The data collected during an investigation (i. e. events and circumstances) can be organized, using multiple components of the modified SHEL model, into a framework surrounding an occurrence template (in this case the occurrence scenario), based upon the Reason model. Causal factors, i. e. the unsafe acts/decisions and conditions, are thereby identified.
Steps 3 to 5-An overview
Steps 3 to 5 are based upon the GEMS framework. The framework provides "pathways" that lead from the identification of the unsafe act/decision (Step 3) to the identification of what was erroneous about the action or decision (Step 4) and finally to its placement within a behavioural context (i.e., a failure mode within a given level of performance in Step 5). The GEMS framework illustrated in figure 3 is particularly useful in exploring hypothetical reconstructions of the occurrence.
Step 3-Identify unsafe acts/decisions and conditions
In step 3 of the process the information gathered and organized using the SHEL and Reason frameworks is used to initiate identification of causal factors, i. e., unsafe acts/decisions and conditions. An unsafe act is defined as an error or violation that is committed in the presence of a hazard or potential unsafe condition. Decisions where there are no apparent resultant actions but which have a negative impact on safety should also be considered as unsafe acts. An unsafe condition or hazard, as noted above, is an event or circumstance that has the potential to result in a mishap. There may be several acts, decisions and/or conditions which are potential unsafe candidates, thus necessitating iterative assessments of the occurrence facts. The SHEL and Reason hybrid tool (refer to figure 2) can provide a useful base for conducting such iterative assessments.
Once an unsafe act, decision or condition has been identified, the next stage is to determine the genesis of that particular act or condition. Further investigation and/or analysis may reveal other unsafe acts/decisions or conditions antecedent to the causal factor that was initially identified.
As noted earlier, several unsafe acts and decisions may be identified throughout steps 1 and 2 of the process. The last unsafe act precipitating the occurrence often provides a convenient starting point for reconstruction of the occurrence. This last act or decision differs from the others in that it can be viewed as the definitive action or decision which led to the occurrence, i. e., the last act or decision that made the accident or incident inevitable the primary cause of the initial event. Although it is usually an active failure, the last unsafe act or decision can be embedded in a latent unsafe condition, such as a flawed design decision which led to a system failure.
Step 4-Identify error or violation type.
This portion of the process is initiated for each unsafe act/decision by posing the simple question "What is erroneous or wrong about the action or decision that eventually made it unsafe?".
The identification of the type of error or violation involves two sub-steps (see figure 3):
