OPERATIONAL RISK ASSESSMENT FOR AIRSPACE PLANNING

Transcription

1 OPERATIONAL RISK ASSESSMENT FOR AIRSPACE PLANNING Karim Mehadhebi Direction des Services de la Navigation Aérienne Toulouse, France Abstract ICAO policy requires that States maintain an acceptable level of safety in the provision of air traffic services (ATS). As a consequence, airspace planners have to adapt this high level safety requirement in the context of their specific operational environment, whenever they lement a new procedure. The main difficulty lies in the nature of the risk, which, over the years, has gradually switched from a technical risk (due to either a failure or a poor performance of technical equipment), to an operational risk.in other terms, although the performance of navigation and surveillance has drastically roved over the years, the level of safety (expressed in terms of fatal accidents per flying hours) has not followed the same evolution. One of the reasons is that, for some scenarios of operational errors, the accuracy of navigation contributes to increase the risk of, as we show in the sequel of this paper. In this paper we span the current methodologies used for quantitative risk assessment, and we explain their limitations for modeling scenarios of operational errors. Then, we introduce a new methodology, supported by an analytical risk modeling together with a software lementation, and we present two applications of this methodology, one involving the assessment of the operational risk in a given part of the airspace, and another one for the detection of hot spots. Collision risk modeling applied to airspace planning In ICAO documentation, the reference of highest level regarding the use of risk models is the DOC 9689, Manual on Airspace Planning Methodology for the Determination of Separation Minima ([]). In this document, the risk assessment determined by a risk model (CRM) is decomed in two independent components. The first component represents the influence of the route network on the risk, in terms of how often a pair of aircraft is likely to fall into a given scenario of accident. The second component, which depends on the performance capability of the environment, corresponds to the probability of associated to the pair of aircraft. It is within this second component that the aircraft navigation performance, the ground and airborne communication performance, and the surveillance performance are taken into account. What kind of operational hazard can be modeled by current CRMs, and what kind of operational hazard can not? It is clear that CRMs currently introduced in Ref [] are not sufficient for modeling all situations, as separation minima for radar surveillance clearly illustrate. Initially, separation minima could be derived from the ition errors due to radar measurement, but as the number of radars was increasing and the accuracy was roving, it became clear that, although a multi-radar measurement could have a very good accuracy, separation minima could not be reduced accordingly. As for the connection between navigation performance and the resulting risk, the analysis of TCAS alerts has revealed that, in some occasions, the risk was increased by the navigational accuracy of the aircraft. For instance, if an aircraft climbs to a flight level for which it was not cleared, it is precisely its lateral accuracy which will cause a risk of with another aircraft on the same route at that flight level. Therefore, we see that navigational errors can contribute to the safety. However, in current CRMs, ition errors due to navigation performance and surveillance error are considered similarly, and added into a total error. An intuitive illustration of the modeling of risk in the CRMs of Ref [] is shown in Figure, for two co-altitude aircraft on parallel routes. Aircraft are initially seen by the air traffic controller as separated, which may not be the case if we consider the inaccuracy of the surveillance. The risk of is the risk that the navigational errors lead both aircraft to reduce their relative distance until they eventually collide in a future time. - -

2 initial reported ition Likelihood of the in this location Separation S Figure : Modelling of risk in current CRMs Justification of the current stochastic modeling of uncertainties The modeling of ition errors as a stochastic process is perfectly valid in environments where aircraft itions are not updated too frequently (as in procedural airspace, or in ADS-C). Actually, between two consecutive ition reports, an aircraft is likely to deviate significantly from its assigned route, due to multiple causes (either technical or operational). Therefore, it is reasonable to model the deviation from the assigned route as a random quantity, whose cone of uncertainty is likely to vary with the time. Another situation where this model applies is when the surveillance uses onboard information. In radar surveillance for instance, the vertical ition of the aircraft corresponds to the Mode C code. If this information is corrupted by a technical cause (problem in the altimetry system for instance), then the air traffic controller is unable to detect and to correct this error. The stochastic modeling allows to represent all kinds of evolution of this error in the course of time (such as a drift, for instance). Limitation of the current modeling from the ATC s viewpoint With such a modeling, it is not easy to explain why an roved navigational performance can increase the risk of. The reason is that the deviations from the assigned route are modeled as random excursions, whereas in many cases of operational errors we know exactly what the deviation will be, without any need to use random modeling. In order to clarify this idea, we consider an environment like the French continental airspace, where, in multi-radar environment, itions are reported to the controller s scope every 4 seconds (for two radars). The multi-radar processing makes the ition fairly accurate, so that the ition displayed on the controller s scope represents the actual ition of the aircraft, corrupted by a small error due to the radar processing and the latency. This latency may also corrupt the speed vector, in the case, for instance, of a change of manoeuvre from the aircraft. When aircraft itions are updated every four seconds, the modelling of random deviations shown in Figure no longer applies, since the frequent updates does not allow aircraft to significantly deviate between consecutive ition updates. In that case, we believe that the main cause for the risk of has to be sought in scenarios where the trajectory anticipation made by the ATC no longer corresponds to the reality of an aircraft trajectory. In the sequel of this paper, we will denote such scenarios of bad anticipation by the ATC as operational errors. In the vertical dimension, a typical scenario of operational error is the following: One aircraft is in vertical evolution, and the ATC expects this aircraft to level off at a given FL, but this aircraft keeps on climbing/descending. In the horizontal dimension, another typical scenario of operational error corresponds to the case where one aircraft is expected to turn, but keeps on in straight line. The two previous scenarios are denoted by straight line scenarios of operational error, in the sense that in both cases the aircraft follows its route in straight line, either in vertical or in horizontal dimension. We may also consider a straight line scenario for the speed, in the case of two aircraft flying one behind the other, and the ATC would instruct the queuing aircraft to reduce its speed, without being obeyed. For such scenarios of operational errors, there is no benefit in adding random ition errors to our modelling, as we now explain. Figure shows such an example of operational scenario, where an aircraft keeps on climbing instead of leveling off at his cleared FL. In this situation, we know by advance that the trajectory for this scenario is roughly an extrapolation from the climbing phase of the aircraft. If we assume that the climbing aircraft and the steady aircraft are on the same horizontal route, then in case of an operational error the introduction of a lateral error will reduce the risk of. In other terms, it is precisely because aircraft have an excellent navigation accuracy that the operational error has higher chances to result in a. We see the difference with the paradigm of Figure, where the risk of was due to the introduction of ition errors from the assigned routes. In scenarios of operational errors such as in Figure, the introduction of ition errors tends to reduce the assessment of the risk.

3 In the RVSM safety assessment made by UK, different scenarios of operational errors have also been modeled in terms of deterministic trajectories (see Reference [3]). as risk models, where the risk of is determined by stochastic modeling of random deviations. FHA FL Possible operational error Determination of safety objectives Hazards for numerical assessment Classified hazards and related safety objectives Real trajectories PSSA Derivation of risk mitigation strategy CRM Safety requirements SSA Verification that safety requirements have been met Figure : Deterministic trajectory for an operational error It was found that the risk estimate given by this modeling was more conservative that another risk estimate based on the Reich model (see Ref [] for a description of the Reich Model). We believe that the modeling of scenarios of operational errors by deterministic trajectories often provides a satisfactory answer to the estimation of a risk induced by a scenario of operational hazard. For such a modeling, the risk is a consequence of the following factors: ) What if the arrival time of the steady aircraft at the vertical colliding point had been slightly different? ) How long would it take to the controller to detect this operational error? 3) What would be the chance for the controller to solve the operational error before the? Before introducing our methodology, we now consider the limitations of another widely used safety assessment methodology, based on EUROCONTROL EATMP Safety Assessment Methodology. Limitations of qualitative safety assessment methodologies Introduction of the methodology The word qualitative refers to the fact that in this methodology the scenarios of operational errors are determined qualitatively, either by brainstorming or by operational experts. This differs from quantitative safety assessment methodologies such Figure 3: Architecture of qualitative safety assessment methodologies Figure 3 shows the general architecture of this qualitative safety assessment methodology. Initially, a high level safety requirement is defined, similar to the acceptable level of safety defined in ICAO documentations. This safety requirement is often denoted as a Target Level of Safety (TLS). The pure of the safety assessment methodology is to demonstrate that the current environment meets this TLS. Schematically, the demonstration is done in three consecutive steps: ) The Functional Hazard Assessment (FHA) identifies potential operational hazards and assesses their effects on the safety of operations. It outputs the classified (in compliance with ESARR 4 severity classification scheme) hazards and their associated safety objectives. Operational hazards together with their severity are coupled together into fault trees with AND/OR gates. ) Based on the TLS, The Preliminary System Safety Assessment (PSSA) determines the maximal frequency of occurrence of the operational hazards, in order to meet the TLS. 3) The SSA (System Safety Assessment) demonstrates that the current system meets the TLS, by checking that the frequency of occurrence of the operational hazards is not higher than the maximal rate determined in the PSSA. In the architecture of Figure 3 we have also shown the connection between this qualitative methodology and the risk modeling methodology. If a given operational hazard can be modeled by a risk model, then it is sible to assess its severity in a more objective 3

4 way than with the FHA process. Actually, in a FHA, the severity is assessed by expert judgment. Limitations of the methodology for assessing operational risk We now exe some limitations of this methodology for the assessment of operational risk. The first limitation stems from the classification of operational hazards made in the FHA. For all operational hazards identified in the FHA, a fixed severity has to be determined. However, in the real life, this severity depends on the underlying context. This context includes both the ATC (what was the ATC workload?) and the aircraft parameters. In addition, a parameter may have several effects, of opite nature. For instance, in the case of the operational hazard illustrated in Figure (a flight level overshoot), the fact that the climbing aircraft has a high climbing rate simultaneously reduces the intervention time for the controller, and the crossing time of the climbing aircraft when it crosses the FL of the steady aircraft. In our opinion, the obligation to associate to all operational hazards a severity independent of the context is the major limitation of this methodology, and we will see in the sequel of this paper how our methodology has attempted to overcome this limitation. Another limitation of the methodology has to do with the SSA step. The objective of the SSA is to check that the frequency of operational hazards in the current system is not higher than the upper bound value determined in the PSSA. This is done by processing all reported incidents. Now, if we consider a scenario of operational error consisting in a bad anticipation of the future trajectory of an aircraft (as our straight line scenarios previously introduced), this scenario will not necessarily result in an incident. For instance, a flight level overshoot similar to the one shown in Figure may well be undetected if there was no other aircraft in the vicinity. Even if all incidents have been collected and analyzed, what is still missing is the probability for an operational hazard to result in an incident. In order to clarify this idea, we give a sle example. We supe that, in a safety assessment, the PSSA has determined that the occurrence of flight level overshoots (similar to Figure ) in a given area should not exceed 0 occurrences per year. We also supe that in one year 4 incidents have been reported, due to a flight level overshoot. If the probability for a flight level overshoot to result in an incident is found to be equal to /3, then the expected number of flight level overshoots which occurred during the year can be estimated as 4, which is higher than the upper bound / 3 value of 0. Synthesis and introduction of our methodology The methodology that we now introduce has been designed in order to overcome the limitations explained in the previous section. We recall our definition of an operational error, which encompasses all scenarios where the anticipation made by the ATC does not correspond to the reality of the trajectory. This includes all straight line scenarios (the aircraft is expected by the controller to do something but he continues in straight line), but other operational scenarios can be considered, where the aircraft would deviate from its route. Such situations occur, for instance, when the ATC confuse two call signs, or when a pilot executes an ATC instruction which was issued to another aircraft. The pure of the methodology is to estimate the risk of resulting from a given scenario of operational error, and to better understand the connection between this risk and the underlying environment. Our methodology is supported by a stochastic modeling of the risk induced by a given operational error, and it has been lemented into a software. We firstly introduce our stochastic modeling, and then we present the current software lementation. Stochastic modeling of the risk induced by an operational error Until now, only the straight line scenarios have been lemented in our stochastic modeling. They represent by far the most frequent occurrences of operational error (particularly in the vertical dimension). «Straight line» trajectory modification :the deviating aircraft follows his route: in the horizontal plane or in the vertical dimension Figure 4: straight line scenarios of operational error 4

5 For both scenarios, we assume that the horizontal or vertical maneuver made by the aircraft was due to a loss of separation with the neighboring aircraft. FL tp z Figure 5: modeling of time uncertainties Our modeling of uncertainties is time oriented rather than ition error oriented. We mean that, instead of inserting ition errors as in current CRMs, we assume that an aircraft flying along its trajectory could have arrived at a given point slightly earlier or later. We also assume that an aircraft cleared to change its FL could as well have started its vertical evolution slightly earlier or later. Figure 5 illustrates our modeling. The along track error (corresponding to a delay or an anticipation) is denoted by t p. The uncertainty on the starting time of a vertical evolution is denoted by tc. The magnitude of these errors is determined by the current separation in the airspace. For two aircraft flying in straight line with a crossing angle denoted byθ, a quick computation shows that the minimal horizontal distance for the pair of aircraft is given by D tc min th th () V + V V V cosθ tp VV sinθ where th and th are the two times of arrival at the crossing point. Therefore, in our methodology, we assume that the difference between the time of arrival of both aircraft at the crossing point follows a uniform distribution on the interval [ T ], with p T p V + V V V cosθ T p Sephor () VV sinθ Sep And hor is the value of the horizontal separation. Our modeling means that, relatively to one aircraft, the other aircraft could have arrived at the crossing point slightly earlier or later, provided that both aircraft were in the course of losing their horizontal separation. This results from our previous assumption that the maneuver instructed t time by the ATC was due to the fact that the maneuvering aircraft was in the course of a loss of separation with another aircraft. Similarly, we see on Figure 5 that the uncertainty t c induces, at a fixed time, a vertical uncertainty z with z v z t c, where v z is the vertical speed. This suffices to determine the magnitude of the uncertainty tc in order to guarantee that the pair of aircraft will pass vertically within the vertical separationsep. In conclusion, we vert assume that, for each aircraft, the time uncertainty t c is uniformly distributed on an interval [ Tc, T c ] where the value of Tc is chosen so as to verify that both aircraft will vertically pass within a vertical distance belowsep vert. The rational is similar to the horizontal case: we assume that the maneuver was due to a conflict solving from the controller from a proximate loss of separation. We now give, for the pair of aircraft, the associated probability of, in the slified case where both aircraft follow a straight line route, with a crossing angle denoted byθ. We have not provided any analytical derivation due to the limitation on the length of the paper, but the reader interested by it can either ask it by to the author or read Reference [5]. The two aircraft are modeled by cylinders, whose diameter is denoted by λ xy and whose height is denoted byλ z. The corresponds to the intersection of the two cylinders. In the case when the two aircraft fly in straight line, the probability of for the pair of aircraft differs whether one or two aircraft are in vertical evolution. In the case when the two aircraft are in vertical evolution, the probability of is given by Pr { } a v with a v λxyvrel VV sinθ T vz, v vz, v z, z, z, z, Tc Tc p πλ xy λz + Vrel δv z ( a + a) (3) Where the relative horizontal speed is given by Vrel V + V V V cosθ, the relative vertical speed is given by δv z, and the vertical speed of the two aircraft are given by vz, and v z,. 5

6 If one aircraft is in vertical evolution and the second one is steady, the probability of is given by Pr { } πλxy λz + Vrelλxy Vrel δvz VV sinθ T T p c (4) We have added to our model a probability for the controller to detect and to solve the conflict. The probability for the controller to solve the conflict is a function of the available time. If the air traffic controller has less than t, then he does not have sufficient time to solve the conflict. If he has more than t, then he can solve the conflict. Between these two values, the distribution function is interpolated linearly, as shown in Figure 6. The detection time of the controller has been modeled as a itive random variable with an exponential distribution. The justification for this choice of distribution is given in Appendix A. 0 P solve t t Figure 6: probability to solve the operational error as a function of the available time If we denote by λ the parameter of the exponential distribution, we find that the probability for the controller to detect and solve the operational error is a function of the available time before the, denoted byt. This probability, denoted by, PATC is given by : If T < t, P 0. If P If P ATC ATC e e λ λ ATC t < T t, ( T t ) λ ( T t ) + ( t t )λ t T, ( T t ) λ ( t t e ) λ ( t t ) + ( t t )λ Finally, the probability of is given by { } ( ) Pr P ATC (5) When the pairs of aircraft are extracted from real radar data, the situation is often more complex, since one or the two aircraft may not fly in straight line. Nevertheless, the probabilistic modeling can be extended to these cases by following the same approach. Software lementation The software takes as inputs files of collected radar data, and determines the encounters of aircraft likely to result in an operational error, either in vertical or in horizontal. Before introducing the applications of the software for safety studies, we introduce the general methodology for processing radar data. A typical application of the software involves the following tasks, which are done in sequence. Smoothing of radar data. Each aircraft trajectory is smoothed individually, and aircraft itions are determined with a fixed time, generally of 5 seconds. In addition to this, the horizontal and vertical maneuvers of the aircraft are detected. Detection of encounters. After the previous step, the collected radar data consists of synchronous aircraft itions (usually one ition every 5 seconds). Then, the whole traffic is played, and pairs of aircraft likely to result in an operational error are identified as encounters. For each encounter, the software stores a certain duration of the trajectory before and after the change of maneuver. All this can be tuned by the user. Post processing of the encounters. Then, each encounter is processed a second time. Actually, it is imsible to interpret the scenario of operational error by playing the traffic in real time, this is why the interpretation of the operational error is done afterwards. During this t processing, all encounters which do not correspond to the horizontal or vertical straight line scenario are discarded. Edition of the encounters. Finally, the encounters which are determined are stored into a file with a special format. These files can be opened by our software, and the conflicts can be edited and visualized. Smoothing of radar data The algorithm use weighted roughness spline functions, which are smoothing function whose rigidity can be set locally (see Ref [4]). The principle of the algorithm is to smooth each trajectory twice. After the first smoothing, the rogue points are identified and excluded, and the 6

7 maneuvers are detected. Then, the rigidity of the smoother is set at a high level in the straight line portions of the trajectory, and at a low level in the maneuvers. The trajectory is then smoothed a second time, with the values of the rigidity of the spline defined previously. Figure 7 illustrates the HMI of the smoother. The user can refine the choice of the parameters for the smoother, and edit all trajectories in a two-view panel, enabling to observe simultaneously joint parameters. In Figure 7, we see on a top view the X/Y trajectory of the aircraft, and on the bottom view the corresponding heading. The blue bullet indicates the ition of the aircraft on each curve. The parameters are selected in order to make the change of heading as abrupt as sible, without anticipation or delay in the value of the heading. Edition of the encounters The encounters determined in the detection and the t-processing phase are then stored into a file. This file can be opened by our software, and the encounters can be classified, sorted, and played. Figure 9 shows the panel editor for the encounters. This panel allows to play the encounter, and to check the validity of our modeling of the operational error. Displayed fields Current conflict parameters Horizontal view Current aircraft itions Conflict fields to display Time slider Current flight parameters Vertical view Figure 7: Detection of a turn Figure 8 shows, on the top view, the vertical profile of the trajectory (time in horizontal, and FL in vertical), whereas the bottom view shows the speed profile (time in horizontal, and speed in vertical). We see that the speed change due to the climbing phase is well detected. The yellow points on the bottom view represent the speed estimation made by the local radar tracking, whereas the red curve shows the speed profile determined by the software once the maneuvers on speed have been determined. Aircraft ition Figure 8: Detection of speed maneuver Figure 9: Edition panel for the encounters The operational scenario of error (in the case of Figure 9, a flight level overshoot) is represented by a blue bullet. The aircraft trajectory corresponding to the scenario of operational error is also represented by a red segment. We now present the scenarios of operational errors currently lemented in the software. Scenarios of operational errors There are currently 8 scenarios of operational errors processed by the software, all corresponding to straight line scenarios, either in the horizontal, the vertical or the speed dimension. We illustrate below two scenarios, one in vertical and one in horizontal The crossing points are represented by big bullets. The red crossing point corresponds to the actual crossing, whereas the blue bullet corresponds to the location of the crossing in the case of the operational error. The scenario of operational error, denoted by VERT_DOWN, applies to an encounter where one aircraft is steady at a flight level, and the other aircraft descends and stabilizes at an upper flight level. An example is given in Figure 0. The trajectories cross in the horizontal plane. The scenario of operational error illustrated on Figure, denoted by HOR_STRAIGHT, applies to situations where both aircraft trajectories intersect in horizontal. The operational error corresponds to a situation where one aircraft does not turn and goes in straight line, causing both 7

8 aircraft to intersect closer than in the current trajectory. Vertical intersection in case of operational error First aircraft stops descending Horizontal intersection Figure 0: illustration of the VERT_DOWN scenario of operational error Figure : illustration of the HOR_STRAIGHT scenario of operational error Application of the methodology to safety assessment We now present two applications: the estimation of the risk associated to a given scenario of operational error, and the detection of hot spots. Estimation of the risk associated to a scenario of operational error Incidents are modeled by the fact that the two aircraft are simultaneously below a horizontal and a vertical threshold which can be defined by the user (for instance,.5 Nm in horizontal and 500 ft in vertical). We recall that in the risk model, aircraft are modeled as cylinder, having diameter λxy and height z λ. Typical values for these two parameters are λxy 45m and λ z 5m. By taking different values for λxy and λ z, it is sible to estimate the probability for any kind of airmiss for the two aircraft. By summing up, for all the encounters, the corresponding probabilities, we obtain the average number of incidents, under the assumption that all the encounters result in an operational error. We now explain how to estimate a frequency of incidents. We assume, for example, that the radar data files encompass a whole week of collected radar data. We then perform in sequence the following tasks: ) We process the whole week, and we determine all the encounters corresponding to the scenario. ) For each encounter, we determine the associated probability for the encounter to result in an incident. 3) We sum all the corresponding probabilities corresponding to the scenario of operational error that we are interested in. If, say, the overall sum of probabilities for the VERT_UP scenario equals 00, then this figure of 00 represents the number of incidents which would be observed per week under the assumption that the operational error happens all the time. Then, we conclude that the number of incidents, per year, would be00 5, always under the previous assumption. Finally, if we know that the real number incidents for the operational scenario, in the previous year, was of 3 incidents, then we estimate the probability for an encounter to 3 result in an operational error as The previous probability represents the probability of occurrence of the operational error for a given encounter determined by the software. We denote it 3 by p occur, so that poccur in our 00 5 example. Now the software determines, for any encounter, the probability of, under the 8

9 assumption that the corresponding operational error happens for the encounter. We denote this latter probability by p encounter. We have seen in the previous subsection how to determine the probability of occurrence of the operational error for a given encounter. We deduce that the probability of for the encounter, p, is given by p poccur pencounter. By summing up all the p for all the encounters determined during the week of collected data, we find a expected number of s, that we denote by N. Finally, we determine the total flying time over the week, that we denote by T fly, and the risk, expressed in terms of number of per flying hour, is given by N T Detection of hot spots The second application is the detection of hot spots. Once the encounters have been determined, it is sible to display them geographically, as shown in Figure, together with the trajectories of steady aircraft. The green encounters correspond to scenarios of operational error in vertical, whereas the red/pink ones correspond to scenarios of operational errors in horizontal. fly. Figure 3: subset of encounters where the time before was lower than 40 seconds We see that most of these encounters are focused on a specific area and that in this specific area most of the encounters are still scenarios of operational errors in vertical. It is also sible to display parameters associated to a selection of encounters. For instance, having selected the encounters in the dotted oval of Figure 3, we represent them on Figure 4 by a two dimensional diagram showing the FL (in vertical) and the time before (TCOL) in horizontal: Figure 4: two dimensional display of the encounters We see that most of these encounters occur between FL50 and FL350. Figure : All encounters for one day of collected traffic We see that most encounters correspond to vertical scenarios, and the link between the routes and the encounters becomes apparent. If we retain among the previous encounters those where the time available before the was below 40 seconds, we obtain the following Figure. Further work The methodology presented in this paper is still in evolution. We plan, in the future, to add detection and interpretation of the instructions given by the ATC, by including into the methodology the flight plan information, and by detecting and interpreting all deviations from the flight plan route. This would allow to characterize not only the operational risk, but also to model the ATC cognitive workload, in terms of number of encounters, stress associated to the encounters depending on their gravity, and so on. 9

10 References [] Air Traffic Management, ICAO Doc 4444/ATM/50, 00 [] Manual on Airspace Planning Methodology for the Determination of Separation Minima, ICAO Doc 9689, 998 [3] Marcus Dacre, Estimating Collision Risk for UK RVSM, ICAO SASP-WG/WHL/- WP/4 [4] Carl De Boor, Calculation of the Smoothing Spline with Weighted Roughness Measure (998), manuscript can be obtained at deboor/ftpreadme.html (Madison) [5] Karim Mehadhebi, Presentation and Software Implementation of a 3D CRM, Eurocontrol MDG/30-DP/0 Appendix In this appendix we justify our choice of an exponential distribution of the ATC detection time, using the hazard rate concept drawn from survival analysis. Any itive random variable T can be seen as a life duration. A realization of T becomes the life duration of a given individual among a population. Now, the conditional probability for an individual to die between t and t+ day, given that he has survived until time t, is denoted in survival analysis as the hazard rate. If we denote it by, it is defined analytically by λ (t) λ () t dt lim 0 Pr { t + dt > T t T t} ( the survival function of T, the previous Equation becomes dt If we denote by F t) Pr{ T > t} λ () t limdt 0 F'( t) F( t) F ( t + dt) F( t) F( t) dt controller to detect that an aircraft has deviated from its cleared route. If we give to our hazard rate an increasing shape, it means that the longer the operational error has been lasting, the more chances the controller has to finally detect it. This is the case for normal operation, when the controller routinely checks its scope. A decreasing shape for our hazard rate would be overly pessimistic, meaning that if the controller has not detected quickly the operational error, he has less and less chances to detect it over the time. A good modeling of a human error is to take a constant rate, meaning that it is not because the controller has not detected the operational error over T seconds that he is more likely to detect it in the next second. Taking λ constant in Equation (6) gives F( t) exp( λ t), which is the survival function of an exponential distribution. Author Biography Karim Mehadhebi graduated from Ecole Polytechnique. He holds a MSc in Artificial Intelligence from Université Paul Sabatier (Toulouse) and a MSc in Computer Science from Mc Gill University (Montreal). His main activity is the design and lementation of software in fields involving both mathematical and algorithmic expertise, such as radar trajectory smoothing by spline techniques, radar bias tuning by generalized regression, and risk assessment by designing and lementing risk models. He represents DSNA within the ICAO SASP (Separation and Airspace Safety Panel) and has contributed to the work of the Eurocontrol MDG (Mathematics Drafting Group). And by integration and using the fact that we finally find that { T > 0} F(0) Pr ( t) e t F 0 λ ( u) du (6) In our case, we have to model a human behavior of non detection of an unexpected deviation from an aircraft. We want to determine the probability density function of the duration time for the 0