page 185
8.1.5.3 - Causes Trees
• Causes trees can be used to focus on controlling error situations.
Incomplete testing results in failure in low pressure environment
Mechanical
Failure of
GYROS
DESIGN
navigation system control not suitable for impact effects during docking
Loss of orientation through impact
MOTION ERROR
miscommunication of mission sequence lead to an unexpected motion
Improper flight plan
MISSION PLANNING
• Note Ishikawa/fishbone diagrams used in quality control are useful here, as well as Pareto diagrams for selecting problems for elimination.
8.1.6 Error Sources
•Humans are very flexible, and are capable of adapting to many diverse situations. On the other hand this creates the ability to make mistakes.
•An estimate of human error rates, for trained operators was made available for nuclear power plant operation [Rasmussen et. al., 1987, pg. 136],
|
DESCRIPTION |
RATE |
|
|
|
|
|
|
Operator selects a safeguard switch (with an additional step such as a key) when |
0.0001 |
|
|
a non-safeguard switch should be selected. |
|
|
|
|
|
|
|
Wrong switch selection through label misreading |
0.003 |
|
|
|
|
|
|
Fatigue induced mistakes |
0.01 |
|
|
|
|
|
page 186
• Another table of human error estimates is given below. [Leveson, 1995, pg.353] |
|
|
|
|
ACTIVITY |
|
RATE |
|
|||
|
|
|
|
|
omission of control action when no status display present. For example, the |
|
0.01 |
|
pilot tests landing gear, but there is no landing gear down indicator, and the |
|
|
|
pilot neglects to retract it. |
|
|
|
items are neglected because they occur midway through a long procedure list, |
|
0.003 |
|
as opposed to the end. For example, On a list of 100 prelaunch steps, the |
|
|
|
step to retract a gantry is missed. |
|
|
|
operational mistake. For example, an operator that is fully familiar with a sys- |
|
0.03 |
|
tem misreads a label and actuates the wrong switch. |
|
|
|
simple mathematical mistakes. For example, a simple addition or flow values. |
|
0.03 |
|
inspection or monitoring error. For example, the first operator has made a mis- |
|
0.1 |
|
take, and it is not observed during checking. |
|
|
|
change of personnel without information exchange. For example, as control |
|
0.1 |
|
crews change, abnormal settings in the controls are not noticed. |
|
|
|
|
|
|
• A list of generic hazards for the space shuttle was found in [Leveson, 1995, pg. 297],