# Human Error Categorization: An Extension to Classical Proposals Applied to Electrical Systems Operations

Daniel Scherer, Maria Fátima Q. Vieira, José Alves N. Neto

► To cite this version:

Daniel Scherer, Maria Fátima Q. Vieira, José Alves N. Neto. Human Error Categorization: An Extension to Classical Proposals Applied to Electrical Systems Operations. Second IFIP TC 13 Symposium on Human-Computer Interaction (HCIS)/ Held as Part of World Computer Congress (WCC), Sep 2010, Brisbane, Australia. pp.234-245, 10.1007/978-3-642-15231-3_23 . hal-01055478

HAL Id: hal-01055478

https://inria.hal.science/hal-01055478

Submitted on 12 Aug 2014

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# Human error categorization: An extension to classical
proposals applied to electrical systems operations

Daniel Scherer¹,², Maria de Fátima Q. Vieira¹,³, José Alves do N. Neto¹

¹LIHM, Federal University of Campina Grande, Electric Engineering Department
Av. Aprígio Veloso, 882 - Bodocongó CEP 58.109-970 Campina Grande, PB – Brazil

²Center for Science and Technology, State University of Paraíba
Bodocongó - Campina Grande, PB - Brazil

³Centre for Excellence in Signal & Image Processing, Dept of Electronic & Electrical
Engineering, University of Strathclyde - Scotland, UK
{daniel.scherer,>jose.alves}@ee.ufcg.edu.br,
fatima@dee.ufcg.edu.br

**Abstract.** Accident and incident analysis is essential to the study of human error and the development of error prevention measures. Human Error research deals essentially with the classification of error and the identification of the causal relation between the error detected and the level of human performance at which it occurred. As a result the literature proposes many error categorization methods and taxonomies. These are not, in themselves, sufficient, however, to analyze (and understand) the circumstances surrounding the error occurrence. For a more complete understanding of human error, it is necessary to associate each error with the sequence of steps taken by the human operator during the task that led to it. This paper proposes an extension of the existing error categorization found in the literature and applies it to the analysis of human error reports originating in the electricity industry.

**Keywords:** Human Error Categorization, Error Analysis, Error taxonomy.

## 1 Introduction

The study of human error has an important application in supporting the reporting and analysis of accidents and incidents in industrial automated systems. Based on the existing literature, studies may be grouped as follows: error identification ([5], [2], [3], [4], [10] and [6]), the human performance level at which the error occurs ([5] and [7]), and the context in which the error occurs ([5] and [10]). Analyzing the error and its background, however, may not be sufficient for a complete understanding of the situation which preceded its occurrence. A crucial requirement for the effective analysis of an error report is the need to identify the precise decision process, made by
the operator<fnref n="1" /> of an automated system, which might have caused the accident or incident.

Hollnagel [10], Reason ([6] and [8]) and Norman [4] address the human error issue from a different viewpoint; that of describing the mechanisms of human malfunction (such as unintentional action, data-driven activation, spoonerisms, problems with causality, etc.). In contrast Rasmussen et al. [5], and particularly the extensions of this work proposed by Rouse et al. (apud Cellier [1], [2], [3]), identify the relationship between the human error and the sequence of decisions that were made prior to it. This is similar to the extension proposed in this paper. Our experience, obtained from analyzing a *corpus* of human error reports using this method of error categorization, suggests that, in addition to considering the error occurrence, it is necessary to consider correct actions taken by the operator. This additional consideration is central to understanding the context and decisions that lead up to an error. This motivates our proposed extension of the classic error classification. We apply the proposed extension to electric power systems operation in the particular context of automated substations.

The rest of the paper is organized as follows. Section 2 presents a review of the model proposed by Rasmussen et al. [5] and its extension, proposed by Rouse et al. ([1], [2], [3]), and draws comparisons between them and the taxonomy adopted by the company which serves as a case study. Section 3 describes our proposed error categorization and applies it to the analysis of a corpus of error reports that comprises the case study. Finally, Section 4 discusses the results and proposes new directions for this work.

## 2 Human Error Classification

Rasmussen proposed a model to describe the human decision sequence. This can be represented as a graph with the typical sequence of steps a human takes when carrying out a task.

### 2.1 Rasmussen error classification

In [5], Rasmussen et al. represents the model as an adequate taxonomy for reporting industrial incidents and events, involving *human malfunctions*. One of the proposed error categories is the *internal human malfunction*, described in Fig.1. The sequence of steps depicted provides the basis for human error categorization as corroborated by other authors (e.g. [2], [3] and [1]). Rouse & Rouse [1] take this sequence and expand it, associating to each step of the decision sequence, errors that might occur during task execution. Rasmussen et al. use this model to explain information processing activities (represented by rectangles in Fig. 1) and the resulting knowledge (represented by ellipses in Fig. 1) associated with the possible sequence of decision leading to the action performed. Another error category is the *external mode of*

<footnote n="1">¹ Along this paper, the term operator will imply human operator in industrial automated systems.</footnote>
malfunction, which describes the immediate and directly observable human malfunction (observable errors) during the execution of a given task (Table 1).

<figure><img src="image_2.png" /><figcaption>Fig. 1. Rasmussen's et al. model of human decision sequence [5]</figcaption></figure>

<table><caption>**Table 1.** Set of observable errors proposed by Rasmussen et al.</caption><tr><td>specified task was not performed:</td></tr><tr><td>- omission of task;</td></tr><tr><td>- omission of act;</td></tr><tr><td>- inappropriate, inaccurate performance;</td></tr><tr><td>- inappropriate/wrong timing;</td></tr><tr><td>- actions in wrong sequence.</td></tr><tr><td>the effect is due to specific, erroneous act:</td></tr><tr><td>- wrong act executed on correct component, equipment;</td></tr><tr><td>- wrong component, equipment;</td></tr><tr><td>- wrong timing.</td></tr><tr><td>the effect is due to extraneous act;</td></tr><tr><td>the effect is due to coincidence, several events or faults;</td></tr><tr><td>not stated, not applicable.</td></tr></table>

## 2.2 Eekhout, Johnson, Rouse and Rouse error classification

Based on the work of Rasmussen et al., Eekhout & Rouse [2] proposed a simplified model of the human decision sequence [5] resulting in a sequential list of general and specific categories; each error type being a member of one specific category. This
sequential list of general and specific categories was modified by Johnson & Rouse [3]. Later Rouse & Rouse (apud Cellier [1]) proposed a larger set of specific categories for each general category, **Table 3**.

## 2.3 Confronting error classifications

The two categories proposed by Rasmussen et al. (internal human malfunction and external mode of malfunction) greatly influenced the work of Eekhout & Rouse, Johnson & Rouse and Rouse & Rouse, resulting in only slight differences between the general error categories proposed by these authors (evident from **Table 2**). Our proposed categorization has three additional general categories (**Table 2**). These are recovery, consequences and causes, and are included to expose, respectively, (i) the time that an operator takes to recover from an error, (ii) the consequences resulting from the error, and (iii) the causes (state level of the operator and contextual situations) of the error. There is a significant difference between the categorizations concerning observable errors as shown in **Table 3**.

<table><caption>**Table 2.** General Error Categories compared</caption><thead><tr><th>Rasmussen</th><th>Eckhout & Rouse</th><th>Johnson & Rouse</th><th>Rouse & Rouse</th><th>Proposed categorization</th></tr></thead><tbody><tr><td>ACTIVATE</td><td>Observation of system state</td><td>Observation of system state</td><td>Observation of system state</td><td>Observation of system state</td></tr><tr><td>OBSERVE</td><td></td><td></td><td></td><td></td></tr><tr><td>IDENTIFY present state of the system</td><td>Identification of fault</td><td>-</td><td></td><td></td></tr><tr><td>INTERPRET consequences for current task, safety, efficiency, etc.</td><td>-</td><td>Choice of hypotheses</td><td>Choice of hypotheses</td><td>Choice of hypotheses</td></tr><tr><td>EVALUATE performance criteria</td><td>-</td><td>-</td><td>Hypotheses evaluation</td><td>Hypotheses evaluation</td></tr><tr><td>DEFINE TASK</td><td>Choice of goal</td><td>-</td><td>Choice of goal</td><td>Choice of goal</td></tr><tr><td>FORMULATE PROCEDURE</td><td>Choice of procedure</td><td>Choice of procedure</td><td>Choice of procedure</td><td>Choice of procedure</td></tr><tr><td>EXECUTE</td><td>Execution of procedure</td><td>Execution of procedure</td><td>Execution</td><td>Execution</td></tr><tr><td>-</td><td>-</td><td>-</td><td>-</td><td>Recovery</td></tr><tr><td>-</td><td>-</td><td>-</td><td>-</td><td>Consequences</td></tr><tr><td>-</td><td>-</td><td>-</td><td>-</td><td>Causes</td></tr></tbody></table>
<table><caption>Table 3. Comparing categories of observable errors</caption><thead><tr><th>General Category</th><th>Rasmussen</th><th>Eckhout & Rouse</th><th>Johnson & Rouse</th><th>Rouse & Rouse</th><th>Proposed categorization</th></tr></thead><tbody><tr><td>Observation of system state</td><td></td><td>- incomplete<br>- inappropriate<br>- lack</td><td>- incomplete<br>- misinterpreted<br>- repeated</td><td>- excessive<br>- misinterpretation<br>- incorrect<br>- incomplete<br>- inappropriate<br>- absent</td><td>- excessive<br>- misinterpretation<br>- incorrect<br>- incomplete<br>- inappropriate<br>- absent<br>- unnecessary<br>- correct</td></tr><tr><td>Choice of hypotheses</td><td></td><td>- incomplete<br>- inappropriate<br>- lack</td><td>- inconsistent with symptoms<br>- consistent but unlikely<br>- consistent but costly<br>- functionally irrelevant</td><td>- inconsistent with symptoms<br>- consistent but unlikely<br>- consistent but costly<br>- functionally irrelevant</td><td>- inconsistent in relation to observation<br>- consistent, but less probable<br>- consistent, but extremely costly<br>- non-pertinent from the viewpoint of functionality<br>- absent<br>- insufficiently consistent<br>- unnecessary<br>- correct</td></tr><tr><td>Hypotheses evaluation</td><td></td><td></td><td></td><td>- incomplete<br>- acceptance of an incorrect hypothesis<br>- rejection of a correct hypothesis<br>- absent</td><td>- incomplete<br>- acceptance of an incorrect hypothesis<br>- rejection of a correct hypothesis<br>- absent<br>- unnecessary<br>- correct</td></tr><tr><td>Choice of goal</td><td></td><td>- incomplete<br>- inappropriate<br>- lack</td><td></td><td>- incomplete<br>- incorrect<br>- superfluous<br>- absent</td><td>- incomplete<br>- incorrect<br>- superfluous<br>- absent<br>- unnecessary<br>- correct</td></tr><tr><td>Choice of procedure</td><td></td><td>- incomplete<br>- inappropriate<br>- lack</td><td>- incomplete<br>- inappropriate<br>- lack</td><td>- incomplete<br>- incorrect<br>- superfluous<br>- absent</td><td>- incomplete<br>- incorrect<br>- superfluous<br>- absent<br>- unnecessary<br>- correct</td></tr><tr><td>Execution</td><td>specified task not performed:<br>- omission of task;<br>- omission of act;<br>- inappropriate, inaccurate performance;<br>- inappropriate/ wrong timing;<br>- actions in wrong sequence.<br>the effect is due to specific, erroneous act:<br>- wrong act executed on correct component, equipment;</td><td>- incomplete<br>- inappropriate timing<br>- inadvertent action</td><td>- omission of steps<br>- other<br>- inadvertent action</td><td>- omitted operation<br>- repeated operation<br>- addition of an operation<br>- operation out of sequence<br>- intervention at some non-appropriate time<br>- position of inappropriate operation<br>- incomplete execution<br>- non-related, inappropriate</td><td>- omission<br>- replication<br>- inclusion<br>- sequence<br>- intervention at some inappropriate time<br>- incorrect operator position<br>- incomplete action<br>- unrelated or inappropriate action<br>- right action on wrong object<br>- unintended action</td></tr></tbody></table>
<table><tr><td></td><td>- wrong component, equipment;<br/>- wrong time.<br/>the effect is due to extraneous act;<br/>the effect is due to coincidence, several events or faults;<br/>not stated, not applicable.</td><td></td><td></td><td>action</td></tr><tr><td>Recovery</td><td></td><td></td><td></td><td>- too late<br/>- late<br/>- immediate</td></tr><tr><td>Consequences</td><td></td><td></td><td></td><td>- non-interrupted load<br/>- interrupted load<br/>- equipment overload<br/>- loss and damaged of equipment<br/>- personal damages</td></tr><tr><td>Causes</td><td></td><td></td><td></td><td>- lack of concentration occasioned by haste<br/>- lack of concentration occasioned by excessive self-confidence<br/>- lack of concentration<br/>- hurry<br/>- stress<br/>- confusion<br/>- pressure<br/>- anxiety<br/>- improvisation<br/>- inexperience<br/>- excessive self-confidence<br/>- personal problems<br/>- lack of technical capacity<br/>- tiredness<br/>- excessive concentration</td></tr></table>

## 3 Proposed categorization of the error

The extension of Rouse & Rouse's categorization was motivated by an analysis of errors in the operation of an electrical power system extracted from 10 years of reports provided by the Brazilian electricity company, CHESF.

Due to the general focus of the Rouse & Rouse categorization the number of errors classed as *Execution* errors resulted in mapping the terms defined by Rouse & Rouse onto those found in the reports. Although the original structure [9] was maintained, the three added general categories (*Recovery*, *Causes* and *Consequences*) and their specific subcategories were proposed to accommodate the corpus analyzed. When scrutinizing the error reports, however, we found situations that were not addressed
by the specific categories proposed by Rouse & Rouse, e.g. when an operator correctly observes the system state, or the situation described makes it unnecessary to evaluate the hypothesis. We therefore added the specific categories *unnecessary* and *correct* to every general category (except execution). We also observed that situations occurred where the choice of hypothesis was partly consistent, but did not justify a subsequent action. The specific category *insufficiently consistent* was therefore added to the general category *Choice of hypotheses*.

## 3.1 Report Analyses

A Pareto chart, aiming to identify the incidence distribution of specific categories, was generated using the set of analyzed data for each general category at each step of the Rasmussen model. This information was then used to propose strategies to prevent the causes of failures that accounted for more than 50% of the errors. **Table 4** summarizes the results of the reports analyzed.

<table><caption>**Table 4.** Categorization of failure reports</caption><thead><tr><th>General Category</th><th>Specific Category</th><th>Incidence</th></tr></thead><tbody><tr><td rowspan="7">Observation of system state</td><td>Excessive</td><td>1</td></tr><tr><td>Misinterpretation</td><td>8</td></tr><tr><td>Incorrect</td><td>2</td></tr><tr><td>Incomplete</td><td>11</td></tr><tr><td>Inappropriate</td><td>0</td></tr><tr><td>Absent</td><td>14</td></tr><tr><td>Unnecessary</td><td>1</td></tr><tr><td>Correct</td><td>3</td></tr><tr><td rowspan="7">Choice of hypotheses</td><td>Inconsistent in relation to observation</td><td>6</td></tr><tr><td>Consistent, but less probable</td><td>1</td></tr><tr><td>Consistent, but extremely costly</td><td>0</td></tr><tr><td>Non-pertinent from the viewpoint of functionality</td><td>8</td></tr><tr><td>Absent</td><td>11</td></tr><tr><td>Insufficiently consistent</td><td>10</td></tr><tr><td>Unnecessary</td><td>1</td></tr><tr><td>Correct</td><td>0</td></tr><tr><td rowspan="6">Hypotheses evaluation</td><td>Incomplete</td><td>3</td></tr><tr><td>Acceptance of wrong hypothesis</td><td>21</td></tr><tr><td>Rejection of right hypothesis</td><td>0</td></tr><tr><td>Absent</td><td>11</td></tr><tr><td>Unnecessary</td><td>2</td></tr><tr><td>Correct</td><td>0</td></tr><tr><td rowspan="6">Choice of goal</td><td>Incomplete</td><td>3</td></tr><tr><td>Incorrect</td><td>7</td></tr><tr><td>Superfluous</td><td>0</td></tr><tr><td>Absent</td><td>0</td></tr><tr><td>Unnecessary</td><td>0</td></tr><tr><td>Correct</td><td>26</td></tr></tbody></table>
<table><tbody><tr><td rowspan="6">Choice of procedure</td><td>Incomplete</td><td>9</td></tr><tr><td>Incorrect</td><td>12</td></tr><tr><td>Superfluous</td><td>1</td></tr><tr><td>Absent</td><td>0</td></tr><tr><td>Unnecessary</td><td>0</td></tr><tr><td>Correct</td><td>17</td></tr><tr><td rowspan="10">Execution</td><td>Omission</td><td>5</td></tr><tr><td>Replication</td><td>0</td></tr><tr><td>Inclusion</td><td>0</td></tr><tr><td>Sequence</td><td>3</td></tr><tr><td>Intervention at some inappropriate time</td><td>3</td></tr><tr><td>Incorrect operation position</td><td>0</td></tr><tr><td>Incomplete action</td><td>5</td></tr><tr><td>Unrelated or inappropriate action</td><td>4</td></tr><tr><td>Right action on wrong object</td><td>15</td></tr><tr><td>Unintended action</td><td>2</td></tr><tr><td rowspan="3">Recovery</td><td>Too late</td><td>7</td></tr><tr><td>Late</td><td>6</td></tr><tr><td>Immediate</td><td>15</td></tr><tr><td rowspan="5">Consequences</td><td>Non-interrupted load</td><td>15</td></tr><tr><td>Interrupted load</td><td>19</td></tr><tr><td>Equipment overload</td><td>0</td></tr><tr><td>Loss and damaged of equipment</td><td>0</td></tr><tr><td>Personal damages</td><td>0</td></tr><tr><td rowspan="16">Causes</td><td>Lack of concentration occasioned by haste</td><td>3</td></tr><tr><td>Lack of concentration occasioned by excessive self-confidence</td><td>5</td></tr><tr><td>Lack of concentration</td><td>14</td></tr><tr><td>Hurry</td><td>4</td></tr><tr><td>Stress</td><td>5</td></tr><tr><td>Confusion</td><td>7</td></tr><tr><td>Pressure</td><td>2</td></tr><tr><td>Anxiety</td><td>3</td></tr><tr><td>Improvisation</td><td>5</td></tr><tr><td>Inexperience</td><td>2</td></tr><tr><td>Excessive self-confidence</td><td>11</td></tr><tr><td>Personal problems</td><td>2</td></tr><tr><td>Lack of technical capacity</td><td>5</td></tr><tr><td>Tiredness</td><td>5</td></tr><tr><td>Excessive concentration</td><td>1</td></tr></tbody></table>

From the analysis it was found that 31 out of 35 failures occurred at the stage of Observation of system state (Fig. 2). In three out of 35 reports the Observation of system state (Fig. 2) was correct, failure occurring at some other stage of the decision sequence. 10 out of 35 errors occurred during the choice of goal (Fig. 3). The choice
*of procedure* was correct in 17 out of 35 reports (**Fig. 4**).

<figure><img src="image_3.png" /><figcaption>Fig. 2. Observation of system state stage</figcaption></figure>

<figure><img src="image_4.png" /><figcaption>Fig. 3. Choice of goal stage</figcaption></figure>

<figure><img src="image_5.png" /><figcaption>Fig. 4. Choice of procedure stage</figcaption></figure>

4 Final considerations and future directions

This paper proposes an extension of Rouse & Rouse's error categorization that resulted from the analysis of a *corpus* of 35 reports. It seeks to identify not only the
final error that occurred (e.g. omission, right action on wrong object), but also the
actions taken throughout the sequential decision process.

The extension was based on the taxonomy proposed by Rasmussen et al., on the
error classification by Rouse et al. and on the analysis of a corpus of human error
reports from the operation of an electrical power system.

The extended classification was reapplied in the analysis of the same set of reports
which made it possible to identify situations unobserved using the original (Rouse &
Rouse) error categorization. The analysis results were then projected into Pareto
diagrams to identify the faults accountable for more than 50% of all errors.

For a complete understanding of human error, it is necessary to associate the error
with the sequence of steps taken by the human operator during task performance. We
have three reports in which the observation of the system was correct. Scrutinizing the
decision-making sequence in these reports (Fig. 5), it is clear that there were problems
in the *choice of hypothesis* and *evaluation of the hypothesis*. In two of the reports the
right goal was chosen with the correct procedure being followed. In contrast, in the
third report (R34), the procedure followed was incomplete, possibly leading to
incomplete execution.

Finally we have the recovery, the causes and consequences reported. In R20 an *absence of hypothesis* culminated in an unintended action. A hypothesis inconsistent in relation to an observation in R25 led to right action on wrong object. In R34 we have a hypothesis *insufficiently consistent* leading to an incomplete action.

**Table 5** illustrates the incidence of hits and misses along the decision making
sequence. The relation between the events that culminated in an execution error and
its causes are illustrated in the graph depicted in **Fig. 5**. These relations were extracted
from the analysis of the error reports, excerpts of which are given in **Fig. 5**.

<table><caption>**Table 5.** Excerpts from error reports: R20, R25 and R34</caption>
   <tr>
    <td>
     R.20:
    </td>
    <td>
     “...decided to go to the equipment in order to inspect it. After opening its comand box directed the attention to reading the label fixed on its door. At this point stepd on false and in the attempt to hold on and avoid falling caused the equipment trip.”
    </td>
   </tr>
   <tr>
    <td>
     R25:
    </td>
    <td>
     “... the operator knows the manouvers in detail and had the manouver instructions at hand... when selecting the switch X got confused and selected switch Y, since both were placed on the same chassis”, “self-confidence- simple, standard and routine manouver”, “momentary loss of concentration due to self-confidence”, “incorrect selection of switch to be manouvered”.
    </td>
   </tr>
   <tr>
    <td>
     R34:
    </td>
    <td>
     “Operator’s lack of concentration during manouver execution due to procedure disregard (task considered simple) and manouver execution during working shift exchange”. “Second operator missing resukting in no double checking or follow up”. “Lack of operator concentration... causing incomplete execution of one item in the manouver, agravated by this item’s characteristics which demanded two actions performed in separate places”.
    </td>
   </tr>
  </table>
<figure><img src="image_6.png" /><figcaption>Fig. 5. Human decision sequence of the reports 20, 25 and 34</figcaption></figure>

Although the error categorization extension proposed here focuses on error situations reported during the operation of an electrical power system, the authors expect to address other contexts by adapting the specific categories: recovery, consequences and causes.

The more refined categorization presented here will not prevent the occurrence of errors but will enable to explicit the relations between causes and consequences leading to more effective strategies to prevent the causes that lead into errors.

It may appear to be a long way to relate causes and consequences and from there come to strategies to prevent the errors, but although the gap still remains, this paper tries to narrow it. The authors plan to invest more time into researching the accidents and incidents based upon this taxonomy, uncovering relations between causes and consequences in order to propose more effective error prevention strategies. Given the scope of the problem this could not be dealt within the scope of this paper.
The following future work is proposed:

- To verify the completeness of the extended categorization, analyzing a new set of reports;

- To develop software to facilitate both the analysis of reports and the visualization of the analysis results;

- To associate the proposed categorization to a test usability protocol in order to support the observation and the analysis of the user's behavior during system operation.

**Acknowledgments.** The authors wish to thank the Brazilian government agencies CNPq and CAPES for the financial support to this project as well as the engineers of the electricity company CHESF for their support and collaboration with this work.

## References

1. Cellier, J.M.. L'erreur human dans le travail. In: Leplat, J., De Terssac, G.. Les facteurs humains de la fiabilité dans les systèmes complexes. Marseille. (1990)

2. van Eekhout, J.M., Rouse, W.B.. Human Errors in Detection, Diagnosis, and Compensations for Failures in the Engine Control Room of a Supertanker. In: IEEE Transactions on System, Man, and Cybernetics. Vol. SMC-11, nro 12. Dezembro. (1981)

3. Johnson, W.B., Rouse, W.B.. Analysis and Classification of Human Errors in Troubleshooting Live Aircraft Power Plants. In: IEEE Transactions on System, Man, and Cybernetics. Vol. SMC-12, nro 3. Maio. (1982)

4. Norman, D.A.. Design Rules Based on Analyses of Human Error. In: Denning, P.J. (Eds), Communications of the ACM. pp. 254-258. Vol. 26, Issue 4. April. (1983)

5. Rasmussen, J., Pedersen, O.M., Mancini, G., Carnino, A., Griffon, M., Gagnolet, P.. Classification system for reporting events involving human malfunctions. In: Relatório RISO-M-2240. RISO National Laboratory. Dinamarca. March. (1981)

6. Reason, J.. A framework for classifying errors. In Rasmussen, J., Duncan, K., Leplat, J. (Eds.), New Technology and Human Error. pp. 5-14. John Wiley & Sons Ltd. (1987)

7. Reason, J.. A preliminary classification of mistakes. In Rasmussen, J., Duncan, K., Leplat, J. (Eds.), New Technology and Human Error. pp. 15-22. John Wiley & Sons Ltd. (1987)

8. Reason, J.. Human Error. Cambridge University Press. (1990)

9. Guerrero, C.V.S.. Modelo conceitual de cenários de acidentes causados pelo erro humano em sistemas industriais críticos com foco na concepção de interfaces ergonômicas. Doctoral Thesis. UFCG. (2006)

10. Hollnagel, E., Woods, D.D.. Cognitive systems engineering. New wine in new bottles. International Journal of Man-Machine Studies. (1983)