Handbook of Industrial Automationedited - Chapter 8 pps

disci-1.2.5.1 Investigation ConceptsConcepts about occurrences and investigations guidehow investigators think about what they are investigat-ing, and what they do during an investigatio

This chapter describes what an investigation program

is, what it should accomplish for an organization, how

it should be created, and what investigators should

do within that framework It presents investigation

fundamentals in a way that enables everyone in an

organization to tailor the ideas so they satisfy their

speci®c investigation needs It includes models to

help investigators during investigations, and references

providing detailed guidance for program designers and

investigators

Accidents involving automated systems occur

infre-quently However, many kinds of investigations are

conducted in organizations using automated systems

Supervisors, mechanics, engineers, labor

representa-tives, claims adjusters, safety sta€, and others

investi-gate claims, operational disruptions, equipment

breakdowns, accidents, ®res, injuries, outages, quality

deviations, environmental insults, and other

unex-pected or undesired occurrences Each type of

investi-gation has many common tasks These commonalties

are masked by thinking about each kind of

investiga-tion as unique In this fragmented environment

nobody looks for the commonalties, or opportunities

that co-ordinated thinking about all investigations

might o€er Thus potential improvements in

investiga-tion programs are overlooked This chapter addresses

that oversight It describes the overlooked

opportu-nities and how to establish a program to take

advan-tage of them

1.2 WHAT IS AN INVESTIGATIONPROGRAM?

An investigation program is an organization'songoing structured activity to investigate unintended

or unexpected and unwanted occurrences This tion describes the context in which such a programexists and functions, the role of the program in adynamic organization, the nature of occurrences andinvestigations and the conceptual basis for an inves-tigation program The context provides the back-ground that explains what an investigation programshould accomplish, and what an organization shoulddemand of an investigation program The discussion ofthe role describes the relationship of an investigationprogram to other organizational activities The discus-sion of the nature of occurrences and investigationsdescribes useful ways to think about them within anorganization The discussion of the knowledge needed

sec-to do investigations describes essential investigationconcepts and principles needed to produce the desiredresults

1.2.1 Investigation Program ContextInvestigations take place within an organizational con-text and a regulatory context The organizational con-text should dominate investigation programs, but mustaccommodate the regulatory environment

689

1.2.1.1 Organizational Context

Nobody likes unpleasant surprises Progressive

man-agers view an investigation program broadly as a set

of continuing activities designed to understand,

pre-dict, and control or prevent unpleasant and unwanted

``surprises'' in operations These surprises include

many kinds of occurrences, such as injuries, accidents,

®res, breakdowns, outages or delays, environmental

insults, operational disruptions, claims, or other

kinds of undesired events Surprises re¯ect deviations

from expected or intended or hoped-for performance,

interfering with desired outcomes The fundamental

mission of a comprehensive investigation program is

to improve future performance by thoroughly

under-standing and acting on past occurrences of all kinds

Recurring unpleasant surprises are in indication, in

part, of investigation program shortcomings or

fail-ures, or possibly the lack of a competent investigation

program

1.2.1.2 Regulatory Context

In addition to an organization's internal interests,

cer-tain regulatory requirements a€ect the investigation

context in most organizations employing or supplying

automated systems Most employers are subject to

occupational safety and health regulations, which

include investigation program requirements [1]

Brie¯y summarized, regulations require that:

1 All accidents should be investigated

2 Accidents involving fatalities or hospitalization

of ®ve or more employees be investigated to

determine casual factors involved and that on

scene evidence be left untouched until agency

inspectors can examine it

3 Any information or evidence uncovered during

accident investigations which would be of

bene®t in developing a new regulatory standard

or in modifying or revoking an existing

stan-dard be promptly transmitted to the agency

4 The investigative report of the accident shall

include appropriate documentation on date,

time, location, description of operations,

description of accident, photographs, interviews

of employees and witnesses, measurements, and

other pertinent information, be distributed to

certain people, and made available to an agency

representative The regulation does not specify

explicitly the purpose of required investigations,

but a standards development purpose is

implied

1.2.2 Investigation RolesThe basic functional role of investigations of all kinds

is to develop a basis for and report on future action toimprove future performance The basis for action mustalways be a valid description and explanation of occur-rences, developed promptly, eciently, objectively,and consistently

This requires investigators to document theirdescription and explanation, reporting them in a waythat enables managers and others to understand,accept, and want to act on this new information.Investigations should assure discovery and de®nition

of problems or needs that require action, and ofactions for addressing them They should also provide

a way to assess whether the changes introduced ally improved future performance Investigationsshould also validate predictive analyses and designdecisions If these basic needs are satis®ed, opportu-nities for additional bene®ts can be realized

actu-Investigators ®rst look backward in time to mine and explain what happened When they under-stand that, they must look forward in time to identifychanges that will improve future performance To ful-

deter-®ll their role, investigations must be perceived by alla€ected as desirable, valuable and helpful, rather thanjudgmental, threatening, punitive, vengeful, or accusa-tory To achieve best long term results, the tone of theinvestigation program must encourage co-operationand support

1.2.2.1 Desired Roles for InvestigationsCompetently designed and implemented investigationprograms should report new understanding of occur-rences in ways that help:

Reduce future surprises which interfere with desiredoutputs

Resolve claims and disputes

Satisfy regulatory requirements

They also have the potential to:

Reduce resource needs by revealing potential cess improvements

pro-Enhance employee capability and morale withconstructive work products

Reduce exposure to litigation

Provide a way to audit analyses of planned tions

func-Predict changes to in¯uence future risks

Identify shifting norms and parameters inoperations

Contribute to the organization's long term

corpo-rate memory

One other potential role requires an executive

deci-sion The choice is whether or not to use investigations

to assess installed safety and reliability systems and

their performance Audits require special criteria and

audit methods, and additional data, so it is advisable

to conduct program audits as stand-alone activities

rather than an element of investigations

1.2.2.2 Traditional Views of Investigation Role

That view di€ers from the regulatory view of the role

of investigations Traditional investigation perceptions

and assumptions in industrial settings focus narrowly

on accident investigations, failures, unsafe acts and

con-ditions, basic, direct and indirect accident causes, and

compliance That focus does not address or satisfy

many internal needs, and limits opportunities for

broader achievements The Federal agency regulating

industrial robotics safety, for example, views

investiga-tions as an element of a safety program rather than a

part of a broad organizational performance

improve-ment program In its view investigations have a narrow

goal of preventing similar accidents and incidents in

the future It holds that ``thousands of accidents

occur throughout the United States every day, and

that the failure of people, equipment, supplies, or

sur-roundings to behave or react as expected causes most

of the accidents Accident investigations determine

how and why these failures occur'' [2] Note the

negative tone of this ``failure'' and cause-oriented

perspective

The agency's demands of investigations are also

narrow ``By using the information gained through

an investigation, a similar or perhaps more disastrous

accident may be prevented Conduct accident

investi-gations with accident prevention in mind'' (emphasis

added) [2]

The loss or harm threshold, rather than the surprise

nature of the occurrence, narrows the ®eld of

candi-dates for investigation The authority to impose

penal-ties also in¯uences the agency's perception of

investigations, and the procedures it must follow

When it becomes involved in investigations, operating

organizations must recognize and adapt to the

regula-tory agency's perspectives

In summary, the role of an investigation program

should be constructive, designed to develop new

knowledge to support a broad range of future actions

in an organization, and produce timely, ecient,

objec-tive and consistent outputs

1.2.3 Nature of Investigation Processes

To investigate something is to examine it cally Any investigation should be a systematic exam-ination process The investigation process focuses onexamining the people and objects involved in theoccurrence, and everything they did that was necessaryand sucient to produce the process outcome thatprompted the investigation

systemati-Investigations involve many tasks Most share manycommon investigation tasks and tools For example, inevery investigation the investigator must:

Make observations of people and objects involved

Recognize, de®ne, and act on unknowns, and framequestions to pose

Diagnose objectively what happened to de®ne needsfor change and candidate changes

Evaluate needs and propose actions, with ways tomonitor their success

Prepare valid and persuasive investigation workproducts

Mediate di€ering views

The speci®c nature of each task and level of e€ortrequired of the investigator di€er in nature depending

on the kind and level of investigation required Forexample, the degree of e€ort required to prepare anincident report form is the least complex, and may beconsidered the lowest level of investigation (Level 1).The nature of that investigation is to gather dataneeded to complete a reporting form That need isusually satis®ed by sequencing whatever data can beacquired in a relatively brief time Note that the datacollected on forms are analyzed later by accident orclaims analysts This may mean that several similarincidents must occur before sucient data for someanalysis methods is available

A slightly greater e€ort and more tasks are required

to complete a logically sequenced and tested narrativedescription of what happened, or Level 2 investigation.This level requires the investigator to do some logicalanalysis tasks as the data are gathered For example,understanding equipment breakdowns requires thiskind of e€ort

When the description of what happened must be

expanded to include carefully developed explanations,

a greater level of investigation is required Level 3

investigations may involve teams, and additional

ana-lytical and testing tasks to validate the explanation and

assure adequate objectivity and quality This level is

required for matters that might be involved in

litiga-tion or compliance aclitiga-tions, or contractual disputes

over equipment performance or warranty claims

If recommendations for actions to improve future

performance are required of an investigator, the

investigator must do additional forward-looking data

gathering and di€erent analytical tasks Level 4

inves-tigations are the most complex and demanding and

usually involve an investigation team They should be

required for any major casualty, or facility or design

changes driven by undesired occurrences Thus the

nat-ure of an investigation and the knowledge and skills

required to do them is dependent on the expected

investigation level and outputs

The nature of an investigation is also partially

dependent on the number of investigating

organiza-tions conducting investigaorganiza-tions of the same occurrence

The tasks where interactions occur should be reviewed

with organizations which might be involved in

investi-gations For example, whenever fatal injuries occur, an

incident might involve investigators from

organiza-tions such as a local law enforcement agency or

med-ical examiner, a state or federal regulatory authority,

an insurance representative, and an organizational

team The authority and actions of those ocials

should be identi®ed before an occurrence, and general

agreement reached about who would do what in an

investigation When law enforcement or regulatory

investigators are involved, their interests include access

to witnesses and property, and preservation of

evi-dence until an investigation has been completed [1]

Legal rights also may a€ect the nature of the

investiga-tion These interactions are complex, but planning

helps everyone work together when required

1.2.4 Investigation Knowledge Needs

Performance of investigation tasks requires knowledge

about investigation concepts, principles and practices,

and skills in applying that knowledge Investigation

knowledge is not the same as knowledge about

auto-mated or robotics systems Every autoauto-mated system

expert is not intuitively an automated system

investiga-tion expert Addiinvestiga-tionally, system experts tend to

unconsciously accept assumptions and ideas on

which their decisions about the system are structured

Frequently those assumptions and ideas have uted to the occurrence Expert investigators avoid thattrap by applying their investigation knowledge andskills

contrib-During the investigation process, investigators useinvestigation tools to determine, describe, and explainwhat happened Sometimes they need expert help toacquire or interpret data they need from objectsinvolved in the occurrence These data can be acquiredwith the help of others by knowing how to identify theexpertise needed, and how to frame the right questionsfor those experts Typically, such experts have expertknowledge and experience in some specialized ®eld ofthe physical sciences, and can interpret what actionswere required to produce the observed postoccurrencestates Their outputs must support the investigator'sconcrete needs

To discover and de®ne needs indicated by theoccurrence, investigators require data about how aspeci®c system was intended or expected to function

in its daily environment Expert investigators get suchsystem data from people with system knowledge,either directly or from their work products Thosesystem experts have knowledge of a speci®c system'sdesign, manufacture, testing, programming, opera-tional behavior, safety or failure analyses, mainte-nance, or other system support activities

1.2.5 Investigation Task KnowledgeStudy of investigation processes has disclosed that, to

be e€ective, investigation process tasks must be plined, objective, timely, ecient, and logical, and pro-duce demonstrably valid, credible, and readily usefuloutputs Special investigation knowledge investigatorsneed to perform their investigation tasks adequatelyincludes fundamental investigation concepts, princi-ples, and procedures They must incorporate thisknowledge into investigation program plans for allkinds of investigations

disci-1.2.5.1 Investigation ConceptsConcepts about occurrences and investigations guidehow investigators think about what they are investigat-ing, and what they do during an investigation [3].Concepts needed by investigators to produce qualitywork products include:

A multilinear conceptual framework

The role of change in occurrences

An investigation data language

Mental movies

Investigation quality assurance.

Multilinear Conceptual Framework What is the

gen-eral nature of occurrences to be investigated? Research

has identi®ed at least ®ve different perceptions of

unintended and unexpected occurrences [4] Each

perception results in a different framework or model

that drives what investigators think and do during

investigations

The most helpful perception of occurrences or

fra-mework for investigators is the ``multilinear'' events

sequences concept [5a] This framework views

occur-rences as a process, during which people and objects

act, concurrently and in sequence, to produce

succes-sive changes resulting in the outcomes of interest

Relative timing of events in this multilinear framework

is often essential to understanding and explaining what

happened The framework leads investigators to focus

on developing descriptions and explanations of process

interactions that produced the outcomes of interest

Other perceptions of the nature of occurrences areoften encountered A linear ``chain of events'' per-ception of occurrences such as accidents has longbeen the most popular in lay circles and the legalcommunity It relies on experts to identify a chain

of unsafe acts and conditions and accident causes

``leading to the accident'' or incident Typically, itresults in subjectively developed, investigator-depen-dent, judgment-laden and frequently controversialinvestigation work products The stochastic percep-tion is similarly investigator or analyst dependent Thetree perception is more disciplined, and helps to orga-nize data, but lacks criteria for selecting top events and

a data language, does not accommodate relative eventtiming and duration considerations, or show interac-tions among concurrent events readily The ®ve majorperceptions are illustrated in Fig 1

Role of Change in Occurrences The role of change insurprise occurrences and their analysis was de®ned

by Johnson during research leading to the MORTsafety assurance system [6] He pointed out thecongruence between change control and accidents,and the importance of examining changes duringinvestigations

Figure 1 Perceptions of accidents: the ®ve ways investigators perceive the nature of the accident phenomenon Each perceptionin¯uences what investigators think and do during investigations (From Accident Investigation: Safety's Hidden Defect Oakton,VA: Ludwig Benner & Associates, 1981.)

During the operation of a process, people or objects

act on other people or objects to produce cascading

changes, with resultant outputs or outcomes When

desired outputs result, change produces progress

When undesired or unintended outputs result, change

produces trouble The change concept facilitates

inves-tigations by providing a focus for investigators' data

searches: look for the changes required to produce the

outcome

When people act during a process, they act to

pro-duce an intended change, to adapt to an unanticipated

change to sustain the process, or to arrest undesired

cascading changes For example, if a robotic device

needs adjustment, a programmer acts to reprogram

the device If a robotics device suddenly activates

dur-ing maintenance, the repairman might either adapt by

trying to avoid the moving parts, or arrest the

progres-sion by activating the emergency ``o€'' control

A useful aspect of change is the concept of change

signals The signal emitted by a change has

conse-quences for investigators For example, if the signal

emitted is not detectable or detected too late, the

opportunities for an adaptive response by either

peo-ple or objects are foreclosed If it is detectable, it must

be detected before an adaptive response is mounted

This general adaptive subprocess has been modeled

from observations during investigations (see

Appendix A)

Event Data Language Investigation data language is

the language structure and terms investigators use to

document, analyze, describe, and explain an

occur-rence To be consistent with the process framework

for occurrences, the investigation data language must

be able to describe and report what people and objects

did to advance the undesired process toward its

out-come The data language structure used by

investiga-tors determines what they can do during an

investigation A structure that facilitates the veri®able

reporting of what happened and why it happened is

needed A structure and terms that undermine

veri®-able reporting are not helpful

The structure should encourage investigators to

focus their observations on ®nding and documenting

data that de®ne and permit the value-free reporting of

what the people and objects did during the occurrence

It should steer investigators to veri®able terms, and

away from terms with built-in judgments or

unsup-ported inferences which stop thought

The data language structure and terms that best

satisfy these demands are the actor±action structure

and event-related terms The structure is simple:

one actor ‡ one action ˆ one event That is the tion for the ``think events'' guidance encouraginginvestigators to structure their investigation thoughtprocesses It employs the de®nitive power of the gram-matical active voice, facilitating the visualization ofspeci®c people or objects This ``actor ‡ action''-based structure, or ``event'' structure, makes possiblethe most economical acquisition and ordering of data

founda-It facilitates the most concrete descriptions of whathappened, the most practical approach to systematicproblem discovery and remedial action selection, theimplementation of objective quality controls, andtimely results

The actor ‡ action language structure helps guideother tasks, such as facilitating visualization ofwhat happened, rather than impeding visualization ofwhat happened It should be used while interviewingwitnesses, photographing ending states of objects, ordesigning damaged-equipment test protocols Docu-menting data with abstract, ambiguous or equivocalterms does not o€er such guidance

It is important to note that conditions are the result

of actions by someone or something Improving futureperformance requires a change in behavior of people orobjects A condition cannot be changed without chan-ging the behavior of someone or something that cre-ated the condition Thus, investigators should focus onthe actor ‡ action data language during investigations,and use observed conditions as a basis to infer theactions that produced them

During investigations, investigators' major lenge is transforming their observations and all otherinformation they acquire into a common format togive them building blocks for creating their descriptionand explanation of what happened This task is notintuitive Further, it con¯icts with daily languageexperiences The challenge is to recast all kinds ofdata from all kinds of sources into a basic commonformat suitable for documentation, analysis, testing,reporting, and dissemination That challenge isdepicted inFig 2

chal-The exact attributes of event building blocks depend

on the choice of investigation process adopted by anorganization The most basic form of event buildingblocks (Fig 3) contains the following information:Actor is any person or any object that initiates achange of state during the process required toproduce the outcome achieved by the occurrence

An actor has only one name Ambiguous, pound, group, or plural names will corrupt theinvestigation and are unacceptable

com-Action is one speci®c act which a€ected another

actor or action and helped initiate or sustain

the process that produced the outcome of the

occurrence

Descriptor is used to expand the description of what

the actor did, to describe what the actor acted on,

or otherwise to de®ne the act so it is uniquely

described, can be visualized, and then can be

related to other events

Source is the source of the data from which the

event block was formulated, noted so it can be

referenced as needed to verify the event

For more complex investigations or investigations

requiring clear documentation of source data and

veri-®cation of the reasoning, it is helpful to use morecomprehensive building blocks, as shown in Fig 4 Thenumbers refer to the sequence in which the contents aretypically added

Without a speci®ed data language structure to guideinvestigators, investigators are likely to use words thatcan corrupt the investigation or undermine the poten-tial value of an investigation Corrupting wordsinclude ambiguous names or action descriptions, implicitconclusions, and words with built-in judgments Forexample, ambiguous names of actors like ``they'' or

``she'' or grouped actors like ``the crew'' or ``the secondshift'' can confuse hearers or readers, because they cannot visualize who did what without more data.Ambiguous actors re¯ecting inadvertent use of the pas-sive voice grammatically, such as ``it was decided,''have the same e€ect Investigators often use the passivevoice to cover up their incomplete or shoddy investiga-tion or unacknowledged unknowns Implicit conclu-

Figure 2 The investigator's data transformation challenge

The investigator must transform all kinds of data from all

sources into the investigation data language format needed to

describe what happened (From 10 MES Investigation

Guides Guide 1, MES Event Building Blocks Oakton,

VA: Ludwig Benner & Associates, 1998, p 6.)

Figure 3 Minimum event building block elements This isthe minimum information required to permit investigators toarrange events into their correct sequence as they developtheir description of what happened (Adapted from KHendrick, L Benner Investigating Accidents with STEP.New York: Marcel Dekker, 1986, p 128.)

Figure 4 Comprehensive event building block This format is helpful for documenting actions during a complex occurrence, andfor investigations which might be used in potentially controversial environments such as claims settlement, arbitration orlitigation (Adapted from K Hendrick, L Benner Investigating Accidents with STEP New York: Marcel Dekker, 1986, p 128.)

sions may be subtle, and are usually hidden in words

like ``did not,'' or ``failed,'' or ``inadequately.'' They

should be avoided, unless the evidence and behavior

standard on which the conclusion is based are also

clearly de®ned and described

Most corrupting are words with built-in judgments

Descriptions of occurrences should be factual, not

judg-mental Frequently the judgments can not be veri®ed,

convey false certainty, rouse defensive feelings, mask

di€erences in understanding, sti¯e thought, and slant

viewpoints For example, once a judgment is made

that someone ``failed'' to act, made a ``human error,''

or was ``inadequately'' prepared, the tone of what

fol-lows is setÐto ®nd out what the person did wrong and

lay blame on that person Investigators should view such

words as poison words, and avoid them A review of

lan-guage pitfalls described in Hayakawa's work [7] is highly

recommended The investigator should strive to report

events at the lowest rung on Hayakawa's ladder of

abstraction

Conformance to the actor ‡ action data structure

helps investigators avoid these pitfalls, economize

their investigation reporting e€orts, and improve

investigation eciencies

Mental Movies A mental movie is a sequence of

visualized images of what happened, arrayed in the

sequential order and approximate times they

hap-pened Making mental pictures or a ``mental movie''

of what people and objects did enables investigators to

cope with new data as the data are acquired They

enable investigators to integrate data gathering and

analysis functions

Mental movies serve four important investigation

purposes They force investigators to try to visualize

what happened, demand concrete action data, help

order the data as they are acquired, and pinpoint

what they do not know about the occurrence The

mental movie construction requires investigators to

visualize the speci®c actors and actions involved in

the occurrence and the e€ects of their actions on

others As the data acquisition continues, the mental

movie framework provides a place to order the actions

relative to other data already in hand When

investi-gators cannot visualize what happened, each ``blank

frame'' in the mental movie identi®es unknowns, and

the need for speci®c data about the actor or action in

the time period involved Thus blank frames de®ne

unknowns and narrow the search for additional data

as the investigation progresses

The concept also applies to witness interviews The

investigators' challenge is to transfer the mental movie

from the witnesses' heads into their heads This viewhelps investigators probe for concrete data fromwitnesses, and ask questions that generate concreteanswers

Progressive Analysis This is the concept of ing new data into all existing data as each new dataitem is acquired during the investigation The reasonfor using progressive analysis methods is to integratethe data gathering and analysis functions into anef®cient, effective consolidated task as the investiga-tion progresses

integrat-The progressive analysis concept provides a basisfor establishing criteria for the selection of the investi-gation methods The formulation of mental movies is

an informal implementation of this concept A moreformal implementation is the multilinear eventssequencing methodology and its ¯ow charting time-events matrices, or worksheets Using either method,investigators can achieve very ecient, real-time datagathering and analysis task integration during investi-gations

The historical approach to investigation has been togather all the facts, analyze the facts, and then drawconclusions and report ®ndings This approach results

in separately gathering the ``facts'' and subsequentlyanalyzing them to develop conclusions and ®ndings.The approach is widely used by traditional industrialaccident investigators, by litigants, and by many publicinvestigation organizations This process is inecient,time consuming, and prone to overlooking relevantdata Additionally, it is more tolerant of ambiguousand irrelevant data, particularly in investigations withtwo or more investigators The identi®cation of rele-vant data during data gathering tasks is ill de®ned, andobjective quality management methods are not usuallyviable

Break Down Events Breaking down or decomposingevents is an old concept, but understanding how it isdone is very important to investigators When the

``think events'' concept is employed, unclear orgrouped actors or actions can be ``broken down'' ordecomposed into two or more actors or actions to helpinvestigators understand what happened

One question every investigator faces in each tigation is how long to continue breaking down events.The technical answer is ``it depends''Ðon the need tounderstand what happened in sucient detail to beable to reproduce the occurrence with a high degree

inves-of con®dence Alternatively, it may depend on theresources available for the investigation: stop whenthe allotted time or money is exhausted Still another

answer depends on the quality assurance task needs:

stop when quality assurance tasks meet quality

assur-ance criteria, including the degree to which

uncertain-ties or unknowns are tolerated in work products

Event Pairs and Sets An event pair or event set

con-sists of two or more events, either next to each other

in the sequence, or part of a cause±effect relationship

Event pairs or sets provide the foundation for

sequen-cing events disclosed by the investigation data, using

temporal and spatial sequencing logic After the

sequential logic is satis®ed, a second application of

the concept is to apply cause±effect logic to determine

if the events are causally related to each other After

causal relationships are established, application of

necessary and suf®cient logic to each related pair or

set can be used to determine the completeness of the

investigation or description of the occurrence

The event pairing also enables investigators to

de®ne gaps in the occurrence description, or any

un-certainties associated with those events That in turn

enables investigators to integrate each new data item

into the existing event patterns and gaps as data are

acquired, as shown in Fig 5

Event pairs are also used to compare what

hap-pened with what was expected to happen, as part of

the problem discovery and de®nition investigative

sub-process Another use is for identifying and assessing

performance improvement options, and preparing

plans for monitoring implementation of new actions

By ``thinking events'' and using progressive analysis

methods, investigators can accelerate the investigation

and reduce data-gathering burdens

Event Linking An event link is a representation of a

cause±effect relationship between two events The

orderly sequencing of events found during the

investi-gation generates the evolving description of what

hap-pened To understand why events happened, the

investigator needs identify and document rigorously

and completely the cause±effect relationships among

all the relevant the events This task rests on the

event linking concept In practice, links are arrows

on documents showing the cause±effect relationshipsbetween the earlier and later events By convention,links lead from the triggering event to the triggeredevent

To establish links, the investigator considers eachpotentially relevant event in pairs or sets, to decidewhether or not they have a cause±e€ect relationship

If one had to occur to produce the other, the gator links the events to document that relationship Ifthe causal relationship is not direct but throughanother event, that third event (or a ``?'') is added tothe set If the original events in the pair have no cause±e€ect relationship, no link is added, and one or both ofthe unlinked events may be irrelevant (Fig 6).The linking concept provides a way to display logi-cal cause±e€ect relationships for each event that isidenti®ed It also provides a way, with the questionmarks, to:

investi-Progressively incorporate relevant events into thedescription of the occurrence as each is acquired.Identify completed data acquisition tasks

Identify un®nished investigation tasks

Figure 5 Sequencing new events As new data de®ning eventA2 become available, the investigator can assure its propersequencing by determining where it should be placed on thetime±actor matrix relative to other known events (From KHendrick, L Benner Investigating Accidents with STEP.New York: Marcel Dekker, 1986, p 135.)

Figure 6 Linked events sets Set 1 represents two events with a direct cause±effect relationship Set 2 represents three events (A1,A2, A3) that will produce B1 every time they occur Set 3 represents one event that will lead to three other events Set 4 representstwo events for which a causal relationship may exist The ``?'' represents an un®nished investigation task (From 10 MESInvestigation Guides, Guide 2, Worksheets Oakton, VA: Ludwig Benner & Associates, 1998, p 4.)

De®ne speci®c remaining data needs and acquisition

An ideal investigation will produce a description of

the occurrence that consists of all interacting or

linked events, and only those which were necessary

and sucient to produce the outcomes Anything

less indicates an incomplete description of the

occur-rence Anything more will almost certainly raise

unne-cessary questions

Energy Tracing This concept is also based on

Johnson's MORT safety research [6] His point was

that energy is directed by barriers to do desired

work When barriers do not successfully direct the

energy to its work target, the energy can do harm to

vulnerable targets These events are part of the

auto-mated system or robotics accident or incident process

Energy produces the changes investigators see in

objects or people Tracing energy paths and ¯ows to

®nd what produced the observed changes helps

inves-tigators explain ``how did what you see come to be?''

Energy ¯ows leave tracks of varying duration To

trace energy ¯ows the investigator's challenge is to

®nd those tracks or changes that resulted from the

energy ¯ow This energy tracing can be done in a

sequential way, from the time the energy enters the

system until the energy has produced the work that

can be observed ``Energy'' should be viewed broadly,

ranging from the readily identi®ed electrical and

mechanical categories to people inputs, for example

[8] It can also be a more obscure energy such as gas

generated by bacterial action, temperature changes

and oxygen that rusts iron See Appendix B for a

thought-starting list of energies observed by the

author during investigations over a 20- year period

[9,10]

Each energy form is an actor that is tracked through

the system to identify any harm that it did, and any

constructive work or control it brought to the system

during the occurrence

The concept also has the e€ect of requiring an

understanding of the system in which the energy

¯ows Systems are designed to constructively direct

energy ¯ows with barriers Thus the investigator

needs to ®nd out what energies might have a€ected

the system, the barrier behaviors, and the harmfulwork that was done, and also to trace any ameliora-tion work that a€ected the interactions or changedthe potential outcome The orderly tracing of energy

¯ow backward from the harm produced often helpsde®ne the system, if it has not been de®ned before theoccurrence That is not unusual, and is why investi-gating minor occurrences is usually so valuable.Witness Plates This concept was adapted from theexplosives testing ®eld During ®eld tests, metal platespositioned all around an outdoor explosion bore wit-ness to work done on them by objects and energiesreleased when the device was exploded Experts theninterpreted the changes to the witness plates to analyzewhat acted on them during the explosion

The concept de®nes the process for ``reading''events on objects after an occurrence It applies theenergy-trace principle to investigation, in that energywhich does work during occurrences leaves tracks on

``witness plates.'' Witness plates are the keepers of thetracks left by energy exchanges This applies to bothobjects and people By viewing both as witness plates

or keepers of data about events that occurred, gators respect the sources They recognize that theirability to access the data depends on their own skills

investi-to acquire the data, more than the witness or object'sability to communicate their data to them Thus theconcept helps investigators maintain a constructiveattitude about witnesses they interview, and objectsthey study in investigations

Objective Investigation Quality Assurance Objectivequality assurance is the use of nonjudgmental criteria

to assess the quality of an investigation and its workproducts This concept results in displaying events, andusing rigorous logic tests to assess the order, relevanceand completeness of the description and explanation ofthe occurrence It uses time and spatial sequencing ofevents to assure the proper ordering of events It thenuses cause±effect logic to assure discovery of relevantinteractions among events It then uses necessary andsuf®cient logic to assure the completeness of theordered and linked events which describe and explainwhat happened

The display enables the investigator to invite structive critiques of the logic ¯ow of the events con-stituting the occurrence The demand to state the dataand name the sources to justify any proposed addi-tional events or changes to a ¯ow chart disciplinesexperience-based experts who want to challenge aninvestigator, promote their interests, redirect plans,

con-or create uncertainty fcon-or other reasons

1.2.5.2 Investigation Principles

Study of many investigation processes has disclosed

key principles which can help investigators produce

superior investigation results These generally

applic-able principles should be incorporated into

investiga-tion program plans for all kinds of investigainvestiga-tions

If You Can't Flowchart It, You Don't Understand It

This fundamental axiom is another contribution of

Johnson's MORT safety research [6] It is especially

important when occurrences are perceived and treated

as processes

Flowcharting the process interactions that produced

an unexpected and unwanted outcome has many

ben-e®ts One of the most important is the discipline it

imposes on investigators to produce complete,

consis-tent, valid, and credible descriptions and explanations

of what happened They must understand the

sequence, cause±e€ect relationships, and the necessity

and suciency of all documented interactions during

the occurrence to be able to prepare a valid ¯owchart

A second and equally important reason for

¯ow-charting occurrences is the visibility the ¯owchart

doc-umentation provides for the events and the logic of

their relationships That visibility provides a

conveni-ent mechanism to organize and analyze data as they

are acquired It enables everyone associated with an

occurrence or its investigation to pool their data into

objective, logical, and disciplining patterns It helps

®lter out questionable or extraneous data

Additionally, ¯owcharts provide an abbreviated record

of the occurrence to share with a€ected personnel for

training, retraining, process or equipment design,

per-formance monitoring, or for monitoring the

e€ective-ness of changes recommended by the investigator

Also, ¯owcharts of such processes can be archived

and retrieved readily from corporate memory for

future applications, which is a major consideration

for building corporate memories

For investigation managers, ¯owcharts provide

instant information about the current status of the

investigation If ¯ow charts are developed as the data

are acquired, gaps help managers pinpoint what data

are still needed, and what they might gain if they get

the data Investigators have a tendency to want to

eliminate every possibility to arrive at the most likely

possibility With ¯ow charts, managers can make

informed decisions about the value of expending

more investigation resources

Track Change Makers Process outcomes result from

changes introduced by people and objects during the

occurrence Therefore, investigators have to focus on

the change makers that produced the outcomes Somepeople and objects are just along for the ride, whileother people or objects shape the outcomes.Investigators must look for and identify the peopleand objects that shaped the outcome, and show thoseinteractions By starting with the outcomes, and work-ing backwards, investigators pursue the change makers

in a logical sequence

Focusing on change makers or ``doers'' leads to ciencies in investigations, by minimizing the amount oftime spent on irrelevant people or objects This mindset re¯ects the ``think events'' concept This is one ofthe key secrets to achieving ecient investigations

e-``Do No Harm'' Rule Introducing changes to peopleand objects that survived the incident before you cap-ture their data can corrupt an investigation Thus the

``do no harm'' rule Investigators must prevent anychange in data sources until they have extracted thedata needed from those sources

This rule poses dicult challenges for investigators.For example, rescue workers usually must disturbsome witness plates to e€ect their rescue.Investigators can walk on debris and change it asthey try to get closer to another object to observe itscondition Investigators may try to start something orturn it on to see if it works when they get there Theyshut down power to immobilize a remote controllercabinet, and lose stored data in volatile memorychips How can essential data be preserved in thesecircumstances?

The answer is to make plans to prevent loss of data,and establish control over the site of the occurrence toprevent as much change as possible Control ofchanges at the scene of an occurrence increases in dif-

®culty as the size of the scene or accessibility delayincreases This is particularly important when trying

to control the people and objects at the site of alarge occurrence, or when the investigator may arrive

at the site later A site involving large or dispersedequipment such as a gantry robot is more dicult tocontrol that a small single station robot site, for exam-ple The rule reminds investigators of the importance

of an on-site mental assessment of the risks to datastored in people and objects before introducing newchanges that can harm the data

Time Never Stands Still Time is an independent able during an occurrence Every person and everyobject has to be someplace doing something during

vari-an incident What they do is identi®able by whenthey did it, and how long it lasted Each action during

a process has a starting and an ending time Time is

used to order events data as they are acquired.

Investigators should be concerned with establishing

or at least roughly approximating the relative times

when people and objects did something to advance

the occurrence to its conclusion or outcome Creation

of a mental movie helps investigators do this

The principle is applicable directly during interviews

of people By trying to visualize what the witness was

doing from the time the witness ®rst became aware of

the occurrence, investigators can develop a ``time line''

of actions by the witness Whenever a person or any

object drops out of sight during the occurrence, the

mental movie helps to pinpoint needed data and

ques-tions to ask

Meeker's Law ``Always expect everyone to act in

what they perceive to be in their best interests, and you

will never be disappointed'' [11] Sometimes

investiga-tors have to deal with people who were actively

engaged in the operation or process that went awry

For many reasons, they may perceive that it is their

best interest to withhold some information from the

investigator, or mislead an investigator, or perhaps

even lie Investigators should be aware of these

percep-tions of self interest, and be prepared to work around

them One way is to use the mental movie to assess the

completeness and sequential logic of the actions

described Another is to document and display the

events reported on a ¯owchart, and test their logic

Another way is to get corroborating or contradictory

statements Trust but remember the perceived interests

and verify what is reported

The Silent Witness Rule The witness has it, you

need it, and the witness doesn't have to give it to

you Investigators are at the mercy of people who

have in their memory the data they need A

compa-nion to the self-interest principle, this principle helps

investigators adopt a helpful frame of mind for

talk-ing to witnesses about an occurrence It reminds

investigators to look for, recognize, and adapt to

the perceptions, interests, and motivation of each

wit-ness They adapt by framing the purpose of the

inter-view and all questions in a way that encourages each

witness to share data the investigator needs Ideally,

successful investigators are able to transfer the

witness' mental movies of the occurrence to their

minds An investigator's challenge is to get the

witness to do 95% of the talking during an

interview

Things Don't Lie For many reasons data acquired

from people are less reliable than data acquired from

things Things respond predictably to energy

exchanges, according to laws of nature that enable diction of changes in things The value of this predict-ability is that investigators should rely on the mostreliable dataÐderived from objectsÐto determinewhat happened

pre-While they do not lie, objects are not ardent versationalists Thus it is up to the investigators toextract whatever data might be stored in things Toread data from an object, it is necessary to know thestate of the object both before and after an occurrence,the changes that occurred during the incident, and theenergies that changed it This means capturing anddocumenting the ending state promptly and eciently

con-is an investigation priority

Data from objects become critically important whennobody was around during the occurrence, or whenthose who saw what happened did not survive theoccurrence

Experience Recycles Yesterday's Problems alizing experiences has the subtle but real capacity

Ration-to normalize deviations or changes that increaserisks or produce degrading performance or accidents[17] The importance of this principle lies in the need

to select investigation methods that prevent ence from leading to conclusions contrary to thosedemanded by the data It also means that the selec-tion of investigators must carefully balance theirexperience against their ability to subordinate it tological thinking about the data they develop duringtheir investigations MORT training cautionsinvestigators not to SLYP or solve last year'sproblems Mental movies and ¯owcharts helpprevent this

experi-This is another reason why primary reliance oninvestigation knowledge and skills rather than systemknowledge and skills is so important in good investiga-tion programs

Investigations Are Remembered by Their Results.Investigations are meaningless and a waste ofresources unless they contribute to timely and endur-ing change Loss incidents have a way of bringingabout temporary changes in behavior and views,even without any investigation The challenge forany investigation program and every investigator is

to produce work products leading to lasting ments and retention of the understanding achieved.Retention is best achieved with brief, readily graspeddescriptions of what happened, with obvious andbroadly applicable principles that can be applied inmany situations

improve-Given these concepts and principles, what

pro-cedures will produce the desired investigation work

products?

1.2.5.3 Investigation Processes

Investigation processes traditionally re¯ected the

intui-tive understanding of investigations by individuals

per-forming the investigations That is changing as

alternative investigation methods have become

avail-able, starting with the MORT research around 1973

[6]

When considering alternative investigation

pro-cesses, several precautions are advisable These

precau-tions include tailoring the investigation program to the

needs and capabilities of the organization In

consider-ing a selection, it is advisable to be aware of desirable

capabilities and attributes to seek, as well as attributes

that may impose constraints or create problems

Selection of an investigation program methodology

should match the capabilities demanded by the favored

choice(s) and the capabilities that can be made

avail-able within the organization

The following summary of criteria can assist in the

task of selecting the investigation process

Preferred Capabilities and Attributes A preferred

investigation process [12] for implementation under

the program plan can:

Provide investigators with guidance about what to

observe and how to frame questions

Help investigators organize and document data they

acquire promptly and eciently

Give investigators real-time guidance for narrowing

their data searches during the investigation

(pro-gressive analysis capability)

Facilitate sequential, cause±e€ect and necessary and

sucient logic testing of the data documented

Help investigators recognize and act on unknowns

De®ne problems, needs, and candidate remedial

actions logically and objectively

Assist in the assessment of needs and candidate

remedial actions, and prediction of their success

Point to ways to monitor actions to evaluate their

success

Expedite preparation of valid and persuasive

deli-verable work products

Mediate di€ering viewpoints and guide their

resolu-tion

Adapt to the full range of occurrences likely to be

encountered

Be learned and practiced at modest cost

Filter quickly any extraneous data during tions, without alienating other investigators.Prevent investigators from drawing conclusionscontrary to the data

investiga-Minimize dependence on experience and maximizedependence on logical reasoning

Facilitate the objective assessments of the tion process and output quality

investiga-Attributes of Less Desirable Processes Less attractiveinvestigation processes also have some distinguishingattributes, including:

Informal and very experience-dependent procedures

A legally oriented sions framework

facts±analysis±®ndings±conclu-A high tolerance level for ambiguous and abstractdata usage, experiential assertions, built-in judg-ments, and subjective interpretations and conclu-sions

Oversimpli®ed descriptions and explanations ofwhat happened, with recurring jargon such aschain of events, unsafe acts, human error, fail-ures, fault, and the like

An emphasis on ®nding a single ``golden bullet'' toexplain the occurrence such as ``the cause'' or theroot cause or equivalent

A lack of scienti®c rigor or disciplining proceduresdemanded of investigators, such as time-disci-plined demonstration of relationships

Lack of objective quality control criteria and dures for the outputs or the process

proce-An understanding of these concepts and principles vides a basis for developing an investigation programplan tailored for a speci®c organization

pro-1.3 INVESTIGATION PROGRAMPLANNING

This section describes the main investigation planning tasks The operation of an e€ective investiga-tion program depends on the design of the programand readiness of four primary program elements:executive commitment, a sound investigation plan,adequate investigator preparations and competentinvestigation support The main investigation programplanning decisions and actions are summarized inFig 7

program-Executives are responsible for an organization'soverall performance, set policies, and allocateresources to achieve desired performance The

Figure 7 Organization-wide investigation program readiness tree displaying the preparatory steps needed to assure readiness of

a comprehensive investigation program

are the program's sponsors, and must be

com-mitted to and satis®ed by the program

Investigation program planners are responsible for

the determining the investigation tasks

investiga-tors will perform They are the program's

crea-tors Their plans must be tailored for the

organization, and capable of producing the

desired results

Investigators and their supervisors are responsible

for producing satisfactory deliverables within the

program They are the program implementers,

and their work must satisfy their sponsor and

their customers

Persons or groups who support investigators

pro-vide knowledge, advice, and support for the

investigators They are program auxiliaries

Investigation program readiness decisions and

actions are shown for each group Executive decisions

and actions (blocks 1±9) de®ne what the program is

expected to accomplish Investigation program

plan-ning actions (blocks 11±19) de®ne how investigations

are conducted, and what they deliver Investigator

selection training, and practice (blocks 21±29) lead to

the investigation capability that will produce the

desired work products Preparation of support

person-nel (blocks 30±40) provides a needed ``resource pool''

to help investigators when they need it

1.3.1 Executive Preparations

Executives set the direction and tone of an

organiza-tion's activities They also control the organization

resources and their distribution Investigations

con-sume resourcesÐsometimes twice: once when they

are conducted, and a second time if the investigation

is ¯awed and undesired surprises continue Success of

an investigation program depends on engaging

execu-tives and getting their sponsorship of the program by

showing them their stake in its success

The following actions by executives are required to

get a successful investigation program underway, and

to keep it going The numbers in parentheses at the end

of the task title refer to Fig 7, the organization-wide

investigation program readiness tree

1.3.1.1 Acknowledge Opportunities (1)

This is the indispensable ®rst step Executives must be

able to recognize the narrowness and shortcomings of

conventional approaches, and why those approaches

do not satisfy their e€orts to continually improve

per-formance Upon recognizing that need, they then need

to recognize that new opportunities are available tothem to achieve better results If they understandthese opportunities, they will want to take advantage

of them, and will be more receptive to new approaches.1.3.1.2 De®ne Mission, Purpose, and

Demands (2)The opportunities enable desires for continuingimprovement to become the basis for revising theinvestigation program mission and purposes Ratherthan a narrow accident prevention mission, everyonecan endorse the broader mission of facilitating contin-uous performance improvement This will establish theperformance demands for the investigation program.After an executive decision has been made to acknowl-edge and seize opportunities to improve investigationprograms, the investigation program planning begins.1.3.1.3 Establish or Update Investigation

Program Objectives (3)Establish objectives for each kind and level of investi-gation, such as:

Eciently and consistently produce timely, valid,and consistent descriptions and explanations ofthe occurrence being investigated

Report that new information in a form facilitatingits use throughout the organization to discoverand de®ne speci®c needs for change, and identifyand assess candidate changes to improve futureperformance

Provide a basis for monitoring in real time the tiveness of predictive analyses, and changesimplemented as a result of investigations

e€ec-Do all this in a constructive, harmonious manner

If the present investigation program has narrowerobjectives, establish new broader objectives for theprogram plan

1.3.1.4 Adopt Investigation Policy Changes (4)When executives are comfortable with the programobjectives, they need to review the organization'sinvestigation policy If new investigation policies areneeded, they should amend current policies Changesshould address the investigation program mission andgoals, particularly regarding the tone of investigations.Determination of what happened and why it hap-pened, and using that understanding to improve futureperformance should be common to all policies Policychanges require executive acceptance and support

One element of this task is to ensure that the policy

is compatible with regulatory requirements Another

element is to communicate the policy and need for

co-operation with investigators to everyone in the

organization who might become involved in

investiga-tions

1.3.1.5 Adopt Updated Investigation Program

Plan (5)

When the investigation program plan is ready it should

be considered, accepted, and advocated at the

execu-tive level of an organization By advocating the plan,

the executives show their support for it They also

become the program's sponsor The program

opera-tion must satisfy the sponsors, or they will abandon it

1.3.1.6 Accept Executives' Roles (6)

The investigation plan should incorporate support

roles at the executive level Support roles include

par-ticipating in periodic program performance reviews, in

leading high-pro®le investigations that might a€ect the

public's perception of the organization, and in the

resolution of di€erence a€ecting the levels of predicted

residual risks accepted These roles should be accepted

by executives who will be involved in these tasks from

time to time

1.3.1.7 Ensure Investigation Budget (7)

If an initiative is worth undertaking, the organization

should be prepared to pay a reasonable price to gain

the bene®ts it expects to receive By setting a budget for

the investigation program, the value of the program is

established, and one measure of its performance is put

in place The source or sources of the funds are less

signi®cant that their allocation to investigations This

can have a positive e€ect on investigators, who will

become conscious of the need to demonstrate the

value of their work It also encourages investigation

eciencies Caution should be exercised to avoid

creat-ing disincentives that penalize anyone via the

budget-ing process

1.3.1.8 Establish Investigation Performance

Feedback Process (8)

Periodic review of any function is an essential element

of good management If the broad mission for an

investigation program is adopted, the suggested

objec-tives provide a basis for assessing the program's

achievements and value A concomitant objective is

to change or terminate the program if it is not ing its objectives

achiev-1.3.1.9 Executives Ready (9)The importance of these executive-level tasks cannot beoverstated If the above actions are taken, the organi-zation's executives will be ready to support theprogram and perform their role in achieving thedesired bene®ts

1.3.2 Investigation Process PlanThe best investigation plan for each speci®c organiza-tion should be identi®ed, prepare, and implemented.Planning tasks to achieve this include selecting, adapt-ing, and implementing an e€ective investigation pro-cess

1.3.2.1 Select Investigation Concepts (11)Selection of the conceptual framework for an investi-gation program is probably the second most importantdecision for ensuring an e€ective program Criteria forprogram selection are applied during this task.What governing framework should be adopted? Areview of references is strongly advised [2,3,5,6,13].Should adoption of the change-driven process modeland event data language concepts be the governingframework? Or should the concept of determiningcause and unsafe acts or unsafe conditions in a chain

of events be chosen? Or would the energy/barrier/target MORT concept be most desirable for theorganization? Use the criteria cited earlier duringthese deliberations, and document the reasons for theselection for later use

1.3.2.2 De®ne Investigation Goals (12)Depending on the investigation policy and the frame-work selected, the speci®c goals of an investigation arede®ned next Goals of any investigation should includedevelopment of a validated understanding and expla-nation of what happened Other goals are suggested bythe discussion above Document the goals selected.1.3.2.3 De®ne Investigation Process

Deliverables (13)Plans should de®ne the work products to be delivered.Plans should also include criteria by which each workproduct will be evaluated during the investigations,and quality assurance procedures Deliverable workproducts include the description and explanation of

the occurrence, source document ®les, visual aids and

other materials required to support the description,

presentations or brie®ngs, and any reporting forms

or other documentation If desired, deliverables may

also include reported needs disclosed by the

investiga-tion, and proposed changes to improve operations

Planners must consider the regulatory requirements

and their e€ects on criteria for the deliverables It is

advisable to review the potential adverse as well as

bene®cial consequences of each with legal counsel

before the plan is adopted

Another important deliverable, particularly when

potential injury claims or litigation are foreseeable, is

the source material used to de®ne the reported actions,

consisting of documents, photos, selected debris,

sketches, or other source materials Plans should

address their acquisition, handling, archiving, and

dis-posal

Provide speci®cations for deliverables expected

from investigations of incidents such as breakdowns,

disruptions, or similar problems If descriptions of the

occurrences are not documented, the problems will

probably return When forms are required, provide

examples of entries that satisfy the form's designers

1.3.2.4 Select Preferred Investigation Process

(14)

Alternative investigation processes are available for

review [2,3,6,10,13±15] Planners should document

the criteria for the investigation process selection as

part of the evaluation process They will be used in

subsequent evaluations of the process The criteria

should include those described above and any

addi-tional criteria needed to tailor the process to the

orga-nization's capabilities Each candidate process should

be evaluated against each criterion and the results

com-pared, and documented for later review

1.3.2.5 De®ne Case Selection Process (15)

What occurrences should be investigated? In a

nar-rowly focused program, case selection is limited to

those required by regulatory authorities, usually

invol-ving a reportable or lost-time injury or fatality In a

broad program, the emphasis is on investigating any

surprises, especially those during which a worse

out-come was averted by successful intervention of people

or object controls

Case selection can be made automatic For example,

when an automated system breaks down or functions

erratically, the troubleshooting and repair are a form

of investigation that is initiated automatically When

disruption of a production process occurs, tions are also preuthorized Preparations shouldinclude identi®cation of the kinds of occurrence thatare investigated automatically and those for which acase selection decision will be required

investiga-Criteria for determining the scope of each kind ofinvestigation should also be prepared to guide investi-gators in speci®c cases These speci®cations shouldaddress at least the extent of the scenario to be devel-oped, hours to be committed, and the investigationdeliverables, among other speci®cations

1.3.2.6 De®ne Investigation Operations (16)This aspect of the investigation plan should addressadministrative matters That includes guidance forthe assignment of investigators, record keeping, andadministrative requirements, including time andexpense record keeping; also noti®cation of and co-ordination with others who have requested noti®ca-tion, including regulatory agencies if applicable.Develop requirements for others in the organization

to co-operate with investigators, and output reviews,distribution procedures, and any other speci®cationsneeded to tailor the plan for the organization Donot overlook guidance for investigators when they sus-pect a crime rather than an unintended occurrence.1.3.2.7 Document Investigation Process (17)This section of the plan documents the selected inves-tigation process It outlines guidance for acquiringdata from people and objects; for handling thosedata after they are acquired; for validating interactions

or bridging gaps; for problem discovery and de®nition;for assessing support needs and capabilities; forquality assurance procedures; for distribution ofwork products; for media contacts; for consultationswith counsel; for self or peer assessment of investiga-tion performance; and any other tailored elements ofthe selected process References provide detaileddescriptions of investigation tasks [10,16]

1.3.2.8 Adopt Investigation Plan (18)This step is the ®nal co-ordination step Each persona€ected by the plan reviews it, con®rms the intendedoperation and bene®ts, demonstrates any diculties itmight present, helps modify it if so required, and com-mits to it with a sign-o€ indicating concurrence Thisstep typically involves selected executives, managers ofactivities that might be investigated, and the likely

investigation program manager or senior or lead

inves-tigators who will implement the plan

1.3.2.9 Investigation Plan Ready (20)

Plan future tasks needed to maintain plan readiness in

the future This may require periodic review and

tune-up of the plan, by using performance indicators to

identify the needed modi®cations or updates

1.3.3 Investigator Preparation

1.3.3.1 De®ne Investigator Tasks (21)

What are investigators expected to do during

investi-gations? The investigation process selection decision

determines investigators' tasks If a formalized process

is adopted, descriptions of various useful techniques

can be identi®ed from the literature [2,3,6,9,10,13±

20] Each reference o€ers di€erent ideas about

investi-gation processes and techniques Review those ideas

and techniques to determine if they should be

incorpo-rated into the plan For example, tailoring might be

needed because of special classes of robotics

equip-ment Tailoring might also be needed because of

spe-cial regulatory considerations, or because of the nature

of the organization or its policies If so, descriptions of

techniques in the literature should, of course, be

mod-i®ed to accommodate those special needs Task

de®ni-tions need not be complex but should provide sucient

detail to prevent inconsistent overall performance for

di€erent levels of investigation

Consider investigation task de®nitions to be

dynamic, subject to change whenever circumstances

change For example, introduction of new products

or new materials, expanded processes or any other

changes a€ecting investigation performance might

pre-cipitate a review and modi®cation of the investigation

procedures

1.3.3.2 Document Investigator Procedures (22)

This planning task requires documentation of the

orderly sequencing and execution of investigation

tasks to provide guidance for investigators, and to

accommodate the nature and levels of anticipated

investigations Investigation procedures might range

from troubleshooting to major accidents Planning

for investigations of serious accidents should have

priority Include a ``walk through'' of each kind of

investigation during planning, to determine personnel

involved in the investigation, task interactions of these

personnel, and the timing of the investigation tasks

relative to each other Project planning software can

be a useful aid to this documentation process Be sure

to designate a supervisory process to accommodatedecision ¯ows during the investigations

Pay special technical attention to procedures foracquiring data after an incident from digital electronicdevices and applications which control automated sys-tems In transport systems, recording devices are used

to keep track of selected operating system parametersduring operations, providing the ability to determinetheir behavior if an accident occurs Without suchrecorders, operators should identify proposed means

to examine such devices for whatever data they mighthold If this situation arises, information about avail-able investigation techniques is available throughsources such as the International Society of AirSafety investigators [21]

1.3.3.3 De®ne Investigator Knowledge and Skill

Needs (23)De®ne knowledge and skills required to perform inves-tigation tasks next, to ensure that investigators arecapable of performing their assigned tasks The knowl-edge needs to include an understanding of tasks andoutputs required, and methods that will equip investi-gators to perform those tasks The knowledge needsare outlined above, but a few are worth repeating.Absolutely essential are knowledge of observation pro-cesses and how to transform data into investigationdata language, practical knowledge of logical reason-ing procedures, an understanding of problems thatcertain kinds of words and language can create, andawareness of investigation concepts and principlesdescribed earlier These apply to all levels of investiga-tion

1.3.3.4 Establish Investigator Selection Criteria

(24)Selection of personnel to qualify as investigators must

be responsive to the needs dictated by the investigationprocess used Generally, the more rigorously disci-plined the investigation process, the more stringentthe criteria for investigator selection The level ofinvestigations required also has a bearing on thosecriteria

Basic criteria for investigators must include the ity to make observations without distortion or bias;transform and document investigation data with mini-mal interjection of personal views, experiences or per-sonal values; order and present data sequentially;visualize patterns and scenarios; reason logically;have a reasonable memory for detail; and be self-criti-

abil-cal without personal constraints Physiabil-cal capabilities

should be consistent with the tasks and environment in

which the investigator will be working If special

knowledge or skills will be required because of the

nature of the systems being investigated or the levels

of investigation, include these criteria

1.3.3.5 Complete Investigator Selection (25)

The interviewing and selection of investigators

contri-bute to the subsequent tone of the activities and

expec-tations of both the employee and supervisor When

describing the duties of the position, discuss the

mis-sion and policies governing investigations, particularly

with respect to regulatory agencies Also, resolve any

questions about the levels of investigations, their

authority and responsibilities, acceptability of their

work products, and how their performance will be

judged

Investigator selection might include selection of

out-side experts to assist in or direct Level 4 or 3

investiga-tions under contract The anticipated frequency of

major investigation cases may be too low to justify

development and maintenance of an investigation

team within the organization If so, the selection of

an outside team to perform the investigations under

contract might be desirable Select all contractors

based on their ability to perform the investigations as

prescribed by the adopted investigation program plan

criteria

1.3.3.6 Train Investigators (26)

Typically, selected investigators will have systems

expertise in some form They will probably not have

formal investigation training, so plans should include

training in the selected investigation process and

tech-niques before they are assigned a case For level 1

investigations, an apprenticeship to trained

investiga-tors might o€er sucient training For other levels,

consider providing classroom investigation training

Design the training to accommodate the mission,

poli-cies and plans, the tools provided for investigations,

and tasks required to achieve the desired outputs

Ensure training in quality assurance tasks

1.3.3.7 Complete Investigation Drills (27)

Include investigation drills for investigators in the

pro-gram During training, drills simulating hypothetical

investigations or case studies can be developed for

spe-ci®c operations to strengthen the investigator thought

processes It is also good practice to have newly trained

investigators do an independent quality assurancecheck of a recently completed case report Have themuse ¯owcharting tools and the quality assurance checks

in Appendix C to build their skills in applying thedesired thought processes Use feedback about theresults to reinforce any investigation process elementsthat need attention

A more sophisticated drill to give new investigatorsinsights into and experience with the kinds of problemsthat arise during an actual investigation is desirable.Have them investigate the breakdown of an automatedsystem to determine what happened and why it hap-pened This has the added advantage of introducingoperational personnel to the thought processes used

in investigations

A third kind of drill is to rotate the quality ance of work products among investigators Thisenables investigators to keep abreast of ®ndings byothers, while continually improving their data gather-ing, analysis, and logic skills

assur-1.3.3.8 Put Quality Controls in Place (28)Quality control procedures should be put in place toassure the adequacy of the deliverables, the quality ofactions implemented as a result of the investigations,and the quality of the investigation process itself.The quality of the deliverables and ®ndings can bescreened before they are distributed Use the qualityassurance check lists described in Appendix C.References provide detailed quality assurance instruc-tions [9,22] Tracking acceptance of the ®ndings pro-vides another indicator of deliverable quality [4d].The greater the controversy or reluctance to acceptthe ®ndings, the greater the likelihood that the qual-ity of the investigation deliverables needs to beimproved

The quality of the actions proposed as a result of theinvestigation is also assessed by the results they pro-duce Before they are released, any recommendedactions should predict the intended e€ects in a waythat can be veri®ed Quality control plans shouldaddress the monitoring and veri®cation tasks

The quality of the investigation process is assessed

by occasional spot auditing of the procedures at theconclusions of an investigation It is also indicated bythe performance against budgets, nature of any delays,handling of uncertainties and unknowns, complaintsabout the investigators or their actions, and the workproducts produced Quality control plans shouldaddress this need

1.3.4 Investigation Support Preparations

Investigators may need various kinds of help,

particu-larly if the investigation involves casualties

1.3.4.1 De®ne Support Needs for Organization

(30)

Plans should identify the kind of help that may be

needed during investigations, and assure that it will

be available promptly when needed The help required

may include functional backup for collateral duty

investigators, document handling, communications,

go-kit maintenance, investigation equipment, readiness

monitoring, technical expertise, legal expertise, and

media expertise Technical expertise may include

elec-tronics, mechanical, chemical, medical, or design

experts

1.3.4.2 Establish Data Source Handling Plan

(31)

During investigations, sources from which

tors extract data increase in number as the

investiga-tion progresses Address how data sources are to be

documented, processed and preserved during and after

investigations, including possible chain-of-custody

implementation tasks in speci®ed cases If willful harm

is involved, consult counsel for planning guidance

1.3.4.3 Communications Protocols and

Equipment Ready (32)

Depending on the occurrence, voice or data

commu-nications links may be required at the site of an

occur-rence Preparations should be responsive to any

anticipated special requirements for such

communica-tions For example, consider communications

proto-cols, security concerns, interfacility electronic data

transfers or exchanges, external data source access

with suppliers, and incompatibility with facility

com-munications or control equipment

1.3.4.4 Complete Go Kit Preparations (33)

Go-kits are the investigators' transportable tool kits,

containing the equipment an investigator will need on

arrival at the site of an occurrence At a minimum,

preparations should specify the equipment to be

pro-vided, and its regular maintenance or updating A

camera and ®lm, sketch pad, voice recorder, personnel

protective equipment, and note-taking equipment are

absolute minimum equipment A list of special

instru-ments and special experts, with contact information, is

also a must Planning should keep in mind that theinvestigator must be able to transport the go-kit,usually without help

1.3.4.5 Con®rm Support Equipment Readiness

(34)Surprises occur irregularly and hopefully infrequently.Thus preparations should address how support equip-ment will be maintained in a continuing state of opera-tional readiness, including assignment of taskresponsibility and perhaps checklists and inspectionschedules

1.3.4.6 Arrange for Functional Backup (35)Investigations interrupt the normal duties assigned toinvestigators except in large organizations where inves-tigation might be a full-time job When investigationsoccur, preparations should provide for backup person-nel to take over the investigator's normal duties whenthe investigator is at the occurrence site or elsewheredoing investigation tasks

1.3.4.7 Prepare Technical Support Personnel

(36)Technical support personnel are likely to be requiredwhen an investigator encounters a need to understandhow something was designed to work, or how it actu-ally worked For example, if a tear down of an auto-mated system or component is needed to examineinternal parts after an occurrence, the investigatormay need help in planning the tear down sequenceand methods to minimize data loss A tear down willprobably require skilled mechanics or engineers.Expertise may be required to recover data or settingsfrom electronic control components Planners shouldidentify and provide for access to in-house expertise,supplier expertise and contractor expertise

1.3.4.8 Prepare Legal Support (37)When people are harmed in any way, and sometimeswhen warranties are involved, investigators may needhelp from a legal expert or counsel Planners shouldwork with counsel to identify when investigatorsshould seek legal advice, and how to access and use it.1.3.4.9 Prepare Media Support (38)

Occasionally occurrences may precipitate media est, particularly if fatalities occurred, or regulatoryagencies become involved Recognize that the media

inter-tend to focus on controversy Plans should establish

procedures and contact points for responding to

media inquiries, and for adequate guidance and

com-pliance with those procedures

1.3.4.10 Support Personnel Prepared (39)

The planning should include some scheduled feedback

arrangement, to accommodate changes in personnel,

personnel assignments, housekeeping, equipment

obsolescence, expired supply dates, etc Plans should

assign feedback and review tasks to whoever manages

or directs the investigation program

1.3.5 Monitor Startup of Investigation Processes

Any change requires planning before implementation,

and monitoring after implementation If a new

pro-gram is initiated, or changes in investigation practices

are instituted, performance monitoring and feedback

to the executive in charge of the investigation program

should be provided frequently during startup, and

per-iodically during subsequent operations

After a predetermined time, monitor the program

for its achievements, and distribute periodic reports

of its achievements

1.4 CONDUCTING INVESTIGATIONS

This section outlines how to conduct investigations

involving automated systems, and the basic tasks

com-mon to all kinds of investigations Each occurrence

is di€erent, but this general guidance is applicable

in all investigations For detailed investigation task

guidance, consult the references

Before beginning, remember a basic axiom of

inves-tigation: if you can't ¯owchart it, you don't understand

it Thus, as an investigation progresses it is good

prac-tice to work toward developing a ¯owchart of events

constituting the occurrence With automated systems,

the relative timing of events involved with the system

controls often become critical to understanding what

happened [23]

1.4.1 Initial Response to Noti®cation

The ®rst information about an occurrence is usually

very sketchy, especially if any casualties are involved

However sketchy, it is necessarily the basis on which

the decision is made to launch an investigation based

on case selection guidance Delaying a response often

raises the risk of losing data or increasing the loss

Preauthorized automatic launches can begin ately If the responsible manager decides to launch aninvestigation, the manager assigns the investigator,with initial instructions about its speci®c goals, con-cerns, resources available, and deliverable schedule.The manager also implements the plans for backupand support services, including site preservationassignments pending arrival of the investigator Themanager then initiates the planned contacts, to providethem the information requested or required by regula-tion or local law The investigator or team goes to thesite of the occurrence

immedi-Early communications should also consider tions to retrieve data about the equipment or processesinvolved, or any earlier analyses of the operations,addressed to the custodians of those data If deemedappropriate or necessary, those contacts can includedirections to protect any data sources

direc-1.4.2 On-Site Tasks

On arrival at the site, the investigator has four ties They are to preserve the data at the site; to over-view the occurrence setting and get a rough idea aboutwhat happened; to set priorities for data gathering;and, frequently, to restart the system

priori-1.4.2.1 Data ProtectionGenerally stated, the ®rst task is to prevent inadvertent

or deliberate changes to the ending state of objectssurviving the incident, or to the memories of peoplewho acquired data during the occurrence This can

be done by roping o€ or otherwise isolating the area

or the equipment or the people Alternatively, postguards until the sources have been examined and thedata they o€er has been acquired by the investigator.1.4.2.2 Data Acquisition and Processing

The next task is to begin to acquire data The taskchallenge is to develop data in a format that supportsecient and timely development of a description andexplanation of what happened Further details are pro-vided in the investigation plan discussion and refer-ences

Start with a ``walkaround'' at the site to get a eral overview of what is there and what might havehappened During the walkaround task, the investiga-tor begins to plan the order of the data acquisitiontasks, setting priorities to examine or record the con-dition of any perishable data sources before theychange Priorities may also be required for examina-

gen-tion or documentagen-tion of equipment that is to be

returned to service to restore operations If potential

witnesses to the occurrence are going to be leaving the

site, arrangements for acquiring their data also require

priority attention

A part of the walkaround task is to document the

ending state of the objects found at the site This can be

accomplished with cameras, video camcorders,

sketches, or drawings, or maps if debris is scattered

Notes describing what was photographed or sketched

should be part of the documentation

Investigators should be prepared to delegate some

of these tasks, such as the witness contacts and

scheduling, or photographing damaged or changed

equipment, for example Use support personnel freely

when needed

The acquisition of data from people and objects

continues after the walkaround The investigator's

challenge is to identify the people and objects that

contributed to the outcome, identify what they did,

and document those actions The order in which this

is done varies with the occurrence, but generally it

begins with asking the ®rst people found at the scene

for their observations They can help the investigator

identify other data sources like witnesses and victims,

or equipment that they observed doing something

They can also describe changes to debris or other

objects which they introduced or saw occurring

When physical conditions of objects can be

observed, investigators have to determine ``how what

you see came to be''Ðor who or what did what to

produce the condition(s) they see Detailed guidance

for extracting action data from physical objects can

be found in some references [3,19,16,20] Sometimes

investigators want to conduct tests or simulations to

determine what produced the condition or attributes of

an object Before any testing is initiated, the

investiga-tor should insist on a test plan, which incorporates

criteria for creating actor±action formatted data as a

test output A test plan should specify who will do

what and in what sequence, to ensure needed data

are not lost inadvertently [24,25]

The acquisition of stored data from digital or analog

electronic devices associated with automated or robotics

systems poses di€erent challenges The plans for

acquir-ing these data should be followed Exercise caution to

avoid changing such data before it has been retrieved

The next step is transforming observations of the

data sources into descriptions of the actions that can

be sequentially organized and analyzed The best way

to do this is to use the actor±action data structure

When listening to people describe what they observed,

the investigator should be listening for and ing data that describe who or what did what and when

document-it happened, and documenting the data as events.1.4.2.3 Restarts

Sometimes the desire to restart equipment or processesinvolved in the occurrence with minimal delay in¯u-ences the investigation When this desire exists, theneed to identify what happened and identify the pro-blems and new controls needed quickly in¯uences thepriorities for the investigation, and the resourcesdevoted to the investigation The need to take short-cuts and the consequences of doing so should be dis-cussed with the operational and investigationmanagers, who are responsible for accepting the risks.1.4.3 Data Handling Tasks

As data about interactions are acquired, the tor can add newly discovered actions to the developingscenario, as ``frames'' to the mental movie, or events tothe events worksheets The data handling goal is tonarrow the focus of the investigation continuously Aconcurrent goal may be to assure compliance withchain of custody requirements When other organiza-tions are involved, ensure that the investigation plan isobserved

investiga-1.4.3.1 Event Linking and TestingThe technical goal of this task is to prepare a com-pleted event ¯owchart that describes what happenedand why it happened during the occurrence Gaps inthe mental movie or sequential layout of events point

to speci®c questions that the investigator should sue Working the gaps narrows the focus of the dataacquisition e€ort, and separates the relevant from theirrelevant events As data are added to the mentalmovie or analysis worksheets, relevance is determined

pur-by examining events in pairs, and identifying cause±e€ect relationships between them When they exist,the events should be linked to show the sequence andwhere important the relative timing of related interac-tions The examination can begin with the process out-come, and proceeds backward in time toward thechange event(s) that initiated the process.Alternatively, it can start wherever an event is dis-played; work in both directions Events that do nothave a cause±e€ect relationship with other eventsshould be considered irrelevant, and tentatively setaside; they can be recalled if additional informationshows a need to do so

When available data have been exhausted, the

events with a cause±e€ect relationship should describe

what happened in the proper sequence, from the ®rst

deviant event to the last harmful event In cases where

adaptive actions prevented a loss outcome, the last

event would be restoration of the original activity or

a shutdown

The testing task checks the description of the events

for completeness The investigator looks at each

``caus-ing'' event to determine if the ``caus``caus-ing'' event was

sucient to produce the ``e€ect'' event every time it

occurred If so, that part of the description is complete

If not, the investigator needs to determine what

addi-tional actions were needed to produce the ``e€ect''

event each and every time the ``causing'' events

occurred When this task is ®nished the investigator

has identi®ed all the events necessary to produce the

outcome Remaining gaps in the description identify

remaining unknowns

Methods for hypothesizing events to ®ll gaps in the

scenarios exposed by the testing task use bounded logic

trees to display possible alternative scenarios A

bounded logic tree has both the top and bottom events

de®ned Alternative hypothesized scenarios are

devel-oped to link the bottom event to the top event The

most likely alternative supported by data recovered

after the occurrence can be used to complete the

description, provided their source is noted, and

uncer-tainties acknowledged

1.4.4 Work Product Development Tasks

These tasks depend on the deliverables speci®ed in the

investigation plan An investigation is remembered by

the work products it produces The description and

explanation documentation are the main work product

common to all investigations

An investigator's main task is to produce the

doc-umentation describing the ¯ow of interactions that

produced the outcome The mental movies or events

¯owcharts provide the basis for describing and

explain-ing what happened If acceptable in the organization,

the ¯owchart satis®es the basic documentation needs

If not, a narrative description prepared from the

¯ow-chart may be needed to satisfy other needs If another

reporting structure is required, such as the

facts/ana-lysis/®ndings/conclusions reporting format, the events

¯owcharts with their supporting data enable

investiga-tors to produce that work product

Regardless of the format, the description must

pro-vide sucient information to enable the user to

visua-lize what happened, and why it happened If

illustrations are needed to achieve this, they should

be added to the description An additional element ofthe investigation work product is the group of support-ing source documents or objects Each source of dataused should be identi®ed and archived and retainedaccording to the investigation plan

1.4.4.1 Problem Identi®cationOne constructive use of the descriptions is problemdiscovery and de®nition The problem discovery taskrequires a supplemental data-gathering e€ort Tode®ne a problem, an investigator must identify what

a person or object was expected to do, or the norm for

an action Then the investigator must de®ne the ence between what a person or object did and whatthey were expected to do, and examine why thatoccurred This comparative approach is the basis forde®ning problems Investigators sometimes fold thistask into the description or explanation developmenttasks That is not recommended unless restarting isurgent

di€er-Alternatively, if a ¯owchart is available, a problemcan be de®ned as a subset of the events constituting thescenario For example, if all expectations were satis-

®ed, but a person or object did not have adequatetime to adapt to prior events, that subset of eventsidenti®es a problem See Appendix A for guidanceabout the kinds of events for which timing may becritical However, then the investigator must pursuethe reason the problem came into being That pursuitcan lead to design, administrative, supervisory, train-ing, programming, or other less direct decisions,assumptions, or actions

1.4.4.2 Recommendation DevelopmentAnother constructive use of the descriptions is in thedevelopment of recommendations for future actions[26] If a ¯owchart of events is available, the eventssets used to de®ne problems provide the basis forexamining potential changes that might be introduced

to change the future ¯ow of events For each event inthe set, every actor, action, or link can be examined as

a candidate for change Changes might include ent sequencing or timing of events, changing the mag-nitude of events, or substitution of components,energies, or barriers, for example Then, the conse-quences of each change can be estimated by studyingwhat e€ect the change might have on the subsequentevents involved in the occurrence

di€er-Comparing the predicted consequences of each didate change provides a basis for evaluating and rank-

can-ing the desirability of the alternative choices, in terms

of their relative ecacy and eciency This

compari-son and evaluation should include a discussion of the

costs of implementation and value of predicted

perfor-mance improvements [27]

1.4.4.3 Success Monitoring

Another constructive use of the descriptions is to

develop a monitoring plan with which the predicted

success of proposed actions can be monitored if they

are implemented The approach is to look for the

recurrence of problem events sets during future

opera-tions Thus by identifying and monitoring those events

sets the e€ectiveness can be identi®ed If they recur, the

change may be unsuccessful If they do not recur, the

change is probably successful

1.4.4.4 Other Uses of Occurrence Descriptions

Action-based ¯owcharts of occurrences can be used for

ecient personnel training or retraining, to identify

operational improvements, for design reviews or new

design guidance, or to support changes in standards,

codes, or regulations The information on the

¯ow-charts is easy for individuals to assimilate because

they can quickly relate actions shown on the ¯owchart

to their own daily tasks They can also see their

rela-tionship to others' tasks, and use that as a basis for

doing their tasks more eciently

Other kinds of investigation outputs have more

limited uses, usually take longer to absorb, and are

more dicult for individuals to assimilate

1.4.5 Quality Assurance Tasks

Quality assurance tasks involve examining the quality

of the investigation work products, the investigation

process, and the investigation program

1.4.5.1 Investigation Work Product Quality

The quality assurance task varies with the investigation

process chosen If the actor±action-based process is

used, the quality assurance task consists of having

another investigator review the ¯owchart and

support-ing data for their logic and suciency This helps

identify and remove conjecture, speculation, and

unsupported conclusions Other indicators of quality

problems are the number of questions raised by users,

or the degree of controversy that follows release of a

report

If another process is chosen, the quickest way toassess the quality of the work products is to ¯owchartthe reported actions and links showing relationships,and look for gaps or logic errors to identify problemswith the work product or perhaps the investigationprocess [21]

1.4.5.2 Investigation Process QualityProblems with the quality of the work products pro-vide one indication of problems with the investigationprocess If work products are found to have problemsduring the quality assurance tasks, the investigationprocess should be re-examined as one possible reasonfor the problems The problem may also result fromthe process chosen, or its execution

Another indicator of problems with the tion process is the level of complaints about investiga-tor actions or behavior during the investigation.1.4.5.3 Investigation Program Quality

investiga-A third and broader indicator of problems is in thevalue of the results produced by investigations overtime A measure of performance is the comparison ofthe resources allocated to the investigation programand the cost of investigations with the value of theimprovements produced This quality assurance task

is more subjective, but still requires attention Howthat is done should re¯ect the assessment practicesapplied to other kinds of activities in the organization.1.4.6 Deliverables

The speci®cations in the investigation plan de®ne thecontent of the deliverables produced by the investiga-tion, and their distribution The investigator's task is toproduce the required deliverables From time to time,the investigators are called upon to make oral presen-tations to explain or defend their deliverables To dothis well, investigators should ensure that the logic oftheir reasoning has been checked carefully

Another important deliverable, particularly whenpotential injury claims or litigation are foreseeable, isthe source material That consists of documents,photos, selected debris, sketches, or whatever sourcematerials were used to de®ne and document thereported actions Chain-of-custody documents may

be an essential element of these deliverables

When regulatory agencies prepare a report, ensurethat internal deliverables are compatible with thosereports, or explain any inconsistencies When accidentsrequiring investigation under regulations are investi-

gated, it is desirable to prepare reports containing the

descriptive data required by regulations to meet their

requirements They require ``the date, time, description

of operations, description of the accident,

photo-graphs, interviews of employees and witnesses,

mea-surements, and other pertinent information.'' A

separate report, with ``information or evidence

uncov-ered during the investigation'' that would be of bene®t

in developing a new or changed standard is also

required to be submitted to the agency [1] It is good

practice to review reports prepared for regulatory

agencies to remove subjective opinions or built-in

judg-ments from the reports Cause statejudg-ments can be

con-tentious To minimize arguments about causes, specify

what action(s) caused what speci®c e€ects, using event

terms

1.4.7 Postinvestigation Tasks

Postinvestigation tasks involve distributing and using

the investigation work products for additional

pur-poses These uses range from resolution of claims

and disputes to long-term enhancement of corporate

memory Some uses are obvious, like resolution of

claims, where the description of what happened

pro-vides a basis for negotiating settlements Other uses

include their incorporation into training or recurrent

training of personnel as case studies Charts can be

used as guidance for operating personnel to help

them to understand interactions among system

compo-nents, and to do their jobs more eciently

Distribution to designers helps them identify design

options or changes that could improve future

perfor-mance In multifacility organizations, the charts are

convenient to exchange among facilities for the same

purposes

When consistency among all investigation is

achieved, it becomes possible to combine the outputs

into a growing body of process ¯owcharts covering any

aspect of operations that may have been investigated

Analogous to mapping DNA, use of investigation

work products to build a map of operations increases

understanding of the processes That also provides new

opportunities for developing improvement

recommen-dations beyond those made in a single occurrence This

is a new frontier in industrial operations

Another important use of the work products is to

update predictive job, hazard, or operational analyses

of the systems Investigations provide the main tool for

assessing the quality of or verifying prior risk and

hazard analyses of the system, and showing where

changes might be needed [23]

1.5 SUMMARYFor an investigation program to be of constructivevalue to an organization, a positive approach trans-cending conventional compliance and prevention per-spectives needs to be in place The program must rest

on progressive policies, concepts, principles, plans, andpreparations The material presented helps organiza-tions accomplish this, while enabling investigators tosatisfy regulatory agency and other narrower demands

of investigations

Investigation technology is expanding at an ating rate Investigators are urged to use the Internetresources and newly published information to keepabreast of new developments They present opportu-nities to learn more about the investigation process andemerging developments, and the investigation require-ments imposed by regulations The Internet is in ¯ux,but the web sites noted with the references are usefulstarting points as this is written

acceler-1.6 APPENDICES: INVESTIGATIONTOOLS

The models and checklists in the appendices o€erguidance to help investigators during investigations

A General Human Decision Model forInvestigators

This model was developed from observations ofhuman behaviors in many transportation accidentinvestigations (Fig A1) It was developed by trackingwhat happened during the accident, and by using theevent-based data language and event matrices to showthe events ¯ows found

A.1 Application of the General HumanDecision Model for Investigators

To apply this model during investigations or views, identify people who appear to have had a role

inter-in the inter-incident process For each relevant action:

1 Begin by ®nding the change or changes in theactivity that created a need for action by thatperson to keep the activity progressing towardits undesired outcome

2 When identifying that change, determine ifthe change emitted some kind of signal that aperson could detect or observe If it did not,

explore why it did not and what e€ect that had

on the outcome

3 If it did emit a signal, explore whether the

per-son saw, heard, felt, or otherwise ``observed'' the

signal If not, explore why not, and what e€ect

that had on the outcome

4 If the person observed the signal, was the signal

diagnosed correctly? Was the person able to

pre-dict the consequence(s) of the change from the

signal, and knowledge of the system and its

operation? If not, explore why not, and its

e€ects

5 If the predicted consequences of the change

were correctly identi®ed, did the person

recog-nize that action was needed to counter those

consequences? If not, explore why not, and its

e€ects

6 If so, did the person identify the choices for

action that were available for successful

inter-vention? If not, explore why not, and its e€ects

Was this a new situation where the action had

to be invented, or was this something that priortraining anticipated and provided the responses

to implement? In other words, was the personconfronted by demand for an adaptive or habi-tuated response? (Here, you start to get into theperson's decision-making process, and potentialpersonal judgment issues, so explore this areaempathetically with the witness, particularlyfor adaptive responses.)

7 If any response actions were identi®ed, did theperson choose a successful response to imple-ment? If a successful response was not chosen,explore why not

8 If a successful response was chosen, did the son successfully implement the desired action? Ifnot, explore why not

per-9 If a suitable response was implemented, the tem adapted to the change without an unin-tended loss or harm If the response did not

sys-Figure A1 This model represents decisions by people in response to changes It helps investigators understand the roles ofstimuli, sensory inputs, communications, diagnostics, decision making and implementation, training, design, procedural, super-visory, and many other ``human factors'' issues in occurrences (Adapted from Four Accident Investigation Games, Simulations

of the Accident Investigation Process Appendix V-F, General Human Decision Model for Accident Investigation Oakton, VA:Lufred Industries, Inc., 1982.)

achieve a no-accident outcome, explore why it

did not Often this leads to discovery of invalid

system design assumptions or other design

problems

After working with this model, you will be in a

much better position to discover, de®ne, describe,

and explain what happened when a so-called ``human

error'' or ``failure'' is alleged You will also be able to

identify more than one possible action to improve

future performance of that system

B Energy Trace and Barrier Analysis

This model (Fig B1) describes generally the steps to

follow to examine events with the energy trace and

barrier analysis (ETBA) method during investigations

It is a generalized model Investigators can apply it to

understand energy ¯ows that produced an observed

changed condition or reaction, or when an action

needs to be understood in greater detail

The kinds of energy that might be involved in a

speci®c investigation are listed below Look for

possi-ble energy sources when the energy source is not

Event form and content in description okay?Event names consistent in description?

Abstractions and ambiguities removed?

Sources referenced okay?

Scope of description adequate?

Flowchart causal links complete and valid?

Uncertainties clearly indicated

Figure B1 Energy trace and barrier analysis process model for accident investigation (Adapted from 10 MES InvestigationGuides, Guide 5, ETBA Oakton, VA: Ludwig Benner & Associates 1998, p 4.)

Mental movie (visualization) supported?

Editorial adjectives and adverbs removed?

Unsupported opinions or judgments removed?

QA checks completed okay?

Referenced sources in archives?

C.2 Recommendation Checklist

Recommendations When including

recommenda-tions in a report, use the following checklist to review

each recommendation [27]

Does the recommendation simply and concretely

describe the problem?

Does the recommendation clearly identify who will

have to do what is proposed?

Does the report state what speci®c improvement is

expected to occur if the recommendation is

implemented?

Does that person have adequate authority and

resources available to implement the proposed

action?

Is there enough uncertainty to indicate that a ®eld

test of the action is needed before making the

recommendation, or before it is widely

imple-mented? If so, is the required testing, de®ned?

Are appropriate implementation milestones needed?

If so, are they included and reasonable?

If more than one recommendation results from the

investigation, are priorities for implementation

necessary or provided?

Do you know how the people who have to

imple-ment the recommendations will respond to them?

Have you determined how both you and the

recipi-ent will know when your recommendation has

produced successful results?

Have you de®ned the follow-up process that is

required to ensure implementation and verify

that predicted performance was achieved?

If you had to implement the recommendation,

would you be willing to do so? Good rule:

don't ask anyone to do something you wouldn't

be willing to do yourself if you received the

recommendation

C.3 Problem Words Checklist

Listed below are words which are known to create

problems with descriptions and explanations of

occur-rences developed by investigators Use the list to locate

problem words, and replace them in ®nal reports if

possible

AndOrHeItSheTheyBlameNotNorWasWereDid notFailed toFaultPlural actor names (®re®ghters, crew)Compound actor names (third shift, crowd)Verbs with wrong tense (drive)

Passive voice verbs (was struck)Built-in judgments (too, failed, erred, misjudged,violated, should have, ignored, etc.)

Editorial ``ly'' adjectives and adverbs (badly, perly, inadequately, poorly, etc.)

impro-Words conveying what did not, happen (e.g., did notreplace) Say what did happen!

REFERENCESDeveloping Descriptions and Explanations

of What Happened

1 U.S Department of Labor, Occupational Safety andHealth Administration Title 29, Code of FederalRegulations, 1960.29 Accident Investigations (http://www.osha-slc.gov/OshStd_data/1960_0029.html)

2 U.S Department of Labor, Occupational Safety andHealth Administration OSHA's Small BusinessOutreach Training Program Instructional Guide,Accident Investigation, May 1997 (http://www.osha-slc.gov/SLTC/smallbusiness/sec6.html) OSHA's view

of investigation programs for small businesses

3 K Hendrick, L Benner Thinking about accidents andtheir investigation In: Investigating Accidents withSTEP New York: Marcel Dekker, 1986 chap 2

4 For a description of these perceptions and how theyin¯uence investigations, see L Benner 5 AccidentPerceptions: Their Implications For AccidentInvestigators ASSE Professional Safety, February

1982, or L Benner Accident Perceptions: TheirImplication For Investigators International Society

of Air Safety Investigators Forum, 14:1, 1981 (http://www.iprr.org)

5 K Hendrick, L Benner Investigation concepts In:

Investigating Accidents with STEP New York:

Marcel Dekker, 1986, pp 30, 235

6 WG Johnson The Management Oversight and Risk

Tree-MORT SAN 821-2 UC4l, prepared for the U.S

Atomic Energy Commission, Division of Operational

Safety under contract AT(04-3)-821, submitted

February 12, 1973, p 59 See also WG Johnson

MORT Safety Assurance Systems New York:

Marcel Dekker, 1980, Chapter 5 Many useful ideas

about nature of mishaps and investigations See also

U.S Department of Energy Accident/Incident

Investigation Manual, DOE/SSDC 76-45/27 2nd ed

1985 Built upon Johnson's research, and contains

some additional useful investigation techniques;

based on legal framework

7 SI Hayakawa, AR Hayakawa Language in Thought

and Action 5th ed San Diego, CA: Harcourt Brace &

Company, 1960, chap 3, pp 48, 85 Essential reading

for investigators who want to use factual language to

develop their work products

8 N Leveson Safeware: System Safety and Computers

Reading MA: Addison-Wesley 1995 Appendix A,

Medical devices: The Therac-25 Story describes

inter-actions between personnel input timing and software

design, for example

9 L Benner 10 MES Investigation Guides Oakton, VA:

Ludwig Benner & Associates, 1998 Guides cover wide

range of investigation procedures and practices

10 D Vaughan The Challenger Launch Decision,

Chicago, II: University of Chicago Press, 1996, chap

5 Describes how deviations become normalized

11 K Hendrick, L Benner Meekers law and perceived

interests, In: Investigating Accidents with STEP New

York: Marcel Dekker, NY, 1986, pp 149, 235

12 Adapted from L Benner Rating accident models and

investigation methodologies J Safety Res 16(3):

105-126, 1985 This work can also be found in ref 3

13 Handbook P88-I-1 Investigation of Mining Accidents

and Other Occurrences Relating to Health and Safety

U.S Department of Labor, Mine Safety and Health

Administration, 6/21 /94 Release 3 (http://

www.msha.gov/READROOM/HANDBOOK/PH88-I-l.pdf.)

14 Introduction to investigation (Companion guide to a

video ®lm with the same title), Stillwell OK:

International Fire Service Training Association, Fire

Protection Publications, 1997 Detailed investigation

guidance is consistent with multilinear events

sequen-cing concepts

15 NFPA 921 Traditional guidance for ®re

investiga-tions Quincy, MA: National Fire Protection

Association, 1995, Traditional guidance for ®re

inves-tigations

16 Accident Investigation (Companion guide to a video

®lm with the same title), Stillwell OK: International

Fire Service Training Association, Fire ProtectionPublications, 1997 Describes detailed investigationtasks, with checklist form of summary of tasks inchap 4

17 Guidelines for Investigating Chemical ProcessIncidents, New York: Center for Chemical ProcessSafety, American Institute of Chemical Engineers,

1992, p 50 Lists different kinds of investigationapproaches, with subjective thoughts of their attributes

18 ``U.S Department of Labor, Occupational Safety andHealth Administration, OSHA Field InspectionReference Manual CPL 2.103, Section 6-Chapter II.Inspection Procedures; OSHA Instruction CPL 2.94July 22, 1991 OSHA Response to Signi®cant Events

of Potentially Catastrophic Consequences http://www.osha.gov/(do site search)''

19 Fatality Inspection Procedures OSHA InstructionCPL 2.113, U.S Department of Labor, Directorate

of Compliance Programs, Washington, DC April 1,

1996 Regulatory agency investigator guidance.(http://www.osha-slc.gov/OshDoc/Directive_data/CPL 2_113.html.)

20 RH Wood, W Sweginnis Aircraft AccidentInvestigation Casper, WY: Endeavor Books, 1995.Chapter 34 helpful for ``reading'' events from witnessplates

21 Proceedings with technical papers from annual nars and individual papers are available through theInternational Society of Air Safety Investigators,Sterling, VA 20164

semi-Assuring Quality

22 L Benner, I Rimson Quality Management ForAccident Investigations (in two parts) InternationalSociety of Air Safety Investigators Forum, 24(3),October 1991; 25(1): February 1992.(http://www.pa-triot.net/users/luben/5IRRQC.html.)

Developing Recommendations

23 I Rimson, L Benner Mishap Investigations: Tools ForEvaluating The Ouality Of System Safety ProgramPerformance Proceedings of 14th System SafetyConference, Albuquerque, NM (www.iprr.org/LIB/QMA_P1.html from http:/www.patriot.net/5IRRQC.html.)

24 K Hendrick, L Benner Appendix E In: InvestigatingAccidents with STEP New York: Marcel Dekker,

1986 Presents instructions for preparing a testplan

25 L Benner 10 MES Investigation Guides Oakton, VA:Ludwig Benner & Associates, 1998, Investigation TestPlan Guide

26 L Benner, 10 MES Investigation Guides 2nd ed.

Oakton, VA: Ludwig Benner & Associates, 1998,

Guide 8 Helps investigators develop

recommenda-tions

27 K Hendrick, L Benner Investigating Accidents with

STEP, New York: Marcel Dekker, 1986, pp 361±365

Describes recommendation quality control problems

to avoid

Internet Site References

Several of the references provide Internet web

addresses Internet sites change frequently, and

more are coming on line daily Sites of interest toinvestigators can be located by doing searches onaccident investigation using one or more of themany internet search engines available The searcheswill disclose the online sites when the search is con-ducted References to additional investigation man-uals, research reports, papers, books, videos, andlinks to investigation sites and investigation reports,publications, and other resources of interest can befound at www.iprr.org