COSPACE HAZOP REPORT (combined controller and pilot)

Transcription

1 COSPACE HAZOP REPORT (combined controller and pilot) Date: Wednesday, March 15, 2006 Draft: V1.6 DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

2 DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

3 CHANGE SHEET Date Change Changes Version status 09/12/05 Creation /01/2006 Minor changes (KZ; RG) 1.1 Minor changes (KZ; RG) 1.2 Minor changes (KZ; RG) - recommendations 1.3 Minor changes (KZ; RG) 1.4 Minor changes (KZ; RG) 1.5 Issue to RFG 1.6 DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

4 Contents DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

5 ACRYNOM LIST Abbreviation ADD ADS-B AMAN ASAS O ATM Cb CDTI CPDLC CRM DCDU EEC E-TMA EXE / EXC FAF ft FCU FL FHA Freq HAZOP HMI IAF kts MCDU ND PF PFD PLC PNF R/T S&M Sev SSR STCA De-Code Aircraft Derived Data Automatic Dependant Surveillance Broadcast Arrival Manager Airborne Separation Assistance System Air Traffic Control Air Traffic Control Officer Air Traffic Management Cumulonimbus Cockpit Display of Traffic Information Controller Pilot Data Link Communications Crew Resource Management Datalink Cockpit Display Unit EUROCONTROL Experimental Centre Extended Terminal Control Area Executive Controller Final Approach Fix feet Flight Control Unit Flight Level Functional Hazard Assessment Frequency Hazard and Operability Study Human Machine Interface Initial Approach Fix knots Multi-Function Control & Display Unit Navigation Display Pilot Flying Primary Flight Display Pilot Planning Controller Pilot Non Flying Radio Telephony Sequencing and Merging Severity Secondary Surveillance Radar Short Term Conflict Alert DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

6 Abbreviation TCAS TMA TRM WPT De-Code Traffic Alert and Collision Avoidance System Terminal Control Area Team Resource Management Waypoint DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

7 COSPACE HAZOP REPORT 1 Introduction The CoSpace team was undertaking a HAZOP as part of the safety analysis (FHA, Functional Hazard Assessment) for Airborne Spacing / Sequencing & Merging (S&M). FHA is the first part of the EUROCONTROL Safety Assessment Methodology for developing a safety case. 1.1 Objectives of CoSpace HAZOPs HAZOP aims to determine four things: i) identify errors associated with S&M ii) make an assessment of their causes, consequences, resulting hazards, current planned safeguards, severity/likelihood iii) propose possible recommendations for further consideration iv) feed-forward key safety information to the S&M operational concept It was decided to run two HAZOPs, one for the controllers and one for the pilots separately, and then a consolidation HAZOP. The controller and pilot HAZOPs were undertaken in April and May, 2005 respectively. The two HAZOPs were limited to 2 days each, and hence a complete HAZOP of the S&M procedure was not possible. The CoSpace project team participated in both sessions, with three controllers for the first HAZOP, and two pilots during the second one. All operational experts were highly experienced with S&M by participating in previous CoSpace simulations. A HAZOP consolidation session was undertaken in September, 2005 with the CoSpace project team, the same controllers and pilots. Group A HAZOP: Controllers April, 2005 Group B HAZOP: Pilots May, 2005 Group C HAZOP Consolidation: controllers and pilots September, Operational Environment The operational environment that provided the basis for the HAZOP sessions was based on what was tested during the air and ground experiments. Due to the limited time, it was decided to focus only on the TMA. Details are described below (Table 1). Table 1. Operational environment characteristics CNS/ATM capabilities Aircraft equipment Traffic characteristics Airspace design Sector manning As today in large TMAs (e.g. radar, voice communication, paper strips). Full ADS-B out (any aircraft can be target). Full ASAS equipage (main assumption) and mixed ASAS equipage (secondary assumption). ASAS in manual (speed select) mode (i.e. no automation) Traffic up to full capacity (e.g. 36 arrivals per hour on one dedicated landing runway under standard conditions). Fleet mix: jets and props (props with speed not less than 220 kts). Standard trajectories from IAFs to FAF with specific design (sequencing legs converging to a single merge point). Specific assumption based on current experience: two IAFs with a single landing runway at one airport. Grouping the arrival control positions into one (i.e. initial/pick-up and intermediate/feeder positions grouped), and to man this single position with an executive and a planning controller. DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

8 Controller working position Separation Weather conditions As today plus graphical links (display on radar screen and interaction through the mouse) to indicate aircraft under spacing. As today in terms of radar and wake turbulence separations. This includes modified separations (e.g. for Low Visibility Procedures). No adverse conditions (e.g. no storms, no very strong winds). 2 Controller and Pilot HAZOPs 2.1 HAZOP Method HAZOP preparation In order to prepare for the HAZOP sessions, an initial task analysis was developed focusing mainly on the controller tasks. This was undertaken describing the tasks of a controller controlling 2 aircraft, a target, and a reference aircraft that were already under spacing before they arrived in the TMA and that they were either: 1. from the same IAF carrying out a merge instruction (not using sequencing legs) 2. from the same IAF carrying out a heading & merge instruction (using sequencing legs) 3. from different IAFs carrying out a merge instruction (not using sequencing legs) 4. from different IAFs carrying out a heading & merge instruction (using sequencing legs) The task analysis was expanded to encompass a more detailed set of the pilot tasks (for use in the pilot HAZOP). See Table B1 and B2 in Appendix B for both the controller and pilot tasks HAZOP method The aims and process of the HAZOP session was described to the group by the HAZOP Chairman (see Appendix A). Refresher training of the S&M procedures was undertaken by the CoSpace Project Manager using the controller and pilot presentations described in section and the scenario task analysis was described. The operational environment assumptions were then discussed and agreed (listed in section 1.2). The HAZOP was then started by using task analysis and HAZOP guidewords (see Table A1, Appendix A). The controller HAZOP analysed Scenarios 1 and 4 and the pilot HAZOP analysed Scenario 4. The group: 1. decided on which task step to begin with, applied a guideword (e.g. none ) 2. developed a deviation or potential errors associated with the guideword 3. discussed the potential consequences (e.g. loss of spacing) of the error 4. discussed the error in more detail with regard to the causes of the error, if it was thought to be a potential safety or workload issue 5. estimated the errors potential severity and frequency rating (using the risk matrix illustrated Figure A2, Appendix A) 6. identified existing safeguards 7. identified, further recommendations (if the safeguards were not thought to be adequate) 8. prioritise the most important errors at the end of the HAZOP session The following tasks were analysed during the controller HAZOP, due to their relevance to the S&M procedures. Seven tasks were discussed from Scenario 1, where a pair of aircraft, from the same IAF, under spacing (and not under spacing), and not using sequencing leg are considered. DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

9 o Spacing cancellation and speed instruction o Sequence order o First call o Decision to use ASAS o Target selection (input code; controller HMI update) o Target identification (target confirmation) o Spacing instruction merge ( instruction; input instruction, WPT and spacing value) One task was discussed from Scenario 2, where a pair of aircraft, from the same IAF, under spacing (and not under spacing), are using the sequencing leg are considered: o Spacing instruction heading & merge same IAF ( instruction; input instruction, WPT and spacing value) Two additional tasks were discussed from Scenario 4, where a pair of aircraft, from different IAFs, are using the sequencing legs: o Spacing cancellation and speed instruction o Spacing instruction heading & merge different IAF ( instruction; input instruction, WPT and spacing value) The following tasks were discussed during the pilot HAZOP (Scenario 4): o Spacing cancellation and speed instruction o Target selection (input code; visualization and positioning; cross-check) o Target identification (target confirmation; validation) o Spacing instruction heading & merge ( instruction; pilot readback; input instruction, WPT and spacing value; remain on navigation; feasibility check; validation) HAZOP participants Controller HAZOP participants Barry KIRWAN HAZOP chairman, Safety Co-ordinator, EEC Rachael GORDON HAZOP recorder, CoSpace safety contact, EEC Karim ZEGHAL CoSpace project leader + procedure, EEC Francois VERGNE Operations - CoSpace project, EEC Laurence ROGNIN Human Factors CoSpace project, EEC Ludovic BOURSIER Approach controller Paris, Orly Claudio COLACICCHI Approach controller Roma Massimo ORSONI Approach controller Roma Pilot HAZOP participants Barry KIRWAN Rachael GORDON Paul HUMPHREYS Karim ZEGHAL Francois VERGNE Philippe PELLERIN Airline captain HAZOP chairman, Safety Co-ordinator, EEC HAZOP recorder (Day 1 and 2), CoSpace safety contact, EEC HAZOP recorder (Day 3), Safety Research Team, EEC CoSpace project leader + procedure, EEC Operations - CoSpace project, EEC Airbus test pilot 2.2 Controller and Pilot HAZOP Results Controller HAZOP Results A total of 46 errors were identified during the controller HAZOP. Of the 46 errors identified, 19 were given severity ratings of 3 (airmiss) and three were given severity ratings of 2 (close airmiss; errors #15; #18; #21 in Table 1). No level 1 (potential accident) severity ratings were identified (see Table 2). DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

10 At the end of the HAZOP session, the HAZOP team was asked to prioritise which of the 21 errors, identified as severity rating 3 or worse, were most important to them. The following list was compiled of the most important errors. The controller participants were asked to further identify which of these errors were of priority to them. These have been highlighted with the use of an asterisk*. Table 2. Critical errors/failure modes identified during the controller HAZOP Ref Task Error / Failure Mode B.1 First call HMI link is missing D.5 Target selection Controller selects wrong target D.3 Target selection Pilot inputs wrong code (wrong target) F.1 Target identification Wrong target identified wrong readback F.2 Target identification *Wrong target identified correct readback K.7 Merge Required spacing not input by pilot K.3 Merge *Pilot enters wrong spacing J.4 Merge *Pilot puts wrong merge point I.3 Heading & merge (same IAF) *Merge without heading I.1, I.2 Heading & merge (same IAF) Heading given, no merge H.7 Heading & merge (same IAF) Pilot does not merge J.4 Heading & merge (same IAF) *Merge to wrong merge point K.1 Heading & merge (same IAF) Incorrect spacing value by controller H.1 Heading & merge (diff IAF) No instruction given I.4 Heading & merge (diff IAF) *Merge without heading N.1 Heading & merge (diff IAF) *Other a/c takes instruction O.3 Spacing cancellation Instruction given to wrong a/c O.4 Spacing cancellation No speed instruction given O.1 Spacing cancellation Instruction given, link not cancelled Q.1 Spacing cancellation Cancel wrong aircraft Pilot HAZOP Results A total of 40 errors were identified during the pilot HAZOP. Of the 40 errors identified, 8 were given severity ratings of 3 (airmiss) and one was given a severity ratings of 2/3 (close airmiss;* although this was changed to a level 3 in the consolidation HAZOP). No errors with level 1 severity ratings (potential accident) were identified (see Table 3). Table 3. Critical errors/failure modes identified during the pilot HAZOP New Ref Task Error / Failure Mode D.3 Target selection Wrong code input (and is a valid code) F.3 Target identification *Wrong target given to H.5 Continue heading then merge instruction not given / delayed H.6 Continue heading then merge Pilot does not input instruction, WPT, spacing J.5 Continue heading then merge Inputting wrong WPT K.6 Continue heading then merge Inputting wrong spacing value L.1 Continue heading then merge Initiate direct to WPT not done/too late L.4 Continue heading then merge Initiate direct to wrong WPT M.1 Continue heading then merge Less maintenance of spacing by speed actions DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

11 3. HAZOP Consolidation After the two HAZOP sessions, a third session was planned in which the results from the first two HAZOPs would be consolidated into one set of HAZOP Notes. Rather than going over all the errors from both HAZOPs, it was decided to focus on those errors identified as more severe (severity level 3 or worse). This process is described in detail next. 3.1 HAZOP Consolidation Method HAZOP consolidation preparation A consolidation of the Notes from the 2 HAZOPs (see Appendix C) was prepared, where: - errors classified with severity levels 2 or 3 were chosen (as there were no level 1 errors) - errors were grouped according to their task step - errors were relabeled according to the main task (A, B, C etc) and error (1,2,3 etc), B.1, B.2 etc - errors that were identified both by the pilots and the controllers during their individual HAZOPs were listed next to each other in the consolidated HAZOP table - comments made by the CoSpace team prior to the consolidation HAZOP were identified (as comments ) in the consolidated HAZOP table. These were to be clarified during the HAZOP consolidation session HAZOP consolidation process The objective of the HAZOP Consolidation session was to merge the two HAZOP notes to form one. To do this, both the controllers and pilots from the two HAZOP sessions participated in the HAZOP consolidation session. An additional participant came for the first day (as an observer). The schedule for the day included: 1. HAZOP aims and method was described to the group (HAZOP Chairman) 2. Refresher training of the sequencing and merging procedures (CoSpace Project Manager) 3. CoSpace Environmental Assumptions were discussed and agreed 4. CoSpace scenario task analysis was described (CoSpace Project Manager) 5. HAZOP Consolidation was started using the merged HAZOP table o Identify similar or identical errors based on the deviation or potential errors o Agree on the potential consequences (e.g. loss of spacing) o Agree on the severity and frequency of the error o Agree on the existing safeguards and causes o Identify additional safeguards that may be required HAZOP consolidation participants Barry KIRWAN HAZOP chairman, Safety Co-ordinator, EEC Rachael GORDON HAZOP recorder (Day 1 and 2), CoSpace safety contact, EEC Karim ZEGHAL CoSpace project leader + procedure, EEC Francois VERGNE Operations - CoSpace project, EEC Ludovic BOURSIER Approach controller Paris, Orly Claudio COLACICCHI Approach controller - Roma Massimo ORSONI Approach controller - Roma Philippe PELLERIN Airbus test pilot Airline captain Bob DARBY Observer, CASCADE, EATM DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

12 3.2 Results Consolidated list of controller and pilot HAZOP notes The consolidation session involved the re-assessment of the severity and frequency, where some modifications were made, and some additional variants of errors were identified. Safeguards and recommendations were validated and sometimes refined. During the consolidation session, the controllers and pilots learnt a lot about the way in which the other side carries out their tasks, but had a consistent view of the concept and procedure. In the main, controllers and pilots were also in agreement with the severity levels and frequencies of errors. The full consolidated list of the S&M errors is provided in Appendix C. In total, from the pilot and controller HAZOP sessions and the consolidation session, 97 errors/ failure modes were identified, 8 with severity level 2, 1 with severity 2/3, 19 with severity level 3, 10 with severity 3/4, and 35 with severity level 4 (24 errors unclassified as they were considered as variants).the critical errors (those errors with severity level 2 or 3) that were discussed during the consolidation HAZOP have been categorized into 12 main categories. Table 4 displays these error categories, the number of critical errors (severity level 3 or worse) under each error category and the highest severity identified. Table 4. Merged list of critical errors discussed during controller and pilot HAZOPs Task Critical Error / Failure mode Categories Severity Level Number of errors First call Spacing link on controller screen not consistent 3 1 Target selection Wrong aircraft selected 3 3 Target identification Wrong aircraft identified 3 3 Instruction not given or not entered (or too late) Only part of instruction given or entered 3 3/4 2/3 3 3/ Spacing instruction Wrong merge point given or entered Wrong spacing value given or entered 3 1 Merge not (properly) initiated 3 3/4 1 3 Spacing not (properly) maintained 3 2 Other aircraft taking instruction 2 1 Cancel spacing Instruction not given or not entered (or partly) 3 3/4 3 1 Wrong aircraft takes cancellation instruction Recommendations (categorized by type) Recommendations were identified during the HAZOP and linked to the individual errors. These recommendations have been re-categorized according to the type of recommendation, whether DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

13 it be HMI (HMI); training (T); procedural (PR); operational environment (OE); or organizationalmanning (OM). The full list can be found in Appendix D. Table 4 displays the recommendations linked to the most critical errors (with severity levels of 2 or 3). The numbers in brackets (n=x) refer to the number of times the generic recommendation was cited in the HAZOP table and recommendations with an asterisk* next to them originate from the severity 2 errors. These recommendations will be examined in more detail to identify the necessary requirements for S&M. HMI Controller - To ensure controller selects (and clicks) correct a/c, have a dotted line (for selection) and a complete line (for identification) i.e. an additional click - To ensure it is not possible to select a/c twice as a target (technically within ADS-B messages: ground & air) - *To ensure correct spacing value is input, an alert on link when spacing is too large or too small (e.g. HMI colour change) - To help ensure the instruction is given to the correct a/c, efficient label anti-overlap is necessary - To check that speed instruction is given with spacing cancellation instruction, temporarily highlight speed value on HMI (e.g. for 5s) HMI - Pilot - To ensure pilot inputs correct parameters (e.g. target code, merge point), DCDU should be coupled with MCDU - *To help ensure spacing value is correct, HMI (ND, MCDU) to display target aircraft wake turbulence category (e.g. H for Heavy) - *To help ensure spacing value is correct, HMI to check spacing against target aircraft wake turbulence category - To help ensure heading & merge to correct merge point, it should not be possible to enter merge point after it has been past - To ensure pilot inputs correct merge point, consider whether ASAS page should only display tagged merge points - To ensure direct to is properly initiated, make resume automatic HMI - ADD/ASAS use of the downlink of spacing parameters - To check correct airborne spacing status - To check correct target is selected - To solve the problem of correct target positioning - *To check correct spacing value is selected - To check that correct merge point is selected - *To check correct instruction is selected (e.g. merge instead of heading and merge) - To check actual spacing - *To check correct a/c taking instruction - To check if resume is initiated - To ensure correct aircraft is executing cancel spacing, put cancel spacing and speed limit by default HMI - CPDLC Use of controller pilot datalink communication - To ensure pilot inputs correct code - *To help ensure correct a/c takes spacing instruction Procedures/Phraseology - To help ensure that HMI link has the correct status, pilot should announce if under spacing (define phraseology for pilot e.g. under spacing each time they enter the sector and ask for more details only if there is a doubt) Note 1: the introduction of ASAS (< 50% a/c with ASAS) will need to consider positive announcement Note 2: Explicit co-ordination is not considered (silent co-ordination is used) - To help ensure controller selects correct target (and clicks right target) reinforce readback of target code by pilots - *To help ensure the correct spacing value is given by the controller the phraseology should be: merge (waypoint) 120s behind heavy DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

14 - To help ensure direct is initiated to the correct waypoint, emphasis reporting to merging waypoint by checking the ND Procedures - To help ensure that controller clicks correct target on HMI, visual checking of crossed lines may be required or numbering sequence of a/c - Explore methods of detecting wrong target : difficult to detect distance (e.g. a/c type);clock position is not very precise (e.g. confusion between 3 and 9 o clock); Use bearing instead of clock position to ensure correct target positioning is given to - *Quick fallback procedures may be required if the wrong aircraft takes heading and merge instruction or if merge instruction is given instead of heading and merge instruction - *To help ensure the correct spacing value is given by the controller, pilot should check spacing value against wake turbulence category (if they know it is a heavy in front) - *To help ensure the correct spacing value is given by the controller (and input by pilot) define minimum spacing value (not less than radar separation) and not less than 90s - To ensure that cancellation instruction is given and link is cancelled a handover checklist may be needed Training - TRM/CRM (Team/Crew Resource Management) - To help prevent against controller selecting the wrong but valid code - *To help prevent the controller from giving a merge instruction instead of a heading & merge instruction - To help prevent canceling the wrong a/c (e.g. ask for help when tired) - To understand better the maintenance of spacing by speed actions Training - Role - Role clarity between EXC and PLC to help prevent inconsistency between the interface and the actual situation. For example when the EXC gives an instruction, he updates the HMI. Training - Procedure training - *To help ensure that the wrong a/c does not take heading and merge instruction - To help prevent controller canceling the wrong aircraft - To ensure that when the cancellation instruction is given by the O, the link on radar screen is updated too Operational Environment - To ensure aircraft merges to the correct merge point, have one merge point per runway and publish the merge points in the ASAS STAR charts; and ensure there is not a possible confusion between nearby waypoints (e.g. BOKET and MOTEK) - To ensure pilot does not input the wrong merge point, limit number of direct to waypoints in TMA; consistency check on WPTs (i.e. only able to perform direct to on tagged merge points) - *To help prevent the wrong aircraft taking the heading and merge instruction, callsign confusion measures may be required - Clarify the impact that airline and speed limitations might have on S&M (in particular on maintaining spacing) Organisational & Manning - Relief controllers or a third person (behind) following the situation maybe required (e.g to ensure the wrong a/c is not cancelled) 4. Conclusions and Future Work In total, from the pilot and controller HAZOP sessions and the consolidation session, 97 errors were identified, 8 with severity level 2 (plus one severity 2/3), and 19 with severity level 3. The CoSpace project is currently completing the FHA (Functional Hazard Assessment) and the DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

15 errors identified during the HAZOPs will be used as the basis for the Event Tree and Fault Tree Analysis. Although both sides learnt a lot about the way in which the other side carries out their tasks, they had a consistent view of the concept and procedure. They were also in agreement with the severity levels and frequencies of errors. Despite not addressing all situations, the three HAZOPs seemed to cover the main aspects related to S&M at least in nominal situations. Issues that were not discussed include abnormal situations (e.g. weather), mixed equipage (ASAS and non-asas equipped aircraft). In addition to the HAZOP sessions, small-scale simulations are currently being undertaken to further investigate a number of non-nominal situations (holding patterns, mixed ASAS and non- ASAS aircraft, wind) and to identify recovery procedures for abnormal situations (aircraft not executing S&M instruction, go-around, emergency, radio failure). In addition a session is planned to investigate potentially relevant incidents that may help to identify safety benefits and issues from the CoSpace project (SafLearn project). DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

16 Appendix A. HAZOP Description HAZOP is a structured brainstorming approach developed by ICI in the UK in the mid-70 s, but has since been applied in many other industries including recently ATM. It is most often used in the early design stages, and relies on expert consideration of potential errors related to a system description and/or specific scenarios. HAZOP aims to determine two things: - Potential errors (including their consequences together with likely severity and anticipated frequency usually only in qualitative terms) - Potential Solutions to these errors where they are not negligible HAZOP is a group-based process run by an experienced chair-person, and with an important Secretarial role. The discussions are led by a Chair-person with on-line notes being recorded by the HAZOP secretary onto a laptop computer and projected onto a screen; the Secretary ensures all relevant discussion is noted, and must occasionally read back what is recorded to ensure the points recorded are fully understood by the group.. This allows all participants to view the HAZOP table, and provide immediate corrections in the event of misunderstanding. In addition, all applicable questions and comments raised during the discussion will be recorded. At the end of the session, all participants are aware of the output of the HAZOP. A copy of the minutes will be provided post-meeting to allow further comments. HAZOP cannot work in a vacuum, so in ATM it typically focuses on a set of operational scenarios, underpinned by an agreed Operating Environment description and assumptions. For Co-Space, there will in addition be a simplified Task Analysis which describes what he Os and Pilots do, and how they should interact. HAZOP then considers how things can go wrong, and how failures (human, technical or other) can be recovered. For example, when using speed control, there is a chance that the aircraft behind may catch up how is this detected and resolved by the controllers and/or pilots? What if the controller selects the wrong aircraft during the identification phase? These are examples where there could be potential errors, and where it is best if the S&M concept of operations is prepared for them, both to reduce their chances of occurrence, and to detect and resolve such errors should they arise. This is the objective of HAZOP. Figure A1 HAZOP Session Process 1. Verify Functions / Tasks Function Identify target Etc. Etc. 2. Brainstorm Failure Modes Failure Mode Pilot unable to identify target Cause Misunderstanding with controller 3. Analyse each row Operational Consequence Increase workload of controller and pilot Current/ planned safeguards Pilot detection (readback clock position) Severity (absolute scale) Severity (relative to today) Recommendations/ Comments?? Explore how data link technology could be used to support both O and pilot when selecting a target during ASAS spacing Table A1. HAZOP Guidewords used o None, No, Not no part of the intentions is achieved and nothing else happens o More of quantitative increases in any relevant parameters (e.g. speed) o Less of quantitative decreases o As well as additional activity DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

17 o Repeated o Sooner than o Later than o Part of only some of the intentions are achieved, some are not o Reverse the logical opposite of the intention (e.g. climb instead of descent) o Other than no part of the original intention is achieved, complete substitution Table A2. Context factors addressed in HAZOP sessions in general Weather Cbs, fog Airspace SIDS, holds, boundary Traffic density, mix, language HMI representation, clarity Equipment R/T, radar, CDTI Disturbances runway, AMAN Failures R/T (stuck), radar Organization night-time, other tasks, awareness, team, workload, time pressure, procedures, agreements Safety nets STCA, TCAS, MSAW Figure A2 Risk Matrix Frequency 1 frequent (1:week) 2 Occasional (1:month) 3 Rare (1:year) 4 Very rare (1:10years) 5 Never 1 Potential Accident SEVERITY 2 3 Close Air Miss Airmiss 4 Workload or SA 5 No effect DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

18 Appendix B. Scenarios developed for CoSpace HAZOP Figure B1. Matrix of the 4 scenarios developed Same IAF Different IAFs Merge Scenario 1 Scenario 3 Heading then merge Scenario 2 Scenario 4 Figure B2. Airspace used for the HAZOP FAO26 BOKET ILS 3000 LOMAN ODRAN KAYEN FL+1 MOTEK FL CODYN OKRIX DRAFT CoSpace HAZOP (combined controller and pilot) Report, September,

19 Table B1. CoSpace HAZOP Scenario 4 A pair of aircraft (A and B), from different IAFs, A and B using sequencing leg; If B under spacing do step 2 (spacing cancellation and speed). Grey writing indicates this task step has been covered in scenario 1. Task Step Controller PNF PF 1 First call B Identification Announce 1. Instruction 2 3 Spacing cancellation and speed for B Target selection for B 2. Read-back 3. Cancel spacing and deselect target (MCDU) 5. Crosscheck of speed action (PFD) 1. Instruction 2. Read-back 3. Input code (MCDU) 5. Crosscheck of positioning (ND) 4. Execute speed (FCU) 4. Visualisation and positioning to PNF (ND) 4 Target identification for B 2. Target confirmation 1. Target positioning to 3. Target validation (MCDU) 1. Instruction 2. Read-back 5 Continue heading then merge for B 3. Input instruction, WPT and spacing value (MCDU) 5. Instruction validation (MCDU) 8. Crosscheck direct to WPT (PFD) 9. Report to 11. Crosscheck of speed actions (PFD) and monitoring the spacing (ND) 3bis. Maintain current heading 4. Check feasibility (MCDU) 6. Monitor the acquisition of spacing (ND) 7. Initiate direct to WPT (MCDU) 10. Maintenance of spacing by speed actions (FCU) 12. Conditional (*): Announce unable spacing 6 Descent for B Instruction Read-back + execution 7 ILS approach for B Instruction Read-back + execution 8 9 Spacing cancellation and speed for B ILS establishment for B Instruction Acknowledgement Read-back + execution Report 10 Transfer B to TWR Instruction Read-back + execution General tasks: monitoring other traffic (TCAS display) and target (ND) (PF and PNF); normal flying tasks (e.g. arrival tasks); transfer from E-TMA to TMA; task steps relevant to ASAS in particular; (*) in case of unexpected event (e.g. technical failure). DRAFT Cospace Pilot HAZOP Report, May,

20 Table B2. CoSpace HAZOP Scenario 1 A pair of aircraft (A and B), from the same IAF, not under spacing, A and B not using sequencing leg Task Step Controller PNF PF 1 Transfer from E-TMA to TMA First call B Identification Announce 1. Instruction 2. Read-back 2 3 Target selection for B Target identification for B 3. Input code (MCDU) 5. Crosscheck of positioning (ND) 2. Target confirmation 1. Target positioning to 4. Visualisation and positioning to PNF (ND) 3. Target validation (MCDU) 1. Instruction 2. Read-back 4 Merge for B 3. Input instruction, WPT and spacing value (MCDU) 5. Instruction validation (MCDU) 7. Crosscheck of speed actions (PFD) and monitoring the spacing (ND) 3bis. Execute direct to WPT 4. Check feasibility (ND/MCDU) 6. Acquisition and maintenance of spacing by speed actions (FCU) 8. Conditional (*): Announce unable spacing 5 Descent for B Instruction Read-back Execution ILS approach for B Spacing cancellation and speed for B ILS establishment for B Transfer B to TWR Instruction Read-back Execution 1. Instruction Acknowledgement 2. Read-back 3. Cancel spacing and deselect target (MCDU) 5. Crosscheck of speed action (PFD) Report 4. Execute speed (FCU) Instruction Read-back Execution General tasks: monitoring other traffic (TCAS display) and target (ND) (PF and PNF); normal flying tasks (e.g. arrival tasks); transfer from E-TMA to TMA task steps relevant to ASAS in particular; (*) in case of unexpected event (e.g. technical failure). DRAFT Cospace Pilot HAZOP Report, May,

21 Appendix C. Consolidated Pilot and Controller HAZOP study log sheets Task Errors Number of errors Highest severity Sequence order identification A Sequence order not identified or identified too late 4 4 First call B Spacing link on controller screen not consistent 3 3 Decision to use spacing Target selection Target identification C Using ASAS when not applicable 2 4 D Wrong aircraft selected 5 3 E Only part of target selection 10 4 F Wrong aircraft identified 3 3 G Only part of target identification 6 4 H Instruction not given or not entered (or too late) 7 3 I Only part of instruction given or entered 13 2/3 J Wrong merge point given or entered 5 3 Spacing instruction K Wrong spacing value given or entered 7 2 L Merge not (properly) initiated 6 3 M Spacing not (properly) maintained 8 3 N Other aircraft taking instruction 1 2 O Instruction not given or not entered (or partly) 10 3 Cancel spacing P Part of cancellation instruction given 6 4 Q Wrong aircraft takes cancellation instruction 1 3 DRAFT Cospace Pilot HAZOP Report, May,

22 (Numbers in brackets refer to the original numbering system; grey boxes refer to error/failure modes not discussed during the consolidation HAZOP severity level 4) Error # TASK GUIDEWORD DEVIATION /ERROR CAUSES CONSEQUENCES RISK RANKING A. SEQUENCE ORDER NOT IDENTIFIED OR IDENTIFIED TOO LATE A Sequence No sequence - High traffic - No ASAS order order - Adverse - More workload identification identification weather (Cb) (EXC) (none) A.2 A Sequence order identification (EXC) 1.1 Sequence order identification (EXC) Non-ASASequipped a/c in sequence (other than) Planning started too far in advance (sooner than) - Non-ASAS a/c not identified (HMI, strips) - Not seen by PC - Flow management error (higher volume of traffic) - Over-trust in AMAN - Confusion (non- ASAS equipped a/c can be a target a/c) and o may assign them as an Instructed a/c - Workload - Forget other traffic coming into the sector at the last moment - Wrong sequence - Workload for EXE Sev 4 Freq - 4 Sev 4 Freq 4/5 Sev 4 Freq - 4 RECOVERY / SAFEGUARDS - Open another freq 2 executive Os (pick-up & feeder) - Quick sector change - Open holding stacks - Non-ASAS pilot will ask O for clarification RECOMMENDATIONS - Training transition from working with to without ASAS - Training - High traffic/ without ASAS - Check this issue with pilots - Ensure HMI is clear with respect to ASAS and non-asas equipage; including non-serviceable ASAS equipage - Tool to better identify sequence (e.g. like AMAN) - Teamworking training between PLC and EXE - EXE - More stable AMAN - AMAN calibration training for EXE, PLC, SEQ (understanding the limits of AMAN) A Sequence order identification (EXC) Sequence order identified late (later than) - Overloaded PLC - Overloaded EXE Sev 4 Freq 4/5 - Open holding stacks - Training for PLC - PLC will no longer do the coordination tasks for a short period (role consolidation) task shedding/ additional role - Team Resource Management (including E-TMA controllers) to DRAFT Cospace Pilot HAZOP Report, May,

23 know their roles & what they are working towards & know how to support each other in high workload DRAFT Cospace Pilot HAZOP Report, May,

24 Error # TASK GUIDEWORD DEVIATION /ERROR CAUSES CONSEQUENCES RISK RANKING B. SPACING LINK ON CONTROLLER SCREEN NOT CONSISTENT B First call (EXC) Spacing link on radar screen is Link not drawn or not updated missing or has by previous wrong status sector B First call (EXC) A/c not under spacing are linked on the HMI B First call (EXC) No first call (none) - Confusion of aircraft spacing status - Workload - Loss of spacing (in case link in green but not under spacing) - Not applicable standard procedures Sev 3 Freq 2 RECOVERY / SAFEGUARDS Pilot reporting when under spacing on first call EXC clicks spacing link and PLC x- checks both for TMA and E-TMA ASAS-equipped a/c will be indicated on HMI - o will request other sector to pass a/c (same as today) RECOMMENDATIONS - Define phraseology for pilot [pilot say under spacing each time they enter sector & ask for more details only if there is a doubt] - Use of ADD/ASAS (downlink of aircraft spacing status) - Explicit co-ordination is not considered (silent co-ordination is used) - Cancel spacing by previous sector and retaining target of the a/c was ruled out because you lose some benefits and increase workload] - Introduction of ASAS (<50% a/c with ASAS) will need to consider using positive announcement - EXC will call a/c to confirm if there is a link and they do not announce they are under spacing DRAFT Cospace Pilot HAZOP Report, May,

25 Error # TASK GUIDEWORD DEVIATION /ERROR C. USING ASAS WHEN NOT APPLICABLE 3. Decision to use spacing instruction (EXC) C.1 C.2 3. Decision to use spacing instruction (EXC) Using ASAS when not applicable or necessary (other than) EXE does not agree with proposed sequence ASAS not applicable; use different sequence (reverse) CAUSES CONSEQUENCES RISK RANKING - Inexperience; - ASAS chain are grouped as one (to simplify picture) - Lack of team working - Different levels of experience - Unable for pilot to enact - Workload Sev 4 Freq 4 (initially) - Workload Sev 4 Freq - 5 RECOVERY / SAFEGUARDS - Pilot reporting when unable - EXE makes final decision RECOMMENDATIONS - Calibration training early phase (operational readiness testing) - Team work training DRAFT Cospace Pilot HAZOP Report, May,

26 Error # TASK GUIDEWORD DEVIATION /ERROR D. WRONG AIRCRAFT SELECTED D Target selection (EXC) D Target selection Input code (PNF) D Target selection Input Instruction given with correct aircraft (target) but controller clicks wrong (target) aircraft on radar screen Pilot inputs wrong code that is not valid (i.e. no corresponding aircraft) Pilot inputs wrong code CAUSES CONSEQUENCES RISK RANKING - Label overlap - SSR code confusion - Incorrect strip ordering in strip bay - Overload - Working arrangements (EXE & PLC) - Wasting time - Need to start the target selection again - Inconsistent view between a/c and - Potential airprox - Wasting time - Need to start the target selection againcospace comment: If identified as input error by the pilot, does not need to contact again.] Sev 3 Freq 3 Sev 4 Freq 3 RECOVERY / SAFEGUARDS - In the phraseology, there is a double cross-check of SSR code - Highlight of both aircraft, one after the other when clicking to do the link - On radar screen, it is not possible to select an aircraft as target twice - EXE maintain HMI & PLC should remind EXE to keep consistency - Readback - Pilot will get an error message - Target identification [CoSpace comment: Cannot reach this step if code does not exist] - Wasting time Sev 3 - SSR code displayed on ND RECOMMENDATIONS - Reinforce importance of readback of target SSR code by pilots (stick to phraseology) - CPDLC will prevent inconsistency between a/c and ( and a/c will have consistent target) but does not prevent D4 - Use of ADD/ASAS (downlink of target selected) - On radar screen, an additional action (a click to switch from a dotted line for selection to a plain line when identified) may contribute to detect a wrong target - Sequence ordering: Visual checking of crossed lines - Sequence ordering: Numbering sequence of a/c (linked with AMAN) - Pilot readback what they are inputting - Use of datalink - Address in pilot HAZOP - Note: for Airbus, SSR code will be next to the target on ND (simulate DRAFT Cospace Pilot HAZOP Report, May,

27 Error # TASK code (PNF) GUIDEWORD DEVIATION /ERROR that is valid (i.e. a corresponding aircraft exists) CAUSES CONSEQUENCES RISK RANKING - Need to start the target selection again - Potential airprox Freq 3 RECOVERY / SAFEGUARDS only during selection - Pilot readback SSR code - Target identification RECOMMENDATIONS heavy traffic and see if display looks cluttered) - Use of ADD/ASAS (downlink of target selected) - Use of datalink D Target selection (EXC) (not identified) Controller gives the wrong (invalid) code Sev 4 D Target selection (EXC) Controller wrong (but valid) code Busy Fatigued Workload Label overlap - Wasting time Need to start the target selection againotential airprox Sev 3 Freq - 3 Pilot readback Target identification X-check from PLC ADD (ASAS) Controller TRM Defined working practices (a routine method of working) DRAFT Cospace Pilot HAZOP Report, May,

28 Error # TASK GUIDEWORD DEVIATION /ERROR E. ONLY PART OF TARGET SELECTION DONE E Target selection for B - Instruction & click (EXC) Forget to make link (part of) E.2 E.3 E Target selection for B Readback (PNF) 4.3 Target selection for B Input code (PNF) Target selection for B Input code (PNF); visualization & positioning (PF) cross-checking (PNF) No readback from pilot (none) Code not input (not done) Code not input; visualization & positioning not done; cross-checking not done (not done) CAUSES CONSEQUENCES RISK RANKING - Distraction - Overload - HMI difficulties - e.g. distraction (between step 3 and 4) - Confusion of a/c status - Requirement for another call - Wasting time Sev 4 Freq - 5 Sev 4 Freq - 5 RECOVERY / SAFEGUARDS - Cross check by PLC - Report by pilot (step 5.1) - Call pilot a second time - Workload - PF will notice - Blue code on pilot HMI reinforces that task is not complete - workload (esp in small TMA) Sev 4 Freq call again - Step 4 not initiated - 3 people in the cockpit (listening) RECOMMENDATIONS - Relief controller (distraction) - Datalink, ADD/ASAS - Address during pilot HAZOP - CRM emphasis on discipline on finishing task (about interruptions) - The blue line denotes temporary (in Airbus) alternate flight plan/goaround - Yellow normally denotes temporary (new FMS - that will be flown) - Consistent HMI coding i.e. Cospace coding must be consistent with airline and airframe manufacturers practices - The Cospace philosophy must deemphasise the linking - the line that is joining instructed & target a/c is it confusing? Line helps pilot identify clock position; discuss more e.g. remove target symbol? - At what stage does put HMI link? Dashed line (see HAZOP) DRAFT Cospace Pilot HAZOP Report, May,

29 E Target selection for B input code (PNF) Pilot gives readback, code not input (part of) - TBD - Wasting time - New call - Start procedure again Sev 4 Freq - TBD - O detects that pilot does not give target identification - Consider in pilot HAZOP E Target selection for B - Visualisation and positioning to PNF (PF) Visualisation and positioning to PNF not done (not done) - Cross-check failure - Too busy - Confusing / Inconsistent colour coding - Interruption - Fail to detect PNF error Sev 4/5 Freq 3/4 - will ask again - PNF will ask for the positioning information (cross check) - (4.4,4.5) Having a cluttering blue line on the display you know that a task needs to be finished when the task is finished the blue line should disappear (it will turn white when spacing is achieved) - In some avionics suppliers blue does not indicate an alert/ the need for an action, yellow does for example] the lines need to be consistent with the manufacturer s colour-coding philosophy - Airbus yellow is used for direct-to (temporary flight plan) - (4.4, 4.5,5) Best practices for CRM E Target selection for B - Visualisation and positioning to PNF (PF) PF visualises wrong a/c (other than) - [time wasted; - confusion] n/a - Current HMI design (blue line) prevents this E.8 E Target selection for B - Visualisation and positioning to PNF (PF) 4.5 Target selection for B - Cross-check of positioning (PNF) PF gives part of information (part of) No crosscheck (none) - [time wasted; - confusion] - PNF will ask for further information - Barrier failure n/a - Airline emphasise discipline of cross-checking - Emphasise discipline in CRM - Emphasise in CRM DRAFT Cospace Pilot HAZOP Report, May,

30 E Target selection for B - Cross-check of positioning (PNF) Different information on 2 MCDUs (other than) - 2 MCDUs are working separately - Pilots can be on a different page from each other - Pilots can see what the other pilot has input on the other MCDU although not necessarily as they may be on a different page - Is a double check required? Both PF and PNF accept the check - Determine conditions and frequency of this cause DRAFT Cospace Pilot HAZOP Report, May,

31 Error # TASK GUIDEWORD DEVIATION /ERROR F. WRONG AIRCRAFT IDENTIFIED F.1 F Target identification Target positioning to (PNF) 5.1 Target identification Target positioning to (PNF) Wrong aircraft identified with positioning corresponding to this (wrong) aircraft Wrong aircraft identified but positioning corresponding to correct aircraft (the one expected by ) TBD TBD CAUSES CONSEQUENCES RISK RANKING - Fail to detect that the wrong aircraft has been identified - Potential airprox - Fail to detect that the wrong aircraft has been identified - Inconsistent pictures between ground and air side - Potential airprox Sev 3 Freq 3 Sev 3 Freq 3 RECOVERY / SAFEGUARDS - SSR code - Detection: clock position and distance; - Monitoring merge (later) by EXC - ensures clock position is correct - SSR code - Monitoring merge by EXC RECOMMENDATIONS - Explore methods of detecting wrong aircraft selected: difficult to detect distance (e.g. a/c type) - Use of ADD/ASAS (downlink of target selected) will solve the problem of target position - Ensure it is not possible to select an aircraft twice as a target (technically within ADS-B messages) - Note: clock position is not very precise (e.g. confusion between 3 & 9 o clock). - Display bearing & range on HMI (can have range & bearings displayed on orange line) and pilot will give bearing & distance not clock information [Note: latency of CWP update may not correspond with the precision of the pilot s range & bearing] CWP update rate should correspond with the a/c - Address in pilot HAZOP - ADD/ASAS F Target identification Target positioning Wrong aircraft reported to - Error when inputting code - Give heading & merge instruction regarding wrong Sev 3 Freq 3 - should detect error (in some situations - Look at sub-cases in-depth - Use precise bearing information DRAFT Cospace Pilot HAZOP Report, May,

32 Error # TASK GUIDEWORD DEVIATION /ERROR CAUSES CONSEQUENCES RISK RANKING to (PNF) - target - General comment: Loss of trust in system (a/c and ) - Inconsistent pictures between ground and air side - Potential airprox RECOVERY / SAFEGUARDS it will be difficult for to detect wrong target identified depending on clock position) - Aircraft separated by 1000ft on sequencing legs [CoSpace comment: This only applies to aircraft on different sequencing leg] RECOMMENDATIONS instead of clock position - Use of ADD/ASAS (downlink of target selected) - Use of datalink (SSR code uplinked) along with code transfer from DCDU (Datalink control display unit) to MDCU - Limitations of safeguard: Strong cross-wind (clock position could be 2 clock positions different) - Limitation of safeguard: Aircrew and sometimes have different clocks DRAFT Cospace Pilot HAZOP Report, May,

33 Error # TASK GUIDEWORD DEVIATION /ERROR G. ONLY PART OF IDENTIFICATION DONE G Target identification Target positioning to (PNF) No report from pilot (none) G.2 G.3 G.4 G Target identification for B - Target positioning to 5.1 Target identification Target positioning to 5.2 Target identification for B Target confirmation (EXC) 5.3 Target identification for B - target validation (PNF) Report to late or not done (not done / late) Pilots report without target code or clock position, or distance (part of) No target confirmation No target validation CAUSES CONSEQUENCES RISK RANKING - TBD - Wasting time - 2 nd call - Crew busy - Frequency busy - Delay the spacing instruction by - Increase in O & aircrew workload - Wasting time - TBD - 2 nd call - wasting time - Busy in cockpit - Interruptions - this could potentially turn into a short-cut temptation - Workload - Remain in temporary state - may assume target is acquired ( not able to detect) - Could go on and give ASAS instruction? Sev 4 Freq - TBD Sev - 4 Freq - 3 Sev 4 Freq - TBD Sev 4 Freq 4 (for short haul more likely) RECOVERY / SAFEGUARDS - Monitoring by EXE - PF can tell PNF to make a call - will contact the a/c - Monitoring by EXE - Aircrew will request confirmation again - Step 6.3 & 7.3 input ASAS instruction - Pilot will notice the mistake shortly after as will give them an instruction heading & merge ; may give 6.1 instruction to RECOMMENDATIONS - ADD/ASAS - Discipline of following logical process - Managing two actions at the same time - ADD/ASAS - could a/c go onto 5.3 without Confirmation? - ADD - to know that target has been validated DRAFT Cospace Pilot HAZOP Report, May,