|
|
|
|
Safety Metric |
|
|
|
Measuring safety in real-time simulations has always been a difficult task, with safety usually being restricted to qualitative statements from the participants.
The fundamental problem is that safety is measured in terms of events (accidents) that we do not want to happen and such events will be very rare in a safe system. Therefore there is a need for surrogate metrics for safety. INTEGRA has developed two such measures Propensity and Resilience.
Through these measures INTEGRA aims to answer the question “is the concept being simulated by system A more or less safe than the concept being simulated by system B”.
|
|
|
|
| Propensity addresses the question: |
|
|
|
‘For a pair of aircraft represented in a simulation at a specific time, is the likelihood of a safety significant event developing greater or less than that for a pair of aircraft in different circumstances?’ |
'Safety significant event' applies to a physical situation involving an aircraft. It includes accidents and incidents. It does not include potential causes of such events, for example pilot error. In day-to-day air traffic control operations the level of Propensity will vary depending on the given traffic situation. For example, two aircraft heading towards each other with appropriate vertical separation will have a higher Propensity value that two similarly separated aircraft on crossing tracks.
There are two reason for this focus for Propensity:
- Safety significant events are the same whatever the ATM system. Differences in the system (e.g. the introduction of new tools) may affect the likelihood of safety significant events occurring but do not affect the types of events.
- Many potential causes never result in safety significant events because they are resolved by the controller. While the events and processes involved in this mitigation are important for maintaining safety levels, safety levels are determined by the safety significant events that come from the unmitigated sequences – what should happen if no active control took place?
|
|
|
The Propensity Metric is a relative measure of Propensity. That is, it addresses the relative likelihood of a safety significant event occurring for aircraft in different (simulated) situations. The Propensity Metric does not attempt to determine an absolute level of safety (or risk).
|
|
|
Resilience addresses the question:
|
|
|
‘To what extent does an unplanned perturbation to an aircraft’s trajectory affect other aircraft?’ |
The underlying concept behind this definition is that a safety significant event (as defined for Propensity) causes immediate unplanned changes in the trajectories of one or more aircraft. These can result in knock-on changes to other aircraft and so on. Such changes tend to reduce safety margins because decisions and actions are taken on a short timescale and safety may need to be managed in real time rather than evaluated and planned in advance. The greater the extent of the knock-on changes across time and airspace, the greater the reduction in potential safety margins.
Resilience is defined such that it is greatest when knock-on changes are least and least when knock-on changes are greatest. Thus, higher Resilience corresponds to greater safety and vice versa.
The Resilience Metric is a relative measure of Resilience. Thus, it addresses the relative extent of the knock-on effects resulting from the occurrence of a safety significant event. Thus, the Resilience Metric does not attempt to determine an absolute level of safety (or risk).
|
|
|
The INTEGRA Safety Metric is documented in the following:
| Detailed Specification of Safety Metric Inputs - Processing - Outputs: main body
|
|
|
|
| Detailed Specification of Safety Metric Inputs - Processing - Outputs: Annexes
|
|
|
|
| Detailed Specification of Safety Metric Analysis Software
|
|
|
|
|
|
| Validation of Safety Metrics - Analysis
|
|
|
|
|
|
|
| |
|
 |
|
Last validation: 15/03/2007
|
|
|
|
|
|
|
