Error on trial

In most other areas of endeavour we learn from triumphs, but in safety the focus is often on disaster. We are knowledgeable enough to realise that we cannot simply blame the end user, but we still try to unpick long, causal chains of errors -- of end users, of senior management, of designers -- seeing human error as something to be designed, managed or reinforced out of an organisation.

Some approaches focus on the end-user errors, whether deliberate violations or mistakes. Behaviour-based safety approaches, for example, assume that the systems have been fixed, and that persuading people to wear their personal protective equipment and complete their checklists should be the focus of effort. Other approaches concentrate on organisational faults -- which still amount to human errors, just further up the management chain. Critics of Herbert Heinrich's 1930s methods often forget that his "fault" domino did not refer just to the human errors of front-line workers. Heinrich's use of the phrases "unsafe design or construction" and "hazardous arrangement" suggests he was well aware of the role of errors in design and management.

James Reason's "Swiss cheese" model shows holes (failings) in layers of protection at the managerial level, which let an accident trajectory through these "slices" so, when the end user performs an unsafe act, an accident occurs.

Through multiple books, Sidney Dekker has tried to persuade organisations to move away from seeing human error as the fault (culpable or otherwise) of the individual to a symptom of problems in the organisation.

As well as the arguments over whose errors are of most concern -- end users', management's, designers', or planners' -- there have been debates over how best to eliminate mistakes. Early approaches considered "error prone" people (see Error proneness box below) could be weeded out of the workplace. Other efforts have focused on training, human factors, reinforcement or punishment.

Human factors expert Jens Rasmussen and Reason are well known for their efforts to categorise human error (see Error definitions box). By categorising an error, it is argued, you are better able to prevent it. Training reduces skill-based errors, checklists improve the use of rules, and a better understanding of the system and of the potential for mistakes reduces the likelihood of knowledge-based faults. But whomever they blamed, and however they thought it could be solved, there has been a consensus that human error is something to be identified and eliminated.

Sense of inevitability?

Even as Rasmussen and Reason were categorising human errors, Barry Turner had already warned of the flaws in this approach. Having explored many of the management errors that resulted in major incidents such as the Aberfan coal slide in Wales, which killed 116 children and 28 adults in 1966, Turner wrote in the book Man-made Disasters (Butterworth Heinemann, 1977):

"However comforting the promise of an infinite tidiness [-¦] there are limits on our ability to reduce uncertainty, to master all of the open-ended and perverse qualities of our environment, and upon our ability to prevent disaster. If we start by recognising that instability lies at the heart of the world, then we may come to realise that the optimism and the assertion of certainty which enables life to create and spread order cannot completely overcome this instability."

In other words, even if we try to understand the chains of errors that "cause" accidents, disasters will still happen. Turner also emphasised how organisations could have an amplifying effect on individual human errors, making things worse rather than better.

We are not consistent, and it is that inconsistency -- or variability -- that has led to progress

In 1983 psychologist Lisanne Bainbridge warned of the "ironies of automation": the more we automate processes, the less capable people become to cope with problems when they occur. The less frequently we have to intervene to make a system work, the less knowledge we have of how it works (leading to more knowledge-based mistakes).

In 1984, Yale sociologist Charles Perrow published Normal Accidents (Princeton), in which he argued that our socio-technical environments are now so complex that accidents are inevitable. And yet, despite these often-cited works we continue as though we can identify all hazards, proceduralise all necessary controls, audit the procedures, and that accidents will only occur if people (whether frontline or management) make errors or choose to violate codes.

Safety too

There is an alternative way to look at behaviour that is labelled "human error" (see Error proneness box below). Perhaps errors are not a problem to be solved, but an innate attribute of human performance that is essential to learning and development. As a leading proponent of this idea, safety academic Erik Hollnagel has attempted to redefine safety. If old safety (or Safety I) is the absence of accidents, or "a condition where the number of things that go wrong is acceptably small", the study of safety will cover those things that go wrong, which inevitably leads to a focus on errors.

Safety II, by contrast, is where as many things as possible go right, and should lead to a focus on desirable outcomes, and encourage more of that. Safety I has an assumption that error-free procedures can be written, and that variability can and should be eliminated; Safety II sees variability in human performance as indispensable.

This is not a new idea. In 1982 Rasmussen explained: "Human variability is an important ingredient in adaptation and learning, and the ability to adapt to peculiarities in system performance and optimise interaction is the very reason for having people in a system."

He went on to suggest that the way to optimise performance was to provide people with opportunities for trial-and-error experiments, with human error considered as an unsuccessful experiment. In some situations, we can experiment because we have the time and resources to reverse the effect if it is not what we wanted. Say an area of floor has been identified as being particularly slippery, so a new method of cleaning is proposed. After the new method is adopted, if the problem remains, other methods can be tried. Complex systems such as flight decks and air traffic control do not allow for trial and error, so people are trained using simulators, which allow for unsuccessful experiments without the unacceptable consequences normally associated with them.

Rasmussen does not claim to have originated the idea that the variability that can lead to disaster or to triumph is the same thing, crediting the philosopher and physicist Ernst Mach in 1905: "Knowledge and error flow from the same mental sources; only success can tell the one from the other."

Rasmussen also identified the problem that Hollnagel tackles: that human errors are identified after the fact, only when a system performs unsatisfactorily. But where Rasmussen's solution to this was ergonomics and human factors -- design the machines and tasks to fit the way people act and think -- understanding Hollnagel's Safety II requires us to stop talking about errors, and instead talk about variability.

Positive variability

If we had always followed the procedures provided by those before us, we would still be carving our own tools, cooking on an open fire and riding horses, albeit with written procedures for the storage of sharp flints, the avoidance of burns, and controls for zoonoses -- diseases that can be transmitted to humans from animals. Humans are innovative -- we think of better ways of doing things, we try them, and if they work we carry on doing them. We are not consistent, and it is that inconsistency -- or variability -- that has led to progress.

The same behaviour that "caused" an accident today was the behaviour that yesterday got the job done successfully and quickly. The can-do attitude that won the contract is the same one that leads to an accident because of driving when tired; the culture that landed the first people on the moon was the same one that led managers to override the advice of engineers to launch the Challenger Space Shuttle on a day that was close to freezing in 1986.

In the short term it might be possible to specify how someone should climb a particular ladder safely to clean a particular window. A different window might need a different approach -- and we don't want to prevent someone finding a better way to clean the window that doesn't involve a ladder.

As the Loughborough University researchers in IOSH's OSH in a Changing World research programme found (bit.ly/2ri574Q), workarounds and dynamic risk assessments are recognised by many as acceptable forms of adapting existing procedures or, in some cases, creating procedures on the spot. Each time a business sends a vehicle out on the road, the driver is expected to adapt their focus to the circumstances. For more complicated systems it is even more important that we have people who can think through the options and determine the best approaches. The more complex our systems become, the greater is the need for "performance adjustments" without which, Hollnagel argues, "anything but the most trivial activity would be impossible".

Whereas Reason's accident trajectory was a straight line, suggesting a predictable linear sequence of events, Hollnagel talks of "non-linear emergent outcomes". Small amounts of variability in lots of places in the system (in people and in technical elements) affect each other in unpredictable ways to produce an undesirable effect. Trying to control the variability of each person and each technical component is practically impossible, and in any case undesirable -- since you would lose the benefits along with the disadvantages.

Returning to Turner's 1978 hypothesis that organisations amplify individual errors, Hollnagel's ideas challenge us to see how we can build resilient organisations instead, ones that can monitor conditions and adjust quickly to sustain operations and safety. He points out that this approach has the benefit of making organisations better able to respond to business opportunities as well as to safety threats.

Another outcome of considering human variability as something of value is that, rather than investigating just accidents or even near-misses, we should put more effort into talking to people about what they do when the outcomes are positive. Asking people how they avoided an accident, or how they prevented a problem escalating might be more revealing than waiting for accident.