A Case Study of Fishbone Sequential Diagram Application and ADREP Taxonomy Codification in Conventional ATM Incident Investigation

Abstract

This paper aims to present the application of a fishbone sequential diagram in air traffic management (ATM) incident investigations performing as a key connection between safety occurrence analysis methodology (SOAM) and accident/incident data reporting (ADREP) approaches. SOAM analysis is focused on organizational cause detection; nevertheless, this detection of individual causes from a complete incident scenario presents a complex analysis, and even more, the chronological relationship between causes, which is lacking in SOAM, should be tracked for post-investigation analysis. The conventional fishbone diagram is useful for failure cause classification; however, we consider that this technique can also show its potential to establish temporal dependencies between causes, which are categorized and registered with ADREP taxonomy for future database creation. A loss of separation incident that occurred in the Edmonton area (Canada) is used as a case study to illustrate this methodology as well as the whole analysis process.

1. Introduction

Air transportation systems are evolving towards multifaceted, hyper-dimensional, highly distributed, and mutually dependent systems with levels of complexity not imaginable just a few decades ago [1]. Maintaining extremely high levels of safety in this complex environment is more challenging than it was in the past.

Stakeholders should gather, monitor, and study safety-related information to predict and anticipate, not only actual, but also emerging safety risks. In this situation, safety analytics need to improve to forecast future safety risks and safety performances. It is of paramount importance that techniques and methods for identifying and predicting adverse safety events are engineered and used broadly. Only then will it be possible to use safety events and occurrence information to improve safety and to protect the air transportation system from any adverse impacts of increased systemic complexity.

1.1. Literature Overview of Aviation Safety Analysis

To keep up the pace, aviation is involved in a shift from reactive, traditional approaches towards more proactive methods; that is, from compliance-based safety towards safety performance-based methodologies [2,3]. This shift is sustained in a set of paradigms:

• The evolution from Safety-I to Safety-II, descripted by Hollnagel [4], with Safety-III as a combination of Safety-I and Safety-II concepts and approaches in consideration. Safety-I is concerned with infrequent events that go wrong in a stable environment, and Safety-II is concerned with the more frequent events that go right in a non-stable environment. Safety-I and Safety-II differ in their ontology, but they represent two complementary views of safety.
• New safety methods and models to learn from both previous approaches and stories of success and failure, and to represent the complexity of modern socio-technical systems and the dynamics of the interactions between humans, technical systems, and the environment. These methods include epidemiological models [5,6,7]; systemic accident models, such as the system-theoretic accident model and processes (STAMP) [8] and the functional resonance analysis method (FRAM) [9]; agent-based models [10]; etc.
• The reporting and evaluation of serious and less serious safety events. Relevant civil aviation occurrences are reported, stored, exchanged, analyzed, and disseminated with the aim that appropriate emergent safety events and risks can be identified, and safety actions can be taken. The effective, proactive, and clever exploitation of this safety data is key to coping with safety improvement in the complex upcoming air transportation system.

Despite the Hollnagel construction of Safety III as the integration of traditional safety methods (Safety-I) and modern safety approaches (Safety-II), the three previous paradigms are still lacking interconnection today. Classic safety methods, such as sequential models, are disregarded and discarded in favor of more complex and recent approaches because of their limitations, missing the potential of a multi-method perspective in the context of safety management. However, new safety methods are complex and labor intensive and cannot be directly and straightforwardly applied to the analysis of the data and information complied in aviation safety databases. Additionally, the potential of aviation safety databases for detecting and predicting emergent safety events has not yet been fully exploited. Despite a solid culture of notifying safety events and occurrences, aviation has not yet fully succeeded in extracting the maximum amount of safety data from this information.

Statistics on serious and less serious incidents can provide a great amount of safety information. Safety authorities, such as the FAA, EASA, ICAO, and EUROCONTROL [10], have invested a great deal of effort in the identification of safety monitoring information and performance indicators. Specifically, ICAO Annex 13 [11] requires that member states establish reporting systems for accidents and incidents to gather information on real and potential safety shortcomings. European Regulation (EU) No 376/2014 [12] makes mandatory the reporting, analysis, and follow-up of civil aviation incidents. Moreover, the European Union has created a database, the European Co-ordination Center for Accident and Incident Reporting System (ECCAIRS), with common standard collection and exchange of aviation accidents and incidents. ECCAIRS implements the ICAO accident/incident data reporting (ADREP) taxonomy for collecting, sharing, and analyzing safety information between National and European transport entities. ECCAIRS complies with Regulations No. 996/2010 [13] and No. 376/2014 [12] in terms of occurrence reports as well as safety recommendations. Regarding this policy, the analyzed causes of all investigated incidents should be identified with their corresponding ADREP taxonomies and recorded in a common database through ECCAIRS.

Thanks to these dispositions, among others, today more safety data than ever are gathered; however, only a small part of them is fully exploited, integrated, analyzed, processed, and used for the best understanding of safety risks. New challenges have appeared to analyze the information available in these big databases. The challenge is to take advantage of the volume of data, integrate data from hundreds of sources, and extract knowledge from the test of the reports.

The adaptation of symmetry methods for safety signal detection might result in faster detection of safety emergent issues in aviation. Symmetry analysis techniques are successfully applied today in safety critical industries for safety signal detection from occurrence reporting databases. For example, disproportionality analysis and sequence symmetry analysis are broadly accepted for safety signal detection in healthcare databases [14]. Symmetry-based regression models have started to be employed in road for safety analysis [15]. However, these types of methods and approaches have not yet been applied in aviation to explore safety occurrence databases. Aviation, despite its high level of safety, is lagging behind other industries regarding the application of advanced data science and data mining methods to the early detection of safety signals.

Reports in the aviation occurrence databases need to be pre-processed to facilitate the safety knowledge that can be derived from their contents. Unfortunately, systemic accident models, variability methods, or agent-based models, although very powerful for understanding complex systems, cannot be directly applied to the reports in the safety databases. In order to take maximum advantage of these methods applied to such large databases, important pre-processing and pre-computational work need to be done. Occurrences and events in the databases need to be systematized to extract relevant safety information and to allow more complex methods to be applied on a common ground. Due to the low level of detail of the information contained in the safety reports and the large amount of reports to be analyzed in these databases (the European occurrence reporting system might receive around 900,000 reports per year), the methods to perform this analysis should be simple, powerful, cost effective, and at the same time dependable.

For this task, modern methods might give way to older methods, such as sequential and epistemological methods, that, despite being overcome by more complex approaches in their attempt to explain how accidents happen in socio-technical complex systems, might still play a useful role in the systematization of the preprocessing of occurrence databases. In particular, sequential and epistemological models can be particularly tuned for this task when combined with other well-adopted and -consolidated safety tools, such as aviation safety taxonomies.

In this work we proposed to reactivate the use of fishbone or Ishikawa diagrams, a sequential method [16,17,18], in combination with the safety occurrence analysis methodology (SOAM), an adaptation of the reason model (an epistemological method) by EUROCONTROL [19], and with the ADREP taxonomy, the most complete aviation safety taxonomy developed by ICAO.

Sequential models have the potential to describe safety events as the consequence of a sequence of events in a specific order. Due to the assumption of well-defined cause–effect relationships that facilitate the propagation of the effects of events into an accident, they are not capable of properly explaining complex accidents characterized by a large number of interactions between humans, technical systems, and the dynamics of these interactions. However, this method can be very useful for classification of the causes of failure and to establish temporal dependencies between causes.

The SOAM approach contributes to the identification of causes in an incident scenario [20]. This approach is an exhaustive process for analysis of data collected during the investigation of a safety occurrence and for providing recommendations. It was developed from the reason model, taking the SHELL model as the basis for construction. It should be highlighted that the human involvement consideration in SOAM includes analysis of the latent conditions within the organization. SOAM has already been integrated by EUROCONTROL with other phases of investigation and widely applied by all CAAs of EU members. The reason or Swiss chess model is widely applied for organizational decision-making in safety-critical systems. Notably, the involvement of human factors in accidents are investigated in-depth and documented; researchers like Neuhaus et al. [21] and Wahab et al. [22] have used this model for analyzing human behavior during critical incidents, even attempting to combine it with a BN (Bayesian network) model for taking preventive measures. The detection of individual causes from a complete incident scenario presents a complex analysis; furthermore, the chronological relationship between causes should be tracked. However, the SOAM approach is unable to provide a chronological relationship between causes, which we consider a relevant step for a post-investigation analysis to understand their temporal dependencies. The fishbone diagram can improve this limitation during incident analysis. Unlike most of the research works [23,24] where fishbone diagrams only present static relationships between factors involved in the accident/incident scenarios, in this research, the Ishikawa technique acts as a temporal axis connecting all causes detected with SOAM and codified with the ADREP taxonomy to represent incident stages.

In the safety literature related to safety modeling, different comparison studies are cited, such as Mogles [25] comparing STAMP and ABM (agent-based modeling) models for aviation incident analysis; Underwood [26] using ATSB, AcciMap, and STAMP models for train derailment analysis; Smith [27] applying FRAM, FTA (fault tree analysis), and BN for understanding industrial safety, etc. Based on this literature review, limitations of sequential methods for the explanation of complex accidents against more holistic approaches are presented in

Table 1. Strengths and weaknesses of safety methods.

Class Methods 1	Characteristics	Examples of Models 2	Strengths	Weaknesses
Sequential	Consider sequences or series of events. Might add barriers to prevent events evolving into accidents. Might use conditions that permit the event. Might consider logical gates to combine events into other events.	ECFA/C Fishbone, Deviation Analysis, FTA, Domino Accident, MORT, STEP RCA, MES	Mature and consolidated methods. Easy to understand Good for communication and convince management Narratives are available for sequential models to identify entities and relations. Might represents a causal network of states and events leading up to an incident or accident, but without considering feedback loops They consider failures, incidental factors, deviations from a norm, unsafe acts, and to a certain extent, the social environment.	Socio-technical context is not taken into account. Only clear and simpler improvements can be identified. Limitation on describing multi-state component behaviors.
Epidemiological	Considers not only events but a layer of latent conditions into the model. Events are explained as consequences of actors’ actions. Actors are conditioned by their organizations	Accimap, 3CA, CREAM, AEB, Reason Model, SOAM, SCT, SCM, TEM, SOL, Tripod	Take socio-technical context into consideration. Focus on elements that cannot be analyzed by sequential models such as company culture, safety procedures, legislation, etc.	They require more time and effort because of the bigger investigation scope. They are more complicated because of the difficulties of capturing the context in a comprehensive narrative As they are focus on organizational and managerial shortcomings are sometimes perceived as treating by managers.
Systemic	Aimed to capture the strong hidden links and influences between the components of the system Each method has its own ontologies and paradigm to model the environment STAMP is a system-theoretical control cycle model that integrates sensors, control, controllers, actuators, and conceptual models to control the process. FRAM model the system and its context in terms of functions, function characteristics (input, resources it needs, outputs, controls and real-time behavior), and interactions between the functions. Outputs of the functions are explained by stochastic resonance leading to undesired effects.	FRAM, STAMP	They acknowledge the tight coupling of individual functions and constituents of the system.	Disparate descriptions of these methods Small correspondence between different methods, such as FRAM and STAMP. Difficult to create an overarching narrative for the accidents, then moderate reliability. Difficult to apply and longer application time. Extra effort might not be justified in many cases by the benefits of analysis, particularly when the consequences of incidents are relatively minor. Less effective graphical communication.

¹ Method is defined as a series of steps to get to an outcome or a result. ² Model is defined as a conceptual structure used to model an incident/accident.

. Despite their differences, the three types of models follow a common logic that incorporates additional steps when moving from sequential up to systemic, passing through epidemiological. Figure 1 compares the scope of the three methods according to the level of coupling and how much they consider the socio-technical context. It also summarizes the logic of the steps mentioned.

1.2. Proposed Approach

In this paper, we acknowledge limitations as well as strengths of the different types of methods and propose a different application for the more conventional sequential methods in a pre-processing phase, in combination with epistemological methods, such as SOAM, and the most complete and up-to-date aviation safety taxonomy: ADREP.

This work proposed to reactivate the use of a sequential method, the fishbone or Ishikawa diagrams, in combination with an epistemological method, the safety occurrence analysis methodology (SOAM) which is an adaptation of the reason model by EUROCONTROL, and with the most complete aviation safety taxonomy developed by ICAO, ADREP taxonomy.

This approach allows a new interaction among traditional and new safety methods. A triplet of more conventional and somehow simpler safety methods and tools are used to pre-process information in safety occurrences, paving the way for the further exploitation of safety occurrence databases with much more complex, rich, and powerful methods, such as symmetry analysis or systemic methods. Additionally, the outcome of this preliminary step will facilitate the link between modern methods, such as the FRAM and STAMP, which could be easily applied in the air traffic management context linked with the ADREP taxonomy and SOAM methodology. A loss of separation incident that occurred in the Edmonton area is used as case study to illustrate this methodology, as well as the whole analysis process.

2. Methodology

Figure 2 presents the proposed methodology with the main process that prepares every incident investigation, from reporting to mathematical analysis.

As a starting point, the principal causes that lead to air traffic management (ATM) incidents have to be investigated. Then, an analysis of the notified occurrences and investigation reports should be required in a first phase. During this phase, factual data of each incident is collected, applying the SOAM approach. However, a chronological vision of incident scenarios is not reflected in this data collection. The sequence of incident scenarios is considered as an important path to understanding how incidents develop from a safe condition to a dangerous situation, and what relationships can be established between the causes based on their temporal evolution; therefore, a sequential analysis with identified factual data should be necessary in a second phase.

In the last phase of this analysis process, regarding ADREP taxonomy, all factual data can be classified as events or factors, which are stored as mathematical parameters in an incident database for further analysis.

2.1. Incident Investigation Report or Occurrence Notification Analysis

Regarding Regulation (EU) No 376/2014 [12], all interested parties implicated in aviation safety, e.g., pilots, air traffic management (ATM)/air navigation service (ANS) staff, and manufacturers, are responsible for reporting occurrences to the competent authorities and, through this medium, make civil aviation safety achieve a high general level in the EU. At a global level, ICAO Annex 13 [11] requires contracting states to establish systems for the reporting of accidents and incidents, and to detect the causes and recommend improvements for real or potential shortcomings; furthermore, according to ICAO Annex 11 [28], it is the responsibility of the contracting states to investigate all air traffic incidents that take place in their airspaces. Once the investigations are concluded, every corresponding state investigation office has the responsibility to publish investigation reports as results. In this first step of this analysis process, ATM incident investigation reports are considered as input and the SOAM approach is used to locate the direct links between the conditions of the occurrence and the actions of the people involved [20], thus gathering factual data thereof. Based on the SOAM approach, in this second step, factual data for collection can be classified in four categories: “Barrier Absent or Failed”, “Human contribution”, “Contextual Circumstance”, and “Organizational Influence”.

2.2. Incident Investigation Sequential Analysis

As References [19] and [20] noted, the SOAM approach was developed based on the reason model [29]. Therefore, its factual data collection method loses in this processing the sequence of the incident or accident scenarios, the temporal relationship between data, and a chronological vision of the incident or accident. For reasons of keeping the traceability and the sequence, one sequential diagram should be used to analyze and organize the temporal dependency relationship between classified factual data (step 3).

In industrial sectors, a fishbone or Ishikawa diagram is commonly used as a tool for accident investigation analysis. Chang and Lin [30] illustrated how one fishbone diagram was developed to identify the principal causes of tank accidents and another was developed for their prevention. Meanwhile, researchers like Kunadharaju et al. [31] only applied this diagram for identifying the principal components of fatalities during a work process. Nevertheless, the usefulness of this diagram can be extended toward dynamic analysis in order to reconstruct incident scenarios. Thus, all factual data within these four categories of the SOAM approach can be reorganized and linked with a temporal line.

2.3. Incident Investigation Database Creation

As well as factual data gathering, factual data storing presents the same importance for future incident or accident investigations. Two rules are followed in this phase of the methodology:

• Encodability: Each datum can be encoded with a reference number and a standard description.
• Uniqueness: Each datum only represents one event or factor. If a combination of more than one factor or event is detected for a factual datum, this data should be separated in individual ones to identify their factors or events.

Events and factors are identified by applying a set of questions proposed by Ferrante et al. [32]. According to the conclusion of these researchers, an occurrence can be broken down using ADREP taxonomy into a sequence of events, and the same events are composed of descriptive factors and explanatory factors (step 4). This relationship between events and factors is represented in Figure 3. In the first level, the answer to the question “What?” corresponds to an event; in the second level, the answer to the question “How?” corresponds to descriptive factors (DFs), which identify the symptoms of each event; and in the last level, the question “Why?” corresponds to explanatory factors (EFs), which reflect the causes of the occurrence. The ICAO ADREP taxonomy [33] provides codification to these answers with reference numbers and standard descriptions (step 5). This information conversion aims to store all data extracted from incident investigations in a database tool, like Microsoft Access SQL, for further information management (step 6).

Additionally, following the process performed in Reference [32], for each event and factor, we considered the opinions of three experts, and the comparison study proceeded to determine the taxonomy with more accuracy.

3. Case Study: Loss of Separation (LOS) Incident in Edmonton, Canada

To illustrate the application of this methodology, one case study related to a loss of separation incident was chosen for analysis. This case occurred on 27 June 2002 near Edmonton (Canada) between CPB888 and CNS213 aircraft, in which we applied our procedure of analysis together with ADREP taxonomy usage. The case was investigated by the Canadian Government [34] and summarized as follows.

3.1. Overview from Incident Investigation Report

The occurrence, a loss of separation, took place in the afternoon on the 27th of June, 2002. Two airplanes were involved in the occurrence: A BA3112 operated by Corpac Canada Ltd., registered as C-GKGM with the call-sign CPB888; and an SA227DC operated by Alta Flights, registered as C-FDMR with the call-sign CNS213. The CPB888 was flying from Edmonton to Calgary under instrument flight rules (IFRs) in an en-route phase of the flight, while the CNS213 was IFR en-route from Calgary to Edmonton. Due to bad weather conditions, both aircraft were diverted east of their original flight plan, and encountered each other, on opposite headings and FL160. Final separation between the traffic was 200 vertical feet and 1.3 NM, quite below the minimum separation prescribed for that airspace.

3.2. Incident Analysis with ADREP Taxonomy Encoding

The whole occurrence from development of the first failure made to the end of this incident can be divided into four adverse events based on SOAM analysis and presented in a sequential diagram, as illustrated in Figure 4. Each adverse event was supported by several influential causes that were extracted from the incident report as follows:

• Pilot of aircraft (A/C) CPB888 did not question an inadequate altitude.
  • Air traffic controllers in that sector were used to issuing altitudes inappropriate for directions.
  • According to Canada Flight Supplement planning documentation, air traffic control (ATC) may assign altitudes inappropriate for direction of flight at any point along preferred routes between Edmonton and Calgary.
• A/C CPB888 was instructed to fly at an inappropriate altitude for the direction of flight.
  • Controllers were used to vector aircraft operating at inappropriate altitudes.
• Controller cleared A/C CNS213 to the same altitude that A/C CPB888 without adequately scanning the radar for traffic and possible conflicts.
  • All the ATC team at the sector (planning and executive controller as well as supervisor) were at the end of their shifts and they were possibly fatigued.
  • Traffic was high and complex at the moment of the operation in the sector.
  • Inadequate management of staff contributed to a high workload.
  • The bad weather added extra workload to the controller that had to negotiate avoidance deviations.
  • The area control centre (ACC) was not equipped with a ground-based conflict alert system.
• None of the controllers in the sector detected the conflict between the two aircraft.
  • Aircraft was not traffic alert and collision avoidance system (TCAS)-equipped.
  • Conformance to altitude and strip marking standards was not regularly checked.
  • Canada flight supplement planning documentation allowed ATC to assign altitudes inappropriate for direction of flight at any point along preferred routes between Edmonton and Calgary.
  • ATC was suffering fatigue and high workload.
  • Traffic was high and complex due to weather avoidance deviations.

All adverse events detected in this case study have corresponding events in ADREP taxonomy; such correspondence can be either one to one, or that one adverse event can be composed of different events defined in ADREP taxonomy, e.g., the adverse event from SOAM “2. A/C CPB888 was allowed to operate at an inappropriate altitude for the direction of flight” has been identified in one event of ADREP taxonomy "Deviation from clearance—assigned flight level" with encoding “2020517”; meanwhile, the adverse event “1. Pilot of A/C CPB888 did not question an inadequate altitude” is composed of two events of ADREP taxonomy “Provision of flight information by the ANS related event” and “ANS clearance to wrong altitude", with encoding “2020601” and “2020202”. Similar to all extracted influential causes from the incident report applying SOAM, they present correspondences with defined DFs as well as EFs in ADREP taxonomy. Based on the characteristics of the taxonomy that each taxon is independent from the others, the independency of every event, DF, or EF can be demonstrated. Through this simple sample, as a result, an incident report with SOAM analysis is transformed into mathematical parameters with codification, as presented in

Table 2. Edmonton incident events and factors identification with accident/incident data reporting (ADREP) taxonomy.

Adverse Event Identified in Report	Event	Influential Causes Identified in Report	Descriptive Factor (DF)	Explanatory Factor (EF)
Pilot of A/C CPB888 did not question an inadequate altitude	t = t(1): Provision of flight information by the ATS (Air Traffic Service) related event. (2020601)	Bad practices of Pilots in receiving inadequate altitude in this sector for flight direction.	Flight crew’s control of the A/C altitude. (12240300)	Experience of route. (105010205)
	t = t(2): ANS clearance to wrong altitude. (2020202)	Air traffic controllers in that sector used to issue altitudes inappropriate for directions. According to Canada Flight Supplement planning documentation, ATC may assign altitudes inappropriate for direction of flight at any point along preferred routes between Edmonton and Calgary	ASM (Air Space Management) conditional route type. (24030202)
A/C CPB888 was instructed to fly at an inappropriate altitude for the direction of flight.	t = t(3): Deviation from clearance—assigned flight level. (2020517)	Controllers used to vector aircraft operating at inappropriate altitudes.	ATC provision of a minimum safe FL (24010704)	ATS incorrect/inappropriate/inadequate. (201020100)
		According to Canada Flight Supplement planning documentation, ATC may assign altitudes inappropriate for direction of flight at any point along preferred routes between Edmonton and Calgary	ASM conditional route type. (24030202)
Controller cleared A/C CNS213 to the same altitude that A/CCPB888 without adequately scan radar for traffic and possible conflicts.	t = t(4): Navigation track error. (2170400)	All the ATC team at the sector (planning and executive controller as well as supervisor) were at the end of their shifts and they were possible fatigued. Traffic was high and complex at the moment of the operation in the sector. Inadequate management of staff contributed to a high workload The bad weather added extra workload to the controller that had to negotiate avoidance deviations. The ACC was not equipped with ground-based conflict alert system.	ATC monitoring of sector traffic load. (27030000)	Fatigue-other (102030900)
			ASM updated capacity of an airspace. (24030300)	Work overload/task saturation. (204010100)
			ATC monitoring of sector traffic load. (27030000)	High workload due to staff/skills shortage. (204010200)
			Thunderstorm. (52031600)
			ATC provision of information concerning en route weather phenomena that may affect the safety of A/C operations. (24010507)
			ATC provision of a STCA (Short Term Conflict Alert) warning. (24010604)
None of the controllers in the sector detected the conflict between the two aircraft.	t = t(5): ANS conflict detection and resolution related event. (4010400)	Aircraft was not TCAS equipped. Conformance to altitude and strip marking standards was not regularly checked. Canada Flight Supplement planning documentation allowed ATC to assign altitudes inappropriate for direction of flight at any point along preferred routes between Edmonton and Calgary. ATC was suffering fatigue and high workload. Traffic was high and complex due to weather avoidance deviations.	Traffic alert and collision avoidance system/Airborne collision avoidance system (11344500)
			ATM of flight progress strip. (21040102)	The interface between humans in relation to use of flight progress strips to communicate information. (501020200)
			ASM conditional route type. (24030202)
			ATC monitoring of sector traffic load. (27030000)	Fatigue-other (102030900)
			ASM updated capacity of an airspace. (24030300)	Work overload/task saturation. (204010100)
			ATC monitoring of sector traffic load. (27030000)	High workload due to staff/skills shortage. (204010200)
			Thunderstorm. (52031600)
			ATC provision of information concerning en route weather phenomena that may affect the safety of A/C operations. (24010507)

. Then, the sequential diagram presented in Figure 4 is transformed in Figure 5 with ADREP taxonomy encoding.

4. Discussion

This case study presents a loss of separation incident analysis using SOAM and ADREP taxonomies, as well as using a simple fishbone diagram for the incident scenario reconstruction keeping its sequential stages.

The SOAM analysis had led to the separation of an incident narrative report into four adverse events and a set of influential causes. Adverse events described the incident in terms of “what has happened”. A second layer of analyses allowed to decompose influential causes into descriptive factors that explained “how the events took place” and explanatory factors that explained “why the events happened”. The Ishikawa analysis captured the sequential relationship between these elements.

Combination of both methods allows a multidimensional dynamic description of safety occurrences. Every safety incident can be dissected into four dimensions: (1) Time; (2) why (explanatory factors) (3) how (descriptive factors) and (4) what (events). The four dimensions are excellent inputs for more complex safety methods such as FRAM or SATMP.

For example, in FRAM, the following six elements are defined for each FRAM function or hexagon. Time, a variable that takes into account temporal aspects. Output, the variable performs as results of the FRAM function. Input, which makes the FRAM function active; and three additional functions that regulates the outcome of the RAM function, i.e., preconditions, controls, and resources. There is a direct correspondence between the dimensions of our approach and the variables in the FRAM model. Time is presented in both approaches; events correspond to the output of the FRAM function; explanatory factors are related to the inputs; meanwhile, descriptive factors can be identified as the preconditions, controls, and resources.

Additionally, the analyses applied in this paper synthesized information embedded in safety occurrences into a taxonomy. It facilitates the application of statistical methods to obtain safety insight by applying modern data processing technologies. Forward analytic analysis, such as information theory or decision-making analysis like a Bayesian network, can be applied to understand the correlation between events and factors, as well as their contributions in serious incident scenarios. Figure 6 presents a simple BN construction for the Edmonton incident. In this graphic model, the scenario can be identified as two sub-phases based on time:

• Preliminary conditions from time (1) to time (3). In this sub-phase, few adverse factors are presented in events and their multiple dependencies with events are limited. Then, the complexity of this sub-phase is reduced, and the unsafe situation is not critical.
• Critical conditions from time (4) to time (5). This sub-phase presents a complex interaction between factors and events. Notably, the absence of previous barriers to prevent the disclosure of these factors leads this unsafe situation from not critical to critical LOS in the order of seconds.

In general, SOAM analysis is focused on organizational cause identification, then through this method investigators have a clear and complete view of an incident scenario. However, analysis with this method results in loss of the sequential relationship between identified causes, and the incident scenario might be difficult to reconstruct. For this reason, ADREP taxonomy and a fishbone diagram contribute an additional value in order to keep the relationship between events chronologically, facilitate the incident scenario reconstruction, and provide an in-depth diagnostic of the impact of the order in which events occurred in loss of separation incidents. It should be noted that the connection between events or factors defined in ADREP taxonomy and causes detected during SOAM analysis do not always present a correspondence. As observed in this case study, one detected cause in SOAM analysis can be identified with more than one event in ADREP taxonomy.

5. Conclusions

This work proposes to reactivate the use of fishbone or Ishikawa diagrams, a sequential method, in combination with the safety occurrence analysis methodology (SOAM), an adaptation of the reason model (an epistemological method) by EUROCONTROL [19], and with the ADREP taxonomy, the most complete aviation safety taxonomy developed by ICAO. A loss of separation incident that occurred in the Edmonton area (Canada) is used as a case study to illustrate this methodology as well as the whole analysis process.

This proposal builds upon what can be considered three main paradigm shifts in aviation safety:

• The consideration of safety III, defined by Hollnagel [4], as complementary combination between safety-I and safety-II concepts and approaches.
• New safety methods and models to learn from both success and failed safety stories, and to represent the complexity of modern socio-technical systems and the dynamics of the interactions between humans, technical systems, and the environment.
• The reporting and evaluation of serious and less serious safety events.

The proposed work is an initial step to mitigate the remaining lack of interconnection between the three elements above today. Despite Hollnagel’s proposal of integration of traditional safety methods (Safety I) and modern safety approaches (Safety II), nowadays the three previous paradigms present weak interconnections. Classic safety methods are overlooked and rejected in favor of more multifaceted and fresh approaches, wasting the benefits of a multi-method perspective in the context of safety management. Meanwhile, the new safety methods are intricate, demand high levels of expertise, and cannot be straightforwardly applied to the analysis of the data and information complied in aviation safety databases.

The paper extensively discusses the strengths and weaknesses of the various types of safety investigation methods, in particular the ones that are proposed to be combined (fishbone, a sequential method, and SOAM, an adaptation of the reason epidemiological method). It also places our proposal in relation to other existing approaches, showing the benefits of a multi-method approach for safety. This research is also contextualized as an instrument necessary for the application of symmetry analysis methods into aviation safety.

Our approach will allow a new interaction between traditional and new safety methods. The proposed triplet can be used to pre-process information in safety occurrences, paving the way for the further exploitation of safety occurrence databases with much more state-of-the-art methods such as FRAM or STAMP.

Through this methodology, we have also explored its advantage for possible computational applications in incident investigations. For this case study, a simple BN model was created to understand this specific incident scenario.

6. Future Work

This transformation from SOAM analysis to ADREP taxonomy codification allows the creation of a database to store all events and factors of every incident. With the database, numerous research topics related to ATM incident investigations, such as mathematical modeling, predictive analysis, or system improvement assessment can be developed.

As a consequence of this methodology application, we have proceeded to analyze all serious LOS incidents that occurred and were reported over four years within Spanish air space. Based on this previous BN model analysis, we divided this project into two blocks:

• In the first phase, a static BN model was constructed to understand correlations between factors and events in these serious incidents. Additionally, a computational analysis was considered that combined the BN model with information theory for accident precursor detection [35].
• In the second phase, and for future work, a dynamic BN model should be considered to assess the efficiency of current barriers or the possibility of new designs.