Multidisciplinary perspective on accident investigation

Edited by C.W. JohnsonInternational audienceThe increasing complexity of many computer-controlled application processes is placing increasing demands on the investigation of adverse events. At the same time, there is a growing realisation that accident investigators must consider a wider range of contributory and contextual factors that help to shape human behaviour in the causes of safety-related incidents. A range of techniques have been developed to address these issues. For example (as we show in this paper), task modelling techniques have been extended from human computer interaction and systems design to analyse the causes and consequences of operator ‘error’. Similarly, barrier analysis has been widely used to identify the way in which defences either protected or failed to protect a target system from potential hazards. Many barriers fail from common causes, including misconceptions that can be traced back to early stages in the development of a safety-critical system. For instance, unwarranted assumptions can be made about the impact of training on operator behaviour in emergency situations. Similarly, barrier analysis can also be used before a system has been designed to inform the system model and make it more tolerant to errors by incorporating human and technical barriers into the design. Task models often uncover deep-rooted problems, for instance, in workload allocation across many different aspects of an interactive control system. It can be difficult to use barrier and task analysis to trace these common causes that lie behind the failure of many different defences. In order to deal with this complex combination of contributory factors and systems, we promote the use of abstraction (via models) as a way of representing these components and their interrelations whether it is design, construction or investigation. We use, to formally model an abstraction of the system. Additionally, the system model (described using a dialect of high-level Petri-nets) allows to reason about the system and to check conformance with the other models (task model, safety case and barriers). This paper, therefore, shows how an analysis of safety case arguments can be used to support the application of barrier, task, error and system analysis during the investigation of a command and control failure. The intention, in this paper, is to show that if an accident involved the failure of multiple barriers, it is also possible to trace the common causes of those failures back to the assumptions and arguments that are embodied within a safety case. Many countries require that safety cases demonstrate a system is ‘acceptably safe’ before they grant regulatory approval. These documents and the associated analytical techniques, therefore, provide a rich source of information about why command and control failures occurred. We demonstrate our approach on a fatal mining accident case study