Causal risk models of air transport - NLR-ATSI

More documents

Recommendations

Info

esults of such models are possible reasons for this. Research has primarily been focussed on the technical feasibility of models, without close consideration of the methodological consistency in relation to user requirements. One of the biggest bottlenecks in the past has been the fact that causal model development was stated as a goal in itself, without considering how such a model should be used [VACS 2003b]. From interviews held with expert groups regarding user requirements for a causal risk model for air transport, it was concluded that “It does not appear clear what the goal behind the causal model is, and this is hampering its development as different goals and scopes ask for different choices in developing the model” [De Jong 2006]. A complicating factor is that the Ministry and the Dutch Parliament completely misunderstood what a causal model could do; a causal model was considered to provide a solution for the problem of setting a maximum allowable value for third party risk around airports when this was not a feasible objective of such a model [VACS 2003b] (see Appendix A for details). The objective of this thesis is to clarify these issues. The approach taken is not to develop yet another prototype model. It is also not the aim to provide a critical analysis and comparison of existing risk models. Existing methodologies such as CATS and TOPAZ are only used to illustrate some of the issues and are not put forward as the primary object of the thesis. Instead, this thesis will systematically identify and compare user requirements with the performance that can be delivered by various existing modelling techniques. In doing so, the thesis will show what a causal risk model can add to current management approaches and what the criteria are for ensuring it makes a contribution. For practical reasons the thesis will be limited to existing and well-known modelling techniques, lesser known techniques and advanced approaches that are under development are considered to be out of scope. For the purpose of this thesis, a causal risk model will be defined as a mathematical object that provides an interpretation and computation of causal queries about accident risk. A causal model can be associated with a directed graph 3 in which each node corresponds to a variable of the model and the arrows point from the variables that have direct influence to each of the other variables that they influence. Economic impact of Schiphol In 2006 Schiphol Airport facilitated 440.153 aircraft movements which resulted in 40 million passenger movements and the shipment of 1.5 million tonnes of cargo, ranking it the 4 th largest European Airport in terms of passenger movements. Schiphol Airport’s aviation business had a revenue of 631 million €, the consumer business (airport shopping, car parks, etc) had a revenue of 231 million €, and the real estate’s business totalled 109 million €. There were 61.691 people, including temporary staff, working in the airport region. [Schipol Group 2007]. The multiplier of direct employment on Amsterdam Schiphol Airport is approximately 2: one job on the airport leads to approximately one job in indirect and induced employment in the greater Amsterdam region [Hakfoort et al 2001]. 3 Examples of directed graphs are fault trees, event trees, Petri nets, Bayesian belief nets. 8
1.1. Research question The main research question is the following: What does causal risk modelling add to current safety management approaches, and what are the criteria for ensuring it makes a successful contribution? To answer this question we must first make the term causal risk model more specific. This is done by asking the following sub questions: How can risk be made tangible? What is a proper way to express risk? What is a causal relation and which characteristics of causal relations are important for causal risk model development? What is a causal risk model? We must then widen the scope a bit and consider the context to search for clues to help answer the main question. This will be done with the following sub questions: What are the needs of users? What are currently the drivers for aviation safety improvement and what could be the role of a causal risk model in the process of safety improvement? What are shortcomings of the current methods for aviation safety analysis? What can be learned from risk modelling in other industries? Having looked at the ‘why’ we will then focus on the mechanisms for risk modelling to analyse how quantified models could support the users: Which modelling techniques are most appropriate? How should a causal risk model be quantified, what numerical accuracy is required and how can that be obtained? As the aviation system is a complex multi-actor distributed system we may expect that some characteristics are more difficult to represent in a model than others. What are, from a modelling point of view, the biggest bottlenecks? Finally, the use of a model cannot be justified when there is not some sort of proof of the validity. The last question addresses this issue: How can we demonstrate the validity of a causal risk model? 1.2. Scope The scope of this study must be described along three dimensions. The first is that of the aviation processes that are the subject of the study. Is it the straightforward gate to gate processes of an aircraft, or are the subsidiary processes like design and certification, maintenance, etc. involved as well? If so, what are the boundaries of the subsidiary 9
Page 1: Causal risk models of air transport
Page 4 and 5: Dit proefschrift is goedgekeurd doo
Page 6 and 7: Acknowledgements A PhD study has be
Page 8 and 9: Chapter 6. Risk models in other ind
Page 10 and 11: List of abbreviations AC Advisory C
Page 12 and 13: STAR Standard Arrival Route STCA Sh
Page 16 and 17: processes? The second dimension is
Page 18 and 19: Chapter 2. Fundamentals of risk Bef
Page 20 and 21: Figure 1: Voluntary exposure to ris
Page 22 and 23: Y (RDC) [km] 495 490 485 480 475 47
Page 24 and 25: achieved (i.e. an aspirational targ
Page 26 and 27: accidents’ because these accident
Page 28 and 29: e restricted to ‘objective’ ris
Page 30 and 31: is irrelevant. The fire-fighter wil
Page 32 and 33: In this example, the drug appears b
Page 34 and 35: ender the model outcome too uncerta
Page 36 and 37: If we adopt Leveson’s [2004a] sys
Page 38 and 39: models. A strategy for avoiding thi
Page 40 and 41: Number of accidents per 100,000 fli
Page 42 and 43: After World War II aviation became
Page 44 and 45: about 100 potential system failure
Page 46 and 47: Airways 25 , although this is excep
Page 48 and 49: Douglas DC-10; an aircraft with a t
Page 50 and 51: of small airlines that went bankrup
Page 52 and 53: Throughout the service life of an a
Page 54 and 55: an inverse relation should exist be
Page 56 and 57: Safety versus the environment: the
Page 58 and 59: A causal risk model could support t
Page 60 and 61: adequate levels of safety in the ci
Page 62 and 63: also because of the large amount of
Page 64 and 65:
met. The explanatory material empha
Page 66 and 67:
Article 8 of the Seveso Directive (
Page 68 and 69:
4.4. Summary of user requirements a
Page 70 and 71:
Grouped by type of requirements, th
Page 72 and 73:
Representation of regulation Regula
Page 74 and 75:
characteristics make test pilots ve
Page 76 and 77:
Table 3: List of fatal flight test
Page 78 and 79:
4.5. User expectations: lessons fro
Page 80 and 81:
helpful tool. This will have to be
Page 82 and 83:
is to have a top-level representati
Page 84 and 85:
Chapter 5. Examples of aviation saf
Page 86 and 87:
therefore the approach cannot be co
Page 88 and 89:
N az ⎡ ⎪⎧ 2λ y& z ⎪⎫ ⎤
Page 90 and 91:
acceptable. The question, scope and
Page 92 and 93:
Chapter 6. Risk models in other ind
Page 94 and 95:
support [Paté-Cornell & Dillon 200
Page 96 and 97:
Techniques that have been used in t
Page 98 and 99:
airline passengers face. A complica
Page 100 and 101:
problems, already well accepted in
Page 102 and 103:
computationally more intensive. A d
Page 104 and 105:
BASIC EVENT - A basic initiating fa
Page 106 and 107:
fault trees best represent the logi
Page 108 and 109:
Bayesian Belief Nets are convenient
Page 110 and 111:
The approach for CATS was with q =
Page 112 and 113:
PDPs can be used to construct model
Page 114 and 115:
analysis is repeated for each secti
Page 116 and 117:
Chapter 8. Quantification The causa
Page 118 and 119:
hole’ is impossible to tell unles
Page 120 and 121:
An example of a complex issue for w
Page 122 and 123:
determined, given the results of th
Page 124 and 125:
Indeed it can be misleading to thin
Page 126 and 127:
determine what preventive action ma
Page 128 and 129:
to provide quantitative data to the
Page 130 and 131:
data the most accurate and detailed
Page 132 and 133:
It takes years to set up and conduc
Page 134 and 135:
Another problem with the use of aud
Page 136 and 137:
Ambiguity in the classification sys
Page 138 and 139:
vulnerable to differences in interp
Page 140 and 141:
Chapter 9. Modelling challenges In
Page 142 and 143:
considerable procedure guidance, do
Page 144 and 145:
Procedures Availability Error proba
Page 146 and 147:
9.2. Modelling safety management IC
Page 148 and 149:
phenomenon 73 . As a matter of fact
Page 150 and 151:
shift changeovers or when an aircra
Page 152 and 153:
will be crossed if no action is tak
Page 154 and 155:
capsule, Grissom realized that he w
Page 156 and 157:
According to this model, ‘fatigue
Page 158 and 159:
Archetype accident example 1: Take-
Page 160 and 161:
Table 8: Runway overrun accidents a
Page 162 and 163:
evolution 78 . An advantage of this
Page 164 and 165:
systems. They then provide a conven
Page 166 and 167:
that the rest contains no ‘new’
Page 168 and 169:
quick handling by the flight crew a
Page 170 and 171:
Cumulative probability 1 0.9 0.8 0.
Page 172 and 173:
speed 86 for the 500 ft altitude ga
Page 174 and 175:
Probability density 0.0008 0.0007 0
Page 176 and 177:
This example concerns an approach f
Page 178 and 179:
10.6. Conclusions for this section
Page 180 and 181:
accident chains in which the ultima
Page 182 and 183:
esults are being used in a certific
Page 184 and 185:
are not ‘calibrated’. These asp
Page 186 and 187:
equirements. The degree to which dy
Page 188 and 189:
this may seem to be an oversimplifi
Page 190 and 191:
Main research question: What does c
Page 192 and 193:
References AAIASB. (2006). Accident
Page 194 and 195:
BEA. (2001). Accident on 25 July 20
Page 196 and 197:
Carpenter, M.S., Cooper, L.G., Glen
Page 198 and 199:
EAI. (2002). Review of Causal Model
Page 200 and 201:
FAA. (1995a). Aviation safety actio
Page 202 and 203:
Hale, A.R. (2000). Railway safety m
Page 204 and 205:
IATA. (2008b). IOSA Standards Manua
Page 206 and 207:
Khatwa, R., Roelen, A.L.C. (1996).
Page 208 and 209:
Lloyd, E. (1980). The development o
Page 210 and 211:
Nijenhuis, W.A.S., Spek, F., Moelek
Page 212 and 213:
Onisko, A., Druzdzel M.J., Wasyluk,
Page 214 and 215:
around airports, Part 1: Main repor
Page 216 and 217:
Simons, M., Valk, P.J.L. (1998). Ea
Page 218 and 219:
Tweede Kamer. (2003b). Toekomst van
Page 220 and 221:
Summary Aviation safety is so well
Page 222 and 223:
existing data bases. Preferably the
Page 224 and 225:
verder verbeteren daarvan, zijn er
Page 226 and 227:
internationale regelgever zoals EAS
Page 228 and 229:
LPG [Tweede Kamer 1983], which set
Page 230 and 231:
of this a situation has been create
Page 232 and 233:
Holding En-route Approach Go-around
Page 234 and 235:
Approximately 5 minutes prior to de
Page 236 and 237:
cockpit announcing flight parameter
Page 238 and 239:
The ground controller then takes ov
Page 240 and 241:
aircraft input will occur. They wil
Page 242 and 243:
Basic principles for the design, co
Page 244 and 245:
egulation became evident and the In
Page 246 and 247:
its functions was to develop and ad
Page 248 and 249:
the delivery systems determines a m
Page 250:
244
show all

Causal risk models of air transport - NLR-ATSI

Create successful ePaper yourself

Delete template?

Save as template?