1. What is the Science of Human Performance?
The Environment
System Display Component
Human Sensory Component
What is the Science of Human Performance?
System Process Component
Human Cognitive Component
The science of human performance analyzes the relationship between human beings and the system and environment in which they work. To do this be breakdown this relationship into its various components:
Human Sensory
Human Cognitive
Human Musculoskeletal
System input Device
System Process
System Display
These components are analyzed within the context of the operational environment. This model depicts information transfer points between a user and a system .
System Input Device Component
Human Musculoskeletal Component

2. Human Sensory Component
Vision
Hearing
Smell
Taste
Touch
The human sensory component is comprised of the five basic senses.
Vision
Hearing
Smell
Taste
Touch
The purpose of these senses is to detect changes in the environment. The sensitivity of these senses can vary greatly between individuals. These senses can also be significantly impacted by materials ingested by the individual (i.e., alcohol, medicine, drugs, food, etc.), by environmental or physical conditions, and by the individual’s level of alertness.
Let’s look at a cell phone for example.  A ring tone alerts a person that they have an incoming call and displays a caller id.

3. Human Cognitive Component
Attention
Memory (Short and Long Term)
Information Processing
Decision Making
Action Initiation
The human cognitive component processes incoming environmental information.
Places that information into memory.
Processes the information by comparing it to old information stored in memory.
Make a decision regarding the information received.
Initiates action by sending signals to the musculoskeletal component.
Hearing the ring tone the human cognitive component system receives this new information, places the information into memory, compares this environmental change to old memories, recognizes it as an incoming call on the cell phone and connects the sound to a desired response or reaction.
Note: Due to the limited capacity of the human cognitive component the human in the picture is now using most of her capability to respond to the stimuli of the ringing phone, hence decreasing her ability to recognize changes in the environment – loss of situational awareness.

4. Human Musculoskeletal Component
Motor Coordination
Action Performance
Object Manipulation
The cognitive component makes the decision on the appropriate course of action and controls the motor coordination of the musculoskeletal component to perform an action and manipulate the object in order to retrieve the phone and press the answer button.

5. Machine Input Device Component
Receives Input via
Sensors
Controls, Switches, levers
Keyboard, Mouse, Trackball
Touch Screen
Voice
The machine (cell phone), no matter how “smart” is still dumb. It only response in a pre-programed manner. It may have very sophisticated sensors, control keyboard, touch screens, or voice recognition, but it’s still dumb. When the human musculoskeletal component pressed the answer button the device receives an input which it is pre-programed to send to the machine process component. It doesn’t think about it. It just responds.

6. Machine Process Component
Process Data
Performs Programmed Procedures
Stores Data
Retrieves Data
Transmits Response
The device’s input signal is received by the machine processing component. It doesn’t think about it. It simply responds via its programing to connect the call and sends a signal to the display component.

7. Machine Display Component
Display Response
Visual
Auditory
Tactile
The machine processing component then updates the machine display component to indicate the system’s current status. In the case of the cell phone example the display indicates that the call has been connected and the system is ready for the next human response.
The human’s sensory system detects the change in the environment by receiving the output from the machine display and the process continues.

8. Human Component Humans are better than Machines in: Sensory Functions
Perceptual Abilities
Stimulus Generalization
Abstract Concepts
Flexibility
Ability to Improvise
Ability to adapt to new situations
Judgment
Selective Recall
Inductive Reasoning
Remember we said that no matter how sophisticated a machine is, it is still dumb. It can’t think in the same manner as humans.
HUMANS SURPASS MACHINES IN:
Ability to detect small amount of visual and acoustic energy and to perceive patterns of light or sound. How many of you recognized the stick figure as being a human being even though it looks nothing like a human being? Interestingly, humans can not look at figures like this without seeing a human being. Do you see this person as a man or a woman? Is it happily waving or angrily shaking its fist? Those questions delve into your perceptions based on your memories, experiences, and biases.
The ability to generalize stimuli, such as knowing the effects of poison ivy developing the wisdom of staying away from plants with three leaves. The ability of abstract thoughts that lead to innovations and creativity.
Ability to improvise and to adapt to new situations. NOTE: This is a blessing and a curse.
Ability to exercise judgment.
Ability to store very large amounts of information for long periods and to recall relevant facts at the appropriate time.
Ability to reason inductively.
Black birds are black.
This is a black bird.
Therefore, this bird is black.

9. Machine Component Machines are Better Than Humans in: Alertness
Speed and Power
Sensor Detection Outside Human Range
Routine Work
Short-term Memory Storage
Simultaneous Activities
However, machines do have some advantages.
MACHINES SURPASS HUMANS IN:
Ability to respond quickly to control signals, and to apply great force smoothly and precisely. Humans first have to recognize an environmental change before they can begin to process the change, decide what it means, decide what to do about it, and begin to react.
Ability to perform repetitive, routine tasks with precision and without getting bored.
Ability to store information briefly and then to erase it completely.
Ability to reason deductively, including computational ability.
Ability to handle highly complex operations--to do many different things at once.

10. Learning from Accident Investigations
The Environment
System Display Component
Human Sensory Component
Learning from Accident Investigations
System Process Component
Human Cognitive Component
Let’s look at the title of this slide for a moment: Learning from Accident Investigations.
Isn’t that the only true purpose of an investigation – to learn “Why” the accident occurred so like accidents can be prevented? Just keep that in mind as we proceed.
So how does this help us understand human factors when we investigate and analyze information about accidents and incidents? Before we can answer that question we must look at how most accidents and incidents are investigated and analyzed today.
For a moment let’s assume an accident was caused by an engineering or mechanical problem. A traditional investigation would demand a thorough evaluation of each component that failed, and a comprehensive timeline on the sequence of component failures. This process would work backwards through sequences until the first component to fail was discovered. A complete analysis of that component would then be conducted to determine “why” that specific component failed: design inadequacies, material defect, manufacturing flaw, etc.
System Input Device Component
Human Musculoskeletal Component

11. Structure of typical engineering/design flaw investigation
System-based Approach using a systematic method
When an accident occurs as the result of a mechanical failure a broad investigation is usually initiated. As the investigation proceeds the scope narrows to a particular sub-system; then to a specific component. Whatever component failed is then submitted to rigorous inspection and testing. If the cause was a broken rail, wheel, or other component part metallurgical tests and even electron microscopithy may be conducted. If it is a relay or electronic device laboratory testing of the devices operating characteristics may be conducted. All this is part of a well structured engineering investigation. By design, engineering investigations are system-based and use a systematic approach.
So what would the structure of an engineering flaw investigation look like? Let’s start with a mechanical failure and follow it through the investigative process.

12. Corrective Actions and Prevention ACCIDENT INVESTIGATION
RESEARCH SPONSORS
FRA and rail industry provide funding for research programs.
Research programs are needs-based and data-driven. Corrective actions are therefore very effective.
Effective
Corrective Actions and Prevention
Programs
Data-driven
Research
Prevention
Catastrophic failures are infrequent events.
When failures do occur, they are often less severe or hazardous due to effective corrective action programs.
MECHANICAL FAILURE
Mitigation
Highly sophisticated techniques and procedures.
Information is objective and quantifiable.
Effective at determining “why” the failure occurred.
ACCIDENT INVESTIGATION
Designed around traditional categories.
Variables are well defined and causally related.
Organization and structure facilitate access and use.
ACCIDENT DATABASE
Traditional analysis are clearly outlined and readily performed.
Frequent analyses help identify common mechanical and engineering issues.
DATABASE ANALYSIS
Accident
In engineering and designing systems there are many principles and guidelines to assist in building safe subsystems and components. However there are three forces that impact engineering design: human error, economics, and unknowns. Human error (use phasers on stun story). Economics: pressure to do things faster, cheaper, better – You can usually only do two out of three. The unknown – going where engineering has never gone before.
Unfortunately, we usually discover these engineering and design faults only after a failure occurs. If we are luck the consequences of the failure will be inconsequential; if not we will have an accident to investigate. Accident investigation is the lest cost-effective method of organizational learning, but sometimes it’s the only method available.
In seeking answers to a mechanical caused accident we find that by using sophisticated techniques and procedures we can often develop objective and quantifiable information that is effect in telling us “Why” the accident occurred. The investigation usually begin with the system as a whole; then determines the subsystem that failed; the isolates the specific component that failed. The process is very systematic: Identify, Analyze, Sectionalize, Isolate.
This information is then generally entered into a well-structured database whose variables are well defined, causal related, and ease to access.
Traditional analytical processes are then used to identify common mechanical and engineering issues.
As issues are identified the FRA, AAR, AREME, and other industry partners sponsor research to resolve the issue. This research is directly driven by the accident investigation data.
Because the research is data-driven the corrective action(s) are effective in eliminating or mitigating the issue.
An example of this type of scientific approach would be the Southern U1 wheel ban of After several derailment had been determined to have been caused by broken wheels an analysis found that all the wheels were high carbon cast wheels manufactured by the southern Wheel company. On March 27, 1978, the FRA issued Emergency Order No. 7 which required inspection of all cars equipped with high carbon cast wheel and the removal all of this type of wheel by December 31, 1978.
No doubt this type of scientific approach saved countless derailments.

13. Learning from Accident Investigations
The Environment
System Display Component
Human Sensory Component
Learning from Accident Investigations
System Process Component
Human Cognitive Component
In contrast, human factor accident generally are much less structured, if they are structured at all. Like other accident investigations they begin with determining “What” happened. But unlike engineering/mechanical investigation that proceed towards determining “Why” the accident occurred, most human factor accident investigations migrate towards determining “who” is responsible. Once the “Who” question is answered the investigation is considered complete.
System Input Device Component
Human Musculoskeletal Component

14. Structure of typical human factors investigation?
Person-based Approach
using a linear method
Premise for discussion:
Humans are not perfect and will err.
Systems are designed, controlled, and operated by humans.
Ergo, systems are not perfect and will fail.
This premise is general ignored in a human factors investigation. Rather, once it has been determined that the accident was caused by a human factor the investigation defaults to a person-based approach and a more linear model as opposed to the systemic model. This linear modal attempts to “connect the dots” on a time line working backwards until the last human error before the accident occur is found. The investigation then determines that this dot on the timeline was the cause of the accident and whoever that dot represents is responsible for the accident. Systemic issues are rarely examined in these type of accidents because the system is considered to be “perfect”.
“To err is human.”

15. ACCIDENT INVESTIGATION
Error occur frequently and are the major cause of accidents.
Few safety programs are effective at preventing the occurrence or consequences of these errors.
HUMAN ERROR
Less sophisticated techniques and procedures.
Information is qualitative and elusive.
Focus on “what” happened but not “why” it happened.
ACCIDENT INVESTIGATION
Not designed around any particular human error framework.
Variables often ill-defined.
Organization and structure difficult to understand.
ACCIDENT DATABASE
Traditional human factors analysis are onerous due to ill-defined variables and database structures,
Few analyses have been performed to identify underling human factors safety issues.
DATABASE ANALYSIS
Accident
Human error occurs frequently and are a major cause of accidents. Traditional safety programs which depend on Engineering, Education, and Enforcement have taken us to a new level of safety, but as we entered the 21st century industry safety performance plateaued. Compared to 30 or 40 years ago industrial safety is much improved, but not getting better. This is in part due to the manner and methods used to investigate human factor accidents. Achieving a new level of safety requires a new paradigm in how we approach safety. That new paradigm, while requiring a continued focus on Engineering, Education, and Enforcement, must also include Ergonomics, Empowerment, and Evaluation.
Following an accident investigators are generally saddled with less sophisticated technologies and procedures for developing the sequence of human factor events, hence they tend to focus on “What” happened and “Who” did it, rather than the “Why” it happened. Therefore, information regarding the “root causes” of the accident remains elusive.
Informational databases regarding human factors are generally ill-defined, ill-structures, and difficult to understand.
Attempting to extract meaningful data from these databases can be very frustrating. Take for example the FRA Train Accident Database for human factors.

16. TRAIN OPERATIONS – HUMAN FACTORS BRAKE, USE OF
Improper operation of train air connections (bottling the air) Failure to properly secure engine(s) (railroad employee) Failure to properly secure hand brake on car(s) (railroad employee) Failure to release hand brake on car(s) (railroad employee) Failure to apply sufficient number of hand brakes on car(s) (railroad employee)
Failure to apply hand brake on car(s) (railroad employee) Failure to properly secure engine(s) (non-railroad employee) Failure to control speed of car using hand brake (railroad employee) Use of brakes, other (Provide detailed description in narrative)
H021
H022
H025
H099
There is no “WHY” here!
Notice the verbs used in each of these descriptions. Improper and failure point to a person, not a cause.
Note that cause codes are only categorized by railroad and non-railroad employees, not by human performance factors. Conducting any type of human factors analysis from this type of database is very frustrating because all that can really be gleaned is “What” happened and “Who” did it. There is no “Why” here!
Unfortunately, the FRA database is the best one in the industry.

17. Corrective Actions and Prevention ACCIDENT INVESTIGATION
RESEARCH SPONSORS
FRA and rail industry provide funding for research programs.
Lack of good data leads research projects based primarily on interests and intuition. Corrective actions are therefore less effective.
Ineffective
Corrective Actions and Prevention
Programs
Fad-driven
Research
Prevention
Error occur frequently and are the major cause of accidents.
Few safety programs are effective at preventing the occurrence or consequences of these errors.
HUMAN ERROR
Mitigation
Less sophisticated techniques and procedures.
Information is qualitative and illusive.
Focus on “what” happened but not “why” it happened.
ACCIDENT INVESTIGATION
Not designed around any particular human error framework.
Variables often ill-defined.
Organization and structure difficult to understand.
ACCIDENT DATABASE
Traditional human factors analysis are onerous due to ill-defined variables and database structures,
Few analyses have been performed to identify underling human factors safety issues.
DATABASE ANALYSIS
Accident
Continuing on with our accident investigation we find that the lack of meaningful data leads to either no research or research driven by intuition and special interests. Corrective actions are less focused and less effective.
Research and corrective actions are driven more by fads than data, resulting in flavor-of-the-month safety programs.
While good intended these fad safety programs are ineffective and undermine managements credibility regard their sincerity for employee safety.

18. Other Human Factor Traps
Outcome Bias
Hindsight Bias
Confirmation Bias
Correlation Bias
Judgmental Bias
Human factor investigators are human! Therefore, they are susceptible to human biases. These biases must be recognized and guarded against during the entire investigative process. The most common investigative biases are:
Outcome Bias
Hindsight Bias
Confirmation Bias
Correlation Bias
Judgmental Bias

19. Outcome Bias
The tendency to judge a decision by its eventual outcome instead of judging it based on the quality of the decision at the time it was made.
For example, The Giants are leading the Cowboys 7 to 6 with two minutes to go and it’s fourth and goal on the one yard line. The Cowboys kick a field goal and take the lead 9 to 7. The Giants get the ball and march down the field. With three seconds on the clock they kick a field goal to win the game 10 to 9. Base on the fact that the Cowboys lost the game the decision to kick a field goal from the one yard line is deemed bad. The coach is a jerk! However, had the Cowboys won the coach would have been a hero. Same decision, different outcomes.

20. Hindsight Bias
The tendency of people to view events as more predictable than they really are.
Sometimes called the "I-knew-it-all-along" effect, the tendency to see past events as being predictable at the time those events happened. Colloquially referred to as "Hindsight is 20/20."
A basic example of the hindsight bias is when, after viewing the outcome of a potentially unforeseeable event, a person believes he or she "knew it all along". He Giants’ fan watches the Cowboys take the lead and is dismayed. The Giants then get the ball, move down the field, and kick the winning field goal. The Giants’ fan says, “I knew they’d win!”

21. Confirmation Bias
This is where an individual searches selectively for evidence to confirm an underlying belief, discounting contradictory evidence and stops searching; once the confirming evidence is found.
“If a man is offered a fact which goes against his instincts, he will scrutinize it closely, and unless the evidence is overwhelming, he will refuse to believe it.  If, on the other hand, he is offered something which affords a reason for acting in accordance to his instincts, he will accept it even on the slightest evidence.  The origin of myths is explained in this way.”   Bertrand Russell
Dec 2103

22. Correlation Bias
Correlation bias is the phenomenon of perceiving a relationship between variables (typically people, events, or behaviors) even when no such relationship exists.  
All crows are black.
This is a crow.
Therefore, it is black
Verses
This bird is black.
Therefore, this bird is a crow.
Note: Correlation does NOT mean causation.

23. Judgmental Bias
A final bias is the (usually unconscious) tendency to favor one's own interests and self, even when consciously trying to be fair and objective. Egocentric bias regularly leads people to overestimate their own positive contributions and responsibility. These biases have implications for conflict management.
A labor leader will unconsciously be biased against management and visa-versa.
Or, “He disagreed with me in the meeting and I was right, so his opinion is no-good!”
Management and employees may be biased against FRA for reasons of self-interest.
“I don’t have time for this!”
“He’s just trying to catch me doing something wrong!”

24. So, the question is, “What do we need to do to make things better?”
Develop and use a method that identifies and categorizes degradations and lapses in human performance.
Use a structured method to systematically analyze human performance in a scientific and consistent manner.
Develop a Human Performance database structure to conform with HP drivers and behaviors.
Better investigation.
Better analysis.
Better database.
It will be up to FRA to address number 3
We will address what we can deal with – Steps 1 & 2.

25. The First Step The Human Factors Analysis and Classification System
Fortunately, tools have already been developed to aid us in solving HP problems and avoid biases.
The first two steps, improving accident/incident investigations and analysis can be accomplished by using HFACS.
HFACS assist us in developing the “Bridge Questions” that take us from contributing factors to root causes. .
Fortunately, tools have already been developed to aid us in solving HP problems and avoid biases.
The first two steps, improving accident/incident investigations and analysis can be accomplished by using HFACS.

26. What drives Behavior? Antecedent Behavior Consequence
proceed and trigger behavior; predict consequences
Behavior
observable action
Consequence
events which follow behavior
We begin by asking, “What drives behavior?”
Antecedents proceed and are the drivers of behaviors. Often they can also predict the consequence of the behavior.
Behavior is the observable action or lack of action by an individual or group of individuals.
Consequences are the outcome of the behavior. The consequence may be positive or negative, or there be no consequence at all. Negative and positive consequences provide feedback for correcting future behavior. No consequences to a specific behavior provides no feedback, which humans generally take as a positive. Lack of consequence to inappropriate behavior tends to cause humans to repeat that behavior.
For example, a switchman may step of a piece of moving equipment without being injured. The lack of negative feedback is perceived as positive and that the behavior is safe and appropriate. This could lead to the behavior being repeated adding risk to the operation. Another example is a warehouse worker that wears a back brace. He may lift heavy object all day without harm or pain. Over time this worker may come to believe he can lift evermore heavier objects without harm, until he receives an injury. Lack of negative feedback can result in negative consequences.

27. HFACS Analysis HFACS allows us to: Study the consequences.
Analyze the behaviors.
Identify the antecedents.
Once the antecedents are identified corrective actions can be developed
The Human Factors Analysis and Classification System provides us with the tool to study consequences or potential consequences, analyze the behaviors leading up to the consequences, and to identify the antecedents. In other word, HFACS allows us to not just fix the problem (the behavior), but to fix the causes of the problem – the antecedent.

28. Risk Risk is the potential of losing something of value. Values:
Physical health
Social status
Emotional well being
Financial wealth
Risk can also be defined as the interaction with uncertainty.
Uncertainty is a potential, unpredictable, unmeasurable and uncontrollable outcome, risk is a consequence of action taken in spite of uncertainty.
Life is full of risk. It is not possible to avoid all risk. However, every effort should be made to avoid uncertainty. In other words, the more you can learn about the risks of a certain behavior the more prepared a person is to counter the risk.
For example, skydiving is a high risk sport. However, because the risks have been identified and countermeasures to those risks have been developed the sport is safely accomplished thousands of time every day.

29. Risk ERRORS THREATS RISK UNCERTAINTY
Risk is a combination of threats and errors in an environment of uncertainty. As an organization uses various processes to identify threats and errors the amount of risk is reduced. If risk is reduce, so is uncertainty.

30. What are Threats?
External Threat: An event or error that occurs outside the influence of the operator, but which requires their attention and management if safety margins are to be maintained.
Internal Threat: A threat that originates within the operator, organization, or system.
The key to the operator recognizing the threat is the maintenance of situational awareness.
(Emphasize recognition by maintaining situational awareness.)

31. Threats Threat Categories Train Dispatcher Operational Environmental
Examples
Error by other
Operators
Unserviceable Equipment
Procedures
Coordination Issues
Computer/System Malfunctions
Communication breakdowns
Terminology
Conflicting Traffic
Inadequate/
Erroneous
Other Operator/Crew Errors
Adverse Weather
Operational Environment
Restrictions/
Limitations
Traffic Mix
Here are some examples of operational threats. For example, a power switch fails to opsrate, this requires the dispatcher to increase his communications workload, implement additional procedures, reevaluate traffic flow, make additional operational decisions, etc.

32. Errors
Error: An observed deviation from organizational expectations or operators intentions
Communication Errors
Procedural Errors
Equipment / Automation Errors
Traffic Handling Errors
What are errors? They are deviation from the expected or intended behaviors.

33. Errors The Marysville Subdivision Incident Example Phraseology
Error Categories
Communications
Procedural
Equipment/ Systems
Traffic management
Example
Phraseology
Readback/
Hearback
Missed Call
Coordination
Checklist
Briefing Error
Transfer
Inaccurate information
Incorrect Routing
Incomplete Clearance
Procedure Error
Examples of some errors. (Point out some of the error types, but don’t dwell on them).
(slowly double click to run audio recording).
(As the recording runs, signal each time the dispatcher says “Main Two” and each time the track inspector refers to main “1”)
(After the recording has been completed discuss the following chain of events).
Failure in the readback/hearback communication led to a procedural briefing error which led to inaccurate information being conveyed resulting in an incorrect routing traffic management error. (trace the bold headings through the chart).
Fortunately, a train crew that was monitoring this conversation identified the error and took action to correct the error before their were adverse consequences.
(Follow up by stating that) the traditional outcome for an event such as this would bean investigation for disciplinary action. This type of investigation would focus on the dispatcher’s and the track inspector’s without much regard for the organizational and system deficiencies that not only allowed the initial error to occur, but allowed the error chain to continue.
The Marysville Subdivision Incident

34. Question
How do we protect people and property from the threats and errors?
Most organizations attempt to build barriers between the risks (threats and errors) and their employees and property.
However, in a world of uncertainty, without knowledge of the threats and risks, barriers can be breached!
How do we protect people and property from the threats and errors?
Most organizations attempt to build barriers between the risks (threats and errors) and their employees and property.
However, in a world of uncertainty, without knowledge of the threats and risks, barriers can be breached!
Organizations don’t even know what barriers to build!

35. HFACS recognizes that accident are a chain of incidents leading to an event
Antecedents Or
Latent Conditions
Accidents & Injuries
Active Condition
Behavior
Let’s dig deeper into how we can identify organizational and system deficiencies. The “Swiss Cheese” model. This model recognizes that accidents are the result of a series of failed barrier; a combination of threats and errors at difference times and at different levels within the organizations management structure. (click)
Many of these threats or error are latent conditions that many lay undiscovered until a scientifically-based analysis sheds light upon them or an accident occurs. (click)
These latent conditions are often the drivers or antecedents to the active condition or behavior that is the final step in the chain of events leading to the accident.
An example of a latent condition can be seen in the 1992 derailment of a Canadian National train at Nakina, Ontario that resulted in two fatalities. The derailment was caused by an engineering error that occurred in1914.

36. Learning Where the Risk Lives
External Threat
Internal Threat
External Error
Internal (Crew) Error
Threat
Management
Behavioral/
Procedural
Countermeasures
Error
Undesired
State
Inconsequential
Error
Outcomes
Close
Call
Undesired State
Management
Behavioral/
Procedural
Countermeasures
Accident/
Incident
We can look at latent condition at three different levels: the system level, the organization level and the professional or individual level. (click)
The system, any system, is faced with the possibility of threats and errors. As discussed in an earlier presentation, that is why it is important to build a resilient organization. An organization capable of identifying operational threats and error before they have adverse consequences. (click)
Building resilience into an operation requires threat and error management through the use of policies, procedures and countermeasures to guide appropriate behaviors. (click)
If things go awry there are three possible outcomes: the threat or error becomes inconsequential, the error chain is continued, or an undesired state is created. (click)
If the error chain is continued or an undesired state created organizations need policies, procedures and countermeasures in place to guide the appropriate behaviors needed for the system operators to safely break the error chain and recover from the undesired state. (click)
If such policies, procedures and countermeasures are in place the result is a close call. (click)
If not, the outcome is an accident or incident. (click)
In either case the results of the science-based investigation should be the recommendation of policies, procedures, and countermeasures that change the organization and the system functions.
System Organizational Professional
Latent Threats

37. Need for Barriers People & Hazards Property Goal: Keep hazards and
DANGER
Hazards
People
&
Property
Barriers are needed to protect people and property for the hazards of the environment. These barriers need to be designed to give the organization resilience and continuously improved as new gaps are identified.
Goal: Keep hazards and
People and Property
from meeting

38. Individual Factors Safe Behaviors Active Conditions Hazards DANGER
HFACS RR identifies six (6) types of barriers. Because weaknesses and gaps in organizations and systems are usually identified by analyzing the behaviors of the people within the system or organization, we will begin with the first barrier of Individual Factors. Safe Behaviors are the cornerstone of safe operation. However, as previously discussed, behaviors have drivers or antecedents. Those antecedents can and do lead to unsafe acts. (click)
Unsafe acts refer to active failures, and involve acts of omission and commission by those closest in time and physical proximity to the accident/incident. These employees are sometimes referred to as being “at the pointy end of the stick.” These unsafe acts knock some holes in the barrier of Safe Behaviors.
Safe Behaviors
Unsafe Acts

39. Preconditions Conditions for Individual Acts
DANGER
Hazards
Other holes due to
latent conditions
The next barrier to consider is Safe Conditions. This barrier can be compromised by Preconditions for Unsafe Acts. (click)
These are contextual factors that foster, enable, or otherwise set up the operator or individual to err or violate a rule, policy, or procedure. Preconditions exist prior to the accident/incident.
Preconditions
For Unsafe Acts
Safe Conditions

40. Environmental Factors
DANGER
Hazards
Other holes due to
latent conditions
Environmental factors, such as facility layout, tool design, ergonomics, and housekeeping, can have a significant impact on safety. (click) These environmental factors can be physical or technical in nature. Weaknesses in the work environment may result in holes in the barrier.
Physical/Technical
Workplace Factors

41. Supervisory Factors Supervisory Factors Safe Supervision
DANGER
Hazards
Other holes due to
latent conditions
Safe supervision is a critical factor in workplace safety and forms an important barrier.
A supervisor’s role is to provide operators with the opportunity to succeed. Supervisory factors consist of decisions, policies, practices, procedures, and actions by front line supervisors (i.e., shift supervisors, trainmasters, foremen, etc.) and first and second-level officers (i.e., superintendents, managers, directors). (click)
These supervisors can compromise the supervisory factors barrier and contribute to accident/incident by (1) Limiting an operator’s opportunity to succeed, or (2) Providing inadequate oversight and guidance.
Safe Supervision
Supervisory Factors

42. Organizational Factors
DANGER
Hazards
Other holes due to
latent conditions
Organizational influences include senior management and executive level decisions, practices, policies, and procedures that guide the operation and general governance of an organization.
Decisions are often made at this high levels of an organization, far from “the pointy end of the stick”, which have the unintended consequence of breaching the Organizational Factors barrier. (click)
Because of the distance in time and space between the decision-making and the unintended consequences it is often hard to recognize the linkage between cause and affect. Only by an in-depth investigation and a complete analysis do these factors come to light.
Note that the farther we move away from “the pointy end of the stick” the more difficult it is to identify the linkage between cause and affect.
Unsuitable Decisions
Organizational Factors

43. Outside Influences to Consider
DANGER
Hazards
Other holes due to
latent conditions
All organizations are influenced by outside sources that drive organizational decision-making. Organizations, like individuals, have behaviors that are driven by antecedents. Some of the drivers of organizational behavior are economics, political, social-technical, and legal.
Economics may determine workforce levels, purchasing of new equipment, the degree of flexibility in setting wages, etc.
The political environment may influence organizational behavior through monetary, operational, and environmental regulations, etc.
The social-technical environment may influence organizational behavior through social pressure (tobacco industry), or technically by advances in technology (Buggy whip industry).
The legal impact is ever increasing on organizations through laws and law suits.
Note that while these categories are defined there is much interconnection between each of them.
External Factors

44. Failed Barriers Hazards DANGER
To varying degrees organization use these barriers to protect people and property from the hazards of their operations. As there are holes in each of the barriers, it is inevitable that eventually the holes in the barriers will align. (chick)
When that occurs people and property are exposed to the hazards of the operation.

45. Human Factors Analysis and Classification System (HFACS)
The HFACS identifies the human contribution to accidents and incident regardless of how far removed from the incident. provides a tool to assist in the investigation process, and target prevention efforts.
HFACS is based on the "Swiss Cheese" model of human error which looks at four (six) levels of active errors and latent failures, including:
Individual Acts,
Preconditions for Operator Acts,
*Environmental Factors,
Supervisory Factors,
Organizational Factors, and
*Outside influences.
*HFACS has been expanded for C³RS to include Environmental Factors and Outside influences.

46. Individual Acts Errors Violations
Let’s explore each of these barriers to get a closer look at the root causes of accidents in the rail road industry. We will be using several examples to demonstrate these points. While not all of them are railroad examples, we believe they will make the point. First let’s look at unsafe acts. As we saw before there are two primary types of unsafe acts. Errors and violation. Each of the categories can be broken down further. Under Errors we find Decision errors.
Individual
Acts

47. SKILL-BASED ERROR INDIVIDUAL ACTS INDIVIDUAL ACTS Errors Errors
Violations
Decision
Errors
Skill-based
Errors
Decision
Errors
Perceptual
Errors
Routine
Exceptional
Sabotage
SKILL-BASED ERROR
Attention Failures
- Breakdown in situational awareness
- Inadvertent operation of controls
- Failure to see and avoid
Memory Error
- Apply wrong rule or procedure
- Omitted step in procedure
Technique Error
Skill-based errors. Skill-based errors often occur during the execution of highly practiced actions in which there is little or no conscious thought required. Skill-based errors can be further classified into attention failures (slips), memory failures (lapses), and technique errors.
• Attention failure. Failures of attention typically occur when carrying out highly automated behavior. Attention failures are characterized by missed or otherwise unnoticed sensory information, and are frequently due to distractions, stress, or fatigue. Attention failures, or slips, may be manifested as delays, reversals, miss-orderings, and miss-timings in procedures and tasks.
• Memory failure. Memory failures, or lapses, involve a failure to remember critical information involved in a task or procedure. Memory failures are often manifested as omissions in a checklist, forgotten intentions, or losing one’s place.
• Technique error. Technique errors involve the execution of a sequence of actions that are technically correct but that contributed to an accident/incident. Technique errors occur when an operator can carry out a task using one of several acceptable sequences. An example is train handling that, although technically adequate, leads to a break-in-two under specific environmental or operational conditions.
Individual
Acts

48. Problem-solving Error
INDIVIDUAL
ACTS
INDIVIDUAL
ACTS
Errors
Errors
Violations
Skill-based
Errors
Decision
Errors
Decision
Errors
Perceptual
Errors
Routine
Exceptional
Sabotage
DECISION ERROR
Procedural Error
Poor Choice
Problem-solving Error
Decision errors. Decision errors are intentional behaviors that proceed as planned, yet the plan itself proves inadequate or inappropriate for the situation. Often referred to as “honest mistakes,” these unsafe acts represent the actions or inactions of individuals who meant to perform correctly, but they either did not have the appropriate knowledge or made a poor choice. Decision errors differ from skill-based errors in that decision errors involve deliberate and conscious acts while skill-based errors are a highly automated behavior. Decision errors consist of conscious decisions that are believed to be correct, but are in fact poor or erroneous. Decision errors can be divided into three types: procedural errors, poor choices, and problem-solving errors.
• Procedural error. Rule-based mistakes that occur during highly ordered or structured tasks, such as “if X occurs, then do Y.” A procedural error may be a misapplication of a good rule or procedure, or the application of a bad rule or procedure.
• Poor choice. Knowledge-based mistakes. Poor choices occur when there is no explicit procedure to apply to the particular situation, and the operator must choose among several response options. These options may be explicit or implicit. This type of error is often due to insufficient knowledge or understanding of the situation, and may arise when the operator lacks sufficient training, or lacks adequate time to respond.
• Problem-solving error. Problem-solving errors occur when the nature of the problem is not well understood, and formal procedures or other options are not available. In situations like this, humans can develop and apply unique solutions that are wrong. In developing this solution, humans use cognitive resources that can result in loss of situational awareness and a delayed response.
Individual
Acts

49. PERCEPTUAL ERRORS INDIVIDUAL ACTS INDIVIDUAL Errors Errors Violations
Skill-based
Errors
Decision
Errors
Perceptual
Errors
Perceptual
Errors
Routine
Exceptional
Sabotage
PERCEPTUAL
ERRORS
Misjudge Distance or
Speed
Spatial Disorientation
Visual Illusions
Misperceive Situation
Perceptual errors. Perceptual errors occur when one’s Theory of the Situation (perception) is different from the reality of the situation. This may be the result from degraded or unusual sensory input or poor or erroneous information displays. The error is the operator’s incorrect response to the illusion or degraded sensory information. Perceptual errors include misjudging distances and misidentifying signal aspects under certain conditions (i.e., solar glare). Perceptual errors also arise from false sensations, ambiguous information, and misperception of hazards.
Individual
Acts

50. ROUTINE (INFRACTIONS)
INDIVIDUAL
ACTS
INDIVIDUAL
ACTS
Errors
Violations
Violations
Decision
Errors
Skill-based
Errors
Decision
Errors
Perceptual
Errors
Routine
Routine
Exceptional
Situational
ROUTINE (INFRACTIONS)
(Habitual departures from rules condoned by management,
supervision, or work group.)
Violation of Rules/Orders/Regulations
- Failed to Conduct Inspects or Tests
- Violated Operating or Safety Rules
- Failure to conduct or comply with Job Briefing
- Knowingly Accepted Non-Qualified Crewmember
Failed to Adhere to Briefed Plan
Not Qualified for Position or Territory
(Engineer, RCO, etc.)
Improper Procedure
Routine. Routine violations include habitual behaviors and actions that violate governing rules, procedures, or policies, and that are carried out with good intent. Routine violations are the result of a perceived license to bend the rules. They are often tolerated or condoned by management, and are frequently intended to save time and/or effort and negative outcomes are not intended. An example of a routine violation condoned by management and the work group would be a football penalty for offensive holding. This is a routine violation of the rules that is condoned and encouraged by the work group which brings cultural pressure on the individual to commit the violation. Regarding management, they not only condone the violation, they training the individuals how to commit the violation without getting caught. Collectively, between the players and the coaches the only time holding is wrong is when you get caught. Other examples include delays in bad ordering defective cars, or not protecting the point because it will save a few minutes of time and effort.
Individual
Acts

51. SITUATIONAL (Non-Routine)
INDIVIDUAL
ACTS
INDIVIDUAL
ACTS
Errors
Violations
Violations
Decision
Errors
Skill-based
Errors
Decision
Errors
Perceptual
Errors
Routine
Situational
Situational
Exceptional
SITUATIONAL (Non-Routine)
(Isolated departures from the rules knowingly or unknowingly
Condoned by management)
Succumbing to pressure (time, workload, weather, lack of equipment of resources)
In a position of having to choose between which rule to violate
Situational Violations are the result of organizational and environmental factors that make it difficult for employees not to commit violations. These factors include time pressure, lack of supervision, poor ambient conditions (e.g. light, noise, heat), insufficient resources, and a negative culture. Technicians may find themselves “signing-off” completed work on a locomotive or rail car without acquiring the necessary supervisory cross-check. Either because of a lack of supervisors, or because the process takes too long.
An example of a situational violation is where due to a particular train handling situation an engineer is place in the position of either breaking an operating rule or breaking an air brake and train handling rule.
Individual
Acts

52. EXCEPTIONAL (Non-Routine)
INDIVIDUAL
ACTS
INDIVDUAL
ACTS
Errors
Violations
Violations
Decision
Errors
Skill-based
Errors
Decision
Errors
Perceptual
Errors
Routine
Situational
Exceptional
Exceptional
EXCEPTIONAL (Non-Routine)
(Isolated departures from the rules NOT condoned
by management)
Violation of Rules/Orders/Regulations
- Short-cuts
- “This is the way we’ve always done it!”
- Complacency
Accepted Unnecessary Hazard
Not Qualified for Position or Territory
Exceeded Limits of Tool, Device, or Equipment
Exceptional. Exceptional violations include isolated actions or behaviors that are:
not indicative of the operator’s typical actions or behaviors, and
not condoned by management.
Exceptional violations are often extreme in nature, but like routine violations, the negative outcome was not intended (i.e., driving 100 mph in a 55 mph zone was intentional, but the crash was not). Exceptional violations are considered exceptional because they are neither typical of the individual, nor condoned by authority. An exceptional violation is a rare act that defies accepted and typical behavior.
Note: Some authors include acts of sabotage in this category. Sabotage is an intentional act and will not be used for the purposes of analysis.
Note: There is a fifth type of violation that is not addressed in this presentation. It is the optimizing violation. Optimizing Violations occur when people try to make a task more exciting or interesting to impress others or to relieve boredom. These are common when people are involved in long periods of monotonous work, such as monitoring tasks, or when the rules are restrictive or outdated.
Individual
Acts

53. Corrective Action Goal
REDUCE
Decision Errors –
Skill-based Errors –
Perceptual Errors –
Routine Violations –
Situational Violations -
Exceptional Violations -
Expected
Unexpected
ELIMINATE
In review, we find that error fall into the “expected” category, and violations fall into the category of “unexpected.” As an organization works to add resilience to their operation they can develop corrective actions to eliminate, trap, or minimize the consequences of errors, but because we are all human we cannot eliminate errors. On the other hand, violations must be eliminated as they foul the system. To successfully eliminate violations the organization must learn why violations occur.

54. Preconditions for Individual Acts
Condition of
the Operator
Personal Factors
Preconditions
for
Unsafe Acts
Individual
Acts
As we move up the HFACS model we will examine Preconditions for Individual Acts. This is the first level where we begin to see behavioral antecedents. Preconditions for individual acts has two (2) categories – condition of the operator and personal factors.

55. Loss of Situational Awareness ADVERSE MENTAL STATE
PRECONDITIONS
FOR
OPERATOR ACTS
PRECONDITIONS
FOR
UNSAFE ACTS
Conditions of Operators
Conditions of Operators
Personal Factors of Operators
Adverse Mental States
Adverse Mental States
Adverse Physiological States
Physical/
Mental
Limitations
Crew Resource Management
Personal Readiness
Loss of Situational Awareness
Alertness (Drowsiness)
Overconfidence
Complacency
Task Fixation
ADVERSE MENTAL STATE
Degraded Alertness (Drowsiness)
Preconditions
for
Unsafe Acts
Individual
Acts
Arguably the unsafe acts of operators can be directly linked to nearly 80 percent of all industrial mishaps. However, simply focusing on unsafe acts is like focusing on a fever without understanding the underlying disease causing it. As such, investigators must dig deeper into why the unsafe acts took place. What were (are) the preconditions for the operator acts? The reason we say “are” is because the preconditions most probably still exist.
Operator conditions include an individual’s mental and physiological conditions that can affect job performance, or mismatches between physical or mental abilities and job/task demands.
Adverse Mental State – An adverse mental state is a common cause for human error. Adverse mental states include mental conditions, perceptions,
expectations, biases, attitudes, beliefs, moods, or states that negatively affected an operator’s performance. Examples include reduced situational awareness, distraction (e.g., personal problems) or preoccupation, task fixation, cognitive fatigue, poor motivation, low self-esteem,
learned helplessness, boredom, job dissatisfaction, complacency, and overconfidence.
These items may explain an individual’s behavior, but they also generate further questions. “Why did the individual lose situational awareness?” “Why was the individual’s alertness degraded?” And so on.

56. ADVERSE PHYSIOLOGICAL STATES
PRECONDITIONS
FOR
OPERATOR ACTS
PRECONDITIONS
FOR
UNSAFE ACTS
Conditions of Operators
Conditions of Operators
Personal Factors of Operators
Adverse Mental States
Adverse Physiological States
Adverse Physiological States
Physical/
Mental
Limitations
Crew Resource Management
Personal Readiness
ADVERSE PHYSIOLOGICAL
STATES
Medical Condition
Cognitive Fatigue
OTC Drugs
Exposure to Hazmat
Intoxication
Preconditions
for
Unsafe Acts
Individual
Acts
Adverse Physiological States – The human body’s performance can easily be influenced by illness or chemicals. Adverse physiological states include physiological and medical conditions that can negatively impact safe operations. These include common and serious medical illnesses or disease (e.g., diabetes), disturbed sleep patterns, intoxication, physical fatigue, hypothermia and heat stroke, and negative physiological effects of medications.

57. PHYSICAL/MENTAL LIMITATIONS
PRECONDITIONS
FOR
OPERATOR ACTS
PRECONDITIONS
FOR
UNSAFE ACTS
Conditions of Operators
Conditions of Operators
Personal Factors of Operators
Adverse Mental States
Adverse Physiological States
Physical/
Mental
Limitations
Physical/
Mental
Limitations
Crew Resource Management
Personal Readiness
PHYSICAL/MENTAL
LIMITATIONS
Incompatible Physical Capabilities
Incompatible Intelligence/Aptitude
Lack of Sensory Input
Limited Reaction Time
Preconditions
for
Unsafe Acts
Individual
Acts
Physical/mental Limitations – Not all persons have the same physical or mental capabilities. Physical/mental limitations occur when operational requirements exceed the capabilities of the individual. This situation can also induce stress, further reducing the human’s ability to perform. This limitation may be due to sensory limitations; lack of familiarity with task requirements; inadequate training and/or limited experience, education, or knowledge of the particular task or situation; incompatible physical capabilities for the task, or any other general physical or mental incompatibility between operator capabilities and task requirements.

58. CREW RESOURCE MISMANAGEMENT
PRECONDITIONS
FOR
OPERATOR ACTS
PRECONDITIONS
FOR
OPERATOR ACTS
Conditions of Operators
Personal Factors of Operators
Personal Factors of Operators
Adverse Mental States
Adverse Physiological States
Physical/
Mental
Limitations
Crew Resource Management
Crew Resource Management
Personal Fitness
CREW RESOURCE
MISMANAGEMENT
Improper Job Briefing
Not Working as a Team
Poor Crew Coordination
Poor communications
Speed of delivery
Message structure
Inadequate Coordination of Task
Preconditions
for
Unsafe Acts
Individual
Acts
These personal factors include two somewhat distinct sets of issues: deficiencies in coordinating and communicating between or among individuals (crew resource mismanagement), and a failure to adequately prepare mentally and physically for duty. Personal factors are further divided along these lines.
Crew resource mismanagement. Crew resource mismanagement factors include conflict, poor communication, and/or poor coordination among individuals involved in the accident/incident. Examples include communication breakdowns and inadequate job briefings.

59. PERSONAL FITNESS PRECONDITIONS FOR OPERATOR ACTS PRECONDITIONS FOR
Conditions of Operators
Personal Factors of Operators
Personal Factors of Operators
Adverse Mental States
Adverse Physiological States
Physical/
Mental
Limitations
Personal Readiness
Crew Resource Management
Personal Fitness
PERSONAL FITNESS
Readiness Factors
Crew Rest Requirements
Drug & Alcohol Rules
Self-Medicating
Poor Judgement
Poor Dietary Practices
Overexertion While Off Duty
Poor Sleep Management
Preconditions
for
Unsafe Acts
Individual
Acts
Personal fitness. Personal fitness includes behavioral factors and decisions that affect physical or mental readiness for duty. These behaviors include inadequate rest, impairment due to self-medication, poor diet, overexertion, and use of drugs and alcohol before starting work or during work.

60. Environmental Factors
Physical
Environment
Environmental factors. Environmental factors can have a significant impact on human performance. Environmental factors are further divided into the physical environment (i.e., workspace, yard, main track, office) and technological environment in which the operator works and interacts to carry out job tasks.
Technology
Environment

61. Loss of Situational Awareness PHYSICAL
ENVIRONMENTAL
FACTORS
PRECONDITIONS
FOR
UNSAFE ACTS
Physical
Environment
Physical
Environment
Technology
Environment
Loss of Situational Awareness
Alertness (Drowsiness)
Overconfidence
Complacency
Task Fixation
PHYSICAL
Housekeeping
Temperature
Lighting
Space
Vibration
Noise
Preconditions
for
Unsafe Acts
Unsafe
Acts
Physical environment - Physical environment includes the tangible, visible or otherwise sensed environment in which the operator works, and includes factors in the operating environment (i.e., walking path, distance between track centers, debris and tripping hazards due to poor housekeeping, etc.) and the ambient environment (i.e., noise, vibration, temperature, lighting, etc.). For example, a resent study indicated that lowering of body core temperature directly affects various stages of human information processing. Other studies have shown that the human body performs well in a very narrow temperature range (65-90 degrees). At temperatures higher or lower than that range human performance drops off rapidly.

62. TECHNOLOGY Design Implementation Reliability Limitations
ENVIRONMENTAL
FACTORS
PRECONDITIONS
FOR
UNSAFE ACTS
Physical
Environment
Technology
Environment
Technology
Environment
TECHNOLOGY
Design
Implementation
Reliability
Limitations
Program Training
Preconditions
for
Unsafe Acts
Unsafe
Acts
Technological environment. The technological environment includes the interaction with, or operation, maintenance, and inspection of, any tools, materials, vehicles (e.g., locomotive air brakes), plant equipment (i.e., signal and track circuitry systems, switches, grade-crossing system), signage, personal protective equipment, or machines used during the accident/incident sequence. Examples include equipment or component failures, poor design of equipment (such as poor human-machine interface), or inappropriate use of equipment for the task/job.

63. Failure to Correct Problem
Supervisory Factors
Inadequate
Supervision
Planned
Inappropriate
Operations
Organizational leadership is critical to developing and maintaining a quality safety culture. Supervisory Factors that can impact the safety culture of an organization and hence the safety attitude of individual employees include:
Inadequate Supervision,
Planned Inappropriate Operations,
Failure to Correct Problem, and
Supervisory Violations.
Failure to Correct Problem
Supervisory
Violations

64. INADEQUATE SUPERVISION
Planned
Inappropriate
Operations
Failure to
Correct
Problem
Supervisory
Violations
SUPERVISORY
FACTORS
SUPERVISORY
FACTORS
Inadequate
Supervision
INADEQUATE SUPERVISION
Failure to Administer Proper Training
Lack of Professional Guidance
Supervisory
Factors
Preconditions
for
Operator Acts
Individual
Acts
Inadequate supervision - Inadequate supervision covers factors where a supervisor or manager does not provide sufficient support to operators to enable them to perform their jobs. This may be manifested as insufficient supervisory or managerial oversight, inadequate training, poor supervisory example, or otherwise not preparing an operator to perform his/her job functions safely.
Other examples of inadequate supervision include inadequate tracking of operator qualifications and/or job performance, not allowing sufficient opportunity for rest, and not providing up-to-date or current documentation and materials (i.e., bulletins, rule books, special instructions, etc.). Inadequate supervision also can include officers not knowing or understanding relevant rules and how those rules are applied, or inconsistently applying these rules.
Another consideration is supervisor workload. A recent audit on a large freight railroad found one supervisor responsible for managing over 250 people.
Inadequate supervision may occur in situations where supervisors and managers are overtasked, overworked, or undertrained/qualified, to the point where the supervisor loses awareness over what is going on in the area that he/she is responsible. An example of how this can happen is when there is a transfer of administrative tasks from administrative personnel to supervisors. Administrative tasks are often easier to measure than supervisory tasks, and therefore receive priority in accomplishment. Remember, supervisors and managers are humans, too.

65. PLANNED INAPPROPRIATE
Inadequate
Supervision
Planned
Inappropriate
Operations
Failure to
Correct
Problem
Supervisory
Violations
SUPERVISORY
FACTORS
SUPERVISORY
FACTORS
Planned
Inappropriate
Operations
PLANNED INAPPROPRIATE
OPERATIONS
Task Risk without Benefit
Improper Work Tempo
Poor Crew Pairing
Supervisory
Factors
Preconditions
for
Operator Acts
Individual
Acts
Planned inappropriate operations - Operations that are conducted in spite of the fact that there is more than the customary risk in either the tempo or tasks associated with the operation. Planned inappropriate operations involve poor supervisory decisions that place operators at unnecessary risk. Examples include placing excessive and/or unusual workload on an operator or expecting an operator to complete a task in less than the customary amount of time.

66. FAILED TO CORRECT A KNOWN PROBLEM
Inadequate
Supervision
Planned
Inappropriate
Operations
Failure to
Correct
Problem
Supervisory
Violations
SUPERVISORY
FACTORS
SUPERVISORY
FACTORS
Failed to
Correct
Problem
FAILED TO CORRECT A
KNOWN PROBLEM
Failure to Correct Inappropriate Behavior
Failure to Correct a Safety Hazard
Supervisory
Factors
Preconditions
for
Operator Acts
Individual
Acts
Failure to correct problem - Failure to correct known problems refers to instances when deficiencies among individuals, equipment, training or other safety related areas are known to the supervisor, yet are allowed to continue unabated. These include failures by a supervisor or manager to correct observed or known unsafe behaviors, conditions, and hazards. This type of supervisory behavior not only allows an unsafe condition to continue to exit, but also undermines the organization’s safety culture by sending the message that management doesn’t care about safety.

67. SUPERVISORY VIOLATIONS
Inadequate
Supervision
Planned
Inappropriate
Operations
Failure to
Correct
Problem
Supervisory
Violations
SUPERVISORY
FACTORS
SUPERVISORY
FACTORS
Supervisory
Violations
SUPERVISORY VIOLATIONS
Not Adhering to Rules and Regulations
Succumbing to Operational Pressures
Willful Disregard for Authority by
Supervisors
Supervisory
Factors
Preconditions
for
Operator Acts
Individual
Acts
Supervisory violations - Supervisory violations include occasions when a supervisor or manager consciously violates or disregards existing rules, regulations, and policies, or allows subordinates to do the same. Examples include encouraging operators to bend or ignore rules (cutting corners), failure to enforce the rules and regulations, and permitting unqualified operators to work. This results in a degradation of the purpose and importance of the rule and can lead to routine violations. It also serves to undermine the organization’s safety culture and operational system.

68. Organizational Factors
Resource
Management
Organizational
Climate
Change
Management
Organizational influences have four categories: Resource Management, Organizational Climate, Operational Process, and Change Management. Organizational influences include senior management and executive level decisions, practices, policies and procedures that guide the operation and general governance of an organization and that contributed to an accident/incident. It should be noted that as we move further away from “the pointy end of the stick” these factors may become harder to discover. As in any investigation there will be a temptation to “leap to judgement”, but we must resist that temptation. Changes at this level of an organization may have many long-term, unintended consequences. Changes at this level must be well thought out, properly implemented, and continuously monitored to ensure that the desired outcomes are achieved.
Organizational
Processes

69. RESOURCE MANAGEMENT Human Monetary Equipment/Facility ORGANIZATIONAL
INFLUENCES
ORGANIZATIONAL
INFLUENCES
Resource
Management
Resource
Management
Organizational
Climate
Operational
Process
Change
Management
RESOURCE MANAGEMENT
Human
Monetary
Equipment/Facility
Organizational
Influences
Unsafe
Supervision
Preconditions
for
Unsafe Acts
Individual
Acts
Resource management factors include organizational decisions regarding the allocation and maintenance of organizational assets such as human resources, monetary assets, equipment, and facilities.
Human resources - This category includes organizational decisions, policies, etc. that govern, determine, or affect the adequacy, quality and/or amount of recruitment, selection, staffing, scheduling, training, and retention of qualified employees at all levels of the organization.
Equipment/facility resources - This category includes organizational decisions that affect the acquisition, maintenance, management, and operation of adequate equipment and facilities.
Examples include:
• Unavailable, missing, or a shortage of, equipment or lack of resources needed to perform work safely and within the customary time frame.
• Acquisition of unsafe, poorly designed, or inappropriate equipment; equipment and facilities that are in poor condition; and
• Lack of formalized practices and procedures for the acquisition, maintenance, management, and/or operation of equipment and facilities.
Monetary/budget resources - This category includes the allocation of monetary assets. Examples include excessive cost-cutting and inadequate funding for safety, operational, and maintenance programs, staff, and equipment.
Keep in mind that this is a management balancing act. If a corrective action to a problem requires resources those resources must come from somewhere else in the organization. This is another place for unintended consequences to occur. For example, if the corrective action is to hire more people that means more of the organization’s money goes to wages. That increase in the cost of wages may result in the organization deferring the purchase of new equipment which may result in an incident/accident due to equipment failure.

70. ORGANIZATIONAL CLIMATE
INFLUENCES
ORGANIZATIONAL
INFLUENCES
Resource
Management
Organizational
Climate
Organizational
Climate
Operational
Process
Change
Management
ORGANIZATIONAL
CLIMATE
Structure
Policies
Culture
Organizational
Influences
Unsafe
Supervision
Preconditions
for
Unsafe Acts
Individual
Acts
Organizational climate
Organizational climate includes the working environment within an organization, and may consist of formal, informal, and unwritten policies and practices. Organizational climate is further divided into three categories: organizational structure, organizational policies, and organizational culture.
Organizational structure - Organizational structure is the family tree of an organization as reflected in an organization’s chain-of-command, delegation of authority [and autonomy], communication channels, and formal accountability for actions as well as access to various management levels.
Organizational policies - Organizational policies are the official guidelines that direct management’s decisions about such things as hiring and firing, promotion, retention, sick leave, and a myriad of other issues important to the everyday business of the organization. Organizational policies are the institutionalized position of the organization, but not necessarily reflective of what actually occurs in the work environment. In addition to the examples above, organizational policies include health and wellness programs and fitness for duty standards/requirements.
Organizational culture - We have mentioned organizational culture several times already and its importance cannot be over emphasized. Organizational culture includes the unofficial or unspoken rules (i.e., norms, values, attitudes, beliefs, and customs) of an organization as well as the values, beliefs and attitudes employees hold toward the company. The degree of harmony in labor relations (i.e., whether this relationship is more harmonious or adversarial) is one indicator of an organization’s culture). Another indicator of organizational culture is the extent to that the organizational culture is viewed by employees as a “blame” culture or a “just” culture. Senior and executive level managers that bend, shortcut, or otherwise violate (1) Existing organizational structures or policies, or (2) External municipal, county, state and Federal regulations, though rare, is also an indication of an organization’s culture. Organizational culture provides an indication of what is truly valued by the organization.

71. OPERATIONAL PROCESS Operations Practices & Procedures Oversight
ORGANIZATIONAL
INFLUENCES
ORGANIZATIONAL
INFLUENCES
Resource
Management
Organizational
Climate
Operational
Process
Operational
Process
Change
Management
OPERATIONAL
PROCESS
Operations
Practices & Procedures
Oversight
Organizational
Influences
Unsafe
Supervision
Preconditions
for
Unsafe Acts
Individual
Acts
Operational process - Operational process refers to corporate decisions and rules that govern the everyday activities within an organization, including the establishment and use of standard operating procedures and formal methods for maintaining checks and balances (oversight) between the workforce and
management. Operational process can be further organized into one of three categories: organizational operations, organizational practices and procedures, and organizational oversight.
Organizational operations - Organizational operations include work-based processes that influence the quality, quantity, pace, or style of operator performance and work. Examples include operational tempo, time pressure, competing goals (such as processes that favor presumed productivity over safety), and the inconsistent or inappropriate use of incentives or quotas.
Organizational practices and procedures. This category includes formalized activities, practices and procedures that govern or directly affect operations. Examples include a lack of, inadequate, ill-defined, poor, or inappropriate:
Standard operating practices, procedures, tasks, instructions, and rules;
Procedures, instructions or information dissemination about these practices, procedures, tasks, and rules; and
Supporting materials, such as rule books, instructions and instruction manuals, checklists, and other job aids.
Organizational oversight. Organizational oversight includes an organization’s formal approach to policy, procedure, and rule compliance. Examples include;
• Corporate safety programs.
• Risk and quality management programs.
• Hazard identification and elimination/mitigation activities, safety or defect reporting systems.
• Accident/incident investigation procedures.
• Corrective action implementation, and
• Tracking and monitoring the resources, processes, procedures, etc. that are necessary to ensure safe operations.

72. CHANGE PROCESS Resource Management ORGANIZATIONAL INFLUENCES Change
Climate
Operational
Process
ORGANIZATIONAL
INFLUENCES
Change
Management
CHANGE
PROCESS
Planning
Communications
Implementation
Organizational
Influences
Unsafe
Supervision
Preconditions
for
Unsafe Acts
Individual
Acts
Change management - Change management involves the formal process of managing significant changes to, or transitions within, an organization’s structure, processes, and equipment/systems. Change management focuses on the impact that a change has on both the organization and its employees. Change management deserves serious consideration by the analyst if significant changes are occurring within the system or organization without unintended consequences.

73. Outside Influences Economics Socio-technical Political Legal
Organizational decision-making, hence operational safety can be influenced by outside sources. These sources can be economic drivers, political pressures, socio-technical norms, or legal considerations. Often the organization has no control over these outside influences, but it is important to identify these influences so that countermeasures can be developed to minimize their impact on operational safety.
Political
Legal

74. Profit Efficiency Speed OUTSIDE INFLUENCES OUTSIDE INFLUENCES Economic
Political
Socio-technical
Legal
Profit
Efficiency
Speed
Economics
Profit - For-profit organizations exist to do just that – make a profit. Manager of larger organizations often have fiduciary responsibility to stockholders and are held accountable for this responsibility by a board of directors. This type of arrangement can sometimes result in pressure being applied to managers to maximize short-term profits at the sacrifice of long-term operational considerations.
Efficiency – Economic pressures may influence managerial decision-making to attempt to make operational processes more efficient. This can lead to policy and procedural changes that are full of potential errors and unintended consequences.
Speed – Economic pressure can also influence managerial decision-making to increase production, while not having a change process in-place that identifies and implements safeguards to operational activities.

75. Local State Federal Industrial OUTSIDE INFLUENCES OUTSIDE INFLUENCES
Economic
Political
Political
Socio-technical
Legal
Local
State
Federal
Industrial
Political Influence - Political influence can come from many sources.
Local, state, and Federal government agencies.
Activist groups
Suppliers
Customers
Industrial groups
Labor organizations
To name a few,

76. Public Opinion Media Coverage Technical Changes OUTSIDE INFLUENCES
Economic
Political
Social
Socio-technical
Legal
Public Opinion
Media Coverage
Technical Changes
Socio-technical – Socio-technical influence comes from a wide variety of sources. Some examples are:
Public opinion regarding the organization. For example, the railroad is an old and dying industry, or railroads are killing the environment.
Media coverage regarding the organization. For example, the media coverage of Metro North after a series of accidents.
Technical changes, complexity, and advancements are coming at an ever increase rate making it difficult for organizations maintain a stable information management infrastructure. For example a major freight railroad has found that their current information management platform is lacking in capacity and capability. They have embarked on a 20 year project of building a new platform. Their major challenge is that technology is advancing so fast that in the time it takes them to design the architecture for their new platform the method and materials they used in their design are obsolete.
To illustrate the reality of this point the USAF is having difficulties in acquiring spare parts for the F-22 fighter. The reason: Suppliers consider the technology obsolete and have move their production to new technologies.

77. Liability Law Suits FELA OUTSIDE INFLUENCES OUTSIDE INFLUENCES
Economic
Political
Socio-technical
Legal
Legal
Liability
Law Suits
FELA
Legal Influences – Legal consideration often apply influence to senior management decision-making.
Liability - The larger the organization the larger their exposure to liability problems. Product liability particularly has become a driver for business decision-making. For example, a chemical used to save people’s lives from cancer is currently under legal fire because the side affect is permanent hair loss.
Law Suits - Organizations are often perceived as being “rich”. This is particularly true if the organization is large or a governmental entity. This makes them attractive targets for lawsuits – fair or unfair. For example, a truck drove through the warning gates and crashed into the last car of a train, killing the driver. The driver’s family sued the railroad and a jury award them several million dollars.
FELA – For railroads, FELA is always an influencer and a major cultural hurdle.

78. Regulatory Oversight Commerce Dept. State DOT PHMSA FRA EEOC USCG HHS
OUTSIDE
INFLUENCES
OUTSIDE
INFLUENCES
Economic
Political
Social
Legal
Regulatory Oversight
Commerce Dept.
State DOT
PHMSA
Finally, there is Regulatory Oversight.
According to the Competitive Enterprise Institute “nobody can say with complete authority exactly how many federal agencies exist.” The Federal Register indicates there are over 430 departments, agencies, and sub-agencies in the federal government, but no one is sure that is accurate because not all agencies subscribe to the Federal Register. This does not include state and local agencies.
If nobody knows how many agencies exist whose decrees organizations must abide, that means we don’t know how many people work for the government nor know how many rules there are. But even when we isolate a given, knowable agency, like the FRA, the rise of “regulatory dark matter” may make it hard for organizations to tell exactly what is and is not a rule. This can give rise to regulatory oversight agencies influencing organizational decision-making beyond their regulatory authority. This can be very bad or very good. We would like to think that the Confidential Close Call Report System falls into the “very good" category.
FRA
EEOC
USCG
HHS
IRS
SEC
DOL
ICE
Dept. Of Ag.
Labor Relations board
Other State Agencies
EPA
BLM
NMB
DoD
Corps of Engineers

79. Summary Antecedents proceed behaviors Threats + Errors = Risk
Barriers are erected to protect
Risk can breach barriers
HFACS assist us in identifying breaches in the barriers and develop corrective actions.
Observing and attacking behaviors may make us feel like we have accomplished something, but achievement is not long-lived unless the antecedents to the behavior are identified, isolated, or eliminated.
Threats + Errors + Risk. By identifying risk and building safeguards uncertainty can be reduced.
Barriers are erected to protect people and property, but
individual acts
Preconditions for individual acts
Environmental conditions
Supervisory factors
Organizational factors
Outside influences
Can breach those barriers.
The HFACS Model can be used to identify breaches or gaps in our barriers and guides us in developing corrective actions. 79

80. Further Readings
Accident Precursor Analysis and Management: Reducing Technological Risk Through Diligence, 2004, National Academy of Engineering, The National Academies Press, Washington, D.C.
 Dekker, Sidney W. A., 2005, Ten Questions About Human Error, Lawrence Erlbaum Associates, New York.
Geller, E. Scott, 2001, Working Safe: How to Help People Actively Care for Health and Safety, Lewis Publishing, New York.
 Hollnagel E., Woods, D., Leveson, N., Resilience Engineering, Ashgate Publishing Limited; Burlington, VT.
 Reason, James, 1997, Managing the Risk of Organizational Accidents, Ashgate Publishing Limited; Burlington, VT.
Wilson, J., Norris, B., Clarke, T., Mills, A., 2005, Rail Human Factors: Supporting the Integrated Railway, Ashgate Publishing Limited; Burlington, VT.
Wiegmann, D., Shappel, S., 2003, A Human Error Approach to Aviation Accident Analysis, Ashgate Publishing Limited; Burlington, VT.

81. Collaborative Incident Analysis and Human Performance Handbook
For more information:
Collaborative Incident Analysis and Human Performance Handbook

82. Discussion and Q&A

83. If you would like a copy of this presentation along with the speaker notes please me at: