Design Beats

Every safety manager has written the memo. The pre-use checklists are being ticked without anyone looking. The end-of-shift questions are being answered before the shift starts. Witness statements all sound the same. Please take the time to do these properly. The memo goes out, things improve for a week, and then the forms go back to what they were. That is not because crews do not care. It is because the form never changed.

The aviation world learned this long ago. Its own guidance on maintenance human factors treats "pencil-whipping" as a predictable result of time pressure and norms, not a character flaw, and it answers it with design: independent checks, procedures that fit the job, and systems that make the shortcut harder than the real thing.¹ We think compliance software should be built the same way. When the data is bad, look at the shape of the tool before you look at the people using it.

“A rule gets argued with. A shape does not.”

Answer the question when it can be answered

A field level hazard assessment ends with four questions about the shift: was anyone hurt, was there a near miss, was work stopped, is there a concern. On paper they sit at the bottom of the same page as everything else, so they get answered at 7 a.m., about a shift that has not happened yet. Nobody is lying on purpose. Finishing the page feels like finishing the job.

In FieldTec the end of the shift is a second step on a record that already exists. It is shown at 7 a.m., locked and flagged, so the worker knows the assessment is not finished, and it unlocks a set number of hours later (four by default, set by each company). There is an override, because a gate with no way through gets worked around with a second, fake assessment, but the override asks for a reason and keeps it. Every time is taken from the server, not the phone, so it cannot be changed in Settings. And the time it was answered is on the record, so "answered ten minutes after filing" becomes a question a supervisor can ask rather than a suspicion.

Do not put words in a witness's mouth

Many incident forms offer quick-pick reasons: slipped, distracted, rushing, not wearing PPE. They are fast, and that is the problem. A worker writing a statement after an incident will often pick the option that is already there, and the investigation starts from a guess the form suggested. Our PIN (preliminary incident notification) and witness capture deliberately offer no reason chips and no leading prompts. It takes a little longer. What you get back is the worker's own account, which is the only thing an investigation can build on.

The evidence for this is half a century old. In 1974, Elizabeth Loftus and John Palmer showed people film of a car crash and asked how fast the cars were going when they "hit" each other. Other groups heard "smashed", "collided", "bumped" or "contacted". One word in the question moved the answer by nine miles an hour.²

A week later the same people were asked whether they had seen broken glass. There was none in the film. Of those who had heard "smashed", 32% said yes; of those who had heard "hit", 14%.² The question did not just colour the answer. It added something to the memory. A form that offers "rushing" as a cause before anyone has said a word is asking the same kind of question.

A finding has to go somewhere

An inspection that finds a cracked mirror and a checklist that records "No" next to a fire extinguisher both end the same way in most systems: as a line in a report nobody owns. In FieldTec every module can turn a finding into an action item with a named owner and a due date, and the item remembers which record raised it. One open item per finding, so the same problem is not tracked twice, and raising one is a deliberate button rather than an automatic side effect, so the list stays work that actually needs doing.

The record is the record

The last piece is quieter. When someone signs a hazard assessment, they confirm the exact wording in front of them. If that wording is corrected next year, their record must not quietly change with it, or the document would claim they confirmed something they never read. So FieldTec copies the wording into the record at the moment of filing, and the screen and the exported PDF both read that copy. A draft says it is a draft, in the file name as well as on the page, because by the time a file is in somebody's inbox the banner is easy to miss.

None of this proves what happened on a shift. Somebody determined to cut a corner still can. The point is narrower and more useful: make the honest path the easy one, make the shortcut take deliberate effort, and make the pattern visible to the people whose job is to notice it. Discipline still matters. It just should not be the only thing holding the system up.