A Study on Practical Guidelines for Resilient Flight Operation Behavior Through Case Analysis Based on Integrated Safety Management System

1. Introduction

1.1. Research Background

The aviation industry has achieved continuous development based on advanced technology and high-level safety management systems. According to International Air Transport Association (IATA) statistics (2023), while major accidents have significantly decreased [1], minor failures in routine operations continue to occur, and notably, certain types of cases show a pattern of recurrence.

These failure cases are currently managed from a Safety-I perspective, which focuses on finding causes and proposing solutions after failure cases occur. Analysis of internal notices and safety education materials from Airline A revealed that this approach tends to address only superficial causes and solutions of failures, showing limitations in solving fundamental problems. In particular, the fact that similar cases continue to recur due to safety managers’ limited resources making systematic analysis difficult suggests that a new examination of current safety management systems and education/training methods is necessary.

1.2. Research Objectives

This study aims to improve the aviation safety management system by integrating Safety-I and Safety-II methodologies, transforming the safety management paradigm from ’failure prevention’ to ’success expansion.’ Through this, we aim to enhance organizational safety culture by learning from both failure and success cases, and establish practical guidelines for flight crew’s resilient behavior.

The specific objectives of this study are as follows. First, identify deficiencies in the current safety management system by analyzing selected failure cases through Safety-I methodology. Second, define ’flight crew’s resilient behavior’ from a operational personnel perspective and propose methods to manage factors related to failure cases analyzed through Safety-I methodology. Third, propose specific methods to transform adverse situations during operations into resilient success cases based on Safety-II methodology. Finally, explore ways to utilize these proposed methods not only for failure case prevention but also as basic guidelines for safety management and education/training.

1.3. Research Methodology

This study first presents key concepts through comprehensive understanding of Safety-I and Safety-II, and constructs the research framework by examining Yoon’s (2010) HEAR (Human Error Analysis and Reduction) framework [2], a Safety-I methodology, and leading Safety-II research in aviation including FSF LAO (Flight Safety Foundation Learning from All Operations) (2022) PAM (Pressure, Adaptations, Manifestations) framework [3] and AA LIT (American Airlines Learning and Improvement Team) (2021) LPAC (Learn, Plan, Adapt, Coordinate) Model [4].

Failure case analysis is performed based on the HEAR framework, and validates the effectiveness of Safety-I methodology through critical review of current safety management behaviors. Subsequently, to effectively manage the root causes of failure cases and expand safety management concepts to Safety-II, we define ’Flight Crew’s Resilient Behavior’ to present core behavioral elements for operational personnels’ resilient behavior.

Based on FSF LAO’s ’PAM Framework’ and AA LIT’s ’LPAC Model’, we propose and validate specific methods for transforming each case into resilient success cases. Through this research process, we present methods for utilizing Safety-I methodology that allows safety managers to systematically analyze failure cases using the HEAR framework, and propose ways to use results derived through Safety-II methodology as basic guidelines for education and training.

Through this research process, as shown in Figure 1, we aim to propose practical methods to overcome the limitations of current safety management systems and strengthen flight crews’ resilient behavior.

2. Theoretical Background and Research Methodology

2.1. Comprehensive Understanding of Safety-I and Safety-II

Traditional safety concept Safety-I is very useful in purely technical systems composed of technical elements, but has been noted to have limitations in dealing with safety issues in complex socio-technical systems [5]. In particular, there exists a conceptual contradiction between Safety-I’s concept and methodology - while Safety-I’s safety concept is defined as ’a state where adverse situations are minimized or non-existent’, its methodology is paradoxically useful only when adverse situations exist as it aims to find and resolve accident causes. Safety-II was proposed from the motivation to complement these limitations and contradictions and present new safety concepts and practical methods [5].

The key differences between Safety-I and Safety-II are clearly evident in terms of safety definition, safety management principles, attitudes toward human factors, role of performance variability, model and system characteristics, and learning and improvement aspects. Safety-II particularly shows fundamental differences from Safety-I in viewing human factors as resources necessary for system flexibility and resilience, and recognizing performance variability as both inevitable and useful elements.

The concept of resilience forms the core of Safety-II. Hollnagel (2010) defines resilience in safety management as “the ability to maintain required operations under both expected and unexpected conditions by adjusting functions before, during, or after changes and disturbances” [6]. The European Union Aviation Safety Agency (EASA) defines resilience in a similar context [7], and notably, AA LIT (2021) characterizes resilient behavior through the concept of ’potential’, which they define as “positive, recurring capability to adjust performance by responding to changes, disturbances and opportunities under actual operating conditions in a flexible and timely manner,” recognizing the essence of resilience as the harmony of four elements: Learn, Plan, Adapt, and Coordinate [4,8].

2.2. Research Methodology

In this study, we apply the HEAR framework, which has been validated in the railway sector, to conduct systematic case analysis in aviation safety. The HEAR framework provides methodology that field practitioners can easily utilize by presenting detailed analysis methods from analysis initiation to conclusion drawing, and providing specific guidelines for clearly understanding relationships between related causes [2]. As shown in Figure 2, it enables systematic analysis through stepwise procedures including basic situation analysis, error cause analysis, and Why-Because Tree visualization.

Along with this, to apply Safety-II in practice, we integrate the LPAC model[4] and the PAM framework[3]. As shown in Figure 3, combining these two models provides concrete and practical guidelines for improving resilient behavior in the field.

2.3. Case Selection

This study selected three types of failure cases where organizational factors were deemed to have impaired flight crews’ decision-making abilities. First, altitude/course deviation cases due to inappropriate use of FMS (Flight Management System) functions represent typical cases where the effectiveness of organization-provided education/training related to system operation can be examined. Second, crew injury cases due to in-flight turbulence are cases where the adequacy of weather-related safety education and field response can be evaluated. Third, approach abort cases due to high-energy state during instrument approach are cases where the appropriateness of conventional safety management behaviors related to aircraft energy management can be examined.

These cases are considered representative examples requiring organizational systematic approach rather than mere individual mistakes or capability issues, and are deemed suitable for developing improvement measures through integrated approach of Safety-I and Safety-II.

3. Analysis and Results

3.1. Systematic Analysis Through Safety-I Methodology

3.1.1. Case 1: Analysis of FMS (Flight Management System) Function-Related Failure Cases

We analyzed two failure cases that occurred at two-month intervals at Airline A as a single case. The first involved violating safety altitude for World Trade Center avoidance during ILS (Instrument Landing System) 13L approach at New York airport, while the second involved path deviation during ILS Z RWY 23 approach at Haneda airport. Both cases occurred during manual input process due to mismatch between STAR (Standard Terminal Arrival Route) endpoint and IAP (Instrument Approach Procedure) starting point in the FMS, and although the safety management department did not point out the connection between these two incidents, they showed very similar characteristics, so they were classified and analyzed as a single case.

Analysis of the HEAR framework as shown in Figure 4 identified three main types of errors. First, information perception errors occurred because flight crews lacked understanding of situations where STAR endpoints and instrument approach procedure starting points did not match. In particular, they lacked knowledge about procedures where controllers guide aircraft from STAR endpoints or specific points to intermediate segments of instrument approach procedures according to PANS-OPS (Procedures for Air Navigation Service – Aircraft Operation) standards, and thus failed to recognize that path discontinuity could occur in FMS settings.

Second, decision-making errors emerged as a result of not considering the characteristics of New York and Haneda airports. While these airports are known for high flight mission assignment rates and frequent approach procedure modifications, inappropriate decisions were made to manually input missing points of incomplete instrument approach procedures due to the aforementioned information perception errors.

Third, execution errors occurred during FMS setup process. Since path discontinuity was attributable to STAR selection, options could have been provided at the instrument approach procedure starting point using the ’NO STAR’ function, but flight crews did not use this function and chose inappropriate manual input methods instead.

Quantitative analysis of contribution factors revealed that organizational human resource management accounted for 53% of all identified factors, followed by management/supervision issues at 20%, and safety culture-related issues at 13%. In particular, the vulnerability of the education/training system emerged as the most significant issue, attributed to the absence of in-depth educational content for understanding FMS principles and specific functions.

Moreover, there was a lack of awareness about the risks of FMS manual input and inappropriate response practices persisted, leading to similar cases recurring within two months due to safety managers’ lack of insight. These analysis results suggest that rather than simply improving individual capabilities, comprehensive and continuous organizational efforts including enhancement of education/training systems are necessary.

3.1.2. Case 2: Analysis of Turbulence-Related Failure Cases

Based on the Ministry of Land, Infrastructure and Transport’s Aviation and Railway Accident Investigation Board (2022) accident investigation report, this case involved a cabin crew member suffering a fractured left ankle after encountering turbulence at approximately 16,700 feet while climbing along the route after departing from the departure airport. The cabin crew member’s injury occurred while moving to check on passenger safety in the lavatory when the seat belt sign was illuminated, demonstrating issues in turbulence response strategy implementation and decision-making process [10].

Analysis using the HEAR framework as shown in Figure 5 identified three main types of errors. First, execution errors occurred in terms of failing to properly time turbulence avoidance strategy implementation and incorrect task performance methods. Second, decision-making errors emerged from making incorrect decisions based on inaccurate analysis of preceding aircraft information and aircraft weather radar. Third, situation assessment errors occurred from misjudging the current weather conditions, leading to entry into turbulence areas.

These series of errors were interconnected, ultimately resulting in the safety risk of crew injury due to turbulence area entry.

Quantitative analysis of contribution factors showed that organizational human resource management accounted for 69% of all identified factors, with safety culture-related issues accounting for 13%. Notably, education/training system issues were prominent - review of the airline’s safety education materials showed no significant changes beyond delivering existing materials and comparing case overviews.

The detailed content of adverse weather training included only basic knowledge about standard operating procedures related to turbulence, jet streams, weather radar, and crew coordination, lacking practical guidelines such as how to utilize weather information like WSI (Weather Services International). Moreover, the fact that the safety management department merely repeats past approaches despite continuous passenger injuries from turbulence suggests serious issues in the organization’s safety culture. These analysis results indicate the need for fundamental problem solving through developing practical education/training programs, improving safety culture, and systematic approaches, rather than merely addressing individual mistakes or capability deficiencies.

3.1.3. Case 3: Analysis of Aircraft Energy Management-Related Failure Cases

We analyzed a case of approach abort due to improper energy management during instrument approach. This case began when a pilot arbitrarily reduced aircraft speed regardless of traffic flow management while controllers were managing the flow of multiple aircraft entering the instrument approach segment. Subsequently, due to airspace altitude restrictions and the need to maintain separation from other aircraft, a High Energy (altitude/speed) situation developed, ultimately resulting in an approach abort as the aircraft exceeded the prescribed altitude and speed criteria for landing. While generally aborting landing from an unstable approach and performing re-entry is not considered a failure case, attempting landing without maintaining proper energy is significant as it can lead to serious risks such as late landing gear extension, speed limit exceedance, runway excursion, or CFIT (Controlled Flight Into Terrain).

Analysis using the HEAR framework as shown in Figure 6 identified two main types of errors. First, decision-making errors manifested as inappropriate responses to ATC’s High Energy condition instructions. The flight crew’s behavior of arbitrarily reducing speed to maintain low energy, deviating from predictable ranges, became an obstacle to air traffic flow and consequently led to ATC restrictions. Second, execution errors occurred in the selection of instrument approach execution methods. Notably, it was confirmed that despite FMS continuously providing important results for situation awareness, disregarding this and utilizing traditional navigation was a common practice among Airline A’s flight crews.

Quantitative analysis of related factors revealed that organizational human resource management accounted for 57% of all identified factors, while worker knowledge/ experience/abilities, task characteristics, regulations/business procedures, management/supervision issues, and organizational processes/culture each accounted for 9%. Notably, while education for interpreting FMS principles and results was absent, repetitive training on traditional methods continued, which is noteworthy.

Furthermore, despite the high frequency of similar cases, the fact that managers maintain traditional methods without adjusting approach methods for managing High Energy situations suggests fundamental issues in organizational safety culture. These analysis results indicate the need for fundamental problem solving through developing practical education/training programs utilizing FMS, improving management supervision systems, and systematic approaches.

3.2. Comprehensive Analysis Results

As shown in Table 1, the most notable characteristic among the 54 causal factors identified through the HEAR framework is that 87.1% (47 cases) were organization-related factors. This is 6.7 times higher than individual/task factors (13%), clearly showing that the root causes of failures lie in organizational rather than individual dimensions.

In particular, the vulnerability of education/training systems was prominent, with human resource management-related issues accounting for 59.3% (32 cases), among which lack of education/training (25.9%, 14 cases) represented the largest proportion. Additionally, management/supervision system-related issues accounted for 11.1% (6 cases), mainly related to supervision action negligence (4 cases).

As shown in Table 2, comparing the safety management department’s approach with Safety-I methodology analysis results revealed significant differences. While the safety management department focuses on procedural solutions centered on operational personnels and remains at reactive responses for preventing failure case recurrence, Safety-I methodology analysis identified fundamental organizational-level issues such as safety managers’ lack of insight, inappropriate education/training systems, and limitations of organizational culture.

These analysis results indicate that systematic and fundamental improvements at the organizational level are needed in aviation safety management, beyond individual-level improvements. In particular, systematic strengthening of education/training systems and improvement of management/supervision systems were identified as urgent tasks.

4. Methods for Improving Resilient Behavior

4.1. Definition of ’Flight Crew’s Resilient Behavior’

This study newly defined flight crew’s resilient behavior in the specific context of civil aircraft operations, reflecting Safety-II characteristics to overcome Safety-I limitations. ’Flight Crew’s Resilient Behavior’ is defined as “the repetitive behavior or capability of flight crews who can successfully manage adverse events by effectively utilizing aircraft systems, having the ability to predict and plan for adverse events, based on high-level effective learning.”

This definition includes four core components. First, high-level effective learning refers to acquiring expertise in aircraft operations and skills through operational experience [6,11,12,13]. Second, the ability to predict and plan for adverse events includes the capability to identify potential risk factors in advance and establish response plans [3,4,5,6,8,14,15]. Third, effective utilization of aircraft systems means the ability to optimize system operation in both normal and abnormal situations [5,6,11,15]. Fourth, successful management of adverse events refers to the ability to maintain safe operations through real-time situation awareness and appropriate responses [11,12].

4.2. Case-Specific Methods for Improving Resilient Behavior

For the three types of failure cases analyzed, we developed specific methods for improving resilient behavior by applying AA LIT’s LPAC model and FSF LAO’s PAM framework. The PAM framework provides a structure for systematically analyzing pressure factors and adaptation methods, and their results [3,14], while the LPAC model presents specific behavioral guidelines in four aspects: Learn, Plan, Adapt, and Coordinate [3,4,8].

For improving resilient behavior related to Case 1 FMS operations, in-depth understanding of FMS functions and limitations must precede. Particularly important are appropriate response methods in situations where STAR endpoints and IAP starting points don’t match, and the ability to quickly reconfigure in cases of late runway changes. For this, flight crews must establish contingency plans for approach procedure changes, be able to respond flexibly to situation changes, and effective coordination between crew members is essential. Accordingly, “the repetitive capability to accurately and quickly reconfigure FMS in adverse situations such as setting/changing instrument approach procedures or late runway changes, based on effective learning and high-level understanding of FMS” was established as flight crew’s resilient behavior.

For improving resilient behavior related to Case 2 adverse weather, weather information analysis and prediction capabilities must be strengthened. Flight crews must assess turbulence probability during pre-flight weather briefing and establish avoidance strategies. During actual flight, they must secure passenger safety through effective use of weather radar and smooth communication with cabin crew. Accordingly, “the repetitive capability to analyze weather-related situations and establish and execute strategies for mitigation, based on effective learning and high-level understanding of adverse weather and aircraft weather radar” was established as flight crew’s resilient behavior.

For improving resilient behavior related to Case 3 aircraft energy management, systematic energy state monitoring using FMS is necessary. Particularly important are establishing pre-plans for preventing high energy states and finding resolution methods through effective coordination with ATC when situations occur. Accordingly, “the repetitive capability to effectively utilize FMS to manage aircraft energy at appropriate levels in adverse situations such as High Energy approach conditions, based on effective learning and high-level understanding of FMS” was established as flight crew’s resilient behavior.

The LPAC model systematizes specific behaviors required in each case in four aspects. From the learning aspect, it emphasizes sharing past experiences and application; from the planning aspect, proactive identification of threat elements and establishing response measures; from the adaptation aspect, real-time situation response and workload management; and from the coordination aspect, effective communication and situation awareness sharing among team members. Table 3 is presented below as a representative example of specific behavioral guidelines.

5. Evaluation of Integrated Safety Management Approach

5.1. Practical Application Guidelines for Integrated Safety Management

The integrated approach of Safety-I and Safety-II presented in this study derives resilient behavior improvement methods by combining systematic failure case analysis through the HEAR framework with PAM framework and LPAC model, as shown in Figure 7. Through this integrated approach, organizations can learn from past failures while developing strategies for future success.

The education/training programs should be improved to strengthen the connection between theoretical knowledge and practical application. This will contribute to creating an organizational culture that can learn from both failures and successes by reflecting the root causes of failures identified through the HEAR framework in Safety-II’s resilient behavior definition.

At the organizational level, programs for strengthening safety managers’ capabilities should be operated, and a data-based decision-making system should be established. As shown in Figure 7, this can simultaneously improve safety managers’ analytical abilities and operational personnels’ resilient behavior capabilities by combining the analytical approach of the HEAR framework with the adaptive approach of PAM framework and LPAC model.

To ensure the effectiveness of this integrated approach, appropriate performance indicators should be developed, and continuous improvement should be made through regular evaluation. This includes the process of validating effectiveness in actual operational environments and deriving necessary improvements.

5.2. Analysis and Evaluation of Safety Management Improvement Effects

Comprehensive analysis was conducted to evaluate the effectiveness of the integrated safety management approach through quantitative and qualitative assessment, comparing the results between Safety-I methodology and integrated safety management implementation as shown in Table 4 and Figure 8.

The analysis revealed significant improvements in three key areas. First, substantial progress was made in resolving systematic issues, as evidenced by the reduction in total identified related factors from 54 to 19 cases. Particularly noteworthy was the significant improvement in system-related issues, with regulations/business procedures, management/supervision, and organizational processes/culture issues showing substantial reduction from their initial levels (5.6-11.1%), indicating positive systemic changes. This systematic improvement demonstrates the transformation from reactive to proactive safety management.

The second significant change was observed in the education and training domain. While human resource management-related issues showed a numerical decrease from 32 to 13 cases, their proportional significance actually increased from 59.3% to 68.4%. This shift indicates a more focused and strategic approach to human resource development, emphasizing the critical role of education and training in safety management.

The third notable improvement was in the understanding and management of worker and task characteristics. The relative importance of worker knowledge, experience, and abilities increased from 7.4% to 15.8%, while task characteristic-related issues showed a similar increase from 5.6% to 15.8%. This resulted in an overall increase in worker/task related factors from 13% to 31.6%, representing a more balanced approach between system and individual factors in safety management.

5.3. Future Improvement Tasks

Based on the effectiveness evaluation results, future improvement tasks were identified as advancement of education/training systems, strengthening task characteristic-based approaches, and establishment of continuous monitoring systems. Particularly for education/training systems, development of systematic programs along with establishment of effectiveness evaluation systems is needed, and development of field-centered practical guidelines considering task characteristics is required for customized safety management solutions. Furthermore, continuous development should be pursued through establishment of regular effectiveness evaluation and improvement feedback systems.

These evaluation results demonstrate that while the integrated safety management approach was effective in resolving systemic issues, they also indicate the need for continuous improvement considering education/training and worker/task characteristics.

6. Conclusions

6.1. Key Research Achievements

This study proposed improvement methods for aviation safety management systems through integrated application of Safety-I and Safety-II methodologies. In the failure case analysis using Safety-I methodology HEAR framework, key deficiencies in safety management practice were identified, with particular empirical confirmation that the root causes of failures lie in organizational rather than individual dimensions. Of all identified causal factors, 87.1% being organization-related factors clearly demonstrates the need for system-centered approaches.

The finding that quality education/training significantly contributes to improving operational personnels’ resilience was also an important discovery. Analysis results showing that education/training system vulnerability accounted for 59.3% of all causes suggest that development and implementation of systematic education/training programs is a key task for safety management improvement. In particular, defining ’Resilient Behavior’ for specialized operational personnels like flight crews is considered a meaningful achievement in providing basic guidelines for expansion from Safety-I to Safety-II.

6.2. Practical Implications

The practical implications of this study can be summarized in three main points. First, it presented specific methods for strengthening safety managers’ capabilities. The aviation field application of the HEAR framework provides a practical tool for safety managers to systematically analyze failure cases and identify root causes.

Second, it presented innovative directions for education/training programs. By proposing practical education/training methods to enhance resilient behavior beyond simple knowledge transfer and procedure familiarization, it suggested field-centered improvement directions with actual effectiveness.

Third, it presented directions for improving organizational safety culture. Through the paradigm shift from ’failure prevention’ to ’success expansion’, it proposed more proactive and positive safety management cultural establishment methods.

6.3. Research Limitations and Future Tasks

The limitations of this study and future research tasks to complement them are as follows. First, additional case studies for extensibility verification are needed. The generalizability of research results needs to be verified through empirical case analysis in various aviation safety areas beyond the three types of cases analyzed in this study.

Second, the effectiveness of research results needs to be verified from multiple angles. Beyond current quantitative indicator-centered evaluation, research’s practical value and academic validity can be further strengthened through integrated application of various evaluation methods including simulation studies, field pilot applications, benchmarking with other airlines, and in-depth interviews with practitioners.

Third, field application and effectiveness verification are needed. Verifying the methodology and deriving improvement measures in various operational environments of the aviation industry is an essential task for enhancing the practical applicability of research results. Above all, for such changes and development to occur, management’s firm commitment and decisive implementation are prerequisites, which will be the most important factor in establishing a sustainable safety management system.