Human error: slips, mistakes and the move from person to system

An accident report opens with a person. A nurse has entered the wrong dose, a controller has cleared two aircraft onto one runway, a driver has braked too late. The first sentence reads like a cause, and it is not one. The argument of this unit is that classifying an outcome as human error hides the conditions in the design and the organisation that let the failure through. The label stops the enquiry where it should begin. Unit 7 asked where judgement goes wrong. This one asks what the error does to the world. The remedy follows from the kind of failure. A slip is a failure in which the intention was right and the action went wrong, and a constraint in the interface answers it. A mistake is a failure in which the intention itself was wrong, and better information and a way to check answer it. The strongest counter is that in tightly coupled, interactively complex systems failures interact unpredictably and outrun any such remedy, so an accident is a normal property of the structure (Perrow, 1984).

A slip and a mistake are not the same failure

Norman (1981) modelled action as a parent schema with child schemas, each carrying triggering conditions and an activation value. He used the model to sort action slips into three categories. The first is errors in forming the intention, such as mode and description errors. The second is faulty activation of schemas, such as losing an intention or misordering steps. The third is faulty triggering, such as blends and intrusions of habit. In a slip the intention was proper and the result did not conform to it, so the person meant the right thing and did the wrong thing (Norman, 1983).

Work a slip in an interface. A user intends to save a document and quit. The menu lists Save and Save As next to each other, the pointer lands on Save As, and a dialog appears that the user did not want. A right intention triggered a wrong action, which is Norman's definition of a slip and an instance of faulty triggering. The remedy follows from that diagnosis, so the fix is the menu rather than the user. The case is a constructed instance of a measured class. It does not tell you which slip a given user will make.

Rasmussen (1983) gives the classification a wider frame. He separates performance at the skill, rule and knowledge levels, and pairs each with its own kind of information. Signals are handled without conscious control, signs trigger stored procedures, and symbols are reasoned over explicitly. A skill-based failure is a lapse in smooth sensorimotor performance. A rule-based failure is the misclassification of a familiar situation or the wrong rule called up. A knowledge-based failure comes from incomplete understanding under load. Reason (1990) assembled these strands into the taxonomy the field now teaches. He argued that the same cognitive processes recur across error types and across domains.

The framework forbids a single remedy: a designer who has classified the failure adds a constraint or a check where that one will work.

The remedy depends on the kind of error

Norman (1983) drew design rules directly from the analysis of slips, reasoning that if the machinery of action is ordinary, the wrong action can be engineered out of the interface. The rules reduce the chance that a right intention triggers a wrong action. Make actions reversible. Cut down the number of modes. Keep the state visible on more than one channel, and at an irreversible step force a deliberate act.

A worked clinical example shows why the split matters, and it is constructed here rather than drawn from a study. A nurse selects the wrong patient record from a long list because the target shares a surname with a familiar patient. That is a capture slip, and the remedy is a constraint: a distinct identifier on the row and a confirmation that names the patient. The same nurse enters the wrong dose because the guidance was misread. Careful clicking does not correct that, because the intention was already wrong. The remedy is information and a check, a dose range beside the field, and an independent verification.

Stanton and Salmon (2009) report that driver error contributes to up to 75 per cent of roadway crashes. They found that all but one of the driver-error studies they reviewed worked without a human error taxonomy, so their countermeasures were not tied to the mechanisms they were meant to prevent. Their response is a taxonomy built from the dominant psychological mechanisms of driving, with in-vehicle technologies mapped to each. The systems view is widely accepted, and acceptance alone does not produce remedies that match the errors.

Contested question: person, system or structure?

Reason (2000) sets out the two habits. The person approach focuses on the unsafe acts of people at the sharp end. It treats error as arising from forgetfulness, inattention or moral weakness, and answers it with more procedures, retraining and blame. The system approach accepts that people are fallible and that error is to be expected. It concentrates on the conditions under which they work, building defences that avert an error or blunt its effect.

Dekker (2002) contrasts the old view, in which error is the cause of failure, with the new view. In the new view error is a symptom of trouble deeper inside the system, and people are doing what made sense at the time. He warns that the new view is widely endorsed in principle and often abandoned under pressure, because naming a proximal cause protects the belief that the system is basically safe. Woods and colleagues (2010) argue that the label human error is prejudicial and hides more than it reveals. Leveson (2011) turns the systems view into an engineering method, modelling accidents as the product of inadequate control of a system's behaviour.

Two results bound the move from person to system. The first is that the taxonomies never abandoned the person. Wiegmann and Shappell (2003) build the Human Factors Analysis and Classification System on Reason's model of latent and active failures. They nest the operator's unsafe acts inside the preconditions, supervision and organisational influences that produce them. Stanton and Salmon (2009) keep the driver at the centre and design technology around the driver's errors. The second result is Perrow (1984), the strongest counter to this unit's thesis.

Work Perrow's case. At Three Mile Island a relief valve stuck open. Its indicator showed only that the command to close had been sent, not that the valve had closed. The operators read a plant state that the panel misrepresented, and their actions followed from that reading. The same gap opens on an intermittent link, where a display reports the last state it heard rather than the state now. Perrow (1984) reads the episode as evidence that in a tightly coupled, interactively complex system, failures interact in ways the design did not anticipate and outrun the operator. The case shows why a constraint at the operator's panel would not have removed the failure. It does not show that no design change could have, which is the dispute the unit leaves open.

What would settle the dispute is measurement, and the evidence is thin. Muecklich and colleagues (2023) reviewed the aviation safety literature from 1984 to 2021 and analysed the 77 most relevant records. They found the theories applied unevenly, with resilience engineering now predominant, and the primary operational subsystems studied far more than maintenance and ground operations. A settling study would analyse one hazard under each theory with predictions stated in advance, and measure coupling rather than classify a system as risky. Neither camp has produced that comparison at scale, so the defensible position is mixed. The two sides differ in what they can show. The systems view rests on accident analyses read after the fact, which invites the very hindsight bias it warns about, while the structural account rests on a few detailed case histories rather than on a population of accidents.

While the dispute is open, a designer can act on what both readings allow. Classify the failure before choosing the remedy, because a constraint answers a slip and a check answers a mistake. Make an irreversible step reversible or deliberate. Where a system is tightly coupled, add slack and independent verification rather than another warning, because coupling is where both accounts agree the failure will run.

Where the argument is heading

The field is moving from naming error to modelling the conditions that produce and absorb it. Safety-II turns resilience into a programme that studies ordinary successful work (Hollnagel, 2014). Carayon and colleagues (2014) set out the SEIPS model, in which interacting elements of the work system shape care processes and outcomes. They argue that interventions aimed at a single element fail because the system rebalances around them. Leveson (2011) presses the same logic into an engineering method usable before an accident. An error count is easy to tally, and the conditions behind it are hard to observe.

The sources this unit rests on

• Carayon, P., Wetterneck, T. B., Rivera-Rodriguez, A. J., Hundt, A. S., Hoonakker, P., Holden, R. and Gurses, A. P. (2014). Human factors systems approach to healthcare quality and patient safety. Applied Ergonomics, 45(1), 14-25. doi:10.1016/j.apergo.2013.04.023 Sets out the SEIPS model, in which interacting elements of the work system shape care processes and outcomes, and argues that single-element interventions fail. It gives the systems view an applied form in healthcare.
• Dekker, S. W. A. (2002). Reconstructing human contributions to accidents: the new view on error and performance. Journal of Safety Research, 33(3), 371-385. doi:10.1016/s0022-4375(02)00032-4 Contrasts the old view of error as the cause of failure with the new view of error as a symptom of trouble deeper in the system, and shows how hindsight bias makes investigators blame those closest to the event. It supplies the unit's central distinction.
• Hollnagel, E. (2014). Safety-I and Safety-II: The Past and Future of Safety Management. CRC Press. doi:10.1201/9781315607511 Contrasts Safety-I, which counts failures and is reactive by construction, with Safety-II, which defines safety as the ability to succeed under varying conditions. It supplies the constructive turn the unit names as where the argument is heading.
• Leveson, N. G. (2011). Engineering a Safer World: Systems Thinking Applied to Safety. MIT Press. doi:10.7551/mitpress/8179.001.0001 Sets out STAMP, a systems-theoretic accident model in which accidents follow from inadequate control of a system's behaviour rather than from a broken component. It turns the systems view into an engineering method.
• Muecklich, N., Sikora, I., Paraskevas, A. and Padhra, A. (2023). Safety and reliability in aviation: a systematic scoping review of normal accident theory. Safety Science, 164, 106097. doi:10.1016/j.ssci.2023.106097 Reviewed the aviation safety literature from 1984 to 2021 and analysed the 77 most relevant records, finding the theories applied unevenly and resilience engineering now predominant. It bounds the structural account of failure and sets the standard for what would settle the dispute.
• Norman, D. A. (1981). Categorization of action slips. Psychological Review, 88(1), 1-15. doi:10.1037/0033-295x.88.1.1 Modelled action as interacting schemas and used the model to sort slips into errors in forming the intention, faulty schema activation and faulty triggering. It turns a slip into a diagnosable event rather than a defect of character.
• Norman, D. A. (1983). Design rules based on analyses of human error. Communications of the ACM, 26(4), 254-258. doi:10.1145/2163.358092 Derived design rules from an analysis of slips, defining a slip as a case where the user's intention was proper but the result did not conform to it, and recommending reversibility, fewer modes and deliberate acts at irreversible steps. It is the unit's remedy for slips, tied to the mechanism.
• Perrow, C. (1984). Normal Accidents: Living with High-Risk Technologies. Basic Books. url:https://archive.org/details/normalaccidentsl0000perr Argued from cases such as Three Mile Island that in systems both interactively complex and tightly coupled, failures interact unpredictably and propagate before anyone can intervene, so accidents are a normal property of the structure. It is the strongest counter to this unit's thesis.
• Rasmussen, J. (1983). Skills, rules, and knowledge: signals, signs, and symbols, and other distinctions in human performance models. IEEE Transactions on Systems, Man and Cybernetics, SMC-13(3), 257-266. doi:10.1109/tsmc.1983.6313160 Distinguished performance at the skill, rule and knowledge levels, paired each with its own kind of information, and argued that each level fails in a different way. It connects the kind of error to the kind of task.
• Reason, J. (1990). Human Error. Cambridge University Press. doi:10.1017/cbo9781139062367 Integrated several isolated literatures into a taxonomy of error and identified cognitive processes common to many error types, arguing that safety improves through understanding the mechanisms of error. It is the central text that makes error a property of systems.
• Reason, J. (2000). Human error: models and management. BMJ, 320(7237), 768-770. doi:10.1136/bmj.320.7237.768 Contrasts the person approach, which blames the unsafe acts of people at the sharp end, with the system approach, which concentrates on the conditions under which people work and builds defences against error. It is the unit's thesis in one place.
• Stanton, N. A. and Salmon, P. M. (2009). Human error taxonomies applied to driving: a generic driver error taxonomy and its implications for intelligent transport systems. Safety Science, 47(2), 227-237. doi:10.1016/j.ssci.2008.03.006 Reports that driver error contributes to up to 75 per cent of roadway crashes, found that all but one of the driver-error studies reviewed worked without a taxonomy, and built one from the dominant psychological mechanisms of driving. It shows that the systems view does not by itself produce remedies matched to the error.
• Wiegmann, D. A. and Shappell, S. A. (2003). A Human Error Approach to Aviation Accident Analysis: The Human Factors Analysis and Classification System. Ashgate. doi:10.4324/9781315263878 Presents the Human Factors Analysis and Classification System, which builds on Reason's model of latent and active failures and nests the operator's unsafe acts inside the preconditions, supervision and organisational influences that produce them. It shows the move from person to system nested the person rather than removing it.
• Woods, D. D., Dekker, S., Cook, R., Johannesen, L. and Sarter, N. (2010). Behind Human Error (2nd ed.). Ashgate. doi:10.1201/9781315568935 Argues that the label human error is prejudicial and hides more than it reveals about how a system functions or fails, and that hindsight bias shapes every attribution of error. It gives the unit its sharpest statement of the labelling critique.