From Black Hawks to HOP: What Aviation and HOP Taught Me About Industrial Safety
Before beginning my civilian EHS career, I spent nearly 20 years in aerospace, primarily supporting Department of Defense aviation.
I began as an enlisted Soldier in the United States Army and later worked as a DoD contractor supporting the Army, Navy, Marine Corps, and several NATO allies as a UH-60 Black Hawk mechanical and avionics subject matter expert and Flightline Safety Officer (FSO).
When we discussed safety in aviation, we spent considerable time discussing Human Factors.
We studied the relationships between workers and:
The tasks they performed
The tools and equipment they used
The environments in which they worked
Fatigue and extended work hours
Illness and medication
Stress and distraction
Communication
Psychological safety
The organizational conditions affecting performance
The objective was not to pretend that people could perform perfectly. The objective was to understand how and why people make mistakes, design stronger systems, and build enough capacity into the operation for people to fail safely.
I did not know it at the time, but that experience would shape everything I later believed about safety.
Welcome to Civilian Safety
When I entered the civilian EHS world, everything I thought I understood about safety was turned upside down. Human Factors was replaced by thick OSHA books and corporate binders containing hundreds of policies and procedures. It was a different world, and I had to catch up quickly to succeed in my new role as an EHS manager.
The language was unfamiliar:
Working at height
Powered Industrial Trucks
Mobile Elevating Work Platforms
Hot work
Permit-Required Confined Spaces
Process Safety Management
Industrial hygiene
NPDES, R13, GWPP, SWPP, RMP…
I had a tremendous amount to learn. I studied the regulations, read the procedures, learned the terminology, and developed the technical knowledge required for the job.
However, I suspected that most managers and line-level leaders were not going to read the same binders. Their employees certainly were not going to read hundreds of pages of EHS policies.
My suspicions were confirmed when leaders routinely stopped at my office to ask what an EHS procedure required. That showed me exactly where I stood.
I was a new safety leader in an unfamiliar industry, working for an organization where many leaders knew little about safety beyond the slogan of the month. Executive leadership was focused heavily on production and the bottom line.
Safety programs belonged to the safety manager. Monitoring and recordkeeping belonged to the safety manager. Safety performance belonged to the safety manager.
As far as I was concerned, I was surrounded by leaders who were not prepared to lead safety.
Ordinary Work Is Not Harmless
We often speak as though military service is dangerous and civilian employment is safe. The raw numbers should challenge that assumption.
In 2024, the United States recorded 5,070 fatal occupational injuries. That means a worker died from a work-related injury approximately every 104 minutes.
In 2024, Department of Defense casualty data recorded only 3 hostile-action deaths among American service members that year.
Even at the height of the war in Iraq, more Americans were killed in the workplace annually than the 3 most active years of the war in Iraq combined.
https://dcas.dmdc.osd.mil/dcas/summaryData/deaths/byYearManner
Those figures are not an apples-to-apples comparison of individual risk. The populations, exposures, missions, and definitions are different. They still make an important point. Ordinary work kills thousands of Americans every year.
Manufacturing plants, mines, construction sites, transportation operations, warehouses, chemical facilities, and other workplaces should not be treated as low-stakes environments simply because employees are not facing bullets, mortars or missiles.
The Department of Defense has spent generations studying how people, equipment, training, leadership, fatigue, communication, and environmental conditions interact during high-risk work.
Military aviation uses training, redundancy, checklists, after-action reviews, engineering controls, Human Factors analysis, and deliberate Operational Learning to build capacity into the system.
Many civilian organizations do not apply the same level of discipline or investment. Learning how not to harm employees costs money. It requires time, training, engineering, maintenance, staffing, operational discipline, and leadership attention. Those investments compete with production, schedule, and short-term financial objectives.
Too often, the safety manager is expected to bridge that gap alone.
We Know How to Engineer Survival
The military operates in environments where people face deliberate and intentional harm. The threats are intelligent, adaptive, and specifically designed to defeat people, aircraft, vehicles, equipment, and defenses. We have spent decades learning how to survive those threats.
We have developed defenses against bullets, mortars, missiles, chemical agents, and attacks from the ground and air. We have engineered aircraft and vehicles with armor, redundancy, warning systems, emergency capabilities, and survivability equipment. We study fatigue, communication, maintenance errors, crew coordination, equipment design, decision-making, and the conditions that influence human performance.
Military operations will never be free from risk, and no organization can guarantee that everyone will return home safely. However, the Department of Defense has invested heavily in understanding failure and building the capacity to survive when people, equipment, or plans do not perform perfectly.
Then we look at general industry.
A machine press performs the same basic function repeatedly. A chemical process runs under largely defined conditions 24 hours a day, 365 days a year. The hazards may be serious, but they are usually identifiable, repeatable, and capable of being studied.
Yet we still struggle to ensure that a worker can interact safely with that press or work around that chemical process for an eight or twelve-hour shift.
We know the machine will cycle. We know where the energy is located. We know the chemicals, temperatures, pressures, and potential consequences. We know people become tired, distracted, stressed, rushed, and confused. We know equipment fails, tools go missing, procedures become outdated, and field conditions change. None of this should surprise us.
Still, many organizations rely on a procedure, a training record, PPE, and an expectation that the employee will perform perfectly every time. When something goes wrong, they conclude that the employee failed to follow the procedure.
In military aviation, we understood that perfect human performance was not a reliable control. We built layers of protection because we expected equipment to fail, plans to change, information to be incomplete, and people to make mistakes. General industry should apply the same discipline.
We have become remarkably capable of protecting people from systems deliberately designed to kill them. Yet we continue to harm people with systems designed to manufacture products, generate energy, move materials, and improve our lives.
The problem is not that industrial hazards are impossible to understand. The problem is that we have not consistently applied the same investment, discipline, operational learning, and engineering to protecting workers that we apply to surviving hostile threats.
That contrast should disturb us.
I Eventually Drank the Kool-Aid
After several years in general industry, I began accepting the belief that I personally owned everything related to safety.
When someone was injured, I viewed it as my failure, not the failure of the supervisor directing the work, not the manager controlling the department, not the plant leadership team establishing priorities, not the executive team providing resources.
My failure.
I typically escorted the injured employee to the ER. Often, I was the one to inform the spouse of the injury. I sat in the waiting room with concerned spouses and young children. I carried the emotional weight of every injury.
I conducted the investigation, developed the corrective actions, gained support from the affected departments, updated the procedure, and retrained the employees.
Then I repeated the process after the next incident. I was running in circles.
The injured worker usually learned not to repeat the same action. The lesson rarely reached the entire workforce, and the organizational conditions that shaped the event often remained unchanged.
The corrective actions worked for a while. Then the same type of problem returned in a different area, under a different supervisor, involving a different employee.
I eventually realized that this was not simply my personal failure. It was the predictable result of an organizational culture that placed responsibility for safety on one person while leaving operational authority elsewhere.
Rediscovering Human Factors Through HOP
Several years into my civilian career, Corning hired me to lead project safety. Corning was beginning its Human and Organizational Performance journey, and Andrea Baker served as our HOP coach. Andrea had studied under Todd Conklin and later became his colleague in the HOP community. I think of Todd as one of the fathers of modern HOP. I carry with me the lessons learned through Andrea still today.
I do not adopt new ideas quickly. Unless you are my wife, you need a strong argument and a difficult-to-challenge position to change my mind. Andrea changed my mind almost immediately.
What inspired me about HOP was how closely it connected with my previous experience in aviation and Human Factors. The language was different, but the principles were familiar:
Error is normal
Blame fixes nothing
Context drives behavior
Learning is vital
Leadership’s response matters
HOP did not ask me to lower expectations or excuse unsafe conduct. It asked better questions.
Instead of asking who failed, we asked what conditions shaped the decision.
Instead of assuming the procedure described the work, we studied how the work was actually performed.
Instead of treating employees as problems to control, we treated them as people with valuable operational knowledge who solved problems every day.
Instead of trying to eliminate every human error, we looked for ways to prevent a normal mistake from becoming a serious injury or operational failure.
This was Human Factors expressed as an operating philosophy.
The stars aligned. I was working for a world-class global organization that was adopting principles I had lived with for nearly two decades.
HOP Moved from Theory to the Field
We began applying HOP through a pilot program and expanded from there. The operational benefits became visible quickly.
We studied how employees actually completed their work.
We asked what made tasks difficult.
We examined where employees had to reach, lift, twist, compensate, improvise, or work around equipment that had not been designed with them in mind.
Most importantly, we involved the workers. Employees participated from the identification of the problem through concept development, design, trials, revisions, and final implementation.
We designed new tools in-house and had them custom manufactured for specific operations. These were not tools designed by someone in an office and handed to the workforce with instructions to use them. The people performing the work helped create them.
We listened, we learned, we improved the work.
Ergonomic injuries were our most frequent and expensive injury category. The tasks included in the initial pilots improved rapidly, and our broader efforts contributed to a significant year-over-year reduction in ergonomic injuries.
We were proving HOP to ourselves and to the workforce. It was an exciting time, and I was hooked on HOP for life.
HOP Energized the Team
HOP did more than improve our work processes. It energized us as a leadership team.
There were evenings when three or four of us would sit in the office talking about HOP for hours after we should have gone home. Nobody required us to stay. There was no scheduled meeting, corporate initiative, or action item keeping us there. We stayed because we were excited about what we were learning and what we could accomplish with it.
Those conversations were some of the most meaningful and impactful of my career.
We talked about what employees had taught us, how work was actually being performed, and what we could change to make it better. We challenged one another’s assumptions. We discussed new tools, improved processes, and ways to remove obstacles from the work. We applauded the positive results we were seeing, but we never stopped looking for the next opportunity to improve.
Every success generated another conversation. Every improvement made us wonder what else was possible.
The results made that energy stronger. We were not discussing abstract safety theories or creating another program for the corporate binder. We were seeing employees use tools they helped design. We were watching difficult tasks become easier. We were reducing ergonomic exposures and realizing significant improvements in a remarkably short period of time.
We were proving to ourselves, our leaders, and our employees that listening could produce better results than blaming.
It was an exciting and inspiring time. We were a small group of people who genuinely believed in what we were doing, and we could see that our work was making a difference. I miss those guys. I miss that team.
It was a special time in my career, and it showed me what is possible when leaders become as passionate about learning and improving work as they are about measuring its outcomes.
HOP Changed the Questions
Traditional incident investigations often begin with questions such as:
Why did the employee fail to follow the procedure?
Why did the employee take a shortcut?
Why was the employee not paying attention?
Why did the employee make the wrong decision?
HOP asks:
What made the action seem reasonable at the time?
What information was available?
What conditions had changed?
What production or schedule pressures existed?
Was the required tool available?
Did the procedure match the actual task?
Was the employee tired, distracted, or overloaded?
Was the workaround common and accepted?
Had the same action succeeded before?
What normally helps employees perform this work successfully?
Those questions do not excuse the employee’s action. They help the organization learn why the action occurred and whether another employee could make the same decision under similar circumstances.
If the investigation ends with “employee failed to follow procedure,” very little has been learned. As I’ve stated in previous posts, “Employee failed to follow procedure” is not a root cause. It may be a contributing factor but it is not a root cause, and there is nothing to be learned, and no credible action to be taken on that RC.
HOP Is Not the Absence of Accountability
One of the most common criticisms of HOP is that it eliminates personal accountability. It does not. Intentional misconduct, sabotage, impairment, reckless behavior, and knowingly exposing others to serious danger still require an appropriate response.
HOP simply requires the organization to learn before assigning blame. There is a difference between:
A deliberate violation.
An honest mistake.
A routine workaround accepted by supervision.
An adaptation to missing tools.
A decision made under production pressure.
A response to changing field conditions.
An action based on incomplete or misleading information.
Traditional systems often label all these situations “failure to follow procedure.” HOP demands a more accurate explanation.
HOP Is Not Another Safety Program
HOP should not become another binder, annual training requirement, slogan, poster campaign, or initiative owned by the EHS department.
It is an operating philosophy. It changes how the organization:
Plans work.
Responds to failure.
Conducts investigations.
Develops procedures.
Designs tools and equipment.
Engages employees.
Evaluates operational success.
Responds when employees deliver bad news.
Builds capacity for unexpected conditions.
HOP cannot survive if leadership says it supports learning but disciplines people before understanding the event.
It cannot survive if employees are encouraged to report problems but nothing is corrected.
It cannot survive if production pressure consistently overrides established controls.
Leadership response determines whether employees continue sharing what they know.
Learn from Successful Work Too
Organizations usually study work after something goes wrong. That misses most of the available learning.
We are successful more often than we are not, that is where real operational learning exists.
Employees adapt to normal variability every day. They compensate for changing conditions, incomplete information, equipment limitations, production demands, and unexpected problems.
Most of the time, they succeed. HOP studies that success.
What makes the job go well?
Which informal practices help employees manage risk?
Where is the process dependent on employee experience or improvisation?
What would happen if the most experienced person were absent?
Which weak signals are employees noticing before management sees them?
Studying normal work allows the organization to strengthen the system before an injury or failure forces attention. That is operational learning.
Stop Measuring Safety Success by Counting Injuries
Most companies measure safety performance by counting how many people they harmed.
Recordable Incident Rate, DART rate, lost time cases, workers’ compensation costs, and severity rates dominate executive dashboards. These measures have a purpose. Companies must record injuries, evaluate trends, and understand the consequences of failure.
The problem begins when leadership treats the absence of reported injuries as proof that the organization is safe.
Imagine presenting this statement during management review: “Our RIR was 2.1 this year, while the BLS average for our industry was 3.7. We performed better than our industry peers.”
What are we really celebrating?
The company recorded 1.6 fewer cases per 100 full-time-equivalent workers than the industry average. That may be a useful benchmark, but it does not prove the operation was safe. It does not tell leadership whether the difference resulted from strong controls, different exposures, statistical variation, good luck, inconsistent reporting, or employees choosing not to report injuries.
A low injury rate tells you what did not happen, or at least what was not recorded. It does not tell you how close the organization came to a serious event.
Measuring safety success primarily through RIR is not admirable. Treating “we hurt fewer people than average” as evidence of excellence sets the bar far too low.
RIR does not tell leadership:
Whether critical safeguards are functioning
Whether procedures reflect how work is actually performed
Whether employees have the right tools for the job
Whether staffing and scheduling create fatigue or production pressure
Whether workers are comfortable reporting problems
Whether leaders respond constructively when employees raise concerns
Whether lessons from incidents and successful work result in stronger controls
Whether the organization has built enough capacity to fail safely when conditions change
Keep the traditional injury rates because they remain useful lagging indicators. Just stop pretending they tell the entire story.
Luck Is Not a Safety Strategy
A low injury rate does not necessarily mean the organization managed risk well. Sometimes nothing happened because the controls worked. Sometimes nothing happened because the worker recognized a problem and recovered. Sometimes the exposure simply did not produce a consequence.
That last outcome is luck.
A forklift misses a pedestrian by inches. A dropped object lands beside someone. A chemical release occurs when nobody is nearby. An employee catches a machine problem moments before startup. A maintenance technician improvises successfully because the correct tool is unavailable.
Nobody gets hurt. The RIR remains unchanged. Leadership sees another successful month.
But the organization was not safe. It was fortunate.
The absence of an injury does not prove the presence of effective controls. A company can report zero injuries while employees work around defective equipment, incomplete procedures, excessive overtime, production pressure, missing tools, bypassed safeguards, and unresolved hazards.
HOP asks the organization to learn from these events before luck runs out. HOP helps us answer the question “What’s happening when nothing is happening?”
That means examining:
Near misses and high potential (HIPO) events.
Successful recoveries from unexpected conditions.
Safety critical controls that were challenged, bypassed, or unavailable.
Serious injury and fatality precursors.
Work that succeeded despite poor tools, weak procedures, or inadequate resources.
Employee concerns raised before an incident occurred.
Situations where one different decision, movement, or timing change could have produced a serious outcome.
A mature organization does not say, “Nobody was hurt, so the system worked.”
It asks, “Why was nobody hurt, and can we depend on that same protection next time?”
Safety is not demonstrated merely by the absence of a bad outcome. It is demonstrated by the organization’s capacity to anticipate failure, recognize changing conditions, respond effectively, and prevent normal human error from becoming a tragedy.
Luck may get you through today. It is not a safety strategy.
Measure What the Organization Is Learning
A HOP-focused scorecard should show whether the organization is learning from work and using that knowledge to improve the system. Useful measures may include:
Operational learning events completed for routine work, successful work, unexpected conditions, near misses, and incidents
Percentage of learning events that include the employees who perform the work
Gaps identified between work as imagined and work as performed
Weak signals, good catches, and employee concerns that resulted in action
Time between identifying a system weakness and implementing an improvement
Percentage of corrective actions evaluated for effectiveness after implementation
Repeat conditions showing that previous actions failed to address the real problem
Counting learning events alone is not enough. If management creates a quota requiring every department to complete two learning teams each month, the process will quickly become another paperwork exercise.
The quality of the learning matters more than the number of meetings held.
Measure Improvements to Controls
Corrective action counts can also be misleading. Closing fifty actions does not mean the organization reduced risk. Many actions consist of retraining employees, revising procedures, posting signs, or reminding people to be careful.
A stronger measure examines what changed.
The organization should track:
Hazards eliminated from the work
Tasks redesigned to reduce exposure
Engineering controls added or improved
Tools modified or replaced based on worker input
Safety critical equipment restored or upgraded
Procedures simplified to match actual field conditions
Production, staffing, or scheduling conflicts resolved
Improvements that reduce dependence on memory, attention, or perfect human performance
The question is not simply, “Did we close the action?” The better question is, “Did we improve the conditions under which people work?”
Measure Leadership Response
Leadership response is one of the clearest indicators of safety culture.
Do leaders enter the field to learn, or only after something goes wrong? Do they ask employees what makes the job difficult? Do they provide resources when weaknesses are identified? Do they thank workers for reporting problems, or make them regret speaking up?
Useful indicators may include:
Leadership and employee operational learning engagements
Employee concerns receiving a documented response
Improvements funded because of field learning
Time required for leadership to resolve resource barriers
Employee participation in the design and testing of controls
Recurring issues escalated to leaders with authority to resolve them
These interactions must be more than scheduled safety walks where leaders check housekeeping and remind employees to wear PPE. A meaningful engagement should help leadership understand the work, identify barriers, make decisions, and remove conditions that increase the likelihood of failure.
Culture cannot be measured by counting how many times a manager walked through the plant. It can be evaluated by examining what leaders learned, how they responded, and whether employees saw anything improve.
Measure the Capacity to Fail Safely
Organizations should also measure whether the operation has enough capacity to absorb error, equipment failure, unexpected conditions, and normal variability without producing a serious outcome.
That may include monitoring:
Safety-critical maintenance backlogs
Availability and condition of required tools
Reliability of alarms, interlocks, safeguards, and emergency systems
Overtime, fatigue, and staffing levels
Temporary repairs and bypassed controls
Deferred corrective actions involving significant risk
Repeated reliance on administrative controls or individual vigilance
The organization’s ability to stop work without production pressure or retaliation
These measures provide information before someone gets hurt. They show whether defenses are becoming stronger or quietly deteriorating.
A Better Definition of Safety Success
Stop measuring safety success only by how many people were injured.
Start measuring how many people were protected because the organization learned from work, strengthened a control, redesigned a task, replaced an inadequate tool, corrected a leadership decision, or responded to a weak signal before it became an incident.
Ask how many employees participated in operational learning. Ask how many concerns resulted in visible improvement. Ask how many serious exposures were removed. Ask whether leaders created the time, resources, and psychological safety needed for employees to tell the truth about work.
The organization will always need injury statistics. OSHA recordkeeping and industry benchmarking are not going away. But those numbers document outcomes after the system has already succeeded or failed. They do not explain why.
HOP gives the organization a better question: “What are we learning today that will prevent someone from being harmed tomorrow?”
That is not ignoring injuries. It is refusing to wait for an injury before deciding to learn.
Where a HOP Journey Should Begin
An organization does not begin HOP by sending employees to a class and declaring the culture changed. It begins by changing how leaders respond and how the organization learns. Start by:
Asking employees how work is actually performed
Studying the difference between written procedures and field conditions
Conducting learning teams without beginning with a predetermined conclusion
Examining successful work, not only incidents
Involving employees in the design of tools, procedures, and controls
Looking for conditions that make error more likely
Building defenses so one mistake does not create a catastrophic outcome
Evaluating how leadership responds to bad news, stopped work, and reported concerns
Correcting systems instead of relying entirely on retraining and discipline
Verifying whether changes made the work easier and safer
The objective is not to create perfect employees. The objective is to create an organization capable of succeeding even when people are imperfect and conditions change.
Coming Full Circle
HOP did not replace what I learned in aviation, it gave me a way to apply it in manufacturing, chemical operations, construction, process safety, and other industrial environments.
It helped me understand that safety does not come from thicker binders, more slogans, or expecting one EHS manager to prevent every error.
Safety comes from understanding work. It comes from listening to employees, examining context, improving tools, strengthening defenses, and building enough capacity into the system for people to fail safely.
Most importantly, it comes from leaders who are willing to learn.
Appalachian EHS & Process Safety Consulting helps organizations integrate Human and Organizational Performance into leadership practices, incident investigations, operational learning, procedure development, field assessments, and management systems.
HOP is not about blaming the worker. It is not about blaming the process either. It is about understanding the entire system well enough to make the next outcome better.