On 4 November 2010, a Qantas A380 lost part of an engine minutes after leaving Singapore. The aircraft's electronic checklist produced more than 50 failure messages. All 469 people on board survived.
Nobody had written a procedure for that exact failure, because nobody could have. Part 2 is about why the crew coped anyway. This issue is about the idea that makes the answer make sense.
We don't build safety systems to make people perfect. We build them because people can't be.
The number everyone quotes
You've seen it in training slides and conference talks: "70 to 80% of accidents are caused by human error."
It's worth being precise about what that means, because it gets repeated far more often than it gets sourced. ICAO's Human Factors Training Manual (Doc 9683) and decades of investigation research find flight crew actions cited as a contributing factor in a majority of accidents. That is not the same as the probable cause. Almost every accident that lists a human action also lists organizational, procedural, or technical factors beside it.
So the number tells you humans are usually present at the point of failure. It tells you almost nothing about who, or what, put them there.
James Reason's Swiss Cheese Model made the point decades ago. Accidents don't come from one broken part. They come from imperfect layers lining up: organizational decisions, supervisory gaps, preconditions, and finally the "active failure" at the sharp end that collects the blame. The pilot who made the last error is rarely the interesting part of the story. The interesting part is everything that had to line up behind them.
Safety-I counts failures. Safety-II asks why things usually work.
For most of aviation's history, safety meant subtraction: find the failure, remove it, add a rule so it can't recur. Erik Hollnagel called this Safety-I. It isn't wrong. It's incomplete. A system run purely on Safety-I logic collects rules faster than it collects understanding, until the manual is thicker than anyone can hold in their head during an emergency.
Safety-II asks a different question: why does this work almost all the time, even when conditions aren't ideal? It treats the daily adjustments crews make, the workarounds and judgment calls that never reach an incident report, as the thing actually keeping the system flying, not a problem to engineer out.
Nothing left to take away
In 1939, Antoine de Saint-Exupéry, pilot and writer, put it this way: perfection is reached not when there is nothing more to add, but when there is nothing left to take away. He meant aircraft design.
Applied to human factors, it says this: good SOPs, checklists, and CRM protocols are lean enough to survive fatigue, stress, and time pressure. A procedure that only works when the crew is rested and unhurried has never really been tested.
Takeaway Human error is a design signal, not a discipline metric. If your SMS only counts errors and never asks why the system usually absorbs them, you're reading half the data.
For your next safety meeting
Pull your last five voluntary reports. How many were closed at the individual level, and how many were traced to an organizational or procedural root? That ratio says more about your safety culture than your incident count does.
Next Tuesday: Part 2
Qantas 32 as a Safety-II case study, and what changes when an investigation's accountability reaches the top of the organization.
The Safety Layer is a weekly newsletter on aviation safety and human factors. Have a case your team wants discussed? Reply to this email.
