Accident Causation

Models

Presented by
Chow Lap-yan

Oetober 2019
Learning Outcomes

1. Deep understanding of Human Factors

2. Understanding of some common accident
causation theories
3. Apply the theories

2
Some history about
Human Factors

3
 Naval aviation accidents

Reference
Wiegmann, D.A., Shappell, S. A., 2003, A Human Factor Approach to Aviation Accident Analysis – The Human Factors Analysis and
Classification System, Ashgate, England. 4
 A view leading to adoption of Human Factors in
aviation
Donald D. Engen, Former Administrator of FAA, 1986:
“We spent over fifty years on the hardware, which is now pretty reliable.
Now it's time to work with people.”

Human Factors

Mechanical Factors

Reference
Monitor, 1986, monthly newsletter for February 5
 Human Factors Study in Aviation Maintenance

Civil Aviation Authority, CAA (2002, p.2):

• It is “the study of human capabilities and limitations in the workplace.”

• It aims to “optimise the relationship between maintenance personnel

and systems with a view to improve safety, efficiency and well-being.”

Reference
Civil Aviation Authority (CAA), 2002, CAP 715 An Introduction to Aircraft Maintenance Engineering
Human Factors for JAR 66, p. 2, UK 6
Headings in Module 9, HKAR-66
 General
 Social Psychology
 Factors Affecting Performance
 Tasks
 Physical Environment Human Factor Disciplines
 Human Performance and
Limitations
 Communication
 Hazards in the Workplace
 Human Error

7
Federal Aviation Administration (FAA), 2008, Aviation Maintenance
Technician Handbook – General, Chapter 14, USA 7
 Goal of Human Factors extended to Health field

WHO (Topic 2, p.2):

“Human factors examines the relationship between human beings and

the systems with which they interact by focusing on improving efficiency,
creativity, productivity and job satisfaction, with the goal of
minimizing errors.”

Reference

World Health Organization, 2009, WHO Patient Safety Curriculum Guide for
Medical Schools, France. 8
 Human Factors Model
used in Aviation
Human is intrinsically unreliable. Human Factor Models
should be designed or adapted to assist his performance
and respect his limitations.

9
 SHELL Model Note: The curved edges
between the Central Liveware
H ardware and the other SHEL blocks
• tools recommend careful match
• equipment between them.
• instrument
• machines

S oftware Central Liveware

• policy E nvironment
• rules & procedures Personal nature • physical
• manuals • Knowledge environment
• Placards (symbology) • Attitudes • social environment
• checklists • Stress

L iveware
Human-human
interactions
• Teamwork
• Communication
• Leadership
Reference • Norms
Hawkins, F. H., 1987, Human Factors in
Flight, Ashgate, U.S.A. 10
SHELL emphasizes on H ardware
the interfaces between • inadequate tools
• inappropriate
Central Liveware and equipment
• poor design for
the other 4 components. maintainability
A mismatch • lack of parts
E nvironment
will set an S oftware • uncomfortable
• impracticable Central Liveware workplace
error procedure • complacency • inadequate
precursor, • difficult to use • lack of knowledge hangar space
• poor lighting
software
which may • time pressure
L iveware
lead to human • lack of
error. supervision
• lack of
communication
• poor relationship
with colleagues
• staff shortage
11
 Central Liveware
• Human Failures

12
When humans cannot perform as expected
this is human failure

13
 Human Information Processing

Reference

Civil Aviation Authority (CAA), 2002, CAP 715 An Introduction to Aircraft

Maintenance Engineering Human Factors for JAR 66, s. 4, UK 14
 Human Information Processing Model

Reference
Civil Aviation Authority (CAA), 2002, CAP 715 An Introduction to Aircraft Maintenance Engineering
Human Factors for JAR 66, s. 4, UK 15
 Information processing
• “Process of receiving information through
the senses,
• analysing it and
• making it meaningful” (p. 12)

Reference
Civil Aviation Authority (CAA), 2002, CAP 715 An Introduction to Aircraft Maintenance Engineering
16
Human Factors for JAR 66, s. 4, UK
 Receptors & Sensory Store
• Receptors (eyes, ears, etc.) receive
physical stimuli, which are stored in
• Sensory Stores
• for up to 2 s.

Reference
Civil Aviation Authority (CAA), 2002, CAP 715 An Introduction to Aircraft Maintenance Engineering
17
Human Factors for JAR 66, s. 4, UK
 Attention
“Concentration of mental efforts on sensory
or mental events” (p. 13)

Reference
Civil Aviation Authority (CAA), 2002, CAP 715 An Introduction to Aircraft Maintenance Engineering
18
Human Factors for JAR 66, s. 4, UK
19
 Clinical Model of Attention:
Component 1: Selective Attention
“ability to maintain a behavioral or cognitive set in the
face of distracting or competing stimuli.” (p. 129)
• Negative example: This driver is easily distracted.

Reference

Sohlberg, M.M., Mateer, C.A., 2001,

Cognitive Rehabilitation, An
integrative neuropsychological
approach, Guilford Press, New York. 20
 Clinical Model of Attention:
Component 2: Focused Attention
“ability to respond discretely to specific visual, auditory or tactile
stimuli.” (p. 128)

Reference

Sohlberg, M.M., Mateer, C.A., 2001,

Cognitive Rehabilitation, An
integrative neuropsychological
approach, Guilford Press, New York.
21
 Clinical Model of Attention:
Component 3: Sustained Attention
“ability to maintain a consistent behavioral response during
continuous and repetitive activity.” (p. 128)
• i.e. maintain attention, often on one task, over long period of
time
• Example: Once you are absorbed in reading, you go on reading.

Reference

Sohlberg, M.M., Mateer, C.A., 2001,

Cognitive Rehabilitation, An
integrative neuropsychological
approach, Guilford Press, New York.
 Clinical Model of Attention:
Component 4: Alternating Attention
“capacity for mental flexibility that allows individuals to shift their
focus of attention and move between tasks having different
cognitive requirements..” (p. 129)

Reference

Sohlberg, M.M., Mateer, C.A., 2001,

Cognitive Rehabilitation, An
integrative neuropsychological
approach, Guilford Press, New York.
23
 Clinical Model of Attention:
Component 5: Divided Attention
“ability to respond simultaneously to multiple tasks” (p. 129)

Remarks:
• Indeed, one task suffers at the expense of the other

Reference

Sohlberg, M.M., Mateer, C.A., 2001,

Cognitive Rehabilitation, An
integrative neuropsychological
approach, Guilford Press, New York. 24
 Perception
Attention via Priming
• Process of assembling sensations into a
useable mental representation of the
world,
• i.e. transform sensory data into information

Reference
Civil Aviation Authority (CAA), 2002, CAP 715 An Introduction to Aircraft Maintenance Engineering
25
Human Factors for JAR 66, s. 4, UK
26
 Decision Making
• Generation of alternative courses of action
and select one preferred option.

Reference
Civil Aviation Authority (CAA), 2002, CAP 715 An Introduction to Aircraft Maintenance Engineering
27
Human Factors for JAR 66, s. 4, UK
A case for Decision Making

28
A flight simulation

29
Decision Options

Option A: Go straight to Teterboro Airport

Option B: Go back to La Guardia Airport
Option C: Land on Hudson River

The fact: Findings from Simulations:

 7 / 13 simulated returns to La
Guardia succeeded.
 1 / 2 simulated flights to Teterboro
succeed.
30
Take the time: from bird strike to final decision

31
 Motor Programmes
• If a task is always performed,
• it may become automatic and the required
skills and actions are stored in long term
memory.
• This programme reduces the load on
Central Decision Making.

Reference
Civil Aviation Authority (CAA), 2002, CAP 715 An Introduction to Aircraft Maintenance Engineering
32
Human Factors for JAR 66, s. 4, UK
 Situation Awareness
• “Synthesis of an accurate and up-to-date ‘mental
model’ of
• one’s environment and state, and
• the ability to use this to make predictions of
possible future states.” (p. 16)

Remark:
• This can be improved by feedback loops

Reference
Civil Aviation Authority (CAA), 2002, CAP 715 An Introduction to Aircraft Maintenance Engineering
33
Human Factors for JAR 66, s. 4, UK
Situation Awareness
What is happening?
What has happened?

Situational
awareness

What will happen?

34
 “Failure” means fail to
meet expectations.

Then, as human, what are

the expectations?

35
 YOU must pay
attention before U
can perform
36
Skill-based Performance

37
Rule-based Performance

38
Knowledge-based Performance

39
3 Human Performance Levels

Remark:
• The 3 performance levels are not mutually exclusive
40
Skill-based Performance
• Automatic control of routine tasks,
• involves practised physical actions
• in very familiar situations

• Such actions are usually executed from

memory without significant conscious
attention
• e.g. keyboarding

41
Rule-based Performance
• Apply pattern-matching rules or solutions
to trained-for problems

• Apply this when there can be anticipated

changes, i.e. If-then logic
• e.g. follow traffic rules

42
Knowledge-based Performance
• Conscious, slow, effortful attempts to
solve new problems

• e.g. decide what to do when you hear the

radio broadcasting a traffic jam ahead

43
Maladaptive Behaviour
1. Applying conscious thought to highly routine situation, or
e.g. pay attention to finger movement during typing, or

2. Applying automatic response to novel situation

e.g. type on non-qwerty keyboard

Maladaptive
behaviour

Maladaptive
behaviour

44
 Central Liveware
• Expected right performance or
action (maybe hindsight)

Central Liveware
• Human Failure

Central Liveware
• Actual unsafe action or non-
action (omission)

45
Types of Human Failures – Failure Taxonomy

Reference
Health and Safety Executive, 2007, Development of a working model of how human
factors, safety management systems and wider organisational issues fit together, UK 46
Human Failures – 2 types
• Errors
– Slips (skill-based errors)
– Lapses (skill-based errors)
– Mistakes (either rule-based or knowledge-based errors)

• Violations
– Routine (corner-cutting) violations
– Exceptional violations
– Situational violations
– Thrill seeking or optimizing violations

47
Slips and Lapses

• Skill-based errors:
• Correct intention, but with incorrect action
Slips
– Arise from inattention
– e.g. type wrong key occasionally

Lapses
– Arise from failures of memory
– e.g. forget to bring along your home key
Remarks:
• This error cannot be eliminated by just training
• Better prevented by designed out
• Chance for this error is less than 1/10,000 in US nuclear power industry
48
Mistakes
• A decision error
• Actions go as planned,
but the plan is already wrong
• e.g. In a closed workplace, normally there is a rule
of “No drinking in workplace”. Now, the workplace
is changed to outdoor workplace in hot summer.
But the management still adopts the rule. This is a
mistake of applying rule wrongly in achieving the
goal of reducing
Rule-based Mistakesheat stress in workplace.
– Apply wrong rule
Knowledge-based Mistakes
– when run out of ready-made solutions and have to deal with novel circumstances

Remarks:
• Chance for rule-based mistake is about 1/1,000 in US nuclear power industry
• Chance for knowledge-based mistake is about ½ to 1/10
49
Human Performance Error Rate Pyramid

Error

Knowledge Based Actions

Rule Based Actions

Skill Based Actions

Referring to the statistics in the US nuclear power industry

50
What error is displayed by the girl?

51
What error will be displayed by Capt
Sullenberger if he lands on Teterboro?

Option A: Go straight to Teterboro Airport

Option B: Go back to La Guardia Airport
Option C: Land on Hudson River

52
 Violations
Deliberate deviation from an expected behaviour, policy, or
procedures:
• Routine (corner-cutting) violations
– follow path of least effort between 2 task-related points
• Situational violations
– Non-compliance is seen as essential in order to get job done
– Arise from a mismatch between work situations and procedures
• Thrill seeking or optimizing violations
– Optimise personal rather than strictly function goal
• Exceptional violations
– when something goes wrong in unpredicted circumstances, esp.
during emergency

Reference
Reason, J., 2008, The Human Contribution - Unsafe Acts, Accidents and Heroic
Recoveries, Ashgate, England 53
What will be the type of violation if
stepping stool is not available?

54
What is the type of violation if a captain rushes to
rescue without putting on breathing apparatus?

55
Human Performance Model vs Failure Taxonomy

Maladaptive
behaviour

Maladaptive
behaviour

Maladaptive
behaviour

56
Example of Rule-Based Mistake

Error-likely error
error precursors
Situation
3-pointer altimeter
H ardware action
• confusing equipment
A civil aircraft pilot error
reads the altimeter
Reads the
during his leisure
wrong altitude
Central Liveware private flight
• lack of
knowledge
• lack of
experience
• complacency

57
Example of
Situational
Violation

Error-likely Move meal cart during turbulence

action
Situation Serve meals
error
Serve meals during
error precursors continuous turbulence

S oftware Central Liveware E nvironment

• impracticable • worrying of • turbulence
procedure customer complaint • time pressure
58
Example of Lapse

Error-likely Situation
error precursors
In the U.S., sterile cockpit is enforced by
law.
Central Liveware
• concentrated
cockpit crew action error
A civil aircraft pilot
starts to fly Leaves cabin
L iveware crew on ground
• lack of communication
with cabin crew

59
 Error-likely Situation
(also known as error traps)

• “A work situation in which there is greater chance for error

when performing a specific action or task in the presence of
error precursors” (Dorner, 1996, cited in DoE, p. 2-30)

• An error-likely situation — an error about to happen —

typically exists when the demands of the t ask and its w ork
environment exceed the capabilities of the i ndividual(s) or the
limitations of human n ature. (Reason, 1998, cited in DoE, p. 1-15)

Reference
Department of Energy (DoE), 2009, Human Performance Improvement Handbook, Volume 1: Concepts and Principles, U.S 60
 Reason’s original model in 1980s,
concept analogous to Swiss Cheese
Focus on that
 ‘precursors’ and ‘unsafe acts’ as holes through which an accident
trajectory could pass

NB: All the holes need to line up

before the accident comes,
i.e. no single failure will result
in the accident

Reference
Reason, J., 2008, The Human Contribution Unsafe Acts, Accidents and Heroic Recoveries, pp. 97-98, Ashgate, England. 61
 Reason’s comprehensive model in early 1990s
 A complete picture NB: This is equivalent to
 linking organisational factors and defences Error-likely Situation
introduced in previous PPT

NB: The defences

NB: Later, he called this come from organisation
Reference Human Error Pathway
Reason, J., 2008, The Human Contribution Unsafe Acts, Accidents and Heroic Recoveries, pp. 98-99, Ashgate, England. 62
 Australian Defence Aviation adapts
Reason’s comprehensive model

Reference
Australian Defence Force, 2017, Australian Defence Force – Aviation Safety Occurrence Investigation, Quick Reference Guide – AL6 63
 Organisational Weaknesses
Latent organisational weaknesses are
 hidden deficiencies in management control processes1
or values2 that can provoke errors (precursors) and
degrade the integrity of controls (flawed controls).

1. Management control processes: e.g. strategy, policies,

work control, training, and resource allocation
2. Values: e.g. shared beliefs, attitudes, norms, and
assumptions
(Reason, 1998, cited in DoE, p. 1-15)
 This means though “to err is human”, organisation can try
to control and prevent the error from coming into accident
or not to provoke the error precursors. (Fenkins, 2019)

Reference
Department of Energy (DoE), 2009, Human Performance Improvement Handbook, Volume 1: Concepts and Principles, U.S 64
What error displayed by the girl?

65
66
Application of Reason’s Model Someone broke
the plate

Victim walks
towards a tilted The plastic plate
broken plate not strong enough
for long time use

Victim not aware of Broken plate not

the tilted plate discovered
Inadequate
design Victim steps on Neither warning sign
the plate nor barrier around
No general A deep pit
Victim falls Victim falls
inspection below the plate through the plate
Broken
into pit
plate

Error likely situation

67
Case – Wall Plastering Machine
 Victim’s foot trapped in rotating screw of the pump
 His foot was crushed and needed to be
amputated
 Metal grid for the screw feeder not found

Steel sieve Mortar gun

Hose
Mortar mixer

Chute
Metal grid
Motor (fixed guard) Feeding hopper
Screw feeder
Mortar pump

68
What is the cause?

69
Present the case by FTA

70
71
An old causation theory:
Heinrich’s Domino Model

72
Heinrich’s Domino Model

Unsafe act and …physical

Ancestry and Social

ial
Fault of Person
oc
Environment

d S
an
try nt

Accident
s
ce me rson
An iron Fault of Pe

hazard

Injury
n v
E

The five factors in accident sequence

(Heinrich, Industrial Accident Prevention, 1931)

73
A sample of accident report form adopting Heinrich’s Domino Model

74
Recommendation
 Give only 1 recommendation to prevent
recurrence of the Wall Plastering Accident

75
FTA of the case
The casualty’s foot trapped in the screw feeder

and

Exposed and rotating screw feeder The casualty stepped on the screw pump

and or

The fixed guard was removed Power to the screw pump was not cut off Injured’s
unsafe act of Limited
stepping on work
pump space
or or

Injured’s
Someone's unsafe act of Machine
Removed for the not cutting off
unsafe act malfunction
purpose of power
cleaning the
Screw Pump

76
Another Causation Theory:
Extension of Domino Model

77
Bird & Loftus Domino Model
Lack of Basic Immediate Incident: Loss:
Control: Causes: Causes:

Inadequate Personal Substandard

system factors acts /practices

Inadequate Job/ Substandard Events Unintended

standard system conditions harm or
factors damage
Inadequate
compliance

Pre-contact Contact Post-contact

Theory (Bird et al, 1976, Loss Control Management):

Lack of control by management permits the basic causes, that
lead to immediate causes, which are the proximate causes of
the accident, which results in the loss. 78
Types of Unsafe Acts and Unsafe Conditions
(source: ANSI Z16.2)
Unsafe Act
Operating without authority
Failure to warn or secure
Operating at improper speed
Making safety devices inoperable
Using defective equipment
Using equipment improperly
Failure to use protective equipment
Improper loading or placement
Improper lifting
Taking improper position
Servicing equipment in motion
Horseplay
Unsafe Condition
Inadequate guards or protection
Defective tools, equipment, substances
Congested work areas
Inadequate warning system
Fire or explosion hazards
Substandard housekeeping
Hazardous atmospheric conditions
Excessive noise
Radiation exposures
Inadequate illumination or ventilation
 
 
79
 Reference for Personal Factors and Job Factors: Basic
Basic
Causes:
Causes:
Prevalent Error Precursors
(listed in order of influence) Personal
Personal
factors
factors
T ask Demands I ndividual Capabilities
• Time pressure (in a hurry) • Unfamiliarity w/ task / First time Job/
Job/
• High Workload (memory requirements) • Lack of knowledge (mental model) system
system
• Simultaneous, multiple tasks • New technique not used before
factors
factors
• Repetitive actions, monotonous • Imprecise communication habits
• Irrecoverable acts • Lack of proficiency / Inexperience
• Interpretation requirements • Indistinct problem-solving skills
• Unclear goals, roles, & responsibilities • “Hazardous” attitude for critical task
• Lack of or unclear standards • Illness / Fatigue
W ork Environment Human N ature
• Distractions / Interruptions • Stress (limits attention)
• Changes / Departures from routine • Habit patterns
• Confusing displays or controls • Assumptions (inaccurate mental picture)
• Workarounds / OOS instruments (Out Of Service) • Complacency / Overconfidence
• Hidden system response • Mindset (“tuned” to see)
• Unexpected equipment conditions • Inaccurate risk perception (Pollyanna)
• Lack of alternative indication • Mental shortcuts (biases)
• Personality conflicts • Limited short-term memory

Reference
Department of Energy (DoE), 2009, Human Performance Improvement Handbook, Volume 1: Concepts and Principles, p. 2-32, U.S
80
FTA added with a
causation theory:
Management Oversight
Risk Tree (MORT)

81
Reference
• http://www.nri.eu.com
82
Top Events

83
Specific Control Factors

84
Management Control Factors

85
MORT
 Logic tree format with long series of
interrelated questions
 Based on the concept that
 Mishap occurs because of oversights and
omissions in
 Specific Control Factors, and
 Management system factors
 For Specific Control Factors, energy
barriers and controls are stressed
 For Management System Factors, the
oversight may be due to policy,
implementation or risk assessment
86
Implications from MORT
 Behind the analysis tool,
 we have accident causation theory in mind
 or in other words, our own perspective of
how accident happens

87
Energy Theory applied
to traffic accident

88
Energy Transfer Theory
Gibson (1961)

 Injury could only be caused by an

interchange of energy

89
Using Energy Theory to
explain accident potential

90
Intersection of Shau Kei Wan Road and Chai Wan Road

Aldrich Street

a st
S t reet E
i n
i Wan Ma
Ke
Shau

Bus

an Road
Kei W
Shau
Flyover

Chai Wan Road

Chai Wan Road

eet
Str

Pedestrian
n

Bridge
Ma
Oi

91
An over-speed bus on the wet steep Chai Wan Road

92
A pedestrian ran across the junction without using the bridge over

93
The bus lost control and …

94
Using Energy Theory to
prevent accident

95
Haddon’s 10 Strategies for road traffic injury
prevention (1970)
Pre-event:
1) Prevent the marshalling of the form of energy
2) Reduce the amount of energy marshalled
3) Prevent the release of the energy
Event:
4) Modify the rate or spatial distribution of release of the energy from its source
5) Separate in space or time, the energy being released from the susceptible
structure
4) Separation by interposition of a material “barrier”
7) Modify the contact surface, substrate or basic structure
8) Strengthen the structure, living or non-living
Post-event
9) Move rapidly in detection and evaluation of damage that has occurred or is
occurring to counter its continuation or extension
10) Measures falling between the emergency period and the final stabilization of the
process

96
1. Prevent formation of energy

97
2. Reduce amount of energy

15

98
3. Prevent release of energy

99
4. Alter release of energy

100
5. Separate energy in time or space

101
6. Separate by a barrier

102
7. Modify the contact

103
8. Strengthen structure or resistance

104
9. Detect quickly

105
10. Emergency and stabilization

106
 10. Emergency and stabilization
If it is not about life or death, DON’T move the victim in traffic accident or
falling case

107
Applications of Accident
Causation Theories
 The previous accident causation models show
different perspectives of looking into accidents

 Though different perspectives, structured

perspectives support the logic for making
effective recommendations

 But the application of which model depends on

the nature of accident

 The models also help in formulating accident

prevention strategies

108
Combination of Theories:
Energy Theory +
Epidemiological Model

109
Epidemiological Model

110
Suchman’s Epidemiological Model

Predisposing Situational Accident Accident

Characteristics Characteristics Conditions Effects

Susceptible host Risk-taking Unexpected Injury

Hazardous Appraisal of hazard Unavoidable Damage

environment
Margin of error Unintentional
Injury-producing agent

Suchman’s Epidemiological Model, 1961

111
 Eg: Hadon’s Matrix (risk factors) for
construction vehicles

Phases Host Agent / Equipment Environment

Pre-event Unsafe behaviour of stakeholders Failed brakes, missing lights, lack of Congested road, narrow shoulders,
such as banksmen, signalers and warning systems rough road, dusty environment, poor
drivers weather, no traffic control
Event Failure to use PPE, such as Failed seat belt, dirty reflective vest, No effective road barrier, collapsing
safety belt, reflective vest, unsafe no FOPS, no ROPS road, falling object
behaviour of other road users
Post-event Do not know how to do or run Fuel leakage, fire No emergency procedure, no
away emergency drill, poor communication
system

112
 Eg: Hadon’s Matrix (protection factors)
for construction vehicles

Phases Host Agent / Equipment Environment

Pre-event Banksman, Signaller, Driver:
Good performance record,
good health status, trained,
licensed
Event Use of PPE, defensive driving
Post-event Emergency response
Planned maintenance for vehicles,
compliance test
Good bumper, vehicle with ROPS,
FOPS
Accident notification system, fire
extinguisher standby
Site traffic regulations, properly
controlled traffic, environment with
good visibility, adequate traffic
control signage
Installation of guiderails
Emergency procedure, emergency
drill, emergency team

113
Another common local
perspective:
Safe System of Work

114
Safe System of Work
 “Safety Systems of Work” is a formal safety
procedure resulting from systematic
examination of a task in order to identify all
the hazards.

 The systematic
examination can be
considered as a risk
assessment.

Labour Department, 1990

115
5 Steps to Safe System of Work
 Assess the task
 Identify the hazards

 Define safe methods

 Implement the system

 Monitor the system

116