Identification of emergent hazards and behaviour Shifting the boundary between unimaginable and imaginable hazards Hans de Jong and Henk lom (NLR) Eurocontrol Safety R&D Seminar, arcelona, 26 October 2006
Introduction Four generations in hazard identification 1 the functional approach 2 the HZOP approach 3 the pure brainstorming approach 4 the modeling and simulation approach Use a runway crossing operation for illustration hazards How do subsets of hazards identified by the various approaches relate eyond hazards interactions and dynamical behaviour play a key role in interpreting safety risks 2
3 runway crossing operation few years ago, Runway 18R/36L was introducted at msterdam irport Schiphol 18R 36L 18C 36C
0 9 runway crossing operation To limit taxiing times to/from 18R/36L, initially crossings over 18C/36C were considered ICO recommends not to introduce active runway crossings when developing airports In order to deal with this, introduce new control concept: the runway controller responsible for all traffic on/around runway direct communication with all this traffic runway incursion alerting system (RIS) stop bar violation alerts runway incursion alerts To/from Runway 18R/36L VM V N9 V P5 P4 W9 W8 W3 36 C 36C W10 18C W6 W7 W10 W5 C 1 8 W4 23 24 25 26 27 28 V W2 W1 W W 22 09 S N5 21 R S irport centre S2 4 19 19 1
5 runway crossing operation
Hazard identification the functional approach Hazard: anything that might negatively influence safety identifying as many hazards as possible is prerequisite unidentified hazards lead to too optimistic perspective The functional approach to hazard identification is wellknown from system engineering determine for each function, including human operator tasks, all possible failure conditions and their effects for instance contained in FH of Eurocontrol s SM V1 6
Example application I n FH kind of safety assessment for the aforementioned runway crossing operations yielded, inter alia, The RIS safety related performance budgets shall be: a minimum availability of the total RIS functionality of 99.9%... a minimum human reliability in responding to a warning issued by the RIS of 99.995%... How about that These and other requirements were used in the development of the operations and especially the RIS 7
Hazard identification HZOP HZOP (Hazard and Operability study) identifies and analyses hazards with operational experts involves brainstorming along keywords also non-functional hazards can be identified HZOP sessions are also used to assess risks and identify potential solutions for hazards Unfortunately analysis and solution disturb the identification process potential solutions may introduce new hazards 8
Hazard identification pure brainstorming NLR has recognized issues with FH and HZOP and developed a pure brainstorming approach with TCo and pilot no analysis and no solving TCo and pilot need to be able to play devil s advocates criticism is forbidden the risk associated with the hazard is not relevant yet rather mention another hazard! a moderator needs to steer the hazard identification subtly along several dimensions conflict scenarios, flight phases, service provision aspects,... keep the brainstorming group as small as possible! TCo, pilot, moderator/note taker, (expert on operation) better repeat it with another group! short sessions and many coffee breaks and... 9
10... bottles of wine for the most creative hazard the last hazard and inspriation, if necessary... Hazard identification pure brainstorming
Hazard identification pure brainstorming The pure brainstorming approach to hazard identification incorporated in Eurocontrol SM Version 2 FH Chapter 3 Guidance Material 2: Identification of hazards How to make imaginable the hazards that are functionally unimaginable available from hdejong@nlr.nl The functional and pure brainstorming approach complement each other apply brainstorming first! or use a fresh team 11
Example application II safety assessment of the crossing operation used pure brainstorming which yielded about 100 hazards: h1: Runway incursion alerting system reacts late or not h2: System gives nuisance alert h3: Pilot misunderstands TCo and takes off erroneously h4: System gives alert, TCo doesn t react appropriately h5: Pilot on the wrong frequency h6: TCo abuses alerting system for efficiency reasons h7: Pilot triggered by the elapsing of prescribed wake vortex separation time with previous take-off and takes off without clearance h8: Pilot on incorrect frequency eventually takes off independently h9: Pilot has the wrong awareness/ is mistaken/ confused/ lost due to taxiway complexity and unintendingly enters runway functional approach pure brainstorming approach 12
0 9 Example application II h9: pilot lost due to complex taxiway structure accidentally enters the runway may concern an aircraft not intending to cross! was not identified in the first safety assessment (functionally) unimaginable The second safety assessment showed that the risk of h9 and similar hazards was very high r/t communication is a bottleneck a perfect RIS would not improve much... Redevelopment of the operation pass active Runway 18C/36C via perimeter no RIS for the time being To/from Runway 18R/36L VM V N9 V P5 P4 W9 W8 W3 36 C 36C W10 18C W6 W7 W10 W5 C 1 8 W4 W2 23 24 25 26 27 28 V W1 W W 22 09 S N5 21 R S 13 irport centre S2 19 19 1
Hazard identification a graphical impression How do the subsets of hazards identified by functional and pure brainstorming approaches compare However, you are still not exhaustive How to improve further ll hazards associated with an operation Hazards identified by functional approach Functionally unimaginable hazards Hazards identified by pure brainstorming approach 14
Monte Carlo model simulation Model the behaviour of the elements of the operations, e.g. controller (monitoring, communicating,...) surveillance system and RIS communication system pilots taxiing aircraft arriving/departing aircraft weather conditions and the interactions between these elements, e.g. controller noticing aircraft approaching runway (or not) pilots braking the departing aircraft r/t calls blocking others and causing delay in instructions ehaviour is modeled dynamically and stochastically 15
Modeling, simulation and hazards You try to model how elements and interactions normally behave and also how things go when things go wrong Make the models sufficiently rich so that their behaviour may exhibit the hazards identified In systematic modeling, even more hazards are identified entrance via exit entrance via exit,, C, D,... departing pilots misunderstands clearance taxiing... In simulation, many combinations of hazards arise taxiing aircraft lost and delayed instruction to departing pilot and dynamics turns out to be crucial... 16
17 How on earth to handle this complexity
0 9 Example application III safety assessment with Monte Carlo model simulations has been performed for redeveloped operation Some of the interesting results lost pilots indeed a big safety risk controller identifies good share of conflicts, but contribution to timely resolution is small many resolution instructions concern conflicts already solved by pilots many instructions are too late for the pilots to avoid successfully a collision the taxiing pilots have the largest capability to prevent a collision These dependencies, interactions and dynamical aspects are difficult to handle well in another way To/from Runway 18R/36L VM V N9 V P5 P4 W9 W8 W3 36 C 36C W10 18C W6 W7 W10 W5 C 1 8 W4 23 24 25 26 27 28 V W2 W1 W W 22 09 S N5 21 R S irport centre 18 S2 19 19 1
Conclusions With the pure brainstorming approach you will identify many (functionally) unimaginable hazards risk is often concentrated on unimaginable hazards Monte Carlo model simulation yields even more hazards by systematic modeling by combinations arising in simulating from that point, the value of hazard as concept fades away interactions and dynamical behaviour play key role in understanding the risks Monte Carlo model simulations help to identify, interpret and evaluate such behaviour 19
20 Questions