© 1979-2003 by Ludwig Benner, Jr. .All rights reserved.

Guide 1


For Use During MES-Based Investigations

Table of Contents

Blue text indicates clickable links in the version posted at the www.starlinesw.com Web site.

Go to Guide: 0 1 2 3 4 5 6 7 8 9 10


An investigator's initial challenge is to acquire and transform observed investigation data into the building blocks needed to develop investigation work products. This documentation challenge generally stated is to:

  1. Observe and list by specific name the people and objects (actors) whose actions during the occurrence resulted in the outcome of interest.
  2. Determine what each actor did during the occurrence.
  3. Record each action advancing the process toward its outcome as a building block in a format suitable for defining, analyzing and describing the progressive interactions that occurred.
  4. Document and preserve the sources of the recorded building blocks.

Procedures for this task are contained in this Guide. They cover manual and software-supported procedures.


The Multilinear Events Sequencing (MES) technology -based investigation process is a universally applicable body of investigation concepts, principles and procedures. It enables an investigator to develop and document an understanding, description and explanation of a phenomenon. It can also help define, plan and evaluate future activities.

One fundamental component of the MES process is the data structure on which all other elements rest. This data structure is defined by the Event Building Block (EB). An Event Building Block is defined as one action by one person or object.

1 actor + 1 action = 1 Event Building Block.

Investigators use EBs to document observed or reported data, organize those data, and document data sources efficiently and systematically. They allow investigators to define unknowns and "unknown unknowns" in real time, helping them focus on remaining data needs. Completed EBs enable investigators to develop descriptions and explanations of actions and interactions that actually happened. They next help investigators to methodically define problems or needed changes after the phenomenon has been described.

Actions by and interactions among people or objects produce changes during a phenomenon. Actions bring about changed conditions, or other subsequent actions. These actions are defined as events for our purposes. The MES investigation process focuses on events - actions by some object or person that initiated successive changes in someone or something. It uses conditions of people or objects to infer the events that produced them. The process stimulates investigators to find the change-makers and what each did to produce the outcome. This Guide describes the documentation and quality control procedures for developing EBs. Use of the EBs is described in detail in the subsequent guides.


Another challenge for investigators is to document their work with the proper words. Investigators must transform their observations into concrete words that permit readers of their words to visualize what happened. They must use words that readers can "see" rather than abstract words that blur their vision. For example, Hayakawa in his book "Language in Thought and Action" points out that an object can be described at various levels of abstraction. His "ladder of abstraction" shows how a specific object, Bessie the Cow, can be described with increasing levels of abstraction, from Bessie - an object we can see and touch - to the word "cow" which is a category into which Bessie fits, but does not help enable one to visualize the specific Bessie. Using increasingly generalized words such as hoofed species to mammal to animal to living creature he moves up the ladder of abstraction. Each higher level further impedes the ability to visualize the specific Bessie, which is necessary to understand what happened. Recognition that investigators must work at the bottom of the ladder - the most concrete words - to develop their descriptions of occurrences is essential to all that follows.

EBs, with their single actor and single action structure, help investigators to cast acquired data into this necessary form. This is part of the basic knowledge required to do MES-based or any other investigations.


Investigators investigate processes that produce outcomes of interest. For investigation purposes, an understanding of any process and its outcome(s) must begin with an awareness that a process consists of interacting components working together to produce the outcome. The MES technology uses the following model to illustrate what a process is, for investigation purposes.


The process outcome is driven by actions of people or objects which change other process components to produce the outcome of interest.

The investigator's challenge is determining who or what did what to produce the outcome of interest, and document that understanding to communicate it to others.

To meet this challenge, the investigator must first transform data from all sources into words that clearly define the actor that changed something, what that actor did. Those sources can vary widely in their origin, nature, structure and content, Figure 1-2 describes the kinds of input data an investigator has to process, for example, in an accident or fire investigation.

Figure 1-2. Investigators' Data Transformation Challenge


(c) 1993 by Helen Benner. Reproduced by permission

All data acquired by the investigator must be processed to transform it into the data language required to describe the occurrence. This skill is basic to every investigation task that follows. Now for the details.


The objective of this Guide 1 is to describe the procedures investigators can use to produce the basic building blocks needed to describe and explain phenomena.


Any observations or data about what happened acquired during an investigation can be transformed into EBs.


Data required during investigations is defined by the EB format: actors and actions. The procedure can use any observed or recorded data about actors or actions from any source. It can accommodate direct observations by an investigator, reported observations or data provided by animate or inanimate "observers" of the occurrence, and logical reasoning based on knowledge of how something actually functions or was intended to function. When EBs are organized, they help define actors or actions still required by the investigator. See Guide 2 for information about actor/action matrix development and identification of data needs.


To implement the basic investigation data language demands, each EB must be in a specific and consistent format, contain common minimum elements, and satisfy prescribed quality standards. The format and elements are shown in Figure1-3.

Figure 1-3. Basic EB Elements


Time Source


+ descriptor/object(s)


These are the common minimum elements of the investigator's building blocks. They are called EBs rather than events, because the term "event" is so ubiquitous that its general usage usually results in undisciplined descriptions, ambiguity, logic errors and controversy.

ACTOR is anyone or anything that initiates a change of state during the process required to produce the outcome achieved. An actor has only one name. Ambiguous, duplicate, compound or plural names are absolutely, positively unacceptable. NEVER BREAK THIS RULE.

ACTION is one specific act by one specific actor which affected another actor. Investigators focus on actions that helped initiate or sustain the process which produced the outcome. If difficulties arise while defining the act of an actor with a single verb, divide the action into more action verbs or divide the actor into more actors, each with its own action. At the early stages of an investigation, focus on what the actor did, not what the actor should have done. That task is introduced later in the investigation process.

 DESCRIPTOR in used to expand the description of what the actor did. Use it to describe what the actor acted on, or otherwise define the act so it is uniquely described, can be visualized and then can be tied to other EBs.

 TIME is the data component required to sequence EBs. Times can be estimated, observed or relative.

SOURCE is the person, object, document or other origin for the data transformed into an EB.


The major pitfalls to guard against in the preparation of EBs are an almost overwhelming tendency of investigators to try to take shortcuts, to record "did nots," to let their experience seep into the EBs they produce, to break some of the rules of this procedure, or to fall back on abstractions to cover up uncertainties about the actors or actions.


Shortcuts are tempting but self defeating. Skipping any of the essential elements of an EB or assuming actors or actions rather than entering placeholders for unknowns are two frequent sources of problems. The former will require backtracking to get the information later, while the latter may seriously misdirect the investigation, overlook documentation of needed data or increase the vulnerability of the work products to later criticism.

Did Nots

The focus must be on what people or objects did, rather than what they did not do. Did nots mask the need to determine what actors actually did do. Did nots presume ideal behavior standards, and assume what actors actually did was not valid. This can thwart understanding and discovery..

Introducing personal experience.

A second major pitfall is interpreting observed data on the basis of personal experience, and using that experience as the basis for formulating an EB. For example, an investigator who has operating experience is tempted to adopt operator’s assumptions rather than probe the operator’s actual tasks, constraints and decision process in a given case. Probably the most frequent abuse is the introduction of "did not" EBs based on what the investigator "knows" or thinks should have happened. This undermines the more productive investigation challenge of finding out what actually did happen based on what the data can tell the investigator.

Breaking MES rules.

This pitfall often involves intellectual laziness, as when an investigator elects to use "crew" or similar plural actor name because the name of the specific actor was not determined as it should have been. The rules are provided primarily because they are needed to ensure the satisfactory subsequent use of the EBs, but also in part to enable the conscientious investigator to exercise self discipline during an investigation.


Another debilitating pitfall is the use of abstractions to describe an actor or action that should be described with specificity and concretely. Abstractions are symptoms of investigation problems, as when an investigator either

  • does not want to acknowledge the uncertainties due to the inadequacy of the available data.

  • is forced to fit incompatible observed data into preconceived categories demanded by form designers or managers,

  • is unwilling to make the effort to develop the needed data during the investigation or

  • knows abstractions will not be challenged by the users of the investigator’s work product.

Lack of discipline

It is easier for investigators to substitute opinions and abstractions than to follow these procedural rules. Follow the rules, even if it requires some hard thinking to define the actions, break down the actions or define uncertainties.

Other pitfalls.

The Quality Control checks provided at the end of this Guide indicate additional pitfalls as EBs are created.



Caution: Try to avoid stating what people or objects didn't do during the development of the description of what happened. After an investigator understands what happened, a comparison with what was expected to happen can be introduced to discover and define problem with either actions and expectations.

Use the following guidance to prepare your EBs during an investigation.


Development of descriptions of what happened requires investigators to identify the people and objects involved, and what each had to do to produce the outcome. "Who or what was involved and what did they do" is the investigator’s constant question. Investigators must identify objects and people that can provide information about those interactions. They must seek the data that helps them discover and define each person or object involved, and then determine who or what did what when and where, and to whom or what. A constant question is who or what was there, and what did they do?

"Think actors and actions" is a fundamental investigation skill. Look for actions and interactions, or you won't see them.

When investigators see an action, they must document it in some manner. Each action can be represented by an EB. During an investigation, keep listening and looking for actors whose actions might have influenced the progression of the process being investigated. Base actor names on data acquired during the investigation. The data should be as value-free as possible, that is, based on observations of this occurrence, rather than opinions or experience or conclusions or past investigation results or known problems. Save speculation for later, and work with observed data initially.


The four minimum steps for creating EBs are:

  1. Record the actor name first
  2. Record what actor did
  3. Then enter time action began
  4. Then record data source for EB

1. Always enter the actor name before entering anything else on an EB.

During an investigation investigators identify and track actors involved and what they did to produce the outcome. Actors can be people or things. Give each actor a specific and unique name. Use suffixes like A or 1 when recording general names like "driver 1" and "driver 2" or use unique job titles or chemical names instead of trade names. Keep a list of the actual name used for each general name with a suffix, so you do not duplicate any names.


Enter only one specific name, and KEEP USING IT. Pronouns (they, she, it, he, etc.) and plural or composite names (the band, the crowd, the fire fighters, crew, maintenance workers) lead to big problems, so avoid them.

The actor named must be the doer of the action which affected someone or something else later in time. Do not enter the name of someone or something that was acted on or had something done TO them as the actor.

An actor may be "broken down" or "decomposed" into two or more actors, with a separate action for each, to overcome naming or transformation difficulties. For example, it may be desirable to track what a person's hands and feet were doing separately during a fall down a set of stairs. Something may separate into two actors during the occurrence, (like a wheel came off a car) and become two objects that produce further changes. Select each actor so the actor can be doing only one action at a time.


The "?" Placeholder Notation Convention

When during an investigation it is observed that an action occurred, but the actor name can not yet be identified, use the Question Mark Placeholder notation convention. Use a ? to represent the name of the actor that acted. As data flow into the investigation, the actual names usually emerge. When the actor name is identified, replace the ? with the actual name. As long as a ? appears on an EB, it defines data still needed to complete the description of the occurrence. This helps direct the investigation tasks, as is discussed in Guide 2 MES-Based Worksheets.

2. Next, enter what the actor did

The actor's name must be followed only by the action word (verb) describing the action that initiated a change of state in someone or something else during the occurrence. This is often one of the most difficult steps in investigations. We are not used to describing actions this explicitly in our everyday language. Focusing on a specific action verb, however, is a useful forcing function for investigators. It compels them to define concretely and precisely what happened. When an investigator must resort to abstractions it shows everyone that the investigators does not understand what is being described, and is trying to cover up this problem..

What are actions?

View actions broadly. PEOPLE ACTIONS include

 1. sensory actions, like heard, smelled, saw, tasted, or touched, which initiate subsequent action by the observer or someone or something else.

 2. physical actions, like turned, told, reset, pushed, pulled, rotated, scolded, shouted, etc. which initiate a change in a physical object or another person.

 3. mental actions, like decided, estimated, interpreted, judged, chose, concluded, interpreted, accepted, etc., which led to subsequent actions by the person.

4. "programming" actions by an individual which taught, instructed, guided, compelled, designed, excused or otherwise influenced what people or objects actually did during a process to affect the process outcome.

THINGS ACTIONS should be described as physical actions that can be visualized by using concrete words and descriptors/objects. For example, shook, rose, fell, descended, struck, scored, broke into two parts, lit, etc. help create visual images.

Avoid words that reflect investigator conclusions or judgments. Saying a "part failed" is ambiguous and can not be visualized. Saying a weld cracked in tension between part A and part B in a specific location and time is much more useful.


* show two verbs in the same EB.

* use the passive voice for actions

Force yourself to state who did what!

As with the actor name, use the ? placeholder to show that the action is an unanswered question, or is not understood. A good example of the use of the ? is when someone was at the scene of the occurrence for a specific time, but the actions they describe to investigators do not fill up all the time they were present. Another example is when a thing comes apart, but the investigator can't figure out yet what it actually did during the breakup.

3. Then add descriptor/object(s)

A verb may be supplemented or limited by adding additional descriptor/object phrases, such as "200 feet in 4 seconds" after the words "aircraft descended." "___ struck car2 gasoline tank fill pipe cap" can be visualized if the car2 system is understood. Such supplemental defining data are termed "DESCRIPTORS." (or OBJECTS in the software.) This space can also be used to identify what the actor acted on, or the "stressee" to further define the action, and lead to the next action. The objective is to provide a way to define the action sufficiently to permit its visualization, using descriptive words to make the action concrete and unique.

The "e" Convention

When a quantifiable measurement or value is needed to help order the EBs, but is not available from the data, and an estimate is required, use an "e" in the EB to show that the values are estimated. This provides everyone with an indication of the nature of what is reported.

4. Location.

The location where the action began is often required to develop the spatial logic flow of recorded events. If physical motion or movement has to be communicated to visualize the EB, show where the actor was when the action began. This may require a sketch, photo or map perhaps with some coordinate system and references to enable the reader to pinpoint the location. If uncertain, use the E for estimated or the question mark notation here, too. Scale of the map or sketch should always be shown on such references.

When implementing the above, the actor and action, descriptor/object and source should be readily visible, while the location, times and other data may be somewhat smaller in size to provide the needed room. For full manual EBs, larger note pads are required, but the EBs can serve as a convenient file repository for the data at the end of the investigation. Computer programs that temporarily can hide text in EBs are helpful when the displays get large.

The Actor, Action, Descriptor, Time and Source are essential entries, as described above. Items 5 and 7-9 are optional, depending on the needs of the sponsor and the investigator.

5. Then Enter Source(s) for the EB

During investigations that last for more than a several hours, the sources of the data used to create the EBs may become confused or lost from memory if the sources are not recorded. The EB provides a useful way to keep the source information with the action, and specify where to look if more information from the source is needed as the investigation progresses. This habit is most useful when occurrences subsequently find their way into litigation or controversy, several years after the investigation.

Reference codes are acceptable if a key to the references is made part of the investigation file. If more than one source for the EB is available, enter each, separated by commas.

Good housekeeping pays big dividends! Control custody of physical data sources until your no longer need them.

Data sources can be investigator observations, photographs, sketches, design or analysis documents, interviewee statements, blueprints, debris, audio/visual records, equipment recorder data tapes, computers or accessories. Interpret sources broadly.

6. Then add date and time action started/ended.

The date and time an EB began is needed for various purposes such as sequencing actions, checking for overlapping actions, and verifying the logical flow of EB pairs. The date and time each event began may become particularly critical when either very rapid changes (i.e., chemical or explosive reactions, in-flight breakup, etc.) or very slow changes (bacteria forming gases in a nutrient-rich environment, rain fall changing river levels over several days, metal fatigue degradation, etc.) need to be understood and analyzed. The date and time the EB began should be entered on the EB.

If date and time are essential and not yet known, enter an "e" followed by the estimated time in that area of the EB. The form "09:00:00:000" or "e 2005:11:27 09:00:00:000 "or "to+E 00:00:00:030" or "to - e 00:00:00:050 " would be satisfactory as long as it satisfies the needs of the investigation. (Investigation Catalyst adds the e to all entries, until the time is confirmed.) Any e appearing on an EB or in the time bar indicates unresolved questions, signaling investigators, reviewers or users that the EB contains at least time uncertainty. When the time is completely unknown, use the Question Mark notation (?) to show that the information is unknown.


A simple actor/action/source EB may be adequate during investigations of simple occurrences. However, it is often helpful or necessary to use more data elements during a more complicated occurrence involving more than two or three actors, or in occurrences involving litigation. The additional elements that might be necessary are shown in Figure 1-4 below. These data might include the times action began and ended, location, duration, record number and any remarks or reminders the investigator would like to note.

Figure 1-4 Comprehensive event block Contents

When implementing the above, the actor and action, descriptor/object and source should be readily visible, while the location, times and other data may be somewhat smaller in size to provide the needed room. For full manual EBs, larger note pads are required, but the EBs can serve as a convenient file repository for the data at the end of the investigation. Computer programs that temporarily can hide text in EBs are helpful when the displays get large.

The Actor, Action, Descriptor/Object, Time and Source are essential entries, as described above. Items 5 and 7-9 are optional, depending on the needs of the sponsor and the investigator.

7. Duration of action.

Sometimes it is helpful to show how long an action lasted, or its duration. For example, a communication between two persons can overlap, so the recipient of a message may be talking before all the data have been received from the sender. Other times, a communication link is destroyed by the beginning of an external noise. The need to describe EB duration is often critical to determining what happened in occurrences commonly attributed to "human error." When needed ending times can be shown in the EB. If uncertain, use the e for estimated or the question mark notation here, or enter a remark at the bottom.

8. Remarks.

Occasionally, it is desirable to make some kind of additional notation on an EB as a reminder to look for confirming data, or other information. For example, when a third party can provide a photograph or sketch, it may be helpful to note that fact with a P or Sk on an EB. If codes are used, make sure to record what they represent, so they are not forgotten months later, or if someone else is also making EBs for the case. This seems obvious, but it is often overlooked.

 One option used by investigators concerned with expected actions has been to use a coding scheme to indicate when a procedure or a regulation or code or standard might have been relevant. Once recorded on the EB, coded entries can be used as reminders to check further on the point when the documentation can be searched, or when preparing a report of the investigation.

Alternatively, both the beginning and

9. EB number.

When the preparation of all EBs is completed manually, it may be desirable to mark each EB with an EB number so it can be referenced easily when required during subsequent uses.

Investigation Catalyst assigns x-y coordinates to each EB, which identifies the location of the EB on the matrix, and serves as a de facto ID number.


Investigators can develop EBs

1. while data are being acquired or delivered, as would occur during oral interviews or meetings or walkarounds, or

 2. while working with sources containing existing data.

During the first case, investigators have to hustle to capture the EBs. The press of time may require some hurry-up techniques. In the second situation, investigators have more time, but the range of techniques can be different.


Rule 1: record sources. A good rule is to try to record (audio or video) such data for later, more detailed perusal. There are times when this is not possible. When we talk to people for example, we can listen faster than we can write. Further complicating the task, people can state what they did, or what they observed others doing. Either type of data may be reported explicitly or implicitly by the person talking. Awareness of both is necessary while listening to someone. Be prepared to capture both. That's why it is a good idea to - at the very least - try to record the discussion verbatim, and review it later for accuracy and completeness.

If you are observing objects, same rule applies. Record the observations on film or some alternative recording medium.

Rule 2. Get permission to record. Getting permission to record individuals or capture images of private property can be a sensitive issue, but permission should be sought and hopefully received before doing any recording. Permission to record implies cooperation by the interviewee. Gaining that cooperation is another essential investigation skill.

If recording is not possible, use the EB shortcut techniques described below.

Rule 3. Use EB shorthand. During a discussion, listen for descriptions or inferences of actions by the individual or by other people or things. When an interviewee describes an action, write down the actors name (or initials if pressed for time) and the action verb that accompanies the actor. Use ? liberally if necessary and then go back and use the ? to pinpoint followup questions. Alternatively, have a second interviewer alternate in asking questions and recording the answers. As soon as feasible, before memory fades, transfer notes about events into the EB format.

During interviews, make mental movies to track and remember the person's movements and actions, and to determine whether the person's actions during the occurrence were covered adequately. A preferred order of precedence for asking questions of people is to ask what the person observed other people or things do. The ask about what the person did (physical and mental actions). Then ask about the decision process that was involved with selected actions. Finally, ask questions requiring value judgments - these are sometimes the most uncomfortable for a person to answer, and may turn a person off. Learn as much as possible before asking threatening questions.

 Experienced investigators develop some shorthand codes to remind themselves of nonverbal information they get from a interviewee, such as body language signals that indicate discomfort or other emotions during the discussion.


When working from documents, development of EBs is somewhat less stressful, because it is possible to use a supplementary technique to capture the EBs. From a written document (like a interviewee statement or accident report) proceed as follows. (See tutorial at Starline Web Site at

1. Underline reported name of each actor and what actor reportedly did.

 2. Convert, format and record the reported actions and source.

 3. Identify words in report which INFER actions and highlight them.

 4. Convert, format and record the implied actions and source.

When working with data from recorded physical media like charts or audio/videos tapes, use techniques similar to the interview situation. Sources can and should be reviewed against the EBs created in these circumstances.

Hint: With objects, look for actions which initiated
changes of state in an object or process.

Making EBs using information derived from physical states of things other than recorded media differs from interviews. Things can't tell investigators what they know about an occurrence. The investigator has to "read" that information in the things. That requires specialized skills and - on many occasions -a technical background. Investigators should get help to read the EBs from things. Focus on "stressors" that initiated the changes, not the "stressees" that were acted on.

 Once the things data have been read, the preparation of the EBs proceeds as described above, except the actor will be a thing with a different kind of name. The actions will be different too - words like cracked.., shifted.., breached, actuated, started, separated, eroded, stopped, rotated, combined with, flowed to..., bridged.., began to slide, etc.

CAUTION: Be aware that most testing or laboratory personnel are not used to documenting the results of things tests or examinations in the EB format. Expect to get their data in the same form as they usually provide, unless you give them specifications for EB outputs. See Test Planning Guide 6.


EBs can be created manually on paper, or with the assistance of computer software like Investigation Catalyst from Starline Software Ltd.


For manual implementation, it is convenient to use the following materials to create EBs:

 1. a package of stick-on notes (12 pads of 3-M POST-IT® 38 x 50.8 mm No. 653 Note Pads or larger. Other brands have been used, but they have not proven as durable.)

 2. a black marking pens (Sanford Sharpie® for example) or soft pencils with good erasers, or a separate eraser.

 When working with EBs, additional data may require modifications to or editing of existing EBs. Use replacement stick-on EB over existing EB to introduce changes so the visible EB is always the latest one.


Investigation Catalyst software from Starline Software Ltd. is designed to implement the MES investigation system. This software facilitates data entry and the organization and analysis of EBs on a Matrix. The development of the data to enter is as described above. See Starline Software's web site. Data can also be captured, less efficiently, on spread sheets by enlarging cells and ordering it as it is acquired. Alternatively, data can be captured in drawing applications and laid out as a flow chart, using the computer screen to organize the EBs as they are acquired.

Another option is to set up a table in a PC word processor that has merge and label preparation capability (Word Perfect or Word, for example). Set up a table with the column titles of actor, action and other EB elements on the first row. Then add rows containing the entries for each EB element and using the label setup functions, set up the files to print labels, and print out data in each row on a label. Each printed label will be a separate EB. The labels are then used in subsequent steps as described in guides 2-10. The tables provide a way to make changes on any of the labels before final printing. Contact Starline for download.


NOTE: The following is from the MES-based investigation quality control (IQC) procedures, described more fully in Guide 10.

This part of the procedure is implemented as each EB is created, to improve investigator efficiency during an investigations. Fortunately, the quality checking of each EB as it is created becomes a habitual mental routine after it is used a few times.
Before offering any EBs for the preparation of MES-based worksheets and other uses, check each EB to verify that
  • each contains the required actor, action, descriptors/objects, and source, or ? if appropriate in lieu of these four required elements.
  • the name for each actor is unique and used consistently in all EBs for that actor.
  • each EB is free of the following "poison words": each EB has sufficient information to identify about when it happened so the EB can be sequenced properly relative to other EBs.
  • each EB with a ? has been reviewed to be verify data are not available, or that provision has been made to acquire the missing data, or that MES-based logic trees will be used to try to postulate what probably occurred before closing the investigation.
  • any codes used are identified and recorded in a master list of investigation records.
  • the sources have all been retained and documented where necessary or when so instructed.

    For most investigators, these checks quickly become ROUTINE - a part of the data gathering and documentation task.


  • Revised 9/3/06