What aviation can teach care about a wrong answer.

We work where a wrong answer has consequences, and the aviation and spaceflight world is the field that has thought longest about that. This note sets down what we read, what it supports and what it does not. Nothing in these sources is about AI systems; the mapping to Inora at the end is ours.

Checklists have a method

Flight-deck normal checklists are run in one of two ways, which come from different philosophies of operation. In a do-list the crew reads an item and does it. In challenge-response the crew does the work first and then checks each item against the list. Asaf Degani and Earl Wiener set the two out in a NASA report, Human Factors of Flight-Deck Checklists: The Normal Checklist, in May 1990. The point for us is that a checklist is a method with a design, not a reminder.

Reports that cannot hurt the reporter

NASA has run the Aviation Safety Reporting System since 1976. Its designers built it on four principles: voluntary, confidential, non-punitive and independent, and reports are de-identified (NASA CALLBACK 555). What protects a reporter is narrow and conditional, not blanket immunity: a US regulation, 14 CFR 91.25, limits how the FAA may use reports in enforcement, and an advisory circular sets conditions for a waiver. Non-punitive in aviation is a legal bargain run by an independent party, not a cultural statement. We found no verified measurement of harm prevented by ASRS.

Watching normal work

The Line Operations Safety Audit watches ordinary flights under no-jeopardy terms: observers record no names, flight numbers or dates. It rests on the Threat and Error Management model, which holds that threats and errors are part of normal operations and have to be managed (ICAO Doc 9803, 2002). The same document states its limits: de-identification gives “a level of protection”, not immunity, and some airlines are not comfortable with no-jeopardy.

Failure as something organisational

James Reason’s account of accidents puts most of the vulnerabilities behind them in the organisation, long before the event. His co-authors are plain about what the Swiss cheese picture is: a heuristic and a means of communication, which “illustrates how an accident could happen, but not how it must happen” (EUROCONTROL, 2006). Diane Vaughan’s name for how an organisation comes to treat a deviation as normal is normalisation of deviance; see her The Challenger Launch Decision (University of Chicago Press, 1996) and volume 1, chapter 6 of the Rogers Commission report.

Learning does not flow by itself either. In March 2012 NASA’s Inspector General found that, although NASA’s rules required it, only 16 of 28 project managers used the Lessons Learned Information System and only 12 contributed to it (IG-12-012). That describes the years 2005 to 2011; we found no later audit.

What has been tried in nursing

The one transfer to nursing that we could verify produced no effect. In the PERMIS trial, nurses wore a vest saying “Do not interrupt, I am preparing medication” during medication rounds, in 29 hospital units. Medication administration errors did not differ: 7.09 against 6.23 percent, p = 0.192 (Berdot and others, BMC Nursing, 2021). A bundled ‘do not interrupt’ intervention reduced interruptions but not errors overall (Westbrook and others, BMJ Quality & Safety, 2017). It is one intervention, in French hospitals, and in no long-term care setting. We found no controlled evidence that checklists, structured handover or confidential reporting reduce harm in long-term care, and that is the setting that matters to us.

What we take, and what we do not claim

Our claim is a design discipline, not an outcome. We borrow four rules and hold ourselves to them: protocols have a version and an owner, so a source can be traced; a question the sources cannot answer travels to the person who owns the subject, without the asker’s name, so that reporting is safe; what the work teaches ships as a new version of the protocol and not as a note nobody reads; and the professional decides. These are rules we design to. We do not claim that aviation-grade outcomes follow from them.