1

UK P&I CLUBIS MANAGEDBY THOMASMILLER

UK P&I CLUB

The human elementThe catch-all term ‘human error’ covers a wide varietyof unsafe behaviours which contribute to accidents

2

Most people would agree with the old adage ‘to err is human’. Most too would agreethat human beings are frequent violators of the ‘rules’ whatever they might be. Butviolations are not all that bad – they got us out of the caves!

One of the most important distinctions between errors and violations is that each hasdifferent mental origins, occur at different levels of the organisation, require differentcounter-measures and have different consequences. Everyone in an organisation,from members of the Board to those at the coal-face, bears some responsibility forthe commission of violations. It also follows that all employees have a part to play inminimising their occurrence.

Over the past two decades there has been a growing appreciation of themany and varied ways that people contribute to accidents in hazardousindustries or simply in every day life. Not long ago most of these wouldhave been lumped together under the catch-all label ‘human error’.Nowadays it is apparent that this term covers a wide variety of unsafebehaviours.

0

20%

40%

60%

80%

100%

Eng officer

Shore

Pilot

Deck officer

Crew

CargoPollutionPersonal injury

Damage to property

Collision

15$m/yr

18$m/yr

27$m/yr 23$m/yr

21$m/yr

(Cost of human error)

Percentage input of human factor in each major risk area

Errors and violations

3

Assuming that a safe operating procedure is well-founded, any deviation will bring the violator into anarea of increased risk and danger. The violation itselfmay not be damaging but the act of violating takes theviolator into regions in which subsequent errors aremuch more likely to have bad outcomes. Thisrelationship can be summarised:

Violations + errors = injury, death and damage

It can sometimes be made much worse becausepersistent rule violators often assume, somewhatmisguidedly, that nobody else will violate the rules, atleast not at the same time! Violating safe workingprocedures is not just a question of recklessness orcarelessness by those at the coal-face. Factorsleading to deliberate non-compliance extend wellbeyond the psychology of the individual in directcontact with working hazards. They include suchorganisational issues (latent failures) as:

● The nature of the workplace

● The quality of tools and equipment

● Whether or not supervisors or managers turn a ‘blindeye’ in order to get the job done

● The quality of the rules, regulations and procedures

● The organisation’s overall safety culture, or lack of.

Violations are usually deliberate, but can also beunintended or even unknowing. They can also bemistaken in the sense that deliberate violations maybring about consequences other than those intended,as at Chernobyl. In this case, out of the seven unsafeacts (active failures) leading up to the explosion, sixwere a combination of a rule violation and an error (amisventure). Here was a sad and remarkable case inwhich a group of well-motivated and exceedingly expert

operators destroyed an elderly but relatively well-defended reactor without the assistance of anytechnical failures.

The distinction between errors and violations is oftenblurred but the main differences are shown in the tablebelow.

As can be seen from the table, errors may be simplememory or attentional failures exacerbated by:

Routinisation – the mark of a craftsman whereby theindividual becomes so expert at exercising a particularskill, that he/she no longer consciously thinks about itallowing the mind to wander and the unexpected tohappen – drivers who regularly travel the same route tothe station each day suffer from this – “am I herealready?”

Normalisation – the process of forgetting to be afraid– interestingly most accidents on mountains happen onthe way down from the summit – only a relatively smallnumber happen on the way up.

Errors Violations

Stem mainly from informational factors: incorrect or incomplete Stem mainly from motivational factors. Shaped by attitudes,

knowledge, either in the head or in the world. beliefs, social norms and organisational culture.

They are unintended and may be due to a memory failure They usually involve intended or deliberate deviations from the

(a ‘lapse’) or an attentional failure (a ‘slip’). rules, regulations and safe operating procedures.

They can be explained by reference to how individuals They can only be understood in a social context.

handle information.

The likelihood of mistakes occurring can be reduced by Violations can only be reduced by changing attitudes, beliefs,

improving the relevant information: training, roadside signs, social norms and organisational cultures that tacitly condone

the driver-vehicle interface, etc. non-compliance (culture of evasion).

Errors can occur in any situation. They need not of themselves, Violations, by definition, bring their perpetrators into areas of

incur risk. increased risk i.e. they end up nearer the ‘edge’.

Intrinsic hazard – no matter how well you defendyourself the dangers ‘out there’ never go away – move

4

outside your protective ‘bubble’ and something orsomeone will get you!

Other factors include:

Creeping entropy – systems, policies and proceduresgrow old or fail to adjust to changing external factorsthus increasing the propensity for accidents to happen.

Murphy’s Law – if it can happen it will happen, butthere is also Schultz’ Law. Mr Schultz merely said thatMurphy was an optimist!

Safe operating proceduresThese are written to shape people’s behaviour so as tominimise accidents. As such they form part of thesystem defences against accidents. Defences areinstalled to protect the individual, the asset or thenatural environment (the ‘object of harm’) againstuncontrolled hazards and come in two forms:

● ‘Hard’ defences provided by fail-safe designs,engineered safety features and mechanical barriers.

● ‘Soft’ defences provided by procedures, rules,regulations, specific safety instructions and training.‘Soft’ defences are more easily circumvented bypeople than ‘hard’ defences and thus constitute amajor challenge to any safety management system.

Procedures are continually being amended to coverchanged working conditions, new legislation, newequipment and, most particularly, to prohibit actionsthat have been implicated in some recent accident.Following an accident how often have you heardpeople (usually senior) exclaim “and what did the

procedures say?” Over time these procedural changesbecome increasingly restrictive yet the actionsnecessary to get the job done haven’t changed andoften extend beyond these permitted behaviouralboundaries. Ironically then, one of the effects ofcontinually tightening-up procedures in order toimprove system safety is to increase the likelihood ofviolations being committed. The scope of permitted, orallowable action shrinks to such an extent that theprocedures are either routinely violated or wheneveroperational necessity demands. In either case theprocedures are often regarded as unworkable by thosewhose behaviour they are supposed to govern.Whereas errors arise from various kinds ofinformational under-specification, many violations areprompted by procedural over-specification – a classicown goal you might say!

As already implied system failures or weaknesses suchas design, maintenance management, hardware,procedures, housekeeping, communications, training,organisation, error-enforcing conditions, incompatiblegoals and defences are called ‘latent failures’ asopposed to unsafe acts which are ‘active failures’.

Performance levelsNow we come to the scientific bit. Error types can beclassified at three levels:

Skill-based level

At the skill-based level, we carry out routine, highlypractised tasks in a largely automatic fashion, exceptfor occasional checks on progress. This is what peopleare very good at for most of the time

55

Rule-based level

We switch to the rule-based level when we notice aneed to modify our largely pre-programmed behaviourin line with some change in the situation around us.This problem is often one that we have encounteredbefore and for which we have some pre-packagedsolution. It is called rule-based because we applystored rules of the kind: if (this situation) then do (theseactions). In applying these stored solutions we operatevery largely by automatic pattern-matching: weautomatically match the signs and symptoms of theproblem to some stored solution. We may then useconscious thinking to check whether or not thissolution is appropriate

Knowledge-based level

The knowledge-based level is something we come tovery reluctantly. Only when we have repeatedly failedto find a solution using known methods do we resort tothe slow, effortful and highly error-prone business ofthinking things through on the spot. Given time and thefreedom to explore the situation with trial and errorlearning, we can often produce good solutions. Butpeople are not usually at their best in an emergency –though there are some notable exceptions. Quite often,our knowledge of the problem situation is patchy,inaccurate, or both. Consciousness is also very limitedin its capacity to hold information, usually not more

than two or three distinct items at a time. It alsobehaves like a sieve, forgetting those things as we turnour attention from one aspect to another. In addition,we can be plain scared, and fear (like other strongemotions) has a way of replacing reasoned action with‘knee-jerk’ or sometimes over-learned responses.

Classifying violationsCase and field studies suggest that violations can begrouped into four categories: routine violations,optimising violations, situational violations andexceptional violations. The relationship of these to boththe performance levels and error types is summarisedin the table below.

A few simple definitions will help clarify theseviolations.

Routine violations – almost invisible until there is anaccident (or sometimes as the result of an audit),routine violations are promoted by a relativelyindifferent environment i.e. one that rarely punishesviolations or rewards compliance – “we do it like thisall the time and nobody even notices.”

Optimising violations – corner-cutting i.e. followingthe path of least resistance, sometimes also thrillseeking – “I know a better way of doing this.”

Performance levels Error types Violation types

Skill-based Slips and lapses Routine violations

Optimising violations

Rule-based Rule-based mistakes Situational violations

Knowledge-based Knowledge-based mistakes Exceptional violations

Situational violations – standardproblems that are not covered in theprocedures – “we can’t do this anyother way.” An excellent exampleconcerns railway shunters: the RuleBook prohibits shunters fromremaining between wagons when

6

wagons are being connected. Only when the wagonsare stopped can the shunter get down between them tomake the necessary coupling. On some occasionshowever, the shackle for connecting the wagons is tooshort to be coupled when the buffers are fully extended.The job can only therefore be done when the buffers aremomentarily compressed as the wagons first come incontact with each other. Thus the only way to join theseparticular wagons is by remaining between them duringthe connection and watching your head. The result isobvious

Exceptional violations – unforeseen and undefinedsituations – “now this is what we got trained for”. TheChernobyl disaster is the best documented account ofexceptional violations, however a simpler example onan oil-rig illustrates the point: a pair of engineers wasinspecting a pipeline. One of them jumps into aninspection pit and is overcome by hydrogen-sulphidefumes. His companion, fully trained to handle suchsituations raises the alarm but then jumps down to helphis partner, whereupon he too is overcome. Familiar

isn’t it? Nothing could have prepared the second man forthe emotions that he felt on seeing his colleague indesperate need of help. Exceptional violations ofteninvolve the transgression of general survival rules ratherthan specific safety rules. Gut impulse is frequentlystronger than the dictates of training and common-senseand quite often has fatal consequences. Survivors ofsuch exceptional violations are often treated as heroes.Exceptional violations can sometimes be seen as anexercise of initiative even sometimes provoking reward if,that is, you get away with it.

ConclusionThere is a general formula which states:

Uncontrolled hazard + Undefended target =Unplanned event

Given that human beings, for whatever reason, are ableto circumvent both controls and defences withsometimes quite remarkable cunning, the problem, forthat is what it is, can be summed up as follows:

● Everyone is fallible and capable of bending the rules.

● All systems have technical and proceduralshortcomings.

● Whatever you do, there’s always something beyondyour control that can hurt you.

Finally there is the theory of Sheep and Wolves. Studieshave identified two sorts of people – sheep and wolves.Wolves accept rule violation as a norm. There are:

● Sheep in sheep’s clothing.

● Wolves in wolf’s clothing.

● Sheep in wolf’s clothing.

● But the largest group are wolves in sheep’s clothing –they haven’t violated the rules – yet!

7

While the immediate reasons for marine accidents andincidents are often quite clear, the underlying causesmay not be so obvious. To extend awareness andprovide a perspective on these contributory factors, theUK P&I Club has produced No room for error, a 46-minute DVD.

The title stems from the part played by human error inover half of all the large (over US$100,000) claims onthe Club in its comprehensive ongoing Major ClaimsAnalysis. Human error is crucial or significant in 83 percent of collisions and 75 per cent of property damageclaims. The incidence for pollution is 54 per cent, forpersonal injury 48 per cent and for cargo 46 per cent.

By contrast, equipment, structural and mechanicalfailures are the primary causes of less than a quarter oflarge claims between them.

The costs are enormous – around US$1.5 billion to theClub since 1987 and a steady $1.5 million a day to theindustry as a whole.

No room for error looks beyond the immediate orproximate factors which trigger claims to the underlyingor latent causes.

The theme is expressed in five scenarios, featuringfamiliar situations which lead all too often to collisions,personal injury, pollution, cargo and property damage.These are then reviewed and shortcomings categorisedas procedure, hardware,design, maintenancemanagement, errorenforcing conditions,housekeeping,incompatible goals,communication,organisation, training anddefences.

OrderingMembers may order copiesof the above direct fromthe Club and non-membersthrough MarisecPublications,www.marisec.org.

The human element was firstproduced as a supplement toLP News 16, September 2003

No room for error

Five fictional maritime scenarios illustrates the rootcauses of human error:

● Ship collision.

● Cargo loss.

● Personal injury.

● Pollution.

● Property damage.

8

UK P&I CLUBIS MANAGEDBY THOMASMILLER

For further information please contact:Loss Prevention Department, Thomas Miller P&I LtdTel: +44 20 7204 2307. Fax +44 20 7283 6517Email: lossprevention.ukclub@thomasmiller.com