Human Factors in Aviation – What OSH Can Learn from Aircraft Maintenance Engineers

On 10 June 1990, 5,300 metres above Oxfordshire, the front windscreen falls out of the cockpit of a British Airways aircraft (flight 5390). The captain is sucked halfway out of the aircraft. He survived, and the co-pilot landed safely in Southampton. The investigation found that the day before, a maintenance engineer had replaced the windscreen using 84 out of 90 bolts with a slightly too small diameter. He was experienced, he was working a night shift, and he picked the parts from a drawer “by eye” rather than from the parts catalogue.

Nobody broke the rules on purpose. What failed is what aviation calls human factors. The aviation industry has been studying them systematically for decades, because a single error can cost hundreds of lives. Its tools, however, work anywhere people work under pressure, tired and by procedure: in a production plant, a warehouse, on a construction site or in a laboratory.

Below we discuss five concepts worth moving from the hangar into every company.

The Dirty Dozen – 12 human factors that lead to error

In the early 1990s, Gordon Dupont, working for Transport Canada, analysed aviation accidents caused by maintenance. He identified twelve states and conditions that most often preceded a maintenance engineer’s error. The list, called the “Dirty Dozen”, became the basis of human factors training in aviation worldwide.

The value of this list is that it names conditions, not culprits. Instead of asking “who is to blame”, we ask “which of the twelve conditions were present”. In the Oxfordshire accident several of them appear at once: fatigue after a night shift, lack of resources, complacency and lack of awareness. In occupational safety, the Dirty Dozen works very well as a checklist during accident analysis or as the topic of a short pre-shift briefing.

The Swiss cheese model – an accident is never a single error

In 1990, the British psychologist James Reason proposed a model that changed the way accidents are analysed. Every organisation has several layers of defence: regulations, procedures, training, supervision, technical guards. Each of them is like a slice of Swiss cheese – it has holes. An accident happens when the holes in several slices line up for a moment.

Reason distinguished two kinds of holes:

• active failures – made by the person on the front line, with an immediate effect (the wrong bolt, a skipped lockout),
• latent conditions – decisions made long ago, often far from the workstation: understaffing, an overly tight schedule, an unclear instruction, savings on tools.

The lesson for occupational safety is simple. If the post-accident investigation ends with the statement “the worker did not exercise due care”, we have plugged one hole, and the other slices remain untouched. The next worker will run into the same gaps.

The SHELL model – people at the centre of the system

The SHELL model (Edwards 1972, developed by Hawkins in 1975) puts the person in the middle and examines their interface with four elements of their surroundings. An accident rarely results from the person alone – usually the fit is wrong at one of the edges.

• S – Software: procedures, instructions, signage, IT systems. Can the workstation instruction be understood in 30 seconds?
• H – Hardware: machines, tools, personal protective equipment. Do the gloves allow precise work, or does the worker take them off?
• E – Environment: lighting, noise, temperature, but also time pressure and organisational culture.
• L – Liveware: other people – supervisors, co-workers, subcontractors. Is the shift handed over properly?
• L – Liveware (centre): the worker themselves, with their knowledge, fatigue, health and perceptual limitations.

SHELL is a good complement to occupational risk assessment. A classic assessment focuses on hazards (noise, dust, moving parts). The SHELL model adds the question of whether the person is able to work safely with what we have given them.

Drowning in documents – a lesson from aircraft maintenance (MRO)

In aircraft maintenance (MRO – Maintenance, Repair & Overhaul) the rule is: if it was not written down, it was not done. Every task has its task card, a reference to the manufacturer’s manual and a signature. Organisations approved under the European Part-145 must also train their staff in human factors.

Yet the same documentation that is meant to protect can become a source of risk. A maintenance engineer faces dozens of pages, manual revisions and forms to sign at the end of the shift. As a result, phenomena well known to the industry appear:

• signing “in bulk” – confirming tasks without actually checking them (known in the trade as pencil whipping),
• working “from memory” – the manual lies to one side because it is too long to work with,
• informal workarounds – the team develops its own, faster method that is not in any document.

Occupational safety has exactly the same problem. Workstation instructions running to a dozen or more pages, training records signed without reading, “I have read and understood” statements collected at the end of an induction. Such documentation protects the employer during an inspection, but it does not protect the worker at the machine.

Aviation responds with simplification: short task cards with the key steps, pictograms, procedures tested together with the engineers. A good instruction is one that workers actually use, not one that is complete.

Just culture – fair, not blame-free

Aviation is so safe partly because people report their own mistakes. In the European Union this is governed by Regulation (EU) No 376/2014 on the reporting of occurrences in civil aviation, which builds on the principle of just culture. It protects reporters from consequences for unintentional errors.

Just culture does not, however, mean a lack of accountability. The most common approach is the classification proposed by David Marx:

Polish companies often lack the middle row. Every deviation is treated as recklessness, so workers stop reporting near misses. The near-miss register stays empty, and the company loses its cheapest source of knowledge about hazards. ISO 45001 requires top management to protect workers from reprisals when they report incidents and hazards, and to remove barriers that discourage them from taking part in the OSH management system.

How to reduce the impact of human factors on workplace accidents: 6 steps

You do not need to build a system modelled on an airline. A few concrete steps are enough:

1. Add the Dirty Dozen to your accident cause analysis. For every accident and near miss, mark which of the twelve factors were present, and take them into account when establishing the causes in the post-accident report.
2. Look for latent conditions. Ask “why did this make sense to the worker at that moment?” and do not end the analysis at the injured person’s error.
3. Check instructions with their users. Ask workers to show you how they really do the task, and compare it with the document.
4. Slim down operational documentation. Separate what is needed for an inspection from what is needed at the machine.
5. Define your just culture rules. Set out in writing when reporting an error does not lead to a penalty – and stick to it.
6. Train your management. It is foremen and managers who decide whether reporting an error ends with a conversation or a reprimand.

Summary

Aviation did not become safe thanks to flawless people. It accepted that people will make mistakes and built a system that catches errors before they turn into accidents. The tools discussed here let you look at an error from several angles. The Dirty Dozen shows the conditions in which people err most often. The Swiss cheese model explains why a single error gets through all the defences. SHELL points to where the workstation, equipment or procedure do not fit the person. The MRO lesson reminds us that an instruction should help with the work, not sit in a binder. Just culture means we learn about problems before someone gets hurt.

The common denominator of all these approaches is changing the question from “who is to blame?” to “what made this error possible?”. It does not require large investments. To start, it is enough to analyse your next near miss through the lens of the Dirty Dozen and check which conditions keep recurring.