rca-human-factors

Human-Factors RCA

"The root cause was human error" is almost never a useful investigation finding. It stops the inquiry exactly where it should begin. This skill teaches the frameworks that treat human performance as a window into the system that produced it — so you end up redesigning the system rather than retraining the operator.

Why "human error" is a symptom, not a cause

Sidney Dekker's principle (2014, The Field Guide to Understanding "Human Error"): if your RCA concludes with a person doing something wrong, you are roughly 20% through the investigation. The next 80% is the question: why was that action reasonable from where the person was standing, with the information they had, under the pressures they faced?

This reframing is not soft on accountability. It is the opposite: it refuses to let organizational design off the hook by letting the nearest human take the blame.

Framework 1 — Reason's Swiss Cheese Model

James Reason (Managing the Risks of Organizational Accidents, 1997) proposed that defenses against accidents are arranged in layers, each with weaknesses ("holes"). An accident occurs when holes in successive layers align and a hazard passes through all defenses.

The slices

1. Organizational influences — culture, resource allocation, policies, incentive structures.
2. Unsafe supervision — inadequate oversight, planned inappropriate operations, failure to correct known problems.
3. Preconditions for unsafe acts — environmental factors, fatigue, stress, poor communication, inadequate tools.
4. Unsafe acts — errors (slips, lapses, mistakes) and violations (routine, exceptional, sabotage).

Active vs. latent failures

• Active failures — unsafe acts at the sharp end by operators in direct contact with the system. Immediate and visible.
• Latent failures — dormant conditions introduced upstream by decisions of designers, managers, and policymakers. May lie dormant for years before combining with a local trigger.

Reason's insight: latent failures are the more productive focus for investigation because they affect many future incidents, not just the one you're investigating. Fixing the sharp-end operator fixes one accident; fixing the latent condition fixes the class.

Perneger's 2005 validation

Perneger's cross-sectional study of 159 healthcare quality professionals found widespread misunderstanding of the Swiss Cheese Model even among practitioners who used it weekly. Common errors:

• Treating "slices" as sequential (slice 1 must hold or we go to slice 2) when they are actually parallel layered defenses.
• Treating "holes" as fixed when they are dynamic, opening and closing with operational conditions.
• Treating "arrows" as a single trajectory when hazards can traverse multiple paths simultaneously.
• Treating active errors as the only causes when latent conditions usually dominate.

Takeaway: use the model but verify that your team's mental model of it is correct. Test understanding before running the framework.

Framework 2 — HFACS (Human Factors Analysis and Classification System)

HFACS was developed by Shappell and Wiegmann at the U.S. Naval Safety Center (2000) as a taxonomy for classifying human-factors contributors to aviation mishaps. It is a direct operationalization of Reason's Swiss Cheese Model.

The HFACS hierarchy

Organizational Influences
├── Resource Management
├── Organizational Climate
└── Organizational Process

Unsafe Supervision
├── Inadequate Supervision
├── Planned Inappropriate Operations
├── Failure to Correct a Known Problem
└── Supervisory Violations

Preconditions for Unsafe Acts
├── Environmental Factors
│   ├── Physical Environment
│   └── Technological Environment
├── Condition of Operators
│   ├── Adverse Mental States
│   ├── Adverse Physiological States
│   └── Physical/Mental Limitations
└── Personnel Factors
    ├── Crew Resource Management
    └── Personal Readiness

Unsafe Acts
├── Errors
│   ├── Decision Errors
│   ├── Skill-Based Errors
│   └── Perceptual Errors
└── Violations
    ├── Routine
    └── Exceptional

How to apply HFACS

1. Extract every contributing factor from the incident narrative.
2. Classify each factor into exactly one HFACS category (with forced-choice rules).
3. Tally classifications — look for patterns across many incidents.
4. Corrective actions must target categories with high incident density, not one-off causes.

Why it works

HFACS forces investigators to look beyond the proximate unsafe act. A well-run HFACS analysis on an aviation incident typically finds 3–5 latent conditions for every active error. Over a fleet of incidents, the taxonomy produces patterns that drive systemic interventions.

HFACS variants

• HFACS-ME (maintenance environment)
• HFACS-MI (military operations)
• HFACS-RR (rail) — adapted for rail incident investigation
• HFACS-HC (healthcare) — adapted for clinical settings

Use the variant matched to your domain, or adapt the generic framework with domain-specific sub-categories.

Framework 3 — Just Culture algorithm

The Just Culture concept, developed by David Marx (Outcome Engenuity) and adopted by the Global Aviation Information Network (GAIN), provides a decision algorithm for distinguishing the kind of unsafe act that calls for:

• Console (the actor was in the hands of an unsafe system)
• Coach (at-risk behavior drift needs course correction)
• Discipline (reckless or intentional violation)

The three behaviors

| Behavior | Definition | Response | |---|---|---| | Human error | Unintended deviation from what was planned | Console; analyze system | | At-risk behavior | Behavioral choice that increases risk where risk is unrecognized or believed justified | Coach; remove incentive | | Reckless behavior | Conscious disregard of substantial and unjustifiable risk | Discipline |

The Marx algorithm for a specific action

For each person involved in an unsafe act, walk through these questions in order:

1. Impairment test. Was the person impaired (drugs, alcohol, medical condition)? If yes → discipline (or medical).
2. Foresee-ability test. Would a professional in the same role at that moment have seen the risk? If no → human error, console.
3. Alternate-action test. Was there a clearly better alternative? If no → human error, console.
4. Substitution test. Would three similarly-situated peers have taken the same action? If yes → system problem, console.
5. History test. Is this a pattern of drift, or a single lapse? Pattern → at-risk, coach. Single → human error.
6. Recklessness test. Did the person knowingly disregard a substantial and unjustifiable risk? If yes → reckless, discipline.

A well-run Just Culture investigation protects operators from punitive responses to system-induced errors while maintaining accountability for reckless behavior. The algorithm is not a license to excuse everything — it is a disciplined classifier.

Counterexample: punitive response undoes reporting

Organizations that punish human error destroy their own incident-reporting systems: operators learn to hide errors, and latent conditions accumulate invisibly. This is well-documented in aviation (pre-ASRS era), healthcare (pre-AHRQ PSOs), and nuclear (pre-INPO). Just Culture is an organizational survival mechanism, not moral philosophy.

Framework 4 — CRM (Crew Resource Management)

Crew Resource Management emerged from the 1979 NASA workshop on flight-crew errors and the 1978 United 173 crash (fuel exhaustion due to captain's preoccupation with a landing-gear indicator). Its premise: technical skill is not enough; the crew as a team must manage communication, workload, and decision-making under stress.

Core CRM topics

• Authority gradient management — flattening excessive authority gradients so first officers will challenge captains.
• Closed-loop communication — standard