Causal risk models of air transport - NLR-ATSI

advancement in ATM on the other hand has been relatively slow because ATM has
traditionally been the responsibility of national authorities and therefore has, until
recently 21 , not experienced the effects of competition. A result is the use of technology that
basically dates from WW II; VHF voice communication and radar.
Regulatory requirements matured. Strength requirements for aircraft structures were
specified in terms of limit loads (the maximum loads to be expected in service) and
ultimate loads (limit loads multiplied by prescribed factors of safety of 1.5). Aircraft
manufacturers had to show compliance to these requirements by analysis supported by
strength testing of sub-components, full scale components or full scale tests of assembled
components (such as a nearly complete airframe) up to limit loads and ultimate loads. The
structure must be able to support ultimate loads without failure for at least 3 seconds. When
tests are used to show compliance, an additional safety factor of 1.15 is typically applied to
account for variability in material properties [EASA 2003a].
Regulatory requirements regarding aircraft system safety also evolved. When automatic
landing systems were designed in the 1950’s, aircraft and equipment manufacturers asked
the airworthiness authorities what requirements or special conditions would be applied to
such systems. The authorities did not consider that they had the background and experience
to write detailed requirements. Instead a target level of safety was agreed with the
manufacturers as a base for certification. Applicants were required to make a case for their
individual systems by assessing them against the declared objective. Subsequently detailed
methods of establishing compliance were evolved. With the further development of
technology and complex systems, in particular related to supersonic transport aircraft, the
authorities from the USA, UK and France produced requirements that included the general
principle that an inverse relationship should exist between the probability of occurrence
and the degree of hazard inherent in its effect on the capability of the aircraft. In addition,
they specified a level of safety to be achieved, in qualitative and quantitative terms, and
required that a safety assessment should be made. The concept of requiring an inverse
relationship between probability of failure and the severity of the failure effect had in
practice been established from the early days of aviation and resulted in, for instance, twin
magnetos and twin spark plugs on engines, dual wing rigging wires and dual control cables.
What was new in the requirements was the introduction of quantitative and numerical
methods for addressing risk instead of the intuitive methods that had been used before
[Lloyd 1980, Lloyd & Tye 1982]. In assessing the acceptability of a system design it was
recognised that rational probability values would have to be established. Historical
evidence indicated that the risk of a serious accident due to operational and airframe-related
causes was approximately 1 per million hours of flight. Furthermore, about 10 percent of
the total could be (albeit arbitrarily) attributed to failure conditions caused by the aircraft’s
systems problems. It seemed reasonable that serious accidents caused by systems should
not be allowed a higher probability than this in new aircraft designs. It was thereby possible
to require for new designs that the probability of a serious accident from all such system
failure conditions be no greater than 1 per ten million flight hours, or 1 x 10 -7 per flight
hour. As it is not possible to say whether the target has been met until all the systems on the
aircraft are collectively analysed numerically, it was assumed, arbitrarily, that there are
retirement. The probability that at some point in his entire career he will have had to shutdown
an engine in-flight is approximately 1 in 5.
21
ANSPs in Europe are becoming more independent from the national authorities; NATS
in the UK for example is fully privatised and LVNL in the Netherlands is a ‘Zelfstandig
bestuursorgaan’.
37