Human Error and Reliability

The first module drew the Swiss cheese; this lesson supplies the anatomy of the holes. It asks what makes a human reliable, what situation awareness really is and how it is lost, how errors chain and classify, where they are generated, and what design and discipline can do about a component (the human) that will never be error-free.

Human reliability

A pilot's reliability is not a fixed property; it moves with a list the syllabus wants named: length of time of exposure to risk and the degree of risk itself, then mental and physical health, innate psychological and physiological characteristics, personality (and its deficiencies), stress factors, experience, motivation and skill level. Much of that list this course has already taught how to protect (sleep, health, hygiene); the rest is exposure, temperament and training. The point of naming the factors is operational: reliability is managed, day by day, not assumed.

Mental models and situation awareness

A mental model is the mind's internal representation of a complex surrounding situation: the picture of where the aircraft is, what it is doing and what comes next, built from perception and knowledge. Its advantages are why cognition works at all: fast comprehension, anticipation of what comes next, gaps filled without waiting for complete data. Its disadvantages are the same properties pointed the wrong way: an incomplete or inaccurate model misleads with full confidence, expectation feeds it, and once formed it resists disconfirming data. And the model's relationship to the cognitive illusions of the perception lesson is direct: the mental model is the top-down half of perception, so a wrong model does not just misjudge — it generates a confident wrong percept.

Situation awareness is the state of holding an accurate mental model of the environment (perception matching reality), inside and outside the aircraft, together with an honest awareness of one's own performance state. It rests on vigilance, alertness, communication, comprehension and briefing, and its importance is stated by its failures: flawed situation awareness has been so overwhelming that crews have ignored true warnings telling them their picture was wrong. The factors that feed it are those five supports; the factors that erode it are stress, interruptions, fatigue, hopes and wishes, poor communication, and boredom.

The syllabus wants the loss recognised and the recovery drilled. The cues that situation awareness is going:

Confusion and fixation — a gnawing sense that something feels strange, or concentration locked onto a single item while the rest of the picture ages.
Hurry and shortcut — rushed speech and actions, rushed or abandoned procedures, short cuts, abnormal impatience, a sudden decline in flying skill.
Unexplained mismatches — instrument discrepancies nobody can account for, unexpected results from actions, unusual timing, and leading questions asked of the other crew member in search of reassurance.

Regaining it is a discipline, not a mood: gather information from every source, take the time available, consider all interpretations of the data (not only those that fit), stop occasionally to take stock, re-test the hypothesis as events move, and treat data that does not fit as a reason to go back to the first symptoms rather than something to discard. The Oxford texts compress it into a motto worth keeping: interpret the world as it is, not as you would like it to be — hope for the best, plan for the worst.

The error chain

An error is any occasion when a mental or physical activity fails to achieve its intended effect. Some errors are isolated: no consequence, no influence downstream (pulling a young plant while weeding). But errors tend to be cumulative (one creates the conditions for the next, which invites a third), and that linkage is the error chain: a faulty maintenance procedure issued once and producing a series of failures is the classic cumulative case. The operational consequence is hopeful: a chain has links, and breaking any one of them stops the accident that the whole chain was building.

The forms of error

The syllabus taxonomy has four entries, and the figure holds them side by side:

Slips — the intent was correct, the execution was not: the right drill carried out wrongly. (The term covers lapses too.)
Faults — the execution satisfied the intent, but the intent itself was wrong: the wrong drill executed perfectly, a flawless answer to the wrong question.
Omissions — a step or process simply left out. Highly automatic tasks interrupted midway are the breeding ground, which is why an interrupted checklist is restarted, not resumed.
Violations — deliberate departures from rules, regulations or procedures. They can look like errors, but the hinge is intent: the deviation is chosen (which is not the same as intending harm), and the safety-culture lesson already built the just-culture consequences on exactly that hinge.

Where errors come from

Error generation splits into internal and external factors. The internal sources are the mind's own: mistaken perception, misinterpretation of information, preconceived assumptions, experimentation, faulty memory, fatigue, and lack of practice (the deterioration effect). The external sources arrive from outside the skin: stressors, and in the flight-deck context the three the syllabus names — ergonomics, economics and the social environment.

Two internal errors belong specifically to the motor programmes of the previous lesson, and the syllabus wants them defined. An action slip happens at the selection stage: the wrong programme fires in the right context — flaps selected instead of gear, an engine-failure drill executed perfectly when the hydraulic drill was needed, the student marking the wrong option while knowing the right answer. Environmental capture is habituation running the show: an action so often performed in one environment that the environment triggers it, or fakes it, as when circuit-practising pilots confirm 'three greens' on final without ever having selected the gear, and remain convinced afterwards that they saw the lights. Together they are the routine errors, and their only counter is the unglamorous one: monitor your own and each other's motor actions, and run drills and checks diligently, never automatically.

The three external sources, with the examples the syllabus asks for:

Ergonomics — bad design or layout: look-alike levers seated side by side, a critical switch hidden behind the yoke, displays that invite misreading. The error is made by the crew and manufactured by the drawing board.

Economics — company and organisational pressure: schedules that punish the go-around, fuel policies that argue with airmanship, the trimmed turn-around that hurries every check on the aircraft.

Social environment — the culture around the crew: cultural misunderstandings, cockpit gradients that suppress a junior voice, norms that make short cuts respectable.

Designing the error out

Since the human will keep erring, the system must be built for it, and the design goals of a human-centred human-machine interface are three: detectability, tolerance and recoverability — the system should detect the crew's errors, tolerate them without catastrophe, and help recover from them. Error tolerance itself is the property that no single error has serious implications for the overall safety of the system: flight-envelope protection that refuses a stalling command is the canonical example, and the design contrast is between protected systems (one failed brick, wall still standing) and vulnerable ones, where a single error propagates through the whole structure. Murphy's law is the design assumption behind all of it: if a system can be operated incorrectly, sooner or later it will be.

The strategies that reduce human error are this course in miniature: error-tolerant design, checklists and SOPs (with procedures documented unless time forbids consulting documents), mutual monitoring and cross-checking (standardisation is what makes one pilot's actions predictable enough for the other to check), briefings, training and simulation, overlearning, drills done diligently rather than automatically, and writing down what working memory cannot be trusted to hold. Above them all sits planning and anticipation: the pilot who stays ahead of the aircraft flattens the workload peaks where errors breed, meets foreseen problems with prepared rule-based responses instead of improvised knowledge-based ones, and keeps spare capacity in hand — the anticipation advantage, and the reason the briefing exists.