Chapter 6

From Flight Time Limitations to Fatigue Risk Management Systems – A Way Toward Resilience

P. Cabon, S. Deharvengt, I. Berechet, J.Y. Grau, N. Maille and R. Mollard

Because of the development of the 24/7 operations in various industries, human fatigue is today considered as one of the major risks for safety. To date, the prescriptive approach through the regulation of duty hours is the traditional way to prevent fatigue. However, besides the inherent rigidity of regulations from an operational point of view, this often fails to take into account all of the complex dimensions of fatigue. In order to cope with this complexity, Fatigue Risk Management Systems (FRMS) are progressively emerging. Rather than setting absolute duty time limitations, a FRMS approach evaluates each operation in terms of fatigue risk. FRMS can be seen as a concrete way to engineer resilience because it requires the organisation to adjust its functioning by re-introducing safety managed by humans in addition to safety by regulations. This chapter presents a concrete application of FRMS in civil aviation. The whole process of the FRMS is described, from the use of predictive models of fatigue to minimize the risk at the aircrew scheduling stage to the development of fatigue related indicators. The principles of the FRMS are discussed from the Resilience Engineering perspective.

Introduction

The regulatory developments for flight and duty time limitations (FTL) in aviation are the results of different processes. The technological and operational developments of aviation (e.g., aircraft range capacities, opening of new routes), the changes in economic and social context (e.g., shortage of pilots, salary negotiations), and implementation of safety management strategies (e.g., training, oversight) are factors that contribute to establish different forms of consensus among states but also between various airlines. In short, when the airline industry struggles in a fiercely competitive environment, it needs operational flexibility which can be gained through flexible usage of the pilot workforce. This is realised in exchange for various compensations in a win–win situation. However this complicates the management of safety since prescriptive regulations are not adapted to achieve such flexibility.

Amalberti (2006) suggested two reasons, external and internal, for a system to change its level of resilience, sacrificing its competitiveness for a more acceptable safety level. In our case this was the Member States – a European Parliament decision in 2006 to implement in 2008 a Europe-wide prescriptive regulation on FTL (i.e., EU-OPS, subpart Q). Based on the ability offered by the legal text to maintain member states national schemes for specific boundary conditions (reduced rests and split duty), it was proposed to engineer a new resilience level based on FRMS. This construction was developed with lessons learnt from past experience in engineering human factor solutions into aviation (Deharvengt, 2007): scientific expertise and a long term process of implementation from the regulator perspective. A large scale effort was put into place by Direction générale de l’Aviation civile (DGAC) to support a scientific team to develop guidelines for airlines and regulator for the new regulation.

Several industries and airlines have already evolved towards a non-prescriptive approach focusing on fatigue risk management rather than solely on the compliance to a FTL scheme. In aviation, New Zealand has the longest experience in the development of FRMS. In 1995, the regulations were altered so that air operators could either comply with a standard prescriptive scheme or apply an alternative, approved company-specific scheme (Civil Aviation Authority of New Zealand, 2007). In this last case the operator has to take into account additional factors that may result in fatigue (Signal et al., 2008; e.g., rest prior duty, effects of time zone change). The introduction of Ultra Long Range flight by Singapore Airlines in 2003 is another example of a FRMS application. The Civil Aviation Authority (CAA) of Singapore has allowed the airline to operate those flights using the results and recommendations from a scientific study based on biomathematical modelling (Spencer et al., 2002; Spencer and Robertson, 2007). In Europe, easyJet became the first major airline to be granted alleviation from the current FTL in 2005 (Stewart 2007). The UK CAA agreed the alleviation based on the results of a safety case report of a six month roster trial.

As fatigue differs from many other workplace hazards because it is impacted by all waking activities, not only those that are work related, FRMS is a shared responsibility of employers and employees. Therefore, FRMS can be seen as a concrete way to engineer resilience as it requires the organisation to adjust its functioning by re-introducing safety managed by humans in addition to safety by regulations. This section presents an application of FRMS for specific cases of adaptation to the European rest requirement scheme. The whole process of the FRMS is described, from the use of predictive models of fatigue to minimise the risk at the aircrew scheduling stage to the development of fatigue-related indicators. The principles of the FRMS are discussed from the Resilience Engineering perspective.

Fatigue and Safety

Fatigue is known to be a major risk for safety in aviation. It has been classified as one of the ‘most wanted’ factors by the National Transportation Safety Board (NTSB) and it has been identified as the major cause of several serious incidents (NTSB, 1999) and accidents (NTSB, 1994). Although there is not a universal consensus on what fatigue is, the International Civil Aviation Organization (ICAO) gives a definition that covers most of the operational aspects that can affect aircrews: ‘A physiological state of reduced mental or physical performance capability resulting from sleep loss or extended wakefulness and/or physical activity that can impair a crew member’s alertness and ability to safely operate an aircraft or perform safety related duties.’ From this definition, it is clear that fatigue is affected by two main factors.

1.  Sleep and circadian rhythms which are influenced by the hours of work.

2.  Workload which is influenced by the nature of the work.

Generally, two types of fatigue are distinguished: an acute fatigue occurring when there is inadequate time to rest and recover from the work period and a chronic fatigue resulting from an insufficient recovery from acute fatigue over time. The latter is probably the least studied but may be critical because it can result from small sleep restrictions repeated over days or weeks. The cumulative effects of these small repetitive sleep losses are known to be equivalent to a total sleep restriction. People are, however, generally not aware of their negative impacts on performance and this can lead to less cautious behaviour (Van Dongen et al., 2003).

Even if the detrimental effects of fatigue on human performance have been well established in laboratory settings (Lamond and Dawson, 1999), only a few studies have investigated its effects on real situation, especially on aircrew work (Foushee et al., 1986; Thomas et al., 2006). The outcome of these studies suggest a complex and non-linear link between fatigue and safety; especially in a highly automated and team-work environment like aviation where aircrews might be able to develop strategies to mitigate the impact of fatigue (e.g., increase of cross check, automation use).

This non-linear link has been already hypothesised by Folkard and Åkerstedt (2004) from accident data and hours of work. A high level of alertness could lead to less cautious behaviour and therefore to an increased relative risk because of the operator’s over confidence. A low level of alertness would be also associated to a higher risk because of a decrease of performance. Relative risk would be at the minimum for a medium level of alertness where individuals would be the most engaged in self-monitoring of their performance and more controlled processing of information. As already mentioned, fatigue awareness is probably one of the most important factors and might explain this complex link between fatigue and safety (Cabon, 2008).

Even if the underlying mechanism linking fatigue and safety is not fully understood, fatigue is widely recognised as a factor that may increase the risk of accidents. This is why fatigue has to be addressed as other risks in the management of safety and that is the objective of FRMS.

The Development of Fatigue Risk Management System

As the FRMS is intended to be an integrated part of the Safety Management System (SMS), the FRMS has been structured around the four essential components of the SMS as described by ICAO (ICAO 2008):

•  safety policy and objectives

•  safety risk management

•  safety assurance

•  safety promotion.

Figure 6.1 describes the whole process and summarises the contents of those four components in terms of FRMS.

The following sections provide more details and practical examples of how this process can be implemented by an organisation. It is the result of an on-going project (the STARE project, Cabon et al., 2008) funded by the DGAC that is intended to provide guidelines to help airlines to implement FRMS and for the regulator to oversee the FRMS implementation process. This work is performed by a consortium of experts in Human Factors, fatigue, safety and aviation with the collaboration of three regional airline partners, Airlinair, Britair and Regional.

Figure 6.1    The whole Fatigue Risk Management System

Safety Policy and Objectives

This first component is fundamental as it sets all the chains of responsibilities in the organisation, allocates the required resources to manage the FRMS and fosters a just reporting culture to ensure that the aircrew will feel free to report any situation where fatigue may have played a significant role.

As aircrew fatigue might be impacted by decisions taken at every level of the organisation, it is necessary that the FRMS be managed by a network within the organisation. This must include people from the top management to the operational management, including the marketing department as they are directly impacted by the design of rosters.

Another aspect that has to be covered at this level is the definition of a clear policy about issues that may impact fatigue. Examples are: the rules related to the right to refuse to report for a duty, the link between the remuneration and the most disruptive schedules, and the management of aircrew desiderata (e.g., to avoid aircrew to cumulate duty time to generate free time).

Fatigue Risk Management

The safety risk management component can be considered as the heart of the FRMS as it defines all the necessary steps to manage the risk of fatigue. This process covers four main steps.

1.  Identification of fatigue factors.

2.  Evaluation of fatigue risk.

3.  Evaluation of safety risk.

4.  Risk mitigation.

Identification of Fatigue Factors

A fatigue factor is defined as a factor that has an intrinsic potential of generating a fatigue risk, alone or combined with other factors. For example, reduced rest has a potential to increase fatigue as it reduces the number of hours of sleep opportunity. However, this factor does not always by itself lead to a reduced sleep and to an excessive fatigue. Therefore a systematic listing of fatigue factors has to be established. Two categories have to be considered (Table 6.1): the fatigue factors related to the hours of work (which impact sleep and circadian rhythms) and the fatigue factor related to the contextual aspects of the rosters (which impact aircrew workload). Of course, the list provided in this table is only indicative and has to be adapted by the airlines according to its own operations. The relative weight given to each item also has to be adjusted.

Table 6.1  Fatigue factors related to the hours of work

Evaluation of Fatigue Risk

This considers the probability that an aircrew reaches an excessive level of fatigue resulting from the combination of fatigue factors. Once the factors have been identified, it is necessary to consider their possible combinations. For example: a reduced rest combined with poor accommodation and a long duty is more likely to increase the risk of fatigue than a reduced rest combined with good accommodation and a short duty. At this stage, biomathematical models of fatigue can efficiently support the Fatigue Risk evaluation. Biomathematical models are able to predict the risk of fatigue associated with specific patterns of working hours. Several software tools (for a review see Neri and Nunneley, 2004) have been developed that might be usable for the design of a new roster after the introduction of a new route or as a result of a significant change of schedule. During the current project, the duty rosters that include a reduced rest have been extracted from the planning database of the three partner airlines and evaluated through a biomathematical model, the Fatigue Risk Index (Spencer et al., 2002 that make it possible to predict the estimated risk of fatigue associated with a specific work schedule. This FRI is expressed as the probability of reaching a sleepiness level which has been validated in laboratory studies as a critical level for human performance, that is, the value of 7 on the Karolinska Sleepiness Scale (Åkerstedt and Guillberg, 1990). Figure 6.2 shows the distribution of FRI scores associated to these duties.

Figure 6.2    Distribution of the FRI scores associated with duties that follow a reduced rest

Note: The score is the probability of reaching a critical level of sleepiness (higher than 7 on the Karolinska Sleepiness scale)

Surprisingly, a rather large variability is observed, the scores ranging from 4.05 to 42.76. A more detailed analysis suggests that this variability is mainly due to the position of the reduced rest in the sequence of planning and therefore to a cumulative effect. For example, the fatigue risk is much lower for a reduced rest falling at the beginning of a week than for a reduced rest falling at the end of the week. This suggests that those reduced rests should be planned by taking into account the cumulative effects induced by the succession of disruptive hours of work. Interviews with the planning officers in the airlines suggest that this cumulative effect is not systematically taken into account and that the rosters are scheduled as ‘isolated blocks’. However, beside the fact that the use of these models needs clear guidance, the results of their prediction should be weighted by the presence of other contextual fatigue factors. For example a low score associated with a specific hours of work could actually lead to high fatigue if the duty requires a high workload. Some of the biomathematical models make it possible to input a level of workload to impact the prediction of the model but the inputs are based on very general assumptions and are not specific to the aviation environment. This underlines the need to evaluate the fatigue risk associated with the contextual aspects of the work. This can be done by the means of questionnaires where the various constraints of the rosters (e.g., ground assistance, weather conditions, accommodations accessibility and quality) are evaluated by aircrews regarding their impact on workload and fatigue. The construction of these questionnaires requires several in-flight observations and interviews.

Evaluation of safety risk, that is, the probability that a given fatigue risk produces an undesired event (incident or accident). Taking into account the intricate links between fatigue and safety in a complex system such as aviation, this probability is a function of the nature of the operational situations. At this stage, a distinction has been made between normal, abnormal and emergency situations, the criticality of the ability of risk management being the highest in emergency situations. Therefore the objective of this step is to combine these three categories of situations (already identified by the airline) with the fatigue-risk evaluation performed into the previous step. This results in the creation of a risk matrix where the main risks are identified. For example a high risk of a Traffic Collision Avoidance System (TCAS) alert in a high traffic density combined with a high fatigue risk yield to a high safety risk. This matrix is a useful way of tracking the various risks in the operations and needs to be updated every year or after any significant change in the operations.

Risk Mitigation

The last stage of the process is devoted to the means of eliminating or reducing the risk to a level as low as reasonably practicable (ALARP). This process has to be considered at all the levels of the organisation (strategic, tactical and operational) since a decision at management level might impact fatigue at the sharp end (operators). The second aspect to consider is the risk mitigation level: suppression, reduction or prevention by means of barriers (Table 6.2). The favoured strategy is the suppression level which aims at removing the exposure of aircrew to fatigue factors (e.g., at the roster design stage). If this is not achievable (for operational or economic reasons) the reduction level has to be considered. This level aims at reducing the exposure of aircrew to fatigue factors. Finally, at the last level, when the two previous levels were not considered efficient enough to suppress or reduce the risk of fatigue, the aim is to avoid that excessive level of fatigue which produces negative effects on safety. For example, an aircrew experiencing a high level of fatigue in flight will use automation (e.g., auto-pilot) to avoid adverse effects of fatigue on flight management.

Table 6.2  Examples of actions at three decision levels and three risk mitigation levels

Safety Assurance

This component is intended to continuously evaluate the efficiency of the FRMS through a monitoring of various indicators. Two categories of monitoring are proposed: a systematic and a focused monitoring.

Systematic Monitoring

Systematic monitoring includes the collection and analysis of existing safety data, essentially the Air Safety Reports and the Flight Data Monitoring.

Air Safety Reports (ASR) are short reports written by the captain to report any safety events occurring during the flight. They are mandatory and transmitted by the airline to the Civil Aviation Authority (CAA). The current structure of the ASR form does not include any information on fatigue or related issues as it is mainly a factual description report.

A first data analysis on 563 ASRs collected over a 12-month period (Figure 6.3) shows, however, that there is a significant effect of reduced rest and time on duty on the frequency of ASR. Surprisingly, there is a clear decrease of ASR for the longest time on duty after a reduced rest. This quantitative processing that already gives useful results needs to be enhanced by a more qualitative approach to further explain this trend.

Figure 6.3    Frequency of Air Safety Reports during morning flights as a function of the nature of rest (standard or reduced) and time on duty (n = 230)

Therefore, it is proposed to complete this generic information with fatigue-related information. Depending on the available resources, it could be done more or less systematically. The most comprehensive means would be to add a specific ‘fatigue reporting form’ to the current ASR. This fatigue reporting form will collect all relevant data related to sleep quantity and quality in the last few days, fatigue evaluation at the time of the event and contextual factors that might have increased workload. Ideally, this form would be filled in systematically by both pilots. Then, only the ASR in its current form would be sent to the CAA, the ASR and the fatigue form being stored by the airline for subsequent analysis. Alternative means would be to ask aircrews to fill the form only when they estimate that fatigue was a contributing factor.

Flight Data Monitoring (FDM) is a mandatory European process for aircraft of more than 27 ton Maximum Certified Take-Off Weight that includes the acquisition, the measurement and the analysis of digital flight data (parameters, for example, speed, altitude, control wheel position, etc., but also system modes, for example, autopilot ON or OFF, etc.) in order to identify, establish probable causes for, and rectify adverse trends and deviations from accepted norms of flight operations. It is a feedback loop that provides a means for the continuous monitoring and improvement of flight operations and performance.

FDM monitors pre-determined events which are relevant for safety and performance. These events are identified by the operator regarding the aircraft and operations specifics. Events occur when one or several values exceed thresholds or when some parameters are not well-shaped at key points during the flight. To date, there is no specific event related to fatigue. STARE analysed the event occurrences and the aircrew predicted fatigue level by the means of a biomathematical model (Fatigue Risk Index), and illustrated that the occurrence of some events is significantly linked to the level of fatigue. The fatigue level where the occurrence of events is significant corresponds to only one of the two crew members being at his maximum of predicted fatigue, but not to both at the same time.

STARE results point out that FDM is a relevant tool in order to manage safety related to crew fatigue. However, a specific methodology has to be applied in order to:

•  identify the aircrew fatigue level from the roster analysis;

•  define the relevant severity level of events;

•  classify the flights regarding the different and various fatigue factors;

•  compare the occurrence of events between flights operated under ‘normal’ flight duty time and rest requirements and those where flexible schemes are used.

FDM gives valid indications to the operator in respect to monitoring the aircrew fatigue. The fatigue-related FDM indicators are operator-specific and defined in reference to the ‘normal’ rosters.

Focused Monitoring

The focused monitoring includes data that directly evaluate various aspects of the impact of work on aircrew sleep, fatigue and personal experience. This can be achieved through two main instruments: In-flight follow-up where sleep and fatigue data are collected on given roster sequences including weekly rests and survey.

•  In-flight follow-up Sleep quantity and quality can be assessed through the use of a sleep log and, if possible, completed by an objective measure. Actigraphy is a light watch worn at the wrist that measures sleep quantity and quality from motor activity (Babin et al., 1997). Fatigue can be evaluated by the means of subjective scales filled in at the end of each flight. The use of validated scales like the Karolinska Sleepiness Scale (KSS) is strongly recommended. Figure 6.4 shows the mean KSS evaluation on 110 aircrews on two rosters that include reduced rests (Cabon et al., 2009). Ideally, in-flight observations are carried out to better understand the impact of contextual factors on fatigue as well as the main consequences of fatigue on aircrew activities. In the STARE project, observations were carried out over a total of 45 rosters. Those observations allowed identifying and classifying the main contextual fatigue factors. From these results, a self-assessment questionnaire was built in order to collect the relative influence of each of these factors for a large sample of aircrew. At the end of each flight, aircrews are asked to evaluate on a scale the contribution of every factor to their global fatigue.

Figure 6.4    Mean KSS score on two rosters including a reduced rests. 3/3: 3 afternoon flights/night stop/3 morning flights. 5/5: 5 afternoon flights/night stop/3 morning flights (n = 110)

This questionnaire is currently distributed to more than 1500 aircrews. Regarding the consequences of fatigue on aircrew activities, a more qualitative approach is required as every flight is by nature specific in terms of events. Preliminary results show that some events are most frequent when aircrews feel tired. These events are, for example, omission to effectively check a checklist item, or error in Air Traffic Control (ATC) frequency reading, but also events related to the way the aircrew communicate and understand the situation. The observations show also that aircrew use behaviours and strategies (e.g., like additional cross-checks or verifications, early engagement of auto-pilot after take-off or late disengagement before landing) to manage all situations in which one or the two of the pilots have some doubts. In normal situations, mostly encountered during the study, the observed events do not impact safety, but generate more constraints and workload for the aircrew. Their potential impacts on abnormal or emergency situations cannot be directly assessed because not encountered.

•  Survey Aircrews are asked to provide their own experience about fatigue such as the main causes, symptoms and coping strategies. This could represent a very useful means to track aircrew representation about fatigue and fatigue management after the implementation of the FRMS.

Monitoring Process

This section provides some suggestions on the overall monitoring process. The process makes use of all the tools discussed in the systematic and focused monitoring sections. Several scenarios can be considered or mixed to develop a coherent strategy for monitoring fatigue risk in order to manage changes and continuously improve FRMS processes.

•  ‘Continuous’ mode. In this ‘basic’ mode, there is a continuous feedback from the systematic monitoring on the risk matrix. For example, a risk that was not identified in the risk matrix is added after specific events identified through the ASRs.

•  ‘Probe’ mode. In this mode, a focused monitoring is conducted on a limited period (e.g., one month) and use to update the matrix risk.

•  Proactive mode. In this mode, a focused monitoring is triggered after a significant change (e.g., introduction of a new route, schedule change). The risk matrix is updated on the basis of the results.

•  Reactive mode. In this mode, a focused monitoring is triggered because of a significant change of an indicator of the systematic monitoring, e.g., frequency of ASRs and associated aircrew fatigue form increased in the last months on a specific roster.

The implementation of FRMS obviously requires a combination of tools and methods in order to manage the complexity of fatigue impact on crew safety performance.

Safety Promotion

Safety promotion has two main objectives:

•  Ensure that every person in the airlines involved in the FRMS have received an appropriate training to implement and manage the FRMS.

•  Ensure that every relevant person in the airlines is periodically informed of the results produced by the FRMS.

An appropriate training of the persons in charge of the FRMS is a prerequisite to the success of the FRMS. In fact, all the processes and tools that composed the FRMS need a clear understanding of what fatigue is, what the main factors impacting fatigue are, and its main consequences. Of course, depending on the involvement of a person in the FRMS, training requirements will be different. They can be divided into two levels:

•  knowledge requirements;

•  skills requirements.

Knowledge is basic information on a specific topic, for example, information about the sleep stages and cycles. Skills cover the ability to use techniques, tools and interpret the results, for example, the design of a sleep log and the related data processing.

Finally, the results of the FRMS should be disseminated as much as possible in the airline to provide a feedback to the aircrews. This is an important condition to maintain the necessary involvement of aircrews into the FRMS process. The feedback to the Authority also forms part of the construction of a shared understanding of fatigue management in aviation. Best practices and sharing of operational scenarios is one avenue considered to actually implement a meaningful State Safety Programme.

Conclusion

Fatigue concerns all aspects of humans at work. In such highly regulated systems as aviation, this topic perfectly illustrates the challenge to engineer ‘managed’ (by humans) safety in addition to ‘regulated’ safety in order to increase the resulting ‘total’ safety. The FRMS is an innovative approach to the hours of work and rest requirements focused on fatigue and safety criteria, rather than relying only on duty time regulations. Therefore, FRMS is seen as a promising way of coping with the complex management of work schedules that requires taking into account all the underlying dimensions, i.e., economic, social and safety requirements.

The on-going research has uncovered many ‘no news issues’ for those who question the ‘Traditional Safety Perspective’. One challenge is to articulate those findings into an acceptable scheme offered by SMS, and ultimately develop pragmatic implementation guidelines for non-scientific but highly technical operational professionals. Another challenge is to develop adaptable and relevant acceptability criteria for the authority inspectors. Changing prescriptive-based for performance-based requirements involves a new way of looking at authority oversight. For example, expertise in risk management might be needed in addition to airline operations domain expertise. In addition meta-criteria should be developed to evaluate the appropriate characteristics of the airline in order to make sure that it is ‘engineered’ to be resilient. Theoretical paradigms such as complexity theories might provide clues to that extent (e.g., the DGAC’s current research study ‘PREDIR’). The adaptability and the acceptability of those guidelines will be part and parcel of the success in engineering FRMS as the support for the new resilience level for this part of the aviation business.

Those results also illustrate the various resilience levels that exist even for ultra safe industries such as aviation. In order to gain operational flexibility in response to competitive pressures in a challenging economic context for this industry, airlines are negotiating adaptation which might involuntarily decrease the resilience of front line actors. This raises the scientific question of competing or converging resilience for systems and individuals: can we achieve both or does the system resilience exclude the resilience at the individual level? The answer may be crucial for fatigue management.

Acknowledgements

This work was conducted under a grant of the Direction Générale de l’Aviation Civile with the active cooperation of the French regional Airlines: Airlinair, Britair, Regional.

Disclaimer

The ideas expressed in this paper only reflect the opinion of the authors and must not be considered as official views from any national or international authorities or official bodies to which the authors belong.