Human error is the symptom, not the cause: the person-system distinction and its taxonomy

An investigation that ends with the words human error has named a symptom and stopped. The claim is James Reason's, and it rests on a distinction between two readings of the same event (Reason, 2000). The system approach treats errors as consequences rather than causes, with their origins upstream. The taxonomy that followed gave the field an object it could decompose, and so did the split between active failures and latent conditions.

This first of ten units argues that the taxonomy still carries the field, even where later work rejects the causal chain it assumes. The choice changes what a designer does next. A verdict ends in retraining and blame. A symptom ends in a search upstream. The nine units after this one take that search outward, through the measures of the operator to the systems, rules, reports and evaluations that shape the work.

The verdict became a question

Reason (2000) puts the two models side by side, and the differences are practical. The person approach treats unsafe acts as products of forgetfulness, inattention, carelessness or recklessness. It reaches for fear appeals, retraining, disciplinary measures and blame. Its followers treat errors as moral issues, and they assume that bad things happen to bad people. The system approach starts from human fallibility instead.

The distinction earned its place by being usable. A claim that people sometimes err explains nothing. An analyst can test a claim that a set of conditions produced a specific error class, and redesign the conditions.

The categories were assembled, not invented

Reason did not invent the taxonomy he is known for. He assembled it from two literatures already at work. Rasmussen (1982) published a taxonomy of human malfunction for industrial installations. His stated view was that the structure he proposed mattered more than the number of categories it carried. He also warned about a natural tendency. When an analyst meets an inappropriate act, the analyst tends to accept human error as the explanation, by the causal backtracking "it is human to err". The analyst must therefore also look for external causes.

Norman (1981) supplied the cognitive machinery for the slips half. He sorted slips into errors in forming the intention, faulty activation of schemas and faulty triggering. Rasmussen (1983) supplied the levels of control behind error type. He distinguished skill-, rule- and knowledge-based behaviour, and the signals, signs and symbols they use.

Reason's frame, and the line it draws

Reason (1990) is where the pieces became one account. Reason (1995) sets that taxonomy out compactly in an article on adverse events in health care, in the form the field teaches it. Slips, lapses, trips and fumbles are execution failures. Mistakes are failures of planning or problem solving, and they divide into rule-based and knowledge-based mistakes. Errors are information-handling problems, and violations are motivational ones.

Those in direct contact with the patient commit active failures. Latent failures arise in organisational and managerial spheres, and they may take a long time to show their effects. Decisions in the upper echelons therefore create the conditions that promote errors and violations downstream. Latent failures are present long before an accident, which makes them prime candidates for risk management. Sanctions and exhortations, Reason adds, have only very limited effectiveness, especially with highly trained professionals.

Reason (1997) turned the distinction into a management model. Major accidents are rare, he argues, because of the barriers, safeguards and defences that modern technology carries. They keep happening anyway. A defence is a property of the system, so when several fail together the interesting fact is their alignment rather than the last person who moved. Reviewers record that this layered-defences picture, the Swiss cheese model, became the basis for applied frameworks including the Human Factors Analysis and Classification System (Ahmadi Rad et al., 2023).

The applied test, and the prediction turn

Shappell and colleagues applied that system to commercial aviation accidents (Shappell et al., 2007). Six pilot-raters coded aircrew, environmental, supervisory and organisational causal factors for 1,020 accidents over 13 years. The raters attributed most causal factors to aircrew and the environment, with decidedly fewer to supervisory and organisational causes. A framework built to find upstream conditions found most of its causes at the sharp end.

Stanton and Salmon (2009) reviewed the driver-error literature. They found that all but one of the studies they examined had worked without a human error taxonomy. Driver error is nevertheless credited with a part in up to three quarters of road crashes. They built one from the mechanisms held to be involved: perception, attention, situation assessment, planning and intention, memory and recall, and action execution. They derived a second taxonomy from the conditions that produce those errors. The exercise shows that researchers can generate categories for a domain that never had them. It does not show that they change an outcome, because the countermeasures the paper sets out are in-vehicle technologies rather than tested interventions.

Rasmussen (1982) had already separated two uses of a taxonomy. Event analysis breaks an event into its features. Prediction must generate the possible chains of events from the task itself, and that requires a functional analysis of the system. Hollnagel (1998) answered that limit with CREAM, a taxonomy integrating individual, technological and organisational factors on cognitive engineering principles. Its chapters run from retrospective analysis to prediction and quantification for probabilistic safety assessment.

The label is a judgement made after the fact

The sharpest critique comes from inside the tradition Reason built.

The label 'human error' is prejudicial and hides much more than it reveals about how a system functions or malfunctions. (Woods et al., 2010)

Woods, Dekker, Cook, Johannesen and Sarter (2010) take that sentence as their premise. Their mechanism is hindsight bias, which enters every attribution of error. The label human error is therefore a judgement that stakeholders make after the fact. The critique does not dissolve the taxonomy. A classification of error is a classification of judgements made after the fact, so its categories inherit the standpoint of the analyst.

The contested question: does the taxonomy explain, or only re-describe?

Researchers hold three positions, and they disagree about what would count as an answer. The first holds that the taxonomy is an explanation machine. Reason (1990, 1995, 2000) is the clearest statement. Its evidence is that classification changes the countermeasure. Reason's example is an omitted act. When the task has the procedure available, a coder reads the omission as a lapse, and the countermeasure becomes a procedure check. That check assumes a reader with the literacy to follow it. When the act reflects a wrong model of the task, the coder reads it as a knowledge-based mistake, and the countermeasure becomes a change to the mental model. The test is whether the category changes what the organisation does next.

The second holds that the taxonomy re-describes a judgement. Woods et al. (2010) argue that stakeholders with an interest in where the line falls make their attributions of error after the fact. Hindsight bias makes an act look more obviously wrong in retrospect than it did at the time. The categories are real as social facts rather than as causes. The test is the information content of the label: two analysts could disagree about the category without either of them being wrong about the facts.

The third holds that the taxonomy has the wrong shape rather than the wrong label. Ahmadi Rad, Lefsrud and Hendry (2023) place the layered-defences model in the epidemiological family of accident models. They record the criticism that it does not fully satisfy systems-theory criteria, because it treats contributing factors as conditions rather than as nonlinear interactions. The review attributes that criticism to Grant and colleagues and to Salmon and colleagues. Salmon, Lenne, Stanton, Jenkins and Walker (2010) supply the transfer evidence. Road transport has few applications of the models, and their impact has been only minimal compared with other safety-critical domains. The authors conclude that theoretical and methodological development, and validation, remain outstanding. The aviation study's raters worked in an industry that funds investigation, unlike a unit that cannot afford a second reviewer.

The evidence that would settle the dispute is not one study but three. The first is a coding study in which independent analysts classify the same events under two taxonomies. Reliability is achievable, as Shappell's six raters show, and the question is whether the categories add information beyond the outcome. The second is a prospective test, comparing predictions of where cognitive reliability will fail with the errors later observed. The third is an outcome test: a setting where a change in classification changed the countermeasure and the harm rate. None of the studies in this unit reports the third.

What to do while the dispute is open

The evidence on the two sides is unequal. That classification changes countermeasures rests on Reason's worked examples, which illustrate rather than test. That the label re-describes a judgement rests on hindsight bias as a mechanism, which no study here has measured. The strongest objection to this unit's thesis is that Shappell's raters found most causes at the sharp end, so a taxonomy built to look upstream can land where the person approach does. While the dispute is open, a designer should record the category, the countermeasure it implies and the outcome it should move, then check whether it changed anything.

Where this is heading

The successor programme is systemic rather than epidemiological, and the taxonomy survives inside it. Ahmadi Rad, Lefsrud and Hendry (2023) reviewed systems-thinking accident analysis for railways. They identified 32 studies between 2000 and November 2022. They found that the Human Factors Analysis and Classification System and STAMP dominate the field, with recent attention turning to FRAM. That dominant system descends from Reason's taxonomy, and so belongs to the family whose causal shape attracted that criticism.

Sources

• Reason, J. (2000). Human error: models and management. BMJ. doi:10.1136/bmj.320.7237.768 Set the person approach and the system approach side by side, and argued that errors are consequences rather than causes, with their origins upstream. It states the distinction compactly.
• Reason, J. (1990). Human Error. Cambridge University Press. doi:10.1017/cbo9781139062367 Integrated previously isolated literatures and identified cognitive processes common to a wide variety of error types, arguing that safety gains depend on understanding error mechanisms. It turned borrowed categories into one account.
• Reason, J. (1995). Understanding adverse events: human factors. Quality and Safety in Health Care. doi:10.1136/qshc.4.2.80 Carried the framework into health care and stated the distinctions exactly, from slips and mistakes through to errors against violations and active against latent failures. It records that sanctions and exhortations are only very weakly effective with trained professionals.
• Reason, J. (1997). Managing the risks of organisational accidents. Ashgate. doi:10.4324/9781315543543 Argued that major accidents are rare because of the barriers, safeguards and defences modern technology carries, and set out principles and tools for managing organisational accidents. Its defences chapters are the source of the Swiss cheese picture.
• Rasmussen, J. (1982). Human errors. A taxonomy for describing human malfunction in industrial installations. Journal of Occupational Accidents. doi:10.1016/0376-6349(82)90041-4 Proposed a multi-facet taxonomy for event analysis in process plant, insisting the structure mattered more than the number of categories, and warned that analysts tend to accept human error as the explanation by the causal backtracking "it is human to err". It separates analysis from prediction.
• Rasmussen, J. (1983). Skills, rules, and knowledge; signals, signs, and symbols, and other distinctions in human performance models. IEEE Transactions on Systems, Man, and Cybernetics. doi:10.1109/tsmc.1983.6313160 Argued that routine and unfamiliar tasks need different models of performance, distinguishing skill-, rule- and knowledge-based levels and the signals, signs and symbols they use. It explains why error type depends on the mode of control.
• Norman, D. A. (1981). Categorization of action slips. Psychological Review. doi:10.1037/0033-295x.88.1.1 Collected everyday slips and organised them into errors in forming the intention, faulty activation of schemas and faulty triggering. It supplies the cognitive account behind the execution-failure half of the taxonomy.
• Shappell, S., Detwiler, C., Holcomb, K., Hackworth, C., Boquet, A. and Wiegmann, D. A. (2007). Human Error and Commercial Aviation Accidents: An Analysis Using the Human Factors Analysis and Classification System. Human Factors. doi:10.1518/001872007x312469 Had six pilot-raters classify aircrew, environmental, supervisory and organisational causal factors for 1,020 commercial aviation accidents over 13 years. The taxonomy proved usable at scale, yet it attributed most factors to aircrew and the environment rather than to supervisory or organisational ones.
• Hollnagel, E. (1998). Cognitive Reliability and Error Analysis Method (CREAM). Elsevier. doi:10.1016/b978-0-08-042848-2.x5000-3 Presented an error taxonomy integrating individual, technological and organisational factors on cognitive engineering principles, applied through a context-dependent cognitive model. Its chapters move from retrospective analysis to prediction and quantification, so it predicts where cognitive reliability will fail.
• Woods, D. D., Dekker, S., Cook, R., Johannesen, L. and Sarter, N. (2010). Behind Human Error. CRC Press. doi:10.1201/9781315568935 Argued that the label human error is prejudicial and hides more than it reveals, and that hindsight bias enters every attribution, so what is labelled error is a judgement made after the fact. It is the strongest statement that the label is no guide to countermeasures.
• Salmon, P. M., Lenne, M. G., Stanton, N. A., Jenkins, D. P. and Walker, G. H. (2010). Managing error on the open road: The contribution of human error models and methods. Safety Science. doi:10.1016/j.ssci.2010.04.004 Reviewed human error models and methods for road transport against other safety-critical domains. It found the applications limited and the impact minimal, and concluded that development and validation remain outstanding.
• Ahmadi Rad, M., Lefsrud, L. M. and Hendry, M. T. (2023). Application of systems thinking accident analysis methods: A review for railways. Safety Science. doi:10.1016/j.ssci.2023.106066 Reviewed systems-thinking accident analysis with a PRISMA search that identified 32 studies between 2000 and November 2022, finding that the Human Factors Analysis and Classification System and STAMP dominate railway accident studies, with FRAM gaining ground. It also records the criticism that the layered-defences model does not fully satisfy systems-theory criteria.
• Stanton, N. A. and Salmon, P. M. (2009). Human error taxonomies applied to driving: A generic driver error taxonomy and its implications for intelligent transport systems. Safety Science. doi:10.1016/j.ssci.2008.03.006 Reviewed the driver-error literature and found that all but one study worked without a human error taxonomy. It proposed one built from perception, attention, situation assessment, planning and intention, memory and recall, and action execution, and a second taxonomy of contributing conditions.