SHIELD Human Factors Taxonomy and Database for Learning from Aviation and Maritime Safety Occurrences
- At the top of the iceberg, it may be relatively easy to see what happened in an occurrence: Who did what and what happened is usually known or at least strongly suspected. The analysis focus at this level is observable performance. The reasons why it happened are not uncovered, such that there is no change in the design or operation. Somebody (if they survived) can be blamed and re-trained, until the next occurrence. The issue is seen as dealt with, but safety learning has failed.
- The second layer considers a range of factors affecting human performance, including HF concepts such as workload, situation awareness, stress and fatigue, human system interfaces, and teamwork. Investigating incidents at this level can lead to more effective prevention strategies and countermeasures, addressing systemic and structural aspects, e.g., job design and interface design.
- The third layer considers how the operations were locally organised and led by operations leaders. There are internal and external targets placing demands on the operators. These may result in workarounds, which can support the efficiency and productivity of the work, which can sometimes also allow risks to emerge. The challenge is determining how jobs and tasks are actually performed in this context. Learning considers the local organisation of the work and leadership strategies in operations.
- The fourth and final layer considers the culture (professional, organisational, national) and socioeconomics (demands, competition) of each sector, which affect individuals, organisations and industries. The analysis focus at this layer is on norms, values and ways of seeing the world and doing things. Such understanding is key to ensuring that derived safety solutions and countermeasures are sustainable for the staff and operating conditions.
2. Materials and Methods
2.1. Human Factors Taxonomy
- Perception (4 factors): The operator does not perceive, or perceives too late or inaccurately, information necessary to formulate a proper action plan or make a correct decision. The factors distinguish between the sensory modalities (visual, auditory, kinaesthetic, and other).
- Planning and Decision Making (3 factors): The operator has no, late or an incorrect decision or plan to manage the perceived situation. This includes issues with the interpretation/integration of information streams, but it excludes intentional deviations from procedures.
- Intentional Deviation (4 factors): The operator decides to intentionally deviate from an agreed procedure or practice, including routine and specific workarounds, and sabotage.
- Response Execution (6 factors): The operator has planned to perform an action that is appropriate for the perceived situation, but executes it in a wrong manner, at an inappropriate time or does not execute it at all. It includes slips and lapses, such as switching actions in sequences, pushing a wrong button and a lack of physical coordination. It excludes communication acts.
- Communicating (2 factors): The operator has planned to take an action that is appropriate for the perceived situation but communicates incorrect or unclear information to other actors or does not communicate at all.
- Physical Environment (9 factors): Conditions in the physical environment such as visibility, noise, vibration, heat, cold, acceleration and bad weather.
- Equipment and Workplace (6 factors): Conditions in the technological environment related to ergonomics, the human–machine interface (HMI), automation, working position and equipment functioning.
- Interpersonal Communication (4 factors): Conditions affecting communication in operations, such as language differences, non-standard or complex communication and the impact of differences in rank.
- Team/Group (6 factors): Conditions in the functioning of a team/group, such as working towards different goals, no cross-checking, no speaking up, no adaptation in demanding situations and groupthink.
- Misperception (4 factors): Misperception conditions leading to misinterpretation, such as motion illusion, visual illusion and the misperception of changing environments or instruments. They provide background for the reason that an operator did not aptly perceive.
- Awareness (7 factors): Lack of focused and appropriate awareness functions leading to misinterpretation of the operation by an operator, such as channelized attention, confusion, distraction, inattention, being ‘lost’, the prevalence of expectations or using an unsuitable mental model.
- Memory (3 factors): Memory issues leading to forgetting, inaccurate recall or using expired information.
- Mental Workload (4 factors): The amount or intensity of effort or information processing in a task degrades the operator’s performance, including low and high workload, information processing overload and the startle effect.
- Personal Factors (7 factors): Personal factors such as emotional state, personality style, motivation, performance pressure, psychological condition, confidence level and complacency.
- Physiological Condition (5 factors): Physiological/physical conditions such as injury, illness, fatigue, burnout, hypoxia and decompression sickness.
- Drugs and Nutrition (3 factors): Use of drugs, alcohol, medication or insufficient nutrition affecting operator performance.
- Competence, Skills and Capability (4 factors): Experience, proficiency, training, strength or biomechanical capabilities are insufficient to perform a task well.
2.1.3. Operational Leadership
- Personnel Leadership (4 factors): Inadequate leadership and personnel management, including no personnel measures against regular risky behaviour, a lack of feedback on safety reporting, no role model and personality conflicts.
- Operations Planning (6 factors): Issues in the operations planning, including inadequate risk assessment, inadequate team composition, inappropriate pressure to perform a task and a directed task with inadequate qualification, experience or equipment.
- Task Leadership (5 factors): Inadequate leadership of operational tasks, including a lack of correction of unsafe practices, no enforcement of existing rules, allowing unwritten policies to become standards and directed deviations from procedures.
- Culture (2 factors): Safety culture problems or sociocultural barriers causing misunderstandings.
- Safety Management (5 factors): Safety management in the organisation is insufficient, including a lack of organisational structure for safety management and limitations of proactive risk management, reactive safety assurance, safety promotion and training and suitable documented procedures.
- Resources (6 factors): The organisation does not provide sufficient resources for safe operations, including personnel, budgets, equipment, training programs, operational information and support for suitable design of equipment and procedures.
- Economy and Business (4 factors): The economy and business of the organisation pose constraints that affect safety, including relations with contractors, strong competition, economic pressure to keep schedules and costs and the required tempo of operations.
2.2. Other Taxonomies in SHIELD
- Occurrence overview: This provides general data on the occurrence, such as headline, date and time, location, number of fatalities and injuries, damage and a narrative of the occurrence.
- Occurrence type: The type of occurrence is described by domain-specific occurrence classes (e.g., accident, serious incident, very serious marine casualty, marine incident) and occurrence categories (e.g., runway incursion, controlled flight into terrain, collision in open sea, capsizing).
- Context: This gathers a range of contextual conditions, such as precipitation, visibility, wind, wake turbulence, light, terrain, sea and tidal conditions, runway conditions and traffic density. This is performed via structured lists, numbers or free texts.
- Vehicle and operation: Information on vehicles involved in a safety occurrence is gathered, such as an operation number, vehicle type (e.g., helicopter, container ship, fishing vessel) and year of build. The operation is specified by operation type (e.g., commercial air transport, recreative maritime operation), operation phase (e.g., take-off, berthing) and level of operation (e.g., normal, training, emergency).
- Actor: The backgrounds of actors involved in a safety occurrence are gathered, describing high-level groups of actor functions (e.g., flight crew, port authority), actor roles (e.g., tower controller, technician, chief officer), activity, qualification, experience, time on shift, age and nationality.
- Prevention, mitigation and learning: The collection of actions by human operators and/or technical systems that prevented the situation from developing into an accident, or that limited the consequences of an accident, is supported by free text fields. Moreover, lessons that have previously been identified following a safety occurrence, e.g., changes in designs, procedures or organisation, can be gathered. These data support the evaluation of the resilience due to operator performance and support safety learning in and between organisations.
2.3. SHIELD Backend and Frontend
- Dashboard: Overview of statistics on HF and occurrence categories (see Figure 3).
- Search: Facility to search for occurrences with particular values.
- My reports: Overview and editing of reports created by a user.
- Create new report: Allows the user to store occurrences according to the taxonomy.
- User guidance: Documentation on the functionalities and taxonomy.
2.4. Data Collection
2.5. Data Analysis Process
2.6. Evaluation by Stakeholders
3.1. Cross-Domain HF Statistics
3.2. Evaluation by Stakeholders
3.3. Early Application of SHIELD in the Maritime Domain
Institutional Review Board Statement
Informed Consent Statement
Data Availability Statement
Conflicts of Interest
Appendix A. SHIELD HF Taxonomy
Appendix A.1. Acts
|AP||Perception||The Operator Does Not Perceive, or Perceives Too Late or Inaccurately, Information Necessary to Formulate a Proper Action Plan or Make a Correct Decision|
|AP1||No/wrong/late visual detection||The operator does not detect, or detects too late or inaccurately, a visual signal necessary to formulate a proper action plan or make a correct decision.||• Controller is late in detecting the deviation of the aircraft.|
• Poor visual lookout by Officer of Watch (OOW). OOW is busy with other tasks and when looking does not look around the horizon.
|AP2||No/wrong/late auditory detection||The operator does not detect, or detects too late or inaccurately, an auditory signal necessary to formulate a proper action plan or make a correct decision.||• The pilot did not hear the heading instruction and did not turn.|
• The operator did not seem to hear (did not react to) the warning chime.
|AP3||No/wrong/late kinaesthetic detection||The operator does not detect, or detects too late or inaccurately, a kinaesthetic signal necessary to formulate a proper action plan or make a correct decision.||• Neither of the pilots made any reference to the buffet during the stall of the aircraft.|
|AP4||No/wrong/late detection with other senses (e.g., smell, temperature)||The operator does not perceive, or perceives too late or inaccurately, information received with senses different from vision, hearing and touch, which is necessary to formulate a proper action plan or make a correct decision.||• The chief engineer did not timely smell the overheated engine.|
|AD||Planning and Decision Making||The operator has no, late or an incorrect decision or plan to manage the perceived situation.|
|AD1||Incorrect decision or plan||The operator elaborates an action plan or makes a decision which is insufficient to manage the situation.||This factor should not be used for situations where the operator decides to not act to manage the situation. In such situations it is advised to use AD3: No decision or plan.|
• The pilot decided to descend too early for the approach in the mountainous area.
• The skipper had decided not to use the outward bound channel but to steer a course parallel with the land.
|AD2||Late decision or plan||The operator does not elaborate on a timely action plan or decision to manage the situation.||• The controller decided to provide a heading instruction to avoid entering other airspace but was too late, leading to an area infringement.|
• It was only during the final minute that the chief officer switched the helm control to manual steering and sounded the whistle.
|AD3||No decision or plan||The operator does not elaborate on any action plan or decision to manage the situation.||This factor should also be used for situations where the operator decides to not act to manage the situation. |
• Though he was twice informed of the presence of conflicting traffic, the pilot did not make an evasive action nor looked for the conflicting aircraft.
• It is apparent that at no stage did the officer of watch consider reducing speed.
|AI||Intentional Deviation||The operator decides to intentionally deviate from an agreed procedure or practice, including workarounds and sabotage.|
|AI1||Workaround in normal conditions||The operator decides to intentionally deviate from an agreed procedure or practice in a normal operating condition.||If it is known that the workaround is used on a regular basis, AI2 “Routine workaround” should be used. |
• In this particular case the master did not post a lookout during the bridge watch.
|AI2||Routine workaround||The operator habitually and intentionally deviates from an agreed procedure or practice on a regular basis.||This factor should only be used if it can be shown that the workaround is used on a regular basis; otherwise use AI1 “Workaround in normal conditions”.|
• Captain as Pilot Flying also regularly performs Pilot Monitoring tasks.
• It was the master’s custom not to post a lookout during the bridge watches.
|AI3||Workaround in exceptional conditions||The operator decides to intentionally deviate from an agreed procedure or practice in an exceptional operating condition.||• Pilot had an engine failure and could not glide back to his airfield, he opted to land on the highway.|
• Becoming concerned about the presence of the fishing vessels, the Filipino officer of watch asked the Chinese second officer to call the fishing vessels in Mandarin to ask them to keep clear.
|AI4||Sabotage||The operator decides to intentionally deviate from an agreed procedure or practice in order to create damage to the system or organization.||This code should only be used when the operator intends to create damage. It should not be used in other cases where an operator intentionally deviates from a procedure.|
• The crash of Germanwings Flight 9525 (24 March 2015) was deliberately caused by the co-pilot.
|AR||Response Execution||The operator has planned to take an action that is appropriate for the perceived situation, but executes it in a wrong manner, at an inappropriate time or does not execute it at all.|
|AR1||Timing error||The operator has planned to take an action that is appropriate for the perceived situation but executes it either too early or too late.||This considers timing errors in the response execution only. Timing errors that are due to late perception should be represented by the category Perception. Timing errors that are due to wrong or late decisions should be represented by the category Planning And Decision Making.|
• The shipper got distracted and acted too late.
|AR2||Sequence error||The operator carries out a series of actions in the wrong sequence.||This considers sequence errors in the response execution of an appropriate plan only, for instance switching two actions in a standard sequence. Sequence errors that are the resultant of wrong planning should be represented by the category Planning And Decision Making. |
• The pilot put the gear down prior to flaps 20.
|AR3||Right action on the wrong object||The operator has planned to take an action that is appropriate for the perceived situation but—when executing it—selects an object (e.g., lever, knob, button, HMI element) different from the intended one.||• The controller plugged the headphone jack into the wrong socket.|
|AR4||Wrong action on the right object||The operator selects the correct object (e.g., lever, knob, button, HMI element), but performs an action that is not the correct one.||• Adding information to the flight management system (FMS) was not performed well, causing route dropping. Rebuilding FMS did still cause problems.|
• The master was not using the automatic radar plotting aid (ARPA) properly to check the other vessels movements and obtain the correct closest point of approach.
|AR5||Lack of physical coordination||The operator takes an action which is appropriate for the perceived situation, but executes it in a wrong manner, due to a lack of physical coordination.||• The operator did not timely manage to move the heavy obstacle.|
|AR6||No action executed||The operator has planned to take an action that is appropriate for the perceived situation but does not execute it.||This lack of action should be distinguished from no actions due to problems in the category Planning And Decision Making, such as AD3 (No decision or plan). AR6 should be used if an operator had planned to act, but then did not, for instance because the operator forgot to do so (precondition: PME1).|
• The crew forgot to turn on the heating of the pitot probes before take-off.
|AC||Communicating||The operator has planned to take an action that is appropriate for the perceived situation but communicates incorrect or unclear information to other actors or does not communicate at all.|
|AC1||Incorrect/unclear transmission of information||The operator transmits to other actors information that is incorrect or unclear, e.g., use of wrong callsign.||• Poor pilot readback of instructions.|
• Second officer fails to specifically inform commanding officer about the overtaking situation.
|AC2||No transmission of information||The operator does not transmit information that is necessary for other actors to operate safely/effectively.||• The controller did not issue a low altitude alert.|
• The master did not leave night orders.
Appendix A.2. Preconditions
|PPE||Physical Environment||Conditions in the Physical Environment That Affect the Perception and/or Performance of the Operator, such as Vision Blockage, Noise, Vibration, Heat, Cold, Acceleration and Bad Weather|
|PPE1||Vision affected by environment||Environmental conditions affect the operator’s vision.||• Pilot reported: “When looking for traffic on final, I did not ask my passenger to move his head so I could get a clear view. I believe the passenger blocked my seeing the plane on final.”|
• Due to very poor visibility and fog patches it was very difficult for the master or pilot to have a clear view of the incoming vessels.
|PPE2||Operator movement affected by environment||Environmental conditions affect the operator’s movement.||This factor should be used only if the movement of the human operator is being affected. It should not be used if the movement of the operation (aircraft/ship) is affected by the environment. |
• The repair was complicated by the small space where the maintenance operator had to do the work.
|PPE3||Hearing affected by environment||Environmental conditions affect the operator’s ability to hear.||• Instructor mentions: “Having my ear piece in the ear facing the Local Controller I was not hearing their transmissions very well”.|
• The engines were very loud.
|PPE4||Mental processing affected by environment||Environmental conditions affect the operator’s ability to mentally process or think about information.||• I could not think clearly due to the noise.|
|PPE5||Heat or cold stress||Exposure to heat or cold degrades the operator’s performance capabilities.||• I could not well handle due to the frost.|
|PPE6||Operation more difficult due to weather and environment||Weather conditions and/or environment make controlling the operation more difficult.||It is advised to use other PPE factors if the weather leads to a specific condition that affects the perception or performance of an operator. |
• Difficult approach due to the nearby mountains.
• The anchor dragged due to the wind speed increasing to over 50 kts and the sea swell.
|PPE7||Acceleration||Forces acting on a body by acceleration or gravity degrade the operator’s performance capabilities.||• The pilot’s performance was degraded by the large acceleration.|
|PPE8||Vibration stress||Excessive exposure to vibration degrades operators’ physical or cognitive performance.||• I could not well control due to the excessive vibration.|
|PPE9||Long term isolation||An individual is subject to long-term isolation, and this degrades operator performance.||• Being alone that long affected my reasoning.|
|PEW||Equipment and Workplace||Conditions in the technological environment that affect the performance of the operator, such as problems due to ergonomics, HMI, automation, working position and equipment functioning.|
|PEW1||Ergonomics and human machine interface issues||The ergonomics of tools and human machines interface, including controls, switches, displays, warning systems and symbology degrade the operator’s performance.||• The conflict window was full and the predicted conflict between the aircraft that the controller was interacting with appeared off screen. The controller could not see the conflict in the list.|
• The data link failed to send and error message was cryptic and partly obscured.
|PEW2||Technology creates an unsafe situation||The design, malfunction, failure, symbology, logic or other aspects of technical/automated systems degrade the operator’s performance.||Problems with communication systems are addressed by PEW5 “Communication equipment inadequate”.|
• The false alert of the ground proximity warning system caused the crew to react on it, and led to confusion about the situation.
• Skipper lost the echo of the ship due to interference.
|PEW3||Workspace or working position incompatible with operation||The interior or exterior workspace layout or the working position are incompatible with the task requirements of the operator.||Interior workspace refers to physical layout of the building, cabin, bridge, machine room or workspace and the offices within which people are expected to function. Exterior workspace refers to the physical layout of the exterior of the building/ship/aircraft. |
• Difficult to see the Hold Point location from the tower, due to its height.
• Once seated in the bridge chair, visibility was restricted due to the poor height and angle of the chair itself.
|PEW4||Personal protective equipment interference||Personal protection equipment (helmets, suits, gloves, etc.) interferes with normal duties of the operator.||• The gloves restricted the fine handling of the apparatus.|
|PEW5||Communication equipment inadequate||Communication equipment is inadequate or unavailable to support task demands. Communications can be voice, data or multi-sensory.||This factor only considers communication systems that are used for communication information from one operator to the other, but not navigation and surveillance systems (use PEW2 for those). |
• The air traffic control frequency was busy, and the pilot could not contact the controller.
• The bridge/engine room communication facilities were extremely limited.
|PEW6||Fuels or materials||Working with fuels, chemicals or materials degrades the operator’s performance.||• Working with the chemicals degraded their performance.|
|PCO||Interpersonal Communication||Conditions affecting communication in operations, such as language differences, non-standard terminology, and impact of rank differences.|
|PCO1||Briefing or handover inadequate||Individual or team has not aptly completed the briefing or handover of an activity.||• The initial argument about which noise abatement procedure was correct happened at the taxiing stage. This might have been avoided had the pre-flight briefing been more thorough.|
• Information was missing when the watch was handed over.
|PCO2||Inadequate communication due to team members’ rank or position||Differences in rank or position within team limit or jeopardize team communication.||• Captain did not take serious warning of chief officer, explaining he was more experienced in these cases|
• During the passage, none of the bridge team questioned the pilot why he had allowed the ship to leave the radar reference line.
|PCO3||Language difficulties||Communication between operators with different native languages degrades operator’s performance.||• Language issues prevented the conflict resolution and contributed to the incident since the pilot did not fully understand the clearance to hold short.|
• The pilot did not seek clarification, and he was isolated from the decision-making process during the discussions between the master and third officer in their native language.
|PCO4||Non-standard or complex communication||Operators use terminology/phrases or hand signals differing from standards and training, or they use complex messages that may lead to misunderstanding.||• The controller used confusing phraseology, which was not well understood by the pilot.|
|PTG||Team/Group||Conditions in the functioning of a team/group that affect the performance of operators, such as working towards different goals, no cross-check, no adaptation in demanding situations, and group think.|
|PTG1||Team working towards different goals||Team members are working towards different goals, leading to loss of shared situational awareness and not anticipating potential problems.||• There was no agreed cohesive plan of the approach, with each person involved having their own ideas about what was going to happen.|
• The third engineer did not consult with the chief engineer, and the chief engineer did not seek approval from the bridge before stopping the engines and effectively removing engine power from the master without knowing the navigational situation.
|PTG2||No cross-check and speaking-up by team members||Decisions or actions by team members are not cross-checked. There is no multi-person approach to execution of critical tasks/procedures and no communication of concerns, not necessarily due to rank or position.||If the lack of communication is due to differences in team members’ rank or position, it is advised to use factor PCO2 “Inadequate communication due to team members’ rank or position”.|
• No cross check by captain of settings instrument settings made by first officer.
• Captain did not speak up when the pilot failed to verbalize-verify-monitor the rest of the approach on the flight management system.
|PTG3||No monitoring and speaking-up of team status and functioning||Team members do not monitor the status and functioning of each other for signs of stress, fatigue, complacency, and task saturation, or do not speak up if status and functioning are monitored as being incorrect.||• As a crew we became laser-focused on separate indications and failed to properly communicate our individual loss of situational awareness; we were both in the red.|
• Other senior officers onboard were aware that the master had been drinking, but took no action.
|PTG4||No adaptation of team performance in demanding situation||Team does not adapt to demanding circumstances. There is no change in team roles and task allocation, there is no team prioritisation of plans and tasks, no workload management, and no management of interruptions and distractions.||• Difficult procedure and the first officer was not experienced for it. Captain should have taken over controls.|
• The commanding officer remained at the end of the bridge, physically remote from the master, even though the company’s blind pilotage procedure was no longer being followed. The helmsman was unsure of his new role, which resulted in him becoming disengaged from the bridge team. Consequently, the cohesive structure of the bridge team was lost.
|PTG5||Long term team confinement||Long-term close proximity or confinement degrades team functioning and operator performance.||• Stress and discomfort were manifest in the crew after the long journey.|
|PTG6||Group think||Excessive tendency towards group, team or organization consensus and conformity over independent critical analysis and decision making degrades operator performance.||• There was a lack of independent critical analysis due to conformity pressure of the bridge team.|
|PER||Misperception||Misperception conditions leading to misinterpretation, such as motion illusion, visual illusion, and misperception of changing environments or instruments.|
|PER1||Motion illusion||Erroneous physical sensation of orientation, motion or acceleration by the operator.||• The pilot was acting at the reverse roll following the previous correction due to a false sensation.|
|PER2||Visual illusion||Erroneous perception of orientation, motion or acceleration following visual stimuli.||• Not appreciating the effect of the off-axis window at the working position.|
|PER3||Misperception of changing environment||Misperceived or misjudged altitude, separation, speed, closure rate, road/sea conditions, aircraft/vehicle location within the performance envelope.||• As the aircraft turned, its attitude to the wind changed and its flight performance was affected. The controller did not realise this until it was too late.|
• The apparent proximity of the looming cliffs which surround the bay caused the master to misjudge the vessel’s distance off the shore.
|PER4||Misinterpreted or misread instrument||Misread, misinterpreted or not recognized significance of correct instrument reading.||• Landing gear not down alert was not correctly interpreted.|
• The pilot was reading the electronic bearing line for the course incorrectly, forgetting that the radar origin was off-centred rather than centred.
|PAW||Awareness||Lack of focussed and appropriate awareness functions lead to misinterpretation of the operation by an operator, such as channelized attention, confusion, distraction, inattention, being lost, prevalence of expectations, or using an unsuitable mental model.|
|PAW1||Channelized attention||Operator focuses all attention on a limited number of cues and excludes other cues of an equal or higher priority. This includes tunnel vision.||• Captain focused on the flight management system, while maintaining altitude is more important, and key for his role.|
• While the third officer relied on the electronic chart display and information system (ECDIS) as the primary means of navigation, he did not appreciate the extent to which he needed to monitor the ship’s position and projected track in relation to the planned track and surrounding hazards.
|PAW2||Confusion||Operator does not maintain a cohesive awareness of events and required actions, and this leads to confusion.||• With the airplane in a left descending turn and air traffic control talking on the radio directing us to turn back to the right, I began to feel disoriented and uncomfortable.|
• The action taken by the skipper of vessel A, which put the vessels on a collision course, was not expected by the master of vessel B and confused him.
|PAW3||Distraction||Interruption and/or inappropriate redirection of operator’s attention.||• The pilot was distracted by the presence of his passenger.|
• The chief officer was distracted by the constant VHF radio conversations.
|PAW4||Inattention||Operator is not alert/ready to process immediately available information.||• Controller’s attention was not fully on the pilot at the time and maybe he only heard what he expected to hear.|
• The master relaxed his vigilance when the pilot was on board.
|PAW5||Geographically lost||The operator perceives to be at a different location compared to the one where s/he actually is.||• Pilot was attempting to land on a road he perceived to be the runway. It was raining, cloud base was low, and it was dark.|
|PAW6||Unsuitable mental model||Operator uses an unsuitable mental model to integrate information and arrives at a wrong understanding of the situation (e.g., wrong understanding of automation behaviour).||• Following the autopilot disconnect, the pilot flying almost consistently applied destabilizing nose-up control inputs and the crew did not recognize the stall condition.|
|PAW7||Pre-conceived notion or expectancy||Prevalence of expectations on a certain course of action regardless of other cues degrades operator performance.||• The local controller expected aircraft Y to exit via C4 and did not check it had actually done so.|
• This course alteration resulted in movement towards the right-hand bank, since the selected course was set very close to the embankment. The pilot was aware and tolerated this because he assumed that it would be compensated subsequently or as they passed through the bend.
|PME||Memory||Memory issues leading to forgetting, inaccurate recall, or using expired information.|
|PME1||Forget actions/intentions||The operator has a temporary memory lapse and forgets planned actions or intentions.||• The controller had previously planned things correctly, then after being busy with other aircraft, forgot about aircraft X when executing aircraft Y descent.|
• At about 0055, the chief officer was required to call the pilot to provide information about the expected arrival time, but it slipped.
|PME2||No/inaccurate recall of information||The operator does not retrieve or recall information accurately from memory.||• Pilot mentions: “The captain then asked me if we had entered the ILS Critical Area and neither one of us could remember passing the sign for one “|
|PME3||Negative habit||The operator uses a highly learned behaviour from past experiences which is inadequate to handle the present situation.||• The pilot in command (PIC) deselected autothrottle (as is his habit) and refused the first officer (FO) offer to select a vertical mode for climb (also his habit) while he hand-flew the climb out. Because of the PIC’s refusal to use autothrottle, vertical mode control, or autopilot during climbout from a very busy terminal area, the FO was forced to spend additional effort monitoring basic flying in between multiple frequency changes and clearance readbacks.|
• GPS Guard zone radius set to 0,3’ which is a standard value for the crew since they have previous experiences with false alarms with guard zones of smaller size.
|PMW||Mental Workload||Amount or intensity of effort or information processing in a task degrades the operator’s performance.|
|PMW1||High workload||High workload degrades the operator’s performance.||• Dealing with two resolution advisories such that approach becomes unstable, no time to properly manage.|
• The master tried to do nearly everything himself, which caused him to become overloaded and to miss the fact that the engines had been left on half ahead inadvertently, and to misinterpret the speed of the vessel and the situation in general.
|PMW2||Low workload||Low workload imposes idleness and waiting, and it degrades operator’s performance.||• The low workload at the remote airfield affected the vigilance of the controller.|
|PMW3||Information processing overload||Available mental resources are insufficient to process the amount of complex information.||• The pilots had difficulty integrating the cockpit displays and understanding the emergency situation.|
|PMW4||Startle effect||Available mental resources are insufficient to process sudden, high-intensity, unexpected information, leading to the startle effect.||• The master was clearly surprised by the event and not able to effectively respond for a while.|
|PPF||Personal Factors||Personal factors affect operator performance, such as emotional state, personality style, motivation, psychological condition, confidence level, complacency.|
|PPF1||Emotional state||Strong positive or negative emotion degrade operator’s performance.||• He (chief officer) was upset about the death of his father, worried about the health of his pregnant wife.|
• When the first crewmember collapsed, his colleague reacted impulsively to the emergency by entering the enclosed space to rescue him without fully assessing the risk.
|PPF2||Personality style||Operator’s personality traits (e.g., authoritarian, over-conservative, impulsive, invulnerable, submissive) contribute to degraded performance and/or negatively affect interaction with other team members.||• This pilot in command is known for difficulties in the cockpit and by most accounts is unwilling or unable to change his habits or cockpit demeanor […] indifference and even hostility to second in command input.|
|PPF3||Confidence level||Inadequate estimation by the operator of personal capability, of the capability of others or the capability of equipment degrades performance.||• I should have also recognized that my fellow crew member was a fairly low time First Officer and given more guidance/technique on how I might fly a visual.|
• The late detection of the conflict were due to an over-reliance on automatic identification system (AIS) information shown on the display.
|PPF4||Performance/peer pressure||Threat to self-image and feeling of pressure to perform an activity despite concerns about the risk associated degrades performance.||• Controller wanted to avoid contributing to delay and stated “but in hindsight delaying a few aircraft would have been a lot easier to explain to the supervisors and my coworkers as well as being safer.”|
• The third officer sought clarification about the use of sound signals and was advised by the chief officer not to sound the horn unless traffic was encountered. On previous ships he had sailed on, the horn was used in restricted visibility, regardless of traffic density. The advice caused the third officer concern, but he did not wish to question his superiors and, with reluctance, he carried on as instructed.
|PPF5||Motivation||Excessive or inadequate motivation to accomplish a task or prevalence of personal goals over organization’s goals degrades operator performance.||• Pilot mentions pressure to build total time and fly that particular aircraft.|
|PPF6||Pre-existing psychological condition||Pre-existing acknowledged personality, psychological or psychosocial disorder/problem degrades operator performance.||• The crash of Germanwings Flight 9525 was deliberately caused by the co-pilot, who had previously been treated for suicidal tendencies and declared “unfit to work” by his doctor.|
|PPF7||Risk underestimation||False sense of safety or complacency brings the operator to ignore hazards or to underestimate the risks associated to them, thus degrading performance.||• The flight crew did not expect to encounter abnormal severe situations include vertical wind, stall warning; so due to lack of adequate situational awareness the flight crew did not [apply] full engine power and flap to solve low energy situation of the aircraft.|
• Neither vessel reduced speed on entering fog, even though visibility reduced to less than 2 cables.
|PPC||Physiological Condition||Physiological/physical conditions affect operator performance, such as injury, illness, fatigue, burnout, medical conditions.|
|PPC1||Injury or illness existed during operation||Pre-existing physical illness, injury, deficit or diminished physical capability due to the injury, illness or deficit, degrades operator performance. This includes situations where the operator intentionally performs duties with a known (disqualifying) medical condition.||• The officer of watch wore glasses for reading, but had met the acuity standards without the need for wearing them. As a result of the collision, he had his eyes re-tested, because he felt that he could not see the radar screen clearly without his glasses. The doctor who re-tested his eyesight concluded that it was surprising that his eyesight problem had not previously been identified.|
• The chief officer reported that, at some time before 03:00, he had started suffering from stomach cramps, and went to his cabin to use the toilet; his cabin was two decks below the bridge and towards the aft end of the accommodation.
|PPC2||Fatigue||Diminished mental capability due to fatigue, restricted or shortened sleep, mental activity during prolonged wakefulness or disturbance of circadian rhythm degrades operator performance.||• The watchkeepers on both vessels had worked in excess of the hours permitted by Standards of Training, Certification and Watchkeeping (STCW) over the previous 2 days.|
• The commanding officer was very tired, so tired that he remained asleep for over an hour.
|PPC3||Mentally exhausted (burnout)||Exhaustion associated with the wearing effects of high operational and/or lifestyle tempo, in which operational requirements impinge on the ability to satisfy personal requirements degrades operator performance.||• It became apparent that his performance had been affected by a burn-out.|
|PPC4||Hypoxia||Insufficient oxygen supply to the body impairs operator performance.||• The crew incapacitated by hypoxia due to a lack of cabin pressurisation.|
|PPC5||Decompression sickness||Development of nitrogen bubbles in the blood and tissues as a result of too quick reduction of atmospheric pressure causes operator chest pains, bends, difficult breathing, skin irritation, cramps.||• The crew suffered from decompression sickness due to the rapid decompression of the aircraft.|
|PDN||Drugs and Nutrition||Use of drugs, alcohol, medication or insufficient nutrition affect operator performance.|
|PDN1||Recreational drugs and alcohol||Recreational use of drugs or alcohol impairs or interferes with operator performance.||• Post-accident toxicological tests indicated one pilot had smoked marijuana within the 24 h before the accident.|
• The second officer considered that the master was tired and drunk.
|PDN2||Prescribed drugs or OTC medications||Use of prescribed drugs or over-the-counter medications or supplements interferes with operator task performance.||• Diphenhydramine, a first-generation sedative antihistaminic, with potentially impairing side effects, was detected in a toxicology analysis following the accident.|
|PDN3||Inadequate nutrition, hydration or dietary practice||Inadequate nutritional state, hydration or dietary practice degrade operator performance.||• The crew didn’t have a meal for over six hours.|
|PCS||Competence, Skills and Capability||Competence, skills, strength or biomechanical capabilities are insufficient to well perform a task.|
|PCS1||Inadequate experience||Operator does not have sufficient experience with a task at hand.||• Operator does not have the experience with the instrument landing system characteristics of the plane.|
• The master was new to the company and to the vessel, and had been in command of her for just a few hours.
|PCS2||Lack of proficiency||Operator capability to accomplish a task does not meet the performance levels expected from her/his skill level.||• The flight crew’s actions for stall recovery were not according to abnormal procedures of the aircraft. Pilot did not use flap 15 and maximum engine power with to recover stall condition.|
• After initial reactions that depend upon basic airmanship, it was expected that it would be rapidly diagnosed by pilots and managed where necessary by precautionary measures on the pitch attitude and the thrust, as indicated in the associated procedure.
|PCS3||Inadequate training or currency||Operator does not meet general training or recurring training requirements for the task assigned to her/him.||• Low exposure time in training to stall phenomena, stall warnings and buffet.|
• The chief officer had received no crew resource management or bridge team management training.
|PCS4||Body size, strength or coordination limitations||Body size, strength, dexterity, coordination mobility or other biomechanical limitations of the operator degrade the task performance of the operator.||• The crew member did not have enough strength to open the pressurized door.|
Appendix A.3. Operational Leadership
|LP||Personnel Leadership||Inadequate Leadership and Personnel Management by Operations Leader, Including No Correction of Risky Behaviour, Lack of Feedback on Safety Reporting, No Role Model, and Personality Conflicts|
|LP1||No personnel measures against regular risky behaviour||An operations leader does not identify an operator who regularly exhibits risky behaviours or does not institute the necessary remedial actions.||• The master did not constitute remedial actions against the repeating risky acts of the third officer.|
|LP2||Inappropriate behaviour affects learning||Inappropriate behaviour of operations leader affects learning by operators, which manifests itself in actions that are either inappropriate to their skill level or violate standard procedures.||• The loose interpretation of the rules by the chief officer contributed to the missed checks of the engineer.|
|LP3||Personality conflict||A “personality conflict” exists between an operations leader and an operator.||• The operator was no longer on speaking terms with the master.|
|LP4||Lack of feedback on safety reporting||Operations leader does not provide feedback to operator following his/her provision of information on a potential safety issue.||• The operator did not get meaningful feedback on her safety concerns.|
|LO||Operations Planning||Issues in the operations planning by the operations leader, including inadequate risk assessment, inadequate team composition, inappropriate pressure to perform a task, and directed task with inadequate qualification, experience, or equipment.|
|LO1||Inadequate risk assessment||Operations leader does not adequately evaluate the risks associated with a specific operation or scenario.||This includes situations where operations are initiated that are too hazardous given the expected benefit.|
• The risk associated with the crossing of the ITCZ (inter-tropical conversion zone) was discussed several times by the crew. The captain did not respond to expressed worries by deciding to avoid the ITCZ. Several nearby aeroplanes altered their routes.
• It seems that the risk of passing at 0.1 was not evaluated as a significant risk.
|LO2||Inadequate crew or team makeup or composition||Operations leader allows inadequate makeup or composition of crew or team for a given activity/operation.||• No lookout was posted when the vessel entered and departed port, or during the hours of darkness. This appeared to be the master’s normal operating practice.|
• The lookout on the bridge had been sent to carry out cleaning duties elsewhere on the ship.
|LO3||Inappropriate pressure to perform a task||Inappropriate pressure by operational leader causes an operator to feel pressured to perform a task or activity.||• The supervisor pushed the attendant to go ahead and waived her concerns.|
|LO4||Directed task with inadequate qualification or currency||Operations leader allows an operator to perform a task, while the qualification or currency of the operator are not in line with the training requirements for the associated activity.||• The master asked the officer to perform the task, which was he was not trained to do.|
|LO5||Directed task with limited experience||Operations leader allows operators to perform a task, while their experience for a specific operation, event or scenario is too limited.||• The captain chose the least experienced as relief pilot.|
|LO6||Directed task with inadequate equipment||Operations leader directs operators to undertake an activity that is beyond the capabilities of their equipment.||• The officer told him just to fix it with tool X.|
|LT||Task Leadership||Inadequate leadership of operational tasks by the operations leader, including lack of correction of unsafe practices, no enforcement of existing rules, allowing unwritten policies becoming standards, and directed deviations from procedures.|
|LT1||Inadequate leadership or supervision||Availability, competency, quality or timeliness of leadership or supervision does not meet task demands.||• The supervisor had changed sectorisation several times, but excessive traffic was still allowed to enter the sector.|
• The master was fully aware of the crew’s extensive use of mobile phones onboard, but he was not aware of any resulting problems.
|LT2||No correction of unsafe practices||An operations leader does not correct known unsafe practices, conditions, guidance or procedure, which allows hazardous practices within the scope of his/her authority.||• The master did not correct the risky course that resulted in the collision.|
|LT3||No enforcement of existing rules||Operations leader does not enforce organizational and operating rules.||• The master did not assure the speed limitation that was required given the limited visibility.|
|LT4||Allowing unwritten policies to become standard||Operations leader allows polices that have not been formally recognized by the organization to be perceived as standards.||• It had become common usance to do the required checks only occasionally.|
|LT5||Directed deviation||Operations leader directs a subordinate to deviate from existing regulations, procedures or technical guidance.||• The master directed the officer to go ahead, without first performing the required checks.|
Appendix A.4. Organisation
|OC||Culture||Safety Culture Problems or Sociocultural Barriers Causing Misunderstandings|
|OC1||Safety culture||There is a poor safety culture or a low company morale in the organisation, leading to a poor attitude to safety in the organisation.||• Reporter states he has raised the issue several times to no avail and is afraid of possible backlash, raising into question the organisation’s Just Culture.|
• Low safety culture within the airline which led to non-entries of inflight problems into the tech logs as well as performing flights with issues that were neither rectified nor deferred.
|OC2||Multi-cultural factors||Sociocultural barriers and conflicts cause misunderstandings between personnel and an unsafe working environment.||• Poor teamwork, exacerbated by cultural differences, was a significant factor in the accident.|
|OS||Safety Management||Safety management in the organisation is insufficient, including lack of organisation structure for safety management, and limitations of proactive risk management, reactive safety assurance, safety promotion and training, and of suitable procedures.|
|OS1||Organisation structure/policy||Management commitment and responsibilities are not clear or insufficient. It is not clear who is accountable for safety issues. The structure of the organisation is not clear about key safety personnel. Safety plans including emergency response planning are not coordinated or unavailable.||• Bridge procedure were left to the senior master, but without a formal process of auditing or feedback to the management board.|
|OS2||Safety risk management (proactive)||Identification of safety hazards and risk assessments and mitigation are not carried out, or are carried out but do not identify and make available relevant safety issues.||• Regular opposing traffic is not a safe situation. A risk assessment should determine mitigations and better procedures for aircraft wishing to re-fuel.|
• Under-evaluation of the severity of the uncommanded Maneuvering Characteristics Augmentation System (MCAS) activation in the functional hazard assessment.
|OS3||Safety risk assurance (reactive)||Safety risk assurance is ineffective in identifying and repairing safety shortfalls. Safety risk assurance includes performance monitoring (inspections, review of tasks), testing, and incident reporting.||• Known issue with the Flight Management Cotnrol Guidance has not been fixed in over 2 years in spite of being apparently reported daily.|
• The lessons from the grounding were not effectively communicated to the master, and steps were not taken subsequently to monitor the implementation of the revised passage planning instructions.
|OS4||Safety promotion||Safety promotion (education, communication) does not sufficiently reinforce the importance of safety.||• There was a lack of effective communication reinforcing the importance of safety.|
|OS5||Publications/procedures/written guidance||Publications and written documentation are not sufficient to ensure that a task can be carried out safely. Procedures may exist, but are poor and cannot be used to perform the task they support. Even where good procedures exist they do not account for all the operational circumstances within which they are expected to be applied (work as imagined versus work as done).||• Procedure seems to be incorrect. Some terrain not depicted on approach chart, and minimum vectoring altitude should be increased.|
• Neither vessels had in place any form of specific documented procedures for operating in conditions of restricted visibility.
|OR||Resources||The organisation does not provide sufficient resources for safe operations, including personnel, budgets, equipment, training programs, operational information, and support for suitable design of equipment and procedures.|
|OR1||Personnel||The organisation provides insufficient personnel who are suitably qualified and experienced to perform the tasks safely.||• Due to staffing shortages, management appears to be happy that all shifts are covered, regardless of the qualification and experience.|
• The staffing levels are low and would greatly benefit from more controllers so that we could have the Local Control position split.
|OR2||Budgets||Budget is insufficient to allow the operation to proceed with adequate resources to operate safely.||• Budget limitations had been imposing on the maintenance schedule.|
|OR3||Equipment/parts/materials availability||Equipment, materials, or parts that operators have to use is not available to them at the time that the task has to be performed.||• The airline decided not to take the angle of attack indicator as an option on the aircraft.|
• It was not possible to display the AIS (Automatic Identification System) data on the radar screens due to their age and design.
|OR4||Inadequate training programs||There are inadequate or unavailable training programs (either one-time, recurrent, upgrade, transition or any other local training program).||• The crew’s unpreparedness when the alarm was issued because of lack of theoretical training and lack of according simulator training.|
• Company did not take steps to ensure its deck officers were familiar with the use of the watch alarms fitted.
|OR5||Design of equipment or procedures||The design of the equipment/procedure to support the operation/task is not suitable to allow the task to be performed safely. The equipment might also prevent operators working in an efficient manner and indirectly encourage short-cuts or workarounds.||• Pilot reports current arrival procedure is not optimal, since spoilers are often needed to get on the profile.|
• Tower frequency occupied with air & ground movements control.
|OR6||Operational information||Operational information necessary to perform the task safely, or meet the requirements of a safe operation is not available at the relevant points in the organisation. This information includes weather briefings/forecasts, intelligence, operational planning material or other information necessary for safe operations.||• The availability of tidal stream date for the port was insufficient to plan the safe passage of the vessel using the ports narrow approach channel.|
|OE||Economy and Business||The economy and business of the organisation pose constraints that affect safety, including relations with contractors, strong competition, pressure to keep schedules and costs, and required tempo of operations.|
|OE1||Contractors||Relationships, communications, or inter-operability between the organisation and contractors are not optimal and this creates an unsafe working relationship.||• The contractors were not well experienced with the safety procedures at the airfield.|
|OE2||External business environment||Strong competition, poor relationships with other organisations (other than contractors) and changes in the market put pressure on the organisation which has a negative impact on safety.||• There had been some friction with the port authority, such that the master didn’t want to make a request.|
|OE3||Economic pressure||Economic conditions and pressures to keep schedule and costs put a pressure on the organisation resulting in a negative impact on safety.||• Having aborted the first attempt to go alongside at the previous arrival the vessel was late and made the master anxious to depart.|
• Commercial pressure contributed to the master’s decision to proceed at full sea speed in such conditions.
|OE4||Tempo of operations||The speed with which an organisation is expected to operate leaves little space for anything else than getting the job done, thus reducing safety.||• The sector was extremely busy. The air navigation service provider tends to run its airspace ‘hot’.|
• The airspace was busy and there was little ‘slack’ in the system at the time of the incident.
- Turan, O.; Kurt, R.E.; Arslan, V.; Silvagni, S.; Ducci, M.; Liston, P.; Schraagen, J.M.; Fang, I.; Papadakis, G. Can We Learn from Aviation: Safety Enhancements in Transport by Achieving Human Orientated Resilient Shipping Environment. Transp. Res. Procedia 2016, 14, 1669–1678. [Google Scholar] [CrossRef][Green Version]
- EMCIP. European Marine Casualty Information Platform. Available online: https://portal.emsa.europa.eu/web/emcip/home (accessed on 20 February 2023).
- CHIRP. Confidential Human Factors Incident Reporting Programme—Maritime. Available online: https://chirp.co.uk/maritime/ (accessed on 20 February 2023).
- Nearmiss.dk. Available online: https://uk.nearmiss.easyflow.dk/ (accessed on 20 February 2023).
- ForeSea. Available online: https://foresea.org/ (accessed on 20 February 2023).
- Kirwan, B.; Cichomska, K.; Bettignies-Thiebaux, B.; Kilner, A. Is Our Human Factors Capability in Aviation and Maritime Domains Up to the Task? In Advances in Safety Management and Human Performance; Proceedings of the AHFE 2021, Virtual, 25–29 July 2021; Lecture Notes in Networks and Systems; Arezes, P.M., Boring, R.L., Eds.; Springer International Publishing: Cham, Switzerland, 2021; Volume 262, pp. 89–96. [Google Scholar]
- Heinrich, H.W. Industrial Accident Prevention: A Scientific Approach; McGraw Hill Book Company: New York, NY, USA, 1931. [Google Scholar]
- Reason, J. Human Error; Cambridge University Press: Cambridge, UK, 1990. [Google Scholar]
- Reason, J. Managing the Risk of Organizational Accidents; Ashgate: Aldershot, UK, 1997. [Google Scholar]
- Shappel, S.A.; Wiegmann, D.A. The Human Factors Analysis and Classification System—HFACS; DOT/FAA/AM-00/7; U.S. Department of Transportation: Washington, DC, USA, 2000. [Google Scholar]
- Kirwan, B.; Bettignies-Thiebaux, B.; Cocchioni, M.; Baumler, R.; Arce, M.C. Towards a Safety Learning Culture for the Shipping Industry: A White Paper; SAFEMODE Project: Brussels, Belgium, 2022. [Google Scholar]
- Stroeve, S.; Van Doorn, B.A.; Jonk, P.; Kirwan, B.; De Maya, B.N. SHIELD human factors taxonomy and database for systematic analysis of safety occurrences in the aviation and maritime domains. In Proceedings of the 32nd European Safety and Reliability Conference (ESREL 2022), Dublin, Ireland, 28 August–1 September 2022. [Google Scholar]
- Save, L.; Pozzi, S.; De Bortoli Vizioli, B.; Kirwan, B.; Kilner, A.; Bettignies-Thiebaux, B.; Stroeve, S.; Gibson, H.; Waters, S.; Kurt, R.E.; et al. SHIELD Human Factors Taxonomy for Risk Analysis, D2.1, version 1.4; SAFEMODE Project: Brussels, Belgium, 2020. [Google Scholar]
- Save, L.; Pozzi, S.; Stroeve, S.; Turan, O.; Kurt, R.E.; De Maya, B.N.; Kirwan, B.; Kilner, A.; Efremov, A. Analysis of reporting systems in safety critical domains to develop the SHIELD HF taxonomy. Results from EU funded SAFEMODE Project. In Proceedings of the 1st International Conference on the Stability and Safety of Ships and Ocean Vehicles, Glasgow, UK, 7–11 June 2021. [Google Scholar]
- ICAO. ADREP 2000 Taxonomy; International Civil Aviation Organisation: Montreal, QC, Canada, 2010. [Google Scholar]
- Isaac, A.; Straeter, O.; Van Damme, D. A Method for Predicting Human Error in ATM (HERA-PREDICT); HRS/HSP-002-REP-07; EUROCONTROL: Brussels, Belgium, 2004. [Google Scholar]
- EUROCONTROL. Risk Analysis Tool—RAT: Guidance Material; EUROCONTROL: Brussels, Belgium, 2015. [Google Scholar]
- EMSA. EMCIP Glossary of Reporting Attributes; European Maritime Safety Agency: Lisbon, Portugal, 2016. [Google Scholar]
- Caridis, P. Casualty Analysis Methodology for Maritime Operations; CASMET Project: Athens, Greece, 1999. [Google Scholar]
- Reinach, S.; Viale, A.; Green, D. Human Error Investigation Software Tool (HEIST); DOT/FRA/ORD-07/15; Federal Railroad Administration: Washington, DC, USA, 2007. [Google Scholar]
- Chang, Y.J.; Bley, D.; Criscione, L.; Kirwan, B.; Mosleh, A.; Madary, T.; Nowell, R.; Richards, R.; Roth, E.M.; Sieben, S.; et al. The SACADA database for human reliability and human performance. Reliab. Eng. Syst. Saf. 2014, 125, 117–133. [Google Scholar] [CrossRef]
- Dillinger, T.; Kiriokos, N. NASA Office of Safety and Mission Assurance Human Factors Handbook: Procedural Guidance and Tools; NASA/SP-2019-220204; National Aeronautics and Space Administration (NASA): Washington, DC, USA, 2019. [Google Scholar]
- Stroeve, S.; Van Doorn, B.A.; De Vries, V.J.F.; Jonk, P.; Siridopoulos, G.; Kanoulas, E.; Farag, Y.; Kirwan, B. Validation and Active Learning Processes of the SHIELD Open Data Repository; D2.8; SAFEMODE project: Brussels, Belgium, 2022. [Google Scholar]
- SAFEMODE. SHIELD Tool. Available online: https://safemodeproject.eu/shieldDashboards.aspx (accessed on 6 December 2022).
- Kirwan, B.; Stroeve, S.; Kurt, R.E.; Turan, O.; De Maya, B.N.; Bettignies-Thiebaux, B.; Pozzi, S. Data Sources and Implementation of the SHIELD Open Data Repository; D2.3; SAFEMODE Project: Brussels, Belgium, 2021. [Google Scholar]
- Lommi, A.; Akyuz, E.; Matyar, E.; Liu, J.; De Wolff, L.; MacKinnon, S. First Validation Report of Maritime Case Studies; D7.3; SAFEMODE Project: Brussels, Belgium, 2022. [Google Scholar]
- EMSA. Safety Analysis of EMCIP Data: Analysis of Navigation Accidents; Summary report, V1.0; European Maritime Safety Agency: Lisbon, Portugal, 2022. [Google Scholar]
- MAIB. Report on the Investigation of the Collision between Hampoel and Atlantic Mermaid in the Dover Strait on 7 June 2001; Report No 12/2002; Marine Accident Investigation Branch: Southampton, UK, 2002. [Google Scholar]
|Vehicles & Operation||Aircraft A: Airbus A320neo passenger flight|
Aircraft B: Boeing E3 Sentry airborne warning and control system (AWACS)
|Actors||Air traffic controllers: Trainee, Instructor, Supervisor|
Cockpit crews of aircraft A and B
|Contextual factors||High traffic density|
|Occurrence type||Incident: Air Traffic Management; Loss of separation|
|Narrative||Supervisor had warned the sector that it was going to be busy and complex, but they decided it would be good for the trainee. Aircraft B was flying a ‘racetrack’ (elongated ellipse) pattern, highlighted on the trainee’s radar picture but not the coach’s. Required separation against such aircraft is 10 nautical mile (as opposed to the normal 5 nautical mile). The trainee turned aircraft A left and descended it, to maintain separation against a third aircraft, but failed to consider aircraft B that was about to turn. Radio communication was then busy with other traffic and separation was lost. The trainee conferred with the coach and then expedited descent of aircraft A until separation was restored.|
|Safety learning||Investigation recommended additional visual prompts for such conflict situations.|
|Acts||Perception||AP1: No/wrong/late visual detection||Trainee||Trainee did not detect/accurately predict racetrack turn of aircraft A|
|Acts||Perception||AP1: No/wrong/late visual detection||Instructor||Instructor did not detect impending loss of separation|
|Preconditions||Awareness||PAW1: Channelized attention||Trainee||Focused attention of trainee due to high complexity and workload|
|Preconditions||Awareness||PAW3: Distraction||Trainee||Trainee was busy with other calls|
|Preconditions||Personal factors||PPF3: Confidence level||Instructor||Instructor decided to not put racetrack on own radar screen, but relied on watching it on the trainee’s radar screen|
|Preconditions||Competence, skills and capability||PCS1: Inadequate experience||Trainee||Operation was handled by a trainee|
|Operational Leadership||Operations planning||LO5: Directed task with limited experience||Instructor||The supervisor already warned the sector would be busy/complex, so having the trainee work in the sector was known to be challenging.|
|Dashboard||1. The Dashboard on the HMI of SHIELD provides relevant and easy-to-understand information||3.9||0.9|
|2. I would like to see more or different information on SHIELD’s Dashboard||3.5||1.0|
|Search||3. The HMI provide an easy-to-use search engine/filtering method to select occurrence reports from the database||3.8||0.7|
|My Reports||4. The HMI provides a clear, well ordered and easy-to-use overview of the reports that I have entered into SHIELD||4.2||0.7|
|5. It is easy to modify (edit, delete) a report from the presented list of My Reports||3.8||1.1|
|Create New Report||6. The HMI provides an easy-to-use interface to create new occurrence reports||4.2||0.4|
|7. The generic part of the SHIELD taxonomy is sufficiently complete to describe a safety occurrence||4.2||0.6|
|8. The Human Factors Classification part of the SHIELD taxonomy is sufficiently complete to describe relevant human factors contributing to a safety occurrence||3.9||0.7|
|User Guidance||9. The SHIELD HMI provides clear and sufficient user guidance on functionalities like searching and creating reports and on using the taxonomy||3.4||1.0|
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.
© 2023 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Stroeve, S.; Kirwan, B.; Turan, O.; Kurt, R.E.; van Doorn, B.; Save, L.; Jonk, P.; Navas de Maya, B.; Kilner, A.; Verhoeven, R.; et al. SHIELD Human Factors Taxonomy and Database for Learning from Aviation and Maritime Safety Occurrences. Safety 2023, 9, 14. https://doi.org/10.3390/safety9010014
Stroeve S, Kirwan B, Turan O, Kurt RE, van Doorn B, Save L, Jonk P, Navas de Maya B, Kilner A, Verhoeven R, et al. SHIELD Human Factors Taxonomy and Database for Learning from Aviation and Maritime Safety Occurrences. Safety. 2023; 9(1):14. https://doi.org/10.3390/safety9010014Chicago/Turabian Style
Stroeve, Sybert, Barry Kirwan, Osman Turan, Rafet Emek Kurt, Bas van Doorn, Luca Save, Patrick Jonk, Beatriz Navas de Maya, Andy Kilner, Ronald Verhoeven, and et al. 2023. "SHIELD Human Factors Taxonomy and Database for Learning from Aviation and Maritime Safety Occurrences" Safety 9, no. 1: 14. https://doi.org/10.3390/safety9010014