17.1 Human Factors & Human Error in Airline Dispatch

17.1 Human Factors & Human Error in Airline Dispatch

Human factors is not a soft topic tacked onto the end of a dispatcher course. It is knowledge area 11 of the 13 areas listed in 14 CFR § 65.55(a), and Part 65 Appendix A, section VIII.A.2 requires an FAA-approved dispatcher certification course to teach human error causes, prevention, and detection/recovery. ADX questions in this area are not about memorizing a regulation number; they test whether you can recognize the mechanism behind a dispatch mistake and name the defense that would have caught it.

The operational reason is blunt. A dispatcher exercising operational control under 14 CFR § 121.533 may be responsible for 30 to 60 simultaneous flights. A single transposed fuel figure, a misread TAF validity period, or a forgotten MEL performance penalty propagates directly into a dispatch release that a crew will fly. Unlike a flight crew error, a dispatch error is often silent — nothing moves, nothing alarms, and the mistake only surfaces hours later when the aircraft is airborne and the margin is gone.

---

The SHELL Model: Where Dispatch Errors Actually Come From

The SHELL model (Edwards, refined by Hawkins) places the human — Liveware — at the center and examines the four interfaces where mismatches create error. It is the most useful framework for a dispatcher because it forces you to look past "who made the mistake" to "which interface was badly shaped."

Exam framing: when an ADX scenario describes an error, identify the interface first. The mismatch tells you the fix. A Liveware–Hardware mismatch is fixed with a system change or a plausibility check, never with "be more careful."

---

The Error Taxonomy: Slips, Lapses, Mistakes, and Violations

James Reason's taxonomy matters operationally because each error type has a different defense. Calling all four "carelessness" guarantees the wrong corrective action.

[!WARNING] ADX trap: candidates routinely mark "violation" whenever a rule was broken. A violation requires knowing departure from a known procedure. A dispatcher who applies the wrong alternate rule because they genuinely believed it applied made a rule-based mistake, and retraining — not discipline — is the corrective action.

---

The Swiss Cheese Model: Latent Conditions vs. Active Failures

Reason's Swiss cheese model describes an accident as the momentary alignment of holes in successive layers of defense. Two terms carry the weight:

• Active failures are the unsafe acts committed at the sharp end — the dispatcher's transposed fuel figure, the crew's unstabilized approach.
• Latent conditions are the decisions made long before, upstream, that create the holes — understaffing a shift, a flight planning system that permits an implausible entry, a turnover procedure with no written checklist, an incentive structure that measures dispatchers on on-time departures alone.

Latent conditions are the dispatcher's real leverage. An active failure is caught once; a latent condition removed is an entire class of future errors removed. This is exactly why the FAA's voluntary reporting programs exist and why the reporting culture matters more than the individual error rate.

---

Cognitive Biases That Distort Dispatch Decisions

These are the specific failure modes ADX scenarios are built around:

1. Expectation bias. You read what you expected to see. A dispatcher expecting BKN015 in a familiar TAF reads past BKN005. Countermeasure: read the raw text aloud or have the release independently verified, rather than scanning the decoded summary.
2. Confirmation bias. Having selected a route, you weight the model run that supports it and discount the one that does not. Countermeasure: deliberately look for the disconfirming product — check the SIGMET and the PIREPs before, not after, committing.
3. Anchoring. The first fuel number produced by the flight planning system becomes the reference point, and every subsequent adjustment is a small deviation from it. Countermeasure: recompute from requirements, not from the previous release.
4. Plan continuation bias ("get-there-itis" for dispatchers). The pull to keep the original plan intact grows as the plan nears completion. This is why pre-briefed re-decision points — a redispatch fix, a bingo fuel figure, a weather review time — are more effective than intending to "keep an eye on it."
5. Automation complacency. A modern flight planning system produces a legal-looking release for almost any input. The output inherits every error in the input. Countermeasure: sanity-check magnitudes — burn per hour, alternate distance, payload — before signing.
6. Channelized attention. During a major weather event a dispatcher can tunnel onto one troubled flight and lose the other 40. Countermeasure: deliberate scan discipline and load-shedding to a relief dispatcher.

---

Fatigue: The Physiology Behind § 121.465

Section 121.465 caps dispatcher duty at 10 consecutive hours and requires rest because the underlying physiology is not negotiable. Two systems drive alertness:

• The homeostatic sleep drive builds with every hour awake. After roughly 17 continuous hours awake, performance degradation on vigilance tasks is comparable in magnitude to alcohol impairment at a 0.05% blood alcohol concentration.
• The circadian rhythm oscillates on an approximately 24-hour cycle regardless of how much sleep was banked. Its trough — the Window of Circadian Low (WOCL), 0200 to 0559 — is when body temperature, reaction time, and error detection are worst.

What fatigue does to a dispatcher specifically:

Sleep debt is cumulative and is not repaid by one long night. The dispatcher's personal mitigations — protected sleep opportunity, strategic caffeine timing, bright-light exposure at the start of a night shift, avoiding a heavy meal before the WOCL — are professional obligations, not lifestyle advice. Under the shared operational control framework of § 121.533, a fatigued dispatcher who continues to sign releases is an active hazard to every flight on the desk.

---

Detecting and Recovering From Error

Appendix A explicitly requires detection and recovery, not just prevention, because error rates never reach zero. The defenses that work:

1. Independent verification of the release. A second dispatcher or an automated validator checks fuel, alternates, MEL penalties, and weather against source data — not against the first dispatcher's summary.
2. The two-challenge rule. If a crewmember or dispatcher voices a concern twice without a satisfactory answer, the plan stops and is re-examined. This is a communication procedure, not an attitude.
3. Structured turnover. A written, signed desk turnover log converts a memory task into a documented one and closes the most common Liveware–Liveware hole.
4. Voluntary safety reporting. The Aviation Safety Action Program (ASAP), run under an FAA/carrier/labor Memorandum of Understanding, and the NASA-administered Aviation Safety Reporting System (ASRS) collect the latent conditions that would otherwise stay invisible. Dispatchers are eligible participants in both.
5. Just culture. A reporting system survives only if honest error is treated differently from reckless conduct. Where every report produces discipline, reports stop — and the latent conditions remain.

---

Common ADX Exam Traps

1. Confusing a lapse with a violation. A forgotten step is a lapse; a knowingly skipped step is a violation.
2. Assuming fatigue is recognized by the fatigued. Self-assessment of alertness is unreliable precisely in the WOCL; that is why the limits are scheduled, not self-declared.
3. Treating the SHELL center as the fix. The Liveware is the center of the model, but the interfaces are where the fix lives. "Retrain the dispatcher" is rarely the correct answer when the hardware or software interface allowed the error.
4. Believing automation removes error. It relocates error from execution to input and monitoring.