1000

1500

2000

2500

3000

1959

1960

1961

1962

1963

1964

1965

1966

1967

1968

Year

Fig. 3b. US coal mining fatalities 1959–1968. Source: US Mining Safety and HealthAdministration.

0.00%

0.10%

0.20%

0.30%

0.40%

0.50%

0.60%

1900 1910 1920 1930 1940 1950 1960 1970 1980 1990 2000

Fata

lity

rate

in U

.S. c

oal m

inin

g

Fig. 4a. Evolution of the fatality rate in the US coal mining between 1900 and 2008.Source: US Mining Safety and Health Administration (MSHA).

0100,000200,000300,000400,000500,000600,000700,000800,000900,000

1,000,000

Num

ber o

f wor

kers

1900 1910 1920 1930 1940 1950 1960 1970 1980 1990 2000

Fig. 4b. Number of workers in the US coal mining. Office workers included startingin 1973. Source: US Mining Safety and Health Administration (MSHA).

2,6422,821

2,656

2,419

2,785

2,4542,269 2,226

2,6962,580

0

500

1,000

1,500

2,000

2,500

3,000

1909 1910 1911 1912 1913 1914 1915 1916 1917 1918Year

Fig. 3a. US coal mining fatalities 1909–1918. Source: US Mining Safety and HealthAdministration.

2 When dealing with occupational health and safety statistics, it is important tokeep in mind the possibility of under-reporting or biases in the data collection, whichmay affect the results and their interpretation. For example, if contractors areincreasingly relied upon, and their accident data are not recorded or not classifiedunder mining operations, as was the case in the Swedish mining industry in the 1990s(Blank et al., 1995), then official statistics may wrongly indicate a decline in accidentrate when reality is not so. In the US, MSHA collects OHS data for employees andcontractors, and these collective statistics are presented in this work.

J.H. Saleh, A.M. Cummings / Safety Science 49 (2011) 764–777 767

for example with the variability of the fatality rate during the1990s. This high variability is the result of major catastrophicevents or mining disasters, each of which claimed the lives ofa significantly large number of miners (see Fig. 5). For exam-ple, the highest peak in the fatality rate occurs in 1907 (tow-ering at 0.48%) is the ‘‘signature’’ of the worst mining disasterin the US, the Monongah, West Virginia disaster in which 362

miners lost their lives due to a methane and coal dust explo-sion (it is believed though that the actual death toll was inexcess of 5002 (Brigg, 1964).� Late 1940s – early 1970s: In this period, the fatality rate exhibits

some variability around an average of 0.16% but it shows no dis-tinctive upward or downward trend. The sharp peak in 1968 (at0.23%) is the result of the worst mining accident during this per-iod, namely the Farmington’s Consol 9 (West Virginia) minedisaster in which 78 miners were killed. Following the Consol9 disaster, Congress passed the Federal Coal Mine Health andSafety Act of 1969, a ‘‘comprehensive and more stringent thanany previous Federal legislation governing the mining indus-try.’’ This Coal Act of 1969, as it is known for short, requiredfor example four annual inspections of every underground coalmine, and it significantly increased federal enforcement powersin coal mines, including the ‘‘establishment of criminal penal-ties for knowing and willful violations of safety standards.’’(History of Mine Safety and Health Legislation, undated). Theeffects of this legislation were to be seen in the third period dis-cussed next.� Early 1970s – present: This period exhibits both a low fatality

rate around 0.03% and limited variability (compared with theprevious two periods). This period starts with a sharpdecrease in the fatality rate in the early 1970s. These observa-tions indicate that on the one hand effective intervention hasindeed paid off and compressed the fatality rate, and on theother hand, that major disasters with significantly large num-ber of fatalities – which translate into variability of the fatal-ity rate – have been if not eliminated at least kept at bayduring this recent period. The small peak in the fatality ratein the lower right corner of Fig. 4a occurred in 2006 as aresult of the Sago mine (West Virginia) disaster in which 12

Fig. 5. Sample of US coal mine disasters in the 20th century. Source: US NationalInstitute of Occupational Health and Safety.

Severity ofimpact

Time toimpactImmediate / short-term Long(er)-term

Fatality

Adverseeffects Example:

Hearing loss

Example:Pneumoconiosis

Example:Blunt/penetrating trauma

Example:Non-fatal injuries

Safety issues

Health issues

Fig. 6. Classification and examples of safety and health issues in the miningindustry.

3 Such as the Chenjiashan mine disaster, Shaanxi province, in which 166 minersperished (November 2004); the Sunjiawan mine disaster, Liaoning province, in which210 miners perished (February 2005); or the Dongfeng mine disaster, Heilongjiangprovince, in which 171 miners perished (November 2005) (BBC News, 2010).

4 Incidentally, 70% of the recorded occupations on the death certificates due topneumoconiosis listed ‘‘mining machining operator’’ (Work-Related Lung DiseaseSurveillance Report, 2007) This is a strong indication for what some research andprevention focus on to be effective in addressing some health problems in coalmining.

768 J.H. Saleh, A.M. Cummings / Safety Science 49 (2011) 764–777

miners were killed. For reference, over the last decade, theemployment in the US mining industry hovered around350,000 people.

Fig. 5 shows the deadliest coal mine disasters in the US in the20th century. The data is displayed by increasing number offatalities and is extensive starting from the No. 5 Centralia disas-ter in 1947 in which 111 miners were killed. The first threedisasters however are only a small sample of more recent miningdisasters, and many other accidents occurred that had between111 and 38 fatalities but are not shown in this chart. Inciden-tally, the Mining Program within the US National Institute ofOccupational Health and Safety defines a mine ‘‘disaster’’ as anevent that involves five or more fatalities.

An extensive list of coal mining disasters worldwide can befound in Hugenard et al. (1996).

Although beyond the scope of the present work, it is sobering toreflect, beyond the statistics displayed in Fig. 5, on the human trag-edies behind these numbers and the traumatic consequences andscars that these events must have left in many communities andregions throughout the country.

The causes of mining accidents include explosions (methane,coal dust, or other), fires, rock and roof falls, landslides, blackdampand toxic gases outbursts, and water inrush/sudden inundations

(see Appendix A for a brief discussion of such accidents). Themajority of the mining disasters shown in Fig. 5 were the resultof (methane + coal dust) explosions, as were most of recentlarge-scale mining disasters in China.3 Accidents in the miningindustry that result in a small number of fatalities typically includeelectrical equipment and machinery, powered haulage, and falls (or‘‘slip, trip, and fall’’).

3. Health and safety issues in the mining industry

It is common in the mining industry to separately identifyhealth issues and safety issues. This separate classification doesnot necessarily reflect mutually independent hazards, but it helpsrecognize a difference in the time scales of effect of the hazardsources. For example an explosion or a mine collapse will resultin immediate traumatic injuries or fatalities, whereas a prolongedexposure to coal or silica dust can result in debilitating and fatalconsequences for miners over the years in the form of lung dis-eases (e.g., black lung or Coal Workers Pneumoconiosis, CWP).Fig. 6 illustrates this safety versus health classification.

Although this work focuses solely on safety issues, health issuesare of major importance to the mining industry. The scale of thehealth problem is considerable and can be crudely conveyed bythe following two statistics. First, in the US for example, 10,406miners died as a result of pneumoconiosis alone between 1995and 2004 (The Work-Related Lung Disease Surveillance Report,2007). This is more than an order of magnitude the number ofUS mining fatalities due to accidents (safety issues).4 In addition,recent studies by NIOSH indicate that the prevalence of pneumoco-niosis is increasing, even among young miners. Second, the US fed-eral expenditure on the Black Lung Benefits Program, a programestablished as a result of the Black Lung Benefits Act ‘‘to provide formonthly payments to and medical treatment for coal miners totally

J.H. Saleh, A.M. Cummings / Safety Science 49 (2011) 764–777 769

disabled from pneumoconiosis (black lung disease)5’’, have reached$44.2 billion as of FY 2009 (Black lung charts, 2009).

These two statistics, the high casualty toll from health hazardsin coal mining and the significant costs of dealing with these issuesafter the fact, make a strong argument in favor of research intothese adverse health consequences of mining and their prevention.This observation is relevant for the mining industry worldwide,and it is particularly important for mining in developing countriesin the following manner:

� Mining accidents with high casualty tolls attract media atten-tion worldwide and may prompt political and legislative action– Chinese coal mines for example are notoriously dangerouswith official Chinese statistics showing a death toll in coalmines between 4746 and 6995 death per year6 (Jianjun, 2007).This bleak safety record has prompted a vigorous governmentresponse and got mining safety to be ‘‘recognized as a top priorityin China’s 11th Five Year Plan’’ (Strengthening coal mine safetystandards in China, 2007).� However, beyond the media attention-grabbing large-scale

accidents, health issues are the more prevalent but silent killersof miners, and as such, they should not be forgotten or disre-garded by decision-makers. If for example the rough order ofmagnitude relationship noted previously between fatalities inthe US coal mining resulting from safety issues and healthissues holds worldwide, then Chinese coal mines may be signif-icantly more dangerous than already acknowledged, and it ishoped that health issues in coal mines, not just safety issues,will also be recognized as a top priority by the governmentand regulatory agencies. To paraphrase a saying by Mark Twain,while thunder (safety) gets the attention, it is lightning (health)that does most of the (sinister) work.

4. Case study: the Jim Walter Resources (JWR) NO. 5 minedisaster

In this section, we analyze one recent mine disaster involvingmethane and coal dust explosions. Our purpose for this case studyis twofold: (1) to provide some specifics on mining accidents be-yond the statistical perspective presented in the previous section,and (2) to pave the way for the discussions that follow in the nextsections on safety levers and defense-in-depth applied to the min-ing industry.

Mine explosions, whether of methane or coal dust, are the mostcommon causes of high fatalities in mining accidents. Their re-peated occurrence, often in depressingly similar manner, both inthe US and abroad, are a clear indication of the failure of the min-ing industry and the regulatory system to heed the lessons of thepast and adopt a robust approach to eliminate these sinister acci-dents, or at least emaciate their deadly consequences. Explosionsare the loud unfinished legacy of mining accidents and their re-peated occurrence in the 21st century is inexcusable and shouldconstitute a strong call for action for all stakeholders involved inthis industry to settle this problem, once and for all.

Although the triggering mechanism or ignition source varies be-tween accidents, spontaneous combustion for example in the caseof the Moura mine disaster (Hopkins, 1999) or lightning in the caseof the Sago mine explosion (Gates et al., 2007a), the accident tra-jectories prior to the precipitating event, or ways in which minesprogress toward an increasingly hazardous state ripe for explosion,

5 Details about this Act can be found at the US Department of Labor, Office ofCompliance Assistance Policy website at http://www.dol.gov/compliance/laws/comp-blba.htm#factsheets (accessed 22.02.10).

6 With coal dust and methane gas explosions as the most frequent threat to thecollieries. Unofficial data puts the death toll around 20,000 per year (Jianjun, 2007).

are similar across many explosions, and as such they offers manyopportunities for learning how to block and terminate these pathsto disasters.

Different safety levers exist to control or influence an accidenttrajectory: technical levers, organizational/managerial levers, andregulatory levers. The mining disaster at the JWR No. 5 mine is apoignant story in which all the safety levers were pulled in thewrong direction, and a host of decisions made that precipitatedthe accident sequence and aggravated its consequences, as we dis-cuss next.

The JWR No. 5 mine is located in Tuscaloosa County, Alabama. Itis one of the deepest coal seams in the United States, and whenmined, it liberates high quantities of methane and as a result isconsidered ‘‘very gassy.’’ On September 23 2001, a roof fall oc-curred followed by a methane explosion, and 55 min later anothermore powerful methane and coal dust explosion occurred claimingthe lives of 13 miners (McKinney et al., 2002; Federal Mine Safetyand Health Review Commission, 2005; Jim Walter Resources #5Mine Disaster, 2010). A simplified sequence of events leading tothis disaster is shown in Fig. 7.

Initiating event: The initiating event of this disaster, the roof fall,gave repeated signs of its impending occurrence, but the serious-ness of the situation – its increasing hazardous potential – wasnot appreciated. Precursors or lead indicators of the roof fall in-cluded the following:

� The roof at the accident location had been deteriorating 2 daysbefore the disaster, and several miners heard at different occa-sions noises, popping sounds, and loud thumps ‘‘like pinsbreaking’’.� In addition to these acoustic signatures of a hazardous condi-

tion, water was seen dripping from the roof. Although at firstthe amount was considered normal, the dripping did not abatefor 2 days. Instead the dripping turned into pouring, a conditiondescribed in one accident report as ‘‘raining water’’ during theday of the disaster.� Furthermore, cracks were seen in the roof, and over the 2 days

prior to the fall, the cracks were noted to have increased in size.� One more indication that the ‘‘top was working’’ (roof move-

ment) was that a close-by cement brattice was ‘‘taking weight’’and cracking, and some ribs were sloughing and rolling, a con-dition that worsened roughly an hour prior to the roof fall.

First accident pathogen7 and flawed operational decision: Theselead indicators of the initiating event, the roof fall, were not isolatedevents but came in support of a known adverse roof condition, a geo-logical fault or ‘‘discontinuity’’ near the location of the accident.Unfortunately, instead of extra precaution in dealing with thisknown and deteriorating roof condition, a surprising operationaldecision was made, reflecting an improper safety culture at the mineand contributing to the development of the accident sequence: alarge battery (weighing 6 tons) and battery charger were broughtand placed under the frail roof.

On the afternoon of September 23, 2001, at 5:17 pm the roof felland damaged the battery. The resulting methane outburst from thefall, along with the general ‘‘gassiness’’ of the mine created anexplosive mixture in this particular section of the mine, an explo-sive mixture that was triggered at 5:20 pm by arcing from the bat-tery recently brought to that location (see Fig. 7).

Intermediate event and consequences: The first explosion thus re-sulted from a confluence of factors, the immediate ones being thefact that the mine was ‘‘very gassy’’, that the roof condition was

7 An accident pathogen can be thought of as an adverse pre-existing or latentcondition, which compounded with other factors, can precipitate an accident oraggravate its consequences.

Timelinemp51:6mp02:55:17pm

i itiignition source

ScoopBatteryBattery

damaged

VentilationRoof movement Roof fall First

explosion

Ventilationdamaged/airflow Methane

accumulationmovement explosion disrupted accumulation

MethaneMethaneliberation

Coal dust accumulation

Secondexplosionaccumulation explosion

ThirteenBlock lights

kept energized +Thirteenminers kill dkept energized + killed

ignition source

Mine notMine notevacuated

Fig. 7. Simplified accident trajectory/sequence of the JWR No. 5 mine disaster.

8 Federal code specifies the incombustible dust content should be at least 65% inthe intake air courses and at least 80% in the return air courses, in the absence ofmethane. The percentages are increased in the presence of methane.

770 J.H. Saleh, A.M. Cummings / Safety Science 49 (2011) 764–777

bad and deteriorating, and that an energized battery was broughtat this particular location. Four miners were injured by this firstexplosion, three survived the disaster, and one sustained seriousinjuries (he did manage to indicate that he could not move). Thefirst explosion damaged the mine’s ventilation system, a systemthat was already deficient as evidenced by the 92 violations of ven-tilation standards issued by the Mining Safety and Health Admin-istration during the 9 months prior to the disaster. With adisrupted airflow, the mine transitioned to a new hazardous stateof methane accumulation (see Fig. 7).

Second accident pathogen: The second accident pathogen in-volves coal dust. Some background information is in order. Com-bustible dust is an insidious hazard with catastrophic potentialacross a broad spectrum of industries. Industries at risk of dustfires and explosions include food production, metal processing,wood, chemical manufacturing, and mining. Dust hazards areprobably not well understood or their catastrophic potential notproperly appreciated by some industry professionals, as evidencedby the repeated dust explosions in the United States – for examplethe Chemical Safety Board identified 281 combustible dust firesand explosions in the US between 1980 and 2005 and describedthis pattern of accidents as a ‘‘significant industrial safety hazard’’(Combustible Dust, 2009). Consider for instance sugar dust. It maybe surprising to think of sugar as an explosive hazard, but on 7 Feb-ruary 2008, a sugar dust explosion occurred at the Imperial SugarRefinery near Savannah Georgia killing 14 workers, injuring 38others, and almost completely destroying the plant. Whether Alu-minum dust, saw dust, or coal dust for example, when confined inspace and dispersed in the air in high concentration levels (withinan explosive range or above a ‘‘Minimum Explosible Concentra-tion’’), they can become extremely potent accident pathogenswaiting for an ignition source to be unleashed. In addition, dustexplosions often occur in sequence, with a primary explosionunsettling dust accumulated in various places and dispersing itin the air, thus creating a new mixture and additional fuel load

for secondary explosions. This particular accident mechanism al-lows dust explosions to propagate significantly further from theinitial accident location, thus threatening a much larger area andmore people than those within the vicinity of the primary explo-sion (the primary and secondary dust explosions can occur almostsimultaneously or continuously).

Coal dust is a recognized explosive hazard in the mining indus-try. Explosions in coal mines involving coal dust are among themost violent and destructive type of accidents. The primary wayof neutralizing this hazard, in addition to cleaning up and avoidingaccumulation of coal dust in the mine and especially on electricequipment, is through rock dusting, that is the application of rockdust, a neutral dust to increase the amount of incombustible con-tent in overall mine dust.8 The US Mining Safety and Health Admin-istration (MSHA) notes the following on the effectiveness of rockdusting:

‘‘The law requires that all areas of a coal mine that can be safelytraveled must be kept adequately rock dusted to within 40 feetof all working faces. These are minimum requirements. Thechance of propagation and risk and widespread explosion disas-ters in coal mines can be nearly eliminated when rock dust isapplied liberally and maintained properly’’ (Rock Dusting,2010).

Going back to JWR disaster, rock dusting at the No. 5 mine wasinadequate, and the hazard of dust explosion was probably notwell appreciated at the mine, as evidenced by the 99 violationsof coal dust accumulation and inadequate rock dusting issued inthe 12-month prior to the accident (McKinney et al., 2002). In addi-

J.H. Saleh, A.M. Cummings / Safety Science 49 (2011) 764–777 771

tion, during the 3 weeks prior to the accident, MSHA cited the mineoperator 10 times for coal dust related violations, over an area cov-ering 22,000 feet in the mine.

Thus, the second accident pathogen at the JWR No. 5 mine con-sisted in the accumulation of coal dust and the longstanding inad-equacy of rock dusting at the mine. Coal dust became a major fuelsource for the second explosion, and both the severity and the ex-tent of propagation of the second explosion were the result of coaldust involvement.

Two fatal operational decisions: At this point in the accidence se-quence, the first explosion had occurred (5:20 pm), mine ventila-tion was damaged and airflow was disrupted, methane wasaccumulating – recall the mine was characterized as and knownto be ‘‘very gassy’’ – and coal dust was lurking over an extendedpart of the mine (see Fig. 7). Given these conditions, two fatal oper-ational decisions precipitated the accident and aggravated its con-sequences. First, the block lights in the section were not de-energized9; they in effect provided the ignition source for the secondexplosion. Second, the mine was not ordered to be evacuated. Themine turned into a ticking bomb after the first explosion, a hazardproperly recognized by some, and one person asked the control roomsupervisor if ‘‘all the miners were on their way out’’. However, in-stead of an immediate evacuation (immediately after 5:20 pm), min-ers remained underground and several were sent to the location ofthe first explosion. The decision not to order an immediate evacua-tion of the mine reflects poor training and deficient procedures fordealing with emergency situations. The accident report noted forexample that ‘‘all the miners were not participating in fire drillsevery 90 days’’ as required by law and that responsibilities for deal-ing with mine emergencies were not clearly delineated (McKinneyet al., 2002). In short, managerial and procedural deficiencies werepresent at the mine, and while they may have remained unobserv-able during normal operations, they surfaced at one crucial momentwhen the need for proper organizational decision-making was mostacute following the first explosion. It is worth pointing out thatwhile the second explosion may or may not have been prevented gi-ven the conditions at the mine, its consequences could have beensignificantly mitigated with proper training and procedures for orga-nizational response to emergency situations.

Final state and consequences: At 6:15 pm, 55 min after the firstexplosion, the ‘‘grace period’’ in this accident sequence duringwhich decisions could have been made to mitigate the conse-quences of the accident, came to an end: a second more violentexplosion involving methane and coal dust engulfed several partsof the mine and killed 13 miners.

The discussion in this section described the accident trajectoryor sequence of the JWR No. 5 mine disaster. Several concepts wereintroduced to help describe the phenomenology of accidents ingeneral and this accident in particular, such as initiating event, pre-cursor or lead indicator, and accident pathogen. One common themethroughout this discussion is that factors contributing to an acci-dent are not to be found only in the temporal vicinity of the mo-ment when an adverse event occurs, but they can extend muchfurther in the past. Factors that are controlled by human decisionsand that can influence safety (not necessarily in an immediate ordeterministic sense) are referred to as safety levers. These factorscan be of different nature (technical, managerial/organizational,and regulatory) and they may contribute to accident prevention(prevention of initiating event), accident containment (blockingan accident sequence at the intermediary events), or consequencemitigation (the accident would occur but its consequences areminimized). In the following section, we expand on these ideas

9 Despite at least one request to the control room supervisor to have the power inthe mine knocked off (Federal Mine Safety and Health Review Commission, 2005).

and introduce the general safety strategy of defense-in-depth.We then revisit JWR No. 5 mine disaster and examine the relevanceof defense-in-depth for this particular accident and more broadlyfor thinking about safety in the mining industry.

5. Defense-in-depth and safety levers

Defense-in-depth is a fundamental principle/strategy forachieving system safety. First conceptualized within the nuclearindustry, defense-in-depth is the basis for risk-informed decisionsby the US Nuclear Regulatory Commission (Sorensen et al., 1999),and is recognized under various names in other industries (e.g.,layers of protection in the chemical industry (Layers of ProtectionAnalysis, 2001; Kletz, 1999; Summers, 2003). Accidents typicallyresult from the absence or breach of defenses or violation of safetyconstraints (Leveson, 2004; Rasmussen, 1997; Svedung andRasmussen, 2002). Defense-in-depth embodies the idea of multi-ple lines of defense or safety barriers along accident scenarios,and it shuns the reliance of safety on a single element (hence the‘‘depth’’ qualifier).

Defense-in-depth, typically realized by successive and diversesafety barriers, technical, organizational, and procedural, is de-signed to: (1) prevent incidents or accident initiating events fromoccurring, (2) prevent these incidents or accidents initiators fromescalating should the first barriers fail, and (3) mitigate or containthe consequences of accidents should they occur (because of thebreach or absence of the previous ‘‘prevention’’ barriers) (Sorensenet al., 1999).

It is worth pointing out that an accident is defined by theDepartment of Energy (Implementation Guide for Use with DOEOrder 225.1A, 2010) as an ‘‘unwanted transfer [or release] of en-ergy that, due to the absence or failure of barriers and controls,produces injury to persons, damage to property, or reduction inprocess output.’’ This definition reflects the fundamental energymodel of accidents, and the safety strategy of defense-in-depth isintrinsically related to this ‘‘energy model’’ of accidents. In essence,defense-in-depth is meant to prevent, mitigate, or contain un-wanted releases of energy.

In mining as well as in other hazardous industries, varioussafety levers exist and can be acted upon to modify the exposureto the inherent risks involved in said industries, and promotesafety. Fig. 8 provides an illustrative representation of varioustypes of safety levers, along with examples of different stakehold-ers in the safety value chain.10 Details on these concepts can befound in Saleh et al. (submitted for publication).

The importance of the safety principle of defense-in-depth can-not be underestimated. How the safety levers are pulled and what‘‘defenses’’ have been put in place along potential accident trajec-tories – that is ways in which hazards transform into accidents –are essential contributions for the understanding of accidentcausation and the support of system safety.

For example, the regulatory lever, which historically has beenan effective safety lever in the US mining industry, as discussedin Section 2, can be pulled in a variety of ways, for instance:

� By mandating pertinent (and up-to-date) technical standardsand safety procedures, supported by proper research and epide-miological studies.� By providing the inspection apparatus of the regulatory agency

with the necessary resources – in terms of funding and skilledinspectors – to audit’s the industry’s compliance with the regu-

10 Instead of focusing on causes and contributing factors to accidents, the notion ofsafety value chain highlights the agency in contributing to accident prevention andsustainment of system safety, a more inclusive and irenic concept than the litigious‘‘contributors’’ to accident causation (Saleh et al., 2010).

Short-termTime to affectsystem safety

Medium-term Long-term

Regulatory

Organizational /Managerial

Operational /Maintenance

Technical /Design

Research

Education

Safety levers

Managers and company executives

Students

Researchers and academics

Engineers and system designers

Technicians, operators, workers

Insurers

Shareholders

Accident investigators, safety inspectors, and regulators

(penalties)

(incentives)

Economic

Fig. 8. Safety levers and stakeholders in the safety value chain.

772 J.H. Saleh, A.M. Cummings / Safety Science 49 (2011) 764–777

lation. In the case of the mining industry, the passage of safetystandards, for example with respect to mine ventilation, meth-ane concentration monitoring, rock dusting, and safety training,is an important first step in pulling the regulatory safety lever.However, the effectiveness of such action is largely contingenton the ability to inspect the implementations of these safetystandards in mines.11

� By supporting the enforcement capability of the regulatoryagency, with a proper legal framework, to enforce compliancewith the safety standards, deter or redress safety violations,and if need be, prosecute repeated safety violations.

These three types of actions on the regulatory safety lever,Mandate – Inspect – Enforce, can be complemented in a varietyof ways, by incentivizing compliance for example, or by assistingthe industry in building its skills and ability to comply with themandated safety standards. The regulatory safety lever canencompass a wide range of actions and predispositions: one theone hand, detection and deterrence through the ability toescalate to threats and legal action against criminal or recklessnon-compliant behavior; and on the other hand, incentives andassistance to comply with safety standards, especially for compa-nies that have the intent but not necessarily the ability and re-quired (organizational and technical) competence to comply(Ayers and Braithwaite, 1992).

It is useful to acknowledge, although beyond – or on the edge of– the scope of the present work, that safety regulations and theirenforcement, and more broadly the regulatory process, are signifi-

11 In other words, the mandate of proper safety standards is not sufficient in and ofitself; the effectiveness of pulling the regulatory safety level can be significantlyweakened by compromising the ability to inspect the industry’s compliance with saidstandards, or the inability/unwillingness to prosecute repeated safety violations.

cantly shaped, among other things, by the political context. Forexample in the US, Scholz and Wei (1986) found clear evidenceof differences in regulatory enforcement activities of the Occupa-tional Safety and Health Administration (OHSA) in response topolitical factors at both the Federal and state levels. One of thefindings of this study for example was that states with Democraticgovernors or legislatures tended to have more frequent workplacesafety violations, and larger penalties for these violations, thantheir Republican counterparts. This important study concludedthat regulatory bureaucracy, and more specifically its enforcementactivities, responds to political demands but does so in a complexway, by ‘‘integrating political demands at various levels [and by]adapting central policies to fit into varied and changing local con-ditions,’’ economic and other.

Kagan (2004) provides and excellent synthesis of ‘‘protectiveregulations’’ and the regulatory process. He notes that:

Partisan electoral politics has been shown to affect regulatory pol-icies and enforcement methods. As the cost imposed by the regula-tory state has grown, conservative political parties often promise toreduce the regulatory burdens on the business sector, while left-of-center parties typically promise to make regulation more stringentand effective.

He then proceeds to illustrate how partisan politics can affectthe regulatory safety lever shown in Fig. 8:

Once elected, political party leaders affect [regulatory] agencies’policies and enforcement methods in many ways – by appoint-ing [. . .] top agency officials; by expanding or contracting agencystaffing and resources through the budget process; by legislativeoversight hearings; and sometimes by telling regulatory officialshow they would like regulatory officials how they would likeregulatory issues of urgent political concerns to be handled.

J.H. Saleh, A.M. Cummings / Safety Science 49 (2011) 764–777 773

Other ways political factors can shape the regulatory process inthe US is through executive reviews and the issuance of Presiden-tial Executive Orders (EO).12 Kagan (2004) discusses the dilemmasof regulatory enforcement13 and the different styles of regulationsin the US and abroad (legal/adversarial process versus social/cooper-ative process). He indicates that effective regulators have at theirdisposal credible legal sanctions and the possibility to escalate upa ‘‘pyramid of sanctions’’ to meet an enterprise’s repeated non-cooperation and safety violations, and that socio-legal scholars tendto agree that the preferred regulatory style is flexible:

legalistic and punitive when needed, but accommodative and help-ful in others, depending on the reliability of the regulated enter-prise, and the seriousness of risks or harms created by particularviolations.

The purpose of this discussion is not prescriptive, but toacknowledge the existence of multiple safety levers, and that eachcan be pulled or relaxed (weakened) in a variety of ways.

Defense-in-depth, and the commitment to its implementation,forces the thinking about regulatory, design, and operationalchoices to address various hazards and potential accident scenar-ios. Traditional risk analysis, in its bare essence, addresses the fol-lowing questions (Apostolakis, 2004):

(1) What can go wrong?(2) How likely it is?(3) What are the consequences?

Defense-in-depth adds the most important complement tothese questions, namely

(1) What are you doing about it (‘‘it’’ being the answer to 1)? Orhow are you defending against it?

The answer to this question constitutes an explicit demonstra-tion of how various hazards and identified accident scenarios are,or ought to be, handled. In the next section, we examine how de-fense-in-depth can be relevant to the mining industry.

6. Defense-in-depth and the mining industry

Several hazards affect the mining industry and render it one ofthe most dangerous worldwide. These include explosions (meth-ane, coal dust, or other), fires, rock and roof falls, landslides, black-damp and toxic gases outbursts, and water inrush/suddeninundations. Example of some of mining accidents in which thesehazards turned into disasters are provided in Appendix A.

These hazards however can be prevented from escalating intoaccidents – or if they do escalate, their consequences can be con-tained or mitigated – with appropriate defenses. In other words,between ‘‘hazards’’ and ‘‘accidents’’, opportunities exist to preventthe transition of the former to the latter, and if this transition doesoccur, opportunities exist to prevent the transition of ‘‘accident’’ to‘‘disaster’’ (consequence mitigation). The opportunities to controlhazards and block accident trajectories can be captured by thesafety principle of defense-in-depth and its implementation.

12 See for example the very influential EO 12866 (issued 10/4/93), which mandatesthe use of cost-benefit analysis of regulatory alternatives before rules are promul-gated, and gives the Office of Information and Regulatory Affairs (OIRA) a powerfuloversight authority, frequently exercised (GAO, 2009), over all ‘‘significant regulatoryactions’’, and the subsequent controversial EO13422 (issued 11/23/07), revoked as of1/30/09 in EO 13497. The content and history of these Executive Orders is beyond thescope of this work, but it is enlightening for the interested reader to consult (see forexample CRS, 2007).

13 Described as an ‘‘iterative prisoner’s dilemma [. . .] meeting non-cooperation withpunishment, while meeting cooperation with forbearance.’’

In order to have an effective control of hazards and to establisha set of ‘‘defenses’’ for blocking accident trajectories, it is importantto understand first the ‘‘ingredients’’ that support the transition ofthe hazards into accidents, second the dynamic nature of this tran-sition or the speed of development of a hazard into an accident,and third the ‘‘signatures’’ that a situation is growing into anincreasingly hazardous state – what was referred to previously asthe precursors or lead indicators. Once this understanding is estab-lished for all identified hazards, technical defenses, organizationaland managerial defenses, and regulatory defenses can be put inplace in support of safety in the mining system.14

The role of the miner is central to this proposed defense-in-depth approach to mine safety. The previous paragraph notedthat for proper hazard control, it is essential to understand theingredients of hazard build-up and escalation, as well as the ‘‘sig-natures’’ of these hazardous states and transitions—the operationalrecognition and awareness that an accident sequence may beunfolding. What was not indicated previously is where or in whomthis understanding should reside; it is essential that this under-standing be shared by all miners, supervisors, and mine manage-ment (not just with safety inspectors for example or otherindividuals remotely connected to the mine). The reasons for thisstatement may be self-evident but they are worth making explicitherein. The miners are at the ‘‘sharp-end of safety’’ (Reason, 1997),and being the closest to the potential hazards, their role in defense-in-depth is essential and covers three broad types of contributions:

1. Miners are the principal agents in defense-in-depth. The sharedknowledge of the ingredients for hazard build-up and escalationinvites their participation in, or contribution towards, eliminat-ing these ingredients and the prevention of accident pathogenbuild-up. In addition, it is the miners’ active intervention insome cases that can help de-escalate an unfolding accidentsequence and bring a mine back from a hazardous state to nom-inal conditions, when possible.

2. Miners are also crucial ‘‘sensors’’ in defense-in-depth: manyhazardous conditions in the mines and ‘‘signatures’’ of anincreasingly dangerous state are best monitored and identifiedby the miners. In other words, miners can fulfill the essentialrole of a (distributed) monitoring network of local hazardousconditions within a mine. In short, they monitor for hazardousstates and provide the prerequisite information for the trigger-ing of active safety interventions in lines of defenses.

For these two roles to be properly fulfilled, mine managementhas to organize the necessary safety workshops for all miners toparticipate in, and during which the ingredients of various minehazards are discussed, the dynamics of hazards escalation are laidout, and the ‘‘signatures’’ of various hazardous states are identified.These dedicated safety workshops can be organized on a regularbasis to maintain an active awareness of mining hazards and atested competence in identifying and dealing with them. Theseworkshops can also help bring the collective wisdom (and experi-ence) of miners to bear on finer details of local conditions, andother hazardous issues that the workshop organizers/facilitatorsmay be unaware of or have overlooked. Finally, these workshopscan have a strong positive side effect, namely the signaling bymanagement the serious commitment of the company to safety(beyond the common lip service ‘‘safety first’’). Managementshould promote safety vigilance and help build and sustain safetycompetence in all employees.

14 The ‘‘mining system’’ includes the physical confines and characteristics of themine, the equipment in the mine, as well as the individuals, the organization, andprocesses that operate the mine.

774 J.H. Saleh, A.M. Cummings / Safety Science 49 (2011) 764–777

3. Finally, safety-competent miners fulfill a crucial role, which canbe termed decentralized decision-making in support of accidentmitigation or containment, a final line of defense, especiallyduring emergencies when centralized decision-making isabsent, unavailable, or flawed (as was the case in the No. 5 minecase study, and many other mine disasters). During nominaloperating conditions in the mine, a strong centralized planningand decision-making is needed for a number of reasons, includ-ing maintaining consistency in operational procedures andcoordination of various work plans, permit-to-work, and hand-overs between day and night shifts. However, in critical situa-tions, when communication with a centralized authority isnot available for example or when local conditions, unbeknownto a supervisor, require immediate action to avert disaster, min-ers can fulfill this role of ultimate line of defense by decidinglocally on the best safety course of action. For example, at theJWR No. 5 mine, had the miners received the proper safetytraining, they would have all concluded after the first explosionthat the mine ventilation may be disrupted, and in a gassy mine,the likelihood of methane build-up leading to a second explo-sion is significantly high. As a result, all the miners would havedecided that the best safety course of action is to evacuate themine, regardless of whether the supervisor is reachable or whathe orders. In extreme cases, this role of decentralized decision-making may justifiably lead to miners refusing to comply withorders that are clearly dangerous.

Consider for example methane explosions. Methane enters an‘‘explosive range’’ when its concentration in the mine atmospherereaches between 5% and 15% (Kissell, 2006). The first line of de-fense therefore against this hazard is proper mine ventilation, toprevent methane concentration from reaching this range (accidentprevention function of this first safety defense). Whether the mineis ‘‘very gassy’’ or not, it is essential to maintain situational aware-ness of this particular hazard and monitor if the mine is progress-ing towards an increasingly hazardous state of methaneconcentration, which would be reflected by the proximity of meth-ane concentration to the boundaries of the explosive range and therate at which it is approaching these boundaries. This monitoringactivity can trigger a second, this time a management or proce-dural line of defense, namely the evacuation of the mine whenmethane concentration level reaches an uncomfortably close levelto the explosive range (consequence mitigation function for thisline of defense). Another ingredient for methane explosions is thepresence of ignition sources, such as electrical shortages, damagedelectrical cords, overheated equipment, and smoking. A series ofdefenses can be put in place to eliminate or immediately neutralizeignition sources in a mine, for example the use of specialized no-spark electrical equipment (and the strict ban of smoking inmines).

Because of the criticality of proper ventilation in support ofmine safety, several lines of defenses can be placed to sustain thissafety barrier. Defenses in the form of management processes canbe developed to carefully develop ventilation plans and monitortheir implementation and performance on a regular basis. Addi-tional defenses in the form of organizational processes can beput in place to trigger effectives responses and corrective actionsshould mine ventilation become less than adequate. Regulationscan be developed and enforced to ensure that these ventilation-related defenses are in place. In short, several of the safety leversshown in Fig. 8 can be pulled in a coordinated manner – in the formof the establishment of lines of defenses – to eliminate accidentpathogens and block accident trajectories at different stages inthe hazard’s escalation.

The previous discussion was confined to methane explosion,but the general idea can be adapted to various mine hazards, some

of which were noted earlier in this section. For all mining hazards,multiple defenses can be put in place around hazards and their‘‘ingredients’’ to prevent their transition into accidents (e.g., froma gassy mine to a methane explosion) or to a ‘‘disaster’’. For exam-ple, going back to the JWR No. 5 mine disaster, we find that multi-ple defenses were seriously flawed or compromised, and thatseveral lines of defense along the accident trajectory (shown inFig. 7) could have prevented the initiating event from occurring,prevented the escalation of the accident sequence, and mitigatedthe consequences of the accident. All these defenses failed, theaccident unfolded, and 13 miners lost their lives.

� The first barriers to fail were literal defense lines in the form ofinadequate roof control and support.� The second flawed line of defense was the inadequate training

in understanding roof fall hazards, in dealing with this hazard,and interpreting its precursor signs. For example, proper train-ing and procedures could have been put in place for aggressiveresponse to deteriorating roof conditions, such as proper infor-mation sharing about the condition across the mine system(including management and mine engineer(s), as well as cor-doning the area and de-energizing the area-at-risk.

Proper training would have resulted in either the battery neverbeing brought to the area-at-risk (of roof fall) in the first place orthat it would have been covered or removed at the signs ofimpending roof fall (see discussion of lead indicators in Section 4).

Furthermore, several lines of defense failed and allowed a seri-ous accident pathogen, coal dust, to accumulate in the mine, inparticular the failure of procedures for and implementation of rockdusting. In addition, the fact that the block lights remained ener-gized after the first explosion and that the mine was not evacuatedreflect important deficiencies in management-driven safety de-fenses of proper training and supervision. Training for emergencysituations is or should be taken as a significantly important safetydefense.

Finally, the regulatory safety lever, which creates several linesof defense, failed to enforce the implementation of proper techni-cal safety barriers at the mine, as evidenced by the staggering 90+safety violations of ventilation standards, and over 90 violations ofcoal dust accumulation and inadequate rock dusting in the yearprior to the accident. In short, the regulatory safety defenses wereinefficient and failed to prompt management to take safety seri-ously and implement the required technical and procedural de-fenses in support of mine safety. Why this occurred and safetyinspections came to be considered as the ‘‘toothless tiger’’ (JimWalter Resources #5 Mine Disaster, 2010) is an important topicfor MSHA leadership and mine inspectors to analyze and reflectupon. The potential effects of these lines of defense are illustratedfiguratively in Fig. 9.

The process-centric relevance of defense-in-depth: Beyond theimportance of the specific implementations of the principle of de-fense-in-depth for ensuring mine safety, we believe/hypothesizethat this safety principle has several process-centric benefits. Theseinclude the following:

1. Defense-in-depth will make it easy to organize safety trainingsand get buy-in from miners and mine management for the var-ious safety defenses that should be implemented.

2. Safety workshops at mines will result in better informationsharing and retention about particular hazards, their potentialescalation, and the ways to defend against them, when theworkshops are organized around the principle of defense-in-depth (for each particular hazard) than when the workshopsconsists of unstructured and increasingly larger lists of ‘‘DOsand DON’Ts’’.

Timeline5:20pm5:17pm

i itiignition source

ScoopBatteryBattery

damaged

XXXRoof

movement Roof fall FirstexplosionXmovement explosion

MethaneMethaneliberation

Miners presencein area-at-risk Xin area-at-risk Injuries / fatalities

Fig. 9. Illustrative effects of lines of defenses on a subset of the accident trajectory at the JWR No. 5 mine.

J.H. Saleh, A.M. Cummings / Safety Science 49 (2011) 764–777 775

3. Defense-in-depth will support a better appreciation of accidentlead indicators by miners and mine management and the needto strengthen lines of defense and trigger effective hazard con-trol responses.

4. Defense-in-depth will support a system approach to miningsafety in which multiple stakeholders better understand theircontributions to accident prevention through their actions onvarious safety levers and lines of defenses; mine safety becomesa collective output of coordinated efforts on various safetydefenses.

MSHA, in collaboration with academia and select mining com-panies, should undertake a few pilot workshops at select minesto test these hypotheses and assess the appeal and usefulness (orlack thereof) of the establishment of defense-in-depth as the guid-ing safety principle for the mining industry.

7. Conclusion

In this work, we provided an overview of the broad and multi-faceted topic of safety in the mining industry. After reviewing somestatistics of mining accidents, we focused on one pervasive andmost deadly failure mode in mines, namely mine explosion. Weanalyzed one recent mine disaster in which various safety barriersfailed to prevent the accident initiating event from occurring, thensubsequent lines of defense failed to block this accident scenariofrom unfolding and to mitigate its consequences.

We then introduced the safety principle of defense-in-depthand examined how it can be relevant to and applicable in the min-ing industry in support of accident prevention and coordinating ac-tions on various safety levers to improve mining safety.

Several important topics for the mining industry were inten-tionally left outside the scope of the present work (primarily be-cause the length of the current article, and because a curttreatment would not do them justice). Some of these topics willbe addressed in future work, and they include (1) mining healthhazards – the present work focused solely on safety issues; (2)emergency response and post-accident analysis, information dis-semination, and recommendations; (3) continuous risk analysis

and identification of new hazards as conditions in the miningindustry change; and (4) safety culture in the mining industry.

Finally, we believe more interactions and partnerships betweenacademia, beyond the traditional mining engineering discipline,and the mining community (mining operators, researchers, and reg-ulators), would be particularly helpful in promoting safety innova-tions and advancing the safety agenda of the mining industry.

Appendix A. Brief discussion of select mining disasters

A.1. Sago mine disaster, United Sates

On the morning of January 2, 2006, an explosion occurred at theSago underground coal mine in Upshur County, West Virginia kill-ing 12 miners. The explosion originated in an abandoned section ofthe mine and blew out the seals, allowing the explosion to propa-gate into the working area of the mine. The accident report identi-fied the most likely ignition source of the explosion as a lightningstrike that traveled from the surface underground into the sealedarea of the mine where an explosive gas mixture had accumulated.One man died in the initial explosion due to blunt force trauma. Ofthe two crews underground, one managed to escape the mine, theother crew determined that they could not safely exit the mine andretreated. Although the second crew attempted to barricade them-selves into conserve oxygen and seal out carbon monoxide, theywere unable to make an airtight seal. All but one man died of car-bon monoxide poisoning before the rescue team was able to reachthem (Gates et al., 2007a).

A.2. Aberfan disaster, United Kingdom

A waste tip slide in Aberfan, South Wales occurred on Friday,October 21, 1966. The slide buried 20 houses, a farm, and a schoolkilling 144 people. The failure was determined to be the fault ofthe National Coal Board for improper construction of the tips. Thecoal tips were placed on top of existing natural springs that couldnot withstand the load of the waste. Several official letters had com-plained of the danger posed by the coal tips before the accident

776 J.H. Saleh, A.M. Cummings / Safety Science 49 (2011) 764–777

occurred but no steps were taken to prevent a slide (Johnes andMcLean, 2000).

A.3. Buffalo Creek disaster, United Sates

On February 26, 1972 a dam failure caused a coal waste slidethat killed 118 people in the Buffalo Creek Valley, West Virginia.The slide was the result of failure of a mine-waste impoundmentthat released 17.6 million cubic feet of water and sludge, alsobreaking two other impoundments. The failure was caused byincorrect construction that collapsed after several days of heavyrain (Kelley et al., 1973).

A.4. Chasnala mine disaster, India

The Chasnala Mine disaster is the deadliest coal mine accidentin Indian history. Three hundred and seventy-five workers werekilled when water breached a wall separating an abandoned minefrom the working areas of a close-by active mine. The abandonedmine had been flooded with water to prevent spontaneous com-bustion (Ramani, 1995). The water flooded the active mine work-ings and killed all the men in the mine.

A.5. Coalbrook North mine disaster, South Africa

The Coalbrook North Mine in South Africa collapsed on January21, 1960. All 435 workers underground at the time died. The disas-ter was a result of the collapse of several brick walls and a series ofrockfalls. In the weeks preceding the accident several indications ofoverstressed pillars were evident, including a strata collapse amonth before the disaster that injured one worker (Ramani,1995). The collapse also released large quantities of methane.The accident was blamed on negligence of the engineers and man-agers in charge of mine. (Martin and Maybee, 2000).

A.6. Sunshine mine disaster, United Sates

The Sunshine silver mine experienced a large mine fire on May2, 1972. Ninety-one men died of smoke inhalation and carbonmonoxide poisoning. The cause of the fire has not been conclu-sively determined, but it is known that previously applied polyure-thane foam used to seal the ventilation escalated the degree of thefire and released a large amount of toxic fumes. The polyurethanefoam was rated to be non-burning and self-extinguishing, but thiswas found to not be the case. An explosion broke through the bar-rier separating the flow intake and outtake at which point fansmeant to force air out of the mine instead started re-circulatingthe carbon monoxide and smoke back into the mine (Launhardt,2010; Mining Disasters, 1972).

A.7. Crandall Canyon disaster, United Sates

The Crandall Canyon Mine disaster occurred on August 6, 2007and was punctuated by a second fatal incident 10 days later. TheAugust 6 incident killed 6 miners after approximately an area ofhalf a mile inside the mine collapsed in from a catastrophic pillarfailure. The second accident on August 16 killed three men on amine rescue team when another rockfall occurred in the still unsta-ble mine. It was later determined that the design of the mine pil-lars was not sufficient to support the weight of the overburden(Gates et al., 2007b).

A.8. Farmington mine disaster, United Sates

In the early morning of November 20, 1968 an explosion at theConsol No. 9 Mine in Farmington, West Virginia killed 78 miners.

Thirteen miners were able to escape on their own power and a fur-ther eight were rescued. Over the next several days a series ofexplosions, fires, and collapses hampered recovery and investiga-tive efforts and eventually forced the closure of the mine. It wasknown that rock dust was prevalent in the mine and had beennoted in the 10 previous federal inspections [United States MineRescue Association]. The exact cause of the explosion could notbe determined. This disaster influenced the Federal Coal MineHealth and Safety Act of 1969 (Ramani, 1995; Farmington MineDisaster, 2010).

References

Apostolakis, G.E., 2004. How useful is quantitative risk analysis? Risk Analysis 24(3), 515–520.

Ayers, I., Braithwaite, J., 1992. Responsive Regulation: Transcending theDeregulation Debate. Oxford University Press, Oxford, UK.

BBC News, 2007a. ‘‘Dozens dead in Ukraine mine blast’’. November 18, 2007.<http://news.bbc.co.uk/2/hi/europe/7100456.stm> (accessed 08.02.10).

BBC News, 2007b. ‘‘Ukraine’s mine death toll rises’’. November 20, 2007. <http://news.bbc.co.uk/2/hi/europe/7103086.stm> (accessed 08.02.10).

BBC News, 2010. ‘‘Scores rescued from flooded Chinese mine.’’ April 5, 2010. http://news.bbc.co.uk/2/hi/asia-pacific/8603102.stm (accessed 08.02.10)

Black lung charts, 2009. Mine Safety and Health Administration, 2009. <http://www.msha.gov/S./BlackLung/2009Charts/BlackLungCharts2009.pdf> (accessed01.03.10).

Blank, V.L.G., Andersson, R., Linden, A., Nilsson, B.-C., 1995. Hidden accident ratesand patterns in the Swedish mining industry due to involvement of contractorworkers. Safety Science 21 (1), 23–35.

Brigg, E.F., 1964. Mine disaster. Science 146 (3640), 14.Combustible Dust, 2009. An Insidious Hazard. US Chemical Safety Board video.

<http://www.csb.gov/videoroom/detail.aspx?VID=30> (accessed 01.03.10).CRS, 2007. Congressional Research Service. Changes to the OMB regulatory review

process by Executive Order 13422. February 2007. Order Code RL33862.Farmington Mine Disaster, 2010. United States Mine Rescue Association Homepage.

<http://www.usmra.com/saxsewell/farmington.htm> (accessed 02.03.10).Federal Mine Safety and Health Review Commission, 2005. Civil Penalty Proceeding,

Secretary of Labor, Mine Safety and Health Administration vs. Jim WalterResources, Inc., November 1, 2005. Docket No. SE 2003-160; AC No. 01–01322–00004. Washington, DC.

GAO, 2009. United States Government Accountability Office. Federal rulemaking:improvement needed to monitoring and evaluation of rules development aswell as transparency of OMB regulatory reviews. GAO-09-205.

Gates, R.A., Phillips, R.L., Urosek, J.E., et al., 2007. Report of investigation: fatalunderground coal mine explosion, January 2, 2006. Sago Mine. Mine Safety andHealth Administration. <http://www.msha.gov/sagomine/sagomine.asp>(accessed 25.07.09).

Gates, R.A., Gauna, M., Morley, T.A., et al., 2007. Report of investigation: Coal BurstAccidents August 6 and 16, 2007. Crandall Canyon Mine. Mine Safety andHealth Administration. <http://www.msha.gov/Fatals/2007/CrandallCanyon/CrandallCanyonreport.asp> (accessed 25.07.09).

History of Mine Safety and Health Legislation, undated. Mine Safety and HealthAdministration. <http://www.msha.gov/MSHAINFO/MSHAINF2.HTM>(accessed 03.15.11).

Hopkins, A., 1999. Managing Major Hazards: The Lessons of the Moura MineDisaster. Allen & Unwin, Australia.

Hopkins, A., 2001. Was three mile island a ‘normal accident’? Journal ofContingencies and Crisis Management 9 (2), 65–72.

Hugenard, P. (Ed.), 1996. Catastrophes: De la Strategie D’intervention a la Prise enCharge Medicale. Elsevier, Paris.

Implementation Guide for Use with DOE Order 225.1A, Accident Investigations,2010. US Department of Energy. 1997, Washington, DC. <http://www.directives.doe.gov/directives/current-directives/225.1-EGuide-a-1/view>(accessed 15.02.10).

Jianjun, T., 2007. Coal mining safety: China’s achilles’ heel. China Security 3 (2), 36–53.

Jim Walter Resources #5 Mine Disaster, 2010. United Mine Workers of AmericaReport. <http://www.umwa.org/?q=content/jim-walters-resources-5-mine-disaster> (accessed 01.03.10).

Johnes, M., McLean, I., 2000. Aberfan Disaster. Nuffield College, University of Oxford,2000 (based on the book ‘‘Aberfan: Government -@@- Disasters’’ by the sameauthors and published by Welsh Academic Press, Cardiff). <http://www.nuffield.ox.ac.uk/politics/aberfan/home.htm> (accessed 26.02.10).

Kagan, R.A., 2004. Regulators and the regulatory processes. In: Sarat, Austin (Ed.),The Blackwell Companion to Law and Society. Malden, MA, USA, pp. 212–230.

Kelley, J.H., Kealy, D., Hylton Jr., C.D., Hallanan, E.V., Ashcroft, J., Murrin, J., et al.,1973. The Buffalo Creek Flood and Disaster: Official Report from the Governor’sAd Hoc Commission of Inquiry. West Virginia Division of Culture and History.<http://www.wvculture.org/history/disasters/buffcreekgovreport.html>(accessed 26.02.10).

Kissell, F.N., 2006. Handbook for Methane Control in Mining. National Institute forOccupational Safety and Health. Pittsburgh Research Laboratory, Pittsburg.

J.H. Saleh, A.M. Cummings / Safety Science 49 (2011) 764–777 777

Kletz, T.A., 1999. Hazop and Hazan: Identifying and Assessing Process IndustryHazards, fourth ed. Taylor & Francis, Philadelphia.

La Porte, T.R., 1996. High reliability organizations: unlikely, demanding and at risk.Journal of Contingencies and Crisis Management 4 (2), 60–71.

LaPorte, T.R., Consolini, P.M., 1991. Working in practice but not in theory:theoretical challenges of High-Reliability Organizations. Journal of PublicAdministration Research and Theory 1 (1), 19–48.

Launhardt, B., 2010. Sunshine Mine Fire: A View From The Inside. United StatesMine Rescue Association Homepage. <http://www.usmra.com/saxsewell/sunshine_view.htm> (accessed 02.03.10).

Layers of Protection Analysis, 2001. Simplified Process Risk Assessment. AmericanInstitute of Chemical Engineers (AIChE): Center for Chemical Process Safety,New York.

Leveson, N., 2004. A new accident model for engineering safer systems. SafetyScience 42 (4), 237–270.

Martin, C.D., Maybee, W.G., 2000. The strength of hard-rock pillars.International Journal of Rock Mechanics and Mining Sciences 37 (8),1239–1246.

McKinney, R., Crocco, W., Stricklin, K.G., Murray, K.A., Blankenship, S.T., Davidson,R.D., et al., 2002. Report of Investigation Fatal Underground Coal MineExplosions September 23, 2001, No. 5 Mine Jim Walter Resources, Inc. MineSafety and Health Administration. <http://www.msha.gov/fatals/2001/jwr5/ftl01c2032light.pdf> (accessed 01.03.10).

Mining Disasters – An Exhibition, 1972. Sunshine Mining Company Mining disaster.Mine Safety and Health Administration. <http://www.msha.gov/DISASTER/SUNSHINE/SS2.asp> (accessed 01.03.10).

National Research Council, 2007. Mining Safety and Health Research at NIOSH,2007. Reviews of Research Programs of the National Institute for OccupationalSafety and Health. The National Academies Press, Washington, DC.

Perrow, C., 1984. Normal Accidents: Living with High-Risk Technologies. PrincetonUniversity Press, New Jersey.

Ramani, R.V., 1995. Mining disasters caused and controlled by mankind: the case forcoal mining and other minerals Part 1: causes of mining disasters. NaturalResources Forum 19 (3), 233–242.

Rasmussen, J., 1997. Risk management in a dynamic society: a modelling problem.Safety Science 27 (2–3), 183–213.

Reason, J.T., 1997. Managing the Risks of Organizational Accidents. Ashgate,Aldershot, Hants, England; Brookfield, VT, USA.

Roberts, K.H., 1990a. Managing High-Reliability Organizations. CaliforniaManagement Review 32 (4), 101–113.

Roberts, K.H., 1990b. Some characteristics of one type of high reliabilityorganization. Organization Science 1 (2), 160–176.

Rock Dusting, 2010. Mine safety and health administration. <http://www.msha.gov/s&hinfo/rockdusting/rockdusting.asp> (accessed 01.03.10).

Saleh, J.H., Marais, K.B., Bakolas, E., Cowlagi, R.V., 2010. Highlights from theliterature on system safety and accident causation: review of major ideas,recent contributions, and challenges. Reliability Engineering and System Safety95 (11), 1105–1116.

Scholz, J.T., Wei, F.H., 1986. Regulatory enforcement in a federalist system.American Political Science Review 80 (4), 1249–1270.

Sorensen, J.N., Apostolakis, G.E., Kress, T.S., Powers, D.A., 1999. On the Role ofDefense in Depth in Risk-Informed Regulation. International Topical Meeting onProbabilistic Safety Assessment, Washington, DC, August 22–26, 1999.

Strengthening coal mine safety standards in China, 2007. United NationDevelopment Programme. <http://www.undp.org.cn/projects/53962.pdf>(accessed 10.03.10).

Summers, A.E., 2003. Introduction to layers of protection analysis. Journal ofHazardous Materials 104 (1–3), 163–168.

Svedung, I., Rasmussen, J., 2002. Graphic representation of accident scenarios:mapping system structure and the causation of accidents. Safety Science 40 (5),397–417.

The Work-Related Lung Disease Surveillance Report, 2007. National Institute forOccupational Safety and Health Publication No. 2008-143. <http://www.cdc.gov/niosh/docs/2008-143/default.html> (accessed 10.03.10).

Weick, K.E., Roberts, K.H., 1993. Collective mind in organizations – heedfulinterrelating on flight decks. Administrative Science Quarterly 38 (3), 357–381.

Weick, K.E., Sutcliffe, K.M., 2001. Managing the Unexpected: Assuring HighPerformance in An Age of Complexity. Jossey-Bass, San Francisco.