Ten Routes, One Airport, Two Hazards: Reading the Incheon RKRR Alert Stack

Executive Summary: A Single Aerodrome, Counted Ten Times

At 15:06 Beijing time on 18 October 2026, the OSINTRAI route-risk fusion run flagged 17 of 60 monitored routes at alert level, and 10 of those 17 share a single characteristic that the raw flag count conceals: they all name the same aerodrome. [source-1] Every one of those ten routes terminates at ICN, Incheon International Airport, inside the RKRR Incheon flight information region, and on every one of them the alert-level reason is an embedded thunderstorm with the EMBD qualifier positioned at a distance of 0 km from the field. [source-1] Six of the ten additionally carry a second hazard entirely different in kind, a severe icing entry with the SEV qualifier, also at 0 km and also travelling east at 30 knots. [source-1] This is a materially different risk structure from a weather pattern that simply affects many airports, because the ten flags are not ten independent observations but one observation of one aerodrome counted once per route that touches it. [source-2] A reader who treats the flag count as a measure of regional storm severity will systematically overstate how much of the network is affected, and this report exists to decompose the count before anyone acts on it. [source-2] The engine that produced this output recorded 75 thunderstorm SIGMETs, 12 volcanic ash SIGMETs, 29 turbulence SIGMETs, 10 icing SIGMETs and 5 tropical cyclone SIGMETs across all sources at the run's timestamp, which is the denominator that makes the ten-route figure legible. [source-1]

1. The Exact Composition of the Alert Set

The run produced 17 alert-level routes out of 60 monitored, leaving 43 at none. [source-1] Those 17 alerts resolve into two geographic clusters that share no aerodrome. [source-1] Seven routes name PVG, Shanghai Pudong, inside the ZSHA Shanghai FIR, each carrying an embedded thunderstorm reason at 0 km moving east at 16 knots. [source-1] Ten routes name ICN, Incheon, inside the RKRR Incheon FIR, each carrying an embedded thunderstorm reason at 0 km moving east at 30 knots, and six of those ten additionally carrying a severe icing reason at 0 km on the same easterly vector. [source-1] The single exception to the clean seven-and-ten split is PVG-ICN, which appears in both clusters because it touches both endpoints, and its reason list contains four entries rather than two. [source-1] Every alert in the run is therefore attributable to exactly two FIR references, and the count of seventeen is an artefact of route pairing rather than a measurement of seventeen separate weather systems. [source-1]

Sources: [source-1]

The reason lists carry a duplication pattern worth naming precisely, because it affects how a reader counts hazards. [source-1] On routes where both a thunderstorm and an icing entry appear, the thunderstorm entry appears twice with identical fields and the icing entry appears twice with identical fields, so a four-entry reason list on PVG-ICN contains two distinct hazards each recorded twice. [source-1] A naive count of reason entries across the alert set would report 34 reasons where 24 distinct hazard records exist, and the inflation is uniform rather than random. [source-1] The engine's own summary renders this correctly, describing ICN as having a thunderstorm area with EMBD qualifier directly affecting take-off and landing plus a further three risks, which is four entries describing two hazards. [source-1] Any downstream consumer tallying reason entries rather than deduplicating on hazard type will overcount by a factor of two on dual-hazard routes. [source-2]

2. Why Incheon, and Why Two Hazards at Once

Incheon sits in a monsoon-adjacent climate where summer convective activity and autumn/winter icing conditions can overlap on the same day at the same altitude band, the physical circumstance that makes a dual-hazard reason list possible rather than anomalous. [source-3] The two hazards are not independent, and treating them as two separate operational problems is the second category error this report addresses. [source-2] Embedded thunderstorms produce organised updraughts that lift supercooled droplets above the freezing level, and that lifting is precisely what converts a convective hazard into an icing hazard. [source-3] Severe icing under the SEV qualifier denotes a condition outside the aircraft's certified ice protection, a categorically different statement from moderate icing the fleet is designed to handle. [source-4] A crew dealing with both is not managing two problems but one problem with two expressions, and the correct response to the combination differs from the response to either alone. [source-3]

Sources: [source-1] [source-3]

The movement vectors separate the two clusters in a way that has direct operational consequence. [source-1] The Incheon cell travels east at 30 knots, which is roughly 56 km/h, and an easterly vector at an airport on the Korean west coast points the cell out to sea rather than across the field. [source-1] The Shanghai cell travels east at 16 knots, roughly 30 km/h, and Pudong sits on the eastern edge of the Shanghai FIR where the same vector points toward open water as well. [source-1] Both clusters are therefore moving away from their reference aerodromes, which is the single most useful fact for anyone deciding whether an alert is decaying or building, and neither cluster's vector suggests an inbound approach. [source-1] An alert generated by a departing cell and an alert generated by an approaching cell are different operational objects, and the fusion engine records the vector precisely so that no reader has to infer direction from geography. [source-5]

3. The Denominator That Makes the Count Legible

A flag count without a source-volume denominator is not interpretable, and the run records enough context to supply one. [source-1] The international SIGMET source reported 5 tropical cyclone, 12 volcanic ash, 75 thunderstorm, 10 icing and 29 turbulence messages at the run's timestamp, totalling 131 active messages. [source-1] The US SIGMET source, the National Weather Service severe alert feed and the USGS earthquake feed all returned ok status, and the earthquake feed carried 10 events at or above magnitude 5.0 over a five-day window. [source-1] The National Weather Service carried 35 severe alerts over the same period. [source-1] Against 131 active international SIGMETs, ten routes naming a single aerodrome is a small fraction of the day's hazard volume, which is the correct context for a reader deciding whether to cancel or rebook. [source-1]

Sources: [source-1]

Two structural gaps in the run deserve explicit statement rather than silent omission. [source-1] The first is that the risk payload's airport resolution field reports 18 of 18 airports resolved, which is complete, but the price-window chain that consumed this output recorded its geographic correlation step as failed, with the correlated geographic risk layer carrying a checked-at timestamp of 2 October 2026 rather than the run date. [source-6] Any route that would have received a geopolitical correlation input on 18 October did not receive one, and this report does not infer what that layer would have added. [source-6] The second is that the chain's own completeness accounting reports 60 signals total, 60 with risk attached and 60 with weather attached, but only 56 with geographic risk attached, which is the same four-route shortfall expressed in the price payload. [source-6] A reader reconciling the two subsystems should expect exactly four routes to lack the geographic layer and should not treat their absence of a geographic flag as a clean result. [source-6]

4. What a Reader Should and Should Not Take From This

The defensible reading of this run is narrow and specific. [source-2] Ten routes terminating at one aerodrome were at alert level because two hazards were reported at that aerodrome's coordinates, both travelling east and both therefore moving away from the field. [source-1] The unflagged 43 routes were not certified safe; they simply had no active hazard entry naming their endpoints at the run's timestamp. [source-1] The tier vocabulary used throughout is dimensionless classification output with alert at 90 and watch at 60, carrying no physical unit, which means the numbers are labels for routing priority rather than measurements of intensity. [source-1] For a passenger holding an ICN-bound ticket on 18 October, the actionable content is that the arrival airport had active convective and icing hazards, not that a specific delay is imminent. [source-1]

The indefensible readings are equally easy to name. [source-2] Seventeen is not the number of storms. [source-1] Ten is not the number of independent weather events in Korea. [source-1] An alert is not a cancellation, and the engine records no delay prediction at all, only hazard presence at a coordinate. [source-1] A dual-hazard reason list does not mean the two hazards will arrive together, because a convective cell and an icing layer at the same coordinates can have entirely different lifetimes. [source-3] And the volume figures do not compose: 131 active SIGMETs across the international feed is not a measure of risk on any particular route, since the vast majority of those messages concern airspace that none of the 60 monitored routes traverses. [source-2]

Sources: [source-1] [source-2]

For a traveller with an ICN connection on the day, the preparation is about resilience rather than prediction. [source-5] Confirm the onward leg separately from the inbound leg, since an arrival delay at a hub of this size propagates differently from a departure delay at the origin. [source-5] Keep the booking reference reachable offline in case a rebooking flow requires it during poor connectivity. [source-7] An eSIM data plan maintains the rebooking and hotel channels when a hub disruption coincides with a local network load increase. [source-8] A fixed-price transfer anchored to a flight number absorbs a multi-hour arrival slip better than a prepaid non-refundable pickup, and flight compensation eligibility depends on the carrier's response rather than on the hazard, which is worth checking separately from the delay itself. [source-9] [source-10] Readers who want these route-risk decompositions delivered as they are produced can register for the OSINTRAI daily brief and follow the desk directly, since each run is timestamped and reproducible against the figures quoted here.

5. Why This Differs from the Prior Route-Flag Analysis

The OSINTRAI archive published a route-flag decomposition on 17 October 2026, and the separation holds on all four required axes. [source-11] The first axis is the flight information region: yesterday's analysis resolved 27 flags across five airports and four FIRs, led by a ZGZU cell over Macau and Hong Kong, while today's resolves 17 flags across two aerodromes and two FIRs. [source-1] [source-11] The second axis is the risk type: yesterday's flags were uniformly embedded thunderstorms with the EMBD qualifier, and today's set introduces a second hazard class, severe icing with the SEV qualifier, which appears on six of the ten Incheon routes and on no Shanghai route. [source-1] [source-11] The third axis is the route set: yesterday's decomposition was built on the HKG-MFM trunk and Pearl River Delta pairings, and today's is built on ICN-terminating routes from ten distinct origins including LHR, JFK, PVG, PEK, BKK, HKG, SIN, CTU, CAN and SZX. [source-1] [source-11] The fourth axis is the date basis, 18 October against 17 October, with different source timestamps at 15:06 against 09:06 Beijing time. [source-1] [source-11] By those four axes the analytical method is shared deliberately while the subject, the hazard mix and the geography are all different. [source-11]

Sources: [source-1] [source-11]

6. Conclusion and Outlook

The run's seventeen alerts reduce to two aerodromes, two FIR references and two distinct hazard types, and the distance from that reduction to the raw flag count is where most of the potential misreading lives. [source-1] Ten of the alerts name Incheon, six of those ten carry a severe icing entry alongside the embedded thunderstorm, and every reason in the set sits at 0 km from its reference field. [source-1] Both cells travel east and away from their aerodromes, which makes decay more likely than intensification on the evidence available at the run's timestamp. [source-1] The duplication of reason entries is uniform, so any consumer counting entries rather than hazard types will report roughly 34 hazards where 24 exist. [source-1] Against a denominator of 131 active international SIGMETs and 35 National Weather Service severe alerts, this is a contained operational picture rather than a systemic one. [source-1] The one honest gap is the failed geographic correlation step, which left four of sixty routes without that layer and dated the surviving data to 2 October. [source-6] The next scheduled run of the same chain will resolve whether the RKRR dual-hazard pairing persists, and the honest forecast from a single observation is that a two-hazard stack at a coastal hub in autumn is common enough to recur and rare enough to require this decomposition each time it does. [source-3]