The Second Story
This section establishes the authors' view of error and how socio-technical systems function. They describe two mutually exclusive world views: (1) “erratic people degrade an otherwise safe system” vs. (2) “people create safety at all levels of the socio-technical system by learning and adapting . . .” (p. 6) It should be obvious that the authors favor option 2.
In such a world “Failure, then, represents breakdowns in adaptations directed at coping with complexity. Indeed, the enemy of safety is not the human: it is complexity.” (p. 1) “. . . accidents emerge from the coupling and interdependence of modern systems.” (p. 31)
Adaptation occurs in response to pressures or environmental changes. For example, systems are under stakeholder pressure to become faster, better, cheaper; multiple goals and goal conflict are regular complex system characteristics. But adaptation is not always successful. There may be too little (rules and procedures are followed even though conditions have changed) or too much (adaptation is attempted with insufficient information to achieve goals). Because of pressure, adaptations evolve toward performance boundaries, in particular, safety boundaries. There is a drift toward failure. (see Dekker, reviewed here)
The authors present 15 premises for analyzing errors in complex socio-technical systems. (pp. 19-30) Most are familiar but some are worth highlighting and remembering when thinking about system errors:
- “There is a loose coupling between process and outcome.” A “bad” process does not always produce bad outcomes and a “good” process does not always produce good outcomes.
- “Knowledge of outcome (hindsight) biases judgments about process.” More about that later.
- “Lawful factors govern the types of erroneous actions or assessments to be expected.” In other words, “errors are regular and predictable consequences of a variety of factors.”
- “The design of artifacts affects the potential for erroneous actions and paths towards disaster.” This is Human Factors 101 but problems still arise. “Increased coupling increases the cognitive demands on practitioners.” Increased coupling plus weak feedback can create a latent failure.
Complex Systems Failure
This section covers traditional mental models used for assessing failures and points out the putative inadequacies of each. The sequence-of-events (or domino) model is familiar Newtonian causal analysis. Man-made disaster theory puts company culture and institutional design at the heart of the safety question. Vulnerability develops over time but is hidden by the organization’s belief that it has risk under control. A system or component is driven into failure. The latent failure (or Swiss cheese) model proposes that “disasters are characterized by a concatenation of several small failures and contributing events. . .” (p. 50) While a practitioner may be closest to an accident, the associated latent failures were created by system managers, designers, maintainers or regulators. All these models reinforce the search for human error (someone untrained, inattentive or a “bad apple) and the customary fixes (more training, procedure adherence and personal attention, or targeted discipline). They represent a failure to adopt systems thinking and concepts of dynamics, learning, adaptation and the notion that a system can produce accidents as a natural consequence of its normal functioning.
A more sophisticated set of models is then discussed. Perrow's normal accident theory says that “accidents are the structural and virtually inevitable product of systems that are both interactively complex and tightly coupled.” (p. 61) Such systems structurally confuse operators and prevent them from recovering when incipient failure is discovered. People are part of the Perrowian system and can exhibit inadequate expertise. Control theory sees systems as composed of components that must be kept in dynamic equilibrium based on feedback and continual control inputs—basically a system dynamics view. Accidents are a result of normal system behavior and occur when components interact to violate safety constraints and the feedback (and control inputs) do not reflect the developing problems. Small changes in the system can lead to huge consequences elsewhere. Accident avoidance is based on making system performance boundaries explicit and known although the goal of efficiency will tend to push operations toward the boundaries. In contrast, the authors would argue for a different focus: making the system more resilient, i.e., error-tolerant.** High reliability theory describes how how-hazard activities can achieve safe performance through leadership, closed systems, functional decentralization, safety culture, redundancy and systematic learning. High reliability means minimal variations in performance, which in the short-term, means safe performance but HROs are subject to incidents indicative of residual system noise and unseen changes from social forces, information management or new technologies. (See Weick, reviewed here)
Standing on the shoulders of the above sophisticated models, resilience engineering (RE) is proposed as a better way to think about safety. According to this model, accidents “represent the breakdowns in the adaptations necessary to cope with the real world complexity. (p. 83) The authors use the Columbia space shuttle disaster to illustrate patterns of failure evident in complex systems: drift toward failure, past success as reason for continued confidence, fragmented problem-solving, ignoring new evidence and intra-organizational communication breakdowns. To oppose or compensate for these patterns, RE proposes monitoring or enhancing other system properties including: buffering capacity, flexibility, margin and tolerance (which means replacing quick collapse with graceful degradation). RE “focuses on what sustains or erodes the adaptive capacities of human-technical systems in a changing environment.” (p. 93) In practice, that means detecting signs of increasing risk, having resources for safety available, and recognizing when and where to invest to offset risk. It also requires focusing on organizational decision making, e.g., cross checks for risky decisions, the safety-production-efficiency balance and the reporting and disposition of safety concerns. “Enhancing error tolerance, detection and recovery together produce safety.” (p. 26)
Operating at the Sharp End
An organization's sharp end is where practitioners apply their expertise in an effort to achieve the organization's goals. The blunt end is where support functions, from administration to engineering, work. The blunt end designs the system, the sharp end operates it. Practitioner performance is affected by cognitive activities in three areas: activation of knowledge, the flow of attention and interactions among multiple goals.
The knowledge available to practitioners arrives as organized content. Challenges include: organization may be poor, the content may be incomplete or simply wrong. Practitioner mental models may be inaccurate or incomplete without the practitioners realizing it, i.e., they may be poorly calibrated. Knowledge may be inert, i.e., not accessed when it is needed. Oversimplifications (heuristics) may work in some situations but produce errors in others and limit the practitioner's ability to account for uncertainties or conflicts that arise in individual cases. The discussion of heuristics suggests Hollnagel, reviewed here.
“Mindset is about attention and its control.” (p. 114) Attention is a limited resource. Problems with maintaining effective attention include loss of situational awareness, in which the practitioner's mental model of events doesn't match the real world, and fixation, where the practitioner's initial assessment of a situation creates a going-forward bias against accepting discrepant data and a failure to trigger relevant inert knowledge. Mindset seems similar to HRO mindfulness. (see Weick)
Goal conflict can arise from many sources including management policies, regulatory requirements, economic (cost) factors and risk of legal liability. Decision making must consider goals (which may be implicit), values, costs and risks—which may be uncertain. Normalization of deviance is a constant threat. Decision makers may be held responsible for achieving a goal but lack the authority to do so. The conflict between cost and safety may be subtle or unrecognized. “Safety is not a concrete entity and the argument that one should always choose the safest path misrepresents the dilemmas that confront the practitioner.” (p. 139) “[I]t is difficult for many organizations (particularly in regulated industries) to admit that goal conflicts and tradeoff decisions arise.” (p. 139) Overall, the authors present a good discussion of goal conflict.
How Design Can Induce Error
The design of computerized devices intended to help practitioners can instead lead to greater risks of errors and incidents. Specific causes of problems include clumsy automation, limited information visibility and mode errors.
Automation is supposed to increase user effectiveness and efficiency. However, clumsy automation creates situations where the user loses track of what the computer is set up to do, what it's doing and what it will do next. If support systems are so flexible that users can't know all their possible configurations, they adopt simplifying strategies which may be inappropriate in some cases. Clumsy automation leads to more (instead of less) cognitive work, user attention is diverted to the machine instead of the task, increased potential for new kinds of errors and the need for new user knowledge and judgments. The machine effectively has its own model of the world, based on user inputs, data sensors and internal functioning, and passes that back to the user.
Machines often hide a mass of data behind a narrow keyhole of visibility into the system. Successful design creates “a visible conceptual space meaningfully related to activities and constraints in a field of practice.” (p. 162) In addition, “Effective representations highlight 'operationally interesting' changes for sequences of behavior . . .” (p. 167) However, default displays typically do not make interesting events directly visible.
Mode errors occurs when an operator initiates an action that would be appropriate if the machine were in mode A but, in fact, it's in mode B. (This may be a man-machine problem but it's not the machine's fault.) A machine can change modes based on situational and system factors in addition to operator input. Operators have to maintain mode awareness, not an easy task when viewing a small, cluttered display that may not highlight current mode or mode changes.
To cope with bad design “practitioners adapt information technology provided for them to the immediate tasks at hand in a locally pragmatic way, . . .” (p. 191) They use system tailoring where they adapt the device, often by focusing on a feature set they consider useful and ignoring other machine capabilities. They use task tailoring where they adapt strategies to accommodate constraints imposed by the new technology. Both types of adaptation can lead to success or eventual failures.
The authors suggest various countermeasures and design changes to address these problems.
Reactions to Failure
Different approaches for analyzing accidents lead to different perspectives on human error.
Hindsight bias is “the tendency for people to 'consistently exaggerate what could have been anticipated in foresight.'” (p. 15) It reinforces the tendency to look for the human in the human error. Operators are blamed for bad outcomes because they are available, tracking back to multiple contributing causes is difficult, most system performance is good and investigators tend to judge process quality by its outcome. Outsiders tend to think operators knew more about their situation than they actually did. Evaluating process instead of outcome is also problematic. Process and outcome are loosely coupled and what standards should be used for process evaluation? Formal work descriptions “underestimate the dilemmas, interactions between constraints, goal conflicts, and tradeoffs present in the actual workplace.” (p. 208) A suggested alternative approach is to ask what other practitioners would have done in the same situation and build a set of contrast cases. “What we should not do, . . . is rely on putatively objective external evaluations . . . such as . . . court cases or other formal hearings. Such processes in fact institutionalize and legitimate the hindsight bias . . . leading to blame and a focus on individual actors at the expense of a system view.” (pp. 213-214)
Distancing through differencing is another risk. In this practice, reviewers focus on differences between the context surrounding an accident and their own circumstance. Blaming individuals reinforces belief that there are no lessons to be learned for other organizations. If human error is local and individual (as opposed to systemic) then sanctions, exhortations to follow the procedures and remedial training are sufficient fixes. There is a decent discussion of TMI here, where, in the authors' opinion, the initial sense of fundamental surprise and need for socio-technical fixes was soon replaced by a search for local, technologically-focused solutions.
There is often pressure to hold people accountable after incidents or accidents. One answer is a “just culture” which views incidents as system learning opportunities but also draws a line between acceptable and unacceptable behavior. Since the “line” is an attribution the key question for any organization is who gets to draw it. Another challenge is defining the discretionary space where individuals alone have the authority to decide how to proceed. There is more on just culture but this is all (or mostly) Dekker. (see our Just Culture commentary here)
The authors' recommendations for analyzing errors and improving safety can be summed up as follows: recognize that human error is an attribution; pursue second stories that reveal the multiple, systemic contributors to failure; avoid hindsight bias; understand how work really gets done; search for systemic vulnerabilities; study how practice creates safety; search for underlying patterns; examine how change will produce new vulnerabilities; use technology to enhance human expertise; and tame complexity. (p. 239) “Safety is created at the sharp end as practitioners interact with hazardous processes . . . using the available tools and resources.” (p. 243)
Our Perspective
This is a book about organizational characteristics and socio-technical systems. Recommendations and advice are aimed at organizational policy makers and incident investigators. The discussion of a “just culture” is the only time culture is discussed in detail although safety culture is mentioned in passing in the HRO write-up.
Our first problem with the book is repeatedly referring to medicine, aviation, aircraft carrier operations and nuclear power plants as complex systems.*** Although medicine is definitely complex and aviation (including air traffic control) possibly is, carrier operations and nuclear power plants are simply complicated. While carrier and nuclear personnel have to make some adaptations on the fly, they do not face sudden, disruptive changes in their technologies or operating environments and they are not exposed to cutthroat competition. Their operations are tightly coordinated but, where possible, by design more loosely coupled to facilitate recovery if operations start to go sour. In addition, calling nuclear power operations complex perpetuates the myth that nuclear is “unique and special” and thus merits some special place in the pantheon of industry. It isn't and it doesn't.
Our second problem relates to the authors' recasting of the nature of human error. We decry the rush to judgment after negative events, particularly a search limited to identifying culpable humans. The search for bad apples or outright criminals satisfies society's perceived need to bring someone to justice and the corporate system's desire to appear to fix things through management exhortations and training without really admitting systemic problems or changing anything substantive, e.g., the management incentive plan. The authors' plea for more systemic analysis is thus welcome.
But they push the pendulum too far in the opposite direction. They appear to advocate replacing all human errors (except for gross negligence, willful violations or sabotage) with systemic explanations, aka rationalizations. What is never mentioned is that medical errors lead to tens of thousands of preventable deaths per year.**** In contrast, U.S. commercial aviation has not experienced over a hundred fatalities (excluding 9/11) since 1996; carriers and nuclear power plants experience accidents, but there are few fatalities. At worst, this book is a denial that real human errors (including bad decisions, slip ups, impairments, coverups) occur and a rationalization of medical mistakes caused by arrogance, incompetence, class structure and lack of accountability.
This is a dense book, 250 pages of small print, with an index that is nearly useless. Pressures (most likely cost and schedule) have apparently pushed publishing to the system boundary for copy editing—there are extra, missing and wrong words throughout the text.
This 2010 second edition updates the original 1994 monograph. Many of the original ideas have been fleshed out elsewhere by the authors (primarily Dekker) and others. Some references, e.g., Hollnagel, Perrow and the HRO school, should be read in their original form.
* D.D. Woods, S. Dekker, R. Cook, L. Johannesen and N. Sarter, Behind Human Error, 2d ed. (Ashgate, Burlington, VT: 2010). Thanks to Bill Mullins for bringing this book to our attention.
** There is considerable overlap of the perspectives of the authors and the control theorists (Leveson and Rasmussen are cited in the book). As an aside, Dekker was a dissertation advisor for one of Leveson's MIT students.
*** The authors' different backgrounds contribute to this mash-up. Cook is a physician, Dekker is a pilot and some of Woods' cited publications refer to nuclear power (and aviation).
**** M. Makary, “How to Stop Hospitals From Killing Us,” Wall Street Journal online (Sept. 21, 2012). Retrieved July 4, 2013.
No comments:
Post a Comment
Thanks for your comment. We read them all. The moderator will publish comments that are related to our content.