Top 5 ATM Operational Safety Priorities Landing Without Clearance BLAJEV Tzvetomir Operational Safety Coordinator, EUROCONTROL Captain Ed Pooley The Air Safety Consultancy

In Brief: The process to determine the priorities - SAFMAPs What are the Top 5? Operational safety study example: Landing without clearance

In Brief: The process to determine the priorities - SAFMAPs What are the Top 5 ? Operational safety study example: Landing without Clearance

How to prioritise Counting numbers versus understanding mechanisms Single point of view versus a common picture Learning from negative versus learning from both negative and positive

How did we get it? We studied two risk areas: (1) Runway incursion (2) Loss of separation en-route Workshops with 6 ANSPS during Summer 2012 Reviewing severity A and B incidents for 2011 Mapping the incidents on SAFMAPs (Safety Functions Maps) – 3 hierarchical levels were developed

SAFMAP Level 0 – Runway Collision Providence UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT Pilot/Driver RWY Conflict Resolution UNRESOLVED BY ATC RUNWAY CONFLICT ATC RWY Conflict Resolution RUNWAY CONFLICT Preventing incorrect RWY presence to turn into RWY conflict RUNWAY INCURSION Preventing incorrect presence into RWY protected area

SAFMAP Level 1 PROVIDENCE UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT Opportunity for physical collision avoidance The conflict is detectable by the pilot / driver The conflict is detected by the pilot/ driver Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided UNRESOLVED BY ATC RUNWAY CONFLICT ATCO detects the conflict Sufficient time and effective ATC decision Adequate Communication Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided RUNWAY CONFLICT Opportunity to prevent the conflict before or with intended RWY use clearance Crew/driver prevents conflict after detecting it before or with intended RWY use clearance ATCO prevents conflict after detecting it before or with intended RWY use clearance RUNWAY INCURSION Pilot/driver detecting that RWY entry will be incorrect ATC prevents incorrect presence No incorrect presence of take-off aircraft No incorrect presence of landing aircraft No incorrect presence of person Preventing ATC causing incorrect entry ATC prevents incorrect presence Taxi pilot/driver adequate positional awareness Taxi pilot/driver adequate communication No confusion that there is a clearance Correct vacation

Incident trajectories on the SAFMAP PROVIDENCE UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT Opportunity for physical collision avoidance The conflict is detectable by the pilot / driver The conflict is detected by the pilot/ driver Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided UNRESOLVED BY ATC RUNWAY CONFLICT ATCO detects the conflict Sufficient time and effective ATC decision Adequate Communication Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided RUNWAY CONFLICT Opportunity to prevent the conflict before or with intended RWY use clearance Crew/driver prevents conflict after detecting it before or with intended RWY use clearance ATCO prevents conflict after detecting it before or with intended RWY use clearance RUNWAY INCURSION Pilot/driver detecting that RWY entry will be incorrect ATC prevents incorrect presence No incorrect presence of take-off aircraft No incorrect presence of landing aircraft No incorrect presence of person Preventing ATC causing incorrect entry ATC prevents incorrect presence Taxi pilot/driver adequate positional awareness Taxi pilot/driver adequate communication No confusion that there is a clearance Correct vacation

Incident trajectory example 1 A vehicle entered RWY for maintenance work without clearance after confusion of the position ATCO detected the incorrect entry with the red stop bar crossing alarm at the time of issuing clearance for a take-off aircraft ATCO immediately cancel the take-off clearance PROVIDENCE UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT Opportunity for physical collision avoidance The conflict is detectable by the pilot / driver The conflict is detected by the pilot/ driver Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided UNRESOLVED BY ATC RUNWAY CONFLICT ATCO detects the conflict Sufficient time and effective ATC decision Adequate Communication Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided RUNWAY CONFLICT Opportunity to prevent the conflict before or with intended RWY use clearance Crew/driver prevents conflict after detecting it before or with intended RWY use clearance ATCO prevents conflict after detecting it before or with intended RWY use clearance RUNWAY INCURSION Pilot/driver detecting that RWY entry will be incorrect ATC prevents incorrect presence No incorrect presence of take-off aircraft No incorrect presence of landing aircraft No incorrect presence of person Preventing ATC causing incorrect entry ATC prevents incorrect presence Taxi pilot/driver adequate positional awareness Taxi pilot/driver adequate communication No confusion that there is a clearance Correct vacation

Incident trajectory example 2 PROVIDENCE UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT Opportunity for physical collision avoidance The conflict is detectable by the pilot / driver The conflict is detected by the pilot/ driver Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided UNRESOLVED BY ATC RUNWAY CONFLICT ATCO detects the conflict Sufficient time and effective ATC decision Adequate Communication Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided During high workload, wet RWY, many Arrivals, more time than usual to vacate the RWY ATCO focussing on the one vacating the outer RWY, tired at the and of the day Clear an a/c to cross (after landing) after already given TOF clearance to another a/c No stop bars used - only for low visibility procedures After identifying the conflict ATCO instructed the crossing to expedite RUNWAY CONFLICT Opportunity to prevent the conflict before or with intended RWY use clearance Crew/driver prevents conflict after detecting it before or with intended RWY use clearance ATCO prevents conflict after detecting it before or with intended RWY use clearance RUNWAY INCURSION Pilot/driver detecting that RWY entry will be incorrect ATC prevents incorrect presence No incorrect presence of take-off aircraft No incorrect presence of landing aircraft No incorrect presence of person Preventing ATC causing incorrect entry ATC prevents incorrect presence Taxi pilot/driver adequate positional awareness Taxi pilot/driver adequate communication No confusion that there is a clearance Correct vacation

Incident trajectory example 3 Landing aircraft mistuned frequency of the TWR and decided to follow the loss of communication landing procedure in VMC Take-off aircraft on the RWY already but no opportunity for take-off or for vacating the RWY The landing aircraft failed to see that RWY is occupied and landed on top of the a/c at the threshold PROVIDENCE UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT Opportunity for physical collision avoidance The conflict is detectable by the pilot / driver The conflict is detected by the pilot/ driver Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided UNRESOLVED BY ATC RUNWAY CONFLICT ATCO detects the conflict Sufficient time and effective ATC decision Adequate Communication Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided RUNWAY CONFLICT Opportunity to prevent the conflict before or with intended RWY use clearance Crew/driver prevents conflict after detecting it before or with intended RWY use clearance ATCO prevents conflict after detecting it before or with intended RWY use clearance RUNWAY INCURSION Pilot/driver detecting that RWY entry will be incorrect ATC prevents incorrect presence No incorrect presence of take-off aircraft No incorrect presence of landing aircraft No incorrect presence of person Preventing ATC causing incorrect entry ATC prevents incorrect presence Taxi pilot/driver adequate positional awareness Taxi pilot/driver adequate communication No confusion that there is a clearance Correct vacation

In Brief: The process to determine the priorities - SAFMAPs What are the Top 5? Operational safety study example: Landing without clearance

Top 5: (1) Risk of operations without transponder or with dysfunctional one A single threat often removing all the barriers up to ‘see and avoid’; No ATC awareness; No STCA; No TCAS/ACAS.

Top 5: (2) Landing without clearance For numerous reasons, aircraft sometimes land without ATC clearance; This results in runway incursions that are often only resolved through ‘providence’.

Top 5: (3) Detection of Occupied Runway Good share of the severe Runway Incursion incidents could have been prevented; Need for the controllers to detect that the runway was occupied at the time of giving a clearance for the next aircraft to use it.

Top 5: (4) “Blind Spot” Conflict was not detected with the closest aircraft; After descending clearance; Rapidly developing situation – often 1000ft and 15 Nm between the conflicting a/c.

Top 5: (5) Conflict detection with adjacent sectors Involve “inadequate coordination” of clearance with an adjacent sector; These typically involve either an early (premature) transfer of control to or from the neighbouring sector.

In Brief: The process to determine the priorities - SAFMAPs What are the Top 5 ? Operational safety study example: Landing without clearance

Operational Safety Study Provide additional insights on causal/contributory factors Suggest actions to reduce or eliminate risk factors Identify industry ‘best’ practice and lessons learned Inform development of SKYbrary material Top 5 Safety Priorities

The Generic Study Process BARRIERS SCENARIOS CONCLUSIONS ANALYSIS OPERATIONAL CONTEXT Top 5 Safety Priorities

The Generic Study Process BARRIERS SCENARIOS CONCLUSIONS ANALYSIS OPERATIONAL CONTEXT Top 5 Safety Priorities

Example Conflict Scenarios (1) Active RWY LANDING WITHOUT CLEARANCE Loss of communication RWY confusion Communication misunderstanding Absence of clearance overlooked Deliberate 2a 3a 3b 1 3c 3d 3e 2b Unoccupied RWY and no clearance given Unoccupied but a clearance has been given Occupied RWY Top 5 Safety Priorities

The Generic Study Process BARRIERS SCENARIOS CONCLUSIONS ANALYSIS OPERATIONAL CONTEXT Top 5 Safety Priorities

Barriers Top 5 Safety Priorities

Mitigation Barriers PROVIDENCE UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT Opportunity for physical collision avoidance The conflict is detectable by the pilot / driver The conflict is detected by the pilot/ driver Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided UNRESOLVED BY ATC RUNWAY CONFLICT ATCO detects the conflict Sufficient time and effective ATC decision Adequate Communication Crew/driver/person initiates action on time The avoidance action is correctly implemented and collision is avoided RUNWAY CONFLICT Opportunity to prevent the conflict before or with intended RWY use clearance Crew/driver prevents conflict after detecting it before or with intended RWY use clearance ATCO prevents conflict after detecting it before or with intended RWY use clearance RUNWAY INCURSION Top 5 Safety Priorities

The Generic Study Process BARRIERS SCENARIOS CONCLUSIONS ANALYSIS OPERATIONAL CONTEXT Top 5 Safety Priorities

Operational Context (1) Availability of radar guidance for the approach Meteorological conditions and time of the day Runway status Clearance conditions Visual surveillance capability from the Tower Top 5 Safety Priorities

The Generic Study Process BARRIERS SCENARIOS CONCLUSIONS ANALYSIS OPERATIONAL CONTEXT Top 5 Safety Priorities

OPERATIONAL SCENARIOS v BARRIER EFFECTIVENESS All Scenarios formulated are not equally prevalent! And: All Prevention Barriers (PB) are not equal in their relevance to the various scenarios All Mitigation Barriers (MB) are not equal in their relevance to the various scenarios But In both cases there are some clear indications of best “value- added” in responding to the risk of LwC Assign each ‘PB’ and each ‘MB’ to the defined scenarios as fully effective, partially effective or ineffective/not intended to address – traffic light system: Top 5 Safety Priorities 29 29

PREVENTION BARRIER MATRIX   PB1 PB2 PB3 PB4 PB5 PB6 PB7 PB8 PB9 PB10 PB11 PB12 PB13 PB14 A1 A2 A3 B1 B2  B3  C1 C2 C3 D1 D2 D3 E1 E2 E3 Top 5 Safety Priorities

MITIGATION BARRIER MATRIX   MB1 MB2 MB3 MB4 MB5 MB6 MB7 MB8 MB9 MB10 A1 A2 A3 B1 B2 B3 C1 C2 C3 D1 D2 D3 E1 E2 E3 Top 5 Safety Priorities

RANKING OF PREVENTION BARRIER EFFECTIVENESS Arbitrary weighting of Green: Yellow at 3:1 (use of 2:1 would make little relative difference) Best Ranked Prevention Barriers (score range 3-31): PB 5 an automated (probably visual), alerting of pilots to an occupied runway and thus the (probable) absence of a landing clearance PB9 a controller-activated (probably visual) alerting of pilots to the absence of a landing clearance. Best/Worst Coverage of Prevention Barriers by Scenario: Best - ‘D’ (pilot unaware) Intermediate - ‘B’ (runway confusion); ‘C’ (comms confusion); ‘A’ (loss of comms) Worst - ‘E’ (deliberate act) Top 5 Safety Priorities 32 32

RANKING OF MITIGATION BARRIER EFFECTIVENESS Same Arbitrary weighting of Green: Yellow at 3:1 (again use of 2:1 would make little relative difference) Best Ranked Mitigation Barriers (score range 20-33 plus one outlier at 3): MB 2 - controller intervention prompted by an automatic alert with or without prior issue of a conflicting clearance. MB 4 - pilot/driver action prompted by an automatic (probably visual) alert. MB3 – pilot/driver action promoted by proactive monitoring of traffic visually or on the radio Best/Worst Coverage of Mitigation Barriers by Scenario: Best - ‘B’ (runway confusion) Intermediate - ‘A’ (loss of comms); ‘C’ (comms confusion); ‘D’ (unaware) Worst - ‘E’ (deliberate act) Top 5 Safety Priorities 33 33

VALIDATION OF BARRIER EFFECTIVENESS Identifies the barriers that could have prevented or mitigated an actual event had they been Available and Used Is not an analysis of what actually happened since the test events were not prevented. Top 5 Safety Priorities

SCENARIO ‘A’ (LOSS OF COMMS) Non-precision approach by private business flight by aircraft owner. Mistuned TWR in IMC and when no contact possible assumed radio failure and did not revert to APP. Broke cloud at 1.5nm and continued land over a Q400 lined up for departure at the threshold without seeing it. Three effective Prevention Barriers: PB4, PB5, PB9 These include the top two ranked barriers Two effective Mitigation Barriers: MB2, MB4 These include two of the three top ranked barriers Top 5 Safety Priorities 35

SCENARIO ‘B’ (RUNWAY CONFUSION) Two parallel runways, one closed long term for nearly- completed reconstruction. In VMC, ATC approved an inbound CRJ crew request to land in the reciprocal direction to that in use. The aircraft was then landed on the closed runway without encountering obstacles - ATC only noticed as the aircraft was about to touch down. The crew said they were used to programming the FMS for the runway they actually used and failed to appreciate or correct their error even when flying a visual approach. Seven effective Prevention Barriers: PB5, PB6, PB7, PB8, PB9, PB11, PB13 These include the top two ranked barriers Two effective Mitigation Barriers: MB3, MB8 These include the one of the top three ranked barriers Top 5 Safety Priorities 36

SCENARIO ‘C’ (COMMS CONFUSION) ATC instructed pilot to “continue approach” to which the pilot readback was “continue”. ATC made no further attempt to communicate to the aircraft and it was landed in the belief that clearance had been given. Five effective Prevention Barriers: PB5, PB9, PB10, PB11, PB12 These include the top two ranked barriers Six effective Mitigation Barriers: MB2, MB3, MB4, MB5, MB6, MB8 These include the top three ranked barriers Top 5 Safety Priorities 37

SCENARIO ‘D’ (PILOT UNAWARE) On initial contact with TWR, the aircraft was instructed to continue advised to expect to be called back. After landing without clearance in the belief that it had been received, the pilot, who was familiar with the airport involved, observed that landing clearance there was usually given a long way out and the absence of the promised call back with clearance was easily missed. Nine effective Prevention Barriers: PB1, PB2, PB3, PB5, PB9, PB10, PB11, PB12, PB14 These include the top two ranked barriers Nine effective Mitigation Barriers: MB1, MB2, MB3, MB4, MB5, MB6, MB7, MB8, MB10 These include the top three ranked barriers Top 5 Safety Priorities 38

SCENARIO ‘E’ (DELIBERATE ACT) An en-route light aircraft lost positional awareness in VMC and, unequipped with GPS, saw what was considered to be a convenient airport, and made a downwind join in the opposite circuit direction to that in use and continued onto finals and landed without radio contact. TWR saw the aeroplane when it was downwind and instructed another aircraft approaching from the opposite in-use direction to make a go around. Two effective Prevention Barriers: PB5, PB9 These are the top two ranked barriers Effective Mitigation Barriers: MB1, MB2, MB3, MB4, MB5, MB6, MB7, MB8, MB10 These include the top three ranked barriers Top 5 Safety Priorities 39

The Generic Study Process BARRIERS SCENARIOS CONCLUSIONS ANALYSIS OPERATIONAL CONTEXT Top 5 Safety Priorities

SOME CONCLUSIONS (1) The study has identified the best performing potential prevention and mitigation barriers. Some barriers are likely to be more cost effective than others. Other studies referenced in the Paper are supportive of these findings but also advocate looking at barriers which would directly reduce the prevalence of pilots not being on the TWR frequency as the landing runway is approached. Combinations of the most effective barriers are likely to make an impressive impact on LwC prevalence and mitigation. Top 5 Safety Priorities

SOME CONCLUSIONS (2) The top two ranked Prevention Barriers, PB5 and PB9, were applicable in all five scenario examples. The top three ranked Mitigation Barriers, MB2, MB3, & MB4 were all applicable in Scenarios C (Comms confusion), ‘D’ (Pilot unaware) and ‘E’ (Deliberate Act) and at least one was applicable in the other two scenarios - ‘A’ (Loss of Comms) and ‘B’ (runway confusion. An outstanding PB5 solution, ‘FAROS’ as currently being deployed in the USA, was estimated prior to this implementation as likely to prevent 65% of runway conflicts – some of which are LwC! Top 5 Safety Priorities 42

Questions? Top 5 Safety Priorities