A Study on Flight Crew’s Resilient Behavior Through Integration of Safety-I and Safety-II: Analysis of Aviation Safety Cases

1. Introduction

1.1. Research Background

The aviation industry maintains very low accident rates and high safety through continuous technological development and improvement of safety management systems [1]. While catastrophic aircraft accidents have significantly decreased through advanced technology and data-based systematic accident analysis systems, small and large failure cases still occur in daily operations.

Analysis of Airline A’s failure cases revealed major limitations in the current Safety-I based approach. First, there is a tendency to focus only on the surface causes of failures, procedural compliance, and field personnel capability enhancement, making it difficu to solve fundamental problems. Second, systematic analysis and identification of root causes cannot be properly conducted due to safety managers’ limited resources. Third, there is a lack of proactive prevention due to the reactive approach that focuses on responding after accidents occur. These limitations have led to the repetitive occurrence of similar failure cases, suggesting the need for a new review of current safety management systems and education/training methods.

1.2. Research Objectives

This study aims to improve the aviation safety management system by integrating Safety-I and Safety-II methodologies.

• Systematically analyze the root causes of failure cases through Safety-I methodology and identify deficiencies in current safety management.
• Define ’flight crew’s resilient behavior’ based on Safety-II methodology and propose methods to transform failure cases into resilient success cases.
• Transform the safety management paradigm from ’failure prevention’ to ’success expansion’ through integrated application of both methodologies, thereby enhancing organizational safety culture.

1.3. Research Process

This study was conducted through the following systematic process.

Section 2 examines the theoretical development and framework of safety management systems. The paradigm shift in safety management concepts was reviewed, and the characteristics, limitations, and integration possibilities of Safety-I and Safety-II methodologies were analyzed. In particular, the theoretical foundations of the HEAR (Human Error Analysis and Reduction) framework, LPAC (Learn, Plan, Adapt, Coordinate) model, and PAM (Pressures, Adaptations, Manifestations) framework were examined to establish methods for application in the aviation safety field.

Section 3 analyzes failure cases and safety management behavior through Safety-I methodology. Three types of failure cases related to FMS operation, turbulence response, and energy management were selected and systematically analyzed using the HEAR framework. The analysis revealed that 87.1% of all related factors were organizational, confirming that the root causes of failures lie at the organizational rather than individual level.

Section 4 develops a resilient behavior framework for flight crews. Reflecting Safety-II characteristics, ’flight crew’s resilient behavior’ was newly defined, and the SRK (Skills, Rules, Knowledge) framework and metacognition-motivation theory were applied as theoretical foundations. Resilient behavior enhancement methods were derived for each case, and specific behavioral guidelines were developed through the PAM framework and LPAC model.

Section 5 presents an integrated approach of Safety-I and Safety-II. A systematic process for transforming failure cases into resilient success cases was developed, and the effectiveness of the proposed integrated safety management approach was evaluated. Through Why-Because Tree analysis and quantitative analysis, effects such as reduction of system-related issues, need for qualitative improvement of education/training, and strengthening of field-centered practical approaches were confirmed.

Section 6 summarizes the main findings and practical implications of the research, and presents limitations and future research directions. The study confirms that the integrated approach can contribute to shifting the aviation safety management paradigm from ’failure prevention’ to ’success expansion,’ and suggests the need for empirical studies across various aviation sectors and long-term effect verification.

Through this systematic research process, improvement measures for aviation safety management systems integrating Safety-I and Safety-II methodologies were derived, and practical guidelines applicable to actual aviation operations were presented.

2. Development of Safety Management Systems and Theoretical Framework

2.1. Evolution of Safety Management Concepts

The approach to safety management has evolved over time as follows. During the early Industrial Revolution period, the main causes of accidents were considered technical issues, focusing on improving machine reliability and preventing technical defects. As technology gradually became more reliable, attention shifted to human error, and concepts such as human-machine interaction, ergonomics, and human reliability assessment became important. In modern times, accident causes are recognized as organizational defects, culture, and structural issues, emphasizing the importance of safety management systems and organizational processes and culture [2].

2.2. Modern Safety Management Paradigm Shift

Safety management systems have developed into two major approaches during their evolution. The traditional safety management approach, Safety-I, defines safety as “a state with as few adverse effects as possible” and focuses on preventing accidents and failures [2,3,4]. This approach assumes a linear relationship between cause and effect and manages safety through standardized procedures and regulations [3].

2.2.1. Characteristics and Limitations of Safety-I

The traditional safety concept Safety-I is recognized as a very useful approach in pure technical systems. However, it shows clear limitations in dealing with safety problems in modern complex socio-technical systems. In particular, its reactive characteristic that focuses on response after accident occurrence makes effective prevention difficult. Also, its limited view of considering humans as system vulnerabilities and negative perception of performance variability are cited as major limitations that hinder flexible response in actual operating environments [2,3,5].

2.2.2. Emergence and Core Characteristics of Safety-II

Safety-II, which emerged to overcome these limitations, redefines safety as “a state where the system operates successfully” and emphasizes understanding of daily success. This approach recognizes humans as essential resources for problem solving and seeks to strengthen system resilience [2,3,4].

Safety-II presents four core elements. First, the ability to respond appropriately to threats or opportunities; second, the ability to flexibly monitor environmental changes and performance; third, the ability to anticipate and prepare for potential situations in advance; and fourth, the ability to learn effectively from past experiences. These elements are the core capabilities that enable a system to adapt and operate successfully even in unexpected situations [4,6].

2.2.3. Integration Possibility of Safety-I and Safety-II

Safety-I and Safety-II have complementary characteristics [2,3,5] that make effective integration possible. Safety-I provides systematic analysis and standardized procedures, while Safety-II enables adaptive response and strengthens system resilience. This integration allows balanced pursuit of failure prevention and success expansion. Also, by comprehensively considering organizational systems and human factors, more comprehensive and effective safety management becomes possible. This has particularly important meaning in solving safety problems in the aviation industry with high technological complexity. Such integrated approach is expected to contribute to enhancing organizational safety culture and building a sustainable safety management system.

2.3. Research Methodology

2.3.1. Safety-I Analysis through HEAR (Human Error Analysis and Reduction) Framework

The HEAR (Human Error Analysis and Reduction) framework is a systematic analysis tool developed (2010) by the Department of Industrial and Systems Engineering at Korea Advanced Institute of Science and Technology (KAIST) and used for human error and accident investigation at Korea Railroad (KORAIL). This framework allows safety managers to analyze direct and indirect causes of human errors step by step and visualize them, enabling comprehensive understanding [7]. In this study, this systematic analysis methodology was applied to aviation safety.

Various methodologies have been developed for human error analysis. In the nuclear industry, HPES (Human Performance Enhancement System) and HPIP (Human Performance Investigation Process) are representative; in the aviation industry, HFACS (Human Factors Analysis and Classification System) is widely used; in the maritime industry, CASMET (Casualty Analysis Methodology for Maritime Operations) is used; and in the oil and gas industry, HFIT (Human Factors Investigation Tool) is utilized. Particularly, CREAM (Cognitive Reliability and Error Analysis Method) is gaining attention as a methodology applicable across industries [7].

The HEAR framework is an analysis tool that integrates the advantages of existing methods and enhances practical applicability. It was developed with reference to the systematic classification system of HFACS [7,8,9,10], the efficient analysis method of CREAM [7,11], and the practical approach of TapRooT^® [7]. It is differentiated by providing analysis tools and procedures considering safety managers’ ease of use.

The HEAR framework has three main features. First, it provides a systematic analysis procedure. The basic situation analysis identifies the context and related factors before and after the event, and the error cause analysis step systematically analyzes the causal relationships of identified factors. Finally, Why-Because Tree visualization helps clearly express complex causal relationships, facilitating comprehensive understanding of analysis results [7].

Second, it enables in-depth analysis of root causes through a multi-layered causal analysis structure. The level 1 identifies direct errors, level 2 analyzes personnel/task related factors such as personnel’s knowledge/experience/ability and task characteristics, and level 3 analyzes organizational factors such as regulations/procedures, education/training, management/supervision, and organizational culture, enabling identification of system-level problems beyond surface causes [7].

Third, it has high field applicability. It provides structured analysis tools and clear analysis procedures that even non-experts in human factors can easily understand and use. In particular, by providing standardized analysis tools such as Content Analysis Sheet, Error Cause Analysis Sheet, and Why-Because Tree, it ensures consistency and objectivity in analysis.

These features of the HEAR framework were deemed very useful for analyzing failure cases and deriving improvement measures in the aviation safety field. In particular, it can provide practical help for field safety managers to systematically analyze the root causes of failure cases and establish effective improvement measures based on this. This integrated approach of theory and practice gives the HEAR framework value as a systematic and practical safety management methodology beyond a simple accident analysis tool. Especially, the integration of validated elements from existing methodologies and enhancement of field applicability make it highly valid for use in the aviation safety field.

2.3.2. LPAC (Learn, Plan, Adapt, Coordinate) Model and PAM (Pressures, Adaptations, Manifestations) Framework for Safety-II Implementation

Based on the author’s civilian airline operational experience, this study adopted the American Airlines’ LPAC (Learn, Plan, Adapt, Coordinate) model and the Flight Safety Foundation’s PAM (Pressures, adaptations, manifestation) framework as analytical tools for enhancing resilience in actual operational environments.

The LPAC model is based on the theory of Dr. Erik Hollnagel, who proposed the Safety-II concept, and was developed through collaborative research between the Cognitive Systems Engineering Lab (CSEL) at Ohio State University (OSU) and American Airlines. It has significance in that it practically implements Hollnagel’s RAG (Resilience Analysis Grid) [6] concept and has undergone empirical validation through cognitive science analytical methodology [12].

The LPAC model consists of four core elements. First, the Learn element includes applying direct and indirect experiences to flight and sharing knowledge through post-flight debriefing. Second, the Plan element emphasizes developing “what if” scenarios before flight and pre-discussing anticipated situations. Third, the Adapt element addresses immediate response to unexpected situations and workload management. Fourth, the Coordinate element emphasizes effective situation model sharing and mutual verification between flight crew members [13].

The PAM framework was developed by FSF (Flight Safety Foundation) as part of NASA (National Aeronautics and Space Administration)’s System-Wide Safety Project, and consists of three core elements [14]. The Pressure element addresses external demands and internal efficiency that the system faces, the Adaptations element analyzes the system’s response mechanisms to these pressures in connection with the LPAC model’s resilience capabilities [15]. The Manifestations element analyzes the system’s actual responses in stages from maintaining within the prevention space to recovery from crisis states and rebounding within the safety control range [15,16].

Thus, the PAM framework integrates the core concepts of the LPAC model as adaptation elements, providing a systematic framework for comprehensively analyzing pressure factors faced by organizations, their response processes, and resulting phenomena. This contributes to providing practical guidance for enhancing resilience in actual operational environments.

2.3.3. Case Selection Criteria

This study selected three types of failure cases that impair flight crews’ decision-making abilities from the perspective of education and training provided by the organization to field personnels.

First, for FMS operation-related cases, we selected route/altitude deviation cases that occurred at two-month intervals at Airline A. These cases are noteworthy as similar errors repeatedly occurred during the FMS input process for instrument approach, and are considered representative cases for testing the effectiveness of education/training on FMS functions.

Second, for turbulence-related cases, we analyzed based on the accident investigation report of the Ministry of Land, Infrastructure and Transport’s Aviation and Railway Accident Investigation Board (ARAIB) [17]. Through this case, which resulted in actual risk of crew injury, we can evaluate the effectiveness of weather-related safety education and appropriateness of field response.

Third, for aircraft energy management cases, we selected an approach abort case due to inappropriate energy management during instrument approach. While approach abort due to unstable approach is not generally considered a failure case, attempting landing without proper energy management can expose to serious risks such as late landing gear completion, speed limit exceedance, runway excursion, and CFIT (Controlled Flight Into Terrain), giving it important significance.

These three cases are representative examples requiring systematic organizational approach rather than simple individual mistakes or capability deficiencies. They are particularly suitable for analyzing and deriving improvement measures for vulnerabilities in education/training systems, safety managers’ lack of insight, and organizational cultural limitations.

3. Analysis of Failure Cases and Safety Management Behavior through Safety-I Methodology

3.1. Analysis of Study Cases

Table 1. Case Details Summary.

Category	Case 1	Case 2	Case 3
Case Type	FMS Operation elated	Turbulence Related	Energy Management Related
Occurence Phase	Instrument Approach Phase	Climb Phase	Instrument Phase
Specific Phenomenon	Path/Altitude Deviation	Crew Injury	Approach Abort
Detailed Situation	Case 1-1: Safety Altitude Violation Case 1-2: Approach Path Deviation	Altitude 16,700 feet during climb, encountered turbulence resulting in cabin crew left ankle fracture	High energy state(*) continuation resulting in unstable approach and landing abort
Main Cause	Lack of FMS function understanding, inappropriate manual input	Inadequate turbulence avoidance strategy formulation/execution	Inappropriate energy management strategy
Education/Training Related Elements	Inadequate FMS operation principle education system	Insufficient adverse weather response education	Inappropriate energy management education system
Organizational Related Elements	Lack of safety manager insight	Habitually repeating conventional safety education	Adherence to traditional navigation methods

^(*)High Energy State: Too High or Too Fast or both [18].

Table 1. Case Details Summary.

Category	Case 1	Case 2	Case 3
Case Type	FMS Operation elated	Turbulence Related	Energy Management Related
Occurence Phase	Instrument Approach Phase	Climb Phase	Instrument Phase
Specific Phenomenon	Path/Altitude Deviation	Crew Injury	Approach Abort
Detailed Situation	Case 1-1: Safety Altitude Violation Case 1-2: Approach Path Deviation	Altitude 16,700 feet during climb, encountered turbulence resulting in cabin crew left ankle fracture	High energy state(*) continuation resulting in unstable approach and landing abort
Main Cause	Lack of FMS function understanding, inappropriate manual input	Inadequate turbulence avoidance strategy formulation/execution	Inappropriate energy management strategy
Education/Training Related Elements	Inadequate FMS operation principle education system	Insufficient adverse weather response education	Inappropriate energy management education system
Organizational Related Elements	Lack of safety manager insight	Habitually repeating conventional safety education	Adherence to traditional navigation methods

^(*)High Energy State: Too High or Too Fast or both [18].

3.1.1. Path and Altitude Deviation due to Inappropriate Use of FMS Functions

We integrated and analyzed two failure cases that occurred at Airline A at two-month intervals as a single case. The first case involved New York airport ILS (Instrument Landing System) 13L approach (Details in Table 2), where path discontinuity occurred in the FMS due to mismatch between the endpoint of STAR (Standard Terminal Arrival Route) and the starting point of IAP (Instrument Approach Procedure). During the manual input process to resolve the path discontinuity, the altitude restriction (2,900FT) input was omitted, resulting in a safety altitude violation situation set to avoid the World Trade Center, but the dangerous situation was avoided through the control agency’s altitude correction instruction.

The second case involved Haneda Airport ILS Z RWY 23 approach (Details in Table 3), where similarly, path discontinuity occurred in the FMS due to a mismatch between the STAR endpoint and ILS starting point. Inappropriate points were entered during the manual input process to resolve the path discontinuity, and path deviation occurred due to delayed FMS settings when changing the instrument approach procedure. In this case as well, normal approach path entry was possible through guidance from the control agency.

Analysis using the HEAR framework revealed that lack of understanding of FMS functions and deficiencies in the education/training system were the root causes in both cases (Figure 1 and Figure 2). In particular, there was a lack of systematic education on specific situations in FMS operation principles, and understanding of the causes of path discontinuity due to mismatch between STAR endpoints and IAP starting points was insufficient. Moreover, inappropriate education methods that emphasized manual input rather than utilizing FMS functions such as the ’NO STAR’ function for path discontinuity persisted, and it was confirmed that conventional safety management was carried out without awareness of the risks associated with manual input.

3.1.2. Crew Injury due to In-Flight Turbulence

Based on analysis using the Ministry of Land, Infrastructure and Transport’s Aviation and Railway Accident Investigation Board (ARAIB) accident investigation report, the following accident circumstances were identified (Details in Table 4). The aircraft was climbing at an altitude of about 16,700 feet, and the area was a section where turbulence potential had been forecasted. While the cabin crew was moving to check the safety of a passenger using the lavatory with the seat belt sign illuminated, body movement due to turbulence caused loss of balance, resulting in a fractured left ankle [17].

Analysis using the HEAR framework revealed that deficiencies in turbulence response strategy formulation and implementation were the main causes (Figure 3 and Figure 4). In particular, the timing and method of applying turbulence avoidance strategy were inappropriate, and interpretation of preceding aircraft information and weather radar analysis results was inaccurate. It was also confirmed that entry into the turbulence area occurred due to incorrect judgment of the weather situation at the time.

Important issues were also found in education/training. Weather-related education remained at the level of simple transfer of existing materials and case comparison, and there was a lack of practical guidelines on effective use of actual weather information systems such as WSI (Weather Service International). Particularly noteworthy is that despite the continuous occurrence of passenger and crew injuries due to turbulence, the problem persisted by simply repeating past safety management approaches.

3.1.3. Approach Abort due to Aircraft High Energy during Instrument Approach

In the analysis based on operational case analysis and flight crew’s actual experience, the initial problem was identified as the pilot arbitrarily reducing speed regardless of traffic flow management (Details in Table 5). This led to a High Energy state occurring during the control instruction process for airspace altitude restrictions and aircraft separation, ultimately resulting in approach abort as landing standard altitude and speed criteria were exceeded.

Although aborting approach from an unstable approach condition is not generally considered a failure case, attempting landing without proper energy management is significant as it can expose to serious risks such as late landing gear completion, speed limit exceedance, runway excursion, and CFIT (Controlled Flight Into Terrain).

Analysis using the HEAR framework revealed that lack of aircraft energy management strategy and deficiencies in the education/training system were the root causes (Figure 5 and Figure 6). During aircraft operation, when the pilot reduced speed arbitrarily without considering control flow, problems occurred in maintaining aircraft spacing in the entire airspace. As a result, Air Traffic Control (ATC) instructed the aircraft to maintain a ’High energy’ state (maintaining high speed and altitude) to maintain smooth traffic flow, but appropriate response was not made. Additionally, it was found that situation awareness information continuously provided by FMS was not sufficiently utilized, and the practice of preferring traditional navigation methods persisted among Airline A’s flight crews.

3.2. Comprehensive Analysis Results

Analysis of failure cases using the HEAR framework (Table 6) revealed that 87% of all 54 related factors were organization-related. This is 6.7 times higher than individual/task factors (13%), clearly showing that the root causes of failures lie at the organizational rather than individual level. This result strongly suggests that structural elements such as organizational systems, culture, and processes need more focus for safety improvement, rather than focusing on field personnels’ capabilities or behaviors.

3.2.1. Contributing Factors Analysis

Human resource management accounted for the highest proportion at 59.3% of the total. Specifically, lack of education/training (14 cases), inadequate educational content (10 cases), and inadequate education/training evaluation (5 cases) were identified in order. Looking at each case, FMS operation showed lack of education on fundamental functions leading to system principle understanding deficiency, turbulence response lacked practical weather information utilization education, and energy management persisted with only traditional navigation education, characteristics that were identified.

The impact of these problems in actual operational environments appeared in two aspects: direct failures and potential risks. Direct failures included path and altitude deviations during FMS operation, crew injuries during turbulence response, and unstable approaches due to inappropriate energy management.

Furthermore, these direct failures were found to lead to more serious potential risks. In particular, it was observed that inappropriate operational procedures became fixed as daily practices, which progressively degraded pilots’ decision-making abilities. Ultimately, these problems were found to weaken the resilience of the entire operational organization, suggesting that the organization’s response capabilities could become more vulnerable in similar risk situations in the future.

Management/supervision-related issues accounted for 11.1% of the total, with a high frequency of supervision negligence (4 cases). This led to failure to predict the possibility of similar accident recurrence and inability to properly identify risk factors.

This analysis proves that organizational rather than individual improvements are essential for enhancing aviation safety. In particular, it suggests that systematic improvement of education/training systems and strengthening of management/supervision systems are urgent tasks.

3.2.2. Safety Management Behavior Evaluation

The responses of existing safety management departments to the three failure cases showed consistent patterns. First, there was a tendency to propose superficial solutions focusing on enhancing field personnels’ capabilities and adherence to standard procedures. Specifically, in the FMS case, thorough confirmation and briefing of approach procedures was emphasized; in the turbulence case, thorough weather confirmation and crew briefing enhancement was stressed; and in the energy management case, adherence to standard procedures was emphasized.

Next, the response to prevent failure cases remained at a reactive level. The safety management department only addressed the direct causes of the cases and did not lead to organizational-level root cause analysis and improvement. A particularly noteworthy point is that similar failure cases continued to occur repeatedly, yet the department continued to adhere to past safety management methods. In particular, FMS-related deviations occurred at two-month intervals, turbulence-related passenger/crew injuries continued, and unstable approaches related to energy management recurred.

In contrast, analysis through Safety-I methodology identified the following organizational problems:

Safety managers’ lack of insight and inappropriate education/training systems

Inappropriate organizational management/supervision methods

Absence of root cause analysis and systematic improvement

This comparison shows that a transformation in the current safety management approach is needed. Moving beyond field personnel-centered solutions, systematic and fundamental improvements at the organizational level are required.

4. Development of Flight Crew’s Resilient Behavior Framework

4.1. Definition of Resilient Behavior

This study newly defined ’flight crew’s resilient behavior’ in the specific context of civilian aircraft operations to successfully manage the root causes of failure cases, reflecting Safety-II characteristics.

Flight crew’s resilient behavior is defined as “the repetitive behavior or capability of flight crews who can successfully manage adverse events by effectively utilizing aircraft systems, having the ability to predict and plan for adverse events, based on high-level effective learning.”

This definition consists of four core elements.

First, high-level effective learning includes professional knowledge acquisition about aircraft operation, skill enhancement through actual operational experience, and learning from various situations’ success and failure cases [6,19,20,21].

Second, the ability to predict and plan for adverse events means identifying potential risk factors in advance, establishing response plans for situation changes, and preparing contingencies for various scenarios [2,3,6,12,13,15,16,19,21].

Third, effective utilization of aircraft systems means optimal operation based on comprehensive understanding of systems in both normal and abnormal situations, and knowing system limitations and alternatives [19,21,22].

Fourth, successful management of adverse events means real-time situation awareness and response, flexible and timely decision-making, and effective problem-solving capability in abnormal situations [2,3,6,19,21].

This definition and components suggest a new paradigm that moves away from focusing merely on failure prevention and strengthens flight crews’ adaptability by expanding success in daily operations.

4.2. Theoretical Basis of Resilient Behavior

This study applied Rasmussen’s SRK (Skills, Rules, Knowledge) [19] framework and metacognition-motivation theory [22] as theoretical foundations for effective resilient behavior.

The SRK framework proposed by Rasmussen provides a key framework for understanding flight crews’ resilient behavior. According to this framework, skill-based behavior occurs as automated patterns without conscious control, rule-based behavior follows set rules or procedures, and knowledge-based behavior requires high-level cognitive effort for problem-solving in new situations [19].

As confirmed in the failure case analysis, current education focuses on providing rule-based knowledge. This makes appropriate response difficult in complex situations such as FMS operation, turbulence response, and energy management. Therefore, a shift to principle-based knowledge provision and system operation-centered approach is needed.

Metacognition and motivation play key roles in effective learning. Metacognition is the ability to understand one’s cognitive state and judge when and how to use specific learning strategies. Motivation is the driving force that enhances learning behavior and achievement, with internal motivation being particularly important for improving sustained learning performance [22].

This theoretical foundation shows that flight crews’ resilient behavior requires deep understanding and flexible response capabilities beyond simple procedure acquisition or rule compliance. This suggests that the education/training system should shift from rule-centered to principle understanding and system utilization-centered.

4.3. Case-Specific Resilient Behavior Enhancement Methods

Flight crew’s resilient behavior was defined for each failure case, and methods for responding to pressure factors occurring during operations were summarized in Table 7. These resilient behavior methods focus not just on avoiding problems but on strengthening flight crews’ adaptive capabilities to enable safe and efficient operations even within the complexity and variability of the operational environment.

4.3.1. FMS Operation Resilient Behavior

“The repetitive capability to accurately and quickly reconfigure FMS in adverse situations such as setting/changing instrument approach procedures or late runway changes, based on effective learning and high-level understanding of FMS.”

In pressure situations such as mismatch between STAR endpoint and IAP starting point or late runway changes, accurate response is required within limited time. In these pressure situations, quick and accurate approach procedure reconfiguration using FMS Database is key. Flight crews need to deeply understand FMS functions and principles and effectively utilize systems, rather than the manual input emphasized in current education.

The four elements of the LPAC model are applied as follows [13]:

• Learn: Flight crews accumulate and share knowledge based on approach procedure experiences at specific airports. Particularly, they enhance in-depth understanding of STAR and IAP relationships and systematically analyze lessons from past experiences. Regular FMS function education helps clearly understand system capabilities and limitations and develop capabilities to effectively use them in actual situations.
• Plan: During pre-flight briefing, all possible approach scenarios’ FMS setting methods are thoroughly reviewed. Particularly, using the “Secondary Flight Plan” function to pre-program alternative approach methods and discussing responses to various situations when operating to airports with high approach procedure change probability can enable systematic response even in time-pressured situations.
• Adapt: Flexibly respond in actual situations. If needed, request guidance to the final approach path from control agencies and quickly reconfigure approach procedures using FMS Database skillfully. Immediately recognize and identify the cause if path or altitude deviation is detected to take appropriate action. In this process, maintain optimal aircraft state by balancing between FMS automation functions and manual operation segments.
• Coordinate: Share and confirm procedure changes through clear and effective communication between flight crew members. Immediately inform control agencies and request cooperation if path or altitude deviation is detected. Clearly divide roles between PF(Pilot Flying) and PM(Pilot Monitoring) for effective simultaneous FMS operation and situation monitoring. Strengthen teamwork-based problem-solving through continuous situation awareness sharing.

4.3.2. Turbulence Response Resilient Behavior

“The repetitive capability to analyze weather-related situations and establish and execute strategies for mitigation, based on effective learning and high-level understanding of adverse weather and aircraft weather radar.”

When operating in forecasted turbulence areas, flight crews face conflicting pressures of passenger safety assurance and schedule adherence. In these pressure situations, systematic analysis and response using weather radar and weather information systems are key. Flight crews need to go beyond basic knowledge of weather phenomena to develop capabilities for integrated utilization of weather systems for proactive response strategies.

The four elements of the LPAC model are applied as follows [13]:

• Learn: Flight crews develop in-depth knowledge of weather phenomena and weather radar interpretation. They systematically analyze and share past turbulence encounter experiences and successful response cases, and become proficient in effective use of the latest weather information systems (e.g., WSI). By developing capabilities to integratedly analyze various weather data such as weather charts, radar images, and SIGMET information, they enhance capabilities to predict and assess turbulence in advance.
• Plan: Before flight, they thoroughly analyze weather conditions along the flight route and identify potential turbulence sections to establish response strategies. Particularly, prepare alternative route and altitude options in advance and plan timing and methods for passenger safety assurance. Review turbulence intensity-specific response protocols and share response methods through pre-crew briefing. Such planning provides the basis for systematic response without time pressure when actual situations occur.
• Adapt: Assess weather conditions in real-time during flight and respond flexibly. Accurately determine turbulence location and intensity using radar data and preceding aircraft information, and execute vertical or horizontal avoidance maneuvers as needed. Prioritizing passenger safety, activate seat belt signs at appropriate times and monitor cabin safety status through close communication with cabin crew. Continuously adjust avoidance strategies according to situation changes to safely operate the aircraft.
• Coordinate: Maintain smooth communication between flight crews and cabin crews, and with control agencies. Share information about anticipated turbulence locations and intensities with cabin crew in advance and clearly communicate about potential turbulence levels and duration. Coordinate with control agencies to secure optimal altitudes and routes, and request reports from other aircraft about turbulence if needed. After turbulence encounters, immediately check for possible injuries or equipment damage and take necessary follow-up measures.

4.3.3. Energy Management Resilient Behavior

“The repetitive capability to effectively utilize FMS to manage aircraft energy at appropriate levels in adverse situations such as High Energy approach conditions, based on effective learning and high-level understanding of FMS.”

In complex pressure situations such as control instructions, airspace restrictions, and traffic flow, maintaining appropriate energy state is essential. In these pressure situations, FMS-based energy management and integrated understanding of air traffic flow management are key to systematic approach. Flight crews need to move beyond traditional energy management methods to effectively utilize energy prediction and management functions provided by FMS.

The four elements of the LPAC model are applied as follows [13]:

• Learn: Flight crews develop deep understanding of aircraft energy management principles and FMS energy prediction/management functions. They systematically learn the effects of energy states on flight safety. Particularly, they become proficient in methods to effectively manage the complex interactions between speed, altitude, thrust, and drag through FMS, developing capabilities to maintain optimal energy states even in various approach situations.
• Plan: Before entering the approach phase, they establish energy management strategies considering airspace restrictions and expected traffic flow. They optimize approach profiles using FMS and prepare response plans for various ATC instruction scenarios. Particularly, they predict situations where High Energy states could occur and plan deceleration timing and external configuration change timing. Such systematic planning reduces workload during the approach phase and improves energy management predictability.
• Adapt: Continuously monitor aircraft energy states during actual approach and adjust strategies as needed. When control instructions change, quickly update FMS routes and select appropriate aircraft external configurations (Spoiler, Flap, Landing Gear, etc.) for the energy state. If High Energy states persist, make decisions such as requesting cooperation from control agencies or deciding to abort approach. By actively utilizing energy prediction information provided by FMS, they proactively respond to prevent unstable approach situations.
• Coordinate: Maintain clear communication between flight crew members about energy states and management strategies. Particularly in situations that deviate from standard operating procedures, clearly share intentions and plans and mutually verify them. Effectively communicate with control agencies to request additional distance or altitude if needed for energy management and clearly explain the reasons for necessary maneuvers.

5. Integrated Application of Safety-I and Safety-II

5.1. Integrated Application Framework

This study presents a systematic process for transforming failure cases into resilient success cases by integrating Safety-I and Safety-II methodologies. This approach combines failure analysis and success expansion perspectives to enable more effective safety management.

The key elements and expected effects of the integrated approach are summarized in Table 8.

The key elements of the integrated approach are as follows:

• Systematic failure analysis: Root cause identification through HEAR framework
• Resilient behavior definition: Derivation of specific behavioral elements for each case
• Adaptation strategy establishment: Application of PAM framework and LPAC model
• Practical guideline development: Presentation of specific guidelines applicable in the field

As shown in Figure 7, this study’s integrated approach consists of two axes: Safety-I analysis and Safety-II implementation.

In Safety-I analysis, failure cases are systematically analyzed based on the HEAR framework [7]. First, analysis target cases are selected and reconstructed to identify key factors. In this process, evidence is explored to identify root causes and derive organizational-level problems [7].

In Safety-II implementation, the process begins with defining resilient behavior for each case. Using the PAM framework, pressure factors occurring during operations, adaptation processes, and resulting manifestations are analyzed [15]. This is linked to the LPAC model to develop specific behavioral guidelines in four aspects: Learn, Plan, Adapt, and Coordinate [13].

This integration of the two methodologies provides a systematic framework for resolving problems identified in failure case analysis and transforming them into resilient behaviors. Particularly, by directly utilizing analysis results from the HEAR framework as pressure elements for the PAM framework and LPAC model application, analysis and implementation are organically connected.

5.2. Effectiveness Evaluation

To evaluate the effectiveness of the integrated safety management method proposed in this study, two analyses were performed according to the HEAR framework. The results visualized through Why-Because Tree analysis (Figure 8, Figure 9 and Figure 10) were compared, and related factors analysis results before (Safety-I methodology) and after (integrated safety management approach) application were comparatively analyzed as shown in Table 9 and quantitative analysis results in Figure 11 were reviewed.

Through Why-Because Tree analysis, visual confirmation of the differences before and after application of the integrated safety management approach was possible. The most notable change in all three cases was that the relationships between causal factors became clearer and simplified. In particular, previously complex and multi-layered organization-related factors were significantly reduced, suggesting that system-level improvements were effectively implemented.

In the FMS operation-related case (Figure 8), organizational culture and management/supervision-related factors were greatly reduced, with focus shifting to qualitative improvement of education/training. In the turbulence response case (Figure 9), the importance of practical weather information utilization education was emphasized, and in the energy management case (Figure 10), the need for systematic approaches to improve FMS utilization capabilities was clearly revealed.

These changes show that the focus of safety management has shifted from individual errors or procedural issues to system-level improvements and qualitative enhancement of education/training. Particularly, the simplification of causal relationships identified in each case helps to more clearly grasp the essence of the problem and establish effective improvement measures.

Significant improvements in system-related issues were confirmed. As seen in Table 9, regulations/business procedures-related issues significantly decreased from 3 cases (5.6%) to 0 cases (0%), and management/supervision issues and organizational processes/culture-related issues each decreased significantly from 6 cases (11.1%) to 0 cases (0%), confirming that substantial system-level improvements were made. These changes are also clearly evident in the quantitative analysis results in Figure 11.

Meaningful changes were also observed in human resource management and personnel/task characteristic-related areas. As shown in Table 9, human resource management-related issues decreased from 32 cases (59.3%) to 13 cases, but their overall proportion increased to 68.4%. This indicates that the need for qualitative improvement in education/training has become more prominent.

The relative importance of personnel knowledge, experience, and ability-related issues and task characteristic-related issues increased from 7.4% to 15.8% and from 5.6% to 15.8%, respectively, which is particularly noteworthy. As confirmed in Figure 11, these changes are consistent with the results showing that the causal relationships between factors became clearer after system improvement in the Why-Because Tree analysis.

The quantitative analysis results in Figure 11 show that the organization’s safety culture is in a process of overall change. It was confirmed that a transition is needed from the existing approach that focused only on failure prevention to a direction that expands successful operations and strengthens resilience. In particular, the changes in organizational process and culture-related indicators shown in Table 9 quantitatively support the necessity of this transition.

The analysis results in Table 9 and Figure 11 show the main effects of applying the integrated safety management approach. System-related issues decreased while the need for qualitative improvement of education/training was highlighted, and it was confirmed that field-centered practical approaches should be strengthened.

However, challenges for making these improvement effects sustainable changes were also identified. As seen in Table 9, the proportion of human resource management areas remains high, suggesting the need for continuous improvement of education/training systems. Also, the increase in indicators related to personnel knowledge, experience, and task characteristics shows the need for systematic support to strengthen individual capabilities.

Notable changes were also confirmed in terms of strengthening safety managers’ capabilities. The analysis results in Figure 11 show the need for systematic failure case analysis using the HEAR framework. This means a transition from existing experience-based judgment to data-based objective analysis is needed.

For the successful establishment of these changes, management’s firm commitment and continuous support will be prerequisites.

However, there are several limitations in the effectiveness evaluation of this study. First, the analysis is limited to three types of cases from a single airline, so caution is needed in generalizing the results. Second, quantitative analysis relies mainly on frequency analysis, and in-depth evaluation of complex causal relationships is needed.

Nevertheless, the effectiveness evaluation results of this study show that the integrated safety management approach can be an effective tool for making substantial improvements in aviation safety management. Future research needs to continuously develop the methodology through more diverse cases and longer-term perspective evaluations.

6. Conclusions

6.1. Key Research Findings

This study aimed to improve the aviation safety management system through integrated application of Safety-I and Safety-II methodologies. Specifically, it conducted failure case analysis through Safety-I methodology, defined resilient behavior based on Safety-II methodology, and presented practical improvement measures through integrated application of the two methodologies. The key findings are as follows.

First, systematic failure case analysis was made possible through the HEAR framework. Analysis results confirmed that the root causes of failures lie in organizational rather than individual dimensions, with 87% of all related factors being organization-related. This means that safety management focus should be placed on organizational system improvement rather than individual errors or capability deficiencies.

Second, flight crew’s resilient behavior was newly defined and specific methods for its realization were presented. The resilient behavior defined as “the repetitive behavior or capability of flight crews who can successfully manage adverse events by effectively utilizing aircraft systems, having the ability to predict and plan for adverse events, based on high-level effective learning” provides a basis for transitioning the safety management paradigm from ’failure prevention’ to ’success expansion’.

Third, practical improvement effects were confirmed through integrated approach of Safety-I and Safety-II. Through reduction of system-related issues, recognition of the need for qualitative transformation of education/training, and strengthening of field-centered practical approaches, more balanced safety management became possible.

6.2. Practical Implications

The practical implications of this study are as follows.

First, it presented methods for strengthening safety managers’ capabilities through systematic approaches. It confirmed that safety culture can be enhanced through systematic organizational education/training system establishment and management/supervision system strengthening, beyond focusing on field personnel responsibilities in safety management solutions. Particularly, the analysis result showing that 87% of related factors are organization-related supports the need for system-centered approaches.

Second, it provided specific tools for strengthening safety managers’ capabilities. With the introduction of the HEAR framework, safety managers can systematically analyze failure cases and identify root causes. This represents a transition from existing experience-based judgment to systematic evidence-based objective analysis.

Third, it presented field-centered practical safety management methods. By identifying specific elements of resilient behavior based on actual cases such as FMS operation, turbulence response, and energy management, and presenting concrete methods for their strengthening, it provided practical guidance that can be actually applied in the field.

6.3. Research Limitations and Future Directions

This study has the following limitations that should be addressed in future research.

First, case study limitations. Since only three types of failure cases from a single airline were analyzed, empirical case studies across various aviation sectors such as air carriers, aircraft maintenance organizations, and airport operators are needed to verify the generalizability of the research results.

Second, methodology validation scope expansion is needed. Current effectiveness evaluation relies mainly on frequency analysis, and methodology validity and practical value can be enhanced through more diverse quantitative and qualitative evaluation methods.

Third, long-term effect verification is needed. The long-term impact of the integrated safety management approach on organizational safety culture and performance needs to be continuously monitored and evaluated.

Despite these limitations, this study has significance in presenting a new paradigm for aviation safety management. Future research should continuously develop the methodology presented in this study through diverse case studies and long-term effect verification. For this, management’s firm commitment and continuous support are prerequisites, which will be the core factors in establishing a sustainable safety management system.