When Helpful Becomes Hazardous:The SToC(+RC/+RRC) Framework for AnalysingAutomation-Induced Risk in Safety-Critical Industries

Abstract

Automated systems have made commercial aviation statistically safer than at any point in its history. Yet the same systems that reduce routine error simultaneously erode the manual competencies which pilots an crews rely upon precisely when automation fails. Existing safety frameworks, such as Reason’s Swiss Cheese model, the Human Factors Analysis and Classification System, and Hollnagel’s Functional Resonance Analysis Method, all provide valuable tools for accident analysis but do not adequately theorise the dynamic interaction between technology deployment, skill degradation, organisational culture, and regulatory capacity as a system.

This paper introduces the SToC(+RRC) framework: a multi-domain analytical model that integrates Safety (S), Technology (T), Organisational Culture (O), and operational Context (C) as interacting domains, with Regulation (+R) and Rate of Change (+RC) as structural moderating variables. The framework is grounded in practitioner evidence drawn from a qualitative study of 13 aviation professionals across commercial, military, and training contexts, validated against systematic analysis of 5 major automation-implicated accidents. SToC(+RRC) seeks to offer a novel contribution to safety science through treating the pace of technological change not simply as a background condition but as an independent risk multiplier. Implications for training design, regulatory reform, and cross-domain application are discussed.

Keywords: automation dependency; safety frameworks; skill degradation; organisational culture; aviation safety; regulatory lag; human factors

1. Introduction

Commercial aviation presents a paradox at the heart of modern safety science.

Statistically, risk has steadily declined over the last 40 years, attributable predominantly to increasing fight-deck and systems automation. Digital flight management, auto-flight, envelope protection, and advanced warning systems have collectively reduced crew-error-induced accidents to a fraction of their historical rate. By any aggregate measure, automation has made flying safer.

Yet practitioners within the system (Captains, Training Captains and Type Rating Examiners) express a markedly different concern: that the same automation responsible for this safety improvement is simultaneously undermining those human competencies which underpin it. When automation fails, or when crews, or operators, are required to operate at its edges, the manual skills required to manage situations are precisely those that routine automation dependency has allowed to deteriorate. The system is safer until it is not, and its resilience in abnormal states now depends on a declining human resource.

The tension between automation as safety improvement and automation as safety risk sits at the intersection of multiple academic disciplines: human factors, safety science, organisational sociology, and regulatory policy. Consequently, an integrative framework treating these domains not as parallel silos but as mutually conditioning systems whose interaction generates emergent risk, and which treats the rate of technological change and the rate of regulatory response as independent and separable variables is not evident. The present paper addresses that gap.

We introduce the SToC(+RC/+RRC) framework: an analytical model structured as a triadic Venn diagram in which Safety (S), Technology (T), and Organisational Culture (O) occupy the three primary domains.

The central circle, always populated when the framework is used analytically, specifies context and outcome[s] under examination. Two external pressures act upon the model as a whole: Rate of Change (+RC), being velocity of technology evolution, and Regulator Rate of Change (+RRC), the velocity of regulatory response[s] to that evolution. The framework’s central claim is that automation-induced risk can increasingly no longer be explained by reference to any single domain, and that the gap between +RC and +RRC is not simply a background condition but an active risk determinant which potentially escalates from manageable lag to structural regulatory capture.

The paper proceeds as follows. Section 2 reviews existing analytical frameworks in safety science and identifies the gap that SToC(+RC/+RRC) is designed to fill. Section 3 presents the framework in full, with theoretical grounding for each component. Section 4 describes the empirical evidence from which the framework was developed and subsequently validated. Section 5 maps the framework against five major automation-implicated accidents. Section 6 discusses implications for practitioners, regulators, and researchers. Section 7 acknowledges limitations and identifies future research directions. Section 8 concludes the paper.

2. The Limits of Existing Safety Frameworks

Safety science has produced a plethora of analytical frameworks, each contributing an important insight into the mechanisms of complex systems failure. To position SToC(+RC/+RRC) as a contribution rather than a duplication, it is necessary to engage seriously with those models and frameworks which precede it, acknowledging what each explains well and identifying the shared limitation that motivates this new framework/model.

2.1 Reason’s Swiss Cheese Model

Reason’s (1990) Organisational Accident model remains the most widely applied framework in safety-critical industry. Its central contribution posits accidents are rarely the product of a single failure but rather the alignment of multiple latent conditions across organisational layers represented a paradigm shift from individual blame to systemic analysis. The model’s visual simplicity has made it a durable tool for practitioners and regulators alike.

However, the Swiss Cheese model originated during a period of limited automation. Consequently, it tends to consider technology as a static component, specifically a potential source of latent failure, rather than acknowledging it as an active and evolving participant within a system. It does not theorise the feedback relationship between technology capability and human skill, nor does it address regulatory response as a structural system feature. Critically, it has no mechanism for representing the varying rates of technological change and regulatory adaptation: essentially the model is static, mapping conditions at a point in time rather than the trajectory of risk as technology and regulation move at different speeds.

2.2 The Human Factors Analysis and Classification System (HFACS)

HFACS (Shappell & Wiegmann, 2000) extended Reason’s framework into an operational classification for accident investigation, organising causal factors into four levels: Unsafe Acts, Preconditions, Unsafe Supervision, and Organisational Influences. Its strength lies in systematic classification, and has generated a large body of comparative accident data across military and civilian aviation.

HFACS treats technology primarily as a precondition defining it as a feature of the environment in which unsafe acts occur, rather than as an interactive agent within the sociotechnical system. Rather than being a causal model, it is a classification system which can describe where failure occurred but cannot explain why the interaction between technology adoption pace, organisational culture, and regulatory response generated the conditions for failure. Crucially, it cannot distinguish between regulatory lag and regulatory capture.  Subsequently, both these would appear simply as an organisational influence, obscuring the qualitative difference between the two.

2.3 Hollnagel’s FRAM and Safety-II

Hollnagel’s Functional Resonance Analysis Method (FRAM) and the associated Safety-II paradigm (Hollnagel et al., 2012) represent the most sophisticated contemporary alternative to linear-causal accident models. Safety-II’s insight states safety is produced by those everyday adjustments which make performance work, not merely by the absence of failure and has achieved a profound influence the field. FRAM’s ability to model functional couplings and emergent resonance between system components captures a complexity which earlier models cannot.

For the specific problem of automation-induced risk, there are limitations associated with FRAM. Its analytical power lies in modelling complex functional systems but fails to offer a theory that examines how organisational culture shapes technology adoption.  Furthermore, it does not address the regulatory dimensions of why technology is deployed faster than professional adaptation allows. FRAM describes how components interact; it does not explain why organisations and regulators permit the conditions that make dangerous resonance possible, and it provides no tools for analysing the differential velocities of +RC and +RRC as independent variables.

2.4 The Gap

Across these frameworks, a consistent limitation emerges. None of these theorises the interaction between technology deployment velocity, organisational culture, and regulatory response as a dynamic, mutually conditioning system. Each offers genuine insight into one or two of these domains, but none of them actually integrates these, and none treats the pace of technological change and regulatory response as separate, active variables rather than a single contextual given.

The argument for SToC(+RC/+RRC) is precisely this: in the era of high-automation and increasingly autonomous systems, both the rate at which technology evolves and the rate at which regulators respond are independent risk determinants. The gap between them can rapidly escalate from manageable lag to catastrophic regulatory capture. A framework adequate to the safety challenges of contemporary aviation must address this as a unit of analysis.

3. The SToC(+RC/+RRC) Framework

Fig 1: The SToC(+RC/+RRC) Framework

3.1 Conceptual Architecture

SToC(+RC/+RRC) is structured as a Venn diagram model in which three primary domains: Safety (S), Technology (T), and Organisational Culture (O), overlap and interact. The centre of the Venn represents Context and Outcome. In the framework’s base form this centre is labelled generically; in every analytical application it is always populated with the specific situation, accident, or scenario under examination. This design feature distinguishes SToC from purely theoretical models: it is built to be applied, the central circle being the anchor of that application.

Two external pressures operate on the framework, rather than at specific domain intersections: Rate of Change (+RC), the velocity at which technology evolves, and Regulator Rate of Change (+RRC), the velocity at which regulatory bodies respond to that technology evolution. These pressures act upon all three domains simultaneously, compressing or expanding the risk landscape depending on their relative velocities. Therefore, the delta between +RC and +RRC is a major contributory factor to the framework’s diagnostic variable.

The SToC framework makes four structural claims. First, that the three primary domains are mutually dependant and conditioning: the safety impact of any technology depends on the organisational culture governing its adoption and the safety systems managing its failure modes. Second, that domain intersections are analytically important: at the Safety-Technology intersection (ST) where technology embeds latent risk within safety-critical systems; the Technology-organisational Culture intersection (TC), technology adoption decisions and training philosophy shape human employee competency profiles; at the organisational Culture-Safety intersection (OS), cultural norms determine the quality of safety signals generated and acted upon. Thirdly, +RC and +RRC are structurally separable: they do not move in lockstep, and the delta between them is a primary risk variable of the framework. Finally, and fourthly, the framework is dynamic and applied: its analytical value lies in tracing how domain interactions evolve as technology advances and regulatory response either keeps pace or does not.

3.2 Component Definitions and Theoretical Anchors

Table 1 presents the components of SToC(+RC/+RRC) with their definitions, theoretical grounding, and primary risk mechanisms.

Table 1: SToC(+RC/+RRC) Framework Components

Component	Domain	Theoretical Anchors	Risk Mechanism
S — Safety	Structures, systems, and models designed to prevent failure	High Reliability Organisations (Weick & Sutcliffe); Normal Accident Theory (Perrow); HFACS; Safety-II/FRAM (Hollnagel)	Automation embeds risk invisibly within safety systems; operational success conceals latent failure pathways
T — Technology	Automated systems, flight deck design, and the human-machine interface	Ironies of Automation (Bainbridge); Situation Awareness (Endsley); Trust in automation (Lee & See); Mode awareness (Sarter & Woods); Parasuraman & Riley	Technology removes the practice opportunities that build the competency required precisely when the technology fails; over-trust at re-engagement creates additional risk at automation state transitions
O — Organisational Culture	Leadership, management priorities, commercial pressures, training philosophy, and professional culture	Organisational culture (Reason); Safety Climate (Zohar); Cultural Dimensions (Hofstede); Just Culture (Dekker)	Commercial and cultural pressure drives technology adoption beyond the pace at which human and organisational adaptation can occur; training investment decisions shape the skill trajectories of the workforce over time
Centre — Context / Outcome	The specific situation, accident, or operational scenario under analysis	Applied in every analytical use of the framework; labelled generically in the base model	Populated when the framework is used analytically; specifies the context and outcome that the S, T, and O domains are being applied to explain
+RC — Rate of Change	The velocity at which technology evolves; an external pressure on the framework as a whole	Technology adoption curves; Diffusion of innovations (Rogers); Sociotechnical transition theory	The faster technology evolves, the greater the gap between system capability and human, organisational, and regulatory readiness, amplifying risk simultaneously across all three primary domains
+RRC — Regulator Rate of Change	The velocity at which regulatory bodies respond to technology evolution; an external pressure on the framework as a whole	Risk regulation (Hutter); Regulatory capture theory; Regulatory sociology	When +RRC lags +RC, unmanaged risk accumulates in the gap. When +RRC collapses into regulatory capture ie, deferring technical judgement to manufacturers, the moderating function ceases to operate independently

3.3 The External Pressures: +RC and +RRC

+RC (Rate of Change) describes the velocity at which aviation technology evolves: the pace of capability improvement in automated systems, the introduction of new flight management architectures, the progression toward AI-assisted and single-pilot operations.  It must be noted that single-pilot operations are not currently a consideration, following EASA and FAA confirmation. Neither definitively rule out future single-pilot commercial operations, though both have effectively suspended near-term progression with future reconsideration being contingent upon substantive advances in “smart cockpit” systems, including among other things, autonomous safety backups. Consequently, +RC is not uniform across time; it accelerates during periods of significant technological transition and plateaus between them. Its risk significance lies not in absolute terms but relative to the capacity of human, organisational, and regulatory systems to adapt.  Each of which operates on fundamentally different timescales.

+RRC (Regulator Rate of Change) describes the velocity at which regulatory bodies respond to technology evolution. Critically, +RRC is independent of +RC: it is shaped by different institutional factors, consisting regulatory resource and expertise, political economy, industry lobbying, and the degree to which regulators maintain genuine technical competencies relative to those technologies it governs. The assumption that +RRC will naturally track +RC, perhaps with some acceptable lag, is precisely what the Boeing MCAS case exposes as false. +RRC can, and does, decouple from +RC entirely, and when it does, the resulting failure is qualitatively different from ordinary lag.

The relationship between +RC and +RRC has three analytically distinct states; Table 2.

Table 2: The Three States of the +RC/+RRC Relationship

State	Condition	Risk Level	Exemplar
State 1 — Healthy Tension	+RRC tracks +RC with acceptable lag. Regulation is slower than technology but remains genuinely independent and functionally competent.	Managed	Routine airworthiness certification cycles for incremental avionics upgrades
State 2 — Regulatory Lag	+RRC falls meaningfully behind +RC. Unmanaged risk accumulates in the gap. The regulatory function remains structurally intact but operationally inadequate.	Elevated	EASA and FAA type rating standards that have not been revised to reflect the competency implications of high-automation operations
State 3 — Regulatory Capture	+RRC loses the technical competency to evaluate +RC independently. The regulator defers to the manufacturer. The moderating function collapses.	Critical	FAA delegation of MCAS safety assessment to Boeing; the regulator approved a system it had not independently evaluated

State 3 is the framework’s most dangerous condition and its most original theoretical contribution. Existing frameworks treat regulation as slow but assume it remains structurally functional. SToC(+RC/+RRC) identifies the failure mode in which the regulator no longer understands what it is regulating; where in which regulatory independence has been surrendered to the industry it is meant to govern. In the Boeing MCAS example, the FAA’s delegation of safety assessment to Boeing did not simply slow regulatory response; it eliminated the independence of that response entirely. The regulator approved a system whose safety implications it had not independently evaluated, because it had progressively ceded the technical competency to do so. This is not merely a governance failure, it is a structural risk that no other current safety framework is equipped to represent.

3.4 Inter-Domain Directionality

A refined understanding of SToC(+RC/+RRC) requires attention to the directionality of domain interactions, not just their existence. Three relationships have notable analytical significance.

The relationship between Organisational Culture and Safety is not symmetrical: O exerts a prior, conditioning influence on S. The quality of safety reporting; that fundamental input to any safety management system, is determined not by the sophistication of the reporting infrastructure but by the cultural environment surrounding it. An organisation with a punitive response to error will generate depressed reporting regardless the quality of its SMS. Safety domain outcomes are causally downstream of Organisational Culture conditions, a relationship with direct implications for intervention design: targeting the SMS system without addressing the culture that conditions its effectiveness is structurally insufficient.

The relationship between Technology and Safety involves two modes of risk that are analytically distinct and often conflated. The first is disengagement risk: skill fade through reduced practice opportunity, well-documented in automation literature. The second is re-engagement risk: over-trust in automation states at that moment when transitioning back to automated flight. FMA misreading following TCAS events illustrates this second mechanism; examples include experienced pilots failing to verify flight mode annunciator state not through lack of competency but because high-reliability automation has conditioned an expectation of correct state which is violated in precisely the abnormal conditions where verification matters most. The TS pathway is therefore not monotonic: technology reduces risk in stable states while generating a qualitatively different risk during status transitions.

The relationship between the external pressures and the primary domains therefore becomes amplifying rather than additive. An increase in +RC does not simply add to the risk across S, T, and O, but multiplies it, by compressing time available for organisational adaptation, human skill development, and regulatory response simultaneously. When +RRC fails to track +RC, this amplification operates without its intended constraint, the resulting risk accumulation becoming systemic rather than domain-specific.

4. Empirical Development and Validation

4.1 Qualitative Dataset

SToC(+RC/+RRC) was developed inductively from a qualitative study conducted with thirteen aviation professionals across commercial, military, cargo, and training contexts. Participants were selected through purposive sampling to ensure coverage of the primary roles through which automation-induced risk is experienced and managed: operational airline captains, training captains, type rating examiners (TREs), safety officers, multi-pilot licence (MPL) instructors, and researchers in aviation human factors. The sample includes representation from long-haul and short-haul commercial operations, low-cost carrier environments, VIP and executive aviation, military aviation, and international operational contexts including Southeast Asia and the Pacific.

Information was collected through semi-structured interviews and analysed using dual methodology: an NVivo-supported codebook analysis aligned to the SToC framework’s a priori domains, and a Braun and Clarke reflexive thematic analysis conducted independently to surface latent meaning beyond the deductive coding structure. The codebook analysis confirmed framework coverage and saturation; the reflexive analysis generated the interpretive contributions that constitute the study’s advancement over the existing literature.

Saturation was achieved across all primary SToC nodes. The core Safety finding, that current aviation safety is sustained by a combination of increasingly reliable technology coupled with diminishing human competency, was the study’s single unanimous finding, coded across all thirteen participants. The Technology domain achieved the highest absolute reference count. The Organisational Culture domain produced the most nuanced coding, with participants consistently distinguishing between national cultural baseline effects and organisational cultural ceiling effects on safety behaviour.

4.2 Framework Validation Through Practitioner Testimony

The framework’s core architectural claim; that safety events cannot be explained by reference to a single domain, was confirmed repeatedly and without prompting by participant testimony. Every participant, when describing an automation-related safety incident or concern, moved naturally across multiple SToC domains. No participant attributed an automation-induced risk to technology alone or to organisational culture alone. Incidents were consistently described as products of technology characteristics interacting with organisational culture conditions, within safety systems not designed to manage the resulting competency degradation.

Particularly significant was testimony from participants with direct experience of automation failure in operational conditions. Their accounts consistently illustrated the TS interaction at the heart of the framework: the moments of highest risk were not the failure of the technology as such, but the degraded human response to that failure, produced through a dependency on precisely the system that had stopped working. One participant characterised the dynamic precisely: the technology had removed the opportunities for practice that build the competency that is needed when the technology fails.

The external pressure variables were independently identified by participants without prompting. Multiple participants characterised regulatory standards, including certification standards for new automated systems and minimum hours for type rating qualification, as calibrated for an operational environment that current technology has fundamentally superseded. The +RRC dimension was most explicitly theorised by a participant researching trust and acceptance in autonomous systems, ascertaining that no major regulatory document has operationalised the trust requirement it nominally acknowledges; a direct instance of State 2 in the +RC/+RRC model. The Boeing MCAS case, discussed by multiple participants, was recognised as qualitatively more dangerous: not regulatory lag but the structural collapse of regulatory independence: State 3.

4.3 Refinements Generated by the Empirical Data

Three findings from the qualitative dataset prompt specific refinements to the framework.

First, the TS interaction requires explicit distinction between disengagement risk and re-engagement risk as described in Section 3.4. The existing automation literature has addressed skill fade extensively, but the re-engagement mechanism, where high-reliability technology generates excess-trust at state transitions is undertheorised. It represents a qualitatively different failure mode that the Technology domain must encompass alongside the disengagement risk more commonly discussed.

Second, the empirical data strongly supports the directional claim that Organisational Culture exerts a prior, conditioning influence on Safety outcomes. Just culture is a cultural property, not a systemic one: its presence or absence is determined by leadership behaviour and organisational norms, not by the sophistication of the safety management system. Interventions targeting safety systems without addressing the organisational culture conditioning their effectiveness are structurally incomplete.

Third, a minority participant position, that current manual flying practice norms may in certain operational contexts increase rather than reduce risk, introduces a productive challenge. If skill profiles have shifted such that manual flying competency has itself become a risk factor in specific scenarios, then the TS relationship becomes non-linear and context-dependent. The framework accommodates this through the Context and Outcome centre circle: analytical application of SToC to a specific case will always specify the operational context, and risk relationships should be assessed within that context rather than as universal claims.

5. Accident Mapping

To validate SToC(+RC/+RRC) beyond practitioner testimonies, the framework was applied systematically to five significant automation-implicated accidents. The mapping draws on publicly available official reports from the BEA, NTSB, AAIB, and ICAO. The criterion for selection was that each accident involved a meaningful contribution from automation interaction, as distinguished from accidents driven primarily by mechanical failure, weather, or deliberate action.

Table 3 presents the mapping. The symbol indicates confirmed domain involvement; absence of the symbol indicates no significant involvement. The Primary Failure Pathway column specifies the Context and Outcome for each case thereby operationalising the framework’s centre circle in analytical application.

Table 3: SToC(+RC/+RRC) Mapping of Automation-Implicated Accidents

(filled circle = domain implicated; open circle = domain not implicated)

Several observations emerge from the mapping. First, no accident is explicable by reference to a single domain. The minimum domain count is two (Turkish Airlines 1951), and the Boeing 737-MAX MCAS case activates all five framework variables. This is consistent with the framework’s foundational claim.

Second, the distinction between +RC and +RRC proves analytically essential in the MCAS case and would be invisible to any framework treating regulatory response as a single variable. +RC is clearly implicated: MCAS represented a software-based stability augmentation system of a sophistication that had not previously required crew awareness, evolving significantly between the 737-800 and 737-MAX. But the more consequential failure is +RRC.  Specifically, the collapse into State 3. The FAA’s delegation of safety assessment to Boeing did not merely slow regulatory response; it eliminated its independence. The regulator approved a system whose safety implications it had not independently evaluated because it no longer possessed the competency to do so without deferring to the manufacturer. This is regulatory capture in its most structurally dangerous form; a failure mode no existing safety framework is equipped to represent.

Third, the framework reveals the qualitative difference between accidents in which +RRC is implicated and those in which it is not. Air France 447 and Asiana 214 represent State 2 +RRC failures, those standards not keeping pace with operational reality rather than the State 3 structural collapse seen in MCAS. The distinction matters for intervention design: State 2 calls for regulatory updating; State 3 calls for structural reform of the relationship between regulator and industry.

6. Implications

6.1 For Practitioners and Training System Design

The location of training philosophy within the Organisational Culture domain has direct practical implications. Training is not a neutral technical process. It is a cultural expression of what an organisation believes competency requires. Organisations that have normalised automation reliance will produce training programmes that reflect that normalisation, reducing manual practice, prioritising systems management over manual skills, and creating the conditions for re-engagement risk at mode/state transitions. Recognising training philosophy as a cultural variable rather than a regulatory compliance exercise is the first step toward addressing it structurally.

The identification of two distinct automation-safety risk modes also requires that training syllabi address both mechanisms explicitly. Recurrent manual flying training addresses skill currency but does not necessarily address the mode awareness and re-engagement verification habits that protect against over-trust at automation transitions. Training that replicates the conditions of automation re-engagement, including the expectation violations that characterise abnormal states, whether by CBT or EBT, is structurally different from training that simply accumulates manual flying hours.

6.2 For Regulators

The framework’s most significant implication for regulators is the three-state +RC/+RRC model and the specific risk of State 3 regulatory capture. The MCAS case should be understood not as a deviation but as the logical endpoint of a regulatory culture in which technical competency has progressively been outsourced to industry. Rebuilding +RRC as a genuinely independent variable requires regulators to maintain, resource, and protect technical expertise that is not dependent on manufacturer cooperation, in other words, a structural requirement, not a procedural one.

At the State 2 level, the framework identifies three priority regulatory interventions: updating certification standards to include explicit competency requirements for degraded-mode operations; revising minimum training hours to reflect the competency implications of current automation levels rather than those of the era in which the standards were written; and developing an operationalised, enforceable framework for trust and acceptance assessment before new autonomous systems are approved for deployment. The current situation, where trust and acceptance are nominally acknowledged in regulatory documents but not operationalised in enforceable standards, is precisely the State 2 condition.

6.3 For Cross-Domain Application

SToC(+RC/+RRC) was developed in aviation but designed for cross-domain application. The structural conditions it describes; high-reliability technology, progressive skill transfer to automated systems, organisational commercial pressures, and regulatory frameworks that post-date the technology they govern, are present in healthcare (surgical robotics, ICU monitoring, AI-assisted diagnostics), maritime operations, nuclear energy management, and road transport. Healthcare is the most analytically proximate domain, and the +RRC dimension is particularly relevant: examining whether medical device regulation has tracked the pace of surgical technology development, and whether State 3 dynamics are present, would constitute both a test of the framework’s generalisability and a substantive contribution to comparative safety science.

7. Limitations and Future Research

Several limitations should be acknowledged. First, the qualitative dataset of thirteen participants, while achieving saturation, is drawn predominantly from experienced, senior aviation professionals. The professional identity tension between experienced and automation-native pilot generations is constructed primarily from one perspective. Counter-perspective data from pilots trained under predominantly automated conditions would allow the framework’s claims about technology-dependency and skill profile change to be tested against the other party’s account.

Second, the framework rests on qualitative evidence and structured accident analysis. While appropriate for a conceptual framework paper, generalisability would be strengthened by quantitative corroboration. A validated survey instrument measuring perceived competency adequacy for automation degradation scenarios, administered to a larger pilot sample, would allow qualitative findings to be tested against quantitative distributions and provide a basis for cross-national comparison.

Third, the +RC/+RRC relationship has been theorised and illustrated through case analysis but not yet operationalised as a measurable variable pair. Future research should explore how both rates might be quantified: candidate measures for +RC include the number of significant automation capability changes per aircraft generation and the pace of software update cycles; candidate measures for +RRC include the elapsed time between system introduction and regulatory standard revision, and the proportion of regulatory technical assessment conducted independently versus delegated to industry.

Fourth, the paper has not addressed the forthcoming challenge of artificial intelligence integration into flight deck operations. AI-assisted flight management, predictive maintenance, and the potential trajectory toward single-pilot operations represent a qualitative step change in both +RC and the challenge facing +RRC: AI system opacity may structurally prevent the independent regulatory assessment that even current-generation automation permits. The State 3 risk is likely to become more acute as AI capability advances, and the framework is designed to accommodate this, but the specific AI dimension warrants dedicated theoretical treatment as a near-term research significance.

8. Conclusion

This paper has introduced the SToC(+RC/+RRC) framework as a contribution to safety science’s analytical inventory for understanding automation-induced risk in safety-critical industries. The framework’s central argument can be stated plainly: existing safety models describe the domains in which automation-induced risk operates; SToC(+RC/+RRC) theorises how those domains interact, treats the rate of technological change and the rate of regulatory response as independent and separable risk determinants, and identifies the failure mode, regulatory capture, in which the independence of regulatory response collapses entirely.

The framework is not a replacement for the analytical tools that precede it. Reason’s Swiss Cheese model, HFACS, and FRAM remain valuable for their respective purposes. SToC(+RC/+RRC) adds an integrative layer they do not provide: a model of how Safety, Technology, and Organisational Culture mutually condition one another, subjected to two external pressures that move at different velocities and whose delta is the system’s primary risk variable.

The importance of this contribution is not merely academic. The aviation industry is actively contemplating a transition to single-pilot operations, remote piloting, and AI-assisted flight management, consequently, an acceleration of +RC without precedent in the industry’s history. It is doing so while the foundational questions about current-generation automation remain unresolved: evidence suggests regulatory standards have not been calibrated to the competency requirements of existing automated cockpits; trust and acceptance remain nominally acknowledged but operationally undefined; and the structural risk of regulatory capture exposed by MCAS has not been structurally addressed. The industry is preparing to deploy the next generation of autonomous systems in a regulatory environment that has yet to catch up with the last one.

The safety of commercial aviation is presently sustained by a combination of increasingly reliable technology and diminishing human competency. The stability of that combination depends entirely on the technology not failing in the ways it is capable of failing, and on the regulatory system maintaining sufficient independence and competency to govern what it approves. SToC(+RC/+RRC) is offered as a framework for understanding why both conditions are under structural pressure, and what would be required, in organisational culture, in technology design, and above all in regulatory reform, to manage that pressure before the transition to greater autonomy makes it acute.

References

Bainbridge, L. (1983). Ironies of automation. Automatica, 19(6), 775-779.

Dekker, S. W. A. (2007). Just Culture: Balancing Safety and Accountability. Ashgate.

Endsley, M. R. (1995). Toward a theory of situation awareness in dynamic systems. Human Factors, 37(1), 32-64.

Hollnagel, E., Wears, R. L., & Braithwaite, J. (2015). From Safety-I to Safety-II: A White Paper. The Resilient Health Care Net.

Hollnagel, E., Paries, J., Woods, D. D., & Wreathall, J. (Eds.) (2011). Resilience Engineering in Practice. Ashgate.

Hutter, B. M. (2001). Regulation and Risk: Occupational Health and Safety on the Railways. Oxford University Press.

Lee, J. D., & See, K. A. (2004). Trust in automation: Designing for appropriate reliance. Human Factors, 46(1), 50-80.

Parasuraman, R., & Riley, V. (1997). Humans and automation: Use, misuse, disuse, abuse. Human Factors, 39(2), 230-253.

Perrow, C. (1984). Normal Accidents: Living with High-Risk Technologies. Basic Books.

Rasmussen, J. (1983). Skills, rules, and knowledge: Signals, signs, and symbols, and other distinctions in human performance models. IEEE Transactions on Systems, Man, and Cybernetics, SMC-13(3), 257-266.

Reason, J. (1990). Human Error. Cambridge University Press.

Reason, J. (1997). Managing the Risks of Organisational Accidents. Ashgate.

Rogers, E. M. (2003). Diffusion of Innovations (5th ed.). Free Press.

Sarter, N. B., & Woods, D. D. (1994). Pilot interaction with cockpit automation II: An experimental study of pilots’ model and awareness of the flight management system. International Journal of Aviation Psychology, 4(1), 1-28.

Shappell, S. A., & Wiegmann, D. A. (2000). The Human Factors Analysis and Classification System – HFACS. FAA Civil Aeromedical Institute.

Weick, K. E., & Sutcliffe, K. M. (2001). Managing the Unexpected: Assuring High Performance in an Age of Complexity. Jossey-Bass.

Zohar, D. (2010). Thirty years of safety climate research: Reflections and future directions. Accident Analysis & Prevention, 42(5), 1517-1522.