Use of ALARP in Naviair

Size: px

Start display at page:

Download "Use of ALARP in Naviair"

Cecil Ford
7 years ago
Views:

1 Use of ALARP in Naviair Sten Bertram Winther Head of Project Facilitation October 2013

2 Agenda Sten Bertram Winther, Naviair ALARP ALARP in operation ALARP in system development Conclusion

3 Naviair IFR Operations En-Route

4 Airspace

5 Airspace FL285 UTA, Upper Control Area FL95 CTA, Control Area 1500ft GDR TMA CTR TMA CTR

6 Naviair

7 Naviair Technical Sites Sindal ATC ILS VOR/DME Aalborg Radar Siri RAMME Bovbjerg Karup Tinghøj Tirstrup Vejrradar Voice kommunikation Data kommunikation Tyra Børsmose LEMME VESTA Esbjerg VAMDU Rømø Skrydstrup Billund Kolding ODIN TRANO Lerbjerg KORSA Slots Bjergby Kulsbjerg NORA (nedlægges) BELLA Roskilde CODAN København Sturup Stevns RØNNE 6 stk. ALSIE Skrøbelev

Esbjerg VAMDU Rømø Skrydstrup Billund Kolding ODIN TRANO Lerbjerg KORSA Slots Bjergby

8 Safety Public Perception 80 % af alle flyulykker sker inden for få minutter under flyvningen især inden for de første tre minutter samt de sidste seks at langt de fleste flyulykker sker risikoen for, at du omkommer i en fly ulykke er en til 11 millioner scorer SAS syv ud af syv stjerner Norwegian, Ryanair og EasyJet fik fem ud af syv

fleste flyulykker sker risikoen for, at du omkommer i en fly ulykke er en til 11

9 Safety Freedom from unacceptable risk

10 Protection Safety space Bankruptcy Catastrophe Production

11 Definition: Functional System ATC ATCOs Maintenance Procedures People Engineers ATM Equipment Network TWR Building VCS

12 Processes and outcomes Causes and consequences of operational errors are not linear in their magnitude

13 Severity ALARP As Low As Reasonably Practicable AFARP EC 1035/2011 Probability - hazard/year Hazard Probability Hazard Risk Severity Often 3E+00 or more Several times during the lifetime of the system 3E+00 to 2E-01 Probably during the lifetime of the system 2E-01 to 1E-02 Probably not 1E-02 to 3E-05 Unlikely to occur Less than 3E-05 I II III IV V Accident 1 A A AA A AA A A A A C Serious incident 2 A A B C D Major incident 3 A B C D D Significant incident 4 B C D D D No immediate effect 5 C D D D D Naviair Management System

to 1E-02 Probably not 1E-02 to 3E-05 Unlikely to occur Less than 3E-05 I II III IV V Accident 1 A A AA A AA A A A A C Serious

14 Hazard hazard means any condition, event, or circumstance which could induce an accident EC 1035:2011;

15 Hazard

16 Effect, EC 1035/2011 Common Requirements COST???

17 Probability, BL 7-25 Bestemmelser om risikovurdering og risikoreduktion i lufttrafikstyring (2003) 1/year 2/10year 1/100year 3/ year <3/ year 4 years 13 years 65 years 100 years years

18 Risk Perception Future Trends Development Mirror Past

19 Risk Perception Future Trends Enviroment, socilogy, trafic, technical. Development Enviroment, socilogy, trafic, technical. Mirror Past

20 Risk High Risk Unacceptable region Tolerable region ALARP Acceptable region Low risk Regulation System req Acceptable risk

21 Bow-tie Model People Preventive Hazard Safety nets Effect Procedure Equipment SW Barriere System Surroundings

22 Safety Requirements Safety Targets Bow-tie Model Causes Mitigations PSSA Preliminary System Safety Assessment D1 E1 Hazard Mitigations FHA Functional Hazard Assessment Effect Effect A SC5 D2 E2 H Effect B SC4 D3 E3 Effect C SC3 E Ph Safety Objective Pe Effect D SC2 Effect E SC1 SSA System Safety Assessment

23 Decision-making-proces Accept of Hazard or Severity or Likelihood or Risk? Model or evaluation or gut feeling! Who is the decision maker! Decision-makers wants: Objectives Cost Alternatives Evidence Benefit Logic Is this provided by the Risk management process?

24 Safety Assessment ATM System Hazard Effect Safety Requirement Ph Pe FTA RBD FMEA FMECA SWAL.. Safety Objective Quantitative model Semi-quantitative model Semi-precriptive model Fixed-precriptive model Safety Target

25 Risk Identify hazard Identify the effect Assess the likelihood Find the risk Do something! Evaluate the risk Accept the risk Not OK OK

26 Perspective System Developer Perspective Fault External Event System Failure Service User Perspective Hazard Incident Accident Potential Consequences Causes of Failures

27 ALARP in operation

28 ALARP in system development Safety objectives/requirements Radar Safety requirements Radar Display System

Examples Security, Not the same RCM Cost: CPH 98 Mkr 2001 437 Mkr 2010 Use of different RCM, eg.

29 Examples Security, Not the same RCM Cost: CPH 98 Mkr Mkr 2010 Use of different RCM, eg. Canada - Iceland Denmark Implementation of software mitigations, CPDLC Controller Pilot Data Link Communication Unknown enviroment Ash cloud 2010 Network dependence TDC MPLS failure SAS Dash 8

30 WAM, Wide Area Multilateration

31 Next call.

Conclusion Correlations between mitigations effect of mitigations Barrier erosion Is cost (mitigations effect) identifiable Quantitative Qualitative argumentation Define apportionment

32 Conclusion Correlations between mitigations effect of mitigations Barrier erosion Is cost (mitigations effect) identifiable Quantitative Qualitative argumentation Define apportionment and assumptions Benefit (success case) Design to avoid instead to control faults Resilient Design Complex systems Design As Simple As Reasonably Practicable Barriere erosion Poor design?

33 Questions.

Information to VFR pilots

Information to VFR pilots Information to VFR pilots This publication has been prepared by Naviair with the purpose of focusing on flight safety and clarifies topics, which are important to know for VFR