Chapter 1. What Is Mistake-Proofing?
The process of turning on a burner on a stove is a simple one. It is an everyday task that most people have performed hundreds of times. Have you ever turned on the wrong burner? Have you ever gone from one room to another in your house only to forget why you went there in the first place? Have you ever put something in the refrigerator that belonged in the cupboard?
Patients should experience health care processes that are more reliable than manufacturing processes. Regrettably,
that is not yet the case.1
These are common errors. Their consequences are usually not very serious. Once you have made these errors, what can you do to ensure that they never happen again? Are willpower and determination enough to avoid them? If one believes that "to err is human," then the answer to these questions is, "No." People who make these errors are not unmotivated or negligent. More importantly, they cannot eliminate the errors simply by telling themselves to do better and deciding not to commit them. The Joint Commission on Accreditation of Healthcare Organizations (JCAHO)2 adds that "it assumes that no matter how knowledgeable or careful people are, errors will occur in some situations and may even be likely to occur."
If executed correctly, many of the tasks that medical professionals perform as part of their jobs offer the potential to heal. The same tasks performed incorrectly, however, can also contribute to harming patients.
Clinicians need to become comfortable performing a wide variety of tasks, some of which are not very different from those performed in everyday life. If the infusion pump does not behave the way a nurse intended it to because the wrong control was adjusted, is the cause of the error really much different from turning on the wrong burner on the stove? The main difference between health care errors and errors in everyday life is that errors that occur in a health care setting can result in serious harm or death.
Whether outcomes are insignificant or life threatening, one question remains to be asked: "What can be done to reduce or eliminate errors and their negative consequences?" Part of the answer, mistake-proofing, is the focus of this book. No single tool can solve every problem; often, the answer will lie in the discovery, implementation, and execution of several tools. Croteau and Schyve3 state that "techniques for designing safe processes are known, waiting only to be adapted to health care." Mistake-proofing is one of these techniques; it is a crucial addition to the tools employed to improve patient safety.
Return to Contents
Mistake-proofing is the use of process or design features to prevent errors or the negative impact of errors. Mistake-proofing is also known as poka-yoke (pronounced pokayokay), Japanese slang for "avoiding inadvertent errors." Shigeo Shingo4 formalized mistake-proofing as part of his contribution to the production system for Toyota automobiles. There are substantial differences between automotive manufacturing and health care operations, yet at least a few health care organizations are beginning to incorporate aspects of the Toyota production system into their efforts to reduce medical errors.5-8
Shingo,4 Hinckley,9 and other authors of books on
manufacturing11 include many examples of mistake-proofing
that can be adapted to health care settings, some
of which are included in this book. The examples are
intended to serve as as a catalog of solutions that can be
directly implemented to reduce the number of errors and
as a catalyst for creating new ways to think about
mitigating human error. The approaches taken in the
examples can be modified to fit specific situations.
The 3.5-inch diskette is an example of mistake-proofing.
The diskette can only be inserted if it is oriented correctly.
It cannot be inserted sideways because it is not square; the
sides are too long to fit. It cannot be inserted backwards or
inverted. The drive is designed to stop the diskette unless
the right front corner is chamfered (angled) (Figure 1.1).
When the disk is inserted correctly, the mistake-proofing
device is not noticeable. When it is inserted incorrectly,
however, the device completely stops the process. The only
cost is that of initial design implementation. No user
training is required. The members of the design team that
created the disk drive believed that getting the orientation
right was important enough to design a process that
allowed users only one way to use the device. Their
decision also indicates a preference for using design as an
error-prevention strategy instead of alternatives such as
training, instructions, or warning labels.
Mistake-proofing has even been applied to yo-yos. Most
yo-yo tricks require that the yo-yo spin freely or "sleep" at
the end of its string. The common (and dreaded) human
error that occurs while one is doing tricks with a yo-yo is
that of failing to snap the yo-yo up while it still has
enough spin to make it back up to the top. The yo-yo
shown in Figure 1.2 has been equipped with a clutch that
reduces the level of expertise and attention to detail
needed to execute tricks.
On either side of the axle is a jaw
that is held in position by a post on one end and a spring
in the middle. On the far end of the jaw is a round
weight. As the yo-yo spins, the centrifugal force of the
weights pushes out against the springs, allowing the jaw to
disengage from the axle, and causing the yo-yo to "sleep."
When the rate of spin slows, the jaws come back into
contact with the axle, and the yo-yo automatically stops
sleeping. The spring and the weight in the jaws are
engineered to provide just enough spin to propel the yo-yo
back up to the user's hand.
Tons of paper are stored in file cabinets. If more than one
file drawer is opened at a time, the center of gravity might
move forward enough to cause the file cabinet to fall on
the user. Modern file cabinets are designed to avoid this
type of injury (Figure 1.3). Opening one drawer locks the
rest. The design facilitates (perhaps even forces) correct
behavior and only allows for proper use.
If engineers found it worthwhile to reduce human error
in performing yo-yo tricks, wouldn't it be worthwhile to
focus similar attention on the more consequential errors
of health care?
History of Mistake-Proofing
Although it was formalized by Japanese manufacturers in
the 1960s (and published in English in the 1980s),
mistake-proofing did not start in Japan and its utility was
not limited to factories. Inventors, designers, and problem
solvers led by common sense implemented mistake-proofing devices long before the 1960s. The question of
which mistake-proofing device appeared first remains
unanswered. However, an example of mistake-proofing
from 1853 disproves that mistake-proofing first appeared
in the 1960s.
The device was the Otis elevator brake. At the Crystal
Palace Exposition of 1853 in New York, Elisha Otis rode
an elevator above the crowd and had an assistant cut the
cable. The elevator brake stopped the elevator and Otis
from falling (Figure 1.4). Examples from everyday life
such as this one and others demonstrate that the
usefulness of mistake-proofing is not limited to
Disk drive, yo-yo, and file cabinet designers were able to
design processes that reduced or eliminated certain errors.
Medical organizations should incorporate these safety
considerations in their processes more often.
Return to Contents
A Review of Human Error
A brief review of the concepts and language of human
error will be useful. Human error has been studied
extensively by cognitive psychologists. Their findings
provide concepts and language that are vital to this
Errors of Intent vs. Errors in Execution
The process humans use to take action has been described
in several ways. One description divides the process into
two distinct steps:
- Determining the intent of the action.
- Executing the action based on that intention.
Failure in either step can cause an error.
errors into two categories, mistakes and slips. Mistakes are
errors resulting from deliberations that lead to the wrong
intention. Slips occur when the intent is correct, but the
execution of the action does not occur as intended.
Generally, mistake-proofing requires that the correct
intention be known well before the action actually occurs.
Otherwise, process design features that prevent errors in
the action could not be put in place. This means that
Shingo's4 concept of mistake-proofing is more effective on
slips than on mistakes. Norman's definition14 of the term
mistake is more precise and narrower than the common
usage of the word.a
Rasmussen14 and Reason15 divide errors into three types,
based on how the brain controls actions. They identify
skill-based, rule-based, and knowledge-based actions.
Their theory is that the brain minimizes effort by
switching among different levels of control, depending on
Common activities in routine situations are handled using
skill-based actions, which operate with little conscious
intervention. These are actions that are done on "autopilot."
Skill-based actions allow you to focus on the
creativity of cooking rather than the mechanics of how to
turn on the stove. Errors that occur at the skill-based level
are comparable to Norman's concept of slips.
Rule-based actions utilize stored rules about how to
respond to situations that have been previously
encountered. When a pot boils over, the response does not
require protracted deliberations to determine what to do.
You remove the pot from the heat and lower the
temperature setting before returning the pot to the burner.
When novel situations arise, conscious problem solving
and deliberation are required. The result is knowledge-based
actions. Knowledge-based actions are those actions
that use the process of logical deduction to determine
what to do on the basis of theoretical knowledge. Every
skill- and rule-based action was a knowledge-based action
at one time. Suppose you turn a burner on high but it
does not heat up. That is unusual. You immediately start
to troubleshoot by checking rule-based contingencies.
When these efforts fail, you engage in knowledge-based
problem solving and contingency planning. Substantial
cognitive effort is involved.
a. Andrew P. Dillon translated Shingo's book. His selection of the
term "mistake" might have been different had he read Norman.13
Perhaps it would now be referred to as "slip-proofing." However,
since the term mistake-proofing is common, no attempt is made
to alter that terminology here.
Knowledge in the Head vs. knowledge in the World
Norman13 introduces two additional concepts that will be
employed throughout this book. He divides knowledge
into two categories:
- Knowledge in the head is information contained in
human memory (Figure 1.5).
- Knowledge in the world is information provided as
part of the environment in which a task is performed
Historically, medicine has focused on improving
knowledge in the head. A comprehensive and elaborate
mental model of physiology is an example of knowledge in
the head. A significant infrastructure has been developed
to support this dependence on memory, including lengthy
standard operating procedures that indicate how tasks are
to be performed. These procedures are not intended to be
consulted during the actual performance of the task, but
rather to be committed to memory for later recall.
Retaining large volumes of instructions in memory so that
they are ready for use requires significant ongoing training
efforts. When adverse events occur in health care,
organizational responses also tend to involve attempts to
change what is in the memory of the health care worker.
These include retraining the worker who errs, certifying
(i.e., testing) workers regularly, attempting to enhance and
manage worker attentiveness, and altering standard
operating procedures. The passage of time will erase any
gains made once the efforts to change memory are
The traditional approach... was to stress the
responsibility of the individual... the way to eliminate
adverse events is to get individual clinicians to perfect
Putting "knowledge in the world" is an attractive
alternative to trying to force more knowledge into the
head. Knowledge can be put in the world by providing
cues about what to do. This is accomplished by
embedding the details of correct actions into the physical
attributes of the process. In health care, for example,
mental energies that were used to generate precise action
and monitor compliance with procedures stored in
memory are now freed to focus on those critical, non-routine
deliberations required for the best possible patient
How do you recognize knowledge in the world when you
see it? Here is a crude rule of thumb: if you can't take a
picture of it in use, it probably is not knowledge in the
world. Mistake-proofing involves changing the physical
attributes of a process, and mistake-proofing devices can
usually be photographed. Mistake-proofing is one way of
putting knowledge in the world.
The rule is crude because there are gray areas, such as
work instructions. If the instructions are visible and
comprehensible at the point in the process where they are
used, then they would probably be classified as knowledge
in the world. Otherwise, work instructions are a means of
creating knowledge in the head.
Return to Contents
There is no comprehensive typology of mistake-proofing.
The approaches to error reduction are diverse and
evolving. More innovative approaches will evolve, and
more categories will follow as more organizations and
individuals think carefully about mistake-proofing their
processes. Tsuda17 lists four approaches to mistake-proofing:
- Mistake prevention in the work environment.
- Mistake detection (Shingo's informative inspection).
- Mistake prevention (Shingo's source inspection).
- Preventing the influence of mistakes.
Each of these four approaches is discussed in more detail
below. Additional information about the basics of mistake-proofing
and other typologies is available.4,9,10,16,18
Tsuda's approaches are similar to those recommended by
the Department of Health and the Design Council19 in
- Prevent user error from occurring.
- Alert users to possible dangers.
- Reduce the effect of user errors.
Mistake Prevention in the Work Environment
This approach involves reducing complexity, ambiguity,
vagueness, and uncertainty in the workplace. An example
from Tsuda17 is having only one set of instructions visible
in a notebook rather than having two sets appear on facing
pages. When only one set of instructions is provided,
workers are unable to accidentally read inappropriate or
incorrect instructions from the facing page.
In another example, similar items with right-hand and
left-hand orientations can sometimes lead to wrong-side
errors. If the design can be altered and made symmetrical,
no wrong-side errors can occur; whether the part is
mounted on the left or right side, it is always correct. The
orientation of the part becomes inconsequential. Likewise,
any simplification of the process that leads to the
elimination of process steps ensures that none of the errors
associated with that step can ever occur again.
Norman13 suggests several process design principles that
make errors less likely. He recommends avoiding wide and
deep task structures. The term "wide structures" means
that there are lots of alternatives for a given choice, while
"deep structures" means that the process requires a long
series of choices. Humans can perform either moderately
broad or moderately deep task structures relatively well.
Humans have more difficulty if tasks are both moderately
broad and moderately deep, meaning there are lots of
alternatives for each choice, and many choices to be made.
Task structures that are very broad or very deep can also
cause difficulties. More of Norman's recommendations are
summarized in Table 1.1.
Table 1.1 Summary of Norman's13 strategies for putting knowledge in the world
||Design one-to-one physical correspondence (Figure 1.8) between the arrangement of controls and the objects being controlled.
||Provide guidance about the operation of an object by providing features that allow or afford certain actions.
||Make observation of the relevant parts of the system possible.
||Give each action an immediate and obvious effect.
||Provide design features that either compel or exclude certain actions.
Constraints may be physical, semantic, cultural, or logical in nature.
Another method of mistake prevention in the work
environment is the implementation of "visual systems,"19
also known as 5Ss (Figure 1.7). The term comes from
Japanese manufacturing, in which the 5Ss are Seiri
(organization), Seiton (orderliness), Seisou (cleanliness),
Seiketsu (standardization), and Shitsuke (discipline).
Visual systems involve sharing information in the work
environment visually. Individuals in the work environment
should be able to "know by looking."20 A visual workplace
is "a work environment that is self-ordering, self-regulating,
and self-improving—where what is supposed to
happen does happen, on time, every time, day or night—because of visual devices."21
- Seiri (organization) focuses on removing unneeded items
from the workplace. Items that are actually used all the
time are sorted from those that are superfluous. Unneeded
items are tagged and removed to a holding area to await
alternate allocation or disposal.
- Seiton (orderliness) involves arranging needed items so
that they are easy to find, use, and put away. Often, the
focus of these efforts is to minimize motion.
- Seisou (cleanliness) involves making sure that the
workplace is clean and stays clean on a daily basis.
Galsworth20 emphatically states, "It's not about being
clean." Rather, it is about creating an environment that
can effectively contain and communicate information.
This step reduces the visual "noise" that would impede
- Seiketsu (standardization) focuses on maintaining and
institutionalizing organization, orderliness, and
cleanliness. It includes preventive steps that reduce the
effort required to maintain the improvements already
- Shitsuke (discipline) involves avoiding a return to the
comfortable behavior of the past. It focuses on aligning
the culture and habits of the organization with its new
approach to organizing work.
Figure 1.9 shows a series of before and after photos of
5S implementations at a large urban hospital. The
photos illustrate how dramatic changes in the
environment can encourage the addition of more
knowledge in the world.
Note that there are fringe benefits to the 5Ss (in
addition to patient safety): Sometimes the unneeded
items found while implementing 5S are still valuable.
Cleaning two rooms as shown in Figure 1.9 yielded the
- $1,600 in hoses (four hoses @ $400 each).
- $1,000 OSI cart.
- $500 case cart table.
- $1,000 in numerous rigid containers.
- $4,100 Total.
The reduction in clutter also reduced the time spent
moving and searching for items by an estimated 156
person hours per year.
Mistake detection identifies process errors found by
inspecting the process after actions have been taken.
Often, immediate notification that a mistake has
occurred is sufficient to allow remedial actions to be
taken in order to avoid harm. Shingo called this type of
inspection informative inspection.5 The outcome or
effect of the problem is inspected after an incorrect
action or an omission has occurred. Informative
inspection can also be used to reduce the occurrence of
incorrect actions. This can be accomplished by using
data acquired from the inspection to control the process
and inform mistake prevention efforts. Another
informative inspection technique is Statistical Process
Control (SPC). SPC is a set of methods that uses
statistical tools to detect if the observed process is being
SPC is used widely in industry to create and maintain
the consistency of variables that characterize a process.
Shingo5 identifies two other informative inspection
techniques: successive checks and self-checks. Successive
checks consist of inspections of previous steps as part of
the process. Self-checks employ mistake-proofing devices
to allow workers to assess the quality of their own work.
Self-checks and successive checks differ only in who
performs the inspection. Self-checks are preferred to
successive checks because feedback is more rapid.
Whether mistake prevention or mistake detection is
selected as the driving mechanism in a specific
application, a setting function must be selected. A
setting function is the mechanism for determining that
an error is about to occur (prevention) or has occurred
(detection). It differentiates between safe, accurate
conditions and unsafe, inaccurate ones. The more
precise the differentiation, the more effective the
mistake-proofing can be. Chase and Stewart19 identify
four setting functions that are described in Table 1.2.
Table 1.2. Setting functions
|Physical (Shingo's contact)
||Checks to ensure the physical attributes of the product or process are
correct and error-free.
|Sequencing (Shingo's motion step)
||Checks the precedence relationship of the process to ensure that steps
are conducted in the correct order.
|Grouping or Counting
(Shingo's fixed value methods)
|Facilitates checking that matched sets of resources are available when
needed or that the correct number of repetitions has occurred.
||Determines and ensures that information required in the process is
available at the correct time and place and that it stands out against
a noisy background.
Control functions. Once the setting function
determines that an error has occurred or is going to occur,
a control function (or regulatory function) must be
utilized to indicate to the user that something has gone
awry. Table 1.3 describes four categories of control
functions for detecting and preventing mistakes.22 Table 1.4 shows medical examples for each cell described in
Not all mistake-proofing is equally useful. Usually, mistake
prevention is preferred to mistake detection. Similarly,
forced control, shutdown, warning, and sensory alert are
preferred, in that order. The preferred devices tend to be
those that are the strongest and require the least attention
and the least discretionary behavior by users.
Table 1.3. Control (or regulatory) functions
||Mistake prevention ||Mistake detection
||Physical shape and size of object or
electronic controls detect mistakes that
being made and stop them from resulting
in incorrect actions or omissions.||Physical shape and size of object or electronic controls detect incorrect actions or omissions before they can cause harm.|
||The process is stopped before mistakes can
result in incorrect actions or omissions.|| The process is stopped immediately after
an incorrect action or omission is detected.|
||A visual or audible warning signal is given
that a mistake or omission is about to occur.
Although the error is signaled, the process
is allowed to continue.||A visual or audible warning signal is given that a mistaken action or omission has just occurred.|
||A sensory cue signals that a mistake is
about to be acted upon or an omission
made. The cue may be audible, visible,
or tactile. Taste and smell have not proved
to be as useful. Sensory alerts signal
mistakes but allow the process to continue.||A sensory cue signals that a mistake has just been acted upon or an omission has just occurred (Figure 1.10).|
Mistake prevention identifies process errors found by
inspecting the process before taking actions that would
result in harm. The word "inspection" as it is used here is
broadly defined. The inspection could be accomplished by
physical or electronic means without human involvement.
The 3.5-inch disk drive is an example of a simple
inspection technique that does not involve a person
making a significant judgment about the process. Rather,
the person executes a process and the process performs an
inspection by design and prevents an error from being
Shingo5 called this type of inspection "source
inspection." The source or cause of the problem is
inspected before the effect—an incorrect action or an
omission—can actually occur. Donald Norman's concept
of forcing functions13 is also included in mistake
prevention. He calls them forcing functions because they
are designed to force, or ensure, that correct actions occur.
Preventing the Influence of Mistakes
Preventing the influence of mistakes means designing
processes so that the impact of errors is reduced or
eliminated. This can be accomplished by facilitating
correction or by decoupling processes.
Facilitating correction. This could include finding easy
and immediate ways of allowing workers to reverse the
errors they commit. While doing things right the first time
is still the goal, effortless error corrections can often be
nearly as good as not committing errors at all. This can be
accomplished through planned responses to error or the
immediate reworking of processes. Typewriters have joined
mimeograph machines and buggy whips as obsolete
technology because typing errors are so much more easily
corrected on a computer. Errors that once required
retyping an entire page can now be corrected with two
keystrokes. Software that offers "undo" and "redo"
capabilities also facilitates the correction of errors (Figure 1.11). Informal polls suggest that people use these features
extensively. Some users even become upset when they
cannot "undo" more than a few of their previous
operations. Also, computers now auto-correct errors like
These features significantly increase the effectiveness of
users. They did not come into being accidentally but are
the result of intentional, purposeful design efforts based
on an understanding of the errors that users are likely to
Automotive safety has been enhanced by preventing the
influence of mistakes. Air bags do not stop accidents.
Rather, they are designed to minimize injuries experienced
in an accident. Antilock brakes also prevent the influence
of mistakes by turning a common driving error into the
correct action. Prior to the invention of antilock brakes,
drivers were instructed not to follow their instincts and
slam on the brakes in emergencies. To do so would
increase the stopping distance and cause accidents due to
driver error. Pumping the brakes was the recommended
procedure. With anti-lock brakes, drivers who follow their
instincts and slam on the brakes are following the
recommended emergency braking procedure. What once
was an error has become the correct action.
"Decoupling" means separating an error-prone activity
from the point at which the error becomes irreversible.
Software developers try to help users avoid deleting files
they may want later by decoupling. Pressing the delete
button on an unwanted E-mail or computer file does not
actually delete it. The software merely moves it to another
folder named "deleted items," "trash can," or "recycling
bin." If you have ever retrieved an item that was previously
"deleted," you are the beneficiary of decoupling. Regrettably, this type of protection is not yet available
when saving work. The files can be overwritten, and the
only warning may be a dialogue box asking, "Are you
Sometimes the separation of the error from the outcome
need not be large. Stewart and Grout25 suggest a
decoupling feature for telephoning across time zones.
The first outward manifestation of forgetting or
miscalculating the time difference is the bleary eyed
voice of a former friend at 4:00 a.m. local time instead
of the expected cheery voice at a local time of 10:00
a.m. One way to decouple the chain would be to
provide an electronic voice that tells the caller the
current time in the location being called. This allows
the caller to hang up the phone prior to being
connected and thus avoid the mistake.
Customer and provider mistake-proofing. Chase and
Stewart26 point out that in service operations, as opposed
to manufacturing, mistake-proofing is needed for both the
person providing the service and the person receiving the
service. They assert that "one-third of customer complaints
relate to problems caused by the customers themselves." In
health care, this means that mistake-proofing that helps
the health care professional perform tasks correctly is not
enough. Chase and Stewart26 divide the mistake-proofing
of both providers' efforts and customers' actions into
three categories each. As shown in Table 1.5, the
categories for providers are task, treatment, and tangibles;
the categories for customers are preparation, encounter,
Table 1.5. Areas of focus for service provider and
||Doing work incorrectly, not
requested, wrong order, too slowly. |
||Lack of courteous, professional
||Errors in physical elements of service. |
||Failure to bring necessary materials,
understand role, or engage correct
||Inattention, misunderstanding, or
memory lapses. |
||Failure to signal service failure, provide
feedback, or learn what to expect. |
Preparation for mistake-proofing. Patients should know
the location of their charts so home health workers can
consult the charts to ensure the care they are planning to
provide is correct and appropriate. The patient error lies
in not keeping the chart accessible. It takes only a few
moments for the chart to be covered with clutter (Figure 1.12).
The "solution" presented in Figure 1.12 is not "strong
mistake-proofing." A patient would not be prohibited
from moving the chart to a good hiding place. However,
in actual practice the solution improves safety and
productivity. (For a detailed description, go to Chapter 7,
Return to Contents
Proceed to Next Section