Human factors and types of error

A week into the investigation, Rachel Okoye, the vice-president of operations, asked Elena a direct question on the phone. 'I've read the interim notes. I understand the light failed and the walkway was blocked. But at the end of the day, didn't the driver reverse into someone without seeing her, and didn't she walk where she shouldn't have? Aren't those the causes?' It is the question every investigation reaches sooner or later, and the answer depends on understanding how human error actually works.

This lesson introduces the main ideas from human factors research that investigators use: the difference between active failures and latent conditions, the types of error people make, the factors that shape performance, and a structured way to classify findings across levels of an organization. The goal is not to excuse anyone. It is to find the causes that can actually be fixed.

Error is normal

People make errors every day, in every job, however skilled and careful they are. Experienced drivers miss mirrors. Expert surgeons occasionally operate on the wrong site. Pilots with thousands of hours mis-set an altimeter. Research in aviation, health care and industry has shown again and again that error is a normal part of human performance, not a sign of a bad worker. What separates safe systems from unsafe ones is not whether people make errors, but whether the system catches errors before they cause harm and limits the harm when they are not caught.

This has a practical consequence for investigators. If an incident report concludes that a worker made an error, it has said almost nothing, because workers will always make errors. The useful questions are what kind of error it was, what made it likely, and why the system did not catch it.

Active failures and latent conditions

The psychologist James Reason, whose work in the 1990s shaped modern safety thinking, distinguished between two kinds of failure. Active failures are the unsafe acts of people at the sharp end, close to the hazard: the driver who reverses without seeing a pedestrian, the operator who presses the wrong button. Their effects are immediate. Latent conditions are weaknesses built into the system by decisions made earlier, often far from the scene: poor layouts, inadequate equipment, missing procedures, production pressure, understaffing, training gaps. They can lie dormant for a long time and only cause harm when they combine with active failures and local triggers.

Reason illustrated this with what became known as the Swiss cheese model. Each layer of defence in a system, such as design, equipment, procedures, training and supervision, is like a slice of Swiss cheese. Each slice has holes, some created by active failures and some by latent conditions, and the holes open, close and shift over time. Most of the time, a hole in one slice is blocked by the next. An incident happens when the holes in several slices line up and a hazard passes straight through.

The model has critics. It can make a complex system look like a neat stack of independent barriers, when in reality the layers interact, and one weakness often causes others. Production pressure, for example, made the staging lane seem necessary, left the pallet return area full and encouraged the urgent replenishment message. But as a way of explaining to managers why one worker's error is rarely the whole story, the Swiss cheese model remains one of the most useful pictures in safety.

Types of error

Reason also offered a classification of unsafe acts that investigators still use. It separates errors, which are unintended, from violations, which are deliberate departures from rules or expected practice.

• Slips are actions that do not go as planned: the right intention, the wrong execution. Pressing the lift lever instead of the tilt lever is a slip. Slips often happen during familiar, automatic tasks when attention is elsewhere.
• Lapses are failures of memory: forgetting a step, losing one's place in a sequence. Forgetting to set the parking brake is a lapse.
• Mistakes are errors of planning or judgement: the action goes as intended, but the intention was wrong. Rule-based mistakes apply a good rule in the wrong situation or a bad rule; knowledge-based mistakes happen in unfamiliar situations where the person has to reason from limited understanding.
• Violations are deliberate departures from a rule or procedure. Routine violations are habitual shortcuts that have become normal practice. Situational violations happen because the situation makes the rule hard or impossible to follow. Exceptional violations are rare, one-off departures, often under unusual pressure.

The classification matters because each type of error needs a different kind of fix. Telling people to concentrate harder does little for slips and lapses, which happen to careful people; design changes, physical barriers, interlocks and checklists help more. Mistakes call for better training, better information and clearer cues. Violations, especially routine and situational ones, call for removing the reasons people depart from the rule: making the safe way the easy way, fixing equipment that makes the procedure hard, and changing the pressures that reward the shortcut.

Applying the types to aisle 14

Elena and the team worked through each unsafe act they had found and asked what kind it was.

Jordan reversed into the travel aisle without seeing Marie. He had been trained to watch the blind spot on the staging lane side, and to rely on the blue dot to warn anyone behind him. He did exactly that. Nobody had told him the light could fail without warning, or that a picker might come from the far side because the walkway was blocked. His action was a rule-based mistake: he applied a reasonable rule, watch the known blind spot and trust the warning light, in a situation where it no longer worked. It was not a violation; he was within the speed limit, logged in, belted, and following his training.

Marie walked in the travel aisle rather than the walkway. Everyone on the night shift did the same, because the walkway had been blocked for at least a week and the travel aisle was the only practical route around the stack. That was a situational violation that had become routine: the situation made the rule impractical, and repetition without harm made the shortcut normal. She was also scanning a label while walking, which her pick device's design encouraged, and her hood and the fan noise masked the alarm. Expecting the blue dot, she read its absence as safety.

Ken closed two near misses with reminders. That was not an error in the usual sense. It was a decision made within the limits of his authority, the form's options and the information he had, and it reflected a latent condition: the near-miss process did not route high-potential reports to anyone who could change a layout.

Performance shaping factors

Human factors specialists use the term performance shaping factors, or performance influencing factors, for the conditions that make errors more or less likely. They include the task (complexity, time pressure, workload, interruptions), the individual (fatigue, experience, health, stress), the environment (lighting, noise, temperature, layout) and the organization (staffing, scheduling, supervision, culture, incentives). Most incidents involve several.

Aisle 14 had many. The collision happened at 2:15 a.m., near the low point of human alertness, which research on shift work places roughly between 2 and 6 a.m. The temperature was about minus 25 degrees Celsius, with workers in bulky suits and hoods that limited hearing and peripheral vision. Lighting had been reduced. Fan noise masked alarms. Both workers had screens directing their attention to the next task. A red priority flag and a dispatcher's deadline added time pressure. Jordan was in his sixth week and had not had a practical evaluation on the site's routes. And the blue light, by working reliably for a year, had trained everyone to trust it.

That last factor has a name in human factors research: over-reliance, sometimes called automation complacency. When a warning or automated system works well for a long time, people come to depend on it and stop using the cues and checks they used before. If the system then fails silently, without telling anyone it has failed, it can leave people less safe than if it had never been installed. Good design either makes failures obvious or checks the system often enough that a failure is found quickly.

Seeing it from inside: local rationality

The safety researcher Sidney Dekker and others have argued for what is sometimes called the local rationality principle: people do what makes sense to them at the time, given their goals, their knowledge, and the situation as they see it. When an action looks foolish in hindsight, the investigator's job is to find out why it did not look foolish to the person at the time.

Hindsight bias works against this. Once investigators know the outcome, the warning signs look obvious, and they find it hard to imagine not seeing them. Outcome bias makes it worse: the same decision is judged more harshly when it led to harm than when it did not. Every picker on the night shift had walked round the pallet stack for a week. Only one was hurt, and it would be easy, and wrong, to judge her as more careless than the others.

Elena's answer to Rachel drew all of this together. 'Yes, the driver didn't see her and she wasn't on the walkway,' she said. 'If we stop there, we'll retrain two people and change nothing. The same truck with the same dead light is still in the building. The next driver will make the same mistake, because he'll be following the same training. And the walkway will be blocked again the next time the pallet return area fills up. Their actions are where the system's weaknesses showed up. They're not where the weaknesses came from.'

Classifying findings across levels: HFACS

The Human Factors Analysis and Classification System, or HFACS, was developed around 2000 by Douglas Wiegmann and Scott Shappell from Reason's model, first for military aviation and later adapted for many industries. It gives investigators four levels at which to look for causes.

• Unsafe acts: the errors and violations of the people directly involved.
• Preconditions for unsafe acts: the conditions of the people and environment, such as fatigue, distraction, poor lighting, noise, and communication or teamwork problems.
• Unsafe supervision: inadequate supervision, planned work that put people at risk, failure to correct known problems, and supervisory violations.
• Organizational influences: resource management, organizational climate and pressure, and organizational processes such as change management, procedures and oversight.

The value of HFACS is that it pushes the team to look at all four levels and gives them a shared vocabulary. A finding list that has everything at the unsafe acts level and nothing above it is a sign the analysis has stopped too early.

# Classify the aisle 14 findings by HFACS level.
findings = [
    ("driver relied on blue dot and watched the known blind spot", "unsafe act"),
    ("picker walked in the travel aisle around the stack",          "unsafe act"),
    ("night lighting reduced, fan noise masked the alarm",         "precondition"),
    ("hood up, dark suit, no workable high-visibility option",     "precondition"),
    ("time pressure from the 3:00 truck and the dispatch message",  "precondition"),
    ("blocked walkway tolerated for a week",                       "supervision"),
    ("near misses closed with reminders",                           "supervision"),
    ("truck kept in service with a failed light",                  "supervision"),
    ("practical evaluation for new drivers not done",              "supervision"),
    ("staging lane created without any safety review",              "organizational"),
    ("pre-use checklist never updated for the new light",          "organizational"),
    ("pallet return area too small for volume",                     "organizational"),
]
levels = ["unsafe act", "precondition", "supervision", "organizational"]
for lvl in levels:
    items = [f for f, l in findings if l == lvl]
    print(f"{lvl:<15} {len(items)}")
above = sum(1 for _, l in findings if l != "unsafe act")
print(f"findings above the unsafe-act level: {above} of {len(findings)}")

unsafe act      2
precondition    3
supervision     4
organizational  3
findings above the unsafe-act level: 10 of 12

Ten of the twelve findings sat above the level of the two workers' actions. That count is not a measure of blame; it is a map of where the fixes are. The corrective actions in lesson 11 target mostly the supervision and organizational levels, because that is where a single change can protect every driver and picker on every shift.