A guest is served a dish containing shellfish. She is allergic. The preference sheet was updated by email two days ago; the printed copy in the pantry was not. The stew who plated it was covering for a colleague, had not been briefed, and assumed the chef had checked. The chef assumed the interior had checked. Nobody was reckless. Six ordinary decisions lined up.
The four error types
| Type | Definition | Interior example | Countermeasure |
|---|---|---|---|
| Slip | Right plan, wrong action | Reaching for the wrong glass | Design, layout, checklists |
| Lapse | Right plan, step forgotten | Forgetting to restock the amenities | Checklists, prompts, handover notes |
| Mistake | Wrong plan, executed correctly | Using the wrong chemical on marble because you believed it was safe | Training, knowledge, supervision |
| Violation | Deliberate departure from a rule | Propping a fire door open to speed service | Supervision, culture, consequence |
Slips and lapses are execution failures by competent people and are usually predictable and designable-out. Mistakes are knowledge failures and are a training issue. Violations are a choice — often a well-intentioned one ("routine violation" to get the job done) — and are the only category that is properly a discipline question.
The error chain
Accidents are almost never one error. They are a chain: a sequence of small failures, each survivable alone. The shellfish incident had at least five links — an uncontrolled document, an unbriefed cover, two assumptions, and no final check. Break any single link and there is no incident.
Recognised links in a developing chain include: ambiguous or conflicting information, a departure from standard procedure, unresolved discrepancies, poor communication, confusion or nobody in charge, and fixation. Any crew member breaking any link stops the accident — which is exactly why speaking up matters so much.
The Swiss-cheese model
Reason model: an organisation has layers of defence — procedures, training, checklists, supervision, briefings, culture. Each layer has holes, caused by latent conditions (a badly designed rota, an out-of-date printed preference sheet, chronic understaffing) and by active failures (the slip, the lapse). When the holes momentarily line up, the hazard passes straight through.
The leadership consequences are direct:
- Do not rely on any single defence. Redundancy is intentional.
- Attack latent conditions, not just the last person in the chain. Firing the stew does not fix the uncontrolled document.
- Every near miss is a free look at where the holes are. It must be reported, or the holes stay hidden.
Onboard Notes
- Report near misses through the SMS reporting system even when nothing happened. That is the point of near misses.
- When you investigate, ask why the action made sense to that person at that moment. It almost always did.
- The distinction between an honest error and a deliberate violation is the foundation of just culture, and it decides how you must respond as HOD.