SMS_ Rosellini

2015

Pierre ROSELLINI

ANSP04 ATM Safety Culture Safety Management System

Module 1

Why do we need a Safety Management System ?

- berlingen accident- Reason model

- This presentation on the berlingen accident is not made to judge a state, an organization or men, but to understand what happened.

- We will try to see how a Safety Management System (SMS) would have prevented this accident.

Why do we need a Safety Management System ?berlingen accident

- This accident happened over the territory of the Federal Republic of Germany, July 1, 2002 at 09h35 pm UTC.

- 71 persons were killed.

- On 24 February 2004 the air traffic controller on duty during the accident was murdered by the parent of a victim.

berlingen accident

berlingen accident

- Most of following informations are issued from the Report AX001 May 2004 of the BFU German Federal Bureau of Aircraft Accidents Investigation. - You can find this report at : http://www.bfu-web.de- Search with Uberlingen.

berlingen accident

Search results : 1 Report and 2 Annexes.

berlingen accident : factual informations

- The 2 flights involved in the collision were controlled byACC Zurich.

- The air traffic volume at ACC Zurich is characterized bydifferent traffic flows : transit flights, climbs from airportsand descents to airports.

- This accident happened over the territory of the FederalRepublic of Germany, July 1, 2002 at 09h35 pm UTC.Control of the airspace in this area is delegated to theSwiss Air Navigation Services.


- During the night shift the whole airspace of ACC Zurich had been switched to workstation RP (128,50 MHz).

- On 1 July at 21h the traffic load was low :Tupolev TU154M and Boeing B757-200 on 128,50 MHz.Airbus A320 delayed flight to Friedrichshafen on 119,920MHz.- The meteorolical conditions were good.

- The approach of Friedrichshafen had been switched to workstation RE (119,920 MHz).


- For the night from 1 to 2 July a modification of the upperairspace sectorisation had been planned.The modification work was to start at 9 pm and was tolast about 6 hours.

- Several systems were impacted by the works : Radar data processing, Flight plan data processing, ATS ground-ground telecommunication system.

Main consequences :- No automatic correlation. - Visual Short Term Conflict Alert (STCA) was off.- Direct telephone connection with the other centers

(Karlsruhe, Friedrichshafen ) had to be switched off.


- 2 official instructions regarding these changes wereissued. These instructions described the assignment ofthe new sectors and the procedures to be followed afterthe completion of the sectorisation.

- Others centers (Karlsruhe, Friedrichshafen ) were notinformed of planned work.

- An additional memoradum included a list of systemimpacted by the work. This memoradum wasnt clear andthe information that the ground-ground direct phoneconnection had to be switched off, was missing.


- 10 technicians were scheduled to carry out the plannedwork, about 6 stayed in the control room.

- 1 staff member from the ACC management was there toact as coordinator between controllers and technicians.During the whole time he stayed in close vicinity with thecontroller.

- The controller had not been informed about the tasks ofthe coordinator.


- Both aircrafts are equipped with TCAS (Traffic alert and Collision Avoidance System).

- B757-200 from Bergamo (Italia) to Brussels (Belgium), cargo flight with 2 pilots.

- Tupolev TU154M from Moscow (Russia) to Barcelona (Spain), 9 crew members and 60 passengers.


berlingen accident : chronology the aircrafts

Events in both cockpits.

berlingen accident : chronology Zurich ACC

In accordance with the procedure SMOP (Single MannedOperation Procedure) :- The second controller on duty left the control room atabout 09h15 pm.- The second assistant left the control room at about 09h25 pm.They retired to rest at the lounge.

- Both controllers have reported to duty at 5h50 pm.

- The chief controller was on duty until 09h pm.

berlingen accident : chronology Zurich ACC

09h10 pm : The technicians entered the control room and set to work.

09h18 pm : The optical SCTA was not avalaible.

09h23 pm : The direct telephone lines to the others ACC and airports were no longer avalaible (Unfortunately the switch to the public network was also out of service).

09h34 30s pm : the direct telephone on RP position is OK.

09h34 37s pm : the direct telephone on RE position is OK.

berlingen accident : chronology Aircrafts-ACC

09h21 21s pm : initial call of Boeing 757

09h30 11s pm : initial call of Tupolev 154

09h?? pm : initial call of Airbus A320, delayed flight, approach to Friedrichshafen ; this fligth was unexpected.

09h35 32s pm : collision between Boeing 757 and Tupolev 154.

berlingen accident : analysis

Boeing 757 : When the TCAS issued a RA descend descend the crew acted in accordance with procedures.


Tupolev 154 : - The BFU considers the crews qualification and experience to be high.The pilot sitting on the right seat is the chief pilot of the compagny. The crew has received a TCAS training in accordance with the national regulations. The crew has not a practical experience of TCAS.

- The manuel compagny was ambiguous about the priority of RA TCAS.


Tupolev 154

At 09h34 56s pm 3 very closed events occurred for the crew :- The instruction of the controller to descent to FL350 has just ended.- The pilot pushed the control column forward (to descent).- An RA climb climb was generated by TCAS. There was a conversation in the cockpit about the RA, butaccording to the compagny manual it was not mandatoryto follow the RA.


See and avoid

The apparent object size of an aircraft changes in form of an exponential function during the approach of two aircrafts. The aircraft stays little for a long time then it explodes optically just a few seconds before the collision.

ACC Zurich- When the controllers reported for duty at 05h50 pm they were not aware about the scheduled work. They did not seize the opportunity to read the documents avalaible for the self briefing.- The controller was concentrated on the Airbus approaching Friedrichshafen. He had to move from position RP to position RE. He tried several times to phone to Friedrichshafen but due to work in progress it was not possible. Unfortunately the connection to the public network phone was not avalaible.


ACC Zurich

- Single Manned Operation Procedure (SMOP) was not an official procedure but was known and tolerated by the management.

- Priorities had not been evaluated properly by the controller.

ATC Karlsruhe

- Visual Short Term Conflict Alert (STCA) was off.

They tried several times to phone to Zurich ; 2 calls with no response.



- For TCAS, regulations of the ICAO are in several documents : Annex 2, Annex 10, Doc 8186 PANS-OPS,Doc 4444 PANS-ATM, State letter AN 11/19-02/82.

- Analysis of the BFU has shown that TCAS regulations are not clear enough.

Regulations

James Reason, born in 1938 in England, is a human factors expert.

berlingen accident : Reason model

Regulations

Management

Controllers

Pilots

Equipments


Reason's model : an organization's defenses against failure are modeled as a serie of barriers, represented as plates with holes. The holes in the plates represent weaknesses. The size and the position of the holes in the plate are varying.

When holes in each plate are aligned a collision happens.


Regulations

Management

Controllers

Pilots

Equipments

Collision

berlingen accident : Causes & Reason model

The conflict has not been seen and solved by the ATCO.

The TU154 crew followed the ATC instruction to descend, and continued after the RA TCAS to climb.

Immediate causes :

Collision

Regulations

Management

Controllers

Pilots

Equipments

We can put each cause in a plate. The plates are families of causes.

Other causes :

The management of ACC Zurich did not ensure that during the night all open positions were continuously staffed by controllers.The management of ACC Zurich tolerated for years that during times of low traffic at night only one controller worked (SMOP).The regulations concerning TCAS published by ICAO and by national aviation authorities, were not standardised ; they were incomplete and partially contradictory.


Collision

Regulations

Management

Controllers

Pilots

Equipments

Due to work in progress :-Optical STCA was off,-Direct phone connections with adjacent centres were off.

No Risk assessment and mitigation for the works. No internal coordination between operationals and technicians.

The written directives concerning the accomplishment of thework did not included explanations about the effects thatwork would have on the availability of technical equipment.


Collision

Regulations

Management

Controllers

Pilots

Equipments

Due to work in progress :-Optical STCA was off,-Direct phone connections with adjacent centres were off.

No Risk assessment and mitigation for the works. No internal coordination between operationals and technicians.

The written directives concerning the accomplishment of thework did not included explanations about the effects thatwork would have on the availability of technical equipment.

The controllers were obliged to read directives concerning the accomplishment of work. But on the 1st july they did not read these directives.

The ATCO had to work on 2 adjacent positions with 2 different frequencies.

The ATCO was not aware that the optical STCA was off.


Collision

Regulations

Management

Controllers

Pilots

Equipments

The bypass phone system had a technical defect, so it was impossible to contact Friedrichshafen.

The controller did not detect the conflict between TU154Mand B737-200. During the last 5 minutes before thecollision, the controller has focused its attention on theAirbus A320 on approach with Friedrichshafen.


Collision

Regulations

Management

Controllers

Pilots

Equipments


Collision

Regulations

Management

Controllers

Pilots

Equipments

To avoid collision we have to delete only 1 hole on 1 plate


Collision

Regulations

Management

Controllers

Pilots

Equipments

1 hole has disappeared in management plate. This plate is certainly the easiest to correct.

X


Collision

Regulations

Management

Controllers

Pilots

Equipments

X

A Safety Management System in ACC has actions on almost all the plates.

Why do we need a Safety Management System ?

END

Module 2SMS Requirements and Implementation

ICAO Annex 19, DOC9859European Requirements.

Policy, Responsability, Priority, Objectives, Competency.

Documentation, External Services.

Survey, Monitoring, Records.

SMS Requirements and Implementation

For Safety Management System we have :- requirements ICAO Annex 19 http://www.icao.int/Pages/default.aspx- requirements European Single Skyhttp://www.skybrary.aero/index.php/Portal:Safety_Regulationshttps://www.eurocontrol.int/

Requirements for European Single Sky are built on ESARRrequirements.They are more explicit and easier to understand than therequirements of Annex 19.

All these requirements are very close.

ICAO Annex 19

- The first edition of Annex 19 (July 2013)was adopted by the council on 25 february2013 and becomes applicable on 14November 2013.- A lot of requirements concern theNational Supervisory Authority (NSA).

- Guidance on the implementation of aSMS is contained in DOC 9859 SafetyManagement Manual.

- Requirements for Air National ServiceProviders (ANSP) are in c4.1.7 and inAppendix 2.

ICAO Annex 19

1. Safety Policy and Objectives

2. Safety Risk Management

3. Safety Assurance

4. Safety Promotion

ICAO Annex 19

There is a personal work in progress in order to understand and to precise each item of Annex 19.In blue you have what has been added.

ICAO Annex 19


1.1 Management commitment and responsability1.2 Safety accountabilities.1.3 Appointment of key safety personnel.1.4 Coordination of emergency response planning.1.5 SMS documentation.

ICAO Annex 19


1.1. Management commitment and responsabilityCommitment at the highest level1.2 Safety accountabilities.Responsibility at the highest levelResponsibilities of the managerial staff1.3 Appointment of key safety personnel.Responsibilities1.4 Coordination of emergency response planning.Contingency plan in ATC1.5 SMS documentation.Management of SMS documentationManagement of operationnal documentationIdentification of demonstrative elements (records)

ICAO Annex 19


2.1 Hazard identification.2.2 Safety risk assessment and mitigation

ICAO Annex 19


2.1 Hazard identification.Notification, immediate actions, analysis of eventsProcessing of safety occurrencesProcessing of security occurrencesPlanning tools and resources2.2 Safety Risk Assessment and MitigationSafety studies (changes)Programmed method of interventionMonitoring measures to reduce risk

ICAO Annex 19

3. Safety Assurance

3.1 Safety performance monitoring and measurement.3.2 The management of change.3.3 Continuous improvement of SMS.

ICAO Annex 19

3. Safety Assurance

3.1 Safety performance monitoring and measurement.Monitoring of Indicators 3.2 The management of change.Management of projects3.3 Continuous improvement of SMS.Corrective ActionsAuditsProcess reviewManagement review

ICAO Annex 19

4. Safety Promotion

4.1 Training and education.4.2 Safety communication.

ICAO Annex 19

4. Safety Promotion

4.1 Training and education.SMI trainingCompetency (ATCO, ATSE)4.2 Safety communication.Lesson dissemination

2002-2004.The Eurocontrol SAfety Regulatory Requirements (ESARR) were prepared by Eurocontrol.

European requirements

The European Commission converted these ESARRs into Common Requirements that were published in 2004 (and amended in 2011). It is on the basis of these requirements that the ANSPs of the UE countries have been certified as air navigation service provider in the European Single Sky.

Eurocontrol SAfety Regulatory Requirement (ESARR)

ESARR1 is for NSA ESARR3 is for ANSP

The SMS requirementsare in ESARR3.

Eurocontrol SAfety Regulatory Requirement (ESARR)

Safety Occurrences

ESARR3 is linked to :- ESARR2 for safetyoccurrences,

Competences

- ESARR5 for competencies,

RiskAssessment

and Mitigation

- ESARR4 for riskassessment and mitigation,

Software in ATM

functionalsystems

- ESARR6 for software.

Today :- 1034 2011 Safety Oversight for NSA. - 1035 2011 Common Requirements for ANSP.


1034 1035

ICAO Annex 19



3. Safety Assurance

4. Safety Promotion

EU Requirements

Safety Policy Level

To Achieve Safety

To Ensure Safety

To Promote Safety

ICAO Annex 19 vs EU Requirements

SMS requirements

SMS Requirements

SAFETY POLICY LEVEL

SAFETY MANAGEMENTTO IMPLEMENT A FORMAL AND EXPLICIT SAFETY MANAGEMENT APPROACH

SAFETY RESPONSIBILITYEVERYBODY HAS ANINDIVIDUAL SAFETYRESPONSIBILITY FORHIS/HER OWN ACTION

SAFETY OBJECTIVETO MINIMISE THE ATM CONTRIBUTION TO THE RISK OF AN AIRCRAFT ACCIDENT

SAFETY PRIORITYOVER COMMERCIAL, OPERATIONAL, ENVIRONMENTAL OR SOCIAL PRESSURES

SMS requirements

SAFETY POLICY LEVEL





This requirement means that you have to implement a SMS !

SMS requirements

SAFETY POLICY LEVEL


SAFETY RESPONSIBILITYEVERYBODY HAS ANINDIVIDUAL SAFETYRESPONSIBILITY FOR HIS/HER OWN ACTION



Everyone involved in safety and in safety management has responsibilities clearly defined.Everyone must known his responsibilities.


Implementation by


Implementation by

ATCOs and ATSEPs

SMS requirements

SAFETY POLICY LEVEL






Implementation bySAFETY PRIORITYOVER COMMERCIAL, OPERATIONAL, ENVIRONMENTAL OR SOCIAL PRESSURES

We can consider that an ANSP is surrounded by barriers.ANSP

Operational


If you put more pressure on one side

ANSP

Operational

you must put less pressure on the others.


Example of commercial pressure. all airlines want to arrive in Paris around 08 am.


Map of the routes and sectors around Paris.Each sector has a maximum number of aircrafts that can be handled at same time.So it is not possible to accept that too much aircrafts arrive in Paris airport at same time for safety reasons.


1. Strategic.Twice a year allocate slots for an optimal use of airport resources in respect with the constraints,Monitor the proper use of slots allocated to airlines.

2. Tactical.The Network Manager Operations Centre in Brussels can modify time of departure of flights if the maximum capacity on an area is reached.

Because safety is the most important item, in order to avoid to have too many flights in Paris at 8h am :


ANSP

Operational

- In accordance with this requirement you must never accept to put less pressure on safety barrier.- Your policy must explain this.- You must apply your policy.

Extract of policy of the French ANSP.The policy or strategy of DSNA is defined by the Director of the DSNA under the authority of the Director General of Civil Aviation (DGCA) and related services, to achieve the objectives of the LOLF.It is materialized by a set of strategic directions defined in the 5 years plan and precised in each annual plan At this end we give priority to the following strategic axes:1) Ensure a high level of safety and security of air navigation2) Controlling the environmental impact of air traffic3) Improve delays.4) Improve the economic efficiency of air navigation services5) Participate in European construction 6) Consider the needs of general aviation in the establishment procedures and airspace structures.I rely on the involvement of all staff to address these objectives at all levels, in order to strengthen the unit and the image of DSNA.I will ensure its implementation and its effectiveness.s

SMS requirements

SAFETY POLICY LEVEL





Implementation by

That requirement means that you must define quantitative and/or qualitative objectives.


Very often the quantitative objectives are linked to indicators.

Objectives can be defined in the policy or in the action plan.

Extract of policy of the French ANSP.The policy or strategy of DSNA is defined by the Director of the DSNA under the authority of the Director General of Civil Aviation (DGCA) and related services, to achieve the objectives of the LOLF.It is materialized by a set of strategic directions defined in the 5 years plan and precised in each annual plan At this end we give priority to the following strategic axes:1) Ensure a high level of safety and security of air navigation2) Controlling the environmental impact of air traffic3) Improve delays.4) Improve the economic efficiency of air navigation services5) Participate in European construction 6) Consider the needs of general aviation in the establishment procedures and airspace structures.I rely on the involvement of all staff to address these objectives at all levels, in order to strengthen the unit and the image of DSNA.I will ensure its implementation and its effectiveness.

SMS requirements

TO ACHIEVE SAFETYMEANS FOR ACHIEVING HIGH SAFETY STANDARDS

AN APPROPRIATE ORGANISATION SYSTEMATIC ACTIONS

SMS DOCUMENTATION THE SMS IS A DOCUMENTED SYSTEM ARISING FROM A SAFETY POLICY

COMPETENCYSTAFF TRAINED, MOTIVATED AND COMPETENT

SAFETY MANAGEMENT RESPONSIBILITY SAFETY MANAGEMENT FUNCTION WITHIN THE ORGANISATION

EXTERNAL SERVICES DEALING WITH EXTERNALLY PROVIDED SERVICES

QUANTITATIVE SAFETY LEVELS DERIVING QUANTITATIVE LEVELS WHEREVER PRACTICABLE

SAFETY OCCURRENCES ATM OPERATIONAL OR TECHNICAL OCCURRENCES ARE INVESTIGATED INTERNALLY

RISK ASSESSMENT AND MITIGATION THE SAFETY OF NEW SYSTEMS AND CHANGES IS TO BE DEMONSTRATED USING A RISK BASED APPROACH.RISK IS ASSESSED AND MITIGATED.

SMS requirements











- The overall safety objective is to ensure the competence of personnel responsible for safety related tasks within the provision of ATM services.

- Air Traffic Controller (ATCO) and Air Traffic Safety Engineers Personnel (ATSEP) are mainly concerned by this requirement.

Requirements for ATCO competency.

ICAOAnnex 1 and DOC 9379.

European requirementsRegulation (EU) 2015/340.

Implementation byCOMPETENCYSTAFF TRAINED, MOTIVATED AND COMPETENTATCO

To be allowed to work on a position, ATCOs must have a valid licence issued by the National Supervisory Authority.

To obtain the licence (initial training) :- Training in ENAC.- Training in ACC or Airport. - On job training.- Medical certificate.


To maintain the licence (continuing training) :- Evaluation and individual training plan.- Proficiency in English. - Medical certificate.- Annual number of hours worked.

Implementation byCOMPETENCYSTAFF TRAINED, MOTIVATED AND COMPETENT

A database is used to monitor the competency of ATCOs.For each ATCO all the trainings done are recorded in this database.

ATCO

To manage, monitor and organize all these trainings we have a dedicated subdivision.

Paris ACC :- 550 ATCOs- Among them 100 ATCOs are in training.

OPS Division : Training Subdivision

OPS Division

SubdivisionStudies

SubdivisionTraining

SubdivisionSafety

Aera East12 teams of 18 ATCO

Aera West12 teams of 18 ATCO

FMP FISAlert

SubdivisionATCO OPS Training

ChiefDeputyATCOEngineers


Planning Paris ACC

IndividualTraining

English

Instructors

Chief Controller

UnitsContinuingTraining 1

ContinuingTraining 2

Requirements for ATSEP competency.

ICAO.- ICAO Annex 1.- SARPS published in ICAO Annex 10 and guidance material in ICAO Doc 7192 - AN/857 Part E2.

European requirements.- ESARR 5 Section3 - Requirements for Engineering and Technical Personnel Undertaking Operational Safety Related Tasks.- Regulation 1035/2011 Annex II section 3.3 (idem ESARR5).

Implementation byCOMPETENCYSTAFF TRAINED, MOTIVATED AND COMPETENTATSEP

Implementation byCOMPETENCYSTAFF TRAINED, MOTIVATED AND COMPETENTATSEP

CNS-ATM EnergyCommunication Electrical engineeringNavigation Air conditioningSurveillanceData processingSupervision and monitoring systems

To be allowed to work on a position, ATSEPs must have a valid licence issued by the National Supervisory Authority.

SubdivisionTraining

Paris ACC :- 80 ATSEPs- Among them about 8 ATSEPs are in training.

Training

ChiefDeputyATSEPInstructors

Technical Division : Training SubdivisionOPS

Division

SubdivisionStudies

SubdivisionSafety



FMP FISAlert

SubdivisionATCO OPS

SMS requirements










Operational Documentation ATCO ManualsATSEP Manuals

Technical documentation

Records: Minutes management review, ACAP, Dashboards, Safety occurrences,

Reports of audits, Strips, Data radar , Flight plan data

SMSManual

Procedures: Audits, Documentation, Records, Corrective Actions,

Management review

Mapping, Process, Activites


The documentation of the SMS can be represented bya five floors pyramid.

Implementation by

SESW

5 ACC

Headquarters

WE

N

BrestCDG & Orly Strasbourg

Lyon

Nice

MarseilleToulouse

Bordeaux

West IndiesGuiana

IndianOcean

11 Airports

Lille

AIS CESNAC

CESNAC = Centralised Air

Navigation SystemsOperations Centre


Implementation by

The Paris ACCs Manual explains how the SMS requirements are implemented.

Implementation by


Anything you write in the SMS manual must be done and demonstrated. It is a new layer of requirements.

Implementation bySMS DOCUMENTATION THE SMS IS A DOCUMENTED SYSTEM ARISING FROM A SAFETY POLICY

So avoid writing too much.

We can use ISO 9001 (quality) tools in order to explain in a procedure how we manage the documentation.


We can identify different families of documents. For each family we define management rules.

Who write, who verifie, who approve ? What is the current version ? Paper or electronic document ? Where is the document of reference ?

With such a procedure its very easy to build an electronic documentation.



OperationalDivision

All the documentation has been converted in pdf files.

The procedure PRO_E_OPR describes the management of the operational documentation.

With these pdf files an intranet site has been implemented.

The procedure PRO_INST_OPR describes the management of the training documentation.


ATCOs documentation.

OperationalDivision


ATCO Training

OperationalDivision


TechnicalDivision

A specific tool SIAM has been implemented. The technical documentation is stored on SIAM.

The procedure PRO_T_OPR describes the management of the technical documentation.

This procedure has been elaborated by a working group :Chief of the Technical Division, Chief of the safetysubdivision + deputy, Chief of radar subdivision, 10ATSEPs.


TechnicalDivision

TechnicalDivision


Form for operational instruction (subdivision)

TechnicalDivision


Form for operational instruction (division)

TechnicalDivision


1 MISO to implement

2 MISO to verify

3 Feedback in progress

4 Corrective Actions in progress

TechnicalManual

Manual: 5 documents

to verify

Manual: 1 document to approve

Manual: 83

documents to update

Manual: 7 new

documents

8 Events in progress

By using this button you can access to a new screen on which you have all the technical documentation.

Manual: 7 new

documents

TechnicalManual

By using this button you can access to the new documents that you have not read.

Manual: 5 documents

to verify

By using this button you can access to the documents to verify.


Manual: 1 document to approve

By using this button you can access to the documents to approve.

Manual: 83

documents to update

By using this button you can access to the documents to update.


SMS requirements











It means that :- You must have identified a safety management function with responsibility for development and maintenance of the safety management system.- This function must be accountable directly to the highest organisational level.- This function must be independant of the operational management.


A dedicated organization has been identified and created at the national level.

A team called MSQS (french acronym, it means team in charge of the Safety, Security) is directly linked the the Director of the french ANSP.

Implementation by


Implementation by

Planning & StrategieSubdirectorate

Human ResourcesSubdirectorate

FinanceSubdirectorate

The Management of Safety, Security,

Quality Mission

The EnvironmentMission

French ANSP Director

French ANSP Headquarters


Implementation by

A dedicated function has been identified and created in each entity (ACC and Airports).

This function called RSMS (french acronym it means responsible of the SMS) is directly linked to the chief of the entity.

French ANSP : A RSMS can be engineer, ATCO or ATSEP.


Implementation by

OperationsDivision

TechnicalDivision

AdministrativeDivision

ACC or AirportChief

ACC or Airport Organization

Deputy RSMS

SESW

5 ACC

HeadquartersMSQS

WE

NBrestCDG & Orly Strasbourg

Lyon

Nice

MarseilleToulouse

Bordeaux

West IndiesGuiana

IndianOcean

11 Airports

Lille

AIS CESNAC




Implementation by

RSMS

RSMSRSMS RSMS

RSMS

RSMS

RSMS

RSMS

RSMS

RSMS

RSMS RSMS

RSMS

RSMS

RSMS RSMS

RSMS

RSMS

Links betweenMission and RSMS for mutualization.

SMS requirements











This requirement means : you must check, survey the external services that have a link with safety.

We have to define what are external services.


According to the Letter of Agrement (LOA) we can say that for the German ANSP, the Swiss ANSP is an external service provider.

Implementation by

Remember when we talked about berlingen accident :This accident happened over the territory of the FederalRepublic of Germany, July 1, 2002 at 09h35 pm UTC.Control of the airspace in this area is delegated to the Swiss Air Navigation Services.


French ANSP has identified a list of suppliers and external services that can have an impact on safety.

Implementation by

Key elements of the list of Paris ACC:- Energy.- Air conditioning.- Fire Detection.- Telecommunications.- Cleaning the operational room.- Cleaning technical rooms.- Training in English.


Implementation by

External services Supplier Contract Date &DurationResponsible

for monitoringMaintenance of

generator sets (fuel) SDMOS5204 14504

01.01.125 years

Chief of energy subdivision

Impact on SafetySafety objectives

for supplier (contract) Others Safety barriers

Major.Energy :1 External (EDF)2 Generator sets (fuel)3 Batteries (4h max)

- 2 preventive interventions by year.- Call : intervention within 4 hours.

- 2 generator sets.- SDMO supplier can be helped by local technicians.


Implementation by

External services Supplier Contract Date &DurationResponsible

for monitoring

Fire detection SICLI 11/07 10.12.075 yearsChief of

administrative division

Impact on SafetySafety objectives

for supplier (contract) Others Safety barriersMajor.- Risk of late detection of a fire - False alarms.

- 2 preventive interventions by year.- Call : intervention within 4 hours.- All the be fire detectors must changed within 4 years.

- 2 generator sets.- SDMO supplier can be helped by local technicians.

SMS requirements











Based on quantitative risk assessment EUROCONTROL has established in ESARR4 an overall safety performance target for ATM in the ECAC region - the maximum tolerableprobability of ATM directly contributing to an accident of a commercial air transport aircraft shall not be greater than1.55 x 10-8 per flight hour.

According to ICAO DOC 9859 Safety Management manual, Whenever quantitative safety performance targets are set, it must be possible to measure, or estimate, the achieved level of safety in quantitative terms. Use of quantitative data helps clarify most decisions and should be used where available.

SMS requirements











Tuesday 26th may, 13h30-15h

MODULE 4Safety Occurrences

Wednesday 27th may, 09h-10h30h and 10h45-12h15.

SMS requirements










Thursday 28th may 09h-10h30.


MODULE 6 Risk assessment

and Mitgation

SMS requirements

TO ENSURE SAFETYMEANS FOR PROVIDING ASSURANCE THAT RISKS ARE BEING PROPERLY MANAGED

SYSTEMATIC ACTIONSCONCERNING THE STEADY STATE

DOCUMENTING SYSTEMATIC ACTIONS AND CHANGES

SAFETY SURVEYS SAFETY HAS TO BE VERIFIED INTERNALLY AND CONTINUOUSLY

SAFETY MONITORING CONTINUOUS MONITORING AND ANALYSIS OF SAFETY INDICATORS

RISK ASSESSMENT AND MITIGATION DOCUMENTATION THE RESULTS OF RISK ASSESSMENT AND MITIGATION PROCESSES ARE DOCUMENTED THROUGHOUT THE SYSTEM LIFECYCLE

SAFETY RECORDS RECORDS ARE PRODUCED AND MAINTAINED THROUGHOUT THE SMS OPERATION

SMS requirements








Implementation bySAFETY SURVEYS SAFETY HAS TO BE VERIFIED INTERNALLY AND CONTINUOUSLY

Internal auditors are trained by an approved organization.

Internal auditors must done at least 1 audit per year.

The procedure Internal Audits describes how are realized the internal audits.

Each year a program of internal audits is planned and realized.


External Audits, done by DSAC (french NSA), in order to certify the SMS of DSNA (french ANSP).

Who PeriodicityACC (5) 3 years

Main Airports (11) 2 yearsHeadquarters Each year

Headquarters, ACC and Airports are audited like mentionned below :


2006 DSNA obtained the certificate of ANSP issued by the DSAC. The certificate ended in 2010.2010 Renewal the certificate, valid until 2016.

Monitoring by DSAC : - Audits. - Monitoring of security events.- Monitoring changes and safety records.- Monitoring the performance.

DSAC performs regular coordination with DSNA.

SMS requirements








Implementation by

In french ACC or Airports safety indicators are built and controlled by dedicated teams (Safety subdivisions) then analysed during several periodic meetings.


For each meeting we have a safety dashboard.

Dashboard

Topic Results TrendSafetyTrafficDelay

Technical

Summary

Managers need a dashboard for monitoring the main indicators.

Definitions : Losses of separation with 50%, 70%, 80%, 100%

NM

ft

Inside red rectangle we are 50% under the minimum of separation, inside the orange 70%, inside the yellow 80% and inside the blue 100%.

Dashboard : safety indicator

0,35

0,40

0,45

0,50

0,55

0,60

Losses of separation per 100 000 flights

Losses of separation below 70% of the minimum radar separation.French ACC minimum radar separation :- Vertical 1000 ft.- Horizontal 5NM.


0,35

0,40

0,45

0,50

0,55

0,60


HN70 Janv Fvr Mars Avr Mai Juin Juil Aot Sept Oct Nov Dc Total

Evolution annuelle 12 mois glissants

2007 1 1 1 0 0 2 1 0 0 2 0 0 8 0,612008 0 0 1 1 0 2 0 0 1 1 0 1 72009 0 0 0 1 1 0 0 1 1 4

0,000,100,200,300,400,500,600,700,800,901,00


A graph is subjective. These 2 graphs are the same but have different scales.It is useful to present the data in a table.


Resolution Advisory Traffic Alert Collision Avoidance System (RA TCAS).

0,000,100,200,300,400,500,600,700,800,901,00

RA TCAS per 100 000 flights

Dashboard : Delays indicator

0

20000

40000

60000

80000

100000

120000

140000

160000

mi n

u te s

Delays for xxxx ACC Dlais 07/08Dlais 08/09

In a dashboard you must explain the peaks or the anomalies.

Meteorogical conditions

ATCO strike

Dashboard : Technical indicators


Event with severity b :Frequency 128,140 permanent emission by aircraft from11h24 to 11h30 am.

This event has been classified with severity b : it is a partial inability to provide safe ATM services.In this case only the frequency 128,140 isconcerned.


Events on telecom leased lines.

Implementation bySAFETY MONITORING CONTINUOUS MONITORING AND ANALYSIS OF SAFETY INDICATORS

SubdivisionSafety1 chief1 Deputy4 ATCO and assistants

When Who

Daily

Chief Division OPS, deputy, chiefs subd

Monthly

OPS Division

SubdivisionSafety1 chief1 Deputy2 ATSEP

When Who

Daily

Chief Technical Division, deputy, chiefs subd

Weekly

Technical Division

DirectionWhen Who

Chief, Deputy, RSMS,Chiefs of divisions, deputies

Weekly

SMS requirements









Implementation by

Safety records are the result of an activity (indicators) or the proof that an activity has been performed (minutes of a meeting).

MAINTAINED THROUGHOUT THE SMS OPERATION

y records he result of ctivity cators) or roof that an ty has been rmed

utes of a ing). Operational Documentation

ATCO ManualsATSEP Manuals

Technical documentation

Records: Minutes management review, ACAP, Dashboards, Safety occurrences,

Reports of audits, Strips, Data radar , Flight plan data

SMSManual

Procedures : Audits, Documentation, Records, Corrective Actions,

Management review

Mapping, Process, Activites




Implementation by

Paris ACC is using an ISO tool : a documented procedure for records. This documented procedure defines several items : identification, storage, protection, retrieval, and retention of records.



Implementation by

Record Acces Who Where Support Duration Archivage

Minutes of management

reviewFree

RSMSG:\Dir_CRNA\SMQS\revues Electronic 3 years 5 years

Audit reportsFree

RSMSG:\Dir_CRNA\SMQS\audits Electronic 3 years 5 years

LOAs FreeChief Subd OPS

G:\EXPLOITA\Doc_Ops\LOA Electronic 3 years 5 years

Safety occurrences

analysisConfide

ntial

Chief SubdSafety

Office Chief Subd Safety Paper 3 years 5 years

SMS requirements

TO PROMOTE SAFETYMEANS TO BUILD A SAFETY IMPROVEMENT CULTURE WITHIN THE

ORGANISATION

LESSON DISSEMINATIONDISSEMINATING PAST LESSONS WITHIN THE ORGANISATION

SAFETY IMPROVEMENTINVOLVING ALL STAFF AND IMPLEMENTING THE IMPROVEMENT OF SAFETY AS A CONTINUOUS PROCESS

SMS requirements


ORGANISATION




Lesson dissemination is included in module 4.

MODULE 4Safety Occurrences

SMS requirements


ORGANISATION




Continuous improvement is a ISO 9001 quality concept but it applies also to safety.

Deming wheel : Plan, Do, Check, Act PDCA cycle.


Provide ATS services

SAFETY OCCURRENCES- Analyse- Causes- GravityAUDITSREVIEWSCorrective

actions to avoid same causes

PolicyAction planObjectivesResources


Continuous improvement is never completed.

You must climb slowly, step by step.


2 Management review per year.

Implementation by

Members of the management review :- Chief of ACC or Airport (chairman of the revue) and deputy- RSMS (secretary of the revue)- Chief of operational division - Deputy of operational division - Chief of technical division- Deputy of technical division- Chief of administrative division

ManagementReview

Audit reports(internal, external)

Safety IndicatorsSafety Dashboard

List ofPlanned changes

Project of internal and external audits

PreparationAnalysis

Synthesisdone

byRSMS

List of corrective actions

Actions plan Minutes ofManagement

ReviewActions

ActionPlan

(update)

Planningof

audits


Implementation byImplementation byImplementation by

NewCorrective

Actions


Agenda :

1. Safety indicators2. Risk assessment and mitigation3. Implementation of SMS4. Audit reports5. Corrective and Preventive Actions

Implementation by

Titre

END

- French civil Aviation Organization.

Module 3ANSP NSA How to work together ?

- French ANSP Organization.

- French NSA Organisation.

- Audits NSA.





- Audits NSA.

French Civil Aviation Organization

General Directoratefor Civil Aviation

Directoratefor Air Transport

(DTA)

Directoratefor Air Navigation

(ANSP)

Directoratefor Civil Aviation

Safety (NSA)

DTA elaborates regulations. Most of the requirements are coming from ICAO and EU.

ANSP applies the regulations and provides services (ATM, CNS, AIS ).

NSA monitors ANSP through audits.The certificate of provider is issued by NSA.

French Civil Aviation Organization





- Audits NSA.

French ANSP Organization

Directoratefor Air Navigation (ANSP)

Planning and StrategySubdirectorate



The management of Safety, Security and Quality Mission


Operations Directorate (ACC, Airports )

Technical and Innovation Directorate


SESW

5 ACC

Operations Directorate(ACC, Airports )

WE

N

Lyon

Nice

MarseilleWest Indies

Guiana

IndianOcean

11 Airports

AIS CESNAC



BrestCDG & Orly Strasbourg

Toulouse

Bordeaux

Lille

OperationsDivision

ATCO

TechnicalDivisionATSEP

AdministrativeDivision

ACC or AirportChiefDeputy RSMS


A dedicated function has been identified and created in each entity (ACC, Airports, AIS and CESNAC). This function called RSMS (french acronym it means responsible of the SMS) is directly linked to the chief of the entity.The RSMS must implement and monitor the local SMS.

OPS Division

SubdivisionStudies

SubdivisionTraining

SubdivisionSafety

Paris ACC :- 550 ATCOs- Among them 100 ATCOs are in training.



FMP FISAlert

SubdivisionATCO OPS



Technical Division

SubdivisionRadar

SubdivisionTelecoms

SubdivisionTraining

SubdivisionSafety

Paris ACC :- 80 ATSEPs- Among them about 8 ATSEPs are in training.

SubdivisionFlight Plan

SubdivisionEnergy

Operational maintenanceSupervision 3 ATSEP

Supervision1 technician

French ANSP Organization

Directoratefor Air Navigation (ANSP)

Planning and StrategySubdirectorate






Technical and Innovation Directorate



Internal Audits and Certification Division

Insurance of the Regulatory

Compliance DivisionSafety Performance Insurance Division

Systems Safety Division

A dedicated organization has been identified and created at the national level. A team called MSQS (french acronym, it means team in charge of the Safety, Security, Quality) is directly linked the the Director of the french ANSP.

The Management Of safety Security and Quality Mission

SESW5 ACC

HeadquartersMSQS

WE

NBrestCDG & Orly Strasbourg

Lyon

Nice

MarseilleToulouse

Bordeaux

West indiesGuiana

IndianOcean

11 Airports

Lille

AIS CESNAC



RSMS

RSMSRSMS RSMS

RSMS

RSMS

RSMS

RSMS

RSMS

RSMS

RSMS RSMS

RSMS

RSMS

RSMS RSMS

RSMS

RSMS

A network of RSMS coordinated by MSQS

The RSMS are coordinated by MSQS in order to mutualize and to share.Monthly meetings are piloted by MSQS.





- Audits NSA.

Resource Management

EuropeanCooperation

Flight Crew

Airworthinessand Air

Navigation

Airports and Air Navigation

French NSA Organization

Security

West

SouthWest

South

South East

North

NorthEast

AntillesFrench Guiana

Centre East

IndianOcean

Local DepartmentsHeadquarters

Licence, medical control, training.

Directoratefor Civil Aviation Safety

Certification and monitoring of airlines and aircratfs.

The oversightand monitoring operations of NSA are done with the support of local departments.

Certification and monitoring of ANSP and Airports.

Control the security measures.

EASA monitors all the NSA.

SESW

5 ACC

WENBrest

CDG & Orly Strasbourg

Lyon

Nice

MarseilleToulouse

Bordeaux

West IndiesGuiana

IndianOcean

11 Airports

Lille

AIS CESNAC



West

SouthWest

SouthSouth East

North NorthEast

West IndiesGuiana

Centre East

IndianOcean

Local NSA

French NSA Organization

NSA headquarters

Staff Aptitude for Air Navigation

Air Navigation Systemsand Equipment

- Audits of SMS.- Monitoring Non Conformities.- Monitoring Correctives Actions.- Monitoring of safety events, safety records, safety performance.- Certification of ANSP.

Pole : Airports and Air navigation

Certification of ANSP

Monitoring of changes (Risk assessment and mitigation).

Monitoring of competences of ATCO and ATSEP.

Airports and Air Navigation

National certification of airports.

Airports





- Audits NSA.

Program of audits :- Program over 6 years, 6 to 10 audits per year.- Defining audit objectives and audit program by adaptation based on the results of year n-1.- Annual monitoring plan taking into account the maturity, the identified risks and regulatory requirements.- Pool of auditors from Headquarter and Local Departments.

Particuliarities of audits DSNA- Large referential. - Multi-site audits.- Monitoring non-conformities and observations of previousaudits.- Harmonization at national level.

Audits NSA

Audits NSA

Program of audits over 6 years, 6 to 10 audits per year.

Defining audit objectives and audit program by adaptation based on the results of year n-1.

Particuliarities of audits DSNA- Large referential. - Multi-site audits.- Monitoring non-conformities and observations of previous audits.- Harmonization at national level.

Annual monitoring plan taking into account the maturity, the identified risks and regulatory requirements.

SESW

3 years

HeadquartersWE

NBrest

CDG & Orly Strasbourg

Lyon

Nice

MarseilleToulouse

Bordeaux

West IndiesGuiana

IndianOcean

2 years

Lille

AIS CESNAC

Each year

Audits NSA : Periodicity

DSNA (french ANSP) : a national provider with more than50 sites.

DSNA provides ATS, CNS and AIS.

2006 DSNA obtained the certificate of Air Navigation Services Provider issued by the DSAC. The certificateended in 2010.2010 Renewal the certificate, valid until 2016.

Certificate of ANSP provided by NSA.

DSNA has an ISO9001 certification since 2009.

DSAC (French NSA) performs regular coordination with DSNA (twice a year).

Non Compliance

ACC X define Corrective Actions

MSQS checks with othersEntities

Corrective Actions accepted by MSQS?

Audits NSA : From Non Compliance to Corrective Actions

Corrective Actions accepted by NSA ?

Yes

MSQS proposes corrective actions to NSA

No

YesCorrective actions are implemented by ANSP and monitored by NSA

No

NSA considers that a non compliance found in an entity concerns the whole ANSP.

Audits NSA : From Non Compliance to Corrective Actions

MSQS must verify that the corrective actions can be applied by all the entities.

The corrective actions must be implemented in all the entities.

MSQS and NSA monitor the implementation of corrective actions and their effectiveness.

MSQS monitors all the corrective actions of the ANSP (linked to NSA audits).

Audits NSA : Monitoring Corrective Actions

MSQS and RSMS have a tool called AGATHA in which all the non compliances and the corrective actions are stored.

Twice a year MSQS has a meeting with NSA in order to monitor the corrective actions in progress.

Sometimes a corrective action needs several months to be completed.

The annual safety report of ACC X shows that all the safety events are not reported spontaneously by the ATCOs :- RA TCAS: 2 of 16 are reported. - Losses of separation 50: 1 on 3 is reported.- Losses of separation 70: 7 of 22 are reported.Non Compliance 1 : All the safety events are not reportedby the ATCOs.

Audits NSA : Exemple of Non Compliance

Explanation : When 2 aircrafts are under the minima of separation the event is automatically stored in a log file. So the ATCOs consider that it is not useful to report the safety events by filling a dedicated form (ATS Occurrence Report)..

Action 1. Note to the ATCOs to ask them to report all events they are aware (AIRPROX, RA TCAS, Losses of separation).

Audits NSA : Example of Corrective Actions

Every agent must report all the safety events which he is aware.

Action 2.A new indicator is implemented in order to monitor the ratio number of reported events by ATCOs / number of events.


The note to ATCO has been done in August 2008. An improvementhas been observedfrom September2008 and, of course, in 2009.

Action 3.Communication to ATCOs via briefings, safety commission, feedback


Between May 2008 and December 2009 during each briefing, each safety commission and each feedback, the mandatory notification of safety occurrences is reminded.

Module 4Safety Occurrences

Definitions, List of Safety Occurrences

Report and Notification

Analysis (Severity, Frequency, Causes)

Corrective Actions, Feedback

Safety occurrences

Regulations and Methodology of the French ANSP






Safety occurrences


ICAO Annex 19

Requirements in Annexe 19

Guidance in DOC 9859

ICAO Annex 19



3. Safety Assurance

4. Safety Promotion

Requirements for Safety Occurrences.

ICAO Annex 19


2.1 Hazard identification.2.2 Safety risk assessment and mitigation

ICAO Annex 19


2.1 Hazard identification.Notification, immediate actions, analysis of eventsProcessing of safety occurrencesProcessing of security occurrencesPlanning tools and resources2.2 Safety Risk Assessment and MitigationSafety studies (changes)Programmed method of interventionMonitoring measures to reduce risk

ICAO Annex 19

4. Safety Promotion

4.1 Training and education.4.2 Safety communication.

ICAO Annex 19

4. Safety Promotion

4.1 Training and education.SMI trainingCompetency (ATCO, ATSE)4.2 Safety communication.Lesson dissemination

Requirements


Guidance : classificationfor severity and frequency

ESARR2 Summary

EAM2/GUI1 Summary

Attachment 1 is used for OPS events.

Attachment 2 is used for Technical events.

Regulations : ICAO Annex 19, DOC 9859,

ESARR2, EAM2/GUI1

Assessment of safety occurrences

Safety events : How to do analysis ? How to classify severity and frequency ? How to search causes ? The regulations are not enough explicit.

French ANSP Methodology

This methodology explains how to do the assessment of the safety occurrences : report, notification, analysis

Satety Occurrences : Methodology of the French ANSP

French ANSP Methodology

Procedure :Findings/

Corrective Actions

Manual :Assessment of

Safety Occurrences

Satety Occurrences : Methodology of the French ANSP

Manual for Assessment of safety occurrences

This manual is used by Safety Subdivisions (OPS andTechnical).






Safety occurrences


Definition : ATM Safety Occurrences

Occurrences : Accidents, serious incidents and incidentsas well as other defects or malfunctioning of an aircraft, itsequipment and any element of the Air Navigation Systemwhich is used or intended to be used for the purpose or inconnection with the operation of an aircraft or with theprovision of an air traffic management service ornavigational aid to an aircraft.

List of Safety Occurrences(To be Reported and Analysed)

1. Accidents : Mid Air collision, Controlled Flight Into Terrain (CFIT), Collision on the ground between aircraft, Collision between an airborne aircraft and vehicle/another aircraft on the ground, Collision on the ground between aircraft and vehicle or person or obstruction(s), Other accidents of special interest would include losses of control in flight, due to VORTEX or meteorological conditions.

2. Incidents :Near collision Separation minima infringement, Inadequate separation, Near Controlled Flight Into Terrain (Near CFIT), Runway incursion where avoiding action was necessary.Potential for collision or near Runway incursion where no avoiding action is necessary, Runway excursion by aircraft, Aircraft deviation from ATC clearance, Aircraft deviation from applicable ATM regulation:


5 NM

5 NM

5 NM

Horizontal separation (aircrafts same flight level FL)

En route minimum horizontal separation 5 NM.

1 000 FT

Vertical separation

FL 220

FL 210

En route minimum vertical separation 1 000 FT.

Short Term Conflict Alert STCA

The Short Term Conflict Alert (STCA) informs the ATCO when 2 aircrafts are going under the minima of separation.

Visual alarm : aircrafts involved are in red on the radar screen

3. ATM-specific occurrences (technical)This shall include the following occurrences: Inability to provide Air Traffic Management Services: Failure of Communication function, Failure of Surveillance function, Failure of Data Processing and Distribution function, Failure of Navigation function, ATM system security.







Safety occurrences


Safety Occurrences

Safety Event

CausesBad radio communications, Human error

Incursion of a vehicle on the runway

ConsequencesInterrupted landing, collision

What did he say ? We could

go I believe

Vehi grrr unway

Runway incursions : Danger

Be careful. Be sure that the radio communications are understood

by your correspondent

Safety Event

Causes

Consequences

To find the causes, we have to investigate the safety event.

A safety event must be reported.

Unfortunately the only thing we can do is to try to minimize the consequences.

Safety Occurrences

Safety Event

Causes

Consequences

To avoid the occurrence of a safety event we have to delete the causes.

X If we delete the causes

we also delete the consequences.X

Safety Occurrences

PolicyAction planObjectivesResources

Safety Occurrences Assessment - Analyze- Severity- Causes Corrective

actions to avoid same causes

Provide ATM & CNS servicesInstall and maintain ATM & CNS

Safety occurrences : Losses of separation,Technical events

Safety Occurrences

Improvement loop for safety occurrences.






Safety occurrences


Safety Occurrences : Report and Notification

Record eventin database

List of eventsto be notifiedto managers

Real Time

SafetyOccurrence

Immediate Actionsif necessary

ECCAIRS : European Coordination Centre for Accident and Incident Reporting Systems.Toward next step

(analysis)

ECCAIRS Database

Report

ATCOs, ATSEPs, Pilots

How to Report safety occurrences to safety subdivisions ?

The reports of the safety occurrences are done by using a dedicated form.

Different forms are available :- Form for ATCO (AIRPROX, Losses of separation ).- Form for ATSEP (technical events, failure of systems ).

All the infringements of the norm (for French ANSP : less than 5 NM horizontal, less than 1000 ft) are automatically recorded in a log file.

Safety Occurrences : Report and Notification

ATCO Occurrence Form 1/2

X

XTP FL280 28/10/2014 12:15 X

AFR F-ABCD A320 LFPG LFML X1457 IFR

XBAW G-KLMN B737 EGLL LIRF IFR2812

RATCAS

123,45 YES NO

A AWY Radar control

XX X

X6002,4

Explanation of the incident by ATCO involved.

X

X

ATCO Paris/ACC 01:05 04:05

None

ATCO Occurrence Form 2/2

ATSEP Occurrence Form 1/2

X

X

Position TT 611/02/2014 S03X

11/02/2014

X

ATSEP Occurrence Form 2/2

The backup computer that manages the radar screen was out of service without any alarm. The backup computer seems to be frozen since several hours and displays an image of the radar situation at 9h22 pm.After a reset situation OK.

XSupervisor

List of events to notify immediately

Accident

Near collision (situations where one aircraft andanother aircraft/the ground/a vehicle/person or object is perceived to be too close to each other) :

- Landing or attempted landing on an occupied or closed runway.

- Takeoff or attempted takeoff on an occupied or closed runway.

Event emergency reported by the pilot to the ATCO.

- Losses of separation (50%) and RATCAS.

Failure of Communication function.

List of events to notify immediately

Inability to provide ATM or CNS Services.

Failure of Data Processing and Distribution function.

Failure of Surveillance function.

ATCO or ATSEP

OperationalDuty

Engineer

ACC or Airport

Analyzewith experts

Chief Chief OPSChief Tech

RSMS

Y

N

END of notification process

Notification Process (mail, phone ).

Chief ANSP MSQS NAS

BEAOffice

investigation analysis

Y

Eventmust be notify ?

Outside ACC or Airport

Notification Process

Who is the operational duty engineer ?

Each week the operational duty engineer is chosen among the chiefs of subdivisions and their deputies.






Safety occurrences


Analysis

ECCAIRS : European Coordination Centre for Accident and Incident Reporting Systems.

Toward next step(search causes)

SearchCauses ?

The databasesare updated during analysis

Safety Subdivision or safety commission

To determine if causesmust be searcheda matrix is used by thesafety Subdivision

N

END

Safety Subdivision

Severity and FrequencyClassification

Debriefing of ATCOor ATSEP involved by

safety subdivision

Y

Analysis

Causes evaluatedby safety

commission

ECCAIRS : European Coordination Centre for Accident and Incident Reporting Systems.

Toward next step(corrective actions)

The databasesare updated during analysis

Y NSafetyCommission

?

Causes evaluatedby safety

subdivision

OPS Division : Severity

Two levels of severity:- Global severity (ATC + aircraft)- ATC Severity.

The ATC severity is the most interesting for us, because we can work to improve it.

If we have a problem with a flight we must inform the airline. If we have too many problems with the same airline we must inform our National Supervisory Authority.

Classification SignificationA : Serious incident ICAO Annex 13: An incident involving circumstances

indicating that an accident nearly occurred.Note: The difference between an accident and a serious incident lies only in the result.

B : Major incident An incident associated with the operation of an aircraft, in which safety of aircraft may have been compromised, having led to a near collision between aircraft, with ground or obstacles (i.e., safety margins not respected which is not the result of an ATC instruction).

C : Significant incident An incident involving circumstances indicating that an accident, a serious or major incident could have occurred, if the risk had not been managed within safety margins, or if another aircraft had been in the vicinity.

D : Not determined An incident which has no safety significance.E : No safety effect Insufficient information was available to determine the risk

involved or inconclusive or conflicting evidence precluded such determination.


Classification ExamplesA : Serious incident - Critical near collision between aircraft or between aircraft and

obstacle(s).- Separations lower than half the separation minima.- Controlled Flight Into Terrain only marginally avoided- Aborted take-offs/landings on a closed or engaged runway- Take-offs/landings from a closed or engaged runway

B : Major incident - Loss of separation (separation higher that half the separation minima) which is not fully under ATC control.- Safety margins not respected ( higher than half the applicable safety margins) which is not fully under ATC control.

C : Significant incident - After visual contact between two aircraft, no avoidance manoeuvre was seen as necessary or was carried out within safety margins.- Aircraft deviation from ATC clearance (such as flight level, route, heading, runway)- Unauthorised penetration of airspace.- Runway incursion with no other traffic in the vicinity (hence, where no avoiding action was necessary).



EUROCONTROL provides some guidelines to classify severity by using Reason plates. For each plate you have to answer some questions and you get points given for each answer. The amount of points helps you to choose the severity.

Regulations

ManagementControllers

Equipments

Examle of question :The event has been :- detected on time (-1)- detected late. (0)- detected by somebody else.(2)- never detected. (3)- detected and forgotten. (2)

FREQUENCY DEFINITION5 Extremely rare Has never occurred yet throughout the total lifetime

of the system.4 Rare Only very few similar incidents on record when

considering a large traffic volume or no records on asmall traffic volume.

3 Occasional Several similar occurrences on record - Hasoccurred more than once at the same location.

2 Frequent A significant number of similar occurrences alreadyon record - Has occurred a significant number oftimes at the same location.

1 Very Frequent A very high number of similar occurrences alreadyon record- Has occurred a very high number of timesat the same location.

OPS Division : Frequency

5 levels of frequency has been defined.

Technical Division : Severity

For technical events we use the same severity than for the global ATM severity.

We use lower case letters !

OPS Division : Classification matrix for severity and frequency

Serious A1 A2 A3 A4 A5Major B1 B2 B3 B4 B5

Significant C1 C2 C3 C4 C5Not determined D1 D2 D3 D4 D5No safety effect E1 E2 E3 E4 E5

Veryfrequent

Frequent Occasional Rare Extremelyrare

A safety occurrence is characterized by two items : - Severity- Frequency

OPS Division : Classification matrix for severity and frequency

Serious A1 A2 A3 A4 A5Major B1 B2 B3 B4 B5

Significant C1 C2 C3 C4 C5Not determined D1 D2 D3 D4 D5No safety effect E1 E2 E3 E4 E5

Veryfrequent

Frequent Occasional Rare Extremelyrare

The causes must be searched for the safety occurrences in the red area (example).

OPS Division : Safety Commission

Composition of the commission: Head of OPS division. Head of Subdivisions Studies, Training, Safety.ATCO involved, others ATCO, experts ...Brainstorming to identify causes.

Replaying radar data

Replaying radio communications

Causes

The numbers are the references in the database.

A safety occurrence can have several causes (455, 443 ).

It is very important to define corrective actions on the main causes.

We have to identify the different categories of causes, specially for the human factors.

Horizontal and vertical distribution of safety eventsft

NM

NM

ft

Inside red rectangle we are 50% under the minimum of separation, inside the orange 70%, inside the yellow 80% and inside the blue 100%.

Comparison between year Y-1 and year Y of the horizontal and vertical distribution of losses of separation.

Year Y -1

Year Y

A very bad loss of separation with 1,4 NM (horizontal) and same level (vertical).

Geographic distribution of safety events by severity

This graph shows us that we have a lot of safety events in sector AO. So we decided to modify the structure of this area and to create another sector.Sometimes we are taking corrective actions when we have several safety events with the same cause.The causes are :- too much traffic,- a bad design of the airspace.In module 6 we will see the change we have done to create a new sector.

Load Sector Description ATMsev

ATCsev

Freq Ref A/C 1 A/C 2 Lossof Sep

66% RT2 aircrafts going to Orly. 2nd one goes faster than 1st.Bad reaction to STCA.

C b 3 497 AFR1301

AFR5573

100%

OPS division : Safety occurrence 1Analyze

5NM


ATCsev


107%

AOClearance given tooearly.No reaction to STCA.No use of emergency phraseology.

C b 4 668 TAR964 AF415N

100%


D


ATCsev


83% UP Level Bust. B e 3 603 AF814WL

VPBBV

70%Pilote


1 000 FT

FL 220

FL 210

FL 200

1 000 FT

Level bust this aircraft does not stop at FL200 (clearance).


For technical events, we use the same severity grid than for the global ATM severity.

But we use lower case letters !

Technical Division : SeveritySEVERITY DEFINITION

aa Total inability to provide safe ATM service

An occurrence associated with the total inability toprovide any degree of ATM Services in compliance withapplicable Safety Regulatory Requirements, where:There is a sudden and non managed total loss ofATM service or situation awarenessThere is a totally corrupted ATM service or corruptedinformation provided to ATS personnel.

a Serious inabilityto provide safe ATM service

An occurrence associated with almost a total and suddeninability to provide any degree of ATM Services incompliance with applicable Safety RegulatoryRequirements. It involves circumstances indicating thatthe ability to provide ATM services is severelycompromised and has the potential to impact manyaircraft safe operations over a significant period of time.

b Partial inability to provide safe ATM service

An occurrence associated with the sudden and partialinability to provide ATM Services in compliance withapplicable Safety Regulatory Requirements.


SEVERITY DEFINITIONc Ability to provide safe butdegraded ATM service

An occurrence involving circumstances indicating that atotal, serious

Documents

SMS_ Rosellini