Download this article - UK P&I Members Area

GETTING TO GRIPS WITHTHE HUMAN FACTOR– an insightThe puzzle that is safety managementand total incident preventionUK P&I CLUB

GETTING TO GRIPS WITH THE HUMAN FACTORThe cost of human errorThe UK Club identified in its first Analysisof Major Claims in 1990 that ‘human error’accounted for 58% of all its claims overUS$100,000. In the years since, despitemarked falls in certain identified causes (forinstance, structural failure), human errorhas remained stubbornly high as the prime cause of accidents and claims.As a consequence, the Club has for some years sought a methodology forboth defining and analysing human error in the maritime context, in thehope of finding ways of tackling this seemingly intractable problem.A close study of the work of researchers at Manchester and LeidenUniversities in the 1990s, on behalf of Shell, has resulted in the Clubadopting their methodology and producing its most complex DVD to-datein order to illustrate the underlying concepts.The DVD No Room for Error graphically illustrates aproven methodology that shipowners can use toidentify the propensity for human error to arise in theirshipping operations. It also gives the Club the tools withwhich to analyse its extensive statistics to show where –and why – human error is most likely to arise.No Room For Error seeks to differentiate between the acts and omissions ofpeople at the sharp end, and latent system faults generated by the culturecreated and the decisions made by those in authority in the shipowner’soffices. Unlike the Club’s previous videos and publications aimed ataddressing trade specific issues, No Room for Error is intended to form partof, or to supplement, a company’s long-term training programme as wellas to stimulate debate within the company aimed at reinforcing the1

GETTING TO GRIPS WITH THE HUMAN FACTOReffectiveness of the ISM Code through the development of a permanentand robust safety and environmental protection culture.Although the DVD can be viewed on its own, and its lessons partiallyabsorbed, the Club has decided to hold a series of intensive one-dayworkshops in Europe and Asia, aimed at assisting Members to deal withthe advanced concepts it contains, to achieve not only a better safetyperformance but also with the aim of reducing the number of all incidentsof whatever nature. The workshops will bring together the latestdevelopments in the fields of safety management and will encourage thedevelopment of a ‘holistic’ approach to safety as opposed to traditionaland often fragmented measures based often on a company’s last majorincident.No Room For Error will be shown as part of the workshop whose broadobjectives will be to:■■■■■Provide guidance aimed at assisting the responsible shippingcompany or ship manager to establish a more effective safetymanagement systemDemonstrate that these same management principles and skillsapply equally to health, environment and reputationAssist the development of a more robust industry-wide health,safety and environmental (HSE) and total incident preventioncultureSupport the effectiveness of the ISM CodeHelp meet the expectations of the UK P&I Club2

GETTING TO GRIPS WITH THE HUMAN FACTORThe workshop will be divided into four modules:1Theneed for safety; safety legislation and operatingprocedures; establishing the HSE trilogy; reputation;total incident prevention; certification; HSEmanagement systems including a ‘state-of-the-art’example and the ISM Code.2Safetyculture; management commitment; ‘open’ and‘no-blame’ reporting; the mythical ‘quick-fix’; the useof HSE ‘road-maps’; performance measurement;understanding statistics and target setting; targetzero and the real cost of incidents of whatever nature.3Definingan accident. An alternative way of lookingat accidents; accident investigation and analysis;proactive safety health checks; understandinghuman error; modifying human behaviour and thetheory of sheep and wolves.4Riskmanagement including health risk assessmentand environmental impact assessments; the ‘hazardsand effects management process’; qualitative versusquantitative risk assessment; use of the ‘riskassessment matrix’; learning from the past; genericshipboard risks; emergency response – recovery from‘the one that got away’ and living near the ‘edge’.3

GETTING TO GRIPS WITH THE HUMAN FACTORMaterial issued at the end of the workshop, intended to ensure that theinterest and momentum generated by the day’s work is not lost, willinclude:■■■■■A copy of all presentation materialThe DVD No Room For Error (video versions can be supplied on request)A No Room For Error contents guideA ‘train the trainers’ guide to HSE managementA copy of the OCIMF Marine Injury Reporting GuideWhile the workshop concentrates on the broadest possible approach tomanaging HSE, rather than attempt to précis its entire contents, thefollowing pages in this booklet offer a brief résumé of parts of the vitalsections on human error and accidents.4

GETTING TO GRIPS WITH THE HUMAN FACTORHuman errorOver the past two decades, there has been a growing appreciation of themany and varied ways that people contribute to accidents in hazardousindustries, or simply in everyday life. Not long ago most of these would havebeen lumped together under the catch-all label ‘human error’. Nowadays itis apparent that this term covers a wide variety of unsafe behaviours.Most people would agree with the old adage ‘to err is human’. Most toowould agree that human beings are frequent violators of the ‘rules’whatever they might be. But violations are not all that bad – throughconstant pushing at accepted boundaries they got us out of the caves!Assuming that the rules, meaning safe operating procedures, are wellfounded,any deviation will bring the violator into an area of increased riskand danger. The violation itself may not be damaging but the act of violatingtakes the violator into regions in which subsequent errors are much morelikely to have bad outcomes. This relationship can be summarised quitesimply by the equation:Violations + errors = injury, death and damageThe resultant situation can sometimes be made much worse becausepersistent rule violators often assume, somewhat misguidedly, that nobodyelse will violate the rules, at least not at the same time! Violating safeworking procedures is not just a question of recklessness or carelessness bythose at the sharp end. Factors leading to deliberate non-compliance extendwell beyond the psychology of the individual in direct contact with workinghazards and include such organisational issues as:■■■The nature of the workplaceThe quality of tools and equipmentWhether or not supervisors or managers turn a ‘blind eye’ in order to getthe job done5

GETTING TO GRIPS WITH THE HUMAN FACTOR■■The quality of the rules, regulations and proceduresThe organisation’s overall safety culture, or indeed its absenceViolations are usually deliberate, but can also be unintended or evenunknowing. They can also be mistaken in the sense that deliberateviolations may bring about consequences other than those intended, as atChernobyl. In this case, out of the seven unsafe acts (active failures)leading up to the explosion, six were a combination of a rule violation andan error (a misventure). Here was a sad and remarkable case in which agroup of well-motivated and exceedingly expert operators destroyed anelderly but relatively well-defended reactor without the assistance of anytechnical failures.The distinction between errors and violations is often blurred but the maindifferences are shown in the table below:ERRORSStem mainly from informationalfactors: incorrect or incompleteknowledge, either in the head or inthe world.They are unintended, and may bedue to, a memory failure (a ‘lapse’)or an attentional failure (a ‘slip’).They can be explained by reference tohow individuals handle information.The likelihood of mistakes occurringcan be reduced by improving therelevant information: training,roadside signs, the driver-vehicleinterface, etc.Errors can occur in any situation.They need not of themselves, incurrisk.VIOLATIONSStem mainly from motivationalfactors. Shaped by attitudes, beliefs,social norms and organisationalculture.They usually involve intended ordeliberate deviations from the rules,regulations and safe operatingprocedures.They can only be understood in asocial context.Violations can only be reduced bychanging attitudes, beliefs, socialnorms and organisational culturesthat tacitly condone non-compliance(culture of evasion).Violations, by definition, bring theirperpetrators into areas of increasedrisk, i.e. they end up nearer the ‘edge’.6

GETTING TO GRIPS WITH THE HUMAN FACTORWhile errors may be simple memory or attentional failures, they can beexacerbated by:Routinisation – the mark of a craftsman whereby the individual becomesso expert at exercising a particular skill, that he/she no longerconsciously thinks about it allowing the mind to wander and theunexpected to happen – drivers who regularly travel the same route tothe station each day suffer from this – ‘am I here already?’Normalisation – the process offorgetting to be afraid – interestinglymost accidents on mountainshappen on the way down from thesummit – only a relatively smallnumber happen on the way up.Intrinsic hazard – no matter how well you defend yourself the dangers‘out there’ never go away – move outside your protective ‘bubble’ andsomething or someone will get you!Creeping entropy – systems, policies and procedures grow old or fail toadjust to changing external factors thus increasing the propensity foraccidents to happen.Murphy’s Law – if it can happen it will happen, but there is also Schultz’Law. Mr Schultz merely said that Murphy was an optimist!The rulesWe have already spoken about breaking the ‘rules’ but what precisely arethey? Basically they are procedures written to shape people’s behaviour soas to minimise accidents. They are, if you like, standards designed to formpart of the system defences against accidents. Defences are installed toprotect the individual, the asset or the natural environment (all ‘objects ofharm’) against uncontrolled hazards and generally appear in two forms:7

GETTING TO GRIPS WITH THE HUMAN FACTOR■■‘Hard’ defences, provided by fail-safe designs, engineered safetyfeatures and mechanical barriers.‘Soft’ defences provided by procedures, rules, regulations, specificsafety instructions and training.‘Soft’ defences are more easily circumvented by people than‘hard’ defences and thus constitute amajor challenge to any safety management systemTo remain totally relevant and to avoid falling victim to ‘creeping entropy’,procedures are continually being amended and updated to cover matterssuch as changed working conditions, new legislation, new equipment andmost particularly, to prohibit actions that have been implicated in somerecent accident. Following an accident how often have you heard people(usually senior) exclaim “and what did the procedures say?” It is a matterof fact therefore that over time these procedural changes becomeincreasingly restrictive yet the actions necessary to get the job donehaven’t changed and often extend far beyondthese permitted behavioural boundaries.Ironically then, one of the effects of continuallytightening-up procedures in order to improvesystem safety is to increase the likelihood ofviolations being committed. The scope ofpermitted or allowable action shrinks to such anextent that the procedures are either routinely violated or violatedwhenever operational necessity demands. In either case, the proceduresare often regarded as unworkable by those whose behaviour they aresupposed to govern. Whereas errors can arise from various kinds ofinformational under-specification, many violations are prompted byprocedural over-specification – a classic own goal you might say!8

GETTING TO GRIPS WITH THE HUMAN FACTORPerformance levelsNow we come to the scientific bit. Error types can be classified at threelevels:■■■At the skill-based level, we carry out routine, highly-practised tasks ina largely automatic fashion, except for occasional checks on progress.This is what people are very good at for most of the time.We switch to the rule-based level when we notice a need to modifyour largely pre-programmed behaviour in line with some change in thesituation around us. This problem is often one that we haveencountered before and for which we havesome pre-packaged solution. It is called rulebasedbecause we apply stored rules of thekind: if (this situation) then do (these actions).The knowledge-based level is somethingwe come to very reluctantly. Only when wehave repeatedly failed to find a solution usingknown methods do we resort to the slow, effortful and highly errorpronebusiness of thinking things through on the spot. Given time, trialand error learning can often produce good solutions. In an emergencyhowever, because consciousness is also very limited in its capacity tohold information, usually not more than two or three distinct items at atime, our brain behaves like a sieve, forgetting some things as we turnour attention to other matters. In addition, we can also be plain scared,and fear (like other strong emotions) has a way of replacing reasonedaction with ‘knee-jerk’ or sometimes over-learned responses.Classifying violationsCase and field studies suggest that violations can be grouped into fourcategories namely: routine violations, optimising violations, situationalviolations and exceptional violations. The relationship of these to both the9

GETTING TO GRIPS WITH THE HUMAN FACTORperformance levels and error types is summarised in the table below withdefinitions following:PERFORMANCE LEVELS ERROR TYPES VIOLATION TYPESSkill-based Slips and lapses Routine violationsOptimising violationsRule-based Rule-based mistakes Situational violationsKnowledge-based Knowledge-based Exceptional violationsmistakesRoutine violations – almost invisible until there is an accident (orsometimes as the result of an audit), routine violations are promoted bya relatively indifferent environment; i.e. one that rarely punishesviolations or rewards compliance – “we do it like this all the time andnobody even notices”.Optimising violations – corner-cutting; i.e. following the path of leastresistance, sometimes also thrill seeking – “I know a better way ofdoing this”.Situational violations – standard problems that are not covered in theprocedures – “we can’t do this any other way”. An excellent exampleconcerns railway shunters: the rule book prohibits shunters fromremaining between wagons when wagons are being connected. Onlywhen the wagons are stopped can the shunter get down betweenthem to make the necessary coupling.On some occasions however, theshackle for connecting the wagons istoo short to be coupled when thebuffers are fully extended. The job canonly therefore be done when thebuffers are momentarily compressed asthe wagons first come in contact witheach other. Thus the only way to join10

GETTING TO GRIPS WITH THE HUMAN FACTORthese particular wagons is for the shunter to remain between themduring the connection. The result can be fatal.Exceptional violations – unforeseen and undefined situations – “nowthis is what we got trained for”. A simple example on an oil-rigillustrates the point: a pair of engineers were inspecting a pipeline. Oneof them jumps into an inspection pit and is overcome by hydrogensulphidefumes. His companion fully trained to handle such situationsraises the alarm but then jumps down to help his partner, whereuponhe too is overcome. Exceptional violations often involve thetransgression of general survival rules rather than specific safety rules.Survivors of such exceptional violations are often treated as heroes.Exceptional violations can also be seen as an exercise of initiative evensometimes provoking reward if, that is, you get away with it!Given that human beings are able to circumvent both controls anddefences with sometimes quite remarkable cunning, the problem can besummed up as follows:●●●Everyone is fallible and capable of bending the rulesAll systems have technical and procedural shortcomingsWhatever you do, there’s always something beyond yourcontrol that can hurt youFinally there is the theory of sheep and wolves. Studies have identified twosorts of people – sheep and wolves. Wolves accept rule violation as a norm,sheep do not. This results in:■■■■Sheep in sheep’s clothingWolves in wolf’s clothingSheep in wolf’s clothingBut the largest group are wolves in sheep’s clothing– they haven’t violated the rules. Yet!11

GETTING TO GRIPS WITH THE HUMAN FACTORAccidentsAn accident or incident is an unplanned chain of events which has, orcould have, caused injury or illness and/or damage to people, assets, theenvironment or reputation. Modern research has shown that the basiccomponents of an accident can be shown as the simple ‘formula’:Uncontrolled hazard + Undefended target =Unwanted event (accident)And that by adding the concept of breached, or missing, controls anddefences a simple accident can be shown diagrammatically:Simple accidentHazardBreached controlAccidentTargetBreached defenceBut accidents are not as simple as this, because usually there are severalbreached or missing controls and defences. More importantly almost allaccidents consist of a series of interlinking ‘events’, in which each eventbecomes either a new hazard or a new target in its own right. In thepresence of further targets or hazards and new and further breaches ofdefences and controls, a second event is created and so on. During12

GETTING TO GRIPS WITH THE HUMAN FACTORaccident investigations it is not uncommon to identify five, six or evenseven interlinking events before the final event or accident becomes areality.The concept of the ‘event chain’ or ‘incident trajectory’ is shown in thediagram below:Simple event chain or incident trajectoryFIRST EVENT SECOND SET OF EVENTS FINAL EVENT(ACCIDENT)HAZARD(ignitionsource)TARGET(flammablematerial)TARGET(operator)EVENT-TARGET(operatorburned)EVENT-HAZARD(fire)TARGET(equipment)HAZARD(ineffectiveaftercare)EVENT(equipmentdamaged)EVENT(partialdisability)Note the original (first) event resulted in a fire. In the presence of two new‘targets’, i.e. an operator and a piece of equipment, the resultant doubleevent led to a badly burnt operator (injury) and damaged equipment (assetdamage). Because the immediate aftercare of the injured operator (first aidor paramedic treatment) was ineffective (new hazard), the operator’sinjuries resulted in a partial disability (final event).Reverting to the simple accident diagram and the ‘formula’ in the text boxon the facing page, if one of the controls or defences had not beenbreached there would not have been an accident. If detected the resultant‘near-miss’ or ‘dangerous occurrence’ could still have been reported,investigated and acted upon as if it were the real thing.13

GETTING TO GRIPS WITH THE HUMAN FACTORActive failures can be viewed as the‘straw that broke the camel’s back’The usual mechanism, whereby controls and defences are breached, is anunsafe act by an individual at the sharp end. Occasionally, they may bebreached by an inherent unsafe condition but these too will invariably havebeen caused by the acts or omissions of people, which may be nothingmore than a simple and unintentional mistake. As has already beenmentioned, such unsafe acts or unsafe conditions are generally referred toas active failures.While active failures are interesting – indeed much can be learnt from them– a lot more can be learnt, and more effective remedial measures put inplace, by addressing the sick camel in the first place.’Conventional’ view of accidentsAccident causation – the ‘conventional view’HazardsUnsafe acts!AccidentsIncidentsLTIs etcSpecificsituationsDefencesConventional wisdom (above), dictates that in order for an accident tohappen, defences of some kind will have been breached, usually by an14

GETTING TO GRIPS WITH THE HUMAN FACTORunsafe act, carried out in a specific situation and in the presence of hazardsof some kind.What changed this long-established view, which as a basis for the newmodel is still correct, was some highly original research sponsored by oneof the oil-majors and carried out at two major universities, one in the UKand one in the Netherlands. The research originally set out to establish therole of the human being in the accident equation but very quicklyestablished an ‘alternative’ theory of accident causation. Because ofthe triangular shape of the basic model of the theory, it became known asthe ‘Tripodian’ view of accident causation. Basically it uses the‘conventional’ diagram shown opposite, but adds a third componentgeneral failure types (GFTs).This ‘alternative’ model of accident causation is shown below:Accident causation – the ‘Tripodean view’ReduceManageGeneralfailuretypes!Hazards!Unsafe actsSpecificsituations!DefencesAccidentsIncidentsLTIs etcLearn from15

GETTING TO GRIPS WITH THE HUMAN FACTORInstead of being reactive,we are becoming proactiveThe research accepts that, properly investigated, there is much in a reactivesense to be learnt from accidents. It also recognises, that unsafe acts oractive failures can be reduced using tools aimed at modifying humanbehaviour. The research suggested that the problem with attempting tolearn solely from active failures is that; (a) there are potentially millions ofthem; (b) they will rarely be repeated in the same way, and; (c) thecircumstances in which they occurred will never be exactly the same. Moreimportantly the research established once and for all that the ‘sick camel’could be made considerably healthier by managing what are called thegeneral failure types (GFTs) of which there are just eleven. Using a medicalanalogy, the GFTs could be considered as the vital organs of the ‘safetybody’. If properly managed in terms of their inherent health or strength,these could actually help prevent large numbers of accidents from everhappening at all. Once again, in medical terms it’s a bit like having a healthyheart and preventing heart attacks, or being vaccinated against pneumoniaor ‘flu – all designed to prevent illness in the first place. Thus rather thanacting in response to an incident we seek instead to act before an incident.The research, delved deep into the causation theory in order to establish aconcrete link between breached defences and controls, and active andlatent failures, thus the Tripod causation model was born – see diagrambelow:PolicymakersLatentfailuresPreconditionsActive failures(incl. unsafe acts)Failed systemdefences/controls! ! ! ! ! IncidentThe interesting point about this model, is that it introduces two newelements into the causation chain. First it provides a linking mechanism,16

GETTING TO GRIPS WITH THE HUMAN FACTORknown as the precondition, though sometimes referred to as the‘psychological precursor’, between the active and latent failures.Preconditionsare the environmental, situational or psychologicalsystem states or states of mindthat promote or directly cause active failuresSecondly, it introduces the policy maker at the very start of the chain, thusillustrating the clear relationship between commitment by the policymakers at the beginning of the chain and the results at the end of the day.No commitment =No effective safety or HSE management systemBy comparing the diagram of the Tripod causation model on the previouspage and the simple accident diagram on page 12, it should becomeIn summary, the Tripod causation theory is based on the premisethat all accidents, of whatever nature, nearly always have multiplecauses. The theory states that active failures, e.g. unsafe acts, do notoccur in isolation but are influenced by external factors, referred toas preconditions. These factors, are themselves routed in failuresfrom elsewhere in the system – latent failures. Latent failures oftenoriginate in decisions, or actions, made remote in time and place bypolicy makers, well away from those at the sharp end. This is not anentirely new concept – other accident causation theories haveidentified ‘immediate’, ‘underlying’ or ‘root’ causes as elements inthe equation. What Tripod does differently is to connect thesecauses to show that latent failures actually encourage active failuresas well as magnifying their consequences.17

GETTING TO GRIPS WITH THE HUMAN FACTORobvious that the link between the two is established through faileddefences (for the target) and failed controls (for the hazard), thus thecombined accident model, known as the Tripod-BETA tree complete withall basic components looks like this:PolicymakersLatentfailures! ! !ActivefailuresHAZARDFailed defenceEVENTTARGETFailed controlPolicymakersLatentfailuresPreconditionsPreconditions! ! !ActivefailuresBearing in mind that any accident consists of a series of interlinking events,a completed accident tree can be exceedingly complex indeed.Active failuresBoth defences and controls are breached by ‘active failures’. Active failuresare the failures close to the accident event that defeat the controls anddefences on the hazard and target trajectories. In many cases, these arethe actions of people, i.e. unsafe acts. Human errors are implicated in atleast four out of five active failures, but human error as we have alreadyseen is a broad term that includes a number of different sources of error.Not all active failures are human actions. Physical failure of controls anddefences also occur due to conditions such as over-stress, corrosion or18

GETTING TO GRIPS WITH THE HUMAN FACTORmetal fatigue. These are often referred to as ‘unsafe conditions’. Havingsaid that, human actions are often implicated as contributory causes to thisform of active failure but they are not, in themselves, unsafe acts. Forinstance, a designer may have failed to identify the need to use a particularhigh-tensile material in a specific circumstance, thus sometime latercausing component failure.Latent failuresAs already mentioned, latent failures are the ‘vital organs’ of the safetyequation. Latent failures are deficiencies, or anomalies, that create thepreconditions that result in the creation of active failures. Management(the so-called policy or decision makers) decisions often involve theresolution of conflicting objectives. Decisions taken using the bestinformation available at that moment prove to be fallible with time. Also,the future potential for adverse effects of decisions may not be fullyappreciated, or circumstances may change that alter their likelihood ormagnitude.The accident-producing potential of latent failures may lay dormant for along time, only becoming apparent when they combine with localtriggering factors – active failures, technical faults, abnormalenvironmental conditions or abnormal system states; some of which eventhe best HSE management systems will have absolutely no control overwhatsoever.Rather than dealing with an infinite number of active failures, it isreassuring to note that there are just eleven latent failures on which towork to ensure absolute good health.A defining characteristic of latent failuresis that they have been present within the operationbefore the onset of a recognisable accident sequence19

GETTING TO GRIPS WITH THE HUMAN FACTORThe eleven latent failures represent the vital organsof the safety equation – failure to ensure their inherentgood health will increase your propensity to have accidentsThe eleven latent failures, which constitute the general failure types (GFTs)are:■■■■■■■■■■■HARDWAREDESIGNMAINTENANCE MANAGEMENTPROCEDURESERROR-ENFORCING CONDITIONSHOUSEKEEPINGINCOMPATIBLE GOALSCOMMUNICATIONSORGANISATIONTRAININGDEFENCESNote that ‘defences’ is the only latent failure specificallyconcerned with safety– the rest are simply good management !PreconditionsPreconditions are the environmental, situational or psychological ‘systemstates’, or even ‘states of mind’, that promote, or directly cause, activefailures. Preconditions form the link between active and latent failures andcan be viewed as the sources of human error. They are best summed up in20

GETTING TO GRIPS WITH THE HUMAN FACTORthe following table which shows the connection between unsafe acts andtypical preconditions.ERROR TYPE DESCRIPTION POSSIBLE CAUSES PRECONDITIONSlip Unintended deviation Attention failure Distraction from taskfrom a correct plan Mis-timing Preoccupationof actionwith other thingsLapse Omission/repetition Memory failure Change in nature of taskof a planned actionChange in task environmentMistake Intended action Sound rule applied in Failure to recognise(rule-based) inappropriate to the inappropriate correct area ofcircumstances circumstances applicationApplication of unsound Failure to appreciate ruleruledeficienciesMistake Erroneous judgement Insufficient knowledge Organisational deficiency(knowledge- in situation not covered or experience – Inadequate trainingbased) by rule immaturityTime/emotionalpressuresRoutine Habitual deviation from Natural human Indifferent operatingviolation required practice tendency to take path environment (no penalties);of least resistance no rewards for complianceExceptional Ad hoc infringement of Wide variety – dictated Particular tasks orviolation regulated practice by local conditions circumstancesnot planned forAct of sabotage Deliberate violation for – –maliciousreasonsThe Tripod causation model can be further expanded to show the variousways of learning from; (a) accidents themselves; (b) from what are calledobserved unsafe acts and; (c) by proactively measuring or assessing thestate of health of the eleven GFTs.21

GETTING TO GRIPS WITH THE HUMAN FACTORThe Tripod incident chain and feedback loopIndicatorsObservedunsafe actsLTIs etcDECISIONMAKERS/ / /SpecificPSYCHOLOGICALsituationENVIRONMENTALGENERALOR SITUATIONAL UNSAFE> FAILURE > >PRECONDITIONS ACTS (active >TYPESOF UNSAFE ACTS failures)Loop 3Loop 2Failure stateprofilingUnsafe act awareness>DEFENCESLocal checks onadequacy ofexisting defences> ACCIDENTSANDINCIDENTS>Loop 1Accident reportsNote that all the improvement loops go straight back to the decision orpolicy makers. Note also, the specific mention of ‘unsafe act awareness’’which is only one of many safety tools aimed at modifying humanbehaviour.The same basic model can be used to find where in the event chainaccountabilities would normally lay, a useful factor to consider whencarrying out accident investigations (see diagram opposite).The research led to the development of two useable tools:a proactive safety (and HSE) health check called Tripod-DELTA anda reactive accident investigation and analysis tool called Tripod-BETA.Tripod-DELTA seeks to measure the inherent health of each of the elevenlatent failures and displays the information as a DELTA Profile.22

GETTING TO GRIPS WITH THE HUMAN FACTORRemember, the primary purpose of an investigationis to establish the facts surrounding an accidentwith a view to preventing possible recurrencesTripod-BETA is a highly disciplined tool, aimed at establishing the totalevent tree and then each of the active and latent failures, plus their linkingpreconditions. The principle differences between a ‘conventional’investigation and an accident investigation carried out in line with theTripod methodology is summarised in the table overleaf.The Tripod causation path shows where to lookFallibledecisionsLatentfailuresBy top leveldecision makersBy line management,designers, plannersPreconditionsActivefailuresBy line managers,supervisorsBy operators,maintenance crews!Systemcontrols anddefencesInvestigationpathAccident23

GETTING TO GRIPS WITH THE HUMAN FACTORTYPICAL ‘CONVENTIONAL’INVESTIGATIONInitial phase usuallyconcentrates on the incidentsite and its immediatesurroundings, gathering factsconcerning the event and itsconsequencesThe next phase of the processexamines the circumstances ofthe incident to identify whathazard management measuresfailed particularly those relatedto procedures. The scope maywiden during this phase toinclude off-site activities.The final phase aims to identifythe underlying causes of theincident very often drawing onsimilar historic events andexperiences sometimes in a veryad-hoc manner.The investigation may includeorganisational arrangements.TRIPOD-BETA ANALYSISInitial phase is similar to the‘conventional’ process but thecore of a Tripod-BETA treedefines the incident mechanismin terms of hazards, targets andconnecting events.Failed, breached or missinghazard and target managementmeasures (controls anddefences) are then added to thecore model in the second phaseof the BETA tree buildingprocess. The result is almost adelta-wing shaped diagram.The final phase is to plot causalpaths against each failed ormissing control or defence i.e.active failures, preconditions,latent failures and decisions bypolicy makers.By identifying latent failures,root causes can then beestablished and addressed.Trainers’ guideThese two sections, Human error and Accidents, are taken from the‘train the trainers’ guide – part of the workshop package (see page 4).For further information, please contact your local UK Club representative.24