Next Article in Journal
Application of the Fuzzy CODAS Method Based on Fuzzy Envelopes for Hesitant Fuzzy Linguistic Term Sets: A Case Study on a Personnel Selection Problem
Previous Article in Journal
Solving the Gap Equation of the NJL Model through Iterations: Unexpected Chaos
 
 
Order Article Reprints
Font Type:
Arial Georgia Verdana
Font Size:
Aa Aa Aa
Line Spacing:
Column Width:
Background:
Article

A Case Study of Fishbone Sequential Diagram Application and ADREP Taxonomy Codification in Conventional ATM Incident Investigation

1
School of Aerospace Engineering, Universidad Politécnica de Madrid (UPM), D. de Sistemas Aeroespaciales, Transporte Aéreo y Aeropuertos, Plaza Cardenal Cisneros n3., 28040 Madrid, Spain
2
Aeronautic, Space & Defence Division, ALTRAN Innovacion S.L., Calle Campezo, 1, 28022 Madrid, Spain
3
School of Aerospace, Transport and Manufacturing, Cranfield University, Centre for Aeronautics, Cranfield MK43 OAL, UK
*
Authors to whom correspondence should be addressed.
Symmetry 2019, 11(4), 491; https://doi.org/10.3390/sym11040491
Received: 18 March 2019 / Revised: 29 March 2019 / Accepted: 2 April 2019 / Published: 4 April 2019

Abstract

:
This paper aims to present the application of a fishbone sequential diagram in air traffic management (ATM) incident investigations performing as a key connection between safety occurrence analysis methodology (SOAM) and accident/incident data reporting (ADREP) approaches. SOAM analysis is focused on organizational cause detection; nevertheless, this detection of individual causes from a complete incident scenario presents a complex analysis, and even more, the chronological relationship between causes, which is lacking in SOAM, should be tracked for post-investigation analysis. The conventional fishbone diagram is useful for failure cause classification; however, we consider that this technique can also show its potential to establish temporal dependencies between causes, which are categorized and registered with ADREP taxonomy for future database creation. A loss of separation incident that occurred in the Edmonton area (Canada) is used as a case study to illustrate this methodology as well as the whole analysis process.

1. Introduction

Air transportation systems are evolving towards multifaceted, hyper-dimensional, highly distributed, and mutually dependent systems with levels of complexity not imaginable just a few decades ago [1]. Maintaining extremely high levels of safety in this complex environment is more challenging than it was in the past.
Stakeholders should gather, monitor, and study safety-related information to predict and anticipate, not only actual, but also emerging safety risks. In this situation, safety analytics need to improve to forecast future safety risks and safety performances. It is of paramount importance that techniques and methods for identifying and predicting adverse safety events are engineered and used broadly. Only then will it be possible to use safety events and occurrence information to improve safety and to protect the air transportation system from any adverse impacts of increased systemic complexity.

1.1. Literature Overview of Aviation Safety Analysis

To keep up the pace, aviation is involved in a shift from reactive, traditional approaches towards more proactive methods; that is, from compliance-based safety towards safety performance-based methodologies [2,3]. This shift is sustained in a set of paradigms:
  • The evolution from Safety-I to Safety-II, descripted by Hollnagel [4], with Safety-III as a combination of Safety-I and Safety-II concepts and approaches in consideration. Safety-I is concerned with infrequent events that go wrong in a stable environment, and Safety-II is concerned with the more frequent events that go right in a non-stable environment. Safety-I and Safety-II differ in their ontology, but they represent two complementary views of safety.
  • New safety methods and models to learn from both previous approaches and stories of success and failure, and to represent the complexity of modern socio-technical systems and the dynamics of the interactions between humans, technical systems, and the environment. These methods include epidemiological models [5,6,7]; systemic accident models, such as the system-theoretic accident model and processes (STAMP) [8] and the functional resonance analysis method (FRAM) [9]; agent-based models [10]; etc.
  • The reporting and evaluation of serious and less serious safety events. Relevant civil aviation occurrences are reported, stored, exchanged, analyzed, and disseminated with the aim that appropriate emergent safety events and risks can be identified, and safety actions can be taken. The effective, proactive, and clever exploitation of this safety data is key to coping with safety improvement in the complex upcoming air transportation system.
Despite the Hollnagel construction of Safety III as the integration of traditional safety methods (Safety-I) and modern safety approaches (Safety-II), the three previous paradigms are still lacking interconnection today. Classic safety methods, such as sequential models, are disregarded and discarded in favor of more complex and recent approaches because of their limitations, missing the potential of a multi-method perspective in the context of safety management. However, new safety methods are complex and labor intensive and cannot be directly and straightforwardly applied to the analysis of the data and information complied in aviation safety databases. Additionally, the potential of aviation safety databases for detecting and predicting emergent safety events has not yet been fully exploited. Despite a solid culture of notifying safety events and occurrences, aviation has not yet fully succeeded in extracting the maximum amount of safety data from this information.
Statistics on serious and less serious incidents can provide a great amount of safety information. Safety authorities, such as the FAA, EASA, ICAO, and EUROCONTROL [10], have invested a great deal of effort in the identification of safety monitoring information and performance indicators. Specifically, ICAO Annex 13 [11] requires that member states establish reporting systems for accidents and incidents to gather information on real and potential safety shortcomings. European Regulation (EU) No 376/2014 [12] makes mandatory the reporting, analysis, and follow-up of civil aviation incidents. Moreover, the European Union has created a database, the European Co-ordination Center for Accident and Incident Reporting System (ECCAIRS), with common standard collection and exchange of aviation accidents and incidents. ECCAIRS implements the ICAO accident/incident data reporting (ADREP) taxonomy for collecting, sharing, and analyzing safety information between National and European transport entities. ECCAIRS complies with Regulations No. 996/2010 [13] and No. 376/2014 [12] in terms of occurrence reports as well as safety recommendations. Regarding this policy, the analyzed causes of all investigated incidents should be identified with their corresponding ADREP taxonomies and recorded in a common database through ECCAIRS.
Thanks to these dispositions, among others, today more safety data than ever are gathered; however, only a small part of them is fully exploited, integrated, analyzed, processed, and used for the best understanding of safety risks. New challenges have appeared to analyze the information available in these big databases. The challenge is to take advantage of the volume of data, integrate data from hundreds of sources, and extract knowledge from the test of the reports.
The adaptation of symmetry methods for safety signal detection might result in faster detection of safety emergent issues in aviation. Symmetry analysis techniques are successfully applied today in safety critical industries for safety signal detection from occurrence reporting databases. For example, disproportionality analysis and sequence symmetry analysis are broadly accepted for safety signal detection in healthcare databases [14]. Symmetry-based regression models have started to be employed in road for safety analysis [15]. However, these types of methods and approaches have not yet been applied in aviation to explore safety occurrence databases. Aviation, despite its high level of safety, is lagging behind other industries regarding the application of advanced data science and data mining methods to the early detection of safety signals.
Reports in the aviation occurrence databases need to be pre-processed to facilitate the safety knowledge that can be derived from their contents. Unfortunately, systemic accident models, variability methods, or agent-based models, although very powerful for understanding complex systems, cannot be directly applied to the reports in the safety databases. In order to take maximum advantage of these methods applied to such large databases, important pre-processing and pre-computational work need to be done. Occurrences and events in the databases need to be systematized to extract relevant safety information and to allow more complex methods to be applied on a common ground. Due to the low level of detail of the information contained in the safety reports and the large amount of reports to be analyzed in these databases (the European occurrence reporting system might receive around 900,000 reports per year), the methods to perform this analysis should be simple, powerful, cost effective, and at the same time dependable.
For this task, modern methods might give way to older methods, such as sequential and epistemological methods, that, despite being overcome by more complex approaches in their attempt to explain how accidents happen in socio-technical complex systems, might still play a useful role in the systematization of the preprocessing of occurrence databases. In particular, sequential and epistemological models can be particularly tuned for this task when combined with other well-adopted and -consolidated safety tools, such as aviation safety taxonomies.
In this work we proposed to reactivate the use of fishbone or Ishikawa diagrams, a sequential method [16,17,18], in combination with the safety occurrence analysis methodology (SOAM), an adaptation of the reason model (an epistemological method) by EUROCONTROL [19], and with the ADREP taxonomy, the most complete aviation safety taxonomy developed by ICAO.
Sequential models have the potential to describe safety events as the consequence of a sequence of events in a specific order. Due to the assumption of well-defined cause–effect relationships that facilitate the propagation of the effects of events into an accident, they are not capable of properly explaining complex accidents characterized by a large number of interactions between humans, technical systems, and the dynamics of these interactions. However, this method can be very useful for classification of the causes of failure and to establish temporal dependencies between causes.
The SOAM approach contributes to the identification of causes in an incident scenario [20]. This approach is an exhaustive process for analysis of data collected during the investigation of a safety occurrence and for providing recommendations. It was developed from the reason model, taking the SHELL model as the basis for construction. It should be highlighted that the human involvement consideration in SOAM includes analysis of the latent conditions within the organization. SOAM has already been integrated by EUROCONTROL with other phases of investigation and widely applied by all CAAs of EU members. The reason or Swiss chess model is widely applied for organizational decision-making in safety-critical systems. Notably, the involvement of human factors in accidents are investigated in-depth and documented; researchers like Neuhaus et al. [21] and Wahab et al. [22] have used this model for analyzing human behavior during critical incidents, even attempting to combine it with a BN (Bayesian network) model for taking preventive measures. The detection of individual causes from a complete incident scenario presents a complex analysis; furthermore, the chronological relationship between causes should be tracked. However, the SOAM approach is unable to provide a chronological relationship between causes, which we consider a relevant step for a post-investigation analysis to understand their temporal dependencies. The fishbone diagram can improve this limitation during incident analysis. Unlike most of the research works [23,24] where fishbone diagrams only present static relationships between factors involved in the accident/incident scenarios, in this research, the Ishikawa technique acts as a temporal axis connecting all causes detected with SOAM and codified with the ADREP taxonomy to represent incident stages.
In the safety literature related to safety modeling, different comparison studies are cited, such as Mogles [25] comparing STAMP and ABM (agent-based modeling) models for aviation incident analysis; Underwood [26] using ATSB, AcciMap, and STAMP models for train derailment analysis; Smith [27] applying FRAM, FTA (fault tree analysis), and BN for understanding industrial safety, etc. Based on this literature review, limitations of sequential methods for the explanation of complex accidents against more holistic approaches are presented in Table 1. Despite their differences, the three types of models follow a common logic that incorporates additional steps when moving from sequential up to systemic, passing through epidemiological. Figure 1 compares the scope of the three methods according to the level of coupling and how much they consider the socio-technical context. It also summarizes the logic of the steps mentioned.

1.2. Proposed Approach

In this paper, we acknowledge limitations as well as strengths of the different types of methods and propose a different application for the more conventional sequential methods in a pre-processing phase, in combination with epistemological methods, such as SOAM, and the most complete and up-to-date aviation safety taxonomy: ADREP.
This work proposed to reactivate the use of a sequential method, the fishbone or Ishikawa diagrams, in combination with an epistemological method, the safety occurrence analysis methodology (SOAM) which is an adaptation of the reason model by EUROCONTROL, and with the most complete aviation safety taxonomy developed by ICAO, ADREP taxonomy.
This approach allows a new interaction among traditional and new safety methods. A triplet of more conventional and somehow simpler safety methods and tools are used to pre-process information in safety occurrences, paving the way for the further exploitation of safety occurrence databases with much more complex, rich, and powerful methods, such as symmetry analysis or systemic methods. Additionally, the outcome of this preliminary step will facilitate the link between modern methods, such as the FRAM and STAMP, which could be easily applied in the air traffic management context linked with the ADREP taxonomy and SOAM methodology. A loss of separation incident that occurred in the Edmonton area is used as case study to illustrate this methodology, as well as the whole analysis process.

2. Methodology

Figure 2 presents the proposed methodology with the main process that prepares every incident investigation, from reporting to mathematical analysis.
As a starting point, the principal causes that lead to air traffic management (ATM) incidents have to be investigated. Then, an analysis of the notified occurrences and investigation reports should be required in a first phase. During this phase, factual data of each incident is collected, applying the SOAM approach. However, a chronological vision of incident scenarios is not reflected in this data collection. The sequence of incident scenarios is considered as an important path to understanding how incidents develop from a safe condition to a dangerous situation, and what relationships can be established between the causes based on their temporal evolution; therefore, a sequential analysis with identified factual data should be necessary in a second phase.
In the last phase of this analysis process, regarding ADREP taxonomy, all factual data can be classified as events or factors, which are stored as mathematical parameters in an incident database for further analysis.

2.1. Incident Investigation Report or Occurrence Notification Analysis

Regarding Regulation (EU) No 376/2014 [12], all interested parties implicated in aviation safety, e.g., pilots, air traffic management (ATM)/air navigation service (ANS) staff, and manufacturers, are responsible for reporting occurrences to the competent authorities and, through this medium, make civil aviation safety achieve a high general level in the EU. At a global level, ICAO Annex 13 [11] requires contracting states to establish systems for the reporting of accidents and incidents, and to detect the causes and recommend improvements for real or potential shortcomings; furthermore, according to ICAO Annex 11 [28], it is the responsibility of the contracting states to investigate all air traffic incidents that take place in their airspaces. Once the investigations are concluded, every corresponding state investigation office has the responsibility to publish investigation reports as results. In this first step of this analysis process, ATM incident investigation reports are considered as input and the SOAM approach is used to locate the direct links between the conditions of the occurrence and the actions of the people involved [20], thus gathering factual data thereof. Based on the SOAM approach, in this second step, factual data for collection can be classified in four categories: “Barrier Absent or Failed”, “Human contribution”, “Contextual Circumstance”, and “Organizational Influence”.

2.2. Incident Investigation Sequential Analysis

As References [19] and [20] noted, the SOAM approach was developed based on the reason model [29]. Therefore, its factual data collection method loses in this processing the sequence of the incident or accident scenarios, the temporal relationship between data, and a chronological vision of the incident or accident. For reasons of keeping the traceability and the sequence, one sequential diagram should be used to analyze and organize the temporal dependency relationship between classified factual data (step 3).
In industrial sectors, a fishbone or Ishikawa diagram is commonly used as a tool for accident investigation analysis. Chang and Lin [30] illustrated how one fishbone diagram was developed to identify the principal causes of tank accidents and another was developed for their prevention. Meanwhile, researchers like Kunadharaju et al. [31] only applied this diagram for identifying the principal components of fatalities during a work process. Nevertheless, the usefulness of this diagram can be extended toward dynamic analysis in order to reconstruct incident scenarios. Thus, all factual data within these four categories of the SOAM approach can be reorganized and linked with a temporal line.

2.3. Incident Investigation Database Creation

As well as factual data gathering, factual data storing presents the same importance for future incident or accident investigations. Two rules are followed in this phase of the methodology:
  • Encodability: Each datum can be encoded with a reference number and a standard description.
  • Uniqueness: Each datum only represents one event or factor. If a combination of more than one factor or event is detected for a factual datum, this data should be separated in individual ones to identify their factors or events.
Events and factors are identified by applying a set of questions proposed by Ferrante et al. [32]. According to the conclusion of these researchers, an occurrence can be broken down using ADREP taxonomy into a sequence of events, and the same events are composed of descriptive factors and explanatory factors (step 4). This relationship between events and factors is represented in Figure 3. In the first level, the answer to the question “What?” corresponds to an event; in the second level, the answer to the question “How?” corresponds to descriptive factors (DFs), which identify the symptoms of each event; and in the last level, the question “Why?” corresponds to explanatory factors (EFs), which reflect the causes of the occurrence. The ICAO ADREP taxonomy [33] provides codification to these answers with reference numbers and standard descriptions (step 5). This information conversion aims to store all data extracted from incident investigations in a database tool, like Microsoft Access SQL, for further information management (step 6).
Additionally, following the process performed in Reference [32], for each event and factor, we considered the opinions of three experts, and the comparison study proceeded to determine the taxonomy with more accuracy.

3. Case Study: Loss of Separation (LOS) Incident in Edmonton, Canada

To illustrate the application of this methodology, one case study related to a loss of separation incident was chosen for analysis. This case occurred on 27 June 2002 near Edmonton (Canada) between CPB888 and CNS213 aircraft, in which we applied our procedure of analysis together with ADREP taxonomy usage. The case was investigated by the Canadian Government [34] and summarized as follows.

3.1. Overview from Incident Investigation Report

The occurrence, a loss of separation, took place in the afternoon on the 27th of June, 2002. Two airplanes were involved in the occurrence: A BA3112 operated by Corpac Canada Ltd., registered as C-GKGM with the call-sign CPB888; and an SA227DC operated by Alta Flights, registered as C-FDMR with the call-sign CNS213. The CPB888 was flying from Edmonton to Calgary under instrument flight rules (IFRs) in an en-route phase of the flight, while the CNS213 was IFR en-route from Calgary to Edmonton. Due to bad weather conditions, both aircraft were diverted east of their original flight plan, and encountered each other, on opposite headings and FL160. Final separation between the traffic was 200 vertical feet and 1.3 NM, quite below the minimum separation prescribed for that airspace.

3.2. Incident Analysis with ADREP Taxonomy Encoding

The whole occurrence from development of the first failure made to the end of this incident can be divided into four adverse events based on SOAM analysis and presented in a sequential diagram, as illustrated in Figure 4. Each adverse event was supported by several influential causes that were extracted from the incident report as follows:
  • Pilot of aircraft (A/C) CPB888 did not question an inadequate altitude.
    • Air traffic controllers in that sector were used to issuing altitudes inappropriate for directions.
    • According to Canada Flight Supplement planning documentation, air traffic control (ATC) may assign altitudes inappropriate for direction of flight at any point along preferred routes between Edmonton and Calgary.
  • A/C CPB888 was instructed to fly at an inappropriate altitude for the direction of flight.
    • Controllers were used to vector aircraft operating at inappropriate altitudes.
  • Controller cleared A/C CNS213 to the same altitude that A/C CPB888 without adequately scanning the radar for traffic and possible conflicts.
    • All the ATC team at the sector (planning and executive controller as well as supervisor) were at the end of their shifts and they were possibly fatigued.
    • Traffic was high and complex at the moment of the operation in the sector.
    • Inadequate management of staff contributed to a high workload.
    • The bad weather added extra workload to the controller that had to negotiate avoidance deviations.
    • The area control centre (ACC) was not equipped with a ground-based conflict alert system.
  • None of the controllers in the sector detected the conflict between the two aircraft.
    • Aircraft was not traffic alert and collision avoidance system (TCAS)-equipped.
    • Conformance to altitude and strip marking standards was not regularly checked.
    • Canada flight supplement planning documentation allowed ATC to assign altitudes inappropriate for direction of flight at any point along preferred routes between Edmonton and Calgary.
    • ATC was suffering fatigue and high workload.
    • Traffic was high and complex due to weather avoidance deviations.
All adverse events detected in this case study have corresponding events in ADREP taxonomy; such correspondence can be either one to one, or that one adverse event can be composed of different events defined in ADREP taxonomy, e.g., the adverse event from SOAM “2. A/C CPB888 was allowed to operate at an inappropriate altitude for the direction of flight” has been identified in one event of ADREP taxonomy "Deviation from clearance—assigned flight level" with encoding “2020517”; meanwhile, the adverse event “1. Pilot of A/C CPB888 did not question an inadequate altitude” is composed of two events of ADREP taxonomy “Provision of flight information by the ANS related event” and “ANS clearance to wrong altitude", with encoding “2020601” and “2020202”. Similar to all extracted influential causes from the incident report applying SOAM, they present correspondences with defined DFs as well as EFs in ADREP taxonomy. Based on the characteristics of the taxonomy that each taxon is independent from the others, the independency of every event, DF, or EF can be demonstrated. Through this simple sample, as a result, an incident report with SOAM analysis is transformed into mathematical parameters with codification, as presented in Table 2. Then, the sequential diagram presented in Figure 4 is transformed in Figure 5 with ADREP taxonomy encoding.

4. Discussion

This case study presents a loss of separation incident analysis using SOAM and ADREP taxonomies, as well as using a simple fishbone diagram for the incident scenario reconstruction keeping its sequential stages.
The SOAM analysis had led to the separation of an incident narrative report into four adverse events and a set of influential causes. Adverse events described the incident in terms of “what has happened”. A second layer of analyses allowed to decompose influential causes into descriptive factors that explained “how the events took place” and explanatory factors that explained “why the events happened”. The Ishikawa analysis captured the sequential relationship between these elements.
Combination of both methods allows a multidimensional dynamic description of safety occurrences. Every safety incident can be dissected into four dimensions: (1) Time; (2) why (explanatory factors) (3) how (descriptive factors) and (4) what (events). The four dimensions are excellent inputs for more complex safety methods such as FRAM or SATMP.
For example, in FRAM, the following six elements are defined for each FRAM function or hexagon. Time, a variable that takes into account temporal aspects. Output, the variable performs as results of the FRAM function. Input, which makes the FRAM function active; and three additional functions that regulates the outcome of the RAM function, i.e., preconditions, controls, and resources. There is a direct correspondence between the dimensions of our approach and the variables in the FRAM model. Time is presented in both approaches; events correspond to the output of the FRAM function; explanatory factors are related to the inputs; meanwhile, descriptive factors can be identified as the preconditions, controls, and resources.
Additionally, the analyses applied in this paper synthesized information embedded in safety occurrences into a taxonomy. It facilitates the application of statistical methods to obtain safety insight by applying modern data processing technologies. Forward analytic analysis, such as information theory or decision-making analysis like a Bayesian network, can be applied to understand the correlation between events and factors, as well as their contributions in serious incident scenarios. Figure 6 presents a simple BN construction for the Edmonton incident. In this graphic model, the scenario can be identified as two sub-phases based on time:
  • Preliminary conditions from time (1) to time (3). In this sub-phase, few adverse factors are presented in events and their multiple dependencies with events are limited. Then, the complexity of this sub-phase is reduced, and the unsafe situation is not critical.
  • Critical conditions from time (4) to time (5). This sub-phase presents a complex interaction between factors and events. Notably, the absence of previous barriers to prevent the disclosure of these factors leads this unsafe situation from not critical to critical LOS in the order of seconds.
In general, SOAM analysis is focused on organizational cause identification, then through this method investigators have a clear and complete view of an incident scenario. However, analysis with this method results in loss of the sequential relationship between identified causes, and the incident scenario might be difficult to reconstruct. For this reason, ADREP taxonomy and a fishbone diagram contribute an additional value in order to keep the relationship between events chronologically, facilitate the incident scenario reconstruction, and provide an in-depth diagnostic of the impact of the order in which events occurred in loss of separation incidents. It should be noted that the connection between events or factors defined in ADREP taxonomy and causes detected during SOAM analysis do not always present a correspondence. As observed in this case study, one detected cause in SOAM analysis can be identified with more than one event in ADREP taxonomy.

5. Conclusions

This work proposes to reactivate the use of fishbone or Ishikawa diagrams, a sequential method, in combination with the safety occurrence analysis methodology (SOAM), an adaptation of the reason model (an epistemological method) by EUROCONTROL [19], and with the ADREP taxonomy, the most complete aviation safety taxonomy developed by ICAO. A loss of separation incident that occurred in the Edmonton area (Canada) is used as a case study to illustrate this methodology as well as the whole analysis process.
This proposal builds upon what can be considered three main paradigm shifts in aviation safety:
  • The consideration of safety III, defined by Hollnagel [4], as complementary combination between safety-I and safety-II concepts and approaches.
  • New safety methods and models to learn from both success and failed safety stories, and to represent the complexity of modern socio-technical systems and the dynamics of the interactions between humans, technical systems, and the environment.
  • The reporting and evaluation of serious and less serious safety events.
The proposed work is an initial step to mitigate the remaining lack of interconnection between the three elements above today. Despite Hollnagel’s proposal of integration of traditional safety methods (Safety I) and modern safety approaches (Safety II), nowadays the three previous paradigms present weak interconnections. Classic safety methods are overlooked and rejected in favor of more multifaceted and fresh approaches, wasting the benefits of a multi-method perspective in the context of safety management. Meanwhile, the new safety methods are intricate, demand high levels of expertise, and cannot be straightforwardly applied to the analysis of the data and information complied in aviation safety databases.
The paper extensively discusses the strengths and weaknesses of the various types of safety investigation methods, in particular the ones that are proposed to be combined (fishbone, a sequential method, and SOAM, an adaptation of the reason epidemiological method). It also places our proposal in relation to other existing approaches, showing the benefits of a multi-method approach for safety. This research is also contextualized as an instrument necessary for the application of symmetry analysis methods into aviation safety.
Our approach will allow a new interaction between traditional and new safety methods. The proposed triplet can be used to pre-process information in safety occurrences, paving the way for the further exploitation of safety occurrence databases with much more state-of-the-art methods such as FRAM or STAMP.
Through this methodology, we have also explored its advantage for possible computational applications in incident investigations. For this case study, a simple BN model was created to understand this specific incident scenario.

6. Future Work

This transformation from SOAM analysis to ADREP taxonomy codification allows the creation of a database to store all events and factors of every incident. With the database, numerous research topics related to ATM incident investigations, such as mathematical modeling, predictive analysis, or system improvement assessment can be developed.
As a consequence of this methodology application, we have proceeded to analyze all serious LOS incidents that occurred and were reported over four years within Spanish air space. Based on this previous BN model analysis, we divided this project into two blocks:
  • In the first phase, a static BN model was constructed to understand correlations between factors and events in these serious incidents. Additionally, a computational analysis was considered that combined the BN model with information theory for accident precursor detection [35].
  • In the second phase, and for future work, a dynamic BN model should be considered to assess the efficiency of current barriers or the possibility of new designs.

Author Contributions

Conceptualization, S.Z.Y.L.C., R.M.V.A., V.F.G.C. and F.J.S.N.; Methodology, S.Z.Y.L.C. and R.M.V.A.; Formal Analysis, S.Z.Y.L.C.; Validation, S.Z.Y.L.C., R.M.V.A. and V.F.G.C.; Investigation, S.Z.Y.L.C.; Resources, R.M.V.A. and V.F.G.C.; Writing-Review & Editing, S.Z.Y.L.C., R.M.A.V. and V.F.G.C.; Supervision, F.J.S.N.; Project Administration, R.M.V.A., V.F.G.C. and F.J.S.N.

Funding

This research received no external funding.

Conflicts of Interest

The authors declare no conflict of interest.

Abbreviations

3CAControl Change Cause Analysis
A/CAircraft
ABMAgent-Based Modelling
ACCArea Control Centre
ADREPAccident/Incident Data Reporting
AEBAccident Evolution and Barrier Analysis
ANSAir Navigation Service
ASMAir Space Management
ATCAir Traffic Control
ATMAir Traffic Management
ATSAir Traffic Service
ATSBAustralian Transport Safety Bureau
BNBayesian Network
CAACivil Aviation Authority
CREAMCognitive Reliability and Error Analysis Method
DFDescriptive Factor
EASAEuropean Aviation Safety Agency
ECCAIRSEuropean Co-ordination Centre for Accident and Incident Reporting System
ECFA/CEvent and Conditional Factors Analysis/Charting
EFExplanatory Factor
EUEuropean Union
FAAFederation Aviation Administration
FRAMFunctional Resonance Analysis Method
FTAFault Tree Analysis
ICAOInternational Civil Aviation Organization
IFRInstrument Flight Rules
LOSLoss of Separation
MESMultilinear Events Sequencing
RCARoot Cause Analysis
SCMSwiss Chess Method
SCTSafety Climate Tool
SHELLSoftware, Hardware, Environment and Lifeware to Lifeware
SOAMSafety Occurrence Analysis Methodology
SOLSafety through Organizational Learning
STAMPSystem-Theoretic Accident Model and Processes
STCAShort Term Conflict Alert
TCASTraffic alert and Collision Avoidance System
TEMThreat and Error Management

References

  1. EASA. EASA Preliminary Safety Review—2017; EASA: Cologne, Germany, 2018. [Google Scholar]
  2. ICAO. Safety Management Manual (Doc 9859-AN/474); ICAO: Montréal, GC, Canada, 2013. [Google Scholar]
  3. Patriarca, R.; Bergström, J.; di Gravio, G.; Constantino, F. Resilience engineering: Current status of the research and future challenges. Saf. Sci. 2018, 102, 79–100. [Google Scholar] [CrossRef]
  4. Hollnagel, E. Safety I and Safety-II. The Past and the Future of Safety Management; Ashgate Publishing: London, UK, 2014. [Google Scholar]
  5. Underwood, P.; Waterson, P. Accident Analysis Models and Methods: Guidance for Safety Professionals; Loughborough University: Loughborough, UK, 2013. [Google Scholar]
  6. Reason, J. The Contribution of Latent Human Failures to the Breakdown of Complex Systems. Philos. Trans. R. Soc. Lond. B Biol. Sci. 1990, 327, 475–484. [Google Scholar] [CrossRef] [PubMed]
  7. EUROCONTROL. Revisiting the Swiss Cheese Model of Accidents; EUROCONTROL: Bruxelles, Belgium, 2006. [Google Scholar]
  8. Leveson, N. Engineering a Safer World: Systems Thinking Applied to Safety; MIT Press: Cambridge, MA, USA, 2011. [Google Scholar]
  9. Hollnagel, E. FRAM: The Functional Resonance Analysis Method: Modelling Complex Socio-Technical Systems; Taylor & Francis Ltd.: Abingdon, UK, 2012. [Google Scholar]
  10. EUROCONTROL; FAA. U.S./Europe Comparison of ATM-Related Operational Performance; EUROCONTROL: Bruxelles, Belgium, 2012. [Google Scholar]
  11. ICAO Annex 13. International Standards and Recommended Practices Annex 13 to the Convention on International Civil Aviation Aircraft Accident and Incident Investigation; ICAO: Montréal, GC, Canada, 2016. [Google Scholar]
  12. European Union. Regulation (EU) No 376/2014 of the European Parliament and of the Council of 3 April 2014; European Union: Bruxelles, Belgium, 2014. [Google Scholar]
  13. European Union. Regulation (EU) No 996/2010 of the European Parliament and of the Council of 20 October 2010; European Union: Bruxelles, Belgium, 2010. [Google Scholar]
  14. Suling, M.; Pigeot, I. Signal Detection and Monitoring Based on Longitudinal Healthcare Data. Pharmaceutics 2012, 4, 607–640. [Google Scholar] [CrossRef] [PubMed][Green Version]
  15. Hauer, E. The Art of Regression Modeling in Road Safety; Springer: Berlin/Heidelberg, Germany, 2015. [Google Scholar]
  16. Adekitan, A.I. Root Cause Analysis of a Jet Fuel Tanker Accident. Int. J. Appl. Eng. Res. 2017, 12, 14974–14983. [Google Scholar]
  17. Flight Safety Foundation. Level One Intensity—Safety Data and Information for Risk Management within a Basic Safety Management System; Flight Safety Foundation: Alexandria, VA, USA, 2017. [Google Scholar]
  18. Ishikawa, K. Introduction to Quality Control; Springer: Berlin/Heidelberg, Germany, 1990. [Google Scholar]
  19. EAM 2/GUI 8. Guidelines on the Systemic Occurrence Analysis Methodology (SOAM); EUROCONTROL: Bruxelles, Belgium, 2005. [Google Scholar]
  20. Licu, T.; Cioran, F.; Hayward, B.; Lowe, A. EUROCONTROL—Systemic Occurrence Analysis Methodology (SOAM)—A ‘Reason’-based organisational methodology for analysing incidents and accidents. Reliab. Eng. Syst. Saf. 2007, 92, 1162–1169. [Google Scholar] [CrossRef]
  21. Neuhaus, C.; Huck, M.; Hofmann, G.; Pierre, M.S.; Weigand, M.A.; Lichtenstern, C. Applying the human factors analysis and classification system to critical incident reports in anaesthesiology. ACTA Anaesthesiol. Scand. 2018, 62, 1403–1411. [Google Scholar] [CrossRef] [PubMed]
  22. Wahab, N.A.; Rusli, R.; Shariff, A.M.; Buang, A. Assessment of Human Factor Performance Using Bayesian Inference and Inherent Safety. Mater. Ind. Manuf. Eng. Res. Adv. 2014, 845, 658–662. [Google Scholar] [CrossRef]
  23. James, A.T.; Gandhi, O.P.; Deshmukh, S.G. Assessment of failures in automobiles due to maintenance errors. Int. J. Syst. Assur. Eng. Manag. 2017, 8, 719–739. [Google Scholar] [CrossRef]
  24. Luo, T.; Wu, C.; Duan, L. Fishbone diagram and risk matrix analysis method and its application in safety assessment of natural gas spherical tank. J. Clean. Prod. 2018, 174, 296–304. [Google Scholar] [CrossRef]
  25. Mogles, N.; Padget, J.; Bosse, T. Systemic approaches to incident analysis in aviation: Comparison of STAMP, agent-based modelling and institutions. Saf. Sci. 2018, 108, 59–71. [Google Scholar] [CrossRef]
  26. Underwood, P.; Waterson, P. Systems thinking, the Swiss Cheese Model and accident analysis: A comparative systemic analysis of the Grayrigg train derailment using the ATSB, AcciMap and STAMP models. Accid. Anal. Prev. 2014, 68, 75–94. [Google Scholar] [CrossRef] [PubMed][Green Version]
  27. Smith, D.; Veitch, B.; Khan, F.; Taylor, R. Understanding industrial safety: Comparing Fault tree, Bayesian network, and FRAM approaches. J. Loss Prev. Process Ind. 2017, 45, 88–101. [Google Scholar] [CrossRef]
  28. ICAO Annex 11. International Standards and Recommended Practices Annex 11 to the Convention on International Civil Aviation Air Traffic Services; ICAO: Montréal, GC, Canada, 2016. [Google Scholar]
  29. Reason, J. Managing the Risks of Organisational Accidents; Ashgate: Aldershot, UK, 1997. [Google Scholar]
  30. Chang, J.; Lin, C. A study of storage tank accidents. J. Loss Prev. Process Ind. 2006, 19, 51–59. [Google Scholar] [CrossRef]
  31. Kunadharaju, K.; Smith, T.D.; DeJoy, D.M. Line-of-duty deaths among US firefighters: An analysis of fatality investigations. Accid. Anal. Prev. 2011, 43, 1171–1180. [Google Scholar] [CrossRef] [PubMed]
  32. Ferrante, O.; Jouniaux, P.; Loo, T.; Nicolas, G.; Cabon, P.; Mollard, R. Application of ADREP 2000 taxonomy for the analysis and the encoding of aviation accidents and incidents: A human factors approach. Hum. Factor Aerosp. Saf. 2004, 4, 19–48. [Google Scholar]
  33. ADREP Taxonomy. ICAO ADREP 2000 Taxonomy; ICAO: Montréal, GC, Canada, 2010. [Google Scholar]
  34. Transportation Safety Board of Canada. LOSS OF SEPARATION NAV CANADA Edmonton Area Control Centre Edmonton, Alberta 60 nm S 27 June 2002; Transportation Safety Board of Canada: Gatineau, QC, Canada, 2002.
  35. Arnaldo Valdés, R.M.; Liang Cheng, S.Z.; Gómez Comendador, V.F.; Sáez Nieto, F.J. Application of Bayesian Networks and Information Theory to Estimate the Occurrence of Mid-Air Collisions Based on Accident Precursors. Entropy 2018, 20, 969. [Google Scholar] [CrossRef]
Figure 1. Comparison of the scope of the three methods according to the level of coupling and awareness of socio technical context.
Figure 1. Comparison of the scope of the three methods according to the level of coupling and awareness of socio technical context.
Symmetry 11 00491 g001
Figure 2. Proposed methodology.
Figure 2. Proposed methodology.
Symmetry 11 00491 g002
Figure 3. Questions and levels to be analyzed in the breakdown of an occurrence.
Figure 3. Questions and levels to be analyzed in the breakdown of an occurrence.
Symmetry 11 00491 g003
Figure 4. Edmonton incident analysis based on fishbone sequential diagram.
Figure 4. Edmonton incident analysis based on fishbone sequential diagram.
Symmetry 11 00491 g004
Figure 5. Fishbone sequential diagram with ADREP taxonomy encoding.
Figure 5. Fishbone sequential diagram with ADREP taxonomy encoding.
Symmetry 11 00491 g005
Figure 6. Bayesian network (BN) model for Edmonton incident investigation.
Figure 6. Bayesian network (BN) model for Edmonton incident investigation.
Symmetry 11 00491 g006
Table 1. Strengths and weaknesses of safety methods.
Table 1. Strengths and weaknesses of safety methods.
Class Methods 1CharacteristicsExamples of Models 2StrengthsWeaknesses
Sequential
  • Consider sequences or series of events.
  • Might add barriers to prevent events evolving into accidents.
  • Might use conditions that permit the event.
  • Might consider logical gates to combine events into other events.
ECFA/C Fishbone, Deviation Analysis, FTA, Domino Accident, MORT, STEP RCA, MES
  • Mature and consolidated methods.
  • Easy to understand Good for communication and convince management Narratives are available for sequential models to identify entities and relations.
  • Might represents a causal network of states and events leading up to an incident or accident, but without considering feedback loops
  • They consider failures, incidental factors, deviations from a norm, unsafe acts, and to a certain extent, the social environment.
  • Socio-technical context is not taken into account.
  • Only clear and simpler improvements can be identified.
  • Limitation on describing multi-state component behaviors.
Epidemiological
  • Considers not only events but a layer of latent conditions into the model.
  • Events are explained as consequences of actors’ actions.
  • Actors are conditioned by their organizations
Accimap, 3CA, CREAM, AEB, Reason Model, SOAM, SCT, SCM, TEM, SOL, Tripod
  • Take socio-technical context into consideration.
  • Focus on elements that cannot be analyzed by sequential models such as company culture, safety procedures, legislation, etc.
  • They require more time and effort because of the bigger investigation scope.
  • They are more complicated because of the difficulties of capturing the context in a comprehensive narrative
  • As they are focus on organizational and managerial shortcomings are sometimes perceived as treating by managers.
Systemic
  • Aimed to capture the strong hidden links and influences between the components of the system
  • Each method has its own ontologies and paradigm to model the environment
  • STAMP is a system-theoretical control cycle model that integrates sensors, control, controllers, actuators, and conceptual models to control the process.
  • FRAM model the system and its context in terms of functions, function characteristics (input, resources it needs, outputs, controls and real-time behavior), and interactions between the functions. Outputs of the functions are explained by stochastic resonance leading to undesired effects.
FRAM, STAMP
  • They acknowledge the tight coupling of individual functions and constituents of the system.
  • Disparate descriptions of these methods
  • Small correspondence between different methods, such as FRAM and STAMP.
  • Difficult to create an overarching narrative for the accidents, then moderate reliability.
  • Difficult to apply and longer application time.
  • Extra effort might not be justified in many cases by the benefits of analysis, particularly when the consequences of incidents are relatively minor.
  • Less effective graphical communication.
1 Method is defined as a series of steps to get to an outcome or a result. 2 Model is defined as a conceptual structure used to model an incident/accident.
Table 2. Edmonton incident events and factors identification with accident/incident data reporting (ADREP) taxonomy.
Table 2. Edmonton incident events and factors identification with accident/incident data reporting (ADREP) taxonomy.
Adverse Event Identified in ReportEventInfluential Causes Identified in ReportDescriptive Factor (DF)Explanatory Factor (EF)
Pilot of A/C CPB888 did not question an inadequate altitudet = t(1): Provision of flight information by the ATS (Air Traffic Service) related event. (2020601)Bad practices of Pilots in receiving inadequate altitude in this sector for flight direction.Flight crew’s control of the A/C altitude. (12240300)Experience of route. (105010205)
t = t(2): ANS clearance to wrong altitude. (2020202)Air traffic controllers in that sector used to issue altitudes inappropriate for directions.
According to Canada Flight Supplement planning documentation, ATC may assign altitudes inappropriate for direction of flight at any point along preferred routes between Edmonton and Calgary
ASM (Air Space Management) conditional route type. (24030202)
A/C CPB888 was instructed to fly at an inappropriate altitude for the direction of flight.t = t(3): Deviation from clearance—assigned flight level. (2020517)Controllers used to vector aircraft operating at inappropriate altitudes.ATC provision of a minimum safe FL (24010704)ATS incorrect/inappropriate/inadequate. (201020100)
According to Canada Flight Supplement planning documentation, ATC may assign altitudes inappropriate for direction of flight at any point along preferred routes between Edmonton and CalgaryASM conditional route type. (24030202)
Controller cleared A/C CNS213 to the same altitude that A/CCPB888 without adequately scan radar for traffic and possible conflicts.t = t(4): Navigation track error. (2170400)All the ATC team at the sector (planning and executive controller as well as supervisor) were at the end of their shifts and they were possible fatigued.
Traffic was high and complex at the moment of the operation in the sector.
Inadequate management of staff contributed to a high workload
The bad weather added extra workload to the controller that had to negotiate avoidance deviations.
The ACC was not equipped with ground-based conflict alert system.
ATC monitoring of sector traffic load. (27030000)Fatigue-other (102030900)
ASM updated capacity of an airspace. (24030300)Work overload/task saturation. (204010100)
ATC monitoring of sector traffic load. (27030000)High workload due to staff/skills shortage. (204010200)
Thunderstorm. (52031600)
ATC provision of information concerning en route weather phenomena that may affect the safety of A/C operations. (24010507)
ATC provision of a STCA (Short Term Conflict Alert) warning. (24010604)
None of the controllers in the sector detected the conflict between the two aircraft.t = t(5): ANS conflict detection and resolution related event. (4010400)Aircraft was not TCAS equipped.
Conformance to altitude and strip marking standards was not regularly checked.
Canada Flight Supplement planning documentation allowed ATC to assign altitudes inappropriate for direction of flight at any point along preferred routes between Edmonton and Calgary.
ATC was suffering fatigue and high workload.
Traffic was high and complex due to weather avoidance deviations.
Traffic alert and collision avoidance system/Airborne collision avoidance system (11344500)
ATM of flight progress strip. (21040102)The interface between humans in relation to use of flight progress strips to communicate information. (501020200)
ASM conditional route type. (24030202)
ATC monitoring of sector traffic load. (27030000)Fatigue-other (102030900)
ASM updated capacity of an airspace. (24030300)Work overload/task saturation. (204010100)
ATC monitoring of sector traffic load. (27030000)High workload due to staff/skills shortage. (204010200)
Thunderstorm. (52031600)
ATC provision of information concerning en route weather phenomena that may affect the safety of A/C operations. (24010507)

Share and Cite

MDPI and ACS Style

Liang Cheng, S.Z.Y.; Arnaldo Valdés, R.M.; Gómez Comendador, V.F.; Sáez Nieto, F.J. A Case Study of Fishbone Sequential Diagram Application and ADREP Taxonomy Codification in Conventional ATM Incident Investigation. Symmetry 2019, 11, 491. https://doi.org/10.3390/sym11040491

AMA Style

Liang Cheng SZY, Arnaldo Valdés RM, Gómez Comendador VF, Sáez Nieto FJ. A Case Study of Fishbone Sequential Diagram Application and ADREP Taxonomy Codification in Conventional ATM Incident Investigation. Symmetry. 2019; 11(4):491. https://doi.org/10.3390/sym11040491

Chicago/Turabian Style

Liang Cheng, Schon Z.Y., Rosa María Arnaldo Valdés, Victor Fernando Gómez Comendador, and Francisco Javier Sáez Nieto. 2019. "A Case Study of Fishbone Sequential Diagram Application and ADREP Taxonomy Codification in Conventional ATM Incident Investigation" Symmetry 11, no. 4: 491. https://doi.org/10.3390/sym11040491

Note that from the first issue of 2016, MDPI journals use article numbers instead of page numbers. See further details here.

Article Metrics

Back to TopTop