Designing Graceful Degradation into Complex Systems: The Interaction Between Causes of Degradation and the Association with Degradation Prevention and Recovery

System resilience is critical to safety in air traffic control. An important element of maintaining resilience is the ability of systems to degrade gracefully. Of the available graceful degradation research, a majority of studies have focused primarily on technological causes of degradation only, limiting an ecologically valid understanding of the causes of degradation in air traffic control, and the preventative and mitigative strategies that enable graceful degradation. The current study aimed to address this research gap by investigating causes of degradation in air traffic control (ATC) across the broad categories of technology, the environment, and the human operator, and the potential interactions between these causes. 12 retired controllers (ATCOs - Air Traffic Control Officers) participated in semi-structured interviews focused on previous experience of causes of degradation and mitigation strategies. Findings provide an understanding of causation of degradation in air traffic control, and the prevention and mitigation strategies that moderate the relationship between cause and system effect. Findings confirmed that causes appear to interact to create compound, multiple effects on overall system performance. Findings also revealed prevention and mitigation strategies utilized to moderate the effect of the cause on the system. In order to gain an ecologically valid understanding of the causes of degradation, and effective prevention or mitigation strategies, causes from multiple categories, and the interactions between them, must be identified. Findings have implications for designers of future air traffic control systems to ensure the ability of the system to gracefully degrade, as well as risk assessment and system validation processes.