Incident reduction and risk migration
Introduction
Although mid-air collisions involving commercial airliners are rare (see EASA, 2009), incidents entailing a loss of standard safe separation between aircraft are relatively more frequent. Whilst undesirable, it is such incidents that enable risk and safety specialists to detect unsafe trends and to forestall accident potential. Losses of standard minimum separation between aircraft (typically 1000 ft vertical separation or five nautical miles lateral separation) may be reported by air traffic controllers, or by pilots, or by both, or even recorded automatically where there is such radar-based technology installed. Such incidents, unless very minor, will be investigated to understand their causes and to see if counter-measures are warranted. Most commonly, incident analysis may lead to some re-training or a procedural amendment, or (less usually) a change to airspace design or the controller’s human–machine interface. Sometimes however, a more complex and systemic picture emerges, particularly if an incident pattern or trend, i.e. a set of incidents with common characteristics, arises.
The working assumption is that we can learn from such events, preferably so that the events stop before loss of life or other significant damage occurs. Mistakes will inevitably occur, but it is the responsibility of an organisation to learn from mistakes (see Brooker, 2008, Johnson et al., 2009). But what happens when an incident trend is resolved, only to return later in a more problematic form? This can be termed risk migration (Kirwan, 2001, Kirwan, 2006) and represents a special case for safety learning. It implies that deeper forces are at work. These will require more fundamental approaches to incident analysis and resolution, to achieve sustainable learning. These deeper forces may be considered as a pressure on the system: when a weak spot leaks and is then fixed, the pressure returns and so can re-appear at the next available weak spot. Such pressure in the Air Traffic Management (ATM) context today can arise from increasing traffic (public demand for flights and travel), as well as commercial pressure to reduce costs in order to remain competitive and in business. This concept emanates from earlier work and precepts by Rasmussen (e.g. Svedung and Rasmussen, 1998), who considered organisational decision-making under pressure from fast technological change.
This paper explores this idea via a case study in risk migration in the area of ATM, a very safe industry in terms of accident statistics. Since this domain is heavily dependent on air traffic controllers, a Human Factors paradigm is the most appropriate one for analysis of such incidents. The following section therefore outlines the Human Factors framework that was used to analyse the trends in both sets of incidents. The two incident trends are then characterised and their resolution explained. The remainder of the paper then explores the potential factors which led to the migration, and considers the implications for incident analysis and reduction in industrial systems.
Section snippets
Human Factors framework
Since ATM is primarily a human-controlled system, one that is very reliable, it is not surprising that when things do go wrong this is seen as ‘human error’. Thus, incident investigation systems and taxonomies often focus on the Human Factors, whether causal or contributory, that were deficient and led to the error and hence the incident. This does not mean that the human is blamed – in fact the reverse, since the Human Factors classification approaches are usually systemic in nature, and
Characterisation of the incident patterns
Caveat: before going into the analysis it must be stated that the analyses and their implications are focusing on a very small proportion of controller performance – the controllers in almost all cases exhibit exemplary performance. However, in some rare cases ‘errors’ are clearly occurring, and will be likely to recur unless further steps are taken to increase safety.
Preventing further risk migration
The first obvious question for the flying public is whether the incidents have stopped; the answer is yes. Some, but not all of the above counter-measures listed above were addressed by the Centre, as shown in Table 1. The incident trend has disappeared (the problem is resolved at this time).
The ‘killer questions’ that remain, however, are how we know these measures are the right ones, and how we measure if they are working. At this time the only clear result is that the problem disappeared.
Conclusions
This paper has presented a case study of risk migration, using two incident analyses to illustrate the phenomenon and to raise questions about how it can be addressed. The first incident was ‘cured’ relatively easily, but the underlying pressures on the system led to a more complex variant of the problem within a few years. This second incident pattern required a more systemic solution set incorporating human, technological and organisational counter-measures. It also required back-up in the
Disclaimer
The opinions expressed in this paper of those of the author alone, and do not necessarily reflect those of EUROCONTROL, or its employees, or any affiliated organisations.
Acknowledgements
The author would like to thank the various people from the ATM centre in question, who will remain anonymous, for their time, insight and candour. The author would also like to thank Veronique Begault who participated in the controller debriefs, for her insights on the contributory factors.
References (25)
The Uberlingen accident: macro-level safety lessons
Safety Science
(2008)- et al.
Human error in European Air Traffic Management: the HERA project
Reliability Engineering and System Safety
(2002) - et al.
Recognition primed decision-making and the organisational response to accidents: Uberlingen and the challenges of safety improvement in European air traffic management
Safety Science
(2009) The paradoxes of almost totally safe transportation systems
Safety Science
(2000)- EASA, 2009 Annual Safety Review. European Aviation Safety Agency, Ottoplatz 1, D-50679 Cologne, Germany....
Measurement of situation awareness in dynamic systems
Human Factors
(1995)- EUROCONTROL, 2008. Safety Culture White Paper. EUROCONTROL-FAA AP15, EUROCONTROL, Rue de la Fusee, Brussels....
- Gordon, R., Kirwan, B., Mearns, K., Kennedy, R., Jensen, C.L., 2007. A Safety Culture Questionnaire for European Air...
- ICAO, 2005. Threat and Error Management in Air Traffic Control, ICAONET, October 6....
Network workshop introduction
Safety Science Monitor
Cited by (22)
An introduction to air traffic control and the application of human factors
2022, Human Factors in Aviation and Aerospace, Third EditionAn integrated approach to near miss analysis combining AcciMap and Network Analysis
2020, Safety ScienceCitation Excerpt :In contemporary safety science philosophies such as Safety II (Hollnagel 2014) and Safety Differently (Dekker 2012, 2014) there is an assumption that effective work practice drives safe system outcomes, including preventing near misses from turning into accidents (Thoroman, Goode, and Salmon 2018, Foster, Plant, and Stanton, 2019). The scholars aligned with these philosophies argue that effective safety management should include investigation into what went right as well as what went wrong (Hollnagel 2014, Dekker, Cilliers, and Hofmeyr 2011, Kirwan 2011, Kyriakidis et al. 2017, Rasmussen, 1997, Leveson 2011b). Protective factors related to what went right have been shown to play a critical role in preventing near miss incidents from progressing to accidents (Thoroman et al. 2019).
Investigating work-related musculoskeletal disorders: Strengths and weaknesses of current practices in large Australian organisations
2019, Safety ScienceCitation Excerpt :This allows participants to better understand the tasks they do not directly influence, and the consequences of their decisions (Rollenhagen, 2011). Emergent and potential unintended consequences also need to be considered during this stage (Kirwan, 2011; Lundberg et al., 2009). Disseminating the lessons learned across the organisation is often seen as instrumental in overcoming the challenges associated with initial implementation of recommendations, and maintenance over time (Jacobsson et al., 2012; Lindberg et al., 2010; Ramanujam and Goodman, 2011).
The risk of an air accident as a result of a serious incident of the hybrid type
2015, Reliability Engineering and System SafetySafety management - A multi-level control problem
2014, Safety ScienceCitation Excerpt :One difficulty seems to be that the systems involved encompass very diverse areas of knowledge and modelling approaches, making it hard to find a common language for describing different aspects of system behaviour. Many authors have argued that systemic approaches to safety should be applied (Bang Dyhrberg and Langaa Jensen, 2004; Kirwan, 2011). We generally support such approaches.