Human error, threats and resilient systems

Why does the type of error change the useful defence?

An action slip and a mistaken plan do not need identical corrections.

Execution versus intention

A slip or lapse occurs when the intended plan is not executed or remembered correctly. A mistake occurs when the selected plan itself is wrong. A violation is a deliberate departure from a rule, although its context and motivation still need investigation. These labels describe behaviour, not a person’s moral worth.

Design the defence to the mechanism

A confirmation step may catch a wrong entry, but repeating the same mistaken reasoning is weak protection. Better equipment design, independent evidence, workload control and useful procedures can prevent or trap different failures. “Be more careful” alone rarely addresses the conditions.

Mechanism and limits

Reliability is a property of the person–task–environment system, not a fixed personal success percentage. A good performer can become vulnerable when interfaces are confusing, procedures conflict or resources are constrained. Errors should be examined for recurrent patterns and shared causes rather than only counted by individual. The SHELL model directs attention to interfaces between the person and software/procedures, hardware, environment and other people. An intervention that improves those interfaces may prevent repeated errors more effectively than another warning to the last person involved.

Applied case · Choose a defence that fits the error

Three synthetic crews select the same wrong configuration. One intended the correct selection but touched an adjacent control; one followed an incorrect plan; one knowingly departed from the procedure. A label alone does not solve any case. For the slip, consider control design and verification. For the mistake, consider the source of the plan and independent reasoning. For the deliberate departure, examine the operational pressure and accountability within the reporting system. Applying only a reminder to “pay attention” to all three would leave distinct mechanisms unresolved and could allow the pattern to recur.

How do threats become an undesired aircraft state?

An external challenge does not force an accident if effective barriers remain.

Trace the sequence

A late runway change is a threat. An incorrect performance entry may be an error. An aircraft accelerating with an unsuitable configuration is an undesired state. Threat and error management seeks to anticipate threats, prevent or trap errors and recover safe states before consequences develop.

Learn without hindsight shortcuts

Reporting and investigation should recover what information and constraints existed at the time. Latent conditions such as ambiguous interface design, poor rostering or weak supervision can align with active errors. A just reporting culture supports learning while retaining appropriate accountability; it is not a promise that every behaviour is acceptable.

Mechanism and limits

Safety culture affects what the organisation learns. If crews expect every report to be dismissed or punished regardless of context, hidden hazards can persist. If procedures are routinely bypassed without review, informal practice can drift away from the assumptions on which safety controls were designed. A useful reporting system examines both behaviour and conditions, follows evidence and provides feedback. Multiple barriers should also be checked for common dependencies: two reviews based on the same obsolete document are not fully independent even if different people sign them.

Applied case · Find where the sequence can still be interrupted

A synthetic late runway change is followed by copied performance data from the original runway. The threat has generated an error, but the aircraft has not yet begun the take-off. An independent check using the current runway and correct source can trap it. If the mismatch reaches the aircraft state, recovery depends on the phase and the approved procedure; a classroom model must not invent a take-off action. Map anticipation, prevention, trapping and recovery as separate opportunities. This makes the safety lesson about available barriers rather than blaming the crew only after the final outcome is known.

Can you explain and apply the mechanism?

Four original questions. Work from the stated facts, then compare your reasoning with the explanation.