Assessing aeromedical risk: a three-dimensional risk matrix approach.

Early aeromedical risk i was based on aeromedical standards designed to eliminate individuals ii from air operations with any identifiable medical risk, and led to frequent medical disqualification. The concept of considering aeromedical risk as part of the spectrum of risks that could lead to aircraft accidents (including mechanical risks and human factors) was first proposed in the 1980s and led to the development of the 1% rule which defines the maximum acceptable risk for an incapacitating medical event as 1% per year (or 1 in 100 person-years) to align with acceptable overall risk in aviation operations. Risk management has subsequently evolved as a formal discipline, incorporating risk assessment as an integral part of the process. Risk assessment is often visualised as a risk matrix, with the level of risk, urgency or action required defined for each cell, and colour-coded as red, amber or green depending on the overall combination of risk and consequence. This manuscript describes an approach to aeromedical risk management which incorporates risk matrices and how they can be used in aeromedical decision-making, while highlighting some of their shortcomings. © Her Majesty the Queen in Right of Canada, as represented by the Minister of National Defence, 2018.

Introduction

Risk assessment is an integral component of aviation safety; whether for private recreational flying or major airline operations, an assessment of risk forms part of every aircraft flight. Early fliers were primarily concerned about the risk of mechanical failure, but, over time, engineers improved aircraft design and construction so that other factors became increasingly important, including weather, pilot judgement and pilot health. Aircraft accident rates steadily declined, and modern aircrafts have a very low risk of mechanical or systems failure.1

Early aviation medicine specialists primarily focused on the special senses, and protection of the aviator from environmental factors such as hypothermia, hypoxia and sustained acceleration. Aeromedical standards evolved to select out individuals with conditions considered likely to cause incapacitation, and while these became increasingly rigid, they often had little or no supportive evidence to justify them (examples include the Schneider index2 (US Army Air Corps), the physical efficiency index3 (Royal Air Force) and, later, anomalies on the electroencephalogram). Aircrew who developed medical conditions that did not meet medical standards were generally removed from duty. Over time, the excessive loss of experienced aircrew, secondary to their medical conditions, led to the development of specific conditions under which such aircrew might be returned to at least restricted flight duties (often formally drafted as waivers in a waiver guide). Civilian aircrew were considered for limited medical certificates under a process involving accredited medical conclusion, relevant ability, skill and experience, and possible licence endorsement with special limitations, as laid out in International Civil Aviation Organization Annex 1.4

The 1% rule

Restrictions were often determined by a board of aeromedical specialists, generally comprising experienced clinicians who based their decisions on their clinical experience with such conditions. In 1973, Ian Anderson (a British physician who had joined the Royal Canadian Air Force (RCAF) and subsequently became the Director of Civil Aviation Medicine in Canada) presented a paper at the 44th Annual Scientific Meeting of the Aerospace Medical Association, in which he proposed that in assessing aeromedical risk for aircrew with medical conditions, aeromedical physicians should attempt to approximate the accepted aeronautical airworthiness risk accepted by aeronautical engineers for fatal accidents, which at that time was 1 in 10 million (107) flying hours.

This concept was further developed in the UK at the first UK Workshop in Aviation Cardiology, at which Tunstall-Pedoe proposed what became the ‘1% rule’.5 At that time, the all-cause accident rate for commercial airlines was approximately 0.2 per 1 million flying hours. For assessing medical risk, the Workshop decided on a target of 0.1 fatal accidents per 1 million flying hours (1 in 107 flying hours). Further, it was argued that aircrew, as part of the overall aircraft system, should not contribute more than 10% to total risk, and that pilot medical incapacitation should account for only 10% of crew failures. Based on these assumptions, it was argued that medical incapacitation should result in a fatal accident no more often than 1 in 1000 million flying hours (1 in 109).

Using a set of assumptions pertaining primarily to commercial civil aviation operations including average duration of flights (1 hour), critical phases of flight (limited to landing and take-off, representing 10% of flight time; ie, 6 min) and the presence of a copilot able to take over in the case of sudden incapacitation (which reduces risk by a factor of 100), it was calculated that only 1 pilot incapacitation in 1000 would be likely to lead to a fatal accident. For a target accident rate of 1 in 109 hours, if only 1 in 1000 incapacitations is likely to lead to an accident, the acceptable medical incapacitation rate is 1 in 106 hours. Since there are 8760 hours in a year (~104), the acceptable annual medical event rate to meet this target is 1% per year (104×102=106). This formed the basis of the ‘1% rule’, widely used in assessing medical risk in aviation.5 The 1% rule provided a useful, objective tool towards assessing acceptable aeromedical risk in evaluating aircrew with established medical problems, cardiovascular or otherwise. For example, in assessing aircrew after revascularisation, or after myocardial infarction (MI), data from clinical trials can provide risk estimates to define subsets of individuals whose annual event rate is less than 1% per year.

However, the 1% rule has significant limitations. It is based on a series of assumptions relevant to short (1 hour) commercial flights with critical flight times limited to take-off and landing (6 min). Medical events are assumed to result in complete incapacitation of one pilot and it is assumed that a copilot could safely deal with incapacitation of the other pilot, occurring during a critical period of landing and take-off, 99 times out of 100.

It assumes that an incapacitation occurring outside this critical 6 min poses no safety risk with the other pilot expected to take over and land the aircraft safely in all cases. Despite these constraints, the ‘1% rule’ (or a variant of it) has become an important tool for aeromedical risk assessment in flying operations in general and is widely used by air forces when assessing acceptable aeromedical risk.6 However, the assumptions underlying the 1% rule remain contentious and it has been argued that a 2% risk per year (or up to 5% per year in certain circumstances) may be acceptable.7

Aeromedical risk matrices

The assessment and management of risk has continued to evolve, as an academic discipline, being applied in diverse fields such as economics, business, engineering and space operations. Risk management principles acknowledge that the assessment of risk involves the probability of an occurrence and the potential consequences of any event. This has led to the evolution of risk matrices, which plot the potential organisational or operational impact of an event based on the probability of occurrence, and the severity of the event. An example of a 4×4 risk matrix is shown in figure 1.

Figure 1

A risk matrix with associated red/amber/green (RAG) organisational risk acceptance=green acceptable to red unacceptable.

Risk matrices allow further granular risk assessment beyond the one-dimensional ‘1% rule’ and provide a semiquantitative assessment of the flight safety and operational impact of a broad spectrum of medical conditions with variable probabilities of occurrence.

The implementation by organisations of formal risk management programmes which include risk identification, quantification and mitigation was adopted by medical management teams, including the International Space Station Multilateral Space Medicine Board, which incorporated a risk matrix approach to assessing risk for certification of Space Station crewmembers.8 Expanding from the ‘1% rule’, the risk matrix approach facilitated a semiquantitative assessment of the flight safety and operational impact of a broad spectrum of medical conditions with varying probabilities of occurrence.

Defining probability and consequences of medical events

Risk matrix columns categorise increasingly severe outcomes of events. The specific factors and definitions used to determine the consequences of aeromedical events and the level of acceptable risk for various classes of medical events are an organisational responsibility, with factors unique to specific agencies (eg, military or civilian). As a specific example, the RCAF classifies severity of outcome depending on probable mission impact, performance decrement and requirement for medical attention, as shown in table 1.9 A national aeromedical licencing agency, or a civilian airline aeromedical department, for example, is likely to define and classify risk and outcomes differently, although with similarly increasingly severity outcomes for each category.

Table 1

The Royal Canadian Air Force (RCAF) classification of medical events, with potential impact, and recommended medical interventions

Class 1 medical event	Class 2 medical event	Class 3 medical event	Class 4 medical event
Minimal impact on mission	May result in a mission abort or compromised effectiveness	Likely to result in a flight safety hazard or compromise	Likely to result in a flight safety critical event
May result in a deleterious effect on the health of the individual aircrew but minimal effect on performance	Aircrew able to continue duties with minor to moderate performance compromise	Major decrement in performance	Total acute incapacitation (may include sudden death)
Requires routine periodic medical follow-up	Requires medical attention	May require immediate medical attention	Requires immediate advanced medical care

Defining probability of events

A standard classification of cardiovascular risk stratification based on risk factors (such as Framingham or Qrisk) classifies risk as low (<10%/decade or <1%/year), intermediate (10%–20%/decade or 1%–2%/year) and high (>20%/decade or >2%/year). For low-impact medical events, some aeromedical organisations may find event rates >2%/year acceptable (such as brief asymptomatic non-sustained ventricular tachycardia) while in critical military air operations, a predicted incapacitation rate of <1%/year may be unacceptably high. As an example, for the purposes of aeromedical disposition assessment, the RCAF stratifies likelihood of events as:

Likely: >2%/year.

Possible: 1%–2%/year.

Unlikely: 0.5%–1%/year.

Highly unlikely: <0.5%/year.

Combining class of medical events with the likelihood of occurrence produces a 4×4 risk matrix (figure 2). Assessment of the acceptable risk (and therefore colour) associated with each cell requires careful consideration by the utilising organisation.

Figure 2

An example of a 4×4 aeromedical risk matrix, incorporating class of medical events with likelihood. Defining the acceptable risk and hence red/amber/green colour coding is an organisational responsibility.

The third dimension: occupational (aircrew) role

As previously stated, the 1% rule was designed for risk assessment of commercial airline pilots but has gradually segued into use for general aeromedical certification purposes. However, while all aircrew have operational responsibilities, various aircrew roles are associated with different flight critical or mission critical risk, from cabin crew at the lower end of the risk spectrum through to single-seat, fast jet pilot at the other. A single risk matrix cannot reflect the operational impact of a medical event for all aircrew roles. To reflect the operational impact of a medical event incorporating aircrew role, a series of risk matrices that reflect the varying operational risk pertinent to specific aircrew role (the third dimension) is required. A simple classification could be: (A) aircrew with direct control over the aircraft (ie, pilot, copilot), (B) aircrew personnel with input to navigation or engine/mechanical systems (ie, navigator, flight engineer), and (C) aircrew responsible for passenger or cargo (ie, loadmasters, cabin crew). Although technically not considered aircrew, air traffic controllers are considered to have an attributable risk similar to pilots. An example of graduated risk matrices for each type of aircrew is shown in figure 3. The third dimension of risk categorisation, that is, aircrew role, is reflected in the various levels of acceptable risk for each group of aircrew (see figures 4 and 5).

Figure 3

Graduated risk matrices incorporating occupational role and differing classes of acceptable organisational risk for each aircrew category.

Search and rescue helicopter mountain hoist operation. Sudden incapacitation of either (category 1) pilot is likely to result in disaster. (Reproduced with permission from the Royal Canadian Air Force)

C-17 strategic transport flight deck. Incapacitation of either (category 2) pilot may result in a mission abort but is unlikely to compromise flight safety. (Reproduced with permission from the Royal Canadian Air Force)

These occupationally stratified sample risk matrices reflect the varying flight or mission risk associated with various aircrew roles. For example, for pilots and copilots, the acceptable class of risk for an acute coronary event leading to sudden incapacitation is <0.5%/year, with consideration for up to 1%/year (eg, with a restriction to fly with another pilot suitably qualified on that aircraft type and able to fly it solo in the event of an emergency). For cabin crew, an acceptable level of risk for such a class IV medical event may be up to 2%/year. For less serious cardiovascular events, for example, asymptomatic or mildly symptomatic atrial fibrillation, a likelihood rate of 2%/year or higher might be acceptable, while for flight critical aircrew, lower likelihoods would be required to be acceptable.

For military air operations, risk matrices would be constructed with a different perspective than in civilian operations, reflecting the potential requirement for medical care in austere operational environments, and the aeromedical consequences of a medical event in flying operations that may include sustained acceleration (high Gz), hypobaria and hypoxia. Military pilot roles vary in their operational and mission criticality. Single-seat fast jet pilots and low-level tactical helicopter pilots have different acceptable risk levels from air transport pilots. Many air forces recognise these differences by applying specific waivers or flying restrictions to certain aircraft types (eg, non-fast jet platforms such as tanker, transport or bomber aircraft). To reflect these differing aircrew roles for risk matrices, the RCAF also defines four categories of aircrew for the purposes of assessing aeromedical risk, as shown in table 2.7

Table 2

Aircrew categories in the RCAF stratified by increasing level of risk acceptance—1 highest impact of incapacitation, so lowest accepted risk, to category 4, lowest impact and highest acceptable risk

Category	Aircrew roles
Category 1	Pilots—fighters, tactical helicopter, maritime rotary wing, search and rescue rotary wing, instructors of ab initio aircrew Search and rescue technicians Air traffic controllers
Category 2	Pilots—transport, maritime fixed wing, instructors of qualified aircrew
Category 3	Airborne combat systems operators, flight engineers, airborne electronic sensor operators, mission specialists, flight test engineers, loadmasters, air weapons controllers, aeromedical training officers, aeromedical technicians, unmanned aerial vehicle operators
Category 4	Flight surgeons, flight nurses, flight medical technicians, cabin crew (flight attendants, flight stewards), AWACS technicians, remotely piloted aircraft systems (RPAS) payload operators

AWACS, Airborne Warning and Control System; RCAF, Royal Canadian Air Force.

For each category, a specific risk matrix is defined which reflects the corresponding risk considerations (figure 3). This approach promotes a more quantitative assessment of aeromedical risk for any medical condition, with more refined consideration of the potential operational impact for various aircrew roles.

Two practical cases are discussed below which reflect the application of risk matrices in conceptualising the risk associated with a low-probability but high-consequence event (Case 1), and a higher probability but lower impact event (Case 2). The former represents a situation in which the 1% rule could be relevant. Application of the 1% rule in the second situation would result in the potential unnecessary medical retirement of trained aircrew.

A 49-year-old air force transport pilot with a positive family history of coronary disease, dyslipidaemia, mild hypertension (controlled with a thiazide diuretic), cigarette smoking and irregular exercise.

Overweight 100 kg, BMI 30.9; waist circumference 104 cm; blood pressure 144/90.

Labs: Total/HDL-C=6.49/0.82 mmol/L, LDL 5.0, triglycerides 2.20, hs-CRP 3.5, Hg A1C 5.8.

Reynolds Risk Score: 30% for a cardiac event over the next decade.

Coronary artery calcium score (CACS): 476.

Exercise stress test and stress echo: negative.

Estimated aerobic capacity: 8 METS.

Coronary angiogram: 40% LAD stenosis, 25% D1 stenosis and 35% RCA stenosis.

Intervention with dietary modification, an exercise programme and statin treatment after 6-month results in Total/HDL-C=5.1/1.0 mmol/L, LDL 2.0, triglycerides 0.90, Hg A1C 5.5 and an improved aerobic capacity at 10 METS.

BMI, body mass index; HDL-C, high-density lipoprotein-cholesterol; hs-CRP, high-sensitivity C-reactive protein; LAD, left anterior descending coronary artery; LDL, low-density lipoprotein; METS, metabolic equivalents; RCA, right coronary artery.

A 43-year-old airline pilot mildly aware of an irregular heart action. No light-headedness. Goes to emergency department. Similar episode 3 years before while on vacation. Symptoms disappeared after a couple of hours.

Atrial fibrillation found on ECG, ventricular rate 90–100.

Normal cardiac structure and function on echo.

Spontaneously reverts to sinus rhythm during emergency room (ER) visit.

Follow-up investigations including exercise stress test, Holter monitor, thyroid indices all normal.

Can he be returned to flying duties? Further assessment of his fitness to fly requires a clearer definition of his risk for a cardiac event. He clearly has coronary aherosclerosis and requires usual primary prevention (as per national clinical guidelines) but he has no evidence of inducible ischaemia. For major adverse cardiovascular events, data from follow-up of coronary calcium score indicate a 1%/year for individuals with a coronary artery calcium score of 400–99910 while coronary angiography data from US Air Force aviators show similar event rates of 1.1%/year for an aggregate of lesions >50% but <120%.11 Preventive interventions of smoking cessation, statin therapy and a regular exercise programme are likely to all reduce his cardiovascular event risk. Together, these interventions may decrease his risk for any coronary event by up to 50%.

Based on this data, and with continuing optimal risk factor control, his risk for MI or sudden death (a class 4 risk matrix event) is in the range of 0.5%–1%/year with risk for angina or an acute coronary syndrome risk (a class 3 risk matrix event) between 1% and 2%/year. As a military transport pilot, utilising the RCAF risk matrix for category 2 aircrew, his risk matrix would be as in figure 6. This suggests that he may be safe to return to category 2 transport pilot duties, provided he maintains full risk mitigation interventions. A return to smoking, for example, would increase his risk to unacceptable levels (>2%/year). This disposition is concordant with those of most air force (and civilian) aeromedical authorities.

Figure 6

Risk matrix/case 1. ACS, acute coronary syndrome; MI, myocardial infarction; SCD, sudden cardiac death.

From an aeromedical perspective, the risk matrix is helpful to conceptualise the potential aeromedical impact of any condition. Strict adherence to a one-dimensional risk tool such as the ‘1% rule’ could lead to a potentially overly restrictive approach of licence removal or restriction. From a military operational perspective, the risk matrix would be considered within a wider operational perspective, reflecting the potential limitations of medical care in austere operational environments.

This 43-year-old otherwise healthy airline pilot has paroxysmal lone atrial fibrillation that is mildly symptomatic with palpitations but no light-headedness or presyncopal haemodynamic symptoms. From an aeromedical perspective, his risks are of recurrence of symptomatic atrial fibrillation especially during flight, and associated risk of thromboembolism. Based on clinical literature, his risk of recurrence exceeds 2%/year, likely in the range of 2%–5%/year.12 13 At age 43, normotensive, with no other associated risk factors, his risk for thromboembolism is very low with a CHADS2 score of 0, and anticoagulation is not indicated.

Using the risk matrix from figure 2 (appropriate for civil air operations), his risk for atrial fibrillation recurrence could be classified as a class 1 or possibly class 2 medical event. Even with projected risks of recurrence exceeding 2% per year, he could be considered for class I medical certification. A thromboembolic event would be a class 3 or 4 medical event, but with a CHADS2 score of 0, this risk is less than 1%/year, again acceptable for class I certification.

From an aeromedical perspective, the risk matrix is helpful to conceptualise the potential aeromedical impact of atrial fibrillation risk. Strict adherence to the ‘1% rule’ could lead to an unnecessarily restrictive approach of licence removal or restriction.

From a military operational perspective, the risk matrix would be constructed with a somewhat different perspective, reflecting the potential requirement for medical care in austere operational environments, and the potential cardiovascular consequences of atrial fibrillation onset in high-G aircraft, which could lead to G-force induced loss of consciousness should atrial fibrillation onset occur during high G.

Summary

Aeromedical risk assessment has evolved from a position of requiring aircrew to meet rigid medical standards, often not related to bona fide operational risk, to one that includes aeromedical risk as an element of the overall risk of aircraft operations. Early approaches attempted to quantify the risk of an incapacitating event related to the human element in overall aircraft operations, resulting in the 1% rule, which was designed for application to dual-piloted commercial air operations. Limitations of the 1% rule included its narrow applicability, and the lack of recognition of different risks arising from different types of incapacitation, including mental incapacitation.

The evolution of risk management practices has led to the concept of medical risk as the combination of probability of an event, along with the operational consequences, conceptualised as a risk matrix. Incorporating a risk matrix approach allows aeromedical decision makers to visualise medical events across a spectrum of outcomes, from catastrophic (as in the 1% rule), to minor events with limited impact on air operations, with differing levels of acceptable probability.

Another limitation of the two-dimensional risk matrix for aeromedical risk is that the loss of differing aircrew personnel due to medical incapacitation, and the resultant failure to undertake their responsibilities, have quite different impacts on air operations, both from a perspective of aviation safety and operational outcomes. This has led to the development of a three-dimensional risk matrix, outlined and proposed in this manuscript; one that incorporates different aircrew roles and responsibilities. The incapacitation of a pilot carries a significantly higher risk impact than, for example, the loss of a flight engineer; among military pilot roles, single-seat fighter pilots and low-level tactical helicopter pilots will, by necessity, have a lower tolerable risk than pilots in strategic air transport operations, flying with a second pilot, suitably qualified on that aircraft. Similarly, in civil air operations, medical events in helicopter pilots undertaking helicopter emergency medical operations are likely to have a higher impact on flight safety than in dual-pilot airline operations.

It should always be remembered that risk matrices are decision support tools for semiquantitative visualisation of aeromedical risk. They are not without limitation however, and the estimated probability of medical events often has wide CIs. These are not reflected in the risk matrices and the margins of error may incorporate unacceptable risk through to acceptable risk. They therefore should not be construed as providing the ‘answer’ or used in isolation. They provide a guide for conceptualisation of aeromedical risk, but the ultimate aeromedical disposition should be a result of rational discussion of the apparent risk within the context of the aircrew role and responsibilities. In this respect, civilian and military aeromedical risk matrices will reflect different acceptable risk limits.

While the general concept of three-dimensional aeromedical risk matrices is applicable to any air operation, the implementation in terms of defining the operational outcomes (consequences) and acceptable level of risk for each type of outcome, across various aircrew roles, is an individual organisational decision. National aeromedical certification agencies will have a different perspective of acceptable risk and different set of risk matrices than the same country’s air force is likely to have.

Case 2/risk matrix.