The Top Five Atm Safety Priorities

DEVELOPING STRATEGIES TO ADDRESS THE TOP FIVE

ATM SAFETY PRIORITIES

by Tzvetomir Blajev & Captain Ed Pooley

Executive Summary

Just over a year ago, the EUROCONTROL Safety Team tasked its Safety Improvement Sub Group (SISG), a consultative body, with defining the top five ATM Safety Priorities so that the development of safety improvement strategies could be appropriately focussed. Workshops were then used to develop comprehensive barrier models, used for identification of the priorities. This work identified the following priorities:

§  Operation without transponder or with a dysfunctional one.

§  Landing without ATC clearance.

§  Detection of an occupied runway.

§  Preventing “blind spot” in detecting closest aircraft conflict.

§  Detection of conflict between adjacent sector traffic.

The analysis of the first of these to be completed was the one for Landing without ATC clearance. This one will be used to demonstrate the methodology applied and the findings, conclusions and recommendations which resulted.

Defining the Top Five

In order to establish the top five ATM Safety Priorities for 2013, the EUROCONTROL Safety Team engaged the broad cross section of European ANSPs who are represented on the Safety Improvement Sub Group (SISG) with its mission. This Group began by defining eight priority risk areas and then looked for ones where reliable safety data was likely to be available and identified ‘Runway Incursion’ and ‘Loss of Separation En Route’ for detailed review. This review took place in mid-2012 in a series of Workshops in which six representative European ANSPs participated. Comprehensive barrier models termed Safety Function Maps (SAFMAPs) in this work were developed and populated with data on a range of high risk events for which thorough investigations had been carried out. This process generated the top five priorities:

§  Operation without transponder or with a dysfunctional one

§  Landing without ATC clearance

§  Detection of an occupied runway

§  Preventing “blind spot” in detecting closest aircraft conflict

§  Detection of conflict between adjacent sector traffic

These were endorsed by the Safety Team and a methodology for the evaluation of each one in respect of the opportunities for both their prevention and the mitigation of their consequences was devised based upon the barrier approach.

Developing the Strategies

A simplified presentation of the process is depicted in Figure 1 which shows the main inputs to the analysis. The process begins with the definition of generic operational scenarios so that the complexity of the subsequent analysis can be reduced. This is achieved by a combination of ‘top-down’ and ‘bottom up’ approaches. The former involves a systematic de-construction of each operational scenario into sub-scenarios which uses all the theoretically-possible combinations of source,

Figure 1 - An overview of the generic steps in each ‘Top Five’ Study

mechanism and outcome. The latter involves a review of the publicly-available information in reports of accidents and serious incidents independently investigated according to the provisions of ICAO Annex 13 together with confidentially-provided data in respect of incidents with less safety-significant outcomes.

Potentially effective barriers to prevent occurrence or safety-significant consequences from occurrence are then documented. It is important to note that the inclusion of barriers does not imply that they are relevant to all situations and neither does it imply that their adoption by aircraft operators or ANSPs as a group would necessarily be appropriate. It is also not seen as an absolute definition - it may be possible to identify potentially useful barriers that the work did not include.

In order to evaluate the potential significance of each barrier to prevention or mitigation, it was recognised that it would be essential to build in the range of operational contexts which could affect the extent to which particular barriers would function effectively.

The analysis then proceeds using a matrix of barriers against operational scenarios in which each ‘barrier-effectiveness’ cell is classified as in one of the following ‘traffic light’ categories:

§  Red - the barrier is either ineffective or is not intended to address a scenario

§  Yellow - the barrier has a limited general effectiveness for a scenario or is effective only under certain conditions

§  Green - the barrier is generally effective for the scenario

This process is applied separately to both prevention and mitigation barriers. An arbitrary relative weighting ratio of 3:1 is then applied to Green and Yellow barriers in order to examine the most potentially effective ones for prevention and for mitigation.

A validation exercise against actual events is then used to identify the barriers with the highest scores against their effectiveness had they been available and employed. Clearly this analysis is not of what actually happened but of the potential which barriers which were not active at the time might have had on the outcome in each case.

The findings of this validation exercise are then compared with any other relevant work already carried out on the same Safety Priority elsewhere and documented. From this it is possible to draw conclusions and from these to make Recommendations which can inform the various stakeholders’ safety strategies in respect if the Safety Priority examined.

The Process Applied

The Safety Priority taken as an illustrative example of the application on this process is Landing without Clearance (LwC)[1].

Analytical deconstruction of the Operational Scenarios associated with LwC identified five sources of the risk:

§  Absence of clearance overlooked by the pilot(s)

§  Loss of communication

§  Runway confusion

§  Communication ineffective

§  Deliberate action

It also led to the conclusion that there were no applicable scenario mechanisms and to the definition of three outcomes which could await a LwC:

§  Runway unoccupied and no other clearance for its use has been given

§  Runway unoccupied and another clearance for an aeroplane or vehicle to enter or cross it has been given

§  Runway occupied by:

-  a previously-landed aeroplane

-  an aeroplane on its take-off roll

-  an aeroplane which has rejected its take-off or is doing so

-  an aeroplane lined up for departure

-  a vehicle

This process led to the definition of 15 discrete Operational Scenarios based on the five sources (lettered A-E) and three outcomes (numbered 1-3). Analysis of a range of actual events involving LwC was able to populate all these categories whilst not discovering any events which did not fit comfortably into one of them.

The concept as an LwC event proceeds from its origin scenario towards “Providence” as a notional final barrier against a collision consequence, is illustrated in Figure 2.

Figure 2 The concept of barrier defences in LwC prevention and mitigation

Compiling comprehensive inventories of the potential barriers to the occurrence of LwC and the mitigation of consequences if it does occur led to the identification of 14 Prevention Barriers (PB) and 10 Mitigation Barriers (MB).

A review of those elements of operational context which were considered capable of constituting a significant influence on the effectiveness of at least some of the identified barriers to LwC in the case of both prevention and mitigation led to the selection of five as follows:

§  Extent of radar monitoring capability for pilot-flown approaches

§  Visibility and day/night

§  Runway operational status (active, inactive, closed)

§  Extent of flexibility in landing clearance issue

§  TWR visual surveillance capability (permanent or transient limitations)

Two spreadsheets showing the available barriers versus the 15 defined operational scenarios, one for the prevention case and the other for the mitigation case, were then populated. Each cell was then categorised for barrier effectiveness/ relevance using the ‘traffic light’ system and explanatory text. The cell categorisation without the text was then transferred to two simplified matrices which allowed the ready identification of both the barriers which addressed the most operational scenarios and the extent to which individual barriers addressed the various operational scenarios.

From the Prevention Barrier Matrix (Figure 3), applying the weighting ratio of 3:1 to the Green/Yellow cells shows that Barrier 5 (automatic, probably visual, alerting of pilots to the absence of a landing clearance[2]) and Barrier 9 (controller-activated, probably visual, alerting of pilots to the absence of a landing clearance) are the most effective. The ‘runners up’ are barrier 11 (system-supported controller awareness of a landing aircraft or of potential conflict for it) and barrier 10 (controller memory aid for issued/not issued landing clearances). The same matrix also shows that the operational scenarios D2 and D3 (which involve LwC on a runway for which there is a conflicting extant occupancy clearance or which is already occupied with or without a clearance because the pilot(s) have overlooked the absence of a landing clearance) are the most comprehensively addressed if all relevant barriers are in place. In this case, the ‘runners up’ are operational scenarios B2 and B3 (which correspond to D2 and D3 but with the origin being runway confusion).

PB1 / PB2 / PB3 / PB4 / PB5 / PB6 / PB7 / PB8 / PB9 / PB10 / PB11 / PB12 / PB13 / PB14
A1
A2
A3
B1
B2
B3
C1
C2
C3
D1
D2
D3
E1
E2
E3

Figure 3 - Prevention Barrier Matrix

From the Mitigation Barrier Matrix (Figure 4), applying the weighting ratio of 3:1 to the Green/Yellow cells shows that Barrier 2 (controller prevention of conflict as the result of a automatic alert with or without the prior issue of a conflicting clearance) is clearly the most widely effective with Barrier 4 (pilot/driver prevention of conflict as the result of the presentation of an automatic, probably visual, alert[3]). These two are closely followed in overall effectiveness by Barrier 3 (pilot/driver prevention of conflict as the result of monitoring radio traffic or due to visual lookout) and Barrier 5 (controller prevention of conflict as the result of visual detection). The same matrix also shows that the majority of the operational scenarios are addressed to a similar extent if all relevant barriers are in place and the more interesting identification here is therefore in respect of the few which are not very well addressed. These are scenarios B1, C1 and E1 which all involve mitigating the consequences of LwC on an unoccupied runway with no conflicting clearance issued due to various origins. These are followed by scenarios E2 and E3 (the actual or potential conflict cases for deliberate LwC) of which perhaps only the E2 case (deliberate LwC on a runway which is unoccupied but for which a conflicting clearance has been given) should be regarded as problematic.

MB1 / MB2 / MB3 / MB4 / MB5 / MB6 / MB7 / MB8 / MB9 / MB10
A1
A2
A3
B1
B2
B3
C1
C2
C3
D1
D2
D3
E1
E2
E3

Figure 4 - Mitigation Barrier Matrix

The final stage of the process for the LwC case was to validate the most widely applicable prevention and mitigation barriers against actual events and to identify as part of the same validation if the identified operational scenarios had effective coverage from the identified defensive barriers. This work enabled a full complement of findings based on the matrix analysis to be confirmed. Based on these findings, and support for them from previously completed work, most notably the major project at MITs Lincoln Laboratory to develop methods of directly and proactively alerting pilots to runway collision risks independently of ATC[4] a series of Conclusions could be drawn and Recommendations based upon them formulated.

The Recommendations of the LwC Study were as follows:

Recommendation 1 / Stakeholders should combine to sponsor Feasibility and Options studies to optimise LwC Prevention Barrier 9 - the provision of a controller selectable and probably visual alert to warn aircraft about to land without clearance of the absence of that clearance
Recommendation 2 / Stakeholders should monitor the implementation and effectiveness of the FAROS system in the USA to inform their safety improvement plans.
Recommendation 3 / ANSP Stakeholders should share industry best practice in the management of transfer of communication and the management of flight data displays.
Recommendation 4 / Stakeholders should monitor the implementation and effectiveness of RWSL installations to inform their safety improvement plans.
Recommendation 5 / Airport operations stakeholders should review Airside driver training to ensure that instruction is given on proactive safety procedures around active runways, which could include the sharing of past event examples.
Recommendation 6 / Aircraft Operators should consider how pilot procedures might be modified to enhance awareness of the acquisition or absence of a landing clearance and ensure that easy reversion to the previous frequency is possible if two way contact is not established following changeover to the frequency which will give the landing clearance.

7

[1] “Operational safety study: Landing without clearance”, EUROCONTROL, Edition 0.6, 19 September 2013.

[2] Such as the FAROS visual alert to aircraft approaching a runway to land which is occupied or about to become so

[3]

Such as the RWSL system of visual alerts to potential runway collision risks whilst on the ground

[4] Eggert, Howes, Kuffner, Wilhelmsen, and Bernays Operational Evaluation of Runway Status Lights. Lincoln Laboratory Journal (2006)