Incident Pattern Mining¶
Procedure — instantiates Emergent Pattern Detection
Analyzes many incidents, near misses, support cases, or complaints to discover system-level patterns no single incident reveals.
Incident Pattern Mining takes a corpus of discrete, after-the-fact records — incidents, near misses, complaints, support cases — and mines it retrospectively for recurring cross-incident structure that no single record reveals. Its defining move is working on an accumulated body of closed cases: each incident is already over and already investigated, and the pattern lives in what many of them quietly share. Where the live detection methods are forward-looking and present-tense, this procedure is forensic and backward-looking; it converts a pile of "isolated" events into a named systemic pattern precisely because the structure is invisible one incident at a time.
Example¶
An airline's safety office receives a steady trickle of voluntary near-miss reports. Each is a one-off, each already investigated and closed, and read individually they look like unrelated pilot judgment calls at scattered airports. Incident Pattern Mining pools a full year of them and codes each along shared dimensions — airport, phase of flight, time of day, weather, contributing factors — so that heterogeneous free-text write-ups become comparable records. Then it clusters. A pattern surfaces that no single report showed: runway-incursion near-misses concentrate at one airport, under a specific taxiway-lighting condition, disproportionately at dusk. No pilot saw this; only the corpus does. The finding — a latent hazard in signage under particular light — routes to an airport-level fix rather than a per-pilot correction, and the coding scheme is refined so the next pass catches the same shape faster.
How it works¶
- Assemble a corpus of discrete incident records (reports, tickets, complaints, postmortems) accumulated over a chosen window.
- Code each record along shared dimensions, turning inconsistent write-ups into comparable, minable data.
- Aggregate and cluster to surface recurring cross-incident structure — the pattern that is invisible per incident.
- Feed findings back into the taxonomy, refining the codes and categories so subsequent passes mine the corpus better.
Tuning parameters¶
- Corpus window — how far back to pool. A longer window finds rarer patterns but mixes in stale, no-longer-relevant cases.
- Coding scheme — a fixed taxonomy versus emergent codes. Fixed is fast and comparable; emergent catches the shape you did not anticipate.
- Cluster granularity — coarse buckets versus fine ones. Fine clusters pinpoint specific hazards but risk overfitting the particular corpus.
- Recency weighting — how much to privilege recent incidents over old ones when the system itself is changing.
When it helps, and when it misleads¶
Its strength is exactly that the pattern is invisible per-incident: it converts a scatter of individually-minor, individually-closed events into a legible systemic hazard, and it does so from records the organization already has.
Its central failure is the denominator. Mining can reveal normalization of deviance — recurring small deviations the system had quietly accepted until the corpus makes their accumulation legible[n1] — but it is blind to what never gets reported, so an under-reported hazard looks reassuringly safe. The classic misuse is treating the incident pile as the ground truth and mistaking reporting bias for the real pattern (the busiest-reporting team looks the most dangerous). The guarding discipline is to watch reporting rates alongside the patterns, and to read an absence of incidents as possibly an absence of reports rather than an absence of risk.
How it implements the components¶
local_signal_collection— the individual incident reports are the local traces the corpus is built from.aggregation_rule— pools and clusters the coded corpus across its shared dimensions.pattern_detector— the clustering-and-surfacing step that names recurring cross-incident structure.feedback_review_loop— findings refine the coding taxonomy so each pass mines the growing corpus better.
It does not fuse live faint signals for early warning — it mines a retrospective corpus of closed cases; forward-looking fusion is Weak-Signal Aggregation. And it does not classify desirability or trigger the response (no desirability_classification / response_rule) — that surface is Emergent Behavior Dashboard.
Related¶
- Instantiates: Emergent Pattern Detection — Incident Pattern Mining supplies the archetype's retrospective, corpus-based route to a systemic pattern.
- Sibling mechanisms: Anomaly Detection · Trend Detection · Weak-Signal Aggregation · Social Pattern Monitoring · Ecosystem Monitoring · Emergent Behavior Dashboard · Organizational Sensing
Editorial Notes¶
Form Classification¶
Form family: Analysis, Modeling & Optimization
Rationale: Incident Pattern Mining operates as a computation, comparison, model, or analytic representation used to infer, estimate, or choose because it analyzes many incidents, near misses, support cases, or complaints to discover system-level patterns no single incident reveals
Independent corroboration: The frozen evidence defines Incident Pattern Mining as 'Analyzes many incidents, near misses, support cases, or complaints to discover system-level patterns no single incident reveals', so its operative form is Analysis, Modeling & Optimization.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Aggregating closed incidents and near misses to reveal systemic safety patterns is a reliability and safety-engineering learning practice.
Related originating lineages:
- Data Science & Analytics — Text and event mining materially scale pattern detection across large incident corpora.
- Organizational & Management Science — Retained as a formative lineage because the independent reviewer identified it as primary: Cross-case discovery of normalized deviance and recurring organizational conditions follows safety-organization research such as Diane Vaughan's.
Review resolution: NASA’s mishap-analysis handbook systematizes coding, causal classification, and trend learning across events. Organizational learning contributes portfolio interpretation, but extracting repeatable failure patterns from incident records is rooted in safety/reliability engineering. The retained alternate domains identify independent or materially shaping provenance, not downstream reach alone. domain_reach=multi_domain because the mechanism has independent established use in several fields. The encyclopedia entry deliberately composes those lineages.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Researched adjudication after independent review; high confidence.
Sources consulted:
- https://standards.nasa.gov/standard/NASA/NASA-HDBK-870925 — NASA handbook for human-factors analysis and classification of mishaps and close calls.
Notes¶
[n1] Normalization of deviance (Diane Vaughan's term from her study of organizational decision-making): a pattern in which small departures from the safe standard are repeatedly tolerated until the abnormal becomes the accepted normal. Cross-incident mining is one of the few things that can make that slow accumulation legible before it produces a catastrophe. ↩