NM Top 5 Safety Priorities
Safety Functions Map Analysis
of European A and B severity safety incidents
(Data sample 2014)
1.
OVERVIEW
The main purpose of this report is to document the process and the results from the Safety
Functions Maps analysis of European A and B severity incidents performed within the context
of Network Manager Safety Prioritisation Process during 2015.
The document structure is as follows:
 Section 2 describes the incident sample used for the analysis.
 Section 3 outlines the analytical process used.
 Section 4 provides the findings from the sample analysis and conclusions
 Section 5 provides a summary of SAFMAP analysis of the individual losses of separation enroute incidents.
 Section 6 provides a summary of SAFMAP analysis of the individual runway incursion
incidents.
Based on the conclusions of the analysis it is suggested:
 To retain “Blind spot” as a safety priority.
 Not to retain the “Conflict detection with adjacent sector” as a safety priority but the risk
associated with it to be to be closely monitored for the next reference period.
 To select “ACAS RA not followed” a safety priority.
 To retain “Operation without a transponder or with a dysfunctional one” as a safety
priority.
 To retain “Controller detection of potential runway conflict” as a safety priority.
 Not to retain “Landing without clearance” as a safety priority but the risk associated with it
to be to be closely monitored for the next reference period.
 To select “Sudden, high energy runway conflict” as a safety priority.
Page 1
2.
INCIDENT SAMPLE
The SAFMAP review sample is judged to be representative for the purpose of identifying Top 5
priorities for the Network Manager based on two arguments:
 Geographical representativeness.
 Sample to population representativeness.
2.1. Geographical representativeness of the sample
The SAFMAP review of incidents involved 14 Air Navigation Service Providers: ANS, BULATSA,
ENAIRE, ENAV, DFS, DSNA, Finavia, MUAC, NATS, NUAC, PANSA, NAV Portugal, ROMATSA,
Skyguide – Figure 1.
Geographical representativeness
Participation
of 14 ANSPs
Figure 1
It can be concluded that the analysed sample of incidents is sufficiently representative for the
overall population incidents in Europe.
2.2. Sample to population representativeness
The analysed sample covered the two selected by SISG and Safety Team risk areas: Runway
Incursion and Separation Minima infringement En-route. Other risk areas with ATC influence
on the risk like Separation minima infringement TMA, CFIT, collision on the ground etc. are not
part of the prioritisation process for the moment. In total, during the workshops, 152
incidents, classified as A or B severity, were analysed:
 Sample of separation minima infringements for the en-route phase of flight:
o
The analysed sample includes 95 separation minima infringements for en-route
phase of flight of which 7 classified as severity A and 88 classified as severity B
Page 2
o
EUROCONTROL Annual Summary Template (AST) data for 2014 shows that 264
separation minima infringements for all flight phases were reported. Twenty one
(21) incidents were classified as severity A and 243 incidents were severity B.
o
The 2014 EUROCONTROL AST data shows that 80 separation minima infringements
occurred in the en-route phase of flight. Of these, 8 incidents were classified as
severity A and 72 incidents as severity B.
o
It can be deduced that the analysed sample contains a very significant share from all
en-route phase of flight separation minima infringements.
o
The analysed with SAFMAPs sample of en-route phase of flight separation minima
infringements constitutes 37% from the reported all flight phases separation minima
infringements.
o
It can be concluded that the analysed sample of en-route phase of flight separation
minima infringements is sufficiently representative for the overall population of enroute phase of flight separation minima infringements in Europe.
 Sample of runway incursions – Figure 2:
o
The analysed sample includes 57 runway incursion incidents of which 13 were
classified as severity A and 44 classified as severity B.
o
The 2014 EUROCONTROL AST data shows 101 there were 101 runway incursion
incidents. Of these, 25 were classified as severity A and 76 incidents as severity B.
o
The analysed with SAFMAPs sample of runway incursions constitutes 56% from all
reported runway incursion incidents. The shares in the sample and the population of
severity A and severity B incidents are identical.
o
It can be concluded that the analysed sample of runway incursion incidents is
sufficiently representative for the overall population of runway incursion incidents in
Europe.
Sample to population representativeness
ALL PHASES ‘A’ AND ‘B’ SEPARATION
MINUMA INFRINGEMENTS
ALL ‘A’ AND ‘B’
RUNWAY INCURSIONS
101
ANALYSED
EN-ROUTE
INCIDENTS
ANALYSED
RUNWAY
INCURSIONS
Figure 2
Page 3
264
3.
THE SAFMAP ANALYSIS PROCESS
The Safety Functions Maps are barrier models that describe the available barriers in the
aviation system to prevent accidents. The functions used are generic, for example the function
“Pilot/driver detecting that RWY protected area entry will be incorrect” does not specify the
actual means to implement this function – stop-bars, runway guard lights or runway entry
lights. Some of the functions are implanted by procedures, some by technical systems and
some by a combination of them.
It was decided as a principle for constructing the SAFMAPs to include all available and ‘used by
someone’ in the industry barriers. This turns SAFMAPS into a knowledge repository of best
practices that are not necessarily required by regulations. An example is the use of Short-term
conflict probes, ASMGCS functions or Runway Status Lights.
SAFMAPs are hierarchical structures where each high-level function can be further split into
several lower level ones. The top level function is called a Basic safety function that is split in
several Level 0 safety functions. In the same manner each of the Level 0 safety functions are
further split into several Level 1 safety functions. Currently, SAFMAPs are decomposed to Level
3 safety functions. Not all the safety functions are decomposed to the same depth. The depth
depends on the need for it. By this a function is decomposed only if there were several
incidents that illustrate the different ways one function can be implemented and challenged.
The basic barriers are structured sequentially in terms of a functional architecture. Here is an
illustration of the basic barriers used in the Separation minima infringement en-route SAFMAP:
PROVIDENCE
POTENIAL COLISION UNRESOLVED BY PILOT
PILOT COLLISION AVOIDANCE - VISIUAL
POTENIAL COLISION UNRESOLVED BY ACAS
PILOT COLLISION AVOIDANCE - ACAS
POTENTIAL COLISION UNRESOLVED BY ATC
ATC COLLISON AVOIDANCE
LOSS OF SEPARATION
ATC TACTICAL SEPARATION ASSURANCE
POTENTIAL AIRBORNE (TACTICAL) CONFLICT
PREVENTING TACTICAL CONFLICT
Figure 3
Page 4
The following examples are provided as a mean for illustration of the structure of the
Separation minima infringement en-route SAFMAP:
 There are 6 Basic Safety Functions – an example is “ATC Tactical Separation Assurance”.
 “Preventing conflict generated by the ATC” is an example of a Level 0 Safety Function.
 “Preventing a potentially conflicting aircraft to be overlooked when clearing or
instructing another one” is an example of a Level 1 Safety Function
 “Blind spot: Preventing a potentially conflicting aircraft to be overlooked after an
instruction to meet constraints” is an example of a Level 2 Safety Function
The version of SAFMAPs used for the analysis is denoted as SAFMAP 2015 and are:
 “SAFMAP RWYC 2015” – runway collisions SAFMAP for analysing the runway incursion
incidents. This SAFMAP has 6 basic safety functions, 35 Level 0 safety functions, 120 Level
1 safety functions and 35 Level 2&3 safety functions.
 “SAFMAP MACER 2015” – mid-air collision en-route SAFMAP for analysing the losses of
separation en-route incidents. This SAFMAP has 5 basic safety functions, 25 Level 0 safety
functions, 69 Level 1 safety functions and 69 Level 2&3 safety functions.
When an incident is reviewed with the help of SAFMAP there is an attempt to identify all the
relevant safety functions. The process is not restricted only to identifying those functions that
fail (negative) but also those that worked and provided resilience (positive): thus this process is
in line with the emerging Safety II philosophy. The following qualifications for a function are
possible:
 Available but not challenged.
 Challenged and failed.
 Challenged and worked.
 Not challenged but not available.
 Not applicable for the scenario.
In this way each of the incidents are described in terms of a qualified sequence of safety
functions – failed, worked, not challenged or not applicable. This creates a very elaborate
description of what happened, of the particular scenario – i.e. what was observable. These can
be called descriptive factors - the description does not go into an elaboration of why things
happened. Or in other words – what were the explanatory factors.
It is to be noted that sometimes there is insufficient information available in the investigation
report or provided during the workshop discussions to systematically qualify all the safety
functions and therefore the information for some of them is either missing or a function is
qualified without any contextual information.
Page 5
4.
FINDINGS AND CONCLUSIONS
4.1. Findings and conclusions - separation minima infringements for the enroute phase of flight
How many times a barrier failed and worked?
Separation minima infringement en-route
PROVIDENCE
2
PILOT COLLISION
AVOIDANCE VISUAL
12
PILOT COLLISION
AVOIDANCE ACAS
ATC COLLISION
AVOIDANCE
41
55
3
44
ATC SEPARATION
ASSURANCE
95
PREVENTING
TACTICAL CONFLICT
95
WORKED OR NOT NEEDED
FAILED
Figure 4
 Performance of the Basic Barrier “Preventing tactical conflict”
o
In 30 incidents (32% of the sample) the conflict was generated by “Blind spot” - ATCO
overlooking a potentially conflicting proximate aircraft when clearing or instructing
another one.
o
In 13 of the incidents (14% of the sample) the conflict was generated by inefficient
inter sector or inter centre coordination.
o
In 10 of the incidents (10%) the conflict was generated by an inadequate ATCO
controlling technique. This involves avoiding misjudgement of horizontal, vertical,
speed, vertical speed or all the aspects of the situation. Often the misjudgement
involves the vertical speed or wrong projection of the future aircraft positions.
o
In 8 of the incidents (8%) the conflict was generated by an altitude deviation.
o
In 8 of the incidents (8%) the conflict was generated by a pre-tactical conflict not
prevented by the ATC tactical planning. These events represent the conflicts inherent
in the flight planned trajectories.
o
In 7 of the incidents (7%) the conflict was generated by military activity. For all of
these incidents the ATC separation assurance and collision avoidance barriers were
inefficient. Typically the scenarios developed rapidly and for some there were no
Page 6
available means for the civil ATCO to detect. For 6 of those events, the ACAS basic
barrier was challenged and worked, and for one it was not challenged.
o
In 6 of the incidents (6%) the conflict was generated by inadequate air-ground
communications. Four conflicts involved incorrect understanding of the call sign and
2 an incorrect understanding of the communications message. Additionally, in 2 of
the altitude deviation incidents the inadequate communication of the level
information triggered the deviation.
o
In 4 of the incidents the conflict was generated by a vertical speed deviation.
o
In 4 of the incidents the conflict was generated by the executive controller plan of
work. These typically involve not knowing or recalling from memory of the critical
aspects for work (e.g. separation and spacing standards).
o
In 2 of the incidents the conflict was generated by ATCO execution. Both cases
involved a ‘slip of the tongue’.
o
In one of the incidents the conflict was generated by ATCO overlooking an aircraft
while clearing or instructing another, not proximate, one.
o
In one of the incidents the conflict was generated by an Airspace Infringement.
o
In one of the incidents the conflict was generated by lateral deviation.
Separation infringement - the scenario trigger
2 ATCO
execution
1 Overlooked 1 Airspace
aircraft
infringement
4 executive plan
of work
1 Lateral
deviation
4 vertical speed
deviation
30 Blind Spot
6 Air-ground
communication
7 military
activity
13 Sector coordination
8 pre-tactical
conflicts
8 altitude
deviation
10 ATCO controlling
technique
Figure 5
 Performance of the Basic barrier “ATC Separation assurance”:
o
In 6 of the incidents, the conflict was not detectable.
o
In 37 of the incidents the conflict was detectable but was not detected in time for
the separation assurance to be effective.
o
13 of the incidents involved a concurrency of the ACAS RA, triggering before or with
the separation infringement.
Page 7
o
In 8 of the incidents, the conflict was detected but the separation assurance
technique was inadequate. This involves mainly insufficient vectoring.
o
In one incident, the communication was not available in order for the separation
assurance to be effective.
o
In 5 of the incidents, the communication function was available but the
communication was inadequate.
o
In 5 of the incidents, the (sufficiently) available time for resolution was exceeded.
o
In 8 of the incidents, the situation developed rapidly and there was insufficient time
for resolution before the separation infringement.
o
In 8 of the incidents, the conflict was detected but the conflict resolution plan was
inadequate.
o
In 4 of the incidents, the conflict was detected on time and a resolution action was
correctly communicated but the flight crew did not act in time in order to prevent
the separation minima infringement.
 Performance of the Basic barrier “ATC Collision avoidance:
o
The barrier worked 32 times and failed 44 times.
o
In 19 of the incidents, there was no need for collision avoidance but there were no
other functional barriers prior to it – for example in the case of diverging trajectories
after a separation infringement.
o
It should be noted that the distinction between ATC separation assurance action and
ATC collision avoidance action is sometimes blurred.
o
A failed separation assurance action that started late due to late detection of the
conflict or that was not sufficient for preventing the separation infringement was in
many of the cases sufficiently effective for collision avoidance.
o
24 of the incidents involved a concurrency of the ACAS RA, triggering before the ATC
collision avoidance.
o
In 5 of the incidents, the separation infringement was undetectable.
o
In 5 of the incidents, the infringement was detectable but ATCO did not to detect it
on time.
o
In one incident, the communication function was unavailable in order for the ATC
collision avoidance to be effective.
o
In 6 of the incidents, the collision avoidance plan of ATCO was inadequate.
o
In 2 of the incidents the available time for collision avoidance was exceeded.
o
In one of the incidents, the separation infringement was detected on time and a
collision avoidance action was correctly communicated but flight crew did not act in
time.
Page 8
 Performance of the Basic Barrier “Pilot collision avoidance - ACAS”:
o
The barrier was challenged and worked properly 32 times and failed 3 times.
o
In 8 of the incidents there was no need for ACAS RA as the CPA distance was higher
than the ACAS trigger.
 Performance of the Basic Barrier “Visual collision avoidance”
o
The barrier was challenged 3 times, worked properly in one of the incidents and
failed 2 times.
 Performance of the Basic Barrier “Providence”
o
The barrier was challenged and worked 2 times. Both events involved ACAS RA not
followed.
Does the incident scenario make a difference?
PROVIDENCE
Reported
additionally to the
study sample
PILOT COLLISION AVOIDANCE - VISUAL
PILOT COLLISION AVOIDANCE - ACAS
11
19
ATC COLLISON AVOIDANCE
ATC TACTICAL SEPARATION ASSURANCE
PREVENTING TACTICAL CONFLICT
BLIND
SPOT
SECTOR
COORDINATION
ACAS RA NOT
FOLLOWED
TRANSPONDER
FAILURE
Figure 6
 “Blind spot” review – Figure 6:
o
The analysed sample contains 30 blind spot incidents. This represents around 32% of
the sample.
o
15 of the incidents happened during descent
o
14 of the incidents were after an instruction to meet constraints such as sector exit
levels and destination descent.
o
10 of the incident were after a ‘rushed’ vertical clearance following a pilot request.
o
4 of the incidents were after a clearance not following the horizontal flight plan
route, including direct routings and weather avoidance.
o
2 of the incidents were after a conflict resolution instruction to solve another
potential conflict and not detecting the resultant one.
Page 9
o
3 of the blind spot incidents were classified as severity A of which one was also a
sector coordination issue.
o
The ACAS collision avoidance basic barrier was challenged and worked properly in 11
of the incidents. Seven of those were after an instruction to meet constraints.
o
The ATC collision avoidance basic barrier was challenged in 30 of the incidents. Thee
barrier failed 11 and worked properly on 16 occasions. In 3 of the incidents the ATC
collision avoidance barrier was not challenged but there were no other functional
barriers prior to it – for example in the case of diverging trajectories after a
separation infringement.
o
The Separation assurance basic barrier failed mainly because of the intrinsic timecriticality of the blind spot scenarios. These incidents, typically involving horizontally
proximate aircraft, vertically separated by 1000ft, develop very rapidly and leave
little opportunity to prevent the separation minima infringement. In this way 16 of
the incidents involved insufficient time for detection and action or concurrency of
the ACAS RA, triggering before or with the separation infringement.
o
A small proportion of 9 incidents offered some possibility for preventing the
separation minima infringement, but ATCO controlling techniques, prompt crew
reaction to instructions or air-ground communications misunderstandings obstructed
the efficient separation assurance action.
o
It can be concluded that blind spot incidents represents the largest single scenario
both in the sample and in the severity A subset of it that typically develops rapidly,
provides little opportunity for separation assurance and is mitigated mainly by the
ACAS collision avoidance barrier. It is suggested blind spot to be retained as one of
the top safety priorities.
 “Sector coordination” review – Figure 6:
o
The analysed sample contains 14 incidents in which inter sector or inter centre
coordination triggered the scenario. This represents around 14% of the analysed
sample.
o
4 of the coordination involved incidents are also blind spot events, where the
conflicting overlooked aircraft is either in another sector’s airspace or has already
been to, and is under the control of, the adjacent sector.
o
One incident is classified as severity A.
o
7 of the incidents were after no identification for the need of coordination.
o
4 of the incidents were after the ATCO incorrectly followed the letters of agreement
and coordination procedures with the adjacent sector.
o
One incident was after an incorrect execution of a correct coordination.
o
One incident was after an incorrect coordination with the adjacent sector that when
implemented created a conflict.
Page 10
o
The ACAS collision avoidance basic barrier was challenged and worked properly in 3
of the incidents.
o
For one incident, classified as severity A, there was no information about the ACAS.
o
The ATC collision avoidance basic barrier was challenged in 10 of the incidents. The
barrier failed 4 times and worked properly on 6 occasions. In 4 of the incidents the
ATC collision avoidance barrier was not challenged but there were no other
functional barriers prior to it – for example in the case of diverging trajectories after
a separation infringement.
o
The separation assurance basic barrier was challenged and failed 6 times because the
ATCO did not detect the conflict in time, 4 times because of inadequate separation
assurance plan, once because the available time for execution was exceeded by a
delayed action, once after call sign confusion and twice because of the concurrency
of the ACAS RA triggering before or with the separation infringement.
o
It can be concluded that inefficient inter sector or inter centre coordination
represent a recognisable share of the sample size with one third of them also
involving a blind spot when the conflicting overlooked aircraft is either in another
sector’s airspace or has already been transferred to, and is under the control of, the
adjacent sector. It can be argued that addressing the blind spot safety priority will
also partially address the sector coordination issues.
 ACAS RA not followed – Figure 6:
o
2 of the 7 incidents classified as severity A involved ACAS RA not properly followed.
o
Additionally in another event classified as severity B, an aircraft misinterpreted the
RA to maintain the level and climbed through the cleared flight level.
o
The information for this analysis comes from the investigation processes of ANSPs
and there is very little overview there of the contributory factors, reasons and
scenarios explaining the ACAS RA non-compliance. In one of the cases from the
downlinked log it was deduced that one of the flight crews did not follow the descent
RA. It is not clear if RA reverse was available and needed. In the worst case this
barrier is considered as failed.
o
It is judged the risk associated with ACAS RA not followed to be extremely high. The
only 2 events in the sample which were resolved by providence involved flight crew
not following the ACAS RA.
o
It is suggested ACAS RA not followed to be selected as a safety priority.
 Operation without a transponder or with a dysfunctional one – Figure 6:
o
There was one incident in the sample of operations without a transponder. The
incident involved a general aviation aircraft that entered a controlled zone in conflict
with an aircraft on final approach. It was classified as a severity A incident and the
resolution was provided by the basic barrier, visual collision avoidance.
o
Additionally, outside of the sample, a few more incidents were reported.
Page 11
o
In one incident a complete transponder failure happened in an ACC sector and went
unnoticed by ATC and flight crew. The flight continued without a transponder,
identification and control through another ACC sector, a TMA sector before it was
finally identified in a second TMA sector. All the sectors involved had correct flight
information but the absence of the flight was not detected. The ACC sectors used
only secondary radar information for surveillance. After reaching the top of descent
the flight crew, still on the frequency of the first ACC sector, made several attempts
to contact ATC on different frequencies until finally establishing contact on the
emergency frequency. The flight was detected using TMA primary radar and was
informed of the absence of the secondary radar information; the flight crew then
switched on the second transponder box. The Flight crew reported that they had had
no indication of the transponder failure.
o
In another incident, a transponder failed in one ACC sector and went unnoticed by
flight crew and ATC. The flight continued without transponder, identification and
control through another ACC sector, entered a third ACC sector and was identified as
primary track there. The first two ACC sectors used only secondary radar
information for surveillance. There was a mismatch between the flight data
information in the third ACC sector and the actual flight level of the flight. The flight
was still not on the frequency of the sector as it was incorrectly and with delay after
the sector boundary, transferred to another sector. The primary target was in
conflict with another crossing aircraft at the same flight level. Traffic information
was correctly provided to this aircraft but the flight crew misjudged the vertical
position of the conflicting (non SSR) aircraft and did not initiate any avoiding action.
o
It can be concluded that the transponder failure incidents are difficult to detect by
both ATC and flight crews, leading to a lack of effective positive air traffic control,
and resolution provided by the basic barrier -providence. It is suggested to retain the
“Operation without a transponder or with a dysfunctional one” as safety priority.
 Severity A incidents review:
o
Seven incidents were classified as severity A in the sample:
o
3 incidents involved ATCO not preventing a potentially conflicting aircraft to be
overlooked when clearing or instructing another one – blind spot.
o
2 incidents involved flight crew not following or manoeuvring in the opposite
direction of an ACAS RA.
o
One incident involved an operation without functional transponder.
o
One incident involved air-ground communication misunderstanding.
Page 12
4.2. Findings and conclusions – runway incursions
How many times a barrier failed and worked?
Runway Incursion
PROVIDENCE
3
PILOT / DRIVER
RUNWAY COLLISION
AVOIDANCE
28
ATC RUNWAY
COLLISION
AVOIDANCE
14
ATC PREVENTING
RUNWAY
CONFLICT
PREVENTING
RUNWAY
INCURSION
3
31
11
45
1
56
WORKED OR NOT NEEDED
FAILED
Figure 7
 Performance of the Basic Barrier “Preventing runway incursions” – Figure 8:
o
In 21 incidents (36% of the sample) the runway incursion was generated by taxiing
mobile incorrectly entering the RWY protected area:

In 8 of the incidents, the inadequate air-ground communication of the taxi
route and runway entry clearance contributed to the taxiing mobile
incorrectly entering the RWY protected area. Typically, these involve
misunderstanding clearance to hold short or misunderstanding conditional
clearances.

In 7 of the incidents, the crew/driver failed to identify that there was a lack
of runway entry clearance. Typically, the clearance to taxi and hold short is
given at some time before the tacking mobile reaches the holding point and
at the time it reaches it there is an omission to stop. Usually the read-back
only contains the taxi instruction without reading back the hold short
instruction.

In 4 of the incidents, the crew/driver was confused about their position.

In 3 of the incidents, the crew/driver followed incorrectly the clearance after
a correct read-back.
o
In 8 incidents the runway incursion was generated by ATC not providing a correct
and timely landing clearance. Typically, these incidents involve clearing an aircraft to
land on an occupied runway.
o
In 8 incidents (14% of the sample), the runway incursion was generated by ATC
causing incorrect entry of taxiing mobile.
Page 13

In 6 of the incidents, the lack of adequate ATC traffic awareness contributed
to ATC causing incorrect entry of taxiing aircraft or vehicle. An example is
ATCO not being aware of the exact position of the mobile when clearing it to
cross the runway. In one event (RWY Incursion 45) ATCO identified the
incorrect clearance, intervened on time and prevented the runway incursion,
but the event was still classified as severity B incident.

In one incident, the lack of adequate ATC coordination contributed to ATC
causing the incorrect entry of a taxiing aircraft or vehicle.

In one incident, the ATCO’s traffic plan contributed to ATC causing incorrect
entry of a taxiing aircraft or vehicle.
o
In 7 incidents the runway incursion was generated by a landing without clearance.
o
In 4 incidents the runway incursion was generated by incorrect presence of vacating
aircraft.
o
In 4 of the incidents the ATCO did not ensure sufficient spacing between landing
aircraft or between landing and departing aircraft.
o
In 3 of the incidents the ATCO provided a conflicting take-off clearance without
ensuring that the runway was not going to be occupied during the take-off.
o
In one incident air-ground communication contributed to the incorrect presence of a
taking-off aircraft.
Runway incursion - the scenario trigger
4 incorrect
presence of
vacating aircraft
3 conflicting
take-off
clearance
1 incorrect take off
after air-ground
communication
22 Taxiing mobile
incorrectly
entering
4 insufficient
spacing
7 landing
without
clearance
8* ATC causing an
incorrect entry of
taxing mobile
* 1 event was a prevented
runway incursion
8 ATC not providing
correct and timely
landing clearance
Figure 8
 Performance of the Basic Barrier “Preventing runway conflict”
o
The barrier was challenged 49 times, worked 4 times, failed 45 times and 7 times the
preceding barriers failed but there was no conflict and the conflict prevention barrier
was not needed.
o
In 35 incidents there was no opportunity for conflict prevention as the clearance to
use the runway had already been given.
Page 14
o
In 9 incidents ATCO and pilot/driver did not identify the potential conflict and
prevent it in time. These cases typically involve lack of visual line of sight or system
support for identification of potential conflicts.
o
In 2 of the incidents the ATCO identified the potential conflict after a crew/vehicle
driver prompt and intervened on time to prevent the conflict.
o
In one incident the ATCO identified the potential conflict with the help of system
support and intervened in time to prevent the conflict.
o
In one incident the flight crew of the landing aircraft identified the potential conflict
and executed a go-around before the actual conflict.
o
In one incident there was no opportunity for conflict prevention as the frequency
was blocked; the taking-off aircraft was not in sight with the landing aircraft and the
landing one manoeuvred to go-around with the available aircraft energy.
o
It is observed that the success rate of the barrier is very low – it worked 4 out of 49
times it was challenged. It is not known what the elasticity of the barrier
performance to investment is. The risk reduction potential may be higher with the
other basic barriers – for example strengthening the runway incursion prevention
with conformity monitoring safety functions or crew collision avoidance with pilotinterpreted safety nets.
o
It is suggested controller detection of potential runway conflict to be retained as a
safety priority.
 Performance of the Basic Barrier “ATC Runway Collision avoidance”
o
The barrier was challenged 38 times, failed 31 times, worked 7 times and 7 times the
preceding barriers failed but there was no need for collision avoidance. An example
is vehicle in the protected area during landing but not on the runway.
o
In 21 incidents the ATCO did not detect the conflict in time, either visually or with
system support, in order to enable the collision avoidance.
o
In 9 incidents the ATCO provided collision avoidance instructions after detecting the
conflict with the help of:

In 4 incidents - radar.

In 1 incident - visually.

In 2 incidents - ASMGCS alert.

In 2 incidents - pilot/driver prompted ATCO to detect.
o
In 2 of the incidents where ATC detected the conflict and provided collision
avoidance instructions, the flight crew did not comply with the instructions.
o
In 8 incidents the situation was developing very fast and there was insufficient time
for ATCO conflict detection.
 Performance of the Basic Barrier “Pilot/driver collision avoidance”
o
The barrier was challenged 25 times, failed 3 times, worked 22 times and 6 times the
preceding barriers failed but there was no need for collision avoidance.
Page 15
o
In 10 incidents the flight crew detected visually that the runway is occupied and
initiated a go-around.
o
In 6 incidents the flight crew detected that RWY was occupied and prevented
collision by landing and succeeding to stop on the runway before reaching the
conflicting mobile.
o
In 3 of the incidents the vehicle driver detected the landing/taking off aircraft and
succeeded to avoid it.
o
In 2 of the incidents there was no opportunity for pilot/driver collision avoidance.
o
In one incident the departing aircraft succeeded to get airborne before the
conflicting mobile.
o
In one incident the taxiing aircraft avoided collision by stopping before entering the
runway, after passing the holding point.
o
In one incident the departing aircraft succeeded to reject the take-off.
o
In one incident the flight crew did not take action in time.
 Performance of the Basic Barrier “Providence”
o
The barrier was challenged and worked in 3 of the incidents.
 “Landing without clearance” review:
o
The analysed sample contains 7 incidents “Landing without clearance”. This
represents around 12% of the analysed sample.
o
5 incidents are classified as severity B and 2 incidents are classified as severity A.
o
In 4 incidents communication misunderstanding generated the scenario of landing
without clearance.
o
In 2 incidents the landing aircraft deliberately continued approach and landed
without clearance.
o
In one incident the lack of clearance was overlooked and this caused the landing
without clearance.
o
In one incident the landing was made during low visibility procedures and there was
a mobile in the ILS critical area.
o
It is suggested landing without clearance not to be retained as a safety priority but
the risk associated with it to be to be closely monitored for the next reference
period.
 Severity A incidents review:
o
There are 14 incidents classified as severity A in the sample. This represents 25% of
the sample size.
o
3 incidents involved ATC not providing a correct and timely landing clearance.
Typically, these incidents involve clearing an aircraft to land on an occupied runway.
o
2 incidents involved inadequate air-ground communication of the taxi route and
runway entry clearance contributing to taxiing mobile incorrectly entering the RWY
Page 16
protected area. Typically, these involve misunderstanding clearance to hold short or
misunderstanding conditional clearances.
o
2 in incidents involved lack of adequate ATC traffic awareness that contributed to
ATC causing incorrect entry of taxiing aircraft or vehicle. An example is ATCO not
being aware of the exact position of the mobile when clearing it to cross the runway.
o
2 incidents involved landing without clearance.
o
One incident involved lack of adequate ATC coordination.
o
One incident involved lack sufficient spacing between landing aircraft
o
One incident involved crew failure to identify that there is a lack of runway entry
clearance.
o
One incident involved air-ground communication contributing to incorrect presence
of taking-off aircraft.
o
One incident involved incorrect presence of taxiing aircraft after position confusion.
 Sudden, high energy runway conflict review:
o
12 of the incidents in the sample (21%) incidents involved sudden, high energy
runway conflicts. The scenario typically involves a rapidly developing situation of
runway entry in front of a high energy landing or taking-off aircraft at position where
the available reaction time is close or less than the needed reaction time for
detection, communication and execution of a collision avoidance manoeuvre.
o
3 of the 14 incidents classified as severity A involved sudden, high energy runway
conflicts.
o
2 of the 3 incidents resolved by providence involved sudden, high energy runway
conflict.
o
It is suggested to select “Sudden, high energy runway conflict” as a safety priority.
Sudden High Energy Runway Conflict
2
PROVIDENCE
9
PILOT / DRIVER RUNWAY COLLISION AVOIDANCE
1
0
0
ATC RUNWAY COLLISION AVOIDANCE
ATC PREVENTING RUNWAY CONFLICT
PREVENTING RUNWAY INCURSION
Figure 9
Page 17
5.
LOSS OF SEPARATION EN-ROUTE
SAFMAP incident data is Restricted information. Release subject to the approval of SISG ANSPs.
Page 18
6.
RUNWAY INCURSION
SAFMAP incident data is Restricted information. Release subject to the approval of SISG ANSPs.
Page 19
Page 20