LVNL Safety Criteria Reaction to SRC findings

1
LVNL Safety Criteria - Reaction to SRC findings -
2
Issue 1Risk allocation to Aircraft systems and
Aircraft Operations

• The philosophy is that LVNL is responsible for
  the design of its operations within the
  ATM-related risk budget
• This corresponds with JAR 25 aircraft systems
  related risk budget
• Risk allocations to the aircraft systems and
  aircraft operations domains, including ATM as a
  causal factor, should be organised on initiative
  of the national regulator

3
Issue 2Scope of TLS

• LVNL recalculated the TLS because the defined
  scope is different than as described by SRC
• Starts from the type of accident, rather than the
  cause
• To ensure robustness of the ATM operation,
  irrespective of the accident cause (ATC, pilots,
  aircraft systems)
• To recognise that most accidents are preceded by
  a chain of events (bow-tie principle)
• To recognise human operator errors due to poor
  system design or organisational shortcomings

Examples
4
Issue 3Derivation of TLS

• The scope of the LVNL TLS is
• ATM-related
• accidents (ICAO definition)
• Derivation based on national experience was not
  considered feasible because of insufficient data
• Analysis shows a reasonably consistent
  ATM-related accident risk rate for different
  world regions
• This rate is the basis for the LVNL TLS
• Transparency of ESARR 4 TLS

5
Issue 4Incorporation of traffic growth

• Objective is to ensure that the number of
  accidents per year does not increase
• It is recognised that only significant traffic
  growth affects the target safety level
• LVNL already incorporates an ambition factor in
  the TLS
• At the time of definition of the LVNL TLS,
  traffic growth was considered neither obvious nor
  reasonably accurately to predict
• Effect of traffic growth is incorporated through
  reviews

6
Issue 5Proportional distribution of ATM-related
risk

• Number of ATM-related accidents worldwide is not
  sufficient to derive a distribution that is
  statistically significant
• Alternatively a proportional distribution is
  assumed, corresponding to JAR 25
• Most critical ATM sub-products are assessed
  first.
• As a result proportional distribution rather
  leads to a conservative safety target

7
Issue 6ambition/negligible factors versus
ALARP principle

• LVNL recognised the need to define an ALARP
  region instead of a single TLS
• to allow application of Safety Management
  Principles
• to enable decision-making
• Practicability of ambition and negligible
  factors must be shown by experience

8
Converging approaches outside UDP
Sticking mike
No direct ATM contribution
9
Crossing of active runway
Erroneous crossing instruction
Direct ATM contribution
10
Crossing of active runway
Crossing without instruction
No direct ATM contribution
11
Oceanic track system
Deviation from oceanic track
No direct ATM contribution
12
Controlled flight into terrain
Excursion from assigned route in mountainous
terrain
No direct ATM contribution
13
Controlled flight into terrain
Incorrect QNH
Direct ATM contribution
14
Scope LVNL Safety Criteria
CFIT
UFIT
Collision
Outcome
Recovery
Detection
Occurrence
ATM event
Flight Ops event
A/c systems event
15
Scope ESARR 4
Collision
CFIT
UFIT
Outcome
Recovery
Detection
Occurrence
ATM event
Flight Ops event
A/c systems event