Human Performance Based

UNCLASSIFIED
Human Performance Based Accident Investigation

Roger Kruse Todd Conklin
ESH&Q Integration Office
Operated by Los Alamos National Security LLC for DOE/NNSA

Operated by the Los Alamos National Security, LLC for the DOE/NNSA
UNCLASSIFIED
Why This Class, Now? We are very efficient at conducting accident investigations, but. Why do events continue to happen? Why are our responses so ineffective? Why dont we seem to fix the right things?
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA
IAEA-TECHDOC-1329 Safety Culture in Nuclear Installations

Organizational Maturity
Rule Based
Goal Based
Improvement Based
People who make mistakes are blamed for their failure to comply with rules
Managements response to mistakes is more controls, procedures, and training
Mistakes are seen as process variability with emphasis is on understanding what happened, rather than finding someone to blame
UNCLASSIFIED
Punishing versus Learning

Punishing
Punishing is about keeping our beliefs in a system intact Punishing is about seeing the culprits as unique parts of the failure Punishing is about stifling the flow of safety-related information. Punishing is about not getting caught the next time. Punishing is about closure, about moving on from the terrible event.
UNCLASSIFIED
Learning
Learning is about changing our belief systems Learning is about seeing the failure as a part of the system. Learning is about increasing the flow of safety-related information. Learning is about countermeasures that remove error-producing conditions so there will not be a next time Learning is about continuity, the event firmly integrated in what the system knows about itself.
The focus of this course is to
Understand the context and explain the event

To understand human performance, do not limit yourself to the quest for causes An explanation of why people did what they did provides a much better understanding With understanding comes the ability to develop solutions that will improve operations
UNCLASSIFIED
Credit where credit is due

Most of the concepts and many of the examples in the course come from books and publications by Sydney Dekker, Department of Aeronautical Engineering, Lund University, Sweden. His books include:
The Field Guide to Human Error Investigations, 2002 Ten Questions About Human Error, a New View of Human Factors and System Safety, 2005 The Field Guide to Understanding Human Error, 2006
Additional concepts on performance variability, accident models, and procedures come from publications by Erik Hollnagel, University of Linkping, Sweden. His books include:
Barriers and Accident Prevention, 2004
UNCLASSIFIED
On 6/12/03, a Civil Air Patrol Cessna 182 based out of Los Alamos and flown by a Los Alamos Squadron pilot, stalled and crashed shortly after takeoff while towing a Schweizer 2-33 glider at the CAP Glider Encampment in Hobbs, NM.
View from tow plane

UNCLASSIFIED
View from glider
UNCLASSIFIED
The question is:
Was this a big accident or little accident?
UNCLASSIFIED
Sometimes you can walk away ..

When the plane crashed, it struck a hanger which absorbed much of the impact. The pilot was able to climb out of the wreckage and was waiting beside the aircraft when help arrived. The only injury was a deep cut on the back of his hand. What were the odds of the aircraft striking the hanger?
UNCLASSIFIED
10
Simple event or Complex event?

A researcher returned to an HRL laboratory to find that a glass bottle containing 500 ml of a sodium hydroxide and detergent solution had burst, scattering broken glass and solution over the unoccupied lab. The conclusion at the critique was that the student who prepared the solution had mistakenly turned the heater knob instead of the stirrer knob on the magnetic stirrer hot plate. Lets briefly scan the Event/Decision Chart used to investigate and analyze the event
UNCLASSIFIED
11
UNCLASSIFIED
12
UNCLASSIFIED
13
UNCLASSIFIED
14
UNCLASSIFIED
15
UNCLASSIFIED
16
Consequence is not the whole story Sometimes complex accidents result in little or no consequence Likewise, relatively simple accidents, can result in a significant consequence All events should be investigated and the level of effort should be determined on-the-fly The causes should reflect the substance of the event, not the consequence
UNCLASSIFIED
17
Module One:
Errors and Performance Variability Meaning Right While Doing the Wrong Things How We Look at Accidents Cause and Effect Barrier Analysis Perils and Pitfalls Event/Decision Charting
UNCLASSIFIED
18
The Two Views of Human Error

Rule Based
Human error is the cause of 90% or more of the accidents The system in which people work is basically safe, the problem is the inherent unreliability of people Progress on safety is made by protecting the system from unreliable humans Protection is achieved through employee selection, procedures, training, discipline, and automation
Improvement Based
Human error is a symptom of trouble deeper within the system Safety is not inherent in most systems, workers have to create safety by their actions Human error is connected to features of the tasks and operating environment Progress on safety comes from understanding and influencing these connections
UNCLASSIFIED
19
Origins of Human Error

Human Errors
70%
Traditional View: Operational Upsets
System Induced Error
30%
90%
Human Error
10%
Equipment Failures
Slip, trip or lapse
UNCLASSIFIED
20
Causes based on LANL occurrence data
UNCLASSIFIED
21

Rule Based
Goal Based
Improvement Based
Communications between departments and functions is poor
Management encourages interdepartmental and inter-functional communication
Collaboration between departments and functions is good
UNCLASSIFIED
22
What does human error really mean?

Human Error is used in the following ways: Cause (focus on action as the cause of the outcome)
The oil spill was caused by human error
Action (focus is on the action)

He forgot to check the water level
Consequence (focus is on the outcome)

He made the error of putting salt in the coffee
Think of human error as a deviation from expected performance, which includes both unintended and intended actions
UNCLASSIFIED
23
Performance Modes
High
Kn Inaccurate ow led Mental Picture ge -B Pa a tte rns sed
Attention (to task)
If
Ru le
-T
Misinterpretation
he n
Ba se
Sk il
Inattention
Low Low
l-B ase Au d to
Familiarity (w/ task)

UNCLASSIFIED
High
24
Unintentional Human Errors (and Violations)
Gray Area
UNCLASSIFIED
25
When is an error an error?

From a practical standpoint: Errors are not known until after the fact:
When the deviation from intent or adverse consequence is noticed, and the action was judged to be wrong
This notice of deviation or consequence could be almost immediate by the worker or it could be delayed In hindsight, errors seem obvious and compelling, but from the view of the people at the time, they were just doing their job
UNCLASSIFIED
26
When is an error not really an error?

An intended action can be judged an error (performance deviation) because of an unintended outcome Here are two common sources: Organization influenced
Actions taken by conscientious workers to meet organizational goals (meeting demands and stretching resources)
Knowledge influenced
Actions taken by knowledgeable workers with intent to produce a better outcome
When successful, the actions are condoned and rewarded When they are unsuccessful or outcome is bad, the actions are quickly judged as violations
UNCLASSIFIED
27
Unintentional Errors and Intended Variations
UNCLASSIFIED
28
More sources of performance variations:

Inherent variability individual psychological & physiological differences Ingenuity and creativity - adaptability in overcoming constraints and under specification Socially induced performance variability - meeting coworker expectations, informal work standards Experience variability past experience drives future actions
UNCLASSIFIED
29
People optimize their performance

Efficiency Thoroughness Trade Off (ETTO) Principle
Efficient
Thorough
Time Required Time Available

UNCLASSIFIED
30
Lets talk about performance variation?

Goals, knowledge, understanding, Think focus, etc.
Sense
Act
? ? ?
UNCLASSIFIED
31
Looks OK to me Not really important No time (or resources) to do it now If I do it this way, I can save time/money Boss says it must be ready in time I know a better way to do it We must get this done
UNCLASSIFIED
32
Performance variability
Goals, knowledge, understanding, focus, etc.
Sense
Act
? ? ?
UNCLASSIFIED
33

Rule Based
Goal Based
Improvement Based
People are rewarded for obedience and results
People are rewarded for exceeding goals
People are rewarded for improving processes
UNCLASSIFIED
34
The facts of life (or work)

The Belief (work-as-imagined)
Systems are well designed and well maintained Procedures are complete and correct Designers can foresee and anticipate every situation People behave as they are expected to - as they are taught
The Reality (work-as-done)

People learn to overcome design flaws and functional glitches People interpret and apply procedures to match conditions People can detect and correct when things go wrong People adapt their performance to meet demands
UNCLASSIFIED
35
A quick example
A questionnaire study of 286 aircraft maintenance engineers found that 34% did not follow the official procedure for a task they just completed. Of these: 45% said there was an easier way 43% said there was a quicker way
UNCLASSIFIED
36
Success lies with the worker
Procedures are resources for action (among other resources) Applying procedures successfully is a substantive, skillful cognitive activity Safety often comes from people being skillful at judging when and how procedures apply
UNCLASSIFIED
37
HPI Anatomy of an Event

Flawed Defenses
Vision, Beliefs, & Values Vision, Beliefs, & Values
on Missi Goals es Polici es ss Proce s am Progr
Event
Initiating Action
Latent Organizational Weaknesses Error Precursors

UNCLASSIFIED
38
Accidents as unexpected combinations of normal variability
Time
UNCLASSIFIED
39
Simple, linear cause effect model

Accidents are the (natural) culmination of a series of events or circumstances, which occur in a specific and recognizable order.
Caused by unsafe acts or conditions Prevented by finding and eliminating possible causes
UNCLASSIFIED
40
Complex, linear cause effect model

Accidents result from a combination of active failures (unsafe acts) and latent conditions (hazards)
Caused by degradation of components (organizational, human, technical) Prevented by strengthening barriers and defenses
UNCLASSIFIED
41
Non-linear accident model

Accidents (and success) emerge from the normal variations in performance
Functional Resonance Accident Model (FRAM) - Erik Hollnagel
Caused by unexpected combinations of normal actions rather than action failures. Solution is to understand the nature of variability (why, when, how) and how to limit it when it can be dangerous
UNCLASSIFIED
42
Module Two:
UNCLASSIFIED
43
In theory, investigations intend to

Determine how the underlying factors that combined to result in the accident Find the latent conditions and organizational weaknesses that led to the human errors Address the conditions that create error likely situations Understand and explain rather than judge and blame
UNCLASSIFIED
44
In practice, investigations almost always:

Focus on bad decisions, inaccurate assessments, and deviation from written guidance Seek evidence of erratic, wrong, or inappropriate behavior Conclude how workers failed to adhere to procedures Conclude how supervision/management failed to prevent the accident Pass judgment and assign blame Name Shame Blame Train (or retrain)
UNCLASSIFIED
45
In practice, causes are often expressed as Worker did not follow (or violated) the procedure Inadequate details in the procedures Inattention or complacency by the involved worker Inadequate training or retraining Inadequate supervision that allowed the error to occur Lack of management attention and oversight
UNCLASSIFIED
46
In practice, corrective actions include Disciplinary action, real or perceived, for the involved worker/supervision Retraining of the involved workers Additional training for all workers Changes in the procedure or more procedures Increase in supervisory/management oversight
Its all about the apples!

UNCLASSIFIED
47
The Bad Apple Theory
Our processes would be fine, were it not for the erratic behavior of some unreliable people (bad apples) AKA: cowboys and buttheads Safety will be achieved when the bad apples are either fixed or eliminated
UNCLASSIFIED
48
Discussion:
Although we believe strongly that we have competent and motivated workers, why do we revert so quickly to a conclusion of bad apples when there is an accident or security event
UNCLASSIFIED
49
Why accident investigations regress into the bad apple theory

Straightforward, simple to understand, and simple to complete Difficult to not be judgmental about seemingly bad performance Emotionally satisfying to punish the guilty The hindsight bias confuses our reality with the one that surrounded the workers Political resistance for probing into sources of failure
UNCLASSIFIED
50
Module Three:
UNCLASSIFIED
51
Three contexts in which we look at accidents:
1. Proximal 2. Retrospective 3. Counterfactual
UNCLASSIFIED
52
Proximal
We tend to focus on those people who were closest to producing or potentially avoiding the accident Rather than recognize weakness in the system, the tendency is to see a localized problem where the people have acted in an irrational manner We tend to ignore the organizational influences on behavior that result from a multitude of conflicting constraints and pressures (be thorough, but also efficient)
UNCLASSIFIED
53
Retrospective
Investigations aim to explain an event in the past, but are conducted in the present As an investigator, you will probably know more about the event than the people involved Because you assessing peoples decisions and actions with hindsight, based on what you know now, you cannot be truly objective about their performance
UNCLASSIFIED
54
Hindsight causes us to oversimplify

We underestimate the uncertainty people felt and do not understand how unlikely the outcome would have seemed We see the sequence of events as a linear progression to the outcome and do not appreciate the multiple pathways that surrounded the people
The next slide is simply amazing
UNCLASSIFIED
55
Solve the maze, then raise maze is to The quickest way to solve theyour hand start from the FINISH and work backwards
UNCLASSIFIED
56
How the people involved saw it before the accident
How the investigator sees it after the accident
UNCLASSIFIED
57
They should have ....

A counterfactual (counter the facts) is a statement of what people should have done instead of what they did do . Examples include: they could have they did not they failed to if only they had With the benefit of hindsight, you can easily see what people could have done to prevent the event But, it is a reality that didnt happen and doesnt help you to understand what did happen
UNCLASSIFIED
58
Counterfactuals are the most prevalent feature of most accident investigations

Excerpts from past investigations Personnel did not follow formal procedures. Management did not effectively respond to precursor events. Management did not eliminate or remove the hazard. Management did not adequately respond to feedback.
UNCLASSIFIED
59
We are not alone, a recent example from the National Transportation Safety Board
On August 27, 2006, Comair flight 5191, crashed during takeoff from Blue Grass Airport, Lexington, Kentucky. The flight crew was instructed to take off from runway 22, but instead lined up the airplane on runway 26 and began the takeoff roll. The airplane ran off the end of the short runway and impacted the airport perimeter fence, trees, and terrain. The captain, flight attendant, and 47 passengers were killed.
UNCLASSIFIED
60
The NTSB Board determined the probable cause(s) of this accident as follows:
The flight crews failure to use available cues and aids to identify the airplane's location on the airport surface during taxi, The flight crews failure to cross-check and verify that the airplane was on the correct runway before takeoff, and The FAAs failure to require that all runway crossings be authorized only by specific air traffic control clearances.
UNCLASSIFIED
61
Why counterfactuals happen

When faced with failure (accident), your first reflex is to seek other failures
Where did people go wrong? What did they miss?
Because we are working backwards with the benefit of a known outcome, we can easily see how they could have avoided the accident The trouble is, this is not how the involved people experienced the accident, and does not explain how failure succeeded
UNCLASSIFIED
62
Developing counterfactuals from the facts

Counterfactuals are most often a theory (i.e. opinion) formed by the investigator Information from and about the event is then used selectively to support these opinions The facts are taken out of context by: Micro-matching comparing behavior with what you know now to be true and finding a mismatch Cherry-Picking selected bits of data that prove a condition identified only in hindsight
UNCLASSIFIED
63
Micro-matching procedures
Investigations invest considerable effort in organizational archeology to reconstruct the regulatory and procedural framework in which the operation took place In hindsight, discrepancies between procedures and practice are easily unearthed But, discrepancies between procedure and practice are common and are not especially unique to the accident circumstances The result is worker did not follow procedures as a cause
UNCLASSIFIED
64
An HPI approach Although we like to appear knowledgeable, interview the workers before reviewing the documents This will help you to understand the context in which they experienced the event Let the worker explain what happened in his own words
UNCLASSIFIED
65
Counterfactuals by micro-matching other standards

Like procedures, other standards of good practice can be found that seem applicable to the situation Then failure to apply the good practice is cited
At least one of the machinists moved the boring bar away from the glovebox gloves prior to donning the cotton gloves. This Good Practice was not included as a step in the work instruction nor was it communicated to all personnel.
The problem is they are usually only relevant with knowledge of the outcome (hindsight)
UNCLASSIFIED
66
Micro-matching other critical info

With hindsight comes knowledge of critical facts that revealed the true nature of the situation The people are then faulted for missing or not acting on the information
.. managers listened to worker feedback, but did not respond. The concern over the difficulty in donning and using the cotton gloves was accepted as a reasonable inconvenience. the direct cause of the injury was the difficulty of donning cotton gloves over glovebox gloves.
But knowledge of what was critical is only obvious in hindsight
UNCLASSIFIED
67
Cherry-picking
Information can be taken out of context by grouping and labeling fragments that, in hindsight, appear to represent a common condition Often the investigator notes a particular fact, develops a theory (opinion), and searches for other evidence to support the theory
The team leader was located at another site The team leader only visited the workers site about once a month
The fragments of information are used to construct a story that explains the cause of the accident
Infrequent management presence led to an inconsistent implementation of safe work practices, methods, and behaviors.
UNCLASSIFIED
68
All is not lost, counterfactuals can be useful

As we try to understand why workers did what they did, a counterfactual can help to provide insight The counterfactual seems obvious to us in hindsight, but that was not the case for the involved workers If we can understand why it was not noticed, why it was not considered important, or why another action (or no action) was seen as a better way to proceed, then we can begin to understand why they did what they did
UNCLASSIFIED
69
Module Four:
UNCLASSIFIED
70
Why do we want to find the cause?

1. Not knowing what caused the accident is really scary 2. DOE (real or perceived) requires it 3. People may simply seek retribution, punishment, or
justice
4. People want to start investing in countermeasures to

prevent the accident from recurring
5. People want to know how to adjust their behavior to

avoid the same kind of trouble
UNCLASSIFIED
71
Like the maze, we search for causes looking backwards

We oversimplify the search for causality What was uncertain working forward, becomes clear working backwards We work backwards with effects preceded by actions, which is opposite of how the people experienced it (actions followed by effects) We look for cause - effect relationships and those preceding actions become the causes
UNCLASSIFIED
72
So, what is a cause?
For our purposes, it is why the accident happened and is expressed in the context of cause and effect.
UNCLASSIFIED
73
Cause and Effect

Cause is inferred from observation, but is not something that can be observed directly Normally, we repeatedly observe action A followed by event B and conclude that B was the effect of A
Cause A
Effect B
Observable
Not Observable (concluded)
Observable
Source: Hollnagel, Erik (2004) Barriers and Accident Prevention

UNCLASSIFIED
74
Cause and Effect

But investigations involve the notion of backward causality, i.e., reasoning from effect to cause We observe event B, assume that is was the effect of something and then try to find out which action A was the cause of it
Cause?
Effect B
Observable
Not Observable (constructed)
Observable

UNCLASSIFIED
75
The problem of backward causation is aggravated by some common mistakes

There is a human tendency to draw conclusions that are not logically valid We tend to use educated guesses, intuitive judgment, or common sense rather than rules of logic The use of event timelines creates sequential relationships that seem to infer a causal relationships Because lots of actions are taking place, there is usually one action before the effect that seems to be a plausible cause
UNCLASSIFIED
76
Requirements for a cause effect relationship
1. The cause must precede the effect (in time) 2. The cause and effect must be contiguous (close) in
time and space
3. The cause and effect must have a necessary and

constant connection between them, such that the same cause always has the same effect
UNCLASSIFIED
77
For example
The first cause of this event was a lack of direct supervision of the worker which resulted in a worker being able to perform work in a manner that was unsafe Is there a cause effect relationship?
The lack of direct supervision preceded the accident The lack of supervision had existed for years
Lack of direct supervision does not always cause work to be performed in an unsafe manner
Is inadequate policing the cause of DUI accidents?

UNCLASSIFIED
78
So once again, what is a cause?

Definitions are hard to come by, but here is one that lays the groundwork: The identification, after the fact, of a limited set of aspects of the situation that are seen as necessary and sufficient conditions for the observed effects to have occurred. The cause, in other words, is constructed rather than found.
- Hollnagel, Erik (2004) Barriers and Accident Prevention
UNCLASSIFIED
79
Bottom Line: Dont Overreach

A true, repeatable cause and effect relationship is almost impossible to find Instead, try to explain how the accident happened while providing the context for the worker actions Although the causal relationships are weak and we can usually identify many factors that contributed to the event Because it is really our opinion, we need to provide enough information that others can draw the same conclusion
Understand and Explain

UNCLASSIFIED
80
WYLFIWYF*
The cause you find usually depends on: where you look, what you look for, who you talk to, what you have seen before, and likely, who you work for It often says more about the investigator than the accident! * What You Look For Is What You Find
UNCLASSIFIED
81
Two official investigations of the same airline crash

One conducted by American Airlines, whose aircraft crashed in the mountains near Cali, Colombia The other by the Colombian civil aviation authority, who employed the air traffic controllers
On December 20, 1995, AA Flight 965 (AA965), a Boeing 757, on a regularly scheduled passenger flight from Miami to Cali, Colombia operating under instrument flight rules (IFR), crashed into mountainous terrain during a descent from cruise altitude. Of the 163 on board, only four passengers survived.
UNCLASSIFIED
82
Causes from different investigations

According to Authority
Air Traffic Controller did not play a role Pilots inadequate use of flightdeck automation Loss of pilots situation awareness regarding terrain and navigation aids Failure to revert to basic navigation when automation created confusion and increased workload Pilots efforts to hasten arrival to avoid delays
According to Airline
Controllers clearances were not in accordance with standards Inadequate language skills and inattention by the Controller Inadequate automation database supplied to computers Lack of radar coverage over area Workload increase because of Controllers sudden instruction to use novel arrival route and different runway
UNCLASSIFIED
83
Categories of cause over time
Equipment & Technology
UNCLASSIFIED
84
Module Five:
UNCLASSIFIED
85
Why barriers?
Re + Md E
reducing errors AND managing defenses lead to zero events
UNCLASSIFIED
86
Types of Barriers Current Categories Better Categories
Physical Administrative
Physical Functional Symbolic Incorporeal
UNCLASSIFIED
87
Physical physically prevents an action from being carried out or an event from happening Containing or protecting - walls, fences, railings, containers, tanks Restraining or preventing movement - safety belts, harnesses, cages Separating or protecting Crumple zones, scrubbers, filters
UNCLASSIFIED
88
Functional impedes actions through the use of pre-conditions Prevent movement/action (hard) locks, interlocks, equipment alignment Prevent movement/action (soft) passwords, entry codes, palm readers Impede actions delays, distance (too far for single person to reach) Dissipate energy/extinguish air bags, sprinklers
UNCLASSIFIED
89
Symbolic requires an act of interpretation in order to achieve their purpose Countering/preventing actions demarcations, signs, labels, warnings Regulating actions instructions, procedures, dialogues (pre-job brief) System status indications signals, warnings, alarms Permission/authorization permits, work orders
UNCLASSIFIED
90
Incorporeal requires interpretation of knowledge in order to achieve their purpose Process rules, restrictions, guidelines, laws Comply/conform self-restraint, ethical norms, morals, social or group pressure
UNCLASSIFIED
91
Evaluation of barrier system quality Effectiveness how well it meets its intended purpose Availability assurance the barrier will function when needed Evaluation how easy to determine whether barrier will work as intended Interpretation extent to which the barrier depends on interpretation by humans to achieve its purpose
UNCLASSIFIED
92
Evaluation of barrier system characteristics
Physical Effective Availability Evaluation Interpretation High High Easy None
Functional High Low - High Moderate Low
Symbolic Incorporeal Medium High Difficult High Low Uncertain Difficult High
UNCLASSIFIED
93
OK, whats the point?

Barrier analysis is one of the cornerstones of accident investigation But we treat every type of barrier as if they were physical and expected to always work The result is many findings involving procedures, rules, training, supervision, oversight, etc. that failed The reality is they were often not very effective in the first place
Be careful not to overreach
UNCLASSIFIED
94
Module Six:
UNCLASSIFIED
95
Sydney Dekkers five steps for reconstructing human error contributions to accidents
1. Lay out the sequence of events and decisions in a
rough timeline
2. Divide the sequence into episodes, if necessary 3. Find out how the world looked or changed during each
episode
4. Identify workers goals, constraints, focus of attention

and knowledge at the time, (i.e., the CONTEXT)
5. Summarize in an explanation, what the workers did

and why they did it
UNCLASSIFIED
96
Event/Decision Charting
This is a variation of the traditional Events and Causal Factors (EC&F) Charting that we developed to incorporate human performance
UNCLASSIFIED
97
Sequence of events
The sequence of events forms the starting point for reconstructing the accident The events include observations, actions, and changes in the process or system. The decisions (before an action) will start to establish the mindset of the worker The goal is to set the framework for how the workers perception unfolded in parallel with the situation evolving around them
UNCLASSIFIED
98
Sequence of Events and Decisions Add add in the DECISIONS, ThenEVENTS and ACTIONS before the actions
UNCLASSIFIED
99
Divide the sequence into episodes, if necessary

Accidents can evolve over a period of time and the goal is to identify how perceptions and mindset change over time Episodes can change when there are: Shifts in behavior Changes in the process Actions to influence the process
UNCLASSIFIED
100
Divide into EPISODES, if necessary
UNCLASSIFIED
101
How the world looked or changed

This step is about reconstructing the event as it unfolded around the worker: find out what their process was doing what information was available Reconstruct how the process was changing and how information about the changes were presented to the workers
UNCLASSIFIED
102
Add in the available INFORMATION
UNCLASSIFIED
103
Workers goals, knowledge, and focus

People have goals. Completion of the task is obvious, but there are other, often conflicting, goals present
Economic considerations, such as safety versus schedule Subtle coercions (what boss wants, not what s/he says) Response to previous situations (successes OR failures)
People have knowledge, but the application of knowledge is not straight forward
Was it accurate, complete and available
Goals & knowledge together determine their focus

Workers cannot know and see everything all the time What people are trying to accomplish and what they know drives where they direct their attention Re-constructing their focus of attention will help you to understand the gap between available information and what they saw or used
UNCLASSIFIED
104
Add in the Workers GOALS & KNOWLEDGE
UNCLASSIFIED
105
Explanation
Provide an explanation of what the workers did and why they did it What was happening with the process What the workers were trying to accomplish and why What they knew at the time Where their attention was focused and why Why what they did made sense to them at the time
UNCLASSIFIED
106
They should have known this was the wrong lift

Accident - At the end of the day, workers used the wrong conveyor lift (wrong size for door) to unload the last truck, resulting in minor damage to the truck.
Old View Cause: Workers knew that it was the wrong conveyor lift, but chose to use it anyway Old View Fixes: Disciplinary action, training & procedure change
UNCLASSIFIED
107
Workers use large conveyor instead of small conveyor to unload front compartment of truck, causing damage
UNCLASSIFIED
108
A: Why did they was in large conveyor instead of the Q: The small oneuse the the remote storage area and they one? smalldidnt want to take the time to get it
UNCLASSIFIED
109
A: Why moved there before the the storage Q: They was theitsmall conveyor in truck arrivedarea?
UNCLASSIFIED
110
A: Why didnt think they would need Q: They did they move it to storage? it
UNCLASSIFIED
111
A: Why had been think they would need it? Q: They didnt theytold the front compartment was empty
UNCLASSIFIED
112
A: But, get did they move it before the truck Q: Theywhy to go home when the last truck is unloaded arrived? and wanted to be ready to leave ASAP
UNCLASSIFIED
113
Finally, when they found out there was cargo in the front, they thought they could use the large conveyor safely
UNCLASSIFIED
114
Explanation based on understanding:

The end of workday was based on the last truck instead of a specific time. The workers went home as soon as it was unloaded. Knowing it was the last truck and having been told there was no cargo in the front, the workers started putting away non-essential equipment. Believing the smaller conveyor was not needed, the workers returned it to the remote storage When the last truck arrived, there was cargo in the front compartment Not wanting to take the time to retrieve the small conveyor, they used the larger conveyor that was still available, believing it would be safe
UNCLASSIFIED
115
Look at the incentive structure If you say they can go home after the last truck, expect them to start packing everything but the bare essentials away before the last truck arrives When confronted with a surprise (unanticipated load), also expect them to improvise with the tools at hand Possible solutions include working to a set time, provisions for overtime pay, and improved information about loads
UNCLASSIFIED
116
How do you know you got it right? You cant The story we write about past performance is always tentative
New information can prove you wrong New interpretations may be better than yours
UNCLASSIFIED
117

Human Performance Based

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Human Performance Based

Uploaded by

Copyright:

Available Formats

UNCLASSIFIED

Human Performance Based Accident Investigation

Operated by Los Alamos National Security LLC for DOE/NNSA

IAEA-TECHDOC-1329 Safety Culture in Nuclear Installations

Managements response to mistakes is more controls, procedures, and training

Punishing versus Learning

The focus of this course is to

Understand the context and explain the event

Credit where credit is due

View from tow plane

View from glider

The question is:

Was this a big accident or little accident?

Sometimes you can walk away ..

Simple event or Complex event?

The Two Views of Human Error

Origins of Human Error

Slip, trip or lapse

Causes based on LANL occurrence data

IAEA-TECHDOC-1329 Safety Culture in Nuclear Installations

Communications between departments and functions is poor

Management encourages interdepartmental and inter-functional communication

Collaboration between departments and functions is good

What does human error really mean?

Action (focus is on the action)

Consequence (focus is on the outcome)

Attention (to task)

Familiarity (w/ task)

Operated by Los Alamos National Security, LLC for NNSA

Unintentional Human Errors (and Violations)

When is an error an error?

When is an error not really an error?

Unintentional Errors and Intended Variations

More sources of performance variations:

People optimize their performance

Time Required Time Available

Lets talk about performance variation?

Goals, knowledge, understanding, focus, etc.

IAEA-TECHDOC-1329 Safety Culture in Nuclear Installations

People are rewarded for obedience and results

People are rewarded for exceeding goals

People are rewarded for improving processes

The facts of life (or work)

The Reality (work-as-done)

Success lies with the worker

HPI Anatomy of an Event

on Missi Goals es Polici es ss Proce s am Progr

Latent Organizational Weaknesses Error Precursors

Accidents as unexpected combinations of normal variability

Simple, linear cause effect model

Complex, linear cause effect model

Non-linear accident model

Functional Resonance Accident Model (FRAM) - Erik Hollnagel

In theory, investigations intend to

In practice, investigations almost always:

Its all about the apples!

The Bad Apple Theory

Why accident investigations regress into the bad apple theory

Three contexts in which we look at accidents:

1. Proximal 2. Retrospective 3. Counterfactual

Hindsight causes us to oversimplify

The next slide is simply amazing

How the people involved saw it before the accident