Top 5 ATM Operational Safety Priorities

1
Top 5 ATM Operational Safety Priorities

• Landing Without Clearance

BLAJEV Tzvetomir Operational Safety Coordinator,
EUROCONTROL
Captain Ed Pooley The Air Safety Consultancy
2
In Brief

• The process to determine the priorities - SAFMAPs
• What are the Top 5?
• Operational safety study example Landing without
  clearance

3
In Brief

• The process to determine the priorities - SAFMAPs
• What are the Top 5 ?
• Operational safety study example Landing without
  Clearance

4
How to prioritise

• Counting numbers versus understanding mechanisms
• Single point of view versus a common picture
• Learning from negative versus learning from both
  negative and positive

5
How did we get it?

• We studied two risk areas(1) Runway incursion
  (2) Loss of separation en-route
• Workshops with 6 ANSPS during Summer 2012
• Reviewing severity A and B incidents for 2011
• Mapping the incidents on SAFMAPs (Safety
  Functions Maps) 3 hierarchical levels were
  developed

6
SAFMAP Level 0 Runway Collision
Providence
UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT
Pilot/Driver RWY Conflict Resolution
UNRESOLVED BY ATC RUNWAY CONFLICT
ATC RWY Conflict Resolution
RUNWAY CONFLICT
Preventing incorrect RWY presence to turn into
RWY conflict
RUNWAY INCURSION
Preventing incorrect presence into RWY protected
area
7
SAFMAP Level 1
PROVIDENCE
UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT
Opportunity for physical collision avoidance
The conflict is detectable by the pilot / driver
The conflict is detected by the pilot/ driver
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and
collision is avoided
UNRESOLVED BY ATC RUNWAY CONFLICT
ATCO detects the conflict
Sufficient time and effective ATC decision
Adequate Communication
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and
collision is avoided
RUNWAY CONFLICT
Opportunity to prevent the conflict before or
with intended RWY use clearance
Crew/driver prevents conflict after detecting it
before or with intended RWY use clearance
ATCO prevents conflict after detecting it before
or with intended RWY use clearance
RUNWAY INCURSION
No incorrect presence of take-off aircraft
No incorrect presence of landing aircraft
No incorrect presence of person
ATC prevents incorrect presence
Pilot/driver detecting that RWY entry will be
incorrect
ATC prevents incorrect presence
Preventing ATC causing incorrect entry
Taxi pilot/driver adequate communication
No confusion that there is a clearance
Taxi pilot/driver adequate positional awareness
Correct vacation
8
Incident trajectories on the SAFMAP
PROVIDENCE
UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT
Opportunity for physical collision avoidance
The conflict is detectable by the pilot / driver
The conflict is detected by the pilot/ driver
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and
collision is avoided
UNRESOLVED BY ATC RUNWAY CONFLICT
ATCO detects the conflict
Sufficient time and effective ATC decision
Adequate Communication
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and
collision is avoided
RUNWAY CONFLICT
Opportunity to prevent the conflict before or
with intended RWY use clearance
Crew/driver prevents conflict after detecting it
before or with intended RWY use clearance
ATCO prevents conflict after detecting it before
or with intended RWY use clearance
RUNWAY INCURSION
No incorrect presence of take-off aircraft
No incorrect presence of landing aircraft
No incorrect presence of person
ATC prevents incorrect presence
Pilot/driver detecting that RWY entry will be
incorrect
ATC prevents incorrect presence
Preventing ATC causing incorrect entry
Taxi pilot/driver adequate communication
No confusion that there is a clearance
Taxi pilot/driver adequate positional awareness
Correct vacation
9
Incident trajectory example 1

• A vehicle entered RWY for maintenance work
  without clearance after confusion of the position
• ATCO detected the incorrect entry with the red
  stop bar crossing alarm at the time of issuing
  clearance for a take-off aircraft
• ATCO immediately cancel the take-off clearance

PROVIDENCE
UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT
Opportunity for physical collision avoidance
The conflict is detectable by the pilot / driver
The conflict is detected by the pilot/ driver
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and
collision is avoided
UNRESOLVED BY ATC RUNWAY CONFLICT
ATCO detects the conflict
Sufficient time and effective ATC decision
Adequate Communication
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and
collision is avoided
RUNWAY CONFLICT
Opportunity to prevent the conflict before or
with intended RWY use clearance
Crew/driver prevents conflict after detecting it
before or with intended RWY use clearance
ATCO prevents conflict after detecting it before
or with intended RWY use clearance
RUNWAY INCURSION
No incorrect presence of take-off aircraft
No incorrect presence of landing aircraft
No incorrect presence of person
ATC prevents incorrect presence
Pilot/driver detecting that RWY entry will be
incorrect
ATC prevents incorrect presence
Preventing ATC causing incorrect entry
Taxi pilot/driver adequate communication
No confusion that there is a clearance
Taxi pilot/driver adequate positional awareness
Correct vacation
10
Incident trajectory example 2
PROVIDENCE
UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT
Opportunity for physical collision avoidance
The conflict is detectable by the pilot / driver
The conflict is detected by the pilot/ driver
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and
collision is avoided
UNRESOLVED BY ATC RUNWAY CONFLICT
ATCO detects the conflict
Sufficient time and effective ATC decision
Adequate Communication
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and
collision is avoided

• During high workload, wet RWY, many Arrivals,
  more time than usual to vacate the RWY
• ATCO focussing on the one vacating the outer
  RWY, tired at the and of the day
• Clear an a/c to cross (after landing) after
  already given TOF clearance to another a/c
• No stop bars used - only for low visibility
  procedures
• After identifying the conflict ATCO instructed
  the crossing to expedite

RUNWAY CONFLICT
Opportunity to prevent the conflict before or
with intended RWY use clearance
Crew/driver prevents conflict after detecting it
before or with intended RWY use clearance
ATCO prevents conflict after detecting it before
or with intended RWY use clearance
RUNWAY INCURSION
No incorrect presence of take-off aircraft
No incorrect presence of landing aircraft
No incorrect presence of person
ATC prevents incorrect presence
Pilot/driver detecting that RWY entry will be
incorrect
ATC prevents incorrect presence
Preventing ATC causing incorrect entry
Taxi pilot/driver adequate communication
No confusion that there is a clearance
Taxi pilot/driver adequate positional awareness
Correct vacation
11
Incident trajectory example 3

• Landing aircraft mistuned frequency of the TWR
  and decided to follow the loss of communication
  landing procedure in VMC
• Take-off aircraft on the RWY already but no
  opportunity for take-off or for vacating the RWY
• The landing aircraft failed to see that RWY is
  occupied and landed on top of the a/c at the
  threshold

PROVIDENCE
UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT
Opportunity for physical collision avoidance
The conflict is detectable by the pilot / driver
The conflict is detected by the pilot/ driver
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and
collision is avoided
UNRESOLVED BY ATC RUNWAY CONFLICT
ATCO detects the conflict
Sufficient time and effective ATC decision
Adequate Communication
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and
collision is avoided
RUNWAY CONFLICT
Opportunity to prevent the conflict before or
with intended RWY use clearance
Crew/driver prevents conflict after detecting it
before or with intended RWY use clearance
ATCO prevents conflict after detecting it before
or with intended RWY use clearance
RUNWAY INCURSION
No incorrect presence of take-off aircraft
No incorrect presence of landing aircraft
No incorrect presence of person
ATC prevents incorrect presence
Pilot/driver detecting that RWY entry will be
incorrect
ATC prevents incorrect presence
Preventing ATC causing incorrect entry
Taxi pilot/driver adequate communication
No confusion that there is a clearance
Taxi pilot/driver adequate positional awareness
Correct vacation
12
In Brief

• The process to determine the priorities - SAFMAPs
• What are the Top 5?
• Operational safety study example Landing without
  clearance

13
Top 5 (1) Risk of operations without
transponder or with dysfunctional one

• A single threat often removing all the barriers
  up to see and avoid
• No ATC awareness
• No STCA
• No TCAS/ACAS.

14
Top 5 (2) Landing without clearance

• For numerous reasons, aircraft sometimes land
  without ATC clearance
• This results in runway incursions that are often
  only resolved through providence.

15
Top 5 (3) Detection of Occupied Runway

• Good share of the severe Runway Incursion
  incidents could have been prevented
• Need for the controllers to detect that the
  runway was occupied at the time of giving a
  clearance for the next aircraft to use it.

16
Top 5 (4) Blind Spot

• Conflict was not detected with the closest
  aircraft
• After descending clearance
• Rapidly developing situation often 1000ft and
  15 Nm between the conflicting a/c.

17
Top 5 (5) Conflict detection with adjacent
sectors

• Involve inadequate coordination of clearance
  with an adjacent sector
• These typically involve either an early
  (premature) transfer of control to or from the
  neighbouring sector.

18
In Brief

• The process to determine the priorities - SAFMAPs
• What are the Top 5 ?
• Operational safety study example Landing without
  clearance

19
Operational Safety Study

• Provide additional insights on causal/contributory
  factors
• Suggest actions to reduce or eliminate risk
  factors
• Identify industry best practice and lessons
  learned
• Inform development of SKYbrary material

20
The Generic Study Process
BARRIERS
SCENARIOS
CONCLUSIONS
ANALYSIS
OPERATIONALCONTEXT
21
The Generic Study Process
BARRIERS
SCENARIOS
CONCLUSIONS
ANALYSIS
OPERATIONALCONTEXT
22
Example Conflict Scenarios (1)Active RWY
LANDING WITHOUT CLEARANCE

1. Loss of communication
2. RWY confusion
3. Communication misunderstanding
4. Absence of clearance overlooked
5. Deliberate

2a
1
3d
3e
3b
3a
3c
2b

• Unoccupied RWY and no clearance given
• Unoccupied but a clearance has been given
• Occupied RWY

23
The Generic Study Process
BARRIERS
SCENARIOS
CONCLUSIONS
ANALYSIS
OPERATIONALCONTEXT
24
Barriers
25
Mitigation Barriers
PROVIDENCE
UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT
Opportunity for physical collision avoidance
The conflict is detectable by the pilot / driver
The conflict is detected by the pilot/ driver
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and
collision is avoided
UNRESOLVED BY ATC RUNWAY CONFLICT
ATCO detects the conflict
Sufficient time and effective ATC decision
Adequate Communication
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and
collision is avoided
RUNWAY CONFLICT
Opportunity to prevent the conflict before or
with intended RWY use clearance
Crew/driver prevents conflict after detecting it
before or with intended RWY use clearance
ATCO prevents conflict after detecting it before
or with intended RWY use clearance
RUNWAY INCURSION
26
The Generic Study Process
BARRIERS
SCENARIOS
CONCLUSIONS
ANALYSIS
OPERATIONALCONTEXT
27
Operational Context (1)

• Availability of radar guidance for the approach
• Meteorological conditions and time of the day
• Runway status
• Clearance conditions
• Visual surveillance capability from the Tower

28
The Generic Study Process
BARRIERS
SCENARIOS
CONCLUSIONS
ANALYSIS
OPERATIONALCONTEXT
29
OPERATIONAL SCENARIOS v BARRIER EFFECTIVENESS

• All Scenarios formulated are not equally
  prevalent! And
• All Prevention Barriers (PB) are not equal in
  their relevance to the various scenarios
• All Mitigation Barriers (MB) are not equal in
  their relevance to the various scenarios
• But In both cases there are some clear
  indications of best value-added in responding
  to the risk of LwC
• Assign each PB and each MB to the defined
  scenarios as fully effective, partially effective
  or ineffective/not intended to address traffic
  light system

Top 5 Safety Priorities
29
30
PREVENTION BARRIER MATRIX
  PB1 PB2 PB3 PB4 PB5 PB6 PB7 PB8 PB9 PB10 PB11 PB12 PB13 PB14
A1                            
A2                            
A3                            
B1                            
B2                             
B3                             
C1                            
C2                            
C3                            
D1                            
D2                            
D3                            
E1                            
E2                            
E3                            
31
MITIGATION BARRIER MATRIX
  MB1 MB2 MB3 MB4 MB5 MB6 MB7 MB8 MB9 MB10
A1                    
A2                    
A3                    
B1                    
B2                    
B3                    
C1                    
C2                    
C3                    
D1                    
D2                    
D3                    
E1                    
E2                    
E3                    
32
RANKING OF PREVENTION BARRIER EFFECTIVENESS

• Arbitrary weighting of Green Yellow at 31 (use
  of 21 would make little relative difference)
• Best Ranked Prevention Barriers (score range
  3-31)
• PB 5 an automated (probably visual), alerting of
  pilots to an occupied runway and thus the
  (probable) absence of a landing clearance
• PB9 a controller-activated (probably visual)
  alerting of pilots to the absence of a landing
  clearance.
• Best/Worst Coverage of Prevention Barriers by
  Scenario
• Best - D (pilot unaware)
• Intermediate - B (runway confusion) C (comms
  confusion) A (loss of comms)
• Worst - E (deliberate act)

Top 5 Safety Priorities
32
33
RANKING OF MITIGATION BARRIER EFFECTIVENESS

• Same Arbitrary weighting of Green Yellow at 31
  (again use of 21 would make little relative
  difference)
• Best Ranked Mitigation Barriers (score range
  20-33 plus one outlier at 3)
• MB 2 - controller intervention prompted by an
  automatic alert with or without prior issue of a
  conflicting clearance.
• MB 4 - pilot/driver action prompted by an
  automatic (probably visual) alert.
• MB3 pilot/driver action promoted by proactive
  monitoring of traffic visually or on the radio
• Best/Worst Coverage of Mitigation Barriers by
  Scenario
• Best - B (runway confusion)
• Intermediate - A (loss of comms) C (comms
  confusion) D (unaware)
• Worst - E (deliberate act)

Top 5 Safety Priorities
33
34
VALIDATION OF BARRIER EFFECTIVENESS

• Identifies the barriers that could have prevented
  or mitigated an actual event had they been
• Available and Used
• Is not an analysis of what actually happened
  since the test events were not prevented.

35
SCENARIO A (LOSS OF COMMS)

• Non-precision approach by private business flight
  by aircraft owner. Mistuned TWR in IMC and when
  no contact possible assumed radio failure and did
  not revert to APP. Broke cloud at 1.5nm and
  continued land over a Q400 lined up for departure
  at the threshold without seeing it.
• Three effective Prevention Barriers
• PB4, PB5, PB9
• These include the top two ranked barriers
• Two effective Mitigation Barriers
• MB2, MB4
• These include two of the three top ranked barriers

35
Top 5 Safety Priorities
36
SCENARIO B (RUNWAY CONFUSION)

• Two parallel runways, one closed long term for
  nearly- completed reconstruction. In VMC, ATC
  approved an inbound CRJ crew request to land in
  the reciprocal direction to that in use. The
  aircraft was then landed on the closed runway
  without encountering obstacles - ATC only noticed
  as the aircraft was about to touch down. The crew
  said they were used to programming the FMS for
  the runway they actually used and failed to
  appreciate or correct their error even when
  flying a visual approach.
• Seven effective Prevention Barriers
• PB5, PB6, PB7, PB8, PB9, PB11, PB13
• These include the top two ranked barriers
• Two effective Mitigation Barriers
• MB3, MB8
• These include the one of the top three ranked
  barriers

36
Top 5 Safety Priorities
37
SCENARIO C (COMMS CONFUSION)

• ATC instructed pilot to continue approach to
  which the pilot readback was continue. ATC made
  no further attempt to communicate to the aircraft
  and it was landed in the belief that clearance
  had been given.
• Five effective Prevention Barriers
• PB5, PB9, PB10, PB11, PB12
• These include the top two ranked barriers
• Six effective Mitigation Barriers
• MB2, MB3, MB4, MB5, MB6, MB8
• These include the top three ranked barriers

37
Top 5 Safety Priorities
38
SCENARIO D (PILOT UNAWARE)

• On initial contact with TWR, the aircraft was
  instructed to continue advised to expect to be
  called back. After landing without clearance in
  the belief that it had been received, the pilot,
  who was familiar with the airport involved,
  observed that landing clearance there was usually
  given a long way out and the absence of the
  promised call back with clearance was easily
  missed.
• Nine effective Prevention Barriers
• PB1, PB2, PB3, PB5, PB9, PB10, PB11, PB12, PB14
• These include the top two ranked barriers
• Nine effective Mitigation Barriers
• MB1, MB2, MB3, MB4, MB5, MB6, MB7, MB8, MB10
• These include the top three ranked barriers

38
Top 5 Safety Priorities
39
SCENARIO E (DELIBERATE ACT)

• An en-route light aircraft lost positional
  awareness in VMC and, unequipped with GPS, saw
  what was considered to be a convenient airport,
  and made a downwind join in the opposite circuit
  direction to that in use and continued onto
  finals and landed without radio contact. TWR saw
  the aeroplane when it was downwind and instructed
  another aircraft approaching from the opposite
  in-use direction to make a go around.
• Two effective Prevention Barriers
• PB5, PB9
• These are the top two ranked barriers
• Effective Mitigation Barriers
• MB1, MB2, MB3, MB4, MB5, MB6, MB7, MB8, MB10
• These include the top three ranked barriers

39
Top 5 Safety Priorities
40
The Generic Study Process
BARRIERS
SCENARIOS
CONCLUSIONS
ANALYSIS
OPERATIONALCONTEXT
41
SOME CONCLUSIONS (1)

• The study has identified the best performing
  potential prevention and mitigation barriers.
  Some barriers are likely to be more cost
  effective than others.
• Other studies referenced in the Paper are
  supportive of these findings but also advocate
  looking at barriers which would directly reduce
  the prevalence of pilots not being on the TWR
  frequency as the landing runway is approached.
• Combinations of the most effective barriers are
  likely to make an impressive impact on LwC
  prevalence and mitigation.

42
SOME CONCLUSIONS (2)

• The top two ranked Prevention Barriers, PB5 and
  PB9, were applicable in all five scenario
  examples.
• The top three ranked Mitigation Barriers, MB2,
  MB3, MB4 were all applicable in Scenarios C
  (Comms confusion), D (Pilot unaware) and E
  (Deliberate Act) and at least one was applicable
  in the other two scenarios - A (Loss of Comms)
  and B (runway confusion.
• An outstanding PB5 solution, FAROS as currently
  being deployed in the USA, was estimated prior to
  this implementation as likely to prevent 65 of
  runway conflicts some of which are LwC!

Top 5 Safety Priorities
42
43
Questions?