Human Performance Based

U N C L A S S I F I E D

U N C L A S S I F I E D

Operated by the Los Alamos National Security, LLC for the DOE/NNSA

Human Performance BasedHuman Performance Based

Accident InvestigationAccident Investigation

Roger Kruse

Todd ConklinESH&Q Integration Office

Operated by Los Alamos National Security LLC for DOE/NNSA

UNCLASSIFIED

Operated by Los Alamos National Security, LLC for NNSA 2

Why This Class, Now?

We are very efficient at conducting accident

investigations, but….

�Why do events continue to happen?

�Why are our responses so ineffective?

�Why don’t we seem to fix the right things?

UNCLASSIFIED


IAEA-TECHDOC-1329

Safety Culture in Nuclear Installations

RuleBased

Improvement Based

Goal Based

Organizational Maturity

People who

make mistakes

are blamed for

their failure to

comply with rules

Management’s

response to mistakes

is more controls,

procedures, and

training

Mistakes are

seen as process

variability with

emphasis is on

understanding

what happened,

rather than

finding someone

to blame

UNCLASSIFIED


Punishing versus Learning

Punishing

� Punishing is about keeping our beliefs in a system intact

� Punishing is about seeing the culprits as unique parts of the failure

� Punishing is about stifling the flow of safety-related information.

� Punishing is about not getting caught the next time.

� Punishing is about closure, about moving on from the terrible event.

Learning

� Learning is about changing our

belief systems

� Learning is about seeing the failure

as a part of the system.

� Learning is about increasing the

flow of safety-related information.

� Learning is about countermeasures

that remove error-producing

conditions so there will not be a next

time

� Learning is about continuity, the

event firmly integrated in what the

system knows about itself.

UNCLASSIFIED


The focus of this course is to …

� To understand human performance, do not limit yourself to the quest for causes

� An explanation of why people did what they did provides a much better understanding

� With understanding comes the ability to develop solutions that will improve operations

Understand the context and explain the event

UNCLASSIFIED


Credit where credit is due …

Most of the concepts and many of the examples in the course

come from books and publications by Sydney Dekker, Department of Aeronautical Engineering, Lund University, Sweden. His books include:

�The Field Guide to Human Error Investigations, 2002

�Ten Questions About Human Error, a New View of Human Factors and System Safety, 2005

�The Field Guide to Understanding Human Error, 2006

Additional concepts on performance variability, accident models, and procedures come from publications by Erik Hollnagel, University of Linköping, Sweden. His books

include:

�Barriers and Accident Prevention, 2004

UNCLASSIFIED


On 6/12/03, a Civil Air Patrol Cessna 182 based out of Los

Alamos and flown by a Los Alamos Squadron pilot, stalled and

crashed shortly after takeoff while towing a Schweizer 2-33 glider

at the CAP Glider Encampment in Hobbs, NM.

View from tow plane View from glider

UNCLASSIFIED


UNCLASSIFIED


The question is:

Was this a “big” accident or “little” accident?

UNCLASSIFIED


Sometimes you can walk away …..

When the plane crashed, it struck a hanger which absorbed much of the impact.

The pilot was able to climb out of the wreckage and was waiting beside the aircraft when help arrived.

The only injury was a deep cut on the back of his hand.

What were the odds of the aircraft striking the hanger?

UNCLASSIFIED


Simple event or Complex event?

A researcher returned to an HRL laboratory to find that a glass bottle containing 500 ml of a sodium hydroxide and

detergent solution had burst, scattering broken glass and

solution over the unoccupied lab.

The conclusion at the critique was that the student who

prepared the solution had mistakenly turned the heater knob instead of the stirrer knob on the magnetic stirrer hot

plate.

Let’s briefly scan the Event/Decision Chart used to

investigate and analyze the event

UNCLASSIFIED


UNCLASSIFIED


Consequence is not the whole story

� Sometimes complex accidents result in little or no

consequence

� Likewise, relatively simple accidents, can result in

a significant consequence

� All events should be investigated and the level of

effort should be determined “on-the-fly”

� The “causes” should reflect the substance of the

event, not the consequence

UNCLASSIFIED


Module One:

� Errors and Performance Variability

� Meaning Right While Doing the Wrong Things

� How We Look at Accidents

� Cause and Effect

� Barrier Analysis Perils and Pitfalls

� Event/Decision Charting

UNCLASSIFIED


The “Two Views” of Human Error

Rule Based

�Human error is the cause of 90% or more of the accidents

�The system in which people work is basically safe, the problem is the inherent unreliability of people

�Progress on safety is made by protecting the system from unreliable humans

�Protection is achieved through employee selection, procedures, training, discipline, and automation

Improvement Based

�Human error is a symptom of trouble deeper within the system

�Safety is not inherent in most systems, workers have to create safety by their actions

�Human error is connected to features of the tasks and operating environment

�Progress on safety comes from understanding and influencing these connections

UNCLASSIFIED


Origins of Human Error

10%

90%30%

70%

Human Error

Slip, trip or lapse

Equipment Failures

Human Errors

Traditional View: Operational Upsets

System Induced Error

UNCLASSIFIED


“Causes” based on LANL occurrence data

UNCLASSIFIED


IAEA-TECHDOC-1329


RuleBased

Improvement Based

Goal Based


Communications

between

departments and

functions is poor

Management

encourages

interdepartmental and

inter-functional

communication

Collaboration

between

departments and

functions is good

UNCLASSIFIED


What does “human error” really mean?

“Human Error” is used in the following ways:

� Cause (focus on action as the cause of the outcome)“The oil spill was caused by human error”

� Action (focus is on the action)“He forgot to check the water level”

� Consequence (focus is on the outcome)“He made the error of putting salt in the coffee”

Think of human error as a deviation from

expected performance, which includes both

unintended and intended actions

�

UNCLASSIFIED


Performance Modes

Knowledge-Based

Patterns

Rule BasedIf - Then

Skill-BasedAuto

High

Low

Att

enti

on (

to t

ask

)

Inattention

Misinterpretation

Inaccurate

Mental Picture

Familiarity (w/ task)Low High

UNCLASSIFIED


Unintentional Human Errors (and Violations)

Gray

Area

UNCLASSIFIED


When is an error an error?

From a practical standpoint:

� Errors are not known until after the fact:

• When the deviation from intent or adverse consequence

is noticed, and

• the action was judged to be wrong

� This notice of deviation or consequence could be almost immediate by the worker or it could be delayed

� In hindsight, errors seem obvious and compelling, but from the view of the people at the time, they were just

doing their job

UNCLASSIFIED


When is an “error” not really an error?

An intended action can be judged an error (performance deviation) because of an unintended outcome

Here are two common sources:

�Organization influenced

Actions taken by conscientious workers to meet organizational goals (meeting demands and stretching resources)

�Knowledge influenced

Actions taken by knowledgeable workers with intent to produce a better outcome

When successful, the actions are condoned and rewarded

When they are unsuccessful or outcome is bad, the actions

are quickly judged as violations

UNCLASSIFIED


Unintentional Errors and Intended Variations

UNCLASSIFIED


More sources of performance variations:

� Inherent variability – individual psychological & physiological differences

� Ingenuity and creativity - adaptability in overcoming constraints and under specification

� Socially induced performance variability - meeting co-worker expectations, informal work standards

� Experience variability – past experience drives future actions

UNCLASSIFIED


People optimize their performanceEfficiency Thoroughness Trade Off (ETTO) Principle

Efficient Thorough

Time Required

Time Available

UNCLASSIFIED


Let’s talk about performance variation?

Sense Act

Think

Goals,

knowledge,

understanding,

focus, etc.

???

UNCLASSIFIED


Looks OK to me

Not really important

No time (or resources) to do it now

If I do it this way, I can save time/money

Boss says it must be ready in time

I know a better way to do it

We must get this done

UNCLASSIFIED


Performance variability

Sense

Goals,

knowledge,

understanding,

focus, etc.

Act

???

UNCLASSIFIED


IAEA-TECHDOC-1329


RuleBased

Improvement Based

Goal Based


People are

rewarded for

obedience and

results

People are rewarded

for exceeding goals

People are

rewarded for

improving

processes

UNCLASSIFIED


The facts of life (or work)

The Belief(work-as-imagined)

� Systems are well designed and well maintained

� Procedures are complete and correct

� Designers can foresee and anticipate every situation

� People behave as they are expected to - as they are

taught

The Reality(work-as-done)

� People learn to overcome design

flaws and functional glitches

� People interpret and apply

procedures to match conditions

� People can detect and correct when

things go wrong

� People adapt their performance to

meet demands

UNCLASSIFIED


A quick example

A questionnaire study of 286 aircraft maintenance engineers found that 34% did not follow the official

procedure for a task they just completed. Of these:

�45% said there was an easier way

�43% said there was a quicker way

UNCLASSIFIED


Success lies with the worker …

� Procedures are resources for action (among other resources)

� Applying procedures successfully is a substantive, skillful cognitive activity

� Safety often comes from people being skillful at judging when and how procedures apply

UNCLASSIFIED


HPI Anatomy of an Event

Event

Error

Precursors

Vision, Beliefs, &

Values

Latent

Organizational

Weaknesses

Mission

Goals

Policies

Processes

Programs

FlawedDefenses

Initiating

Action

Vision,

Beliefs, &Values

EventEvent

Error

Precursors

Error

Precursors

Vision, Beliefs, &

Values

Latent

Organizational

Weaknesses

Mission

Goals

Policies

Processes

Programs

Latent

Organizational

Weaknesses

Mission

Goals

Policies

Processes

Programs

Mission

Goals

Policies

Processes

Programs

FlawedDefensesFlawedDefenses

Initiating

Action

Initiating

Action

Vision,

Beliefs, &Values

UNCLASSIFIED


Accidents as unexpected combinations of

normal variability

Time

UNCLASSIFIED


Simple, linear cause – effect model

� Accidents are the (natural) culmination of a series of events or circumstances, which occur in a specific and

recognizable order.

� Caused by unsafe acts or conditions

� Prevented by finding and eliminating possible causes

UNCLASSIFIED


Complex, linear cause – effect model

� Accidents result from a combination of active failures (unsafe acts) and latent conditions (hazards)

� Caused by degradation of components (organizational,

human, technical)

� Prevented by strengthening barriers and defenses

UNCLASSIFIED


Non-linear accident model

� Accidents (and success) emerge from the normal variations in performance

� Caused by unexpected combinations of “normal” actions

rather than action failures.

� Solution is to understand the nature of variability (why,

when, how) and how to limit it when it can be dangerous

Functional Resonance

Accident Model (FRAM)

- Erik Hollnagel

UNCLASSIFIED


Module Two:







UNCLASSIFIED


In theory, investigations intend to…

� Determine how the underlying factors that combined to result in the accident

� Find the latent conditions and organizational weaknesses that led to the human errors

� Address the conditions that create error likely situations

� Understand and explain rather than judge and blame

UNCLASSIFIED


In practice, investigations almost always:

� Focus on bad decisions, inaccurate assessments, and deviation from written guidance

� Seek evidence of erratic, wrong, or inappropriate behavior

� Conclude how workers failed to adhere to procedures

� Conclude how supervision/management failed to

prevent the accident

� Pass judgment and assign blame

Name → Shame → Blame → Train (or retrain)

UNCLASSIFIED


In practice, causes are often expressed as

� Worker did not follow (or violated) the procedure

� Inadequate details in the procedures

� Inattention or complacency by the involved worker

� Inadequate training or retraining

� Inadequate supervision that allowed the error to

occur

� Lack of management attention and oversight

UNCLASSIFIED


In practice, corrective actions include

� Disciplinary action, real or perceived, for the

involved worker/supervision

� Retraining of the involved workers

� Additional training for all workers

� Changes in the procedure or more procedures

� Increase in supervisory/management oversight

It’s all about the apples!

UNCLASSIFIED


The Bad Apple Theory

� Our processes would be fine, were it not for the

erratic behavior of some unreliable people (bad

apples)

� Safety will be achieved when the bad apples are

either fixed or eliminated

AKA: “cowboys and buttheads”

UNCLASSIFIED


Discussion:

� Although we believe strongly that we have competent and motivated workers, why do we revert so quickly to

a conclusion of “bad apples” when there is an accident

or security event

UNCLASSIFIED


Why accident investigations regress into the

bad apple theory …

� Straightforward, simple to understand, and simple to complete

� Difficult to not be judgmental about seemingly bad performance

� Emotionally satisfying to punish the guilty

� The hindsight bias confuses our reality with the one

that surrounded the workers

� Political resistance for probing into sources of failure

UNCLASSIFIED


Module Three:







UNCLASSIFIED


Three contexts in which we look at accidents:

1. Proximal

2. Retrospective

3. Counterfactual

UNCLASSIFIED


Proximal

� We tend to focus on those people who were closest to producing or potentially avoiding the accident

� Rather than recognize weakness in the system, the tendency is to see a localized problem where the people

have acted in an “irrational” manner

� We tend to ignore the organizational influences on

behavior that result from a multitude of conflicting constraints and pressures (be thorough, but also efficient)

UNCLASSIFIED


Retrospective

� Investigations aim to explain an event in the past, but are conducted in the present

� As an investigator, you will probably know more about

the event than the people involved

Because you assessing people’s decisions and actions with hindsight, based on what you know now, you cannot be

truly objective about their performance

UNCLASSIFIED


Hindsight causes us to oversimplify

� We underestimate the uncertainty people felt and do not understand how unlikely the outcome would have

seemed

� We see the sequence of events as a linear progression

to the outcome and do not appreciate the multiple

pathways that surrounded the people

The next slide is simply amazing

UNCLASSIFIED


Solve the maze, then raise your handThe quickest way to solve the maze is to

start from the FINISH and work

backwards

UNCLASSIFIED


How the people involved saw it before the accident

How the investigator sees it after the accident

??

?

UNCLASSIFIED


“They should have ....”

� A counterfactual (counter the facts) is a statement of what people should have done instead of what they did

do . Examples include:

• “they could have …”

• “they did not …”

• “they failed to …”

• “if only they had …”

� With the benefit of hindsight, you can easily see what people could have done to prevent the event

� But, it is a reality that didn’t happen and doesn’t help

you to understand what did happen

UNCLASSIFIED


Counterfactuals are the most prevalent

feature of most accident investigations

Excerpts from past investigations

�Personnel did not follow formal procedures.

�Management did not effectively respond to precursor events.

�Management did not eliminate or remove the hazard.

�Management did not adequately respond to feedback.

UNCLASSIFIED


We are not alone, a recent example from the

National Transportation Safety Board

On August 27, 2006, Comair flight 5191, crashed during takeoff from Blue Grass Airport, Lexington, Kentucky.

The flight crew was instructed to take off from runway 22, but instead lined up the airplane on runway 26 and began

the takeoff roll. The airplane ran off the end of the short

runway and impacted the airport perimeter fence, trees, and terrain.

The captain, flight attendant, and 47 passengers were

killed.

UNCLASSIFIED


The NTSB Board determined the probable

cause(s) of this accident as follows:

� The flight crew’s failure to use available cues and aids to identify the airplane's location on the airport surface

during taxi,

� The flight crew’s failure to cross-check and verify that

the airplane was on the correct runway before takeoff,

and

� The FAA’s failure to require that all runway crossings be authorized only by specific air traffic control

clearances.

UNCLASSIFIED


Why counterfactuals happen …

� When faced with failure (accident), your first reflex is to seek other failures• Where did people go wrong?

• What did they miss?

� Because we are working backwards with the benefit of

a known outcome, we can easily see how they could

have avoided the accident

The trouble is, this is not how the involved people experienced the accident, and does not explain how

failure succeeded

UNCLASSIFIED


Developing counterfactuals from the “facts”

� Counterfactuals are most often a theory (i.e. opinion) formed by the investigator

� Information from and about the event is then used selectively to support these opinions

� The facts are taken out of context by:

• Micro-matching – comparing behavior with what you

know now to be true and finding a mismatch

• Cherry-Picking – selected bits of data that “prove” a

condition identified only in hindsight

UNCLASSIFIED


Micro-matching procedures

� In hindsight, discrepancies between procedures and practice are easily “unearthed”

But, discrepancies between procedure and practice are common and are not especially unique to the accident

circumstances

The result is “worker did not follow procedures” as a cause

� Investigations invest considerable effort in “organizational archeology” to reconstruct the

regulatory and procedural framework in which the

operation took place

UNCLASSIFIED


An HPI approach …

� Although we like to appear “knowledgeable”,

interview the workers before reviewing the

documents

� This will help you to understand the context in

which they experienced the event

� Let the worker explain what happened in his

own words

UNCLASSIFIED


Counterfactuals by micro-matching other

standards

� Like procedures, other “standards of good practice” can be found that seem applicable to the situation

� Then failure to apply the good practice is cited

“At least one of the machinists moved the boring bar away from the glovebox gloves prior to donning the cotton gloves. This “Good Practice” was not included as a step in the work instruction nor was it communicated to all personnel.”

� The problem is they are usually only relevant with

knowledge of the outcome (hindsight)

UNCLASSIFIED


Micro-matching other “critical” info

� With hindsight comes knowledge of “critical facts” that revealed the true nature of the situation

� The people are then faulted for missing or not acting on the information

“.. managers listened to worker feedback, but did not respond. The concern over the difficulty in donning and using the cotton gloves was accepted as a reasonable inconvenience.”

“… the direct cause of the injury was the difficulty of donning cotton gloves over glovebox gloves.”

But knowledge of what was critical is only obvious in hindsight

UNCLASSIFIED


Cherry-picking

� Information can be taken out of context by grouping and labelingfragments that, in hindsight, appear to represent a common condition

� Often the investigator notes a particular “fact”, develops a theory (opinion), and searches for other evidence to support the theory

The team leader was located at another site

The team leader only visited the workers site about once a month

� The fragments of information are used to construct a story that “explains” the cause of the accident

Infrequent management presence led to an inconsistent implementation of safe

work practices, methods, and behaviors.

UNCLASSIFIED


All is not lost, counterfactuals can be useful

� As we try to understand why workers did what they did, a counterfactual can help to provide insight

� The counterfactual seems obvious to us in hindsight, but that was not the case for the involved workers

� If we can understand why it was not noticed, why it was not considered important, or why another action (or no

action) was seen as a better way to proceed, then we can begin to understand why they did what they did

UNCLASSIFIED


Module Four:







UNCLASSIFIED


Why do we want to find “the cause”?

1. Not knowing what caused the accident is really scary

2. DOE (real or perceived) requires it

3. People may simply seek retribution, punishment, or justice

4. People want to start investing in countermeasures to prevent the accident from recurring

5. People want to know how to adjust their behavior to

avoid the same kind of trouble

UNCLASSIFIED


Like the maze, we search for causes looking

backwards

� We oversimplify the search for causality

� What was uncertain working forward, becomes clear

working backwards

� We work backwards with effects preceded by actions,

which is opposite of how the people experienced it (actions followed by effects)

� We look for cause - effect relationships and those preceding actions become the causes

UNCLASSIFIED


So, what is a “cause”?

For our purposes, it is why the accident happened

and is expressed in the context of cause and effect.

UNCLASSIFIED


Cause and Effect

� Cause is inferred from observation, but is not something that can be observed directly

� Normally, we repeatedly observe action A followed by event B and conclude that B was the effect of A

Cause A Effect B

Observable ObservableNot Observable

(concluded)

Source: Hollnagel, Erik (2004) Barriers and Accident Prevention

UNCLASSIFIED


Cause and Effect

� But investigations involve the notion of backward causality, i.e., reasoning from effect to cause

� We observe event B, assume that is was the effect of something and then try to find out which action A was

the cause of it

Cause? Effect B

Observable Observable

Not Observable

(constructed)


UNCLASSIFIED


The problem of backward causation is

aggravated by some common mistakes

� There is a human tendency to draw conclusions that are not logically valid

� We tend to use educated guesses, intuitive judgment, or “common sense” rather than rules of logic

� The use of event timelines creates sequential relationships that seem to infer a causal relationships

� Because lots of actions are taking place, there is usually one action before the effect that seems to be a

plausible cause

UNCLASSIFIED


Requirements for a cause – effect relationship

1. The cause must precede the effect (in time)

2. The cause and effect must be contiguous (close) in

time and space

3. The cause and effect must have a necessary and

constant connection between them, such that the same cause always has the same effect

UNCLASSIFIED


For example …

The first cause of this event was a lack of direct supervision of the worker which resulted in a worker being able to

perform work in a manner that was unsafe

Is there a cause – effect relationship?

☺ The lack of direct supervision preceded the accident

� The lack of supervision had existed for years

� Lack of direct supervision does not always cause

work to be performed in an unsafe manner

Is inadequate policing the cause of DUI accidents?

UNCLASSIFIED


� Definitions are hard to come by, but here is one that lays the groundwork:

“The identification, after the fact, of a limited set of aspects of the situation that are seen as necessary and

sufficient conditions for the observed effects to have occurred. The cause, in other words, is constructed

rather than found”.- Hollnagel, Erik (2004) Barriers and Accident Prevention

So once again, what is a “cause”?

UNCLASSIFIED


Bottom Line: Don’t Overreach

� A true, repeatable cause and effect relationship is almost impossible to find

� Instead, try to explain how the accident happened while providing the context for the worker actions

� Although the causal relationships are weak and we can usually identify many factors that “contributed” to the event

� Because it is really our opinion, we need to provide enough information that others can draw the same conclusion

Understand and Explain

UNCLASSIFIED


WYLFIWYF*

� The cause you find usually depends on:

• where you look,

• what you look for,

• who you talk to,

• what you have seen before, and likely,

• who you work for

� It often says more about the investigator than the

accident!

* What You Look For Is What You Find

UNCLASSIFIED


Two official investigations of the same airline

crash

� One conducted by American Airlines, whose aircraft crashed in the mountains near Cali, Colombia

� The other by the Colombian civil aviation authority, who employed the air traffic controllers

On December 20, 1995, AA Flight 965 (AA965), a Boeing 757, on a

regularly scheduled passenger flight from Miami to Cali, Colombia

operating under instrument flight rules (IFR), crashed into mountainous

terrain during a descent from cruise altitude. Of the 163 on board, only four

passengers survived.

UNCLASSIFIED


Causes from different investigations

According to Authority

� Air Traffic Controller did not play a

role

� Pilots inadequate use of flightdeck

automation

� Loss of pilot’s situation awareness

regarding terrain and navigation aids

� Failure to revert to basic navigation

when automation created confusion

and increased workload

� Pilots efforts to hasten arrival to

avoid delays

According to Airline

� Controller’s clearances were not in

accordance with standards

� Inadequate language skills and

inattention by the Controller

� Inadequate automation database

supplied to computers

� Lack of radar coverage over area

� Workload increase because of

Controller’s sudden instruction to

use novel arrival route and different

runway

UNCLASSIFIED


Categories of cause over time

Equipment &

Technology


UNCLASSIFIED


Module Five:







UNCLASSIFIED


Why barriers?

Re + Md Re + Md →→ ØØEEreducing errors AND managing

defenses lead to zero events

UNCLASSIFIED


Types of Barriers

Current Categories

� Physical

� Administrative

Better Categories

� Physical

� Functional

� Symbolic

� Incorporeal

UNCLASSIFIED


Physical – physically prevents an action from

being carried out or an event from happening

� Containing or protecting - walls, fences,

railings, containers, tanks

� Restraining or preventing movement - safety

belts, harnesses, cages

� Separating or protecting – Crumple zones,

scrubbers, filters

UNCLASSIFIED


Functional – impedes actions through the use

of pre-conditions

� Prevent movement/action (hard) – locks,

interlocks, equipment alignment

� Prevent movement/action (soft) – passwords,

entry codes, palm readers

� Impede actions – delays, distance (too far for

single person to reach)

� Dissipate energy/extinguish – air bags,

sprinklers

UNCLASSIFIED


Symbolic – requires an act of interpretation in

order to achieve their purpose

� Countering/preventing actions – demarcations,

signs, labels, warnings

� Regulating actions – instructions, procedures,

dialogues (pre-job brief)

� System status indications – signals, warnings,

alarms

� Permission/authorization – permits, work

orders

UNCLASSIFIED


Incorporeal – requires interpretation of

knowledge in order to achieve their purpose

� Process – rules, restrictions, guidelines, laws

� Comply/conform – self-restraint, ethical norms,

morals, social or group pressure

UNCLASSIFIED


Evaluation of barrier system quality

� Effectiveness – how well it meets its intended

purpose

� Availability – assurance the barrier will function

when needed

� Evaluation – how easy to determine whether

barrier will work as intended

� Interpretation – extent to which the barrier

depends on interpretation by humans to

achieve its purpose

UNCLASSIFIED


Evaluation of barrier system characteristics

Physical Functional Symbolic Incorporeal

Effective High High Medium Low

Availability High Low - High High Uncertain

Evaluation Easy Moderate Difficult Difficult

Interpretation None Low High High

UNCLASSIFIED


OK, what’s the point?

� Barrier analysis is one of the cornerstones of accident investigation

� But we treat every type of barrier as if they were “physical” and expected to always work

� The result is many findings involving procedures, rules, training, supervision, oversight, etc. that failed

� The reality is they were often not very effective in the first place

Be careful not to overreach

UNCLASSIFIED


Module Six:







UNCLASSIFIED


Sydney Dekker’s five steps for reconstructing

human error contributions to accidents

1. Lay out the sequence of events and decisions in a rough timeline

2. Divide the sequence into episodes, if necessary

3. Find out how the world looked or changed during each

episode

4. Identify workers’ goals, constraints, focus of attention

and knowledge at the time, (i.e., the CONTEXT)

5. Summarize in an explanation, what the workers did

and why they did it

UNCLASSIFIED


Event/Decision Charting

� This is a variation of the traditional Events and Causal Factors (EC&F) Charting that we developed to

incorporate human performance

UNCLASSIFIED


Sequence of events

� The sequence of events forms the starting point for reconstructing the accident

� The events include observations, actions, and changes in the process or system.

� The decisions (before an action) will start to establish the mindset of the worker

� The goal is to set the framework for how the workers perception unfolded in parallel with the situation

evolving around them

UNCLASSIFIED


Sequence of Events and Decisions

Add EVENTS and ACTIONSThen add in the DECISIONS, before the actions

UNCLASSIFIED


Divide the sequence into episodes, if necessary

� Accidents can evolve over a period of time and

the goal is to identify how perceptions and

mindset change over time

� Episodes can change when there are:

• Shifts in behavior

• Changes in the process

• Actions to influence the process

UNCLASSIFIED


Divide into EPISODES, if necessary

UNCLASSIFIED


How the world looked or changed

� This step is about reconstructing the event as it

unfolded around the worker:

• find out what their process was doing

• what information was available

� Reconstruct how the process was changing and

how information about the changes were presented

to the workers

UNCLASSIFIED


Add in the available INFORMATION

UNCLASSIFIED


Workers’ goals, knowledge, and focus

� People have goals. Completion of the task is obvious, but there are other, often conflicting, goals present• Economic considerations, such as safety versus schedule

• Subtle coercions (what boss wants, not what s/he says)

• Response to previous situations (successes OR failures)

� People have knowledge, but the application of knowledge is

not straight forward• Was it accurate, complete and available

� Goals & knowledge together determine their focus• Workers cannot know and see everything all the time

• What people are trying to accomplish and what they know drives where they direct their attention

• Re-constructing their focus of attention will help you to understand the gap between available information and what they saw or used

UNCLASSIFIED


Add in the Workers’ GOALS & KNOWLEDGE

UNCLASSIFIED


Explanation

Provide an explanation of what the workers did and whythey did it

�What was happening with the process

�What the workers were trying to accomplish and why

�What they knew at the time

�Where their attention was focused and why

�Why what they did made sense to them at the time

UNCLASSIFIED


“They should have known this was the wrong lift”

Accident - At the end of the day, workers used the wrong conveyor lift (wrong size for door) to unload the last truck,

resulting in minor damage to the truck.

Old View Cause:

Workers knew that it was the wrong conveyor lift, but chose to use it anyway

Old View Fixes:

Disciplinary action, training & procedure change

UNCLASSIFIED


Workers use large conveyor instead of small

conveyor to unload front compartment of truck,

causing damage

UNCLASSIFIED


Q: Why did they use the large conveyor instead of the

small one?

A: The small one was in the remote storage area and

they didn’t want to take the time to get it

UNCLASSIFIED


Q: Why was the small conveyor in the storage area?A: They moved it there before the truck arrived

UNCLASSIFIED


Q: Why did they move it to storage?A: They didn’t think they would need it

UNCLASSIFIED


Q: Why didn’t they think they would need it?A: They had been told the front compartment was

empty

UNCLASSIFIED


Q: But, why did they move it before the truck

arrived?

A: They get to go home when the last truck is

unloaded and wanted to be ready to leave ASAP

UNCLASSIFIED


Finally, when they found out there was cargo in the front,

they thought they could use the large conveyor safely

UNCLASSIFIED


Explanation based on understanding:

� The end of workday was based on the last truck instead of a specific time. The workers went home as

soon as it was unloaded.

� Knowing it was the last truck and having been told there was no cargo in the front, the workers started

putting away non-essential equipment.

� Believing the smaller conveyor was not needed, the

workers returned it to the remote storage

� When the last truck arrived, there was cargo in the

front compartment

� Not wanting to take the time to retrieve the small conveyor, they used the larger conveyor that was still

available, believing it would be safe

UNCLASSIFIED


Look at the incentive structure

� If you say they can go home after the last truck,

expect them to start packing everything but the

bare essentials away before the last truck

arrives

� When confronted with a surprise (unanticipated

load), also expect them to improvise with the

tools at hand

Possible solutions include working to a set time,

provisions for overtime pay, and improved

information about loads

UNCLASSIFIED


How do you know you got it right?

You can’t

The story we write about past performance is always tentative

�New information can prove you wrong

�New interpretations may be better than yours

Human Performance Based

Documents

Transcript of Human Performance Based