A system's defenses can be penetrated for one of two reasons: 1) the system's defenses are present but do not work properly for some reason; or 2) the system's defenses are missing or entirely mismatched to the threat they face. These defense penetrations illustrate an important aspect of system failures: they can be active failures (number one above), or they can be latent unsafe conditions (LUCs) (number two above). Active failures and LUCs do not arise only in the defenses. In fact, the threats that penetrate defenses originate within the system itself. They are, in fact, active failures and LUCs originating in each of the elements of production.

　

Active Failures are the unsafe acts and decisions committed by line workers that occur m a system during operations (i.e., in the production and defense elements of the system). Unsafe acts and decisions are human errors and willful violations. Most often, active failures have an immediate impact on safety. Active failures are described as: 1) an action taken by a person in the presence of a hazard, or 2) a decision taken by a person in the presence of hazard. For example:

　

　

Latent Unsafe Conditions (LUCS) are hazardous conditions in the system that lie dormant, often for years, only becoming evident when they combine with an active failure to result in a negative outcome. Often they arise from decisions made far from the incident scene and believed to be good or necessary. LUCs should describe the condition of the system arising from a fallible decision, action, or mismanagement, rather than the decision, action or mismanagement itself. For instance:

　

　

The active failures and LUCs in the maritime transportation system all exist for a specific period of time, and they can be thought of as windows in the elements of production which open at a given time, and close at another time (when the LUC disappears). Because these LUCs are opening and closing, they will not, in most cases, align. For this reason, incidents do not constantly occur in complex systems despite the many active failures and LUCs that may be present. When these opening and closing windows align and open at the same time, a hazard progresses through all the elements of production and becomes an incident. If active failures and LUCs are represented as holes, a system incident can be visualized as in the below "Swiss Cheese Diagram":

　

Just as decision makers set the stage for production at the organizational level with appropriate decisions, they also set the stage for an incident through inappropriate or fallible decisions. In deciding how to use their limited resources, decision makers face difficult choices, and the system itself does not help them. Money spent on improving the system's productivity (i.e. making the extra run, carrying the extra cargo) has a relatively clear outcome: higher profit. Money spent on safety or environmental protection has relatively distant and long-term outcomes. Fallible decision makers occasionally inappropriately weigh the system's feedback, and make bad decisions. These fallible decisions create LUCs in the system. Examples of poor decisions include a lack of regulation, poorly planned government deregulation, and too rapid expansion of routes or services. These decisions create LUCs that act on line managers.

　

The following Organizational Factors commonly occur in system incidents:

　

　

The consequences of the Organizational Factors manifest themselves differently in the various line management departments or activities. If a line manager is competent, motivated, adequately funded, properly staffed, and has adequate time, they can transform a bad decision from above into a less-risky or even safe activity. A less competent or poorly supplied line manager, however, can make a bad decision worse, or execute a good decision in such a manner that it has bad effects. The decisions and actions of line managers in implementing the decisions of those above them in the system can create additional LUCs. Examples of bad line management creating latent unsafe (pre)conditions include inadequate procedures for doing the job, poor scheduling, insufficient training for line workers, and an inadequate maintenance regime.

　

The following Workplace Factors commonly occur in system incidents

　

LUCs in Human Resources

LUCs in Monetary/Budget Resources

LUCs in Material Resources (equipment, facilities, etc.)

LUCs in Organizational Structure

LUCs in Operational Culture

LUCs in Operations and Supervision

LUCs in Practices and Procedures

　

Preconditions are the LUCs of the line workers and equipment itself. Some LUCs in workplace management can render workers and equipment unready. An inadequate training program, for instance, could manifest itself in a variety of LUCs: excessive workload, undue time pressure, and motivation problems, creating ways in which workers would not be ready to go work. The reverse relationship is also true: a single LUC (gear or people not ready to work) could be created by several workplace factors. Examples of latent unsafe (pre)conditions include: improper gear, inexperience or untrained personnel, fatigue, equipment that is worn or unsuited to its use, etc.

　

There are many factors known to degrade the performance of human beings. Enclosure 1 describes these many factors in detail as they pertain to generating the timeline. In short, LUCs related to line workers fall into one of the following general categories:

　

Limitations of persons

Person Mismatches

　

Equipment and materiel use for production also possess preconditions rendering them unsuitable for use.

　

Limitations of Equipment