A SYSTEMIC MODEL OF ATM SAFETY: THE INTEGRATED RISK ...

• Prevention opportunities, where extendedcoverage of safety equipment or enhancedperformance by ATC or pilots would havebeen able to prevent the accident, eventhough they would not be regarded as“failures” in an accident investigation.• Indirect influences, where performance ofone element of ATM leads to errors orfailures by another element (e.g. poorcontroller performance influencing piloterrors). These exclude direct influences thatare modelled in the categories above.Causal breakdowns are expressed as“contributions” to the fatal accident frequency. Thisis a simple estimate of the maximum fractionalreduction in accident frequency that would occur ifthe causal factor were eliminated and other factorsremained constant.[4]:• Presents the 2005 baseline risk picture,showing the current overall ATMcontribution to accident risks forcommercial aircraft in Europe• Describes how the 2012 risk picture hasbeen developed through quantification ofthe effects of all ATM changes that areplanned to occur by then.Validation & UncertaintiesClassical validation of the IRP model, in thesense of an independent dataset that is shown toagree with the IRP results to within an acceptablelevel of accuracy, has been up to now impracticalfor this type of causal model. This is because: (1)Most available data has been used in constructingthe model; and (2) No other model seems to becurrently able to obtain comparable results.The IRP has been validated against historicalexperience since 1990. This date was chosenbecause it is the beginning of the period for whichaccident data has been analyzed in detail. Olderdata would show more significant differences inrisks, but the aircraft and the ATM practices wouldbe less consistent with the current risk model. . Itwould be desirable to obtain more thoroughvalidation. Possible approaches include:• Validation against accident and incidentexperience in the coming years.• Retrospective prediction of risks forspecific regions or units for which there isaccident or incident data suitable forvalidation of aspects of the risk model.• Dissemination of the techniques used in theIRP through peer-reviewed journals orother risk studies.• Evaluation of independent proposals forimproving accident safety. If these wereeither consistent with conclusions from theIRP or different for a clear reason, thiscould be considered a validation of it.• Expert review of the conclusions from theIRP. If the recommendations from the IRPwere supported by industry experts, thiscould also be considered a validation of theIRP.A comprehensive uncertainty analysis,obtaining confidence limits on all the IRP results,would be time-consuming to perform. It would alsobe complex to present, as each of the above resultswould be replaced by a probability distribution,although this could be summarized as a median andtwo representative confidence limits. In the presentwork, illustrative sensitivity tests have been carriedout and the following conclusions are based onthese.• The overall fatal accident frequencies arebased on an average of 13 accidents peraccident category, consisting of the relevantevents in the overall accident dataset. Ifoccurrences follow a Poisson distribution,the 90% confidence ranges for thefrequencies would be from approximately0.6x to 1.6x the estimated values. Similaruncertainties will apply to the ICAOaccident frequencies, since they have beenderived from the fatal frequencies, not fromindependent larger datasets.• The individual causal factors are each basedon an average of approximately 3 incidents,which are the relevant events in the overallaccident and incident dataset. Ifoccurrences follow a Poisson distribution,the 90% confidence ranges for thecontributions would be from approximately0.25x to 3x the estimated values. In futurework, it would be desirable to reduce theseuncertainties by analysing more accidentsand incidents.• The contributions for the ATM elements orfor ATM as a whole combine thecontributions from several causal factors.Provided the uncertainties in thecomponents are independent, this will tendto reduce the uncertainties in the summedvalues. As a rough indication, it is judged6