human performance based
TRANSCRIPT
U N C L A S S I F I E D
U N C L A S S I F I E D
Operated by the Los Alamos National Security, LLC for the DOE/NNSA
Human Performance BasedHuman Performance Based
Accident InvestigationAccident Investigation
Roger Kruse
Todd ConklinESH&Q Integration Office
Operated by Los Alamos National Security LLC for DOE/NNSA
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 2
Why This Class, Now?
We are very efficient at conducting accident
investigations, but….
�Why do events continue to happen?
�Why are our responses so ineffective?
�Why don’t we seem to fix the right things?
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 3
IAEA-TECHDOC-1329
Safety Culture in Nuclear Installations
RuleBased
Improvement Based
Goal Based
Organizational Maturity
People who
make mistakes
are blamed for
their failure to
comply with rules
Management’s
response to mistakes
is more controls,
procedures, and
training
Mistakes are
seen as process
variability with
emphasis is on
understanding
what happened,
rather than
finding someone
to blame
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 4
Punishing versus Learning
Punishing
� Punishing is about keeping our beliefs in a system intact
� Punishing is about seeing the culprits as unique parts of the failure
� Punishing is about stifling the flow of safety-related information.
� Punishing is about not getting caught the next time.
� Punishing is about closure, about moving on from the terrible event.
Learning
� Learning is about changing our
belief systems
� Learning is about seeing the failure
as a part of the system.
� Learning is about increasing the
flow of safety-related information.
� Learning is about countermeasures
that remove error-producing
conditions so there will not be a next
time
� Learning is about continuity, the
event firmly integrated in what the
system knows about itself.
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 5
The focus of this course is to …
� To understand human performance, do not limit yourself to the quest for causes
� An explanation of why people did what they did provides a much better understanding
� With understanding comes the ability to develop solutions that will improve operations
Understand the context and explain the event
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 6
Credit where credit is due …
Most of the concepts and many of the examples in the course
come from books and publications by Sydney Dekker, Department of Aeronautical Engineering, Lund University, Sweden. His books include:
�The Field Guide to Human Error Investigations, 2002
�Ten Questions About Human Error, a New View of Human Factors and System Safety, 2005
�The Field Guide to Understanding Human Error, 2006
Additional concepts on performance variability, accident models, and procedures come from publications by Erik Hollnagel, University of Linköping, Sweden. His books
include:
�Barriers and Accident Prevention, 2004
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 7
On 6/12/03, a Civil Air Patrol Cessna 182 based out of Los
Alamos and flown by a Los Alamos Squadron pilot, stalled and
crashed shortly after takeoff while towing a Schweizer 2-33 glider
at the CAP Glider Encampment in Hobbs, NM.
View from tow plane View from glider
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 8
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 9
The question is:
Was this a “big” accident or “little” accident?
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 10
Sometimes you can walk away …..
When the plane crashed, it struck a hanger which absorbed much of the impact.
The pilot was able to climb out of the wreckage and was waiting beside the aircraft when help arrived.
The only injury was a deep cut on the back of his hand.
What were the odds of the aircraft striking the hanger?
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 11
Simple event or Complex event?
A researcher returned to an HRL laboratory to find that a glass bottle containing 500 ml of a sodium hydroxide and
detergent solution had burst, scattering broken glass and
solution over the unoccupied lab.
The conclusion at the critique was that the student who
prepared the solution had mistakenly turned the heater knob instead of the stirrer knob on the magnetic stirrer hot
plate.
Let’s briefly scan the Event/Decision Chart used to
investigate and analyze the event
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 12
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 13
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 14
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 15
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 16
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 17
Consequence is not the whole story
� Sometimes complex accidents result in little or no
consequence
� Likewise, relatively simple accidents, can result in
a significant consequence
� All events should be investigated and the level of
effort should be determined “on-the-fly”
� The “causes” should reflect the substance of the
event, not the consequence
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 18
Module One:
� Errors and Performance Variability
� Meaning Right While Doing the Wrong Things
� How We Look at Accidents
� Cause and Effect
� Barrier Analysis Perils and Pitfalls
� Event/Decision Charting
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 19
The “Two Views” of Human Error
Rule Based
�Human error is the cause of 90% or more of the accidents
�The system in which people work is basically safe, the problem is the inherent unreliability of people
�Progress on safety is made by protecting the system from unreliable humans
�Protection is achieved through employee selection, procedures, training, discipline, and automation
Improvement Based
�Human error is a symptom of trouble deeper within the system
�Safety is not inherent in most systems, workers have to create safety by their actions
�Human error is connected to features of the tasks and operating environment
�Progress on safety comes from understanding and influencing these connections
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 20
Origins of Human Error
10%
90%30%
70%
Human Error
Slip, trip or lapse
Equipment Failures
Human Errors
Traditional View: Operational Upsets
System Induced Error
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 21
“Causes” based on LANL occurrence data
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 22
IAEA-TECHDOC-1329
Safety Culture in Nuclear Installations
RuleBased
Improvement Based
Goal Based
Organizational Maturity
Communications
between
departments and
functions is poor
Management
encourages
interdepartmental and
inter-functional
communication
Collaboration
between
departments and
functions is good
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 23
What does “human error” really mean?
“Human Error” is used in the following ways:
� Cause (focus on action as the cause of the outcome)“The oil spill was caused by human error”
� Action (focus is on the action)“He forgot to check the water level”
� Consequence (focus is on the outcome)“He made the error of putting salt in the coffee”
Think of human error as a deviation from
expected performance, which includes both
unintended and intended actions
�
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 24
Performance Modes
Knowledge-Based
Patterns
Rule BasedIf - Then
Skill-BasedAuto
High
Low
Att
enti
on (
to t
ask
)
Inattention
Misinterpretation
Inaccurate
Mental Picture
Familiarity (w/ task)Low High
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 25
Unintentional Human Errors (and Violations)
Gray
Area
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 26
When is an error an error?
From a practical standpoint:
� Errors are not known until after the fact:
• When the deviation from intent or adverse consequence
is noticed, and
• the action was judged to be wrong
� This notice of deviation or consequence could be almost immediate by the worker or it could be delayed
� In hindsight, errors seem obvious and compelling, but from the view of the people at the time, they were just
doing their job
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 27
When is an “error” not really an error?
An intended action can be judged an error (performance deviation) because of an unintended outcome
Here are two common sources:
�Organization influenced
Actions taken by conscientious workers to meet organizational goals (meeting demands and stretching resources)
�Knowledge influenced
Actions taken by knowledgeable workers with intent to produce a better outcome
When successful, the actions are condoned and rewarded
When they are unsuccessful or outcome is bad, the actions
are quickly judged as violations
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 28
Unintentional Errors and Intended Variations
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 29
More sources of performance variations:
� Inherent variability – individual psychological & physiological differences
� Ingenuity and creativity - adaptability in overcoming constraints and under specification
� Socially induced performance variability - meeting co-worker expectations, informal work standards
� Experience variability – past experience drives future actions
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 30
People optimize their performanceEfficiency Thoroughness Trade Off (ETTO) Principle
Efficient Thorough
Time Required
Time Available
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 31
Let’s talk about performance variation?
Sense Act
Think
Goals,
knowledge,
understanding,
focus, etc.
???
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 32
Looks OK to me
Not really important
No time (or resources) to do it now
If I do it this way, I can save time/money
Boss says it must be ready in time
I know a better way to do it
We must get this done
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 33
Performance variability
Sense
Goals,
knowledge,
understanding,
focus, etc.
Act
???
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 34
IAEA-TECHDOC-1329
Safety Culture in Nuclear Installations
RuleBased
Improvement Based
Goal Based
Organizational Maturity
People are
rewarded for
obedience and
results
People are rewarded
for exceeding goals
People are
rewarded for
improving
processes
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 35
The facts of life (or work)
The Belief(work-as-imagined)
� Systems are well designed and well maintained
� Procedures are complete and correct
� Designers can foresee and anticipate every situation
� People behave as they are expected to - as they are
taught
The Reality(work-as-done)
� People learn to overcome design
flaws and functional glitches
� People interpret and apply
procedures to match conditions
� People can detect and correct when
things go wrong
� People adapt their performance to
meet demands
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 36
A quick example
A questionnaire study of 286 aircraft maintenance engineers found that 34% did not follow the official
procedure for a task they just completed. Of these:
�45% said there was an easier way
�43% said there was a quicker way
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 37
Success lies with the worker …
� Procedures are resources for action (among other resources)
� Applying procedures successfully is a substantive, skillful cognitive activity
� Safety often comes from people being skillful at judging when and how procedures apply
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 38
HPI Anatomy of an Event
Event
Error
Precursors
Vision, Beliefs, &
Values
Latent
Organizational
Weaknesses
Mission
Goals
Policies
Processes
Programs
FlawedDefenses
Initiating
Action
Vision,
Beliefs, &Values
EventEvent
Error
Precursors
Error
Precursors
Vision, Beliefs, &
Values
Latent
Organizational
Weaknesses
Mission
Goals
Policies
Processes
Programs
Latent
Organizational
Weaknesses
Mission
Goals
Policies
Processes
Programs
Mission
Goals
Policies
Processes
Programs
FlawedDefensesFlawedDefenses
Initiating
Action
Initiating
Action
Vision,
Beliefs, &Values
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 39
Accidents as unexpected combinations of
normal variability
Time
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 40
Simple, linear cause – effect model
� Accidents are the (natural) culmination of a series of events or circumstances, which occur in a specific and
recognizable order.
� Caused by unsafe acts or conditions
� Prevented by finding and eliminating possible causes
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 41
Complex, linear cause – effect model
� Accidents result from a combination of active failures (unsafe acts) and latent conditions (hazards)
� Caused by degradation of components (organizational,
human, technical)
� Prevented by strengthening barriers and defenses
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 42
Non-linear accident model
� Accidents (and success) emerge from the normal variations in performance
� Caused by unexpected combinations of “normal” actions
rather than action failures.
� Solution is to understand the nature of variability (why,
when, how) and how to limit it when it can be dangerous
Functional Resonance
Accident Model (FRAM)
- Erik Hollnagel
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 43
Module Two:
� Errors and Performance Variability
� Meaning Right While Doing the Wrong Things
� How We Look at Accidents
� Cause and Effect
� Barrier Analysis Perils and Pitfalls
� Event/Decision Charting
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 44
In theory, investigations intend to…
� Determine how the underlying factors that combined to result in the accident
� Find the latent conditions and organizational weaknesses that led to the human errors
� Address the conditions that create error likely situations
� Understand and explain rather than judge and blame
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 45
In practice, investigations almost always:
� Focus on bad decisions, inaccurate assessments, and deviation from written guidance
� Seek evidence of erratic, wrong, or inappropriate behavior
� Conclude how workers failed to adhere to procedures
� Conclude how supervision/management failed to
prevent the accident
� Pass judgment and assign blame
Name → Shame → Blame → Train (or retrain)
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 46
In practice, causes are often expressed as
� Worker did not follow (or violated) the procedure
� Inadequate details in the procedures
� Inattention or complacency by the involved worker
� Inadequate training or retraining
� Inadequate supervision that allowed the error to
occur
� Lack of management attention and oversight
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 47
In practice, corrective actions include
� Disciplinary action, real or perceived, for the
involved worker/supervision
� Retraining of the involved workers
� Additional training for all workers
� Changes in the procedure or more procedures
� Increase in supervisory/management oversight
It’s all about the apples!
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 48
The Bad Apple Theory
� Our processes would be fine, were it not for the
erratic behavior of some unreliable people (bad
apples)
� Safety will be achieved when the bad apples are
either fixed or eliminated
AKA: “cowboys and buttheads”
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 49
Discussion:
� Although we believe strongly that we have competent and motivated workers, why do we revert so quickly to
a conclusion of “bad apples” when there is an accident
or security event
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 50
Why accident investigations regress into the
bad apple theory …
� Straightforward, simple to understand, and simple to complete
� Difficult to not be judgmental about seemingly bad performance
� Emotionally satisfying to punish the guilty
� The hindsight bias confuses our reality with the one
that surrounded the workers
� Political resistance for probing into sources of failure
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 51
Module Three:
� Errors and Performance Variability
� Meaning Right While Doing the Wrong Things
� How We Look at Accidents
� Cause and Effect
� Barrier Analysis Perils and Pitfalls
� Event/Decision Charting
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 52
Three contexts in which we look at accidents:
1. Proximal
2. Retrospective
3. Counterfactual
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 53
Proximal
� We tend to focus on those people who were closest to producing or potentially avoiding the accident
� Rather than recognize weakness in the system, the tendency is to see a localized problem where the people
have acted in an “irrational” manner
� We tend to ignore the organizational influences on
behavior that result from a multitude of conflicting constraints and pressures (be thorough, but also efficient)
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 54
Retrospective
� Investigations aim to explain an event in the past, but are conducted in the present
� As an investigator, you will probably know more about
the event than the people involved
Because you assessing people’s decisions and actions with hindsight, based on what you know now, you cannot be
truly objective about their performance
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 55
Hindsight causes us to oversimplify
� We underestimate the uncertainty people felt and do not understand how unlikely the outcome would have
seemed
� We see the sequence of events as a linear progression
to the outcome and do not appreciate the multiple
pathways that surrounded the people
The next slide is simply amazing
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 56
Solve the maze, then raise your handThe quickest way to solve the maze is to
start from the FINISH and work
backwards
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 57
How the people involved saw it before the accident
How the investigator sees it after the accident
??
?
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 58
“They should have ....”
� A counterfactual (counter the facts) is a statement of what people should have done instead of what they did
do . Examples include:
• “they could have …”
• “they did not …”
• “they failed to …”
• “if only they had …”
� With the benefit of hindsight, you can easily see what people could have done to prevent the event
� But, it is a reality that didn’t happen and doesn’t help
you to understand what did happen
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 59
Counterfactuals are the most prevalent
feature of most accident investigations
Excerpts from past investigations
�Personnel did not follow formal procedures.
�Management did not effectively respond to precursor events.
�Management did not eliminate or remove the hazard.
�Management did not adequately respond to feedback.
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 60
We are not alone, a recent example from the
National Transportation Safety Board
On August 27, 2006, Comair flight 5191, crashed during takeoff from Blue Grass Airport, Lexington, Kentucky.
The flight crew was instructed to take off from runway 22, but instead lined up the airplane on runway 26 and began
the takeoff roll. The airplane ran off the end of the short
runway and impacted the airport perimeter fence, trees, and terrain.
The captain, flight attendant, and 47 passengers were
killed.
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 61
The NTSB Board determined the probable
cause(s) of this accident as follows:
� The flight crew’s failure to use available cues and aids to identify the airplane's location on the airport surface
during taxi,
� The flight crew’s failure to cross-check and verify that
the airplane was on the correct runway before takeoff,
and
� The FAA’s failure to require that all runway crossings be authorized only by specific air traffic control
clearances.
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 62
Why counterfactuals happen …
� When faced with failure (accident), your first reflex is to seek other failures• Where did people go wrong?
• What did they miss?
� Because we are working backwards with the benefit of
a known outcome, we can easily see how they could
have avoided the accident
The trouble is, this is not how the involved people experienced the accident, and does not explain how
failure succeeded
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 63
Developing counterfactuals from the “facts”
� Counterfactuals are most often a theory (i.e. opinion) formed by the investigator
� Information from and about the event is then used selectively to support these opinions
� The facts are taken out of context by:
• Micro-matching – comparing behavior with what you
know now to be true and finding a mismatch
• Cherry-Picking – selected bits of data that “prove” a
condition identified only in hindsight
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 64
Micro-matching procedures
� In hindsight, discrepancies between procedures and practice are easily “unearthed”
But, discrepancies between procedure and practice are common and are not especially unique to the accident
circumstances
The result is “worker did not follow procedures” as a cause
� Investigations invest considerable effort in “organizational archeology” to reconstruct the
regulatory and procedural framework in which the
operation took place
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 65
An HPI approach …
� Although we like to appear “knowledgeable”,
interview the workers before reviewing the
documents
� This will help you to understand the context in
which they experienced the event
� Let the worker explain what happened in his
own words
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 66
Counterfactuals by micro-matching other
standards
� Like procedures, other “standards of good practice” can be found that seem applicable to the situation
� Then failure to apply the good practice is cited
“At least one of the machinists moved the boring bar away from the glovebox gloves prior to donning the cotton gloves. This “Good Practice” was not included as a step in the work instruction nor was it communicated to all personnel.”
� The problem is they are usually only relevant with
knowledge of the outcome (hindsight)
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 67
Micro-matching other “critical” info
� With hindsight comes knowledge of “critical facts” that revealed the true nature of the situation
� The people are then faulted for missing or not acting on the information
“.. managers listened to worker feedback, but did not respond. The concern over the difficulty in donning and using the cotton gloves was accepted as a reasonable inconvenience.”
“… the direct cause of the injury was the difficulty of donning cotton gloves over glovebox gloves.”
But knowledge of what was critical is only obvious in hindsight
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 68
Cherry-picking
� Information can be taken out of context by grouping and labelingfragments that, in hindsight, appear to represent a common condition
� Often the investigator notes a particular “fact”, develops a theory (opinion), and searches for other evidence to support the theory
The team leader was located at another site
The team leader only visited the workers site about once a month
� The fragments of information are used to construct a story that “explains” the cause of the accident
Infrequent management presence led to an inconsistent implementation of safe
work practices, methods, and behaviors.
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 69
All is not lost, counterfactuals can be useful
� As we try to understand why workers did what they did, a counterfactual can help to provide insight
� The counterfactual seems obvious to us in hindsight, but that was not the case for the involved workers
� If we can understand why it was not noticed, why it was not considered important, or why another action (or no
action) was seen as a better way to proceed, then we can begin to understand why they did what they did
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 70
Module Four:
� Errors and Performance Variability
� Meaning Right While Doing the Wrong Things
� How We Look at Accidents
� Cause and Effect
� Barrier Analysis Perils and Pitfalls
� Event/Decision Charting
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 71
Why do we want to find “the cause”?
1. Not knowing what caused the accident is really scary
2. DOE (real or perceived) requires it
3. People may simply seek retribution, punishment, or justice
4. People want to start investing in countermeasures to prevent the accident from recurring
5. People want to know how to adjust their behavior to
avoid the same kind of trouble
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 72
Like the maze, we search for causes looking
backwards
� We oversimplify the search for causality
� What was uncertain working forward, becomes clear
working backwards
� We work backwards with effects preceded by actions,
which is opposite of how the people experienced it (actions followed by effects)
� We look for cause - effect relationships and those preceding actions become the causes
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 73
So, what is a “cause”?
For our purposes, it is why the accident happened
and is expressed in the context of cause and effect.
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 74
Cause and Effect
� Cause is inferred from observation, but is not something that can be observed directly
� Normally, we repeatedly observe action A followed by event B and conclude that B was the effect of A
Cause A Effect B
Observable ObservableNot Observable
(concluded)
Source: Hollnagel, Erik (2004) Barriers and Accident Prevention
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 75
Cause and Effect
� But investigations involve the notion of backward causality, i.e., reasoning from effect to cause
� We observe event B, assume that is was the effect of something and then try to find out which action A was
the cause of it
Cause? Effect B
Observable Observable
Not Observable
(constructed)
Source: Hollnagel, Erik (2004) Barriers and Accident Prevention
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 76
The problem of backward causation is
aggravated by some common mistakes
� There is a human tendency to draw conclusions that are not logically valid
� We tend to use educated guesses, intuitive judgment, or “common sense” rather than rules of logic
� The use of event timelines creates sequential relationships that seem to infer a causal relationships
� Because lots of actions are taking place, there is usually one action before the effect that seems to be a
plausible cause
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 77
Requirements for a cause – effect relationship
1. The cause must precede the effect (in time)
2. The cause and effect must be contiguous (close) in
time and space
3. The cause and effect must have a necessary and
constant connection between them, such that the same cause always has the same effect
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 78
For example …
The first cause of this event was a lack of direct supervision of the worker which resulted in a worker being able to
perform work in a manner that was unsafe
Is there a cause – effect relationship?
☺ The lack of direct supervision preceded the accident
� The lack of supervision had existed for years
� Lack of direct supervision does not always cause
work to be performed in an unsafe manner
Is inadequate policing the cause of DUI accidents?
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 79
� Definitions are hard to come by, but here is one that lays the groundwork:
“The identification, after the fact, of a limited set of aspects of the situation that are seen as necessary and
sufficient conditions for the observed effects to have occurred. The cause, in other words, is constructed
rather than found”.- Hollnagel, Erik (2004) Barriers and Accident Prevention
So once again, what is a “cause”?
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 80
Bottom Line: Don’t Overreach
� A true, repeatable cause and effect relationship is almost impossible to find
� Instead, try to explain how the accident happened while providing the context for the worker actions
� Although the causal relationships are weak and we can usually identify many factors that “contributed” to the event
� Because it is really our opinion, we need to provide enough information that others can draw the same conclusion
Understand and Explain
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 81
WYLFIWYF*
� The cause you find usually depends on:
• where you look,
• what you look for,
• who you talk to,
• what you have seen before, and likely,
• who you work for
� It often says more about the investigator than the
accident!
* What You Look For Is What You Find
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 82
Two official investigations of the same airline
crash
� One conducted by American Airlines, whose aircraft crashed in the mountains near Cali, Colombia
� The other by the Colombian civil aviation authority, who employed the air traffic controllers
On December 20, 1995, AA Flight 965 (AA965), a Boeing 757, on a
regularly scheduled passenger flight from Miami to Cali, Colombia
operating under instrument flight rules (IFR), crashed into mountainous
terrain during a descent from cruise altitude. Of the 163 on board, only four
passengers survived.
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 83
Causes from different investigations
According to Authority
� Air Traffic Controller did not play a
role
� Pilots inadequate use of flightdeck
automation
� Loss of pilot’s situation awareness
regarding terrain and navigation aids
� Failure to revert to basic navigation
when automation created confusion
and increased workload
� Pilots efforts to hasten arrival to
avoid delays
According to Airline
� Controller’s clearances were not in
accordance with standards
� Inadequate language skills and
inattention by the Controller
� Inadequate automation database
supplied to computers
� Lack of radar coverage over area
� Workload increase because of
Controller’s sudden instruction to
use novel arrival route and different
runway
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 84
Categories of cause over time
Equipment &
Technology
Source: Hollnagel, Erik (2004) Barriers and Accident Prevention
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 85
Module Five:
� Errors and Performance Variability
� Meaning Right While Doing the Wrong Things
� How We Look at Accidents
� Cause and Effect
� Barrier Analysis Perils and Pitfalls
� Event/Decision Charting
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 86
Why barriers?
Re + Md Re + Md →→ ØØEEreducing errors AND managing
defenses lead to zero events
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 87
Types of Barriers
Current Categories
� Physical
� Administrative
Better Categories
� Physical
� Functional
� Symbolic
� Incorporeal
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 88
Physical – physically prevents an action from
being carried out or an event from happening
� Containing or protecting - walls, fences,
railings, containers, tanks
� Restraining or preventing movement - safety
belts, harnesses, cages
� Separating or protecting – Crumple zones,
scrubbers, filters
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 89
Functional – impedes actions through the use
of pre-conditions
� Prevent movement/action (hard) – locks,
interlocks, equipment alignment
� Prevent movement/action (soft) – passwords,
entry codes, palm readers
� Impede actions – delays, distance (too far for
single person to reach)
� Dissipate energy/extinguish – air bags,
sprinklers
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 90
Symbolic – requires an act of interpretation in
order to achieve their purpose
� Countering/preventing actions – demarcations,
signs, labels, warnings
� Regulating actions – instructions, procedures,
dialogues (pre-job brief)
� System status indications – signals, warnings,
alarms
� Permission/authorization – permits, work
orders
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 91
Incorporeal – requires interpretation of
knowledge in order to achieve their purpose
� Process – rules, restrictions, guidelines, laws
� Comply/conform – self-restraint, ethical norms,
morals, social or group pressure
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 92
Evaluation of barrier system quality
� Effectiveness – how well it meets its intended
purpose
� Availability – assurance the barrier will function
when needed
� Evaluation – how easy to determine whether
barrier will work as intended
� Interpretation – extent to which the barrier
depends on interpretation by humans to
achieve its purpose
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 93
Evaluation of barrier system characteristics
Physical Functional Symbolic Incorporeal
Effective High High Medium Low
Availability High Low - High High Uncertain
Evaluation Easy Moderate Difficult Difficult
Interpretation None Low High High
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 94
OK, what’s the point?
� Barrier analysis is one of the cornerstones of accident investigation
� But we treat every type of barrier as if they were “physical” and expected to always work
� The result is many findings involving procedures, rules, training, supervision, oversight, etc. that failed
� The reality is they were often not very effective in the first place
Be careful not to overreach
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 95
Module Six:
� Errors and Performance Variability
� Meaning Right While Doing the Wrong Things
� How We Look at Accidents
� Cause and Effect
� Barrier Analysis Perils and Pitfalls
� Event/Decision Charting
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 96
Sydney Dekker’s five steps for reconstructing
human error contributions to accidents
1. Lay out the sequence of events and decisions in a rough timeline
2. Divide the sequence into episodes, if necessary
3. Find out how the world looked or changed during each
episode
4. Identify workers’ goals, constraints, focus of attention
and knowledge at the time, (i.e., the CONTEXT)
5. Summarize in an explanation, what the workers did
and why they did it
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 97
Event/Decision Charting
� This is a variation of the traditional Events and Causal Factors (EC&F) Charting that we developed to
incorporate human performance
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 98
Sequence of events
� The sequence of events forms the starting point for reconstructing the accident
� The events include observations, actions, and changes in the process or system.
� The decisions (before an action) will start to establish the mindset of the worker
� The goal is to set the framework for how the workers perception unfolded in parallel with the situation
evolving around them
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 99
Sequence of Events and Decisions
Add EVENTS and ACTIONSThen add in the DECISIONS, before the actions
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 100
Divide the sequence into episodes, if necessary
� Accidents can evolve over a period of time and
the goal is to identify how perceptions and
mindset change over time
� Episodes can change when there are:
• Shifts in behavior
• Changes in the process
• Actions to influence the process
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 101
Divide into EPISODES, if necessary
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 102
How the world looked or changed
� This step is about reconstructing the event as it
unfolded around the worker:
• find out what their process was doing
• what information was available
� Reconstruct how the process was changing and
how information about the changes were presented
to the workers
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 103
Add in the available INFORMATION
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 104
Workers’ goals, knowledge, and focus
� People have goals. Completion of the task is obvious, but there are other, often conflicting, goals present• Economic considerations, such as safety versus schedule
• Subtle coercions (what boss wants, not what s/he says)
• Response to previous situations (successes OR failures)
� People have knowledge, but the application of knowledge is
not straight forward• Was it accurate, complete and available
� Goals & knowledge together determine their focus• Workers cannot know and see everything all the time
• What people are trying to accomplish and what they know drives where they direct their attention
• Re-constructing their focus of attention will help you to understand the gap between available information and what they saw or used
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 105
Add in the Workers’ GOALS & KNOWLEDGE
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 106
Explanation
Provide an explanation of what the workers did and whythey did it
�What was happening with the process
�What the workers were trying to accomplish and why
�What they knew at the time
�Where their attention was focused and why
�Why what they did made sense to them at the time
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 107
“They should have known this was the wrong lift”
Accident - At the end of the day, workers used the wrong conveyor lift (wrong size for door) to unload the last truck,
resulting in minor damage to the truck.
Old View Cause:
Workers knew that it was the wrong conveyor lift, but chose to use it anyway
Old View Fixes:
Disciplinary action, training & procedure change
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 108
Workers use large conveyor instead of small
conveyor to unload front compartment of truck,
causing damage
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 109
Q: Why did they use the large conveyor instead of the
small one?
A: The small one was in the remote storage area and
they didn’t want to take the time to get it
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 110
Q: Why was the small conveyor in the storage area?A: They moved it there before the truck arrived
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 111
Q: Why did they move it to storage?A: They didn’t think they would need it
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 112
Q: Why didn’t they think they would need it?A: They had been told the front compartment was
empty
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 113
Q: But, why did they move it before the truck
arrived?
A: They get to go home when the last truck is
unloaded and wanted to be ready to leave ASAP
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 114
Finally, when they found out there was cargo in the front,
they thought they could use the large conveyor safely
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 115
Explanation based on understanding:
� The end of workday was based on the last truck instead of a specific time. The workers went home as
soon as it was unloaded.
� Knowing it was the last truck and having been told there was no cargo in the front, the workers started
putting away non-essential equipment.
� Believing the smaller conveyor was not needed, the
workers returned it to the remote storage
� When the last truck arrived, there was cargo in the
front compartment
� Not wanting to take the time to retrieve the small conveyor, they used the larger conveyor that was still
available, believing it would be safe
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 116
Look at the incentive structure
� If you say they can go home after the last truck,
expect them to start packing everything but the
bare essentials away before the last truck
arrives
� When confronted with a surprise (unanticipated
load), also expect them to improvise with the
tools at hand
Possible solutions include working to a set time,
provisions for overtime pay, and improved
information about loads
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 117
How do you know you got it right?
You can’t
The story we write about past performance is always tentative
�New information can prove you wrong
�New interpretations may be better than yours