© 1979-2006 by Ludwig Benner, Jr. .All rights reserved.




for use with


The greatest obstacle to discovering the shape of the earth, the continents and
the oceans was not ignorance, but the illusion of knowledge.

- - - Daniel J. Boorstin

Guidance to help investigators avoid any illusions of knowledge!

This set of Guides was created to help conscientious investigators and analysts improve the efficiency, effectiveness, timeliness and value of their investigation work products. Software to help implement the guidance during investigations is available at http://www.investigationcatalyst.com/

The entire set of documents is copyrighted, and remains the property of the publisher. A copy is furnished free to purchasers of Investigation Catalyst software. Permission for others to download for personal use all or part of this document set is hereby granted to any individual for his or her private, personal use on the condition that they notify the publisher at the address below, and mention in any reproductions of the conent or work products they produce using the concepts, principles and procedures described herein, or adaptations thereof, the following:

"Investigated with MES Technology"

Registered users will be provide notices of updates and other related offers. Reproduction for any other purpose without the express written consent of the Publisher is stealing intellectual property.

Order set G061 10 Guides on line

Contact Starline Software Ltd. for information about using this material for commercial or governmental purposes, or special student arrangements.

© 1979-2005 by Ludwig Benner, Jr.
All rights reserved.

Second Printing 1995 Fourth Printing 2005 Revised through January 24, 2005

Neither this document nor any part may be copied, reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, microfilming, recording, digitizing, or by any information recording, storage or retrieval system, electronic or non-electronic, without permission in writing from the Publisher.

Published by Starline Software Ltd.
12101 Toreador Lane, Oakton, VA 22124 —2217


(Blue text indicates internal links)




MES Foundation
MES System Overview
Reasoning tasks
Investigation Reasoning Tasks
Sequential logic
Cause-effect logic
Deductive logic
Necessary-sufficient logic
Investigation Management
What you can expect
Top 10 Investigation Axioms


Design approach to Guides
Intended use




Guide 1. Developing MES Event Blocks (EB Guide)

Guide 2. Building MES-Based Matrixes (MATRIX Guide)

Guide 3. Using MES Trees (MES-TREE Guide)

Guide 4. Using Change Tracking Method (CTM Guide)

Guide 5. Using Energy Trace & Barrier Analyses (ETBA Guide)

Guide 6. Creating Investigation Test Plans (Test Plan Guide)

Guide 7. Using Time/Loss Analysis (T/LA Guide)


Guide 8. Recommended Action Development (REC Guide)

Guide 9. Management Oversight And Risk Tree (MORT Guide)


Guide 10 Quality Assurance Procedures (QA Guide)

Multilinear Events Sequencing technology implemented in these Guides makes possible a comprehensive proven investigation system for the examination of any kind of phenomenon. It is best mastered through use. Its true power and value can only be observed through its use. The Guides provide practical instruction in its use during investigations, and for other purposes.

Most of these 10 MES INVESTIGATION TASK GUIDES are based on the Multilinear Events Sequencing (MES) Technology. That technology is based on the systematic acquisition, ordering and linking of data about events that occur during specific phenomena. This Edition updates earlier guides to incorporate the latest thinking and experiences with implementation of MES technology in all types of investigations, and the introduction of Investigation Catalyst software to support its learning and use. Updates include

an overview and new information about the MES investigation process here, and a summary of steps at beginning of each Guide.
updated sections on investigation logic tasks, and task knowledge and skill needs.
more links to investigation web sites where supplemental information can be found.
updated guidance about developing descriptions and explanations of what happened, and uses of those descriptions.
updated MES-based Matrix development process to accommodate different types of investigations.
updated Recommended Action Development process tasks for problem or needs discovery, definition and assessment, and selection of needs for action.
upgraded investigation quality assurance task section.
incorporated Investigation Catalyst software references into tasks..


First a word about the foundation on which MES investigations, or the framework within which it occurs. The foundation consists of the underlying concepts and principles on which the MES technology is built.

Every investigation is a process. All investigations involve many common tasks, each task requiring specialized investigation knowledge, skills and methods. Those common tasks, and the knowledge, skills and methods required to perform them, are addressed in these Task Guides. Investigators need to produce valid new information on which individuals and organizations can act to achieve better performance. The procedures are applicable to any kind and level of investigation and analysis seeking better performance.

Occurrences or System Operations to be investigated are also viewed as processes, consisting of people and objects interacting with each other to produce outcomes. Investigations are undertaken to gain an understanding of occurrences or operations by understanding the dynamic interactions that produced the outcomes - how what you see came to be. Once understood, underlying processes can be analyzed, predicted and managed in the future to produce more desirable outcomes more efficiently, more consistently and with less risk.

To gain understanding, investigators must determine what happened and why it happened during the process, or how it works. The methodology they use must provide for consistency and discipline in the documentation of what happened. It must be research definingto help investigators determine what is known, and point investigators toward the data they still need to acquire. It must provide for the timely organization and progressive analysis of new data to show relationships among events as data is acquired. It must show the logical flow of the events to explain why the process progresses. Then it must facilitate problem discovery by offering an orderly way to examine all interactions during the process. It must lead to the ready, clear communication of the process interactions to encourage their use in the greatest variety of ways. These guides help investigators develop, quickly, efficiently and consistently a valid documented description and explanation of what happened or how it works.

The descriptions produced should meet certain minimum criteria. For example, they must be valid representations of what happened. They should be problem defining by enabling the orderly identification and definition of problem interactions from episodic occurrences. They should facilitate the analysis and evaluation of options for changes that might be expected to achieve better process outcomes. They should minimize subjective opinions to reduce potential controversy about the contents.

Developing proposals to make changes is a different type of "investigation" than determining what happened. Problem discovery and definition require understanding and definition of expected interactions, and identification of improvement actions focuses on prediction of future occurrences. Problem discovery and definition builds on valid knowledge of what happened, but also requires process and predictive analytical knowledge, skills and methods. The Guides describe how the two investigations task areas overlap and support each other. The additional knowledge, skills and methods required to meet both challenges are also addressed.

Invalid, incomplete or inconsistent descriptions lead to many unnecessary problems: such as misdirected analyses and actions; waste; conflicts; flawed research and others. Therefore, these Guides include Quality Assurance guidance and procedures for both investigation work products, and for the investigations themselves, to help achieve highly valued work products.

MES System Overview

To help orient users establish reasonable expectations as they peruse the Guides, an overview of the MES Investigation System may be helpful. The system consists of
  • principles and procedures for documenting data acquired during investigations in a timely, consistent, complete and disciplining way.
  • principles and procedures for organizing sequentially and documenting all data acquired during an investigation in real time,
  • timely direction to guide the acquisition of additional data as the investigation progresses.
  • procedures to filter the actions needed to produce the outcome from those that did not contribute.
  • quality assurance procedures for the investigation process and work products.
Reasoning tasks during investigations.

Logical reasoning is indispensable to good investigation outputs. MES requires investigators to use four kinds of logical reasoning during their investigation tasks. They are:
SEQUENTIAL LOGIC - the reasoning process applied to data to organize it into the proper sequence in which actions by people or objects occurred. For example, the investigator must reason whether A happened before B, or B before A by determining the relative timing and spatial logic of the events.

IF-THEN or CAUSE-EFFECT LOGIC - the reasoning process applied, after actions or behaviors have been ordered sequentially, to determine if they are influenced what followed, and to test relevance of new data. If-then or coupled relationships are represented by linking arrows, to show the flow of the interactions. For example, if A occurred during a process, then does it follow that B would occur? If so draw a tentative link from A to B. Some times A led to several other actions (A1, A2 and A3). If so, show this by drawing tentative links ffrom action A to resultant B1, B2, B3 etc. Sometimes several actions (A1, A2 and A3) all led to B draw links from each to B. If you think there may be a relationship but need more data, display a tentative arrow with a ? on it between these actions. The reverse of this reasoning may be applied backwards, from a resultant action to the action(s) that might have proceeded it.

DEDUCTIVE LOGIC - the reasoning process applied to objects to 1) infer events that must have occurred to produce states of objects observed during investigations, and 2) fill gaps in an investigator's understanding of what happened with hypothetical candidate scenarios. By applying natural laws and scientific principles to infer possible specific actions of people or objects that produced the observed state, or to bridge gaps in causal flows between known action, an investigator can pinpoint data which should be sought to verify each assumed scenario. Deductive reasoning may also be used to discover unknowns. Deductive reasoning can utilize reasoning aids such as Investigation Catalyst software, or various kinds of logic trees.

NECESSARY AND SUFFICIENT LOGIC- the reasoning process applied to linked actions, to determine what and only what had to occur to produce a subsequent action or outcome, and to test the completeness of a process description. Must A always occur before B occurs? If so, it remains part of the linked set. Next, determine sufficiency by determining if B will always occur if A and only if A occurs? If so, the investigator has a complete couple relationship. If not, what other actions must occur to produce B with reasonable certainty? N/S logic helps investigators find and define unknown unknowns, or unk-unks.that may not be discovered by other reasoning processes.

Another way to illustrate this reasoning is to use if-them reasoning. "If A occurred, then B had to occurr" describes a complete cause-effect coupling of two actions. "If A, then maybe B" but you need more As (A1, A2. . . ) to produce B, you have to keep adding more A's until all the "If A1 and A2 and A3 then B" describe the EBs it takes to make B happen every time the A's occur.

At the conclusion of necessary and sufficient logic testing, investigators will know what they know and don't know about the occurrence. With that knowledge, they are prepared to report all uncertainties, with an explanation why they could not be resolved.

Each type of logic must be applied with rigor to produce work products that expose uncertainties and eliminate unjustifiable, illogical or biased conclusions by investigators. Additional information about logical reasoning problems and how they can be overcome are found at the Logic and Logic Fallacies pages.

Investigation Management

Investigations consume resources. Resource consumption should be managed to achieve the best attainable efficiency, effectiveness and value. Investigation management is not unlike other management tasks. They include, generally, the

  • definition and establishment of objectives,

      - identifying customers for outputs
      - determining what outputs customers want
      - defining specifications for desired outputs

  • planning work flows to achieve those objectives,

      - selecting a process to produce the outputs
      - defining tasks, cost, schedules required by the process
      - assuring resources to the process
      - defining the process controls needed

  • staffing the work with capable personnel

      - establishing personnel specifications
      - selecting competent personnel
      - preparing personnel for tasks
      - providing needed support
      - ensuring proper staff compensation

  • directing implementation of the planned process

      - assuring supervision of work
      - implementing monitoring plan
      - adapting process to inputs, changes
      - tracking progress

  • ensuring that deliverables achieve desired objectives.

      - verifying specified quality of work products
      - ensuring timely delivery
      - soliciting customer feedback
      - satisfying problems, complaints

The value of an investigation program depends very heavily on its objectives and the process selected to achieve those objectives. Unfortunately, the determination of cause to prevent similar accidents is almost universally the objective. A far more productive and valuable objective is to determine what happened, and why it happened to improve future process performance, for reasons that are discussed in many works (For more, see http://www.starlinesw.com/lbjr/)

The investigation process selection is equally influential on program success. The MES technology is presented because it provides the most efficient, effective process, and outputs of broader, less controversial value to their users. It helps investigators identify relevance as data are acquired, define what data to seek, avoid unnecessary data gathering, and constantly test the emerging scenario. From a management perspective, it helps investigators define and control work flow efficiently and produce concrete logically tested descriptions of the accident process, and it defines needs for changes systematically to increase their effectiveness. All this reduces the cost/benefits ratio of investigator's efforts, compared to the "find the cause" (or causes or root causes), "eliminate all other possibilities" or facts/ analysis/ conclusions approaches

What you can expect

The investigation and analytical processes described in these Guides have been tested and used successfully for many types of investigation tasks over a twenty five year period. Software to implement them has recently been developed, expediting many of the tasks involved, and expanding the capabilities of the process. The process has proven useful for tasks ranging from discovering hazards and risks in new systems to accident and incident investigations, defining systems for analysis, understanding equipment breakdowns, accident research, documenting human performance in mishaps, scenario modeling, crimes, investigation report quality assurance and assessment, fire investigations and development of improved inter-agency emergency procedures. MES has been used to investigate many sizes of incidents from minor near misses to workplace fatalities and catastrophic accidents of nationwide interest.

With the availability of supporting software and its outputs, MES-based process descriptions with their events sets can help improve designs, operational manuals and procedures, monitoring processes, training, and task analyses, and help with litigation support, change assessment and control, data sharing, and other tasks.

Important Investigation Axioms

Axioms can help Investigators during their investigations and analyses of different kinds of occurrences. To view what are probably the Top 10 Axioms, click here, or proceed to Guide 1.


Design approach to Guides

These Task Guides are task oriented, presented in the general sequence needed by Investigators. The contents are compatible with the guidance in the Help Menu of the Investigation Catalyst software, and support the software use.

Guide 1 explains how to develop the building blocks used to describe the process from the many kinds of data sources available. Guide 2 explains how to use the MES Matrix to organize and logic test the building blocks describing and explaining the process. Guide 3 explains how to fill gaps in that may exist in the process descriptions as the investigation progresses. Guide 4 explains how to use change analysis to help develop data for the building blocks. Guide 5 explains the use of energy trace and barrier analysis techniques to find data for the building blocks. Guide 6 explains how to develop a test plan when tests, teardowns or simulations are needed to develop building blocks. Guide 7 explains how to use a Time/Loss Analysis method for evaluating responses to emergencies. Guide 8 explains how to analyze the process descriptions to develop problem statements and options for improving future performance. Guide 9 explains the use of MORT tools to assist in the analysis of descriptions. Guide 10 explains how to assure the quality of investigations and investigation work products.

Intended use

The Guides were designed to be suitable for

  • self-study,

  • classroom training support,

  • reference during investigations,

  • assessing quality of work products produced with other investigation and

  • to help design investigation programs.

Used properly the MES process can serve you well. View Guides 1-10 next.

Go to Guide: 0 1 2 3 4 5 6 7 8 9 10

Contact Starline

Starline Software Ltd. Home Page