OPERATIONAL SAFETY STUDY

OPERATIONAL SAFETY STUDY MAC TMA & CTR Incidents in Europe Edition No : 1.0 Edition Validity Date : 11.10.2018

MAC TMA & CTR Incidents in Europe Safety Functions Maps Analysis 2014 2016 data sample Edition Number : 1.0 Edition Date : 11.10.2018 Status : Released Issue Intended for : General Public Edition:1.0 Page II

DOCUMENT CHANGE RECORD The following table records the complete history of the successive editions of the present document. EDITION NUMBER EDITION DATE INFOCENTRE REFERENCE REASON FOR CHANGE PAGES AFFECTED 0.1 Creation of the Working Draft All 0.4 Revised Draft All 1.0 Released Issue Edition:1.0 Page 4

CONTENTS DOCUMENT APPROVAL... 3 DOCUMENT CHANGE RECORD... 4 1. Introduction... 9 1.1 Incident sample... 9 1.2 Approach... 10 2. General analysis of barriers performance... 12 2.1 Basic barriers overall performance... 12 2.2 Barriers resilience per initiator... 15 3. Analysis of events with specific context... 18 3.1 ATCO controlling techniques... 18 3.2 Providence as an alternative barrier left... 20 3.3 Low altitude events... 21 3.4 Events stopped by the Providence barrier... 22 3.5 Controlled airspace excursion... 23 3.6 Low level go-around... 24 3.7 Events involving VFR flights... 25 3.8 Events in class D and E airspace... 26 4. Basic barrier performance analysis... 27 4.1 ATC Tactical Separation Assurance... 27 4.2 ATC Collision Avoidance... 30 4.3 ACAS assisted Pilot Collision Avoidance... 32 4.4 Pilot visual collision avoidance... 33 5. Findings... 34 Annex 1. SAFMAP events description... 36 Edition:1.0 Page 5

TABLE OF FIGURES Figure 1: Reported SMI & IS incidents 2014-2016... 9 Figure 2: Analysed incident sample... 10 Figure 3: Basic barriers for prevention of mid-air collision... 11 Figure 4: Basic barriers performance... 13 Figure 5: Number of incidents stopped by a barrier... 14 Figure 6: Events with only providence left as an alternative barrier... 15 Figure 7: Barriers resilience per initiator... 16 Figure 8: Distribution of events per initiator... 17 Figure 9: ATCO controlling techniques... 18 Figure 10: ATCO controlling techniques... 19 Figure 11: Providence as last resort... 20 Figure 12: Low altitude events... 21 Figure 13: Events stopped by the Providence... 22 Figure 14: Controlled airspace excursion... 23 Figure 15: Low level go-around... 24 Figure 16: Events involving VFR flight... 25 Figure 17: Events in class D and E airspace... 26 Figure 18: ATC separation assurance failure scenarios... 28 Figure 19: Scenario No opportunity for tactical conflict resolution... 29 Figure 20: Scenario Lack of timely conflict detection by ATCO... 30 Figure 21: ATC collision avoidance mitigation potential... 31 Figure 22: ATC collision avoidance failure scenarios... 31 Figure 23: ACAS pilot collision avoidance failure scenarios... 32 Figure 24: Pilot visual collision avoidance failure scenarios... 33 Edition:1.0 Page 6

Executive Summary This document describes the process and the results of the analysis of a sample of A and B severity incidents that occurred in the Terminal Control Areas (TMAs) and Control Zones (CTRs) around airports in EUROCONTROL member states in the period 2014-2016. The purpose of this report is to support the EUROCONTROL Top 5 operational risks identification and prioritisation process. The data sample analysis was performed by using the already proven approach for identification of the Network Manger Top 5 safety priorities. It is based on plotting the incident information onto the structures of the Safety Functions Map (SAFMAP) barrier model that represents the defences against mid-air collision accidents. This incident analysis provides information about Safety I (i.e. safety functions that failed) but also about Safety II (i.e. safety functions that performed well). In particular, at barrier level, the resilience (Safety II) is addressed by identifying the barrier that stopped an incident from propagating further to an accident, while Safety I is addressed by analysing the previous trespassed barriers. With regard to Safety I, the information about the barriers components that failed is available in most cases. As regards Safety II, incidents of lower severity level (e.g. severity C, D and E) would need to be analysed in order to build a reliable picture of what worked well. The analysed data sample includes 187 incidents of separation minima infringement and inadequate separation from a total of 553 A and B such incidents that occurred in European TMA and CTR airspaces in 2014, 2015 and 2016 and were reported to EUROCONTROL. It can be concluded that the analysed sample of incidents is sufficiently representative for the overall population of TMA and CTR separation infringement incidents in Europe. The results of the data analysis informed the following generic findings: The ATC Tactical Separation Assurance and ATC Tactical Conflict Prevention barriers failed in all cases they were challenged, i.e. these barriers did not stop the propagation of the events to the next barrier levels. This result is explained by the fact that the analysed data sample incudes only high severity events ( A -s and B -s). The ATC Collision Avoidance barrier was challenged 187 times and worked 107 times, i.e. its recorded efficiency is 57%. It should be noted that this barrier is not applicable in the analysis of incidents involving IFR and VFR flights in class D and E airspace. The ACAS Pilot Collision Avoidance barrier was challenged 80 times and worked 63 times, i.e. its recorded efficiency is considerably higher (than of the ATC Collision Avoidance barrier) reaching 79%. The Pilot Visual Collision Avoidance barrier was challenged 17 times and worked 11 times, i.e. its recorded efficiency is 65%, which seems to be a better performance than anticipated. This potential of the Pilot Visual Collision Avoidance barrier to stop the further propagation of the incidents that challenged it may not be fully representative in view of the IFR/IFR and IFR/VFR encounters included in the analysed data sample. In six (6) cases the conflict geometry (chance) helped avoid the mid-air collision, which means that the overall recorded efficiency of the manageable TMA conflict prevention and collision avoidance barriers is 97%. The effectiveness of the first barriers, namely the ATC Separation Assurance and ATC Collision Avoidance is lower and therefore the ACAS Pilot Collision Avoidance, Pilot Visual Collision Avoidance and the Providence basic barriers are relatively more often challenged compared to the en-route environment. Edition:1.0 Page 7

A possible explanation that the Pilot Visual Collision Avoidance and the Providence barriers are more often challenged in the TMA and CTR environment is the fact that TCAS RA alerts are inhibited below 1000ft. Overall, the ATC induced tactical conflicts account for 71% of the analysed incident data sample. The tactical conflict being generated by the use of inadequate ATC controlling techniques is the clearly outstanding initiator with a share of 23 % of events analysed. Incidents that occurred in class D and E airspace are well represented in the analysed data sample (around 10% of all incidents analysed). The big majority of those incidents was stopped by the ACAS Pilot Collision Avoidance barrier. One incident was stopped by the Pilot Visual Collision Avoidance and another one by the Providence. Therefore it is suggested that this type of incidents are further analysed by dedicated operational safety study. Nearly a quarter (23%) of the incidents in the analysed data sample involves VFR flights. The size of this group and the severity of incident outcome is considerable and therefore the VFR/IFR encounters in TMA and CTR airspaces should be monitored. The analysed sample included only one event of controlled airspace excursion but with high risk potential. Therefore it is suggested to monitor this type of safety occurrences, too. The analysis of the data sample events involving going-around aircraft identified that their safety criticality is considerable. In particular, the risk born by encounters between low level going-around aircraft and the preceding departure is suggested as a priority for operational safety study. Edition:1.0 Page 8

1. Introduction 1.1 Incident sample The study used a sample of A and B severity incidents of IFR flights separation minima infringement and of inadequate separation between IFR and VFR flights that occurred in the TMA and CTR airspaces (controlled by APP and TWR ATS units) in EUROCONTROL member states in the years 2014, 2015 and 2016. Figure 1 below provides more detailed information about the reported incidents during the referred 3 year period. Separation Minima Infringements (SMI) and Inadequate Separations (IA) TMAs & CTRs (APP & TWR) 2014-2016 2014 2015 2016 Total SMI IS SMI IS SMI IS A 27 5 9 10 21 7 79 B 176 53 62 45 110 28 474 Total 203 58 71 55 131 35 553 Figure 1: Reported SMI & IS incidents 2014-2016 The incident data were collected through the NM collaborative process for identification of operational safety hazards at network level and assessment of the associated risk agreed by the Network Management Board on 12 April 2016. The process defines the data requirements based on Edition:1.0 Page 9

the evolution of the SAFMAP model and of the NM Top 5 prioritisation process during the years of 2015, 2016 and 2017. In this regard it is to be noted that the 2014 data sample (provided in Annex 1 of the report) contains only a limited number of TMA/CTR incidents (23) compared to the 2015 and 2016 data samples (84 and 80 respectively). The analysed 3-year sample, as presented on Figure 2, includes 187 separation minima infringement and inadequate separation incidents, of which 19 were classified as severity A and 168 as severity B incidents. The sample of TMA/CTR incidents analysed constitutes 33,8% of all A and B severity TMA/CTR separation minima infringement (SMI) and inadequate separation (IS) incidents that occurred in the European airspace in the period 2014-2016 and were reported to EUROCONTROL. Therefore, it can be concluded that the analysed sample of runway incursion incidents is sufficiently representative for the overall population of TMA/CTR SMI and IS incidents in Europe, in particular for the years 2015 and 2016 where this percentage is 66,7% and 48% respectively. A AND B SEPARATION MINIMA INFRINGEMENTS AND INADEQUATE SEPARATIONS 2014-2016 553 ANALYSED INCIDENTS Figure 2: Analysed incident sample 1.2 Approach The sample of 187 incidents was analysed using the same approach applied by EUROCONTROL for the identification of Network Manger Top 5 safety priorities and in the analysis of en-route separation minima infringement incidents. It is based on plotting the incident information on the TMA Safety Functions Map (SAFMAP) barrier structure depicting the defences against mid-air collision accidents in the TMA & CTR airspaces. The used model version is Safety Functions Map Configuration Description Model of 18 November 2016. The SAFMAPs are barrier models based on a structured documentation of the available defences against particular unwanted accident outcomes. These barriers are either part of the ATM system (ground and/or airborne component) or can impact the safety performance of ATM and/or aircraft navigation. Each discrete barrier is considered as a safety function. The functions used are rather generic, for example the function Alert of potential deviation from clearance or instruction does not Edition:1.0 Page 10

specify the actual (technical) means to implement this function, such as for example the conformance monitoring tools (MONA) implemented at ATS units. SAFMAPs are hierarchical structures in which each higher level structure (function) can be decomposed into several lower level structures (sub-functions). The top levels are called basic safety functions. The basic safety functions for the prevention of mid-air collision are presented on Figure 3. PROVIDENCE P O T E N T I A L C O L I S I O N U N R E S O LV E D B Y V I S U A L W A R N I N G PILOT COLLISION AVOIDANCE - VISUAL P O T E N T I A L C O L I S I O N U N R E S O LV E D B Y A C A S PILOT COLLISION AVOIDANCE - ACAS P O T E N T I A L C O L I S I O N U N R E S O LV E D B Y AT C ATC COLLISON AVOIDANCE S E P A R AT I O N I N F R I N G E M E N T / I N A D E Q U AT E S E P A R AT I O N ATC TACTICAL SEPARATION ASSURANCE A I R B O R N E TA C T I C A L C O N F L I C T TACTICAL CONFLICT PREVENTION Figure 3: Basic barriers for prevention of mid-air collision It should be noted that the basic barriers for the prevention of mid-air collision en-route and in the TMA/CTR airspaces do not differ at this generic level. The difference can be identified at the lower levels of decomposition where environment-specific functions (barriers) kick-in. In the current version of the TMA SAFMAP model used in this analysis the only difference to the en-route SAFMAP model is in the Level 1 function TCP01 - Pre-tactical conflict prevention. Edition:1.0 Page 11

2. General analysis of barriers performance 2.1 Basic barriers overall performance The information presented on Figure 4 below illustrates the barriers strength, except for the barriers Tactical Conflict Prevention (TCP) and ATC Tactical Separation Assurance. The indicator of a barrier s strength is its ability to stop an event developing into a more severe outcome and ultimately into a mid-air collision. Figure 4 does not illustrate the strength of the TCP barrier as all the events analysed with the help of the TMA SAFMAP model have been classified as A and B severity events, hence it is obvious that the TCP barrier has failed in all of the analysed cases. Information about the TCP barrier s strength may be obtained by analysis of safety occurrences of lower severity (incidents class C, D and E), i.e. reported cases when this barrier worked well. In the analysed sample the ATC Tactical Separation Assurance barrier also failed (i.e. did not stop the propagation of the events) in all cases it was tested. The explanation of this result is the same as for the TCP barrier - the analysed data sample incudes only high severity events ( A -s and B -s). It should be noted that this barrier does not apply to the analysis of incidents involving IFR and VFR flights in airspace classes D and E. The ATC Collision Avoidance barrier was tested 187 times and worked or was not needed 107 times, i.e. its recorded efficiency is 57 %. It should be noted that this barrier is not applicable in the analysis of incidents involving IFR and VFR flights in airspace classes D and E. The ACAS Pilot Collision Avoidance barrier has been tested 80 times and worked or was not needed 63 times, i.e. its recorded efficiency is considerably higher (than of the ATC collision avoidance barrier) reaching 78,8%. The Pilot Visual Collision Avoidance barrier has been tested 17 times and worked or was not needed 11 times, i.e. its recorded efficiency is 64,7%, which seems to be a better performance than anticipated in the IFR/IFR and IFR/VFR encounters analysed. In 6 cases the conflict geometry (chance) helped avoid the mid-air collision, which means that the overall recorded efficiency of the manageable collision avoidance barriers is 96,8%. Edition:1.0 Page 12

PROVIDENCE PILOT COLLISION AVOIDANCE - VISUAL PILOT COLLISION AVOIDANCE - ACAS ATC COLLISION AVOIDANCE 6 11 6 63 17 107 80 ATC SEPARATION ASSURANCE 187 TACTICAL CONFLICT PREVENTION 187 WORKED OR NOT NEEDED FAILED Figure 4: Basic barriers performance Figure 5 below provides further insight into the barriers strength. It identifies the number of incidents stopped by a barrier in terms of absolute number (shown to the left of the barrier bars) and percentage of all incidents analysed (shown to the right of the barrier bars). It also identifies the number of times the next barrier was not challenged despite the failure of the previous one. For example, in 34 out of 187 cases (18 %) there was no need for ATC collision avoidance despite that the previous barrier ATC Tactical Separation Assurance failed to stop those events. The vast majority of those events involve infringement of the applicable separation minimum or wake turbulence minimum between successive arriving aircraft during sequencing for final approach or on final. Edition:1.0 Page 13

6 10 PROVIDENCE PILOT COLLISION AVOIDANCE - VISUAL 3% 6% 1 No need for visual collision avoidance 51 PILOT COLLISION AVOIDANCE - ACAS 27% 12 73 No need for ACAS collision avoidance ATC COLLISON AVOIDANCE 7% 39% 34 0 0 No need for ATC collision avoidance (e.g. diverging trajectories) ATC TACTICAL SEPARATION ASSURANCE TACTICAL CONFLICT PREVENTION 18% 0% 0% Figure 5: Number of incidents stopped by a barrier Figure 6 illustrates the events that were stopped (to develop into a mid-air collision) by one of the ATC barriers, but where only providence was left as a further barrier had the ATC barrier that stopped them failed. The number shown to the left of a barrier bar identifies the total number of incidents stopped by that barrier. The number shown to the right of a barrier bar identifies the number of incidents stopped by that barrier with only providence left as alternative barrier. Edition:1.0 Page 14

6 10 PROVIDENCE PILOT COLLISION AVOIDANCE - VISUAL 1 No need for visual collision avoidance 51 PILOT COLLISION AVOIDANCE - ACAS 1 12 73 No need for ACAS collision avoidance ATC COLLISON AVOIDANCE 2 34 0 0 No need for ATC collision avoidance (e.g. diverging trajectories) ATC TACTICAL SEPARATION ASSURANCE PREVENTING TACTICAL CONFLICT Event stopped by ATC barriers but only providence left as an alternative barrier 1 Figure 6: Events with only providence left as an alternative barrier 2.2 Barriers resilience per initiator The barriers resilience per initiator is illustrated on Figure 7. In this data analysis context the initiators are failures of one of the 6 (out of 7) sub-functions (sub-barriers) of the Tactical Conflict Prevention basic safety barrier, namely: Pre-tactical conflict prevention by ATC tactical planning, synchronization and use of entry procedures; Prevention of tactical conflict caused by deviation from clearance or instruction; Prevention of tactical conflict caused by airspace infringement; Conflict-free ATC clearances and instructions; Prevention of tactical conflict being generated by air-ground communications; Prevention of tactical conflict being generated by controlled airspace excursion. In addition to the barriers resilience per initiator, Figure 7 illustrates the events that were stopped to develop into mid-air collision by one of the barriers, but where only providence was left as a further barrier had the barrier that stopped them failed. It is to be noted that latter events have various originators; however a half of them (2 events) are caused by flawed sequencing of departures, and departure and arrival aircraft. Edition:1.0 Page 15

6 10 1 51 12 73 PROVIDENCE PILOT COLLISION AVOIDANCE - VISUAL No need for visual collision avoidance PILOT COLLISION AVOIDANCE - ACAS No need for ACAS collision avoidance ATC COLLISON AVOIDANCE 1 2 34 No need for ATC collision avoidance (e.g. diverging trajectories) 1 0 0 Pretactical conflict Altitude Deviation ATC TACTICAL SEPARATION ASSURANCE Synchronisation Horizontal Deviation TACTICAL CONFLICT PREVENTION Blind Spot Controlled airspace infringement Overlooked aircraft Sector Coordination Figure 7: Barriers resilience per initiator The number shown to the left of a barrier bar identifies the total number of incidents stopped by that barrier. The number shown to the right of a barrier bar identifies the number of incidents stopped by that barrier with only providence left as alternative barrier. ATCO Techniques ATCO Plan Adequate Communication Other Figure 8 presents the share of the various initiators in the overall sample of events analysed. It provides the answer to the question Why were the aircraft proceeding on conflicting trajectories? The tactical conflict being generated by the use of inadequate ATCO controlling techniques is the clearly outstanding initiator (23 % of events analysed). Four other factors also stand equally out at a second important level of incident contribution. These are: overlooking conflicting aircraft when issuing ATC clearance or instruction, including blindspot, having a total share of 17 % of all events analysed; synchronisation of arriving and departing aircraft, having a share of 12 % of all events analysed; deviation from the ATC clearance or instruction in horizontal plain, having a share of 11 % of all events analysed; inadequate controller s plan of work, having a share of 11 % of all events analysed. Overall, the ATC induced tactical conflicts account for 71% of the analysed incident data sample. Edition:1.0 Page 16

TACTICAL CONFLICT PREVENTION Figure 8: Distribution of events per initiator Edition:1.0 Page 17

3. Analysis of events with specific context 3.1 ATCO controlling techniques Figure 9 below illustrates the barrier efficiency in mitigating the risk caused by the use of inadequate ATCO controlling techniques the number one initiator in the analysed sample. In 27 out of the 43 events (63%) the ATC Collision Avoidance barrier was still effective and stopped them. The rest (16 events or 37%) were stopped by the Pilot Collision Avoidance barriers ACAS assisted and visual avoidance. The high criticality of inadequate speed control and vectoring for final approach is illustrated by the 5 events stopped by the last manageable barrier Pilot Visual Collision Avoidance. 6 10 PROVIDENCE PILOT COLLISION AVOIDANCE - VISUAL 1 No need for visual collision avoidance 51 PILOT COLLISION AVOIDANCE - ACAS Speed control on final approach, vectoring and final approach sequencing where TCAS is inhibited 0 5 0 7 12 73 No need for ACAS collision avoidance ATC COLLISON AVOIDANCE 4 18 34 0 0 No need for ATC collision avoidance (e.g. diverging trajectories) ATC TACTICAL SEPARATION ASSURANCE TACTICAL CONFLICT PREVENTION 9 0 0 Figure 9: ATCO controlling techniques The number shown to the left of a barrier bar identifies the total number of incidents stopped by that barrier. The number shown to the right of a barrier bar identifies the number of incidents stopped by that barrier which were caused by the use of inadequate ATCO controlling techniques. Figure 10 below illustrates the main issues related to the use ATCO controlling techniques which led to the failure of the Tactical Conflict Prevention and ATC Tactical Separation Assurance barriers. These issues are: Failure to exercise speed/rate of change control or inadequate speed/rate of change control by ATC. This factor has the highest share in this sub-category (17 out of 43 events analysed). Edition:1.0 Page 18

Inadequate vectors given to the flight crew is the second important factor with a share of 14 out of 43 events in the sub-category. Inadequate distance judgment and inadequate sequencing for final approach are the other two factors with similar share of 6 and 4 events respectively. Sequencing for final approach Distance judgement Vectoring Vectoring and speed Speed and/or speed and rate TACTICAL CONFLICT PREVENTION Figure 10: ATCO controlling techniques Edition:1.0 Page 19

3.2 Providence as an alternative barrier left The events highlighted on Figure 11 represent the four cases in the analysed data sample where only Providence would have been available had the barrier that stopped the event failed. Two of the events represent the scenario of low level go-around in conflict with previous departure in bad weather conditions. The other two cases represent the basic types of airspace infringement scenario infringement of controlled airspace (by a balloon) and infringement of restricted airspace by a GAT flight. In the latter 2 cases the conflicting aircraft/asset was without operating transponder. 6 10 PROVIDENCE PILOT COLLISION AVOIDANCE - VISUAL Civil aircraft unauthorised entry in restricted airspace; no operating transponder 1 No need for visual collision avoidance 51 PILOT COLLISION AVOIDANCE - ACAS 12 73 No need for ACAS collision avoidance Low level go-around in conflict with previous ATC departure COLLISON in bad AVOIDANCE weather. 34 0 0 Pretactical conflict Altitude Deviation No need for ATC collision avoidance (e.g. diverging trajectories) ATC TACTICAL SEPARATION ASSURANCE Synchronisation Horizontal Deviation TACTICAL CONFLICT PREVENTION Controlled airspace infringement by a balloon Blind Spot Controlled airspace infringement Overlooked aircraft Sector Coordination ATCO Techniques ATCO Plan Adequate Communication Other Figure 11: Providence as last resort The number shown to the left of a barrier bar identifies the total number of incidents stopped by a barrier. Edition:1.0 Page 20

3.3 Low altitude events The results of the data sample analysis identified the low altitude (below 1000 feet) conflict encounters as events of particularly high safety criticality. A major factor that may have contributed to this high safety criticality is the TCAS alert inhibition at very low altitudes. As illustrated on Figure 12 out of the 16 low altitude events included in the analysed data sample 8 (50%) were stopped by the Pilot Visual Collision Avoidance barrier and 5 (31%) by the Providence. The low altitude events have various initiation factors, such as deviation from the ATC clearance and overlooking an aircraft when issuing ATC clearance, with inadequate ATCO controlling techniques having the biggest share (more than 30%). 6 10 PROVIDENCE PILOT COLLISION AVOIDANCE - VISUAL 1 No need for visual collision avoidance 51 PILOT COLLISION AVOIDANCE - ACAS 12 73 No need for ACAS collision avoidance ATC COLLISON AVOIDANCE 34 No need for ATC collision avoidance (e.g. diverging trajectories) 0 0 Pretactical conflict Altitude Deviation ATC TACTICAL SEPARATION ASSURANCE Synchronisation Horizontal Deviation TACTICAL CONFLICT PREVENTION Blind Spot Controlled airspace infringement Overlooked aircraft Sector Coordination ATCO Techniques ATCO Plan Adequate Communication Other Figure 12: Low altitude events The number shown to the left of a barrier bar identifies the total number of incidents stopped by that barrier. Edition:1.0 Page 21

3.4 Events stopped by the Providence barrier As commented in the generic analysis chapter, the data sample includes 6 events that were stopped to develop into mid-air collision by the last, uncontrollable barrier the Providence. Those events, presented in Figure 13 were initiated by: lateral deviation from the ATC clearance; inadequate synchronisation of departing and arriving aircraft; overlooking and aircraft when issuing ATC clearance. In 5 of the above events TCAS alerts were inhibited due to the low altitude of conflict occurrence and in one event the conflicting aircraft did not provide Mode C data. In four (4) out of the six (6) events the TWR was providing ATS service to the conflicting aircraft. Two events involved a going around aircraft and two events involved departure in the opposite direction to the arrival aircraft. 6 10 PROVIDENCE PILOT COLLISION AVOIDANCE - VISUAL 5 incidents where TCAS was inhibited because of low level and one incident where transponder was operating without mode C. 1 No need for visual collision avoidance 51 PILOT COLLISION AVOIDANCE - ACAS 12 73 No need for ACAS collision avoidance ATC COLLISON AVOIDANCE 34 No need for ATC collision avoidance (e.g. diverging trajectories) 0 0 ATC TACTICAL SEPARATION ASSURANCE TACTICAL CONFLICT PREVENTION Pretactical conflict Altitude Deviation Synchronisation Horizontal Deviation Blind Spot Controlled airspace infringement Overlooked aircraft Sector Coordination ATCO Techniques ATCO Plan Adequate Communication Other Figure 13: Events stopped by the Providence The number shown to the left of a barrier bar identifies the total number of incidents stopped by that barrier. Edition:1.0 Page 22

3.5 Controlled airspace excursion The controlled airspace excursion event presented on Figure 14 illustrates the high risk potential of such occurrences (stopped by the Providence barrier). It happened due to controller inadvertently instructing an IFR flight into class G airspace in conflict with a VFR flight with no mode C transponder. 6 10 PROVIDENCE PILOT COLLISION AVOIDANCE - VISUAL Controller inadvertently vectored aircraft into class G 1 No need for visual collision avoidance airspace in conflict with VFR aircraft with no mode C transponder. PILOT COLLISION AVOIDANCE - ACAS 51 12 73 No need for ACAS collision avoidance ATC COLLISON AVOIDANCE 34 No need for ATC collision avoidance (e.g. diverging trajectories) 0 0 Pretactical conflict Altitude Deviation ATC TACTICAL SEPARATION ASSURANCE Synchronisation Horizontal Deviation TACTICAL CONFLICT PREVENTION Blind Spot Controlled airspace infringement Overlooked aircraft Sector Coordination ATCO Techniques ATCO Plan Adequate Communication Other Figure 14: Controlled airspace excursion The number shown to the left of a barrier bar identifies the total number of incidents stopped by that barrier. Edition:1.0 Page 23

3.6 Low level go-around The results of the analysis of the data sample events involving going-around aircraft imply that their safety criticality is considerable, too. The half of those events (4 out of 8) was stopped by the ATC Collision Avoidance barrier, and the other half by the Pilot Collision Avoidance barriers 2 events by ACAS assisted collision avoidance and 2 events by visual collision avoidance. Those events have various initiating factors, but inadequate synchronisation of departing and arriving aircraft is the dominant factor. More detailed information of the exact occurrence scenarios is provided on Figure 15 below. 6 10 1 51 12 73 34 0 0 Pretactical conflict Altitude Deviation PILOT COLLISION AVOIDANCE - VISUAL No need for ATC collision avoidance (e.g. diverging trajectories) Synchronisation Horizontal Deviation PILOT COLLISION AVOIDANCE - ACAS ATC COLLISON AVOIDANCE TACTICAL CONFLICT PREVENTION PROVIDENCE No need for visual collision avoidance Late go-around at night conflicting with the previous departure followed by an immediate turn instruction. No need for ACAS collision avoidance Go-around as a collision avoidance Go around at RWY threshold ATC conflicting TACTICAL with SEPARATION previous ASSURANCE departure in bad weather. Turn at 80ft marginally avoiding TWR. Blind Spot Controlled airspace infringement Overlooked aircraft Sector Coordination Figure 15: Low level go-around 3 events of going-around conflicting with the previous departure. The two saved by Providence were in bad visibility or night time. ATCO Techniques ATCO Plan Adequate Communication Other The number shown to the left of a barrier bar identifies the total number of incidents stopped by that barrier. Edition:1.0 Page 24

3.7 Events involving VFR flights A VFR flight was involved in 43 out of the 187 events included in the analysed data sample which corresponds to nearly a quarter (23%) of the sample events. As illustrated on Figure 16 below a significant part of the events were initiated by not resolved pretactical conflict (flights were on planned conflicting trajectories) and lateral deviation from the ATC clearance or instruction. Other, less frequently represented factors are: synchronisation of arriving and departing aircraft, overlooking an aircraft when issuing ATC clearance, inadequate ATCO plan of work and inadequate controlling techniques, as well as deviation from the assigned FL/altitude. The big majority of the events involving a VFR flight trespassed the ATC Collision Avoidance barrier. It was able to stop only 9 out of 41 events that challenged this barrier (17% success rate). The ACAS assisted Pilot Collision Avoidance barrier performed considerably better - it stopped 22 out of 27 events that challenged this barrier (81% success rate). Three events were stopped by pilot visual collision avoidance and two events did not result in mid-air collision due to the conflict geometry. The above findings put the IFR/VFR encounters in TMA/CTR airspaces in the group of events with the significant safety criticality. 6 10 - VFR flight PROVIDENCE PILOT COLLISION AVOIDANCE - VISUAL Large part of events initiated by pretactical conflict and No need for visual collision avoidance 1 horizontal deviation 51 PILOT COLLISION AVOIDANCE - ACAS 2 3 0 22 12 73 No need for ACAS collision avoidance ATC COLLISON AVOIDANCE 6 7 34 No need for ATC collision avoidance (e.g. diverging trajectories) 2 0 0 Pretactical conflict Altitude Deviation ATC TACTICAL SEPARATION ASSURANCE Synchronisation Horizontal Deviation TACTICAL CONFLICT PREVENTION Blind Spot Controlled airspace infringement Overlooked aircraft Sector Coordination ATCO Techniques ATCO Plan Adequate Communication 0 0 Other Figure 16: Events involving VFR flight The number shown to the left of a barrier bar identifies the total number of incidents stopped by that barrier. The number shown to the right of a barrier bar identifies the number of incidents stopped by that barrier in which a VFR flight was involved. Edition:1.0 Page 25

3.8 Events in class D and E airspace The events that occurred in class D and E airspace account for 11% of the analysed data sample (20 out of 187 analysed events). The ATC related barriers are particularly week to stop the propagation of such events which can be explained by the type of air traffic service provided in class D and E airspaces, namely no ATC separation assurance and no ATC collision avoidance for IFR-VFR and VFR-VFR encounters. As illustrated on Figure 17 the majority of the events in this group were stopped by the ACAS assisted Pilot Collision Avoidance barrier. The latter stopped 11 out of 13 events that challenged it (85% success rate). The 2 events that trespassed it were stopped by the Pilot Visual Collision Avoidance barrier and by the Providence. 6 PROVIDENCE 1 10 1 51 PILOT COLLISION AVOIDANCE - VISUAL No need for visual collision avoidance PILOT COLLISION AVOIDANCE - ACAS 1 0 11 12 73 No need for ACAS collision avoidance ATC COLLISON AVOIDANCE 4 2 34 No need for ATC collision avoidance (e.g. diverging trajectories) 1 0 0 Pretactical conflict Altitude Deviation ATC TACTICAL SEPARATION ASSURANCE Synchronisation Horizontal Deviation PREVENTING TACTICAL CONFLICT Blind Spot Controlled airspace infringement Overlooked aircraft Sector Coordination ATCO Techniques ATCO Plan Adequate Communication 0 0 Other Figure 17: Events in class D and E airspace The number shown to the left of a barrier bar identifies the total number of incidents stopped by that barrier. The number shown to the right of a barrier bar identifies the number of incidents that occurred in class D and E airspace and were stopped by that barrier. Edition:1.0 Page 26

4. Basic barrier performance analysis 4.1 ATC Tactical Separation Assurance As briefly commented in section 2.1 above, the ATC Tactical Separation Assurance barrier failed to stop the propagation of any event of the analysed sample that challenged it. Figure 18 below identifies the basic barrier failure scenarios. Two scenarios play the dominant role No sufficient time for tactical conflict resolution and ATCO does not detect the conflict in time (to prevent the occurrence of a separation infringement or of inadequate separation). These scenarios account for 63% of the analysed events. Use of inadequate controlling techniques by ATCO is the third important scenario. Edition:1.0 Page 27

ATC TACTICAL SEPARATION ASSURANCE Only traffic information provided due to airspace class ACAS triggers before No sufficient time for tactical resolution ATCO does not detect the conflict in time Inadequate ATCO decision Inadequate ATCO controlling technique Other Figure 18: ATC separation assurance failure scenarios Further insight into the poor performance of the ATC Tactical Separation Assurance barrier is provided by Error! Reference source not found.. It illustrates the initiating factors of the generic cenario No opportunity for tactical conflict resolution by ATC. There is no clearly outstanding factor, however among the 11 listed, the most important in descending order of importance appear to be: Inadequate synchronisation of arriving and departing aircraft; Overlooking an aircraft when issuing an ATC clearance (including blindspot ); Aircraft deviation from the assigned FL/altitude; Lateral deviation from the ATC clearance; Lack of or inadequate inter-sector coordination; Use of inadequate controlling techniques by the ATCO. Edition:1.0 Page 28

ATC TACTICAL SEPARATION ASSURANCE PREVENTING TACTICAL CONFLICT Figure 19: Scenario No opportunity for tactical conflict resolution Error! Reference source not found. complements the analysis of the ATC Tactical Separation ssurance barrier performance by identifying the initiating factors of the generic scenario Lack of timely conflict detection by ATCO. Among the 11 listed initiating factors, there are two clearly outstanding ones, namely: overlooking an aircraft when issuing an ATC clearance, including blindspot (20 events in total); inadequate ATCO plan of work (15 events). There are two other significant scenario initiating factors, each one represented in 8 events, namely: use of inadequate controlling techniques by the ATCO; lateral deviation from the ATC clearance. Edition:1.0 Page 29

ATC TACTICAL SEPARATION ASSURANCE PREVENTING TACTICAL CONFLICT Figure 20: Scenario Lack of timely conflict detection by ATCO 4.2 ATC Collision Avoidance The ATC Collision Avoidance barrier was challenged 187 times. When challenged (after separation minima infringement or inadequate separation) it worked 107 times and failed 80 times, i.e. its recorded efficiency is 57 %. It should be noted that this barrier is not applicable in the analysis of incidents involving IFR and VFR flights in class D and E airspace. Figure 21 illustrates the barrier s mitigation potential in terms of number of events in a generic scenario that have already trespassed the ATC Tactical Separation Assurance barrier (as identified in the previous section 4.1) and the share of these events the ATC Collision Avoidance barrier did or did not stop. It is obvious that the ATC Collision Avoidance barrier is not able to stop events that occurred in class D or E airspace or events with ACAS RA already triggered. However, it seems that the barrier efficiency is not high also in the scenarios of SMI or IA caused by late conflict detection, or inadequate ATCO decision, or use of inadequate ATC controlling techniques. Edition:1.0 Page 30

ATC TACTICAL SEPARATION ASSURANCE Only traffic information provided due to airspace class ACAS triggers before No sufficient time for tactical resolution ATCO does not detect the conflict in time Inadequate ATCO decision Inadequate ATCO controlling technique Other Figure 21: ATC collision avoidance failure rate/mitigation potential The blue colour in the bars indicates the share of events that propagated through the ATC Collision Avoidance barrier. Further insight into the performance of the ATC Collision Avoidance barrier is provided by Figure 22. It identifies the generic barrier failure scenarios. Two scenarios play the dominant role, namely ACAS RA triggered before and ATCO does not detect the conflict in time. These scenarios account for 60% of the events that trespassed the barrier. Use of inadequate controlling techniques by ATCO is the third important scenario. ATC COLLISON AVOIDANCE Only traffic information provided due to airspace class ACAS triggers before No sufficient time for ATC collision avoidance ATCO does not detect the conflict in time Inadequate ATCO decision Inadequate ATCO controlling technique Crew does not act on time on the ATC instruction Other Figure 22: ATC collision avoidance failure scenarios Edition:1.0 Page 31

4.3 ACAS assisted Pilot Collision Avoidance The ACAS Pilot Collision Avoidance barrier has been tested 80 times and worked 63 times, i.e. its recorded efficiency is 78,8%. Figure 23 below identifies the generic failure scenarios of this barrier. There is one clearly outstanding scenario, namely No RA provided to flight crew. According to the findings of the data analysis the reason for this is not a TCAS equipment failure, but the TCAS alert inhibition at low altitudes (below 1000 feet). No functional ACAS or transponder PILOT COLLISION AVOIDANCE - ACAS No correct or timely RA Crew ignores RA Including one event - no mode C transponder. All events include ACAS inhibited due to low altitude. Figure 23: ACAS pilot collision avoidance failure scenarios Edition:1.0 Page 32

4.4 Pilot visual collision avoidance The Pilot Visual Collision Avoidance barrier has been tested 17 times and worked 11 times, i.e. its recorded efficiency is 64,7%, which seems to be a better performance than anticipated in the IFR/IFR and IFR/VFR encounters analysed. Figure 24 below identifies the failure scenarios of this barrier. In the majority of the events (4 out of 6) that trespassed this barrier the conflicting aircraft was visible (VMC prevailed) but was not visually detected by the crew of the other aircraft. PILOT COLLISION AVOIDANCE - VISUAL The conflict is not visible The conflict is visible but is not visually detected Figure 24: Pilot visual collision avoidance failure scenarios Edition:1.0 Page 33

5. Findings The analysis of the data sample of A and B severity incidents of IFR flights separation minima infringement and of inadequate separation between IFR and VFR flights that occurred in the TMA and CTR airspaces (controlled by APP and TWR ATS units) in EUROCONTROL member states in the years 2014, 2015 and 2016 enabled the establishment of the following generic findings: A. The ATC Tactical Separation Assurance and ATC Tactical Conflict Prevention barriers failed in all cases they were challenged, i.e. these barriers did not stop the propagation of the events to the next barrier levels. This result is explained by the fact that the analysed data sample incudes only high severity events ( A -s and B -s). B. The ATC Collision Avoidance barrier was challenged 187 times and worked 107 times, i.e. its recorded efficiency is 57%. It should be noted that this barrier is not applicable in the analysis of incidents involving IFR and VFR flights in class D and E airspace. C. The ACAS Pilot Collision Avoidance barrier was challenged 80 times and worked 63 times, i.e. its recorded efficiency is considerably higher (than of the ATC Collision Avoidance barrier) reaching 79%. D. The Pilot Visual Collision Avoidance barrier was challenged 17 times and worked 11 times, i.e. its recorded efficiency is 65%, which seems to be a better performance than anticipated. This potential of the Pilot Visual Collision Avoidance barrier to stop the further propagation of the incidents that challenged it may not be fully representative in view of the IFR/IFR and IFR/VFR encounters included in the analysed data sample. E. In six (6) cases the conflict geometry (chance) helped avoid the mid-air collision, which means that the overall recorded efficiency of the manageable TMA conflict prevention and collision avoidance barriers is 97%. F. Environment factors reported in the incident descriptions, such as bad weather, traffic complexity, ATC position hand-over/take-over appear to not have a considerable impact on barriers performance. G. Events, in which OJT and technical system contribution was reported as a factor, did in general have a higher propagation potential - 50% were stopped by the Pilot Collision Avoidance barriers and one event by the Providence. Edition:1.0 Page 34

H. The effectiveness of the first barriers, namely the ATC Separation Assurance and ATC Collision Avoidance is lower and therefore the ACAS Pilot Collision Avoidance, Pilot Visual Collision Avoidance and the Providence basic barriers are relatively more often challenged compared to the en-route environment. I. A possible explanation that the Pilot Visual Collision Avoidance and the Providence barriers are more often challenged in the TMA and CTR environment is the fact that TCAS RA alerts are inhibited below 1000ft. J. Overall, the ATC induced tactical conflicts account for 71% of the analysed incident data sample. The tactical conflict being generated by the use of inadequate ATC controlling techniques is the clearly outstanding initiator with a share of 23 % of events analysed. K. Incidents that occurred in class D and E airspace are well represented in the analysed data sample (around 10% of all incidents analysed). The big majority of those incidents was stopped by the ACAS Pilot Collision Avoidance barrier. One incident was stopped by the Pilot Visual Collision Avoidance and another one by the Providence. Therefore it is suggested that this type of incidents are further analysed by dedicated operational safety study. L. Nearly a quarter (23%) of the incidents in the analysed data sample involves VFR flights. The size of this group and the severity of incident outcome is considerable and therefore the VFR/IFR encounters in TMA and CTR airspaces should be monitored. M. The analysed sample included only one event of controlled airspace excursion but with high risk potential. Therefore it is suggested to monitor this type of safety occurrences, too. N. The analysis of the data sample events involving going-around aircraft identified that their safety criticality is considerable. In particular, the risk born by encounters between low level going-around aircraft and the preceding departure is suggested as a priority for operational safety study. Edition:1.0 Page 35

ANNEX 1. SAFMAP EVENTS DESCRIPTION 2014 safety occurrence data Occurrence Tactical Conflict Prevention Tactical Separation Assurance ATC Collision Avoidance ACAS Collision Avoidance Visual Collision Avoidance Providence APP event 1 A descending aircraft came in conflict with another descending aircraft. Prevention of tactical conflict caused by deviation from clearances or instructions Prevention of lateral deviation initiation An aircraft was cleared to IAF without other instructions. As per published procedures should hold at IAF but the aircraft turned at the IAF and commenced approach. The conflict is detected and interpreted by controller No STCA in approach, inhibited because of many false alerts. No need for ATC collision avoidance. APP event 2 A descending aircraft came in conflict with another descending aircraft. APP event 3 Two successive departing aircraft came in conflict. APP event 4 Two successive arriving aircraft came in conflict. APP event 5 A climbing aircraft came in conflict with another descending aircraft. Prevention of tactical conflict caused by deviation from clearances or instructions Prevention of lateral deviation initiation An aircraft was cleared to IAF without other instructions. As per published procedures should hold at IAF but the aircraft turned at the IAF and commenced approach. Pilot continued on ILS approach. Prevention of conflict being generated by inter-sector and inter-unit coordination TWR did not comply with the LoA for the performance of the aircraft and cleared for take-off the second, higher performance aircraft too early. controller s plan of work A super heavy aircraft was vectored too short behind a light aircraft on final without controller realising the different performance. Prevention of overlooking potentially conflicting aircraft when issuing clearance or instruction Effective controller decision and action Adequate controller conflict resolution plan - adequate controlling techniques Opportunity for ATC tactical resolution There is sufficient time for ATC tactical resolution The conflict is detected and interpreted by controller No STCA in approach, inhibited because of many false alerts. The conflict is detected and interpreted by controller Effective controller decision and action Adequate controller collision avoidance plan - adequate controlling techniques No need for ATC collision avoidance. The succeeding aircraft was instructed to go-around. Adequate air-ground communications Correct communication and understanding of the communication message The ACAS RA s were followed Worked. The ACAS RA s were followed Worked. The collision avoidance instruction overlapped with the TA announcement in the cockpit. Edition:1. Page 36

APP event 6 A descending aircraft came in conflict with another aircraft in level flight. APP event 7 Inadequate separation between IFR and VFR aircraft. Prevention of overlooking potentially conflicting aircraft when issuing clearance or instruction Blind spot an aircraft in close proximity was overlooked after an instruction as per FPL. Distraction by another sector coordination call. Conflicting aircraft close horizontally and at 1000ft. Pre-tactical conflict prevention by ATC tactical planning, synchronisation and use of entry procedures Controller forgot the VFR aircraft and did not provide traffic information. The conflict is detected and interpreted by controller No STCA in approach, inhibited because of many false alerts. ATC separation not required. TCAS triggered Opportunity for ATC collision avoidance ACAS does not activate beforehand Failed ATC collision avoidance not required. TCAS triggered The ACAS RA s were followed Worked. The ACAS RA s were followed Worked APP event 8 Two consecutive arriving a/c came in conflict APP event 9 Two consecutive arriving a/c came in conflict APP event 10 An arriving a/c came in conflict with an opposite direction departing one APP event 11 Two consecutive arriving a/c came in conflict Inadequate controlling technique vectoring misjudgement, expected larger turn radius. During sequencing for final approach. Conflict with the preceding a/c during ILS interception. The speed indication in a/c track label was not used. Work related fatigue night shift and 223 minutes on position without a break. Following the previous event. Inadequate controlling technique - specific speed profile for RWY 34 and strong North winds changing across altitudes. During sequencing for final approach. Catch up of two a/c after ATCO assigned the same speed but due to the wind profile there was a speed difference. After HOTO not optimal time for HOTO as there were many tasks and information provided. Misunderstanding during HOTO for the speed instructions. The Feeder was under pressure to solve issues at the end of the final and no time to continuously monitor the speeds of the a/c in front. Increased workload due to holding stack management. During HOTO after a remark by the upcoming ATCO the departing a/c was re-cleared to the same altitude the arriving a/c was descending to. Inadequate ATCO plan. Trusted the judgement of the upcoming ATCO. During personal set-up. During sequencing for final approach. Balance safety and efficiency. Inadequate ATCO plan assumed speed for the preceding a/c higher than the actual. Inadequate controlling technique judgement that there will be no separation infringement.. Traffic information was provided. Inadequate controlling technique judgement that there will be no separation infringement.. ATCO detected the tactical conflict at the same time as STCA. Avoiding action and traffic information were issued. The descending a/c reported traffic in sight. ACAS RA before. No sufficient time for separation assurance - the a/c were already at the separation limit. No opportunity for ATC collision avoidance. ACAS RA before. No need for collision avoidance. ACAS RA before. No need for collision avoidance. The ACAS RA was followed. The ACAS RA was followed. Edition:1.0 Page 37