The Blame Machine: Why Human Error Causes Accidents R.B.Whittingham AMSTERDAM BOSTON HEIDELBERG LONDON NEW YORK OXFORD PARIS SAN DIEGO SAN FRANCISCO SINGAPORE SYDNEY TOKYO Elsevier Butterworth-Heinemann Linacre House, Jordan Hill, Oxford OX2 8DP 200 Wheeler Road, Burlington, MA 01803 First published 2004 Copyright © 2004, R.B. Whittingham. All rights reserved The right of R.B. Whittingham to be identified as the author of this work has been asserted in accordance with the Copyright, Designs and Patents Act 1988 No part of this publication may be reproduced in any material form (including photocopying or storing in any medium by electronic means and whether or not transiently or incidentally to some other use of this publication) without the written permission of the copyright holder except in accordance with the provisions of the Copyright, Designs and Patents Act 1988 or under the terms of a licence issued by the Copyright Licensing Agency Ltd, 90 Tottenham Court Road, London, England W1T 4LP. Applications for the copyright holder’s written permission to reproduce any part of this publication should be addressed to the publisher. Permissions may be sought directly from Elsevier’s Science and Technology Rights Department in Oxford, UK; phone:(cid:2)44-0-1865-843830; fax:(cid:2)44-0-1865-853333; e-mail: [email protected]. You may also complete your request on-line via the Elsevier homepage (http://www.elsevier.com), by selecting ‘Customer Support’and then ‘Obtaining Permissions’. British Library Cataloguing in Publication Data Whittingham, Robert B. The blame machine : why human error causes accidents 1. Accidents 2. Errors 3. Accidents - Case studies I. Title 363.1 Library of Congress Cataloguing in Publication Data Whittingham, Robert B. The blame machine : why human error causes accidents / Robert B. Whittingham. p. cm. Includes bibliographical references and index. ISBN 0-7506-5510-0 (alk. paper) 1. Accidents. 2. Accidents–Prevention. 3. Human engineering. I. Title. HV675.W48 2003 363.1(cid:3)065–dc22 2003049531 ISBN 0 7506 5510 0 For information on all Elsevier Butterworth-Heinemann publications visit our website at www.bh.com Typeset by Charon Tec Pvt. Ltd, Chennai, India Printed and bound in Great Britain Contents Preface xi Acknowledgements xv Part I Understanding human error 1 To err is human 3 1.1 Defining human error 3 1.1.1 Introduction 3 1.1.2 Swain and Guttman 1983 3 1.1.3 Reason 1990 4 1.1.4 Hollnagel 1993 4 1.1.5 Meister 1966 4 1.1.6 Characterizing an error 5 1.2 Random and systemic errors 7 1.2.1 Introduction 7 1.2.2 Error causation 7 1.2.3 Human performance 8 1.2.4 Estimating human error probability 9 1.2.5 The balance between random and systemic errors 9 1.2.6 Human error and risk 11 References 11 2 Errors in practice 12 2.1 Introduction 12 2.2 Genotypes and phenotypes 12 2.2.1 Definition 12 2.2.2 Example of phenotype/genotype taxonomy 13 2.3 The skill, rule and knowledge taxonomy 15 2.3.1 Definitions 15 2.3.2 Selection of appropriate behaviour type 17 2.3.3 Determination of behaviour type 20 2.4 The generic error modelling system taxonomy 20 2.4.1 Overview 20 2.4.2 Slips and lapses 21 iv Contents 2.4.3 Mistakes 22 2.4.4 Summary 25 References 25 3 Latent errors and violations 26 3.1 Introduction 26 3.2 Latent and active errors 27 3.2.1 Introduction 27 3.2.2 Active errors 27 3.2.3 Latent errors 28 3.2.4 Latent errors in maintenance 30 3.2.5 Latent errors in management 31 3.3 Violations 33 3.3.1 Introduction 33 3.3.2 Definition of a violation 34 3.3.3 Distinction between errors and violations 35 3.3.4 Classification of violations 36 3.3.5 The causes and control of violations 40 References 43 4 Human reliability analysis 44 4.1 Introduction 44 4.2 Measuring human reliability 45 4.2.1 Introduction 45 4.2.2 Definitions 46 4.2.3 Expressing probability values 46 4.2.4 Performance shaping factors 47 4.2.5 Task complexity 47 4.3 Human reliability methods 49 4.3.1 Database methods 49 4.3.2 Expert judgement methods 56 4.3.3 Conclusion 57 4.4 Task decomposition 58 4.4.1 Introduction 58 4.4.2 Task analysis 58 4.5 Error identification 64 4.5.1 Introduction 64 4.5.2 Taxonomy based methods 64 4.5.3 Knowledge based methods 65 References 67 5 Human error modelling 69 5.1 Introduction 69 5.2 Basic probability theory 69 5.2.1 Introduction 69 5.2.2 Failure and success probability 70 Contents v 5.2.3 Probability of two or more independent events 70 5.2.4 Combining human error probabilities using logic gates 71 5.2.5 Fault trees 71 5.2.6 Event trees 72 5.3 Error recovery 74 5.3.1 Introduction 74 5.3.2 Error recovery mechanisms 75 5.3.3 Effect of error recovery on error probability 77 5.4 Error dependency 81 5.4.1 Introduction 81 5.4.2 Root causes 82 5.4.3 Coupling between errors 83 5.4.4 The importance of error dependency 84 5.4.5 Dependency modelling 85 References 89 6 Human error in event sequences 90 6.1 Introduction 90 6.2 Human reliability event trees 91 6.2.1 Introduction 91 6.2.2 Example human reliability analysis event tree 91 6.2.3 Quantification of error probabilities 92 6.2.4 Event tree logic 95 6.3 Scenario analysis 101 6.3.1 Introduction 101 6.3.2 Scenario 1: Influence of dependency on outcome F 101 3 6.3.3 Scenario 2: Influence of recovery factor in scenario F 101 5 6.4 Overview of human error modelling 103 6.4.1 Introduction 103 6.4.2 Task analysis 103 6.4.3 Error identification 104 6.4.4 Error quantification 104 6.4.5 Human reliability event trees 105 Part II Accident case studies 107 7 Organizational and management errors 109 7.1 Introduction 109 7.2 The Flixborough chemical plant disaster 110 7.2.1 Introduction 110 7.2.2 Description of the cyclohexane process 111 7.2.3 Events leading to the accident 112 7.2.4 The accident 114 7.2.5 The public inquiry 114 7.2.6 Alternative event sequence 116 vi Contents 7.2.7 Epilogue 117 7.2.8 Conclusions 117 7.3 The capsize of the Herald of Free Enterprise 119 7.3.1 The accident 119 7.3.2 The inquiry 119 7.3.3 Conclusions 122 7.4 Privatization of the railways 123 7.4.1 Introduction 123 7.4.2 Rail safety statistics before and after privatization 124 7.4.3 A brief history of railway safety management 125 7.4.4 The impact of privatization upon safety 126 7.4.5 Conclusion 128 References 129 8 Design errors 130 8.1 Introduction 130 8.2 The fire and explosion at BP Grangemouth 131 8.2.1 Introduction 131 8.2.2 Description of the process 132 8.2.3 The accident 133 8.2.4 The investigation 133 8.2.5 Report of the inquiry 134 8.2.6 The design error 135 8.2.7 Conclusion 136 8.3 The sinking of the ferry ‘Estonia’ 137 8.3.1 Introduction 137 8.3.2 The accident 137 8.3.3 The investigation 139 8.3.4 The causes 139 8.3.5 The aftermath 140 8.3.6 Conclusions 141 8.4 The Abbeystead explosion 143 8.4.1 Introduction 143 8.4.2 The accident 144 8.4.3 The investigation 145 8.4.4 The aftermath 147 8.4.5 Conclusion 148 References 149 9 Maintenance errors 150 9.1 Introduction 150 9.2 Engine failure on the Royal Flight 151 9.2.1 Introduction 151 9.2.2 The accident 151 Contents vii 9.2.3 Cause of the accident 152 9.2.4 Conclusion 152 9.3 The railway accident at Hatfield 157 9.3.1 Introduction 157 9.3.2 The accident 157 9.3.3 The causes 158 9.3.4 Investigations 158 9.3.5 Conclusions 160 9.4 The railway accident at Potters Bar 163 9.4.1 Introduction 163 9.4.2 Initial investigation – direct causes 164 9.4.3 Later findings – root causes 164 9.4.4 Postscript – the future of rail maintenance? 165 References 166 10 Active errors in railway operations 167 10.1 Introduction 167 10.2 Signals passed at danger 168 10.2.1 Introduction 168 10.2.2 The accident at Clapham Junction 169 10.3 The train accident at Purley 171 10.3.1 Introduction 171 10.3.2 The accident 171 10.3.3 The inquiry 172 10.3.4 Conclusion 172 10.4 The driver’s automatic warning system 172 10.4.1 System operation 172 10.4.2 A conditioned response 173 10.4.3 The effect of dependency 174 10.5 The Southall and Ladbroke Grove rail accidents 175 10.5.1 Introduction 175 10.5.2 The Southall rail accident 1997 175 10.5.3 The Ladbroke Grove accident 1999 178 10.6 Human error analysis of signals passed at danger 180 10.6.1 Introduction 180 10.6.2 Causes of SPADs 181 10.6.3 Probability of SPADs 181 10.6.4 Human reliability event tree for SPADs 182 10.6.5 Conclusion 185 10.7 Driver protection against SPADs 186 10.7.1 Introduction 186 10.7.2 Train protection and warning system 187 10.7.3 Automatic train protection 187 10.7.4 Conclusion 188 References 189 viii Contents 11 Active errors in aviation 190 11.1 Introduction 190 11.2 The loss of flight KAL007 191 11.2.1 Introduction 191 11.2.2 The accident 191 11.2.3 The causes 192 11.2.4 Conclusions 197 11.3 The Kegworth accident 199 11.3.1 Introduction 199 11.3.2 The accident 200 11.3.3 The causes 202 11.3.4 Conclusion 208 References 210 12 Violations 211 12.1 Introduction 211 12.2 The Chernobyl accident 212 12.2.1 Introduction 212 12.2.2 The Chernobyl reactor 212 12.2.3 Problems with the design 214 12.2.4 The accident 215 12.2.5 The causes 217 12.2.6 Conclusions 220 12.3 The Airbus A320 crash at Mulhouse 222 12.3.1 Introduction 222 12.3.2 The A320 Airbus 223 12.3.3 The accident at Mulhouse 224 12.3.4 Conclusions 232 References 233 13 Incident response errors 234 13.1 Introduction 234 13.2 Fire on Swissair flight SR111 235 13.2.1 Introduction 235 13.2.2 The accident 236 13.2.3 The causes 237 13.2.4 Conclusion 240 13.3 The Channel Tunnel fire 242 13.3.1 Introduction 242 13.3.2 Channel Tunnel description 242 13.3.3 The accident 244 13.3.4 The causes and development of the fire 247 13.3.5 The emergency response 247 13.3.6 Conclusions 251 References 253 Contents ix 14 Conclusions 254 14.1 Human error and blame 254 14.2 Understanding human error 256 14.3 Human error in industry 258 References 260 Appendix: Train protection systems 261 Index 267