Where high reliability came from

High reliability wasn't invented in a laboratory. It was pieced together from wreckage and near misses by investigators and researchers who kept asking one question from different directions: when a complicated system fails, what actually failed?

Over and over, the answer was rarely a single careless person. It was a chain of small weaknesses that lined up on the wrong day, and a group of capable people who, for reasons that made sense at the time, didn't catch it. This page follows that question from 1935 to 2026. It ends at a gap researchers have only recently named: the patient at the center of all this care is running a safety-critical system too, and almost nobody has taught patients how.

1935: too much airplane

On October 30, 1935, during the Army's evaluation of new bombers at Wright Field in Ohio, Boeing's Model 299 took off with an experienced Army test pilot, Maj. Ployer P. Hill, at the controls. The prototype of the B-17 climbed a few hundred feet, stalled and crashed. Hill and Boeing's chief test pilot, Leslie Tower, died; three others survived. The cause was almost mundane. The gust locks that hold the elevators and rudder steady while the airplane sits on the ground had never been released.

When the surgeon and writer Atul Gawande retold the story in The New Yorker in 2007, he quoted one newspaper's verdict that the bomber was "too much airplane for one man to fly." The response wasn't a lecture about carefulness. It was a checklist, and Gawande reported that pilots went on to fly the Model 299 1.8 million miles without one accident. As the museum historian Douglas Lantry put it in a Military Officers Association of America article, pilots "needed consistent, repeatable steps to be certain they flew safely every time."

Hill was no novice. The airplane had simply outgrown what one person could reliably hold in memory. A body managed across several doctors, a dozen prescriptions and years of test results has outgrown it too.

1977 to 1979: the people in the room knew

Four decades later, aviation and nuclear power learned a harder lesson. The equipment can be sound and the checklists followed, and the crew can still fail, because of how the people in the room talk to each other.

On March 27, 1977, in thick fog at Los Rodeos airport on Tenerife, a KLM 747 started its takeoff roll without clearance while a Pan Am 747 was still on the runway. 583 people died, the deadliest accident in aviation history. The cockpit voice recorder caught the moment it could have been stopped. Thirteen seconds before the collision, the KLM flight engineer asked, "Is he not clear, then?" The captain said yes. The engineer had the right worry, voiced it as a question to a senior colleague and let it go.

Twenty-one months later, on December 28, 1978, United Airlines Flight 173 circled Portland, Oregon, for about an hour while its crew worked on a landing-gear problem. The DC-8 ran out of fuel and crashed into a Portland suburb. The National Transportation Safety Board found that the captain's "inattention resulted from preoccupation with a landing gear malfunction," and that the other two crew members had failed "to fully comprehend the criticality of the fuel state or to successfully communicate their concern to the captain."

Three months after Portland, nuclear power got its version of the same lesson. At about 4 a.m. on March 28, 1979, a relief valve at Unit 2 of the Three Mile Island plant stuck open while instruments in the control room told operators it had closed. Not realizing that coolant was escaping, they took steps that uncovered the reactor core, and it partially melted down. Releases beyond the plant were very small, and the Nuclear Regulatory Commission reports no detectable health effects. What the accident showed was how a reassuring reading can steer capable people the wrong way.

The responses set a pattern that the rest of this history repeats. The NRC tightened its requirements for operator training and staffing, instrumentation and emergency preparedness, and the industry created the Institute of Nuclear Power Operations late in 1979 to hold its own plants to a higher standard. In June of that year, NASA and the airlines had met in San Francisco for a workshop on "resource management on the flight deck", which is generally treated as the start of crew resource management: training that teaches every member of a crew to speak up, and every captain to listen.

1984: two answers to one question

In the years after Three Mile Island, two very different theories of safety took shape, and both date to 1984. Charles Perrow's Normal Accidents argued that when a system's parts interact in complex, hard-to-follow ways and are tightly coupled, so that one failure spreads before anyone can step in, serious accidents are inevitable. They are "normal," in his word. Worse, each safeguard you add can bring complexity, and new ways to fail, of its own.

That same year three researchers at the University of California, Berkeley, Todd La Porte, Karlene Roberts and Gene Rochlin, turned the question around. Some organizations run hazardous, tightly coupled technology for years without a disaster, so what do the people there do all day? They studied air traffic control, Pacific Gas and Electric's power grid including the Diablo Canyon nuclear plant, and above all Navy aircraft carrier flight operations. In a 1987 paper they called the carrier deck the activity closest to "the edge of the envelope," run by "a young and largely inexperienced crew" in an organization that has to rebuild itself about every eighteen months.

What they found looked less like a rulebook than an attitude. Kathleen Sutcliffe, who later helped turn the research into management practice, recalled in a 2017 interview how Rochlin summed it up: "these are organizations that seek perfection but they know they're not going to achieve it." The studies of high reliability, she said, "originated in the 1980s, as a contrast to Perrow's normal accident theory."

For a patient, both camps have something to say. Perrow explains why your care will sometimes fail however good your doctors are: modern medicine is complex, and at moments like a hospital discharge it is tightly coupled too. The Berkeley group explains what the people who beat those odds do differently, and most of it can be learned.

1986: when a warning becomes normal

On January 28, 1986, the space shuttle Challenger broke apart 73 seconds after liftoff, and all seven crew members died. Engineers had recommended against launching below 53°F. At liftoff it was 36°F, according to a Columbia Magazine retrospective.

The joint that failed had surprised no one. Its O-rings had shown erosion on earlier flights, and the presidential commission found that the problem had been "finally treated... as an acceptable flight risk." Every flight that came home safely made the next one feel safer. In his appendix to the commission's report, the physicist Richard Feynman put it plainly: "When playing Russian roulette the fact that the first shot got off safely is little comfort for the next."

In 1996 Diane Vaughan gave the pattern a name in The Challenger Launch Decision: the normalization of deviance, the slow process by which a warning sign that doesn't immediately cause harm comes to seem acceptable.

"For a successful technology, reality must take precedence over public relations, for nature cannot be fooled." Richard Feynman, Appendix F to the Rogers Commission report, 1986

Every body produces its own version of O-ring erosion. Imagine a cough that has lasted six weeks, a mole that has changed shape, a blood pressure reading that was "a little high" at the last two visits. Each time nothing bad happens, the sign gets easier to live with. The first step of Dr. Scott's protocol, self-awareness, exists to interrupt that drift.

1990 to 2001: holes in the cheese, and five habits

By the end of the 1990s the field had two big ideas. The first came from James Reason, whose book Human Error appeared in 1990 and whose 2000 paper in the BMJ carried his model into medicine. Reason separated "active failures," the unsafe acts of people in direct contact with the patient or system, from "latent conditions," the "resident pathogens" that designers and managers build into a system and that can lie dormant for years. A system's defenses, he wrote, are like slices of Swiss cheese with many holes. The holes open, close and move, and harm gets through only when they line up.

The second idea came from Karl Weick and Kathleen Sutcliffe. In 1999, with David Obstfeld, they described reliability as something people achieve continuously through collective mindfulness, not something an organization earns once and keeps. In 2001 their book Managing the Unexpected distilled what had been learned into five principles, which the Agency for Healthcare Research and Quality now uses to explain high reliability to hospitals. Three are about anticipating trouble and two are about containing it once it starts. Dr. Scott built the SCOTT Protocol on them.

1999 onward: medicine counts its own errors

Medicine came to all of this late, and it came because of a number. In 1999 the Institute of Medicine's report To Err Is Human estimated that medical errors killed at least 44,000 Americans in hospitals each year, and perhaps as many as 98,000. The figures were extrapolated from studies in Colorado, Utah and New York and have been argued over ever since, but the report is widely regarded as the start of the modern patient safety movement. Its authors wrote that it "would be irresponsible to expect anything less than a 50 percent reduction in errors over five years."

The real test was whether ideas from cockpits and control rooms would work at a bedside. Two studies suggested they could. In 2006, Peter Pronovost and colleagues reported on intensive care units that adopted a checklist-style bundle of practices against catheter bloodstream infections, along with work on safety culture. In the 103 units that reported data, the median infection rate fell from 2.7 per 1,000 catheter-days to zero within three months. In 2009 a team led by Alex Haynes tested the World Health Organization's 19-item surgical safety checklist in eight hospitals in eight cities, with the results below.

Turning one good project into a way of operating proved harder. In 2013 Mark Chassin and Jerod Loeb laid out what high-reliability health care would take: a 14-part framework with stages of maturity. Hospitals can't apply the methods of a carrier deck directly, they argued. Getting there takes incremental change built on leadership's commitment to zero patient harm, a strong safety culture and tools for improving processes. Their verdict was cautiously hopeful: "Hospitals can make substantial progress toward high reliability." Zero harm, the commitment their framework asks of hospital leaders, is also the goal behind the fifth SCOTT step, taking action.

2026: the layer nobody trained

Look back over this history and notice who is missing. Every study, checklist and maturity model here is aimed at an organization: a flight crew, a reactor staff, a hospital unit. The patient appears mostly as the person who gets hurt when the system fails.

That is starting to change. In a 2026 study of cancer care teams, Megan Salwei and colleagues interviewed 17 clinicians and 8 patients about high reliability in everyday practice. They found that patients and their family caregivers "were primarily responsible for monitoring their health," and that patients "developed expertise throughout treatment, thereby supporting system safety." Resilience, they wrote, "relied on individual actions rather than system-level processes and structures." They called for more research at the level of individuals as well as teams and organizations.

Patients were already doing the monitoring. Nobody had handed them the method.

Each chapter of this history leaves you something you can use. Because of the Model 299, keep a written list of your medications and diagnoses rather than trusting memory in an exam room. Tenerife argues for saying a worry as a statement ("I'm concerned this could be my heart") instead of a question that's easy to wave off. From Three Mile Island, ask for the actual number behind "your labs look fine." Challenger's lesson is the hardest to follow, since it means taking a fresh look at a symptom you've lived with for weeks and stopped noticing. And Reason's cheese says to confirm every handoff yourself; each one is a slice with holes in it.

High reliability science was built for organizations. Applying it to one person's health is a newer idea, and it is the one Dr. Carol J. Scott, an emergency physician, built the SCOTT Protocol around: five habits from cockpits, control rooms and carrier decks, rewritten for the person who sees every appointment, every prescription and every reading of one particular body. That person is you.

Last updated October 16, 2026. Guidance cited here was current on that date; clinical guidelines change, so check with your own clinician. See our editorial policy.