Two Controls, One Weak Point: Trace the Shared Dependency

Human Performance weekly series: lesson 48 of 52.

A 5–10 minute crew discussion, plus time to verify the actual controls. The crew talk and Word version are public. Separate supervisor and attendance records are included with free Safety & Systems membership.

Why this matters

Two controls can look separate while relying on the same input or person. Counting them does not establish separate protection. Trace their needs and flag shared dependencies for review before relying on them.

Learning objective

Identify a possible shared dependency and obtain qualified assessment without defeating or testing safeguards.

Key hazards or failure points

Two displays fed by one source; two checks repeating one assumption; shared support overlooked; a backup unavailable for the same reason as the primary; unauthorized testing to prove independence.

Practical controls

• Choose two controls in the approved task plan and describe the protective function of each. Identify the information, equipment, support and assigned roles they rely on. Keep uncertain connections marked as unknown.
• Use current approved documentation and the responsible technical person to assess a suspected dependency. Do not calculate reliability or declare independence from a crew sketch. A shared input needs assessment; it does not automatically prove failure.
• Maintain all required protection while questions are reviewed. Have any revised arrangement approved, implemented and checked through the governing process. Tell affected workers what restrictions remain and what changes require another review.

Verify It in the Field

• On paper, trace each selected control to its documented input or supporting arrangement. Record the exact document and revision. Ask what single missing input might affect both; distinguish a documented connection from a question requiring technical confirmation.
• Compare permitted visible identifiers and current records with the documents from an authorized safe position. Do not open equipment, disconnect supplies, suppress warnings or create a failure. Record the actual finding, reviewer and time; route discrepancies to the responsible authority.
• Review the authorized disposition with the crew. If a change is required, have designated people perform the prescribed checks against the applicable criteria and record actual results. Confirm restrictions and required release; two signatures or matching readings alone do not demonstrate separate protection.

Stop and reassess

Hold affected reliance when a required control is unavailable, its basis is unknown or a discovered dependency challenges the approved protection. Follow the task’s safe-state process and seek the required review. Never remove one safeguard to see whether another catches the problem.

Crew discussion questions

• What does each control depend on to work?
• Which shared input is confirmed, and which remains uncertain?
• Who can assess the dependency and approve any change?

For each required control, record its acceptance source and criterion, safe verification method, responsible checker, actual result and time. Use VERIFIED, HOLD/NOT VERIFIED, or N/A with a reason. A tick alone is not evidence. Complete all applicable task inspections; do not enter danger or improvise a test to fill out a form.

Leader preparation and practical detail

Different displays can repeat the same information

Illustrative situation: a plan treats two visible status displays as separate confirmations. Current approved documentation shows that both receive information from the same source. The crew records the connection and asks the responsible technical authority whether the planned protection remains adequate. Do not infer the underlying design from appearances or disconnect anything to test the hypothesis. Some shared arrangements may be acceptable under the governing design; that determination needs the applicable expertise and criteria.

Two people can share one unchecked assumption

Illustrative situation: both checks begin from the same outdated work list, so both people select the same wrong item. The concern is the common starting information, not simply whether there were two signatures. Establish the current controlled source and have discrepancies resolved under the required process. Independent Verification explains separation of judgment and preservation of an as-found condition. This lesson asks what the controls themselves rely on, including information upstream of either checker.

A paper map is a question for review, not a reliability model

The exercise makes dependencies visible without assigning failure probabilities or prescribing redundant equipment. Technical reviewers may require design information, manufacturer instructions, inspection evidence or a specialist assessment before accepting an arrangement. Any physical verification remains within an approved safe method performed by the required people. The archive’s numerical reliability diagram and universal wording about independence are excluded. This resource neither certifies a safety system nor authorizes a crew to redesign it.

Short supervisor field check

• Each selected control has a defined protective function.
• Dependencies traced to current approved information; uncertainties marked.
• Actual identifiers or records compared without equipment manipulation.
• Responsible technical authority evaluates significance and restrictions.
• Approved changes have required verification evidence and release.

Confirm the relevant trained/authorized people, unresolved items, interim protection, correction owner and recheck. Record required release authority and rebrief anyone affected. The separate sheet supports these records; it does not replace a specialist inspection, permit or engineering determination.

Attendance and follow-through

Use the separate attendance sheet for participants, roles, discussion concerns, actions and late-arrival rebriefs. Attendance is not proof of competence, functioning controls or authorization to work. Keep completed records private under employer procedures.

Source acknowledgment

This resource draws on the U.S. Department of Energy’s DOE-HDBK-1028-2009, Human Performance Improvement Handbook, Volume 1 (June 2009). Todd Jerome Jenkins makes no claim of authorship or copyright ownership in the original U.S. Government work. New explanations, examples, exercises and layouts are Todd Jerome Jenkins adaptations. No endorsement by DOE or the U.S. Government is implied. Third-party material credited in the handbook remains attributed to its source; this notice does not claim rights in that material.

Source excerpt: Volume 1/VOLUME 1 CHAPTER 2-REDUCING ERROR.pdf; Printed pp. 2-11, 2-12. The June 2009 handbook supplies concepts; this lesson uses original explanations and exercises.

Technical scope and references

References reviewed October 9, 2026. DOE human-performance tools and OSHA recommended practices support preparation and discussion; they do not establish universal technical acceptance criteria. Apply the current task procedure, manufacturer instructions, permit and required competent or qualified decisions. A successful exercise does not replace required training, technical verification or work authorization.

1. DOE-HDBK-1028-2009, Volume 1 — Chapter 2, printed pp. 2-11–2-12 — June 2009 conceptual discussion of dependency and checks. Reliability calculations, diagram and categorical independence claims excluded.
2. OSHA — Hazard Prevention and Control — Recommended practices on selecting effective combinations of controls, consulting expertise and verifying implementation. Does not establish system independence or a redundancy requirement.

Connect this discussion to your JHA/JSA

Use the JHA/JSA planning and field-verification worksheet to record the actual task steps, hazards, responsible roles and controls. No task-specific worked example is linked for this topic yet. Return to What Changed Today? when the plan or conditions change.

Related Todd Jerome Jenkins articles: How to Conduct a Job Safety Analysis and What Is Human and Organizational Performance?.

Related crew discussions

• Independent Verification: Confirm Without Being Led
• What Does This Control Actually Do?

Continue the weekly series

• Lesson 47: Competing Assignments: Agree What Comes First
• Lesson 49: What Does This Control Actually Do?

Put one check into practice

Use the free JHA/JSA planning and field-verification worksheet to record today’s change, the required protection and the evidence needed before exposure.