The Human Cost of Getting It Wrong · Issue 4 of 5
Crew Endurance and Crewing Models: The Design Constraint Programmes Assume Away
The spreadsheet shows enough bodies rotating through enough watches. Whether those people survive the real operational tempo is a hypothesis somebody has to test before signature.
A crewing model is a hypothesis about human endurance, and it is only true if it is validated against the worst realistic operational tempo before contract signature. Crew endurance is a design constraint: the work-rest model belongs in the safety case, tested and certified, because a crew that cannot be sustained cannot generate the capability the platform was bought to provide. The Armidale class, retired early after its planned work-week model failed against near-continuous border operations, is the clean example.
Why is a crewing model a hypothesis?
Every capability programme has a crewing model, and most of them work beautifully on paper. The spreadsheet shows enough bodies, rotating through enough watches, to keep the platform manned. What the spreadsheet almost never shows is whether that model survives contact with real operations: the surge that runs for months instead of weeks, the transit times nobody costed, the maintenance burden that lands on the same people who are already standing watch. A crewing model is a hypothesis about human endurance. It is only true if someone tests it against the tempo the platform will actually face.
What did the Ajax review reveal about endurance culture?
Ajax exposes the cultural version of this failure. The UK Ministry of Defence’s own review found that the Army did not believe it was harming its people, because it was tacitly expected that soldiers can and should endure such issues. Read that again. The assumption was not that the design would protect the crew but that the crew would absorb whatever the design failed to deliver. Endurance was treated as an infinite, free resource, and when you treat human endurance that way you stop designing for it, because there is apparently nothing to design for. Safety and sustainability quietly become subordinate to schedule, and optimism does the rest.
What happened to the Armidale class crews?
Australia has a clean maritime example. When the Armidale class patrol boats were acquired, the ANAO explicitly scoped crewing sustainability as an audit concern: a human-systems red flag raised at the acquisition stage, not in hindsight. The Safety Case Report, the document that certifies a vessel is safe to operate in a defined way, had not been delivered when the contract was signed. The programme proceeded anyway. Then the boats went to work on near-continuous border operations, with long transits and a punishing maintenance load falling on small crews. Post-delivery research found that the standard work-week model the Navy planned around could not absorb the actual operational tempo of the class. The crewing hypothesis had not survived contact. The boats were eventually retired without completing their planned life extension, the human and material strain having compounded for years.
Where does aviation fit?
Aviation lives with this too. Fatigue is one of the most thoroughly documented risk factors in military flying, which is why crew duty limits and rest cycles exist at all. This piece does not attach fatigue to any single accident, because causation in aviation is rarely that tidy. Anyone who has run high-tempo operations knows the rest: a tired crew is a degraded crew, and the degradation is invisible right up until it is not.
How is crew endurance validated as a design constraint?
In Human Systems Integration this is the workforce and personnel domain, and the discipline is concrete. Crew endurance is a design constraint rather than a staffing afterthought. You validate the crewing model against the real operational profile, meaning the worst realistic tempo rather than the brochure case, before you sign. Fatigue risk is a capability requirement, because a crew that cannot be sustained cannot generate the capability the platform was bought to provide. The work-rest model is part of the safety case, tested and certified, not a planning assumption that gets quietly broken in service and blamed on the people breaking under it.
Here is the pattern worth remembering. The crewing model is almost always the first thing to fail when a platform meets real operational pressure, and almost always the last thing anyone formally validated before that pressure arrived. We certify the engine, the hull, the weapon. We assume the people. Then we are surprised when the people are the part that runs out.
If you run a capability programme, or you sustain any high-tempo crewed operation, the question of whether your crewing model survives the real profile is one an independent review answers directly.
Frequently asked questions
Why is a crewing model called a hypothesis?
Because on paper it only shows enough bodies rotating through enough watches. Whether those people can sustain the platform’s real tempo, with surges, transits and maintenance load included, is an empirical question that has to be tested against the worst realistic operational profile rather than assumed.
What happened with the Armidale class?
Crewing sustainability was flagged by the ANAO at acquisition, the Safety Case Report had not been delivered when the contract was signed, and the boats then ran near-continuous border operations that post-delivery research found the planned work-week model could not absorb. The class was retired without completing its planned life extension.
How should crew endurance be treated in a capability programme?
As a design constraint validated before signature: the crewing model tested against the worst realistic tempo, fatigue risk carried as a capability requirement, and the work-rest model certified as part of the safety case.
Three or more red flags means an unassessed exposure
The Seven HSI Red Flags checklist is one page. If you tick three or more, your programme or operation has a human systems exposure that has not been formally assessed. Optimised Human Performance conducts fatigue risk management and crewing sustainability reviews built for exactly this question.
Download the Seven HSI Red Flags