The implementation of the VTMIS system for the Gulf of Finland a FSA study

Transcription

1 Reviewed and published in the Proc. RINA Intl. Conf. on Formal Safety Assessment, Sept 2002, London. The implementation of the VTMIS system for the Gulf of Finland a FSA study Tony Rosqvist, VTT Industrial Systems, Finland Tapio Nyman, VTT Industrial Systems, Finland Sanna Sonninen, VTT Industrial Systems, Finland Risto Tuominen, VTT Industrial Systems, Finland SUMMARY The on-going port construction work in Russia and the Baltic countries, and the significant increase of vessel traffic foreseen in the Gulf of Finland has raised a public concern with respect to traffic safety. Proactively, the Maritime Administrations of Finland, Russia and Estonia have initiated risk control measures for the gulf area. As one of the main measures, a Vessel Traffic Management and Information Services (VTMIS) system has been planned as a joint effort by the three countries. The new VTMIS system will supplement the present national VTS systems, which are effective only in the corresponding national sea areas. Two options for implementing the VTMIS system have been of special interest for the Maritime Administrations: i.e., System1 consisting of a mandatory ship reporting system, and System2 consisting of a mandatory ship reporting system and a radar-based monitoring system. Both options also include an amended ship routeing system for the Gulf of Finland. The approval of the International Maritime Organisation of implementing systems, such as the proposed VTMIS system, presupposes that the proposal for new international regulation, before passed on to the IMO s decision-making process, be supported by a Formal Safety Assessment (FSA) addressing the effectiveness of the proposed system in reducing risk and improving traffic safety. A Formal Safety Assessment study has been carried out with respect to the proposed VTMIS system for the Gulf of Finland focusing on the risk of ship-to-ship collisions. Generic vessel types representing the gulf traffic were defined and predicted collision frequency estimates were computed for the different vessel types based on the predicted traffic image for the years 2010 to Economic consequences related to oil spills due to collisions were also computed and formed the basis of the cost-benefit analyses. As a reference point, a decision option Baseline2010, representing no additional investments to vessel traffic control in the gulf area, was defined and assessed. The risk modelling framework used in the FSA study was based on the GRACAT software developed by the Technical University of Denmark to support maritime safety studies. The software estimates ship collision frequencies using traffic data such as vessel types and predicted traffic intensities, specific route information, and the interaction of operative functions, the failure of which will lead to the realisation of the ship-to-ship collision hazard. Both VTMIS options assessed in the present FSA study were found to decrease the risk of ship-to-ship collisions and the related economic loss due to oil spill. The cost-benefit performance of the risk control options was assessed in terms of the expected total return of investing in a particular option. The results indicate that, from economic point of view, the investment in the more advanced VTMIS system including radar based ship monitoring, i.e., System2, can be recommended. AUTHORS BIOGRAPHY Tony Rosqvist holds the position of research scientist at VTT Industrial Systems. He has been involved in several risk assessment projects in various industrial sectors and in marine transportation. His current research interest relates to the use of expert judgement in risk and decision analysis. Tapio Nyman holds the position of senior research scientist at VTT Industrial Systems. He is responsible for maritime safety issues, especially the role of human factors in maritime transport systems. He has a long experience in the field of winter navigation research. Sanna Sonninen holds the position of research scientist at VTT Industrial Systems. She is involved in projects concerning the safety of maritime operations. She has a background of a navigating officer in the merchant vessels and is experienced with VTS operations. Risto Tuominen holds the position of senior research scientist at VTT Industrial Systems. His research interests concern the methodologies for safety and risk assessments. He has been involved in several risk assessment studies dealing with various industrial systems and transportation systems, including railroads and marine transportation.

2 1. INTRODUCTION The establishment of new and the development of existing oil terminals in Russia and the Baltic countries will significantly increase the amount of oil transported across the Gulf of Finland. According to the development scenarios of the terminals in the Gulf of Finland area, the total annual transportation will be doubled, and the amount of oil transported yearly will be tripled by the year 2015 compared to the present volume. The growth in freight transportation and passenger traffic will further increase the density of vessel traffic in the gulf area. In particular, the passenger and recreational boat traffic intersecting the tanker routes in the area between Helsinki and Tallinn is seen to cause a potential threat to safety of navigation and the marine environment. Figs. 1 and 2 show the use of the fairways by the oil tankers in year 2000 and the forecast of oil tanker movements for the year 2015 [1]. The annual growth rates of tanker traffic vary between 2 and 7 % depending on the country or the port under survey. The most rapid growth of the oil tanker traffic is assumed to take place in Russia and in the Baltic countries. No tanker calls have been assigned for the Port of Helsinki in Fig. 2 as the Helsinki (Laajasalo) oil harbour is planned to be closed by the year The main concern that has been expressed with respect to the increasing ship traffic in the Gulf of Finland is the increase of the risk of collisions between different types of vessels, and environmental damage due to subsequent oil spills. The risks related to grounding accidents are also recognised, but considered less significant due to the fact that the water depth of the international waters of the Gulf of Finland clearly exceed the draught of vessels able to enter the Baltic Sea through the entrances. In order to better control the risks and to avoid the potential increase in marine accidents and pollution in the Gulf of Finland due to the increasing vessel traffic, the Maritime Administrations of Finland, Russia and Estonia have introduced a plan to implement a new Vessel Traffic Management and Information Services (VTMIS) system for the Gulf of Finland. Two VTMIS system options were initially defined for this purpose as combinations of three basic measures: the amended ship routeing system (NAV 48/3/1 ANNEX 1), the mandatory ship reporting system (NAV 48/3/1 ANNEX 3) and the radar-based traffic monitoring system. The first VTMIS implementation option - System1 - includes the new ship routeing system and the mandatory ship reporting system proposed for the international waters of the Gulf of Finland. As this option does not include the radar-based traffic monitoring system, short Hamina 916 Kotka 108 Sköldvik Helsinki 679 Aseri 0 Tallinn (Muuga) Tallinn(Paldiski) 0 0 Primorsk St.Petersburg 0 Batareynaja Ust-Luga Figure 1. Oil traffic (annual number of port calls) in the Gulf of Finland in year 2000 for selected ports Hamina 1150 Kotka Sköldvik Helsinki Aseri 40 Tallinn(Muuga) Tallinn(Paldiski) 400 Primorsk St.Petersburg Batareynaja Ust-Luga Figure 2. Oil traffic estimate (annual number of port calls) in the Gulf of Finland for years position reports must be given by the ships more frequently than described in NAV 48/3/1 ANNEX 3. The position reports also include an estimated time of arrival to the next reporting point. The position report is always submitted before entering a traffic separation zone, or when entering or leaving the reporting area to national waters. The second VTMIS implementation option - 'System2' - includes the new ship routeing system, the mandatory ship reporting system and the radar-based traffic monitoring system. In this option the identification of vessels will be achieved automatically when an Automatic Identification System (AIS) transmitter is used. The mandatory ship reporting system operates according to the procedures defined in NAV 48/3/1 ANNEX 3. The operation of 'System2' is considered equal to a Vessel Traffic Service (VTS) operation, as defined in IMO Resolution A.857 (20). A limited Formal Safety Assessment (FSA) study [2, 3] was commissioned by the Finnish Ministry of Traffic and Communications together with the Finnish Maritime Administration in August 2001 with the objective of assessing the effectiveness of the two initially defined

3 VTMIS system options as risk control measures. The motivation of utilising the FSA approach was based on the requirement by IMO that any proposal for new international regulation that is passed on to the IMO decision-making process should be supported by a FSA study. The FSA study was completed in March 2002 with the dissemination of the final study report [4]. 2. THE FSA OF VTMIS-BASED RISK CONTROL OPTIONS FOR THE GULF OF FINLAND 2.1 FSA-STEP 1: HAZARD IDENTIFICATION A structured expert-group meeting was organised with the aim of identifying various risk scenarios associated with ship traffic at the Gulf of Finland during the opensea season taking into account the traffic profile predictions for the years The initial concerns related to the risks of the increasing tanker traffic were confirmed by the expert s views. In particular, the concerns related to oil spills due to collisions between tankers and other vessels, such as freighters and passenger ships were verified. The expert group meeting produced a total of around fifty different risk scenarios. Potential causes for ship collisions were identified and grouped into cause categories, such as human error, technical failures and external causes, according to the most significant determinant in the cause effect chain of the risk scenario. The risk scenarios were prioritised, and used accordingly as a basis for the modelling and computation of the collision risk in the risk analysis phase of the FSA. The experts consulted represented different relevant areas of expertise: risk assessment techniques, accident investigation, human factors, shipping regulations, the technical, operational and organisational fields of shipping, and environmental protection. The hazard identification phase was supported by a group decision support system (Groupsystem V) that facilitated simultaneous risk scenario generation, commenting and prioritisation by voting. A document summarising the results of the hazard identification phase was produced on-line FSA-STEP 2: RISK ANALYSIS The risk analysis activity was focused on the ship-to-ship collision risk. In particular, only the risks of oil, chemical or gas tankers colliding with passenger vessels, freight vessels, or with each other, were quantified. The collision risk was estimated with respect to the three decision options: Baseline2010 (= do nothing ), System1, and System2, as described in the Introduction. The ship-to-ship collisions were classified according to generic vessel types involved, which were limited to three types: tanker, passenger ship and other. Each vessel type was further divided into two size groups; large and small, as defined in Table 1. The vessel dimensions indicated in Table 1 present the link of the generic vessel types to the vessel size classes implemented in the GRACAT software that were used in the collision frequency calculations. Table 1. Vessel type definitions. Vessel Type Definitions Vessel type Weight (Ktonne) Dimensions (m) Tankers -small L= 170 B= 24 T= large L= 241 B= 40 T= 14.0 Passenger ships -small L= 50 B= 9 T= 2.4 -large L= 177 B= 29 T=6.3 Others -small 3 5 L= 94 B=15 T= 5.6 -large L= 189 B= 32 T=7.75 (All given sizes in tonnes are dead weight tonnes, L= length, B= breadth, T= draught) Acronym Ts Tl Ps Pl Os Ol The generic vessel type 'tanker' includes all tankers regardless of whether they carry oil, chemicals or gas. The vessel type 'passenger ship large' includes, in addition to cruise ships and passenger ferries, all roropassenger ships. The passenger ship small represents high-speed crafts. Finally, the vessel type 'other' includes all other vessels, including general cargo, dry bulk cargo, roro, container and other vessel types carrying neither passengers nor hazardous bulk cargo. The framework used for modelling and computing the ship collision risk is outlined in Fig. 3. Firstly, the latent collision frequency associated with a collision type involving two specific vessel types is calculated given the traffic and routeing data of such vessels. The latent collision frequency represents the amount of collision hazards per unit time assuming blind navigation. The expected collision frequency is then obtained by multiplying the latent collision frequency with the expected value of the Causation Factor related to the collision type (i.e., collision involving two specific vessel types). The expected collision frequency of a collision type is the measure of risk used in the study. The Causation Factor represents the fraction of the vessels that fail to notice the presence of a dangerous encounter situation in time and to react by carrying out sufficient actions to avoid collision. The Causation Factor depends on several functions related to traffic perception, communication and avoidance actions. It also depends on external factors such as the vessel types involved in the potential collision situation, weather conditions, physical manoeuvre options, etc.

4 The Causation Factor was modelled by the Fault Tree technique using the FaultTree Plus V7.0 software. The Collision Fault Trees used to estimate the expected values of the Causation Factor with respect to each of the decision options considered in the study are given in the Appendix. CT 1 causation probability P C CF 1 Baseline 2010 collision type expected collision frequency... GRACAT P C cause factors... System1 Risk Control Options CT n latent collision frequency Traffic data (vessel type, route, volume, etc.) Routeing data CF n System2 Figure 3. Framework for modelling ship-to-ship collision risk The underlying dynamics of the functions related to a Causation Factor were decomposed into two phases: functions related to escalation and functions related to evasive action. The functional failures related to the escalation were structured in more detail, as the impacts of the risk control options System1 and System2 considered in the present study materialise in this phase. The probabilities of the basic events of the Collision Fault Tree were elicited from four experts for each of the three decision options. The experts consulted had experience of different types of vessels, including passenger ship, high speed passenger craft, RoPax and tanker vessels. The experts expressed their estimates in the form of minimal and maximal values in the range [0, 1], which where interpreted as the and percentile points associated with a lognormal probability distribution. The potential error induced by using an improper probability distribution function was considered insignificant compared to other uncertainties in the assessment. Table 2 shows the collision types considered and the associated expected value of the Causation Factor as determined by the Collision Fault Trees for the three decision options. As indicated in Table 2, only such collision types were investigated in the present study where a tanker is involved either as the striking or the struck vessel. Table 2. Collision type and the corresponding expected value of the Causation Factor for the three decision options. Collision types Expected value of Causation Factor (% / 100) Baseline 2010 System1 System2 Tl: Ob 2.17E E E-4 Os 2.84E E E-4 Pb 2.17E E E-4 Ps 2.17E E E-4 Ts 2.84E E E-4 Tl 2.17E E E-4 Ts: Ob 2.84E E E-4 Os 2.84E E E-4 Pb 2.84E E E-4 Ps 2.84E E E-4 Ts 2.84E E E-4 The expected collision frequencies were computed using the frequency module of the GRACAT software. GRACAT (Grounding and Collision Analysis Toolbox) is a prototype software developed by the Technical University of Denmark [5]. With respect to ship-to-ship collisions, the GRACAT software examines separately three different collision scenarios, namely: 1. Head-on collision, in which two vessels collide on a straight leg of a fairway as a result of two-way traffic on the fairway 2. Intersection collision, in which two vessels moving in an opposite direction on the same fairway collide on a turn of the fairway as a result of one of the vessels neglecting or missing the turn (error of omission) and thus coming into contact with the other vessel 3. Crossing collision, in which two vessels using different fairways collide at the fairway crossing In addition, the collision scenario between a vessel following a particular traffic lane and another vessel joining the same lane was considered in the present assessment separately where applicable. The calculation routine implemented in GRACAT for crossing collisions was applied for the assessment of this scenario.

5 The computations of the collision frequencies are based on the specification of the routes and fairways. The amended traffic separation system, taken into account in the GRACAT fairway specifications for the System1 and System2 risk control options, is shown in Fig. 4. In Fig. 5, the GRACAT fairway specification for System1 and System2, is graphically shown. The fairways are defined by waypoints, given by latitude and longitude values. The fairway specification in Fig. 5 includes the east-bound and west-bound main traffic lanes, the northern and the southern coastal fairways, and the connecting fairways to and from the ports. Figure 4. The amended traffic separation system for the Gulf of Finland. Figure 5. Fairway specifications for the GRACAT risk calculations the System1 and System2 decision options.

6 The prevailing traffic image extrapolated for the Gulf of Finland for the years 2010 to 2015 was used as the basis of the computations. The statistical deviation of ships off the mid-fairway was specified for each fairway leg, based on the information on the available traffic lane width, as measured from the nautical charts, and on expert judgement. GRACAT assumes the normal distribution for characterising the spread of vessels off the mid-fairway line. Specification of the traffic distribution for a particular leg thus consisted of defining the representative mean and standard deviation values for the distribution. The influence of the separation zones in restricting the spread of vessels on the traffic lanes was accounted, in particular, regarding the System1 and System2 options implementing the amended ship routeing system. The risk of head-on collisions between vessels using one of the two main traffic lanes and other vessels heading to the opposite direction using the other main traffic lane or the coastal fairway was also considered. The estimated risk however turned out to be only marginal as compared to the estimated overall risk of collisions in the main traffic lanes. The results of the collision risk computations are given in Table 3. The results represent the estimates of the expected yearly frequencies of collisions including oil, chemical or gas tankers. The standard deviations related to the estimates are considered to be of the same magnitude for each of the decision options. Table 3. The estimated expected collision frequencies of the collision types. 1/ 2/ Collision type Expected Collision Frequency (per year) Baseline 2010 System1 System2 Tl: - collisions overall 1/ O (Os+Ol) P (Ps + Pl) Ts Tl Ts: - collisions overall 2/ O (Os+Ol) P (Ps + Pl) Ts Includes collisions with passenger vessels, freight vessels (type Other ) and tankers. Includes collisions with passenger vessels, freight vessels (type Other ) and small tankers. Based on the results, the overall number of collisions involving a large tanker is decreased by 80% in the case of System2 compared to the situation that no additional investments are made to vessel traffic control (i.e., Baseline 2010 ). In the case of System1, the effect is also positive, but marginal. For the small tanker case, the results are found to be very similar. The estimates of the collision frequencies for the Baseline2010 and the System1 are rather high. This is partly explained by the conservative estimates of the input and risk model parameters. Thus the estimates of the expected collision frequencies are upward-biased. The relative risk impact of the options is, however, less sensitive to systematic bias in the case of offset errors. Thus, the cost-benefit estimates for the decision options are more realistic and also more suitable for the comparison of the options than the estimates of the expected collision frequencies. The reason for the poor performance of the 'System1' option in the risk calculations is due to the fact that the Causation Factor values obtained by expert judgements turned out to be very close or even higher for 'System1' as compared to 'Baseline2010'. This is due to the basic event REMA ( Restricted manoeuvre options in critical situation ) in the Collision Fault Trees (see the Appendix)), which was judged to have a relatively high probability of occurrence in case of the System1 option. The reduction in the expected collision frequencies as seen in Table 3 is due to the integrated effect of the amended routeing system and the mandatory ship reporting and the monitoring systems as implemented in the two risk control options under consideration. The amended routeing system, common to both options, has a direct impact in the latent collision frequency. A reduction of about 7 percent in the overall latent collision frequency is expected to be achieved by its implementation. As expected, the most significant improvement is found with respect to the collision types involving small tankers FSA-STEP 3: RISK CONTROL OPTIONS At the outset of the FSA study, two risk control options, System1 and System2, were defined with the specific objective to assess their effectiveness in reducing collision risk. Brainstorming of risk control options, based on the risk model and the results of the risk analysis, was thus not an issue in the FSA study FSA-STEP 4: COST-BENEFIT ANALYSIS The benefit of implementing a VTMIS system was measured in terms of the expected reduced societal cost due to an expected decrease in the number of collisions and related oil spills.

7 It has to be noted that every collision type is related to a certain average oil spill. The probabilities of oil leakage in both, either or neither vessel, given that a collision has occurred, were derived from the probability data given in the MEHRA-report [6]. The average oil spill volumes for the collision types involving a small tanker / large tanker are given in Table 4. Conservative point estimates of the amount of spilled oil have been used. Table 4. Average oil spill volumes of specific collision types. Average Oil Spill of Collision Type (tonnes) Vessel type Tl Ts P O Tl Ts The societal cost associated with ship-to-ship collisions were defined as the sum of overhead costs of the authorities, the cleaning work, and the harm incurred to the environment, where the latter has been estimated by the formula 9,33 * amount of spilled oil in tonnes + 610,7 K¼Ã>@ The expected reduced societal costs related to the VTMIS options System1 and System2 were computed as the difference between the expected societal cost of the Baseline2010 option and the expected societal costs of System1 and System2, respectively. The life cycle of the VTMIS system was assumed to be 10 years. Table 5 shows the net present value of the expected reduced societal cost related to System1 and System2 assuming an interest rate of 6 %. It has to be noted that systematic offset biases in the point estimates of the oil spill volumes are partly cancelled out by the subtractions related to the computations of the expected reduced societal costs. Table 5. The net present value of the expected reduced societal cost due to System1 and System2. Expected Reduced Societal Cost (M¼ System1 912 System The investment costs related to the VTMIS system options System1 and System2 were based on cost figures obtained from each of the nationally responsible parties. The costs included the equipment, the installation and the annual operational costs of the system for the Finnish, Estonian and Russian authorities. Table 6 shows the respective net present value of the life cycle cost of the VTMIS system options as incurred over the life cycle of 10 years. The life cycle cost estimates shown in Table 6 are assumed to be much more accurate than the expected reduced societal cost estimates shown on Table 5. Table 6. The net present value of the life cycle cost of System1 and System2. Life Cycle Cost (M¼ System1 12,8 System2 30,5 As the consequence of the collision risk is measured in monetary terms, the decision criterion used in the risk assessment was naturally obtained from investment analysis, where the investment option with the largest Total Return is preferred, where Total Return = amount received / amount invested The amount received is seen here as the amount of societal costs avoided by investing in the VTMIS system, resulting in fewer ship-to-ship collisions and subsequent oil spills. Obviously, the Total Return values related to all decision options are random variables with different mean values. The standard deviations are of the same magnitude for all options. Thus, it suffices to compare the VTMIS system options in terms of expected Total Return only (i.e., standard mean-variance portfolio analysis). Table 7 shows the calculated expected Total Returns of System1 and System2. For VTMIS systems with the expected Total Return value larger than 1, the economic benefits are expected to exceed the costs of implementing the system. Based on the results shown on Table 7, both VTMIS systems considered here were found to be justifiable from an economic point of view, however, with System2 heavily out ranking System1. Table 7. The expected Total Return of System1 and System2. Expected Total Return (% / 100) System1 64 System FSA-STEP 5: RECOMMENDATIONS FOR DECISION-MAKING As the consequences of collision risk were measured in monetary terms only, the ALARP-criteria [8] were not feasible in judging the relative merits of the VTMIS system options. The evaluation of the acceptability of the level of risk represented by the option Baseline2010 was also unfeasible in this sense.

8 Both VTMIS system options assessed in the FSA study were found to decrease the risk of ship-to-ship collisions, and thus to be capable to improve the safety of shipping and protection of the marine environment in the Gulf of Finland considering the foreseen significant increase in vessel traffic in the gulf area. From an economic point of view, the investment in the VTMIS system option System2 can be recommended based on the cost-benefit analysis (or mean-variance portfolio analysis). The effects of the conservative (pessimistic) point estimates of the risk model parameters are partly cancelled out in the calculations of the Total Return. An over-optimistic indication for investing in the System2 option is thus avoided to some extent. Furthermore, some credible collision types (for example, collisions between passenger vessels and between freight vessels) were not considered at all as indicated in Table 3. Consequently, benefits in terms of the reduction of societal costs related to these collision types are not taken into account in the present cost benefit analysis. Uncertainty and sensitivity analyses were not conducted to reveal the most critical risk model assumptions and parameters. This was partly due to the mixture of the Fault Tree and the GRACAT methods for modelling and computing risk. An integration of the methods is a prerequisite for such analyses to be feasible in a consistent manner. It is, however, the belief of the analysts that the main uncertainties in the present study pertain to the expert judgements related to the parameter estimation of the basic events of the Collision Fault Trees. The clear indication of profitability in investing in System2, however, suggests that a fine-tuning of the risk model is not crucial for a discrimination of the given VTMIS options and the indication of the economic attractiveness of the System2 option. 3. CONCLUSIONS The FSA study was focused on the risk impact of the VTMIS system proposed by the Maritime Administrations of Finland, Estonia and Russia for reducing the risk of ship-to-ship collisions and related oil spills in the Gulf of Finland. The study assessed the effectiveness of two particular VTMIS system implementation options in reducing the risk and improving traffic safety during the open sea period. Despite the constraints in the scope and the numerous assumptions of the risk model and the GRACAT simulation method, it is argued that from an economic point of view the investment in the System2 option is clearly recommendable. As required by the decision-making process of the International Maritime Organisation (IMO), the FSA was conducted to support the proposal for new regulation related to the implementation of a VTMIS system for the Gulf of Finland. 4. REFERENCES 1. VTT. Statistical Analyses of the Baltic Maritime Traffic. Research report VAL VTT Industrial Systems, Espoo, Finland, MSA. Formal Safety Assessment. MSC 66/14. IMO, London, IMO. Formal Safety Assessment: Interim guidelines for FSA application to the IMO rule-making process. MEPC 40/16, VTT. The implementation of the VTMIS-system for the Gulf of Finland. VTT-Report VAL VTT Industrial Systems, Espoo, Finland, ISESO. User manual for GRACAT Grounding and Collision Analysis Toolbox. Document ID I107/I A, SAFETEC UK. Identification of Marine Environmental High Risk Areas (MEHRAs) in the UK. Doc. No.: ST-8639-MI-1-Rev 01. December VTT. Kustannus-hyöty analyysi Saaristomerelle suunnitellulle meriliikenteen hallinta- ja informaatiojärjeselmälle. VTT Report VALC29. VTT Manufacturing Technology, Espoo, Finland, MELCHERS, R.E. On the ALARP approach to risk management. Reliability Engineering & System Safety 71, , Based on the study results, the annual number of ship collisions involving tankers is expected to be decreased by 80% by investing in the System2 option - a VTMIS system comprising of a new ship routeing system, a mandatory ship reporting system and a radar-based monitoring system. The expected total return of the investment in System2 is almost 300.

9 APPENDIX Baseline page 1 Control of critical situation

10 APPENDIX Baseline page 2, Escalation of collision

11 APPENDIX System1 page 1 Control of critical situation

12 APPENDIX System1 page 2, Escalation of collision

13 APPENDIX System2 page 1 Control of critical situation

14 APPENDIX System2 page 2, Escalation of collision