Degraded Modes and Factors of Operatio Safety for Operatioal Efficient Repair

Transcription

1 Degraded Modes Safety for Operatioal Egieerig ESP EUROCONTROL Cooperative Network Desig Europea Orgaisatio for the Safety of Air Navigatio (EUROCONTROL) October 2009 This documet is published by EUROCONTROL for iformatio purposes. It may be copied i whole or i part, provided that EUROCONTROL is metioed as the source ad it is ot used for commercial purposes (i.e. for fiacial gai). The iformatio i this documet may ot be modified without prior writte permissio from EUROCONTROL. EUROCONTROL

2 INTRODUCTION O the 8th October 2001 the Liate Airport disaster occurred killig 118 people. The airport had cotiued operatios i thick fog, with limited surface movemet radar, iappropriate ruway markigs ad i multiple laguages. O the 1st July 2002 the Überlige disaster killed 71 people. The disaster occurred durig a FDPS update whe telephoe systems were uavailable, radio commuicatios at the cotroller workstatio were restricted, ad a rostered cotroller was takig a break. The two accidets represet degraded modes operatios: i.e. cotrollers providig a service to aircraft whe the system was ot capable of supportig that service fully. The problem is that we get used to operatig i degraded modes. Every day some system or aother does t work, ad we forget to questio whe it will be available or whether the data is accurate. As more services become uavailable, the result is that whe a failure occurs, the ability to recover is practically il. Professor Chris Johso Chairma of the SESAR Scietific Committee Aimed primarily at the Egieerig disciplie, this brochure seeks to: Provide a overview of the degraded modes of operatio Uderstad the relatioship betwee safety culture ad degraded modes Share the kowledge from a idepth 2008 ECAC study report Discuss tools for support i assessig degraded modes risk Provide resources for further iformatio o degraded modes 2 3

3 WHAT ARE DEGRADED MODES OF OPERATION It is best to thik of degraded operatios i the cotext of other modes: Normal operatios: are situatios i which all elemets of the system (icludig staff) are fuctioig as iteded. Mior faults may eed to be resolved, but they do ot place restrictios o the systems ad staff, ad all routie tasks are achievable. Degraded modes of operatio: arise whe problems i the uderlyig system occur. These are expected but are ot cosidered ormal. Staff have procedures for dealig with these situatios ad the risks associated with ay failure are ot cosidered sigificat. Reduced staffig levels are cosidered as a example of degraded modes. Crisis: a adverse evet that eed ot force a move from the operatios room. More serious tha degraded modes, they last for a shorter time tha cotigecy, but may be severe i ature. Examples might iclude; strikes, floods & fires, security icidets, ad bomb warigs. Cotigecy: represets a situatio i which it is ecessary to move from the stadard operatios room. These may be more log term tha crises, ad result i a iterruptio to the ATM service. Defiitios ad guidace may be foud at Whe we thik of ormal operatios, degraded modes are becomig every day operatios. We tolerate systems workig imperfectly; we lear to igore iformatio that the system provides. This ormal operatio cotributed to the Liate disaster. 4 5

4 DEGRADED MODES AND SAFETY CULTURE Safety Culture describes the realities of safety: the way that safety is doe, ot ecessarily the way that people say it is doe. The way we thik about safety affects our behaviours ad what is doe. The way we speak about safety affects what is believed. All of these affect safety outcomes i our daily workig lives. What is BELIEVED The way that safety is doe aroud here. What is SAID What is DONE SAFETY OUTCOME Safety Culture No ANSP will say that it does ot take safety seriously, ad rightly so. However, we eed to scrutiise safety ad ask what safety actually looks like o the groud: Is the operatios room ruig with too few cotrollers? Are multiple systems uavailable as a result of maiteace? Are Egieers short staffed ad workig extra shifts? Have equipmet upgrades bee postpoed due to other fudig priorities? Is there a clash betwee termial facilities ivestmet ad ruway ifrastructure ivestmet? Who ows the etwork switch that hadles your data? At what poit does a ormal operatio become a degraded mode? By toleratig degraded modes we are reducig our commitmet to safety. 6 7

5 THE INCIDENT PIT Whe a isect lads o a pitcher plat it is attracted to the ectar i its deep eck. As the isect moves from the top over the crest of the flower it falls; it has passed a poit from which it caot escape. The sides of the plat are too slippery ad steep for it to escape. The isect drows. The pitcher plat aalogy, whe applied to degraded mode operatios, is what we call the icidet pit. The icidet pit leads us ito urecoverable situatios i similar ways. There are factors which push us ito the icidet pit. Each represets a set of maagemet, operatioal ad egieerig decisios made before or i respose to a evet. Evetually a poit is reached where it is ievitable that a icidet will occur: at that poit we fall to the bottom of the pit. There are a similar set of barriers that keep us out of the pit: best practice, safety maturity, ifrastructure ivestmet etc. The systematic removal ad degradatio of these barriers occurs durig degraded modes of operatio. Pushig us ito the pit Staff shortages Limited secodary systems Limited experieced resources Legacy equipmet 3rd party systems, support cotracts Itermittet failures Cocurret breakdows Keepig us out of the pit Risk assessmet Cotigecy plas Spare persoel Fully fuctioig equipmet Icidet ivestigatio & learig Safety maturity Plaed upgrade programme Traiig Risk awareess Spare equipmet Experieced persoel INCIDENT The Icidet Pit 8 9

6 DEGRADED MODES & MAJOR INCIDENTS Two major accidets are described below, ad for each the degraded mode is clarified. Have you leared the lessos from each of the icidet reports? Could these icidets happe at your uit? Liate I poor visibility, a Cessa crossed the ruway threshold ad was struck by a MD80. The MD80 crashed ito a baggage hall ad 118 people were killed. Beyod pilots ad cotrollers, the whole ATM operatio was severely degraded: Ruway maps did ot represet actual ruway markigs Surface radar ieffective Ruway lightig ieffective Stop bars ieffective Aother icursio 24h earlier Why did operatios cotiue? Überlige A Tupolev ad Boeig collided i mid air killig 71 people. Cofusio over TCAS alerts was idetified as the primary reaso for the accidet, but degraded modes also played a sigificat role: FDPS update i progress RVSM beig itroduced Phoe lies ieffective RT frequecies ot o same workstatio STCA audible oly Similar icidets occur ofte Why did operatios cotiue? May of the above items are commo across ANSPs. How robust is your system? I respose to such evets, what should your orgaisatio do? 10 11

7 AIRCRAFT, EQUIPMENT PROVIDERS AND ANSPs O behalf of Eurocotrol, Professor Chris Johso reviewed the activities of system maufacturers, ANSPs ad aircraft maufacturers i order to determie the idustries appreciatio of degraded modes. The combied picture of all services is ecessary to costitute a fuller uderstadig of degraded modes i the aviatio idustry, ot just ATM, ad where sources of degraded modes might arise. Not all the observatios were egative. Aircraft maufacturer s view Airlies cotiue to rely o fallible compoets eve whe they have bee implicated i icidets. The provisio of redudacy does ot ecessarily avoid the issues related to degraded modes. Desig flaws are exacerbated by maiteace procedures 3rd party servicig. Solvig techical degraded mode issues may be possible, but those related to soft issues, i.e. people, are difficult for techical orgaisatios. Commitmet to product exteds to the life of the product - positive Local 3rd party maiteace orgaisatios will feed back to a maufacturer to educate them o maiteace of their product - positive Maskig faults i tolerat systems removes the crew from a clear picture of aircraft faults. It is ot always possible to predict all degraded modes

8 Equipmet maufacturer s view The eed to work withi budgets ad timescale will lead to shortcuts embedded withi equipmet. The uderstadig of safety for maufacturers is very differet to that of the ANSP. Equipmet support cotracts do ot cover 3rd party equipmet withi the total system. Systems may shed more advaced features if they are strugglig with data volumes. If subcotractig for a larger supplier, egieers have o opportuity to express cocers about the larger product. Specialised equipmet for ACCs will ot provide the same level of support for uits that are ot ACCs. Similarly specialised aiport ad termial cotrol systems will ot support ACCs effectively. Project teams i whom customers have trust will be disbaded followig delivery to the cliet. The customer s process of commissioig should address degraded modes ad idetify which systems may fail ad who is resposible for them. Techical supplier ad operatioal views of the same issues will be sigificatly differet

9 ANSPs view Fidigs from visits across Europea ANSPs highlighted commo observatios. These are detailed below. How does you ANSP address the questios they raise? Ca you distiguish betwee systems that are redudat ad those that are fall-back. Are fall-back systems used for periods of degraded mode operatios? Self-healig ad redudat systems mask true fault coditios. What maiteace is ecessary for redudat systems? Advaced techical systems used i ATM require sub-systems to create iterfaces for the equipmet to work seamlessly. How have these bee built? Does your ANSP rely o a 50 etwork card? Do your subcotractors have the same attitude to safety as your staff? Are egieerig traiig facilities of a similar stadard to cotroller traiig facilities? How depedet o eighbourig states are you for primary systems? What is the kock-o effect to other ANSPs of a failure i oe of your Uits? Where is the safety departmet whe tryig to resolve a degraded mode? Who is resposible for imposig ad liftig flow restrictios durig degraded modes; what pressures are put o operatios ad egieerig ad by who? How do you cotact emergecy decisio-makers whe required? Does it work? 16 Sales, maiteace ad support cotracts ca be ueforceable whe equipmet actually fails what service do you aticipate, what will you receive? Is it clear to cotrollers whe a system is operatig without redudacy or i fall-back mode? Rectifyig degraded modes itroduces ew hazards, how are these idetified ad dealt with? Freezig equipmet budgets durig procuremet or limitig fuctioality results i shortcuts or reduced service. How is this maaged? The more progressive compaies visited implemeted a form of rapid risk assessmet before begiig resolutio actios. The more progressive compaies visited implemeted a form of rapid risk assessmet before begiig resolutio actios Do ACCs ad Towers (TC) maage systems i the same way across the orgaisatio; do they take risks that you do t? How well equipped are the regios to deal with degraded modes, what support do they have? What documetatio do you rely o, maps, plas etc. that are ot maitaied because they are ot safety documetatio? What risk assessmet is made before puttig hads o a piece of equipmet ad chagig its status? Could a egieer be prosecuted i the evet of a passeger fatality caused by your ANSP? 17

10 Rapid Risk Assessmet How ofte do we review risks for existig equipmet? How ofte do we assess risks before makig a decisio o the actios eeded to resolve a icidet? Rapid Risk Assessmet (RRA) is a tool for structured assessmet of situatios that would ot ormally be assessed. Learig Icidets Review Learig wrog server tured off RRA is used i the defece idustry to assess key operatioal decisios that will expose troops ad equipmet to risk. This may be eemy fire or routie operatioal decisios about equipmet movemet. I each case, troops o the groud are ow traied i assessig ad implemetig RRA to aid decisio-makig i critical situatios. RRA form Effect Decisio Here & Now RRA i cotext Phoe before discoect Here & Now The RRA approach uses lessos leared ad provides a assessmet of the major cotributors to previous accidets ad icidets. The RRA assessmet form is a livig documet ad is regularly reviewed i light of ew icidets. Where decisios that might have a impact o operatios ad safety have to be made quickly, a RRA tool provides a o-the-groud aid for Egieers. Based o the icidets i your uit, a RRA tool ca brig learig from past evets to the here-ad-ow i momets. What RRA tool do you use? Strategic Operatioal Here & Now Safety Cases Risk Tools RRA Chages over time Chages with equipmet Chages with staff & maagemet How does this happe i your orgaisatio? If the primary fails, the back-up will ot be able to hadle the traffic; but it is t safety critical because it s back-up, so we do t have to do a safety assessmet for it Uamed ANSP Europe 18 19

11 Degraded Modes Checklist Whe we look at icidets ad accidets with perfect hidsight it is clear where the problems i orgaisatios lie. But do we ask these questios o a daily basis, ad do we ask them before actig prevetig a icidet from becomig a accidet? A hardy memoic for decidig if it is safe to proceed is give below: P A R I S Paths leadig to failure uderstood Assess risks before actio take Recovery paths uderstood Iformed all poits of commuicatio Secodary systems available ad uaffected A Questioig Culture? No ANSP would admit that safety does ot have top priority, but whe we thik of safety we eed to broade the defiitio to iclude safety culture, ad cosider how we thik, act ad lear i relatio to safety. How a ANSP deals with, ad how its egieers thik about, degraded modes directly ifluece safety ad how we lear from our ow ad other ANSPs degraded modes experiece. Where is resposibility ad liability i maagemet ad service cotracts? What are the sigle poit failures i your systems? Ca you commuicate, ad do back-up commuicatio systems actually work? Have you assessed floodig ad water igress sources icludig fire fightig? Do ew systems require you to update detailed fire safety assessmets? Do you uderstad the hardware i your servers ad telecoms ifrastructure? Where is your ifrastructure degradig; what happes if it fails tomorrow? Where have you itroduced vulerabilities ito your facilities maagemet? Will fall-back modes really work, have you tested them? Are fall-back systems safety critical systems or just back-ups? Do you uderstad the risk of removig a etwork card from a multiplexer? Risk is cotiually o the move do you uderstad your risks? Do you have a safe culture? 20 21

12 For further iformatio cotact: EUROCONTROL is developig a traiig course for ATM Egieers o degraded modes safety, icludig awareess of Rapid Risk Assessmet. For more iformatio cotact oe of the people below. Chris Johso is a professor at Glasgow Uiversity ad has worked with EURO- CONTROL for the past 14 years i the field of icidet ivestigatio ad safety. It is Chris s work that has bee the major cotributor to the productio of this brochure. Chris has recetly bee appoited to the SESAR Scietific Committee. johso@dcs.gla.ac.uk Barry Kirwa is safety research leader at EUROCONTROL, researchig, developig ad implemetig ew safety approaches, supportig icidet ivestigatios at Maastricht, co-chairig the FAA- EUROCONTROL Actio Pla o Safety Research, ad leads the Europea Safety Culture programme. Barry.kirwa@eurocotrol.it Ady Kiler has spet 17 years workig i huma cetred processes ad safety icludig ATM, covetioal defece, civil uclear & electroics. He ow works at EUROCONTROL as a safety expert ad is cotributig to research i the fields of degraded modes, huma reliability aalysis, safety culture ad the wider SESAR project. Adrew.kiler@eurocotrol.it Toy Licu has a backgroud as a cotroller ad egieer. He has maaged EURO- CONTROL s Strategic Safety Actio Pla ad Europea Safety Programme for ATM (ESP) implemetatio, ad Just Culture with the aim of clarifyig ad promotig the cocept. Toy leads the Safety KPI developmet work i Europe ad maages the Network Developmet Pillar of safety ad huma factors, withi EURO- CONTROL. Atoio.licu@eurocotol.it 22