1. Top 5 ATM Operational Safety Priorities
Landing Without Clearance
BLAJEV Tzvetomir
Operational Safety Coordinator, EUROCONTROL
Captain Ed Pooley
The Air Safety Consultancy

2. In Brief: The process to determine the priorities - SAFMAPs
What are the Top 5?
Operational safety study example: Landing without clearance

3. In Brief: The process to determine the priorities - SAFMAPs
What are the Top 5 ?
Operational safety study example: Landing without Clearance

4. How to prioritise Counting numbers versus understanding mechanisms
Single point of view versus a common picture
Learning from negative versus learning from both negative and positive

5. How did we get it?
We studied two risk areas: (1) Runway incursion (2) Loss of separation en-route
Workshops with 6 ANSPS during Summer 2012
Reviewing severity A and B incidents for 2011
Mapping the incidents on SAFMAPs (Safety Functions Maps) – 3 hierarchical levels were developed

6. SAFMAP Level 0 – Runway Collision
Providence
UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT
Pilot/Driver RWY Conflict Resolution
UNRESOLVED BY ATC RUNWAY CONFLICT
ATC RWY Conflict Resolution
RUNWAY CONFLICT
Preventing incorrect RWY presence to turn into RWY conflict
RUNWAY INCURSION
Preventing incorrect presence into RWY protected area

7. SAFMAP Level 1 PROVIDENCE
UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT
Opportunity for physical collision avoidance
The conflict is detectable by the pilot / driver
The conflict is detected by the pilot/ driver
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and collision is avoided
UNRESOLVED BY ATC RUNWAY CONFLICT
ATCO detects the conflict
Sufficient time and effective ATC decision
Adequate Communication
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and collision is avoided
RUNWAY CONFLICT
Opportunity to prevent the conflict before or with intended RWY use clearance
Crew/driver prevents conflict after detecting it before or with intended RWY use clearance
ATCO prevents conflict after detecting it before or with intended RWY use clearance
RUNWAY INCURSION
Pilot/driver detecting that RWY entry will be incorrect
ATC prevents incorrect presence
No incorrect presence of take-off aircraft
No incorrect presence of landing aircraft
No incorrect presence of person
Preventing ATC causing incorrect entry
ATC prevents incorrect presence
Taxi pilot/driver adequate positional awareness
Taxi pilot/driver adequate communication
No confusion that there is a clearance
Correct vacation

8. Incident trajectories on the SAFMAP
PROVIDENCE
UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT
Opportunity for physical collision avoidance
The conflict is detectable by the pilot / driver
The conflict is detected by the pilot/ driver
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and collision is avoided
UNRESOLVED BY ATC RUNWAY CONFLICT
ATCO detects the conflict
Sufficient time and effective ATC decision
Adequate Communication
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and collision is avoided
RUNWAY CONFLICT
Opportunity to prevent the conflict before or with intended RWY use clearance
Crew/driver prevents conflict after detecting it before or with intended RWY use clearance
ATCO prevents conflict after detecting it before or with intended RWY use clearance
RUNWAY INCURSION
Pilot/driver detecting that RWY entry will be incorrect
ATC prevents incorrect presence
No incorrect presence of take-off aircraft
No incorrect presence of landing aircraft
No incorrect presence of person
Preventing ATC causing incorrect entry
ATC prevents incorrect presence
Taxi pilot/driver adequate positional awareness
Taxi pilot/driver adequate communication
No confusion that there is a clearance
Correct vacation

9. Incident trajectory example 1
A vehicle entered RWY for maintenance work without clearance after confusion of the position
ATCO detected the incorrect entry with the red stop bar crossing alarm at the time of issuing clearance for a take-off aircraft
ATCO immediately cancel the take-off clearance
PROVIDENCE
UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT
Opportunity for physical collision avoidance
The conflict is detectable by the pilot / driver
The conflict is detected by the pilot/ driver
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and collision is avoided
UNRESOLVED BY ATC RUNWAY CONFLICT
ATCO detects the conflict
Sufficient time and effective ATC decision
Adequate Communication
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and collision is avoided
RUNWAY CONFLICT
Opportunity to prevent the conflict before or with intended RWY use clearance
Crew/driver prevents conflict after detecting it before or with intended RWY use clearance
ATCO prevents conflict after detecting it before or with intended RWY use clearance
RUNWAY INCURSION
Pilot/driver detecting that RWY entry will be incorrect
ATC prevents incorrect presence
No incorrect presence of take-off aircraft
No incorrect presence of landing aircraft
No incorrect presence of person
Preventing ATC causing incorrect entry
ATC prevents incorrect presence
Taxi pilot/driver adequate positional awareness
Taxi pilot/driver adequate communication
No confusion that there is a clearance
Correct vacation

10. Incident trajectory example 2
PROVIDENCE
UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT
Opportunity for physical collision avoidance
The conflict is detectable by the pilot / driver
The conflict is detected by the pilot/ driver
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and collision is avoided
UNRESOLVED BY ATC RUNWAY CONFLICT
ATCO detects the conflict
Sufficient time and effective ATC decision
Adequate Communication
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and collision is avoided
During high workload, wet RWY, many Arrivals, more time than usual to vacate the RWY
ATCO focussing on the one vacating the outer RWY, tired at the and of the day
Clear an a/c to cross (after landing) after already given TOF clearance to another a/c
No stop bars used - only for low visibility procedures
After identifying the conflict ATCO instructed the crossing to expedite
RUNWAY CONFLICT
Opportunity to prevent the conflict before or with intended RWY use clearance
Crew/driver prevents conflict after detecting it before or with intended RWY use clearance
ATCO prevents conflict after detecting it before or with intended RWY use clearance
RUNWAY INCURSION
Pilot/driver detecting that RWY entry will be incorrect
ATC prevents incorrect presence
No incorrect presence of take-off aircraft
No incorrect presence of landing aircraft
No incorrect presence of person
Preventing ATC causing incorrect entry
ATC prevents incorrect presence
Taxi pilot/driver adequate positional awareness
Taxi pilot/driver adequate communication
No confusion that there is a clearance
Correct vacation

11. Incident trajectory example 3
Landing aircraft mistuned frequency of the TWR and decided to follow the loss of communication landing procedure in VMC
Take-off aircraft on the RWY already but no opportunity for take-off or for vacating the RWY
The landing aircraft failed to see that RWY is occupied and landed on top of the a/c at the threshold
PROVIDENCE
UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT
Opportunity for physical collision avoidance
The conflict is detectable by the pilot / driver
The conflict is detected by the pilot/ driver
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and collision is avoided
UNRESOLVED BY ATC RUNWAY CONFLICT
ATCO detects the conflict
Sufficient time and effective ATC decision
Adequate Communication
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and collision is avoided
RUNWAY CONFLICT
Opportunity to prevent the conflict before or with intended RWY use clearance
Crew/driver prevents conflict after detecting it before or with intended RWY use clearance
ATCO prevents conflict after detecting it before or with intended RWY use clearance
RUNWAY INCURSION
Pilot/driver detecting that RWY entry will be incorrect
ATC prevents incorrect presence
No incorrect presence of take-off aircraft
No incorrect presence of landing aircraft
No incorrect presence of person
Preventing ATC causing incorrect entry
ATC prevents incorrect presence
Taxi pilot/driver adequate positional awareness
Taxi pilot/driver adequate communication
No confusion that there is a clearance
Correct vacation

12. In Brief: The process to determine the priorities - SAFMAPs
What are the Top 5?
Operational safety study example: Landing without clearance

13. Top 5: (1) Risk of operations without transponder or with dysfunctional one
A single threat often removing all the barriers up to ‘see and avoid’;
No ATC awareness;
No STCA;
No TCAS/ACAS.

14. Top 5: (2) Landing without clearance
For numerous reasons, aircraft sometimes land without ATC clearance;
This results in runway incursions that are often only resolved through ‘providence’.

15. Top 5: (3) Detection of Occupied Runway
Good share of the severe Runway Incursion incidents could have been prevented;
Need for the controllers to detect that the runway was occupied at the time of giving a clearance for the next aircraft to use it.

16. Top 5: (4) “Blind Spot”
Conflict was not detected with the closest aircraft;
After descending clearance;
Rapidly developing situation – often 1000ft and 15 Nm between the conflicting a/c.

17. Top 5: (5) Conflict detection with adjacent sectors
Involve “inadequate coordination” of clearance with an adjacent sector;
These typically involve either an early (premature) transfer of control to or from the neighbouring sector.

18. In Brief: The process to determine the priorities - SAFMAPs
What are the Top 5 ?
Operational safety study example: Landing without clearance

19. Operational Safety Study
Provide additional insights on causal/contributory factors
Suggest actions to reduce or eliminate risk factors
Identify industry ‘best’ practice and lessons learned
Inform development of SKYbrary material
Top 5 Safety Priorities

20. The Generic Study Process
BARRIERS
SCENARIOS
CONCLUSIONS
ANALYSIS
OPERATIONAL CONTEXT
Top 5 Safety Priorities

21. The Generic Study Process
BARRIERS
SCENARIOS
CONCLUSIONS
ANALYSIS
OPERATIONAL CONTEXT
Top 5 Safety Priorities

22. Example Conflict Scenarios (1) Active RWY
LANDING WITHOUT CLEARANCE
Loss of communication
RWY confusion
Communication misunderstanding
Absence of clearance overlooked
Deliberate 2a 3a 3b 1 3c 3d 3e 2b
Unoccupied RWY and no clearance given
Unoccupied but a clearance has been given
Occupied RWY
Top 5 Safety Priorities

23. The Generic Study Process
BARRIERS
SCENARIOS
CONCLUSIONS
ANALYSIS
OPERATIONAL CONTEXT
Top 5 Safety Priorities

24. Barriers
Top 5 Safety Priorities

25. Mitigation Barriers PROVIDENCE
UNRESOLVED BY ATC AND PILOT/DRIVER RUNWAY CONFLICT
Opportunity for physical collision avoidance
The conflict is detectable by the pilot / driver
The conflict is detected by the pilot/ driver
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and collision is avoided
UNRESOLVED BY ATC RUNWAY CONFLICT
ATCO detects the conflict
Sufficient time and effective ATC decision
Adequate Communication
Crew/driver/person initiates action on time
The avoidance action is correctly implemented and collision is avoided
RUNWAY CONFLICT
Opportunity to prevent the conflict before or with intended RWY use clearance
Crew/driver prevents conflict after detecting it before or with intended RWY use clearance
ATCO prevents conflict after detecting it before or with intended RWY use clearance
RUNWAY INCURSION
Top 5 Safety Priorities

26. The Generic Study Process
BARRIERS
SCENARIOS
CONCLUSIONS
ANALYSIS
OPERATIONAL CONTEXT
Top 5 Safety Priorities

27. Operational Context (1)
Availability of radar guidance for the approach
Meteorological conditions and time of the day
Runway status
Clearance conditions
Visual surveillance capability from the Tower
Top 5 Safety Priorities

28. The Generic Study Process
BARRIERS
SCENARIOS
CONCLUSIONS
ANALYSIS
OPERATIONAL CONTEXT
Top 5 Safety Priorities

29. OPERATIONAL SCENARIOS v BARRIER EFFECTIVENESS
All Scenarios formulated are not equally prevalent! And:
All Prevention Barriers (PB) are not equal in their relevance to the various scenarios
All Mitigation Barriers (MB) are not equal in their relevance to the various scenarios
But In both cases there are some clear indications of best “value- added” in responding to the risk of LwC
Assign each ‘PB’ and each ‘MB’ to the defined scenarios as fully effective, partially effective or ineffective/not intended to address – traffic light system:
Top 5 Safety Priorities 29 29

30. PREVENTION BARRIER MATRIX
PB1
PB2
PB3
PB4
PB5
PB6
PB7
PB8
PB9
PB10
PB11
PB12
PB13
PB14 A1 A2 A3 B1
B2 
B3  C1 C2 C3 D1 D2 D3 E1 E2 E3
Top 5 Safety Priorities

31. MITIGATION BARRIER MATRIX
MB1
MB2
MB3
MB4
MB5
MB6
MB7
MB8
MB9
MB10 A1 A2 A3 B1 B2 B3 C1 C2 C3 D1 D2 D3 E1 E2 E3
Top 5 Safety Priorities

32. RANKING OF PREVENTION BARRIER EFFECTIVENESS
Arbitrary weighting of Green: Yellow at 3:1 (use of 2:1 would make little relative difference)
Best Ranked Prevention Barriers (score range 3-31):
PB 5 an automated (probably visual), alerting of pilots to an occupied runway and thus the (probable) absence of a landing clearance
PB9 a controller-activated (probably visual) alerting of pilots to the absence of a landing clearance.
Best/Worst Coverage of Prevention Barriers by Scenario:
Best - ‘D’ (pilot unaware)
Intermediate - ‘B’ (runway confusion); ‘C’ (comms confusion); ‘A’ (loss of comms)
Worst - ‘E’ (deliberate act)
Top 5 Safety Priorities 32 32

33. RANKING OF MITIGATION BARRIER EFFECTIVENESS
Same Arbitrary weighting of Green: Yellow at 3:1 (again use of 2:1 would make little relative difference)
Best Ranked Mitigation Barriers (score range plus one outlier at 3):
MB 2 - controller intervention prompted by an automatic alert with or without prior issue of a conflicting clearance.
MB 4 - pilot/driver action prompted by an automatic (probably visual) alert.
MB3 – pilot/driver action promoted by proactive monitoring of traffic visually or on the radio
Best/Worst Coverage of Mitigation Barriers by Scenario:
Best - ‘B’ (runway confusion)
Intermediate - ‘A’ (loss of comms); ‘C’ (comms confusion); ‘D’ (unaware)
Worst - ‘E’ (deliberate act)
Top 5 Safety Priorities 33 33

34. VALIDATION OF BARRIER EFFECTIVENESS
Identifies the barriers that could have prevented or mitigated an actual event had they been
Available and Used
Is not an analysis of what actually happened since the test events were not prevented.
Top 5 Safety Priorities

35. SCENARIO ‘A’ (LOSS OF COMMS)
Non-precision approach by private business flight by aircraft owner. Mistuned TWR in IMC and when no contact possible assumed radio failure and did not revert to APP. Broke cloud at 1.5nm and continued land over a Q400 lined up for departure at the threshold without seeing it.
Three effective Prevention Barriers:
PB4, PB5, PB9
These include the top two ranked barriers
Two effective Mitigation Barriers:
MB2, MB4
These include two of the three top ranked barriers
Top 5 Safety Priorities 35

36. SCENARIO ‘B’ (RUNWAY CONFUSION)
Two parallel runways, one closed long term for nearly- completed reconstruction. In VMC, ATC approved an inbound CRJ crew request to land in the reciprocal direction to that in use. The aircraft was then landed on the closed runway without encountering obstacles - ATC only noticed as the aircraft was about to touch down. The crew said they were used to programming the FMS for the runway they actually used and failed to appreciate or correct their error even when flying a visual approach.
Seven effective Prevention Barriers:
PB5, PB6, PB7, PB8, PB9, PB11, PB13
These include the top two ranked barriers
Two effective Mitigation Barriers:
MB3, MB8
These include the one of the top three ranked barriers
Top 5 Safety Priorities 36

37. SCENARIO ‘C’ (COMMS CONFUSION)
ATC instructed pilot to “continue approach” to which the pilot readback was “continue”. ATC made no further attempt to communicate to the aircraft and it was landed in the belief that clearance had been given.
Five effective Prevention Barriers:
PB5, PB9, PB10, PB11, PB12
These include the top two ranked barriers
Six effective Mitigation Barriers:
MB2, MB3, MB4, MB5, MB6, MB8
These include the top three ranked barriers
Top 5 Safety Priorities 37

38. SCENARIO ‘D’ (PILOT UNAWARE)
On initial contact with TWR, the aircraft was instructed to continue advised to expect to be called back. After landing without clearance in the belief that it had been received, the pilot, who was familiar with the airport involved, observed that landing clearance there was usually given a long way out and the absence of the promised call back with clearance was easily missed.
Nine effective Prevention Barriers:
PB1, PB2, PB3, PB5, PB9, PB10, PB11, PB12, PB14
These include the top two ranked barriers
Nine effective Mitigation Barriers:
MB1, MB2, MB3, MB4, MB5, MB6, MB7, MB8, MB10
These include the top three ranked barriers
Top 5 Safety Priorities 38

39. SCENARIO ‘E’ (DELIBERATE ACT)
An en-route light aircraft lost positional awareness in VMC and, unequipped with GPS, saw what was considered to be a convenient airport, and made a downwind join in the opposite circuit direction to that in use and continued onto finals and landed without radio contact. TWR saw the aeroplane when it was downwind and instructed another aircraft approaching from the opposite in-use direction to make a go around.
Two effective Prevention Barriers:
PB5, PB9
These are the top two ranked barriers
Effective Mitigation Barriers:
MB1, MB2, MB3, MB4, MB5, MB6, MB7, MB8, MB10
These include the top three ranked barriers
Top 5 Safety Priorities 39

40. The Generic Study Process
BARRIERS
SCENARIOS
CONCLUSIONS
ANALYSIS
OPERATIONAL CONTEXT
Top 5 Safety Priorities

41. SOME CONCLUSIONS (1)
The study has identified the best performing potential prevention and mitigation barriers. Some barriers are likely to be more cost effective than others.
Other studies referenced in the Paper are supportive of these findings but also advocate looking at barriers which would directly reduce the prevalence of pilots not being on the TWR frequency as the landing runway is approached.
Combinations of the most effective barriers are likely to make an impressive impact on LwC prevalence and mitigation.
Top 5 Safety Priorities

42. SOME CONCLUSIONS (2)
The top two ranked Prevention Barriers, PB5 and PB9, were applicable in all five scenario examples.
The top three ranked Mitigation Barriers, MB2, MB3, & MB4 were all applicable in Scenarios C (Comms confusion), ‘D’ (Pilot unaware) and ‘E’ (Deliberate Act) and at least one was applicable in the other two scenarios - ‘A’ (Loss of Comms) and ‘B’ (runway confusion.
An outstanding PB5 solution, ‘FAROS’ as currently being deployed in the USA, was estimated prior to this implementation as likely to prevent 65% of runway conflicts – some of which are LwC!
Top 5 Safety Priorities 42

43. Questions?
Top 5 Safety Priorities