Top 5 ATM Operational Safety Priorities Landing Without

Top 5 ATM Operational Safety Priorities Landing Without Clearance BLAJEV Tzvetomir Operational Safety Coordinator, EUROCONTROL Captain Ed Pooley The Air Safety Consultancy

In Brief: § The process to determine the priorities - SAFMAPs § What are the Top 5? § Operational safety study example: Landing without clearance

In Brief: § The process to determine the priorities - SAFMAPs § What are the Top 5 ? § Operational safety study example: Landing without Clearance

How to prioritise § Counting numbers versus understanding mechanisms § Single point of view versus a common picture § Learning from negative versus learning from both negative and positive

How did we get it? § We studied two risk areas: (1) Runway incursion (2) Loss of separation en-route § Workshops with 6 ANSPS during Summer 2012 § Reviewing severity A and B incidents for 2011 § Mapping the incidents on SAFMAPs (Safety Functions Maps) – 3 hierarchical levels were developed

SAFMAP Level 0 – Runway Collision Providence UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT Pilot/Driver RWY Conflict Resolution UNRESOLVED BY ATC RUNWAY CONFLICT ATC RWY Conflict Resolution RUNWAY CONFLICT Preventing incorrect RWY presence to turn into RWY conflict RUNWAY INCURSION Preventing incorrect presence into RWY protected area

SAFMAP Level 1 PROVIDENCE UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT Opportunity for physical collision avoidance The conflict is detectable by the pilot / driver The conflict is detected by the pilot/ driver Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided UNRESOLVED BY ATC RUNWAY CONFLICT ATCO detects the conflict Sufficient time and effective ATC decision Adequate Communication Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided RUNWAY CONFLICT Opportunity to prevent the conflict before or with intended RWY use clearance Crew/driver prevents conflict after detecting it before or with intended RWY use clearance ATCO prevents conflict after detecting it before or with intended RWY use clearance RUNWAY INCURSION Pilot/driver detecting that RWY entry will be incorrect Preventing ATC causing incorrect entry ATC prevents incorrect presence Taxi pilot/driver adequate positional awareness Taxi pilot/driver adequate communication No confusion that there is a clearance ATC prevents incorrect presence Correct vacation No incorrect presence of take-off aircraft No incorrect presence of landing aircraft No incorrect presence of person

Incident trajectories on the SAFMAP PROVIDENCE UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT Opportunity for physical collision avoidance The conflict is detectable by the pilot / driver ATCO detects the conflict Sufficient time and effective ATC decision The conflict is detected by the pilot/ driver Crew/driver/person initiates action on time UNRESOLVED BY ATC RUNWAY CONFLICT Adequate Communication Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided RUNWAY CONFLICT Opportunity to prevent the conflict before or with intended RWY use clearance Crew/driver prevents conflict after detecting it before or with intended RWY use clearance ATCO prevents conflict after detecting it before or with intended RWY use clearance RUNWAY INCURSION Pilot/driver detecting that RWY entry will be incorrect Preventing ATC causing incorrect entry ATC prevents incorrect presence Taxi pilot/driver adequate positional awareness Taxi pilot/driver adequate communication No confusion that there is a clearance ATC prevents incorrect presence Correct vacation No incorrect presence of take-off aircraft No No incorrect presence of of landing person aircraft

Incident trajectory example 1 • A vehicle entered RWY for maintenance work without PROVIDENCE clearance after confusion of the position UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT • ATCO detected The conflict is entry with the is stop bar the incorrect Opportunity for The conflict red Crew/driver/person physical collision detectable by the issuing clearance for a takedetected by the pilot/ crossing alarm at the time of initiates action on time avoidance pilot / driver off aircraft UNRESOLVED BY ATC RUNWAY CONFLICT • ATCO immediately cancel the take-off clearance Sufficient time and ATCO detects the conflict effective ATC decision Adequate Communication Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided RUNWAY CONFLICT Opportunity to prevent the conflict before or with intended RWY use clearance Crew/driver prevents conflict after detecting it before or with intended RWY use clearance ATCO prevents conflict after detecting it before or with intended RWY use clearance RUNWAY INCURSION Pilot/driver detecting that RWY entry will be incorrect Preventing ATC causing incorrect entry ATC prevents incorrect presence Taxi pilot/driver adequate positional awareness Taxi pilot/driver adequate communication No confusion that there is a clearance ATC prevents incorrect presence Correct vacation No incorrect presence of take-off aircraft No incorrect presence of landing aircraft No incorrect presence of person

Incident trajectory example 2 PROVIDENCE UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT Opportunity for physical collision avoidance The conflict is detectable by the pilot / driver The conflict is detected by the pilot/ driver Crew/driver/person initiates action on time UNRESOLVED BY ATC RUNWAY CONFLICT ATCO detects the conflict Sufficient time and Adequate Crew/driver/person effective ATC • During high workload, wet RWY, many Communication initiates action on time decision time than usual to vacate the RWY The avoidance action is correctly implemented and collision is avoided The avoidance action is correctly implemented Arrivals, more and collision is avoided RUNWAY CONFLICT Opportunity to prevent the conflict before or with intended RWY use clearance • ATCO focussing on the one vacating the outer RWY, Crew/driver prevents conflict after detecting it before or with intended RWY use clearance tired at the and of the day ATCO prevents conflict after detecting it before or with intended RWY use clearance • Clear an a/c to cross (after landing) after already given TOF clearance to another a/c RUNWAY INCURSION ATC No No prevents No incorrect • No stop bars incorrect ATC prevents incorrect presence used - only for low visibility procedures incorrect presence of Taxi pilot/driver No confusion of take-off of landing person adequate positional adequate identifying is a conflict ATCO instructed the that there the Correct • After aircraft vacation awareness communication clearance Pilot/driver detecting that RWY entry will be incorrect Preventing ATC causing incorrect entry crossing to expedite

Incident trajectory example 3 • Landing aircraft mistuned PROVIDENCE frequency of the TWR and decided to follow the loss of communication UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT Opportunity for The conflict is The avoidance action is landing procedure in VMC Crew/driver/person physical collision avoidance ATCO detects the conflict detectable by the pilot / driver detected by the pilot/ driver initiates action on time Adequate Communication Crew/driver/person initiates action on time correctly implemented and collision is avoided • Take-off aircraft on the RWY already but no opportunity for take. UNRESOLVED BY ATC RUNWAY CONFLICT off or for vacating the RWY Sufficient time and The avoidance action is effective ATC decision Opportunity to prevent the conflict before or with intended RWY use clearance correctly implemented and collision is avoided • The landing aircraft failed to see that RWY is occupied and landed on RUNWAY CONFLICT top of the a/c at the threshold Crew/driver prevents conflict after detecting it before or with intended RWY use clearance ATCO prevents conflict after detecting it before or with intended RWY use clearance RUNWAY INCURSION Pilot/driver detecting that RWY entry will be incorrect Preventing ATC causing incorrect entry ATC prevents incorrect presence Taxi pilot/driver adequate positional awareness Taxi pilot/driver adequate communication No confusion that there is a clearance ATC prevents incorrect presence Correct vacation No incorrect presence of take-off aircraft No incorrect presence of landing aircraft No incorrect presence of person

In Brief: § The process to determine the priorities - SAFMAPs § What are the Top 5? § Operational safety study example: Landing without clearance

Top 5: (1) Risk of operations without transponder or with dysfunctional one § A single threat often removing all the barriers up to ‘see and avoid’; § No ATC awareness; § No STCA; § No TCAS/ACAS.

Top 5: (2) Landing without clearance § For numerous reasons, aircraft sometimes land without ATC clearance; § This results in runway incursions that are often only resolved through ‘providence’.

Top 5: (3) Detection of Occupied Runway § Good share of the severe Runway Incursion incidents could have been prevented; § Need for the controllers to detect that the runway was occupied at the time of giving a clearance for the next aircraft to use it.

Top 5: (4) “Blind Spot” § Conflict was not detected with the closest aircraft; § After descending clearance; § Rapidly developing situation – often 1000 ft and 15 Nm between the conflicting a/c.

Top 5: (5) Conflict detection with adjacent sectors § Involve “inadequate coordination” of clearance with an adjacent sector; § These typically involve either an early (premature) transfer of control to or from the neighbouring sector.

In Brief: § The process to determine the priorities - SAFMAPs § What are the Top 5 ? § Operational safety study example: Landing without clearance

Operational Safety Study § Provide additional insights on causal/contributory factors § Suggest actions to reduce or eliminate risk factors § Identify industry ‘best’ practice and lessons learned § Inform development of SKYbrary material Top 5 Safety Priorities 19

The Generic Study Process BARRIERS SCENARIOS ANALYSIS CONCLUSIONS OPERATIONAL CONTEXT Top 5 Safety Priorities 20

The Generic Study Process BARRIERS SCENARIOS ANALYSIS CONCLUSIONS OPERATIONAL CONTEXT Top 5 Safety Priorities 21

Example Conflict Scenarios (1) Active RWY LANDING WITHOUT CLEARANCE A. Loss of communication B. RWY confusion 2 a 3 a 3 b 1 3 c 3 d 3 e 2 b 1. Unoccupied RWY and no clearance given 2. Unoccupied but a clearance has been given 3. Occupied RWY Top 5 Safety Priorities C. Communication misunderstanding D. Absence of clearance overlooked E. Deliberate 22

The Generic Study Process BARRIERS SCENARIOS ANALYSIS CONCLUSIONS OPERATIONAL CONTEXT Top 5 Safety Priorities 23

Barriers Top 5 Safety Priorities 24

Mitigation Barriers PROVIDENCE UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT Opportunity for physical collision avoidance The conflict is detectable by the pilot / driver The conflict is detected by the pilot/ driver Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided UNRESOLVED BY ATC RUNWAY CONFLICT ATCO detects the conflict Sufficient time and effective ATC decision Adequate Communication Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided RUNWAY CONFLICT Opportunity to prevent the conflict before or with intended RWY use clearance Crew/driver prevents conflict after detecting it before or with intended RWY use clearance ATCO prevents conflict after detecting it before or with intended RWY use clearance RUNWAY INCURSION Top 5 Safety Priorities 25

The Generic Study Process BARRIERS SCENARIOS ANALYSIS CONCLUSIONS OPERATIONAL CONTEXT Top 5 Safety Priorities 26

Operational Context (1) § § § Availability of radar guidance for the approach Meteorological conditions and time of the day Runway status Clearance conditions Visual surveillance capability from the Tower Top 5 Safety Priorities 27

The Generic Study Process BARRIERS SCENARIOS ANALYSIS CONCLUSIONS OPERATIONAL CONTEXT Top 5 Safety Priorities 28

OPERATIONAL SCENARIOS v BARRIER EFFECTIVENESS § All Scenarios formulated are not equally prevalent! And: § All Prevention Barriers (PB) are not equal in their relevance to the various scenarios § All Mitigation Barriers (MB) are not equal in their relevance to the various scenarios § But In both cases there are some clear indications of best “valueadded” in responding to the risk of Lw. C § Assign each ‘PB’ and each ‘MB’ to the defined scenarios as fully effective, partially effective or ineffective/not intended to address – traffic light system: Top 5 Safety Priorities 29

PREVENTION BARRIER MATRIX PB 1 PB 2 PB 3 PB 4 PB 5 PB 6 PB 7 PB 8 PB 9 PB 10 PB 11 PB 12 PB 13 PB 14 A 1 A 2 A 3 B 1 B 2 B 3 C 1 C 2 C 3 D 1 D 2 D 3 E 1 E 2 E 3 Top 5 Safety Priorities 30

MITIGATION BARRIER MATRIX MB 1 MB 2 MB 3 MB 4 MB 5 MB 6 MB 7 MB 8 MB 9 MB 10 A 1 A 2 A 3 B 1 B 2 B 3 C 1 C 2 C 3 D 1 D 2 D 3 E 1 E 2 E 3 Top 5 Safety Priorities 31

RANKING OF PREVENTION BARRIER EFFECTIVENESS § Arbitrary weighting of Green: Yellow at 3: 1 (use of 2: 1 would make little relative difference) § Best Ranked Prevention Barriers (score range 3 -31): § PB 5 an automated (probably visual), alerting of pilots to an occupied runway and thus the (probable) absence of a landing clearance § PB 9 a controller-activated (probably visual) alerting of pilots to the absence of a landing clearance. § Best/Worst Coverage of Prevention Barriers by Scenario: § Best - ‘D’ (pilot unaware) § Intermediate - ‘B’ (runway confusion); ‘C’ (comms confusion); ‘A’ (loss of comms) § Worst - ‘E’ (deliberate act) Top 5 Safety Priorities 32

RANKING OF MITIGATION BARRIER EFFECTIVENESS § Same Arbitrary weighting of Green: Yellow at 3: 1 (again use of 2: 1 would make little relative difference) § Best Ranked Mitigation Barriers (score range 20 -33 plus one outlier at 3): § MB 2 - controller intervention prompted by an automatic alert with or without prior issue of a conflicting clearance. § MB 4 - pilot/driver action prompted by an automatic (probably visual) alert. § MB 3 – pilot/driver action promoted by proactive monitoring of traffic visually or on the radio § Best/Worst Coverage of Mitigation Barriers by Scenario: § Best - ‘B’ (runway confusion) § Intermediate - ‘A’ (loss of comms); ‘C’ (comms confusion); ‘D’ (unaware) § Worst - ‘E’ (deliberate act) Top 5 Safety Priorities 33

VALIDATION OF BARRIER EFFECTIVENESS üIdentifies the barriers that could have prevented or mitigated an actual event had they been Available and Used ×Is not an analysis of what actually happened since the test events were not prevented. Top 5 Safety Priorities 34

SCENARIO ‘A’ (LOSS OF COMMS) §Non-precision approach by private business flight by aircraft owner. Mistuned TWR in IMC and when no contact possible assumed radio failure and did not revert to APP. Broke cloud at 1. 5 nm and continued land over a Q 400 lined up for departure at the threshold without seeing it. §Three effective Prevention Barriers: § PB 4, PB 5, PB 9 § These include the top two ranked barriers §Two effective Mitigation Barriers: § MB 2, MB 4 § These include two of the three top ranked barriers Top 5 Safety Priorities 35

SCENARIO ‘B’ (RUNWAY CONFUSION) § Two parallel runways, one closed long term for nearly- completed reconstruction. In VMC, ATC approved an inbound CRJ crew request to land in the reciprocal direction to that in use. The aircraft was then landed on the closed runway without encountering obstacles - ATC only noticed as the aircraft was about to touch down. The crew said they were used to programming the FMS for the runway they actually used and failed to appreciate or correct their error even when flying a visual approach. §Seven effective Prevention Barriers: § PB 5, PB 6, PB 7, PB 8, PB 9, PB 11, PB 13 § These include the top two ranked barriers §Two effective Mitigation Barriers: § MB 3, MB 8 § These include the one of the top three ranked barriers Top 5 Safety Priorities 36

SCENARIO ‘C’ (COMMS CONFUSION) § ATC instructed pilot to “continue approach” to which the pilot readback was “continue”. ATC made no further attempt to communicate to the aircraft and it was landed in the belief that clearance had been given. §Five effective Prevention Barriers: § PB 5, PB 9, PB 10, PB 11, PB 12 § These include the top two ranked barriers §Six effective Mitigation Barriers: § MB 2, MB 3, MB 4, MB 5, MB 6, MB 8 § These include the top three ranked barriers Top 5 Safety Priorities 37

SCENARIO ‘D’ (PILOT UNAWARE) §On initial contact with TWR, the aircraft was instructed to continue advised to expect to be called back. After landing without clearance in the belief that it had been received, the pilot, who was familiar with the airport involved, observed that landing clearance there was usually given a long way out and the absence of the promised call back with clearance was easily missed. §Nine effective Prevention Barriers: § PB 1, PB 2, PB 3, PB 5, PB 9, PB 10, PB 11, PB 12, PB 14 § These include the top two ranked barriers §Nine effective Mitigation Barriers: § MB 1, MB 2, MB 3, MB 4, MB 5, MB 6, MB 7, MB 8, MB 10 § These include the top three ranked barriers Top 5 Safety Priorities 38

SCENARIO ‘E’ (DELIBERATE ACT) § An en-route light aircraft lost positional awareness in VMC and, unequipped with GPS, saw what was considered to be a convenient airport, and made a downwind join in the opposite circuit direction to that in use and continued onto finals and landed without radio contact. TWR saw the aeroplane when it was downwind and instructed another aircraft approaching from the opposite in-use direction to make a go around. §Two effective Prevention Barriers: § PB 5, PB 9 § These are the top two ranked barriers §Effective Mitigation Barriers: § MB 1, MB 2, MB 3, MB 4, MB 5, MB 6, MB 7, MB 8, MB 10 § These include the top three ranked barriers Top 5 Safety Priorities 39

The Generic Study Process BARRIERS SCENARIOS ANALYSIS CONCLUSIONS OPERATIONAL CONTEXT Top 5 Safety Priorities 40

SOME CONCLUSIONS (1) Ø The study has identified the best performing potential prevention and mitigation barriers. Some barriers are likely to be more cost effective than others. Ø Other studies referenced in the Paper are supportive of these findings but also advocate looking at barriers which would directly reduce the prevalence of pilots not being on the TWR frequency as the landing runway is approached. Ø Combinations of the most effective barriers are likely to make an impressive impact on Lw. C prevalence and mitigation. Top 5 Safety Priorities 41

SOME CONCLUSIONS (2) Ø The top two ranked Prevention Barriers, PB 5 and PB 9, were applicable in all five scenario examples. Ø The top three ranked Mitigation Barriers, MB 2, MB 3, & MB 4 were all applicable in Scenarios C (Comms confusion), ‘D’ (Pilot unaware) and ‘E’ (Deliberate Act) and at least one was applicable in the other two scenarios - ‘A’ (Loss of Comms) and ‘B’ (runway confusion. Ø An outstanding PB 5 solution, ‘FAROS’ as currently being deployed in the USA, was estimated prior to this implementation as likely to prevent 65% of runway conflicts – some of which are Lw. C! Top 5 Safety Priorities 42

Questions? Top 5 Safety Priorities 43