Upload
vuongthien
View
226
Download
2
Embed Size (px)
Citation preview
The CREDOS Project
“Wake Vortex Safety Management System
Recommendations”
Abstract: The objective of this task is to provide recommendations for a Wake Vortex Safety Management System (WV SMS) for Air Navigation Service Providers with respect to safety policy; safety achievement; safety assurance; and safety promotion. The Wake Vortex Safety Management System recommendations will be established using ESARR3 guidance material for the use of safety management systems for ATM service providers. This study includes the specification of details for wake vortex safety data collection, data processing and statistical treatment of data to be processed and used as part of the management system. Such data can be used for wake vortex reporting systems, safety occurrence investigation, safety monitoring.
Contract Number: AST5-CT-2006-030837 Proposal Numbe r: 30837
Project Acronym: CREDOS
Project Co-ordinator: EUROCONTROL
Document Title: Wake Vortex Safety Management recom mendations Deliverable D4-9
Delivery Date: T21
Responsible: NLR
Nature of Deliverable: Report (R) Dissemination level: Public (PU)
File Id N°: CREDOS_420_NLR_DLV_D4-9_WVSMS.doc
Status: Approved Version: 1.0 Date: 18-06-2008
Approval Status
Document Manager Verification Authority Project App roval
NLR NLR PMC
Lennaert Speijker Lennaert Speijker PMC members
WP4 Leader WP4 Leader
- 3 -
Acronyms
A/C Aircraft
ACTUAL Actual Aerodrome Weather Report
ADREP Accident/Incident Data Reporting System
AIC Aeronautical Information Circular
AIRMET Airmen's Meteorological Information
AN Air Navigation
ANSP Air Navigation Service Provider
ASR Air Safety Report
ATC Air Traffic Control
ATCO Air Traffic Controller
ATFM Air Traffic Flow Management
ATM Air Traffic Management
ATS Air Traffic System
ASM AirSpace Management
CAA Civil Aviation Authority
CREDOS Crosswind Reduced separations for Departure Operations
EATMP European Air Traffic Management Programme
ESARR Eurocontrol Safety Regulatory Requirements
ECAC European Civil Aviation Conference
ECCAIRS European coordination centre for aviation incident reporting systems
EDR Eddy Dissipation Rate
ETWIRL European Turbulent Wake Incidence Reporting Log
EU European Union
EUROCONTROL European Organisation for the safety of air navigation
FAA Federal Aviation Administration
FANOMOS Flight track and NOise Registration Monitoring System
FDA Flight Data Analysis
FDR Flight Data Recorder
FDM Flight Data Management
FHA Functional Hazard Assessment
FOQA Flight Operations Quality Assurance
FSF Flight Safety Foundation
FTRS Flight track Registration System
IAS Indicated Air Speed
ACRONYM DEFINITION
- 4 -
IATA International Airlines Transport Association
ICAO International Civil Aviation Organization
IFALPA International Federation of Air Line Pilots' Association
IMC Instrument Meteorological Conditions
JAA Joint Aviation Authorities
JAR Joint Aviation Requirements
JRC Joint Research Centre
LLFC Low Level ForeCast
LOSA Line Operations Safety Audit
METAR Meteorological Terminal Aerodrome Report
METSEL Meteorological Self Briefing
NARSIM NLR Air Traffic Control Research Simulators
NATS National Air Traffic Services
NLR Nationaal Lucht- en Ruimtevaartlaboratorium
NM Nautical Mile
NOSS Normal Operations Safety Survey
PSSA Preliminary System Safety Assessment
QAR Quick Access Recorder
QNH Atmospheric Pressure (Q) at Nautical Height
SARP Standards and Recommended Practices
SID Standard Instrument Departure
SIDD Safety Investigation and Data Department
SIGMET Significant Meteorological Information
SMS Safety Management System
SRG Safety Regulation Group
SSA System Safety Assessment
SSR Secondary Surveillance Radar
SWC Significant Weather Chart
TAF Terminal Aerodrome Forecast
UK United Kingdom
UTC Universal Time Coordinated
VOLMET Meteorological Information for aircraft in flight
VMC Visual Meteorological Conditions
WAVENDA WAke Vortex ENcounter Detection Algorithm
WINDGRAD WIND GRADients
WP Work Package
WV Wake Vortex
WVE Wake Vortex Encounter
- 5 -
Executive summary
With the increase in air traffic, airports are under continuous pressure to increase
aircraft handling capacity. The CREDOS project aims to develop and validate a new
operation for ATC that would allow variable aircraft wake vortex separation times, as
opposed to the fixed times presently applied at airports. This study specifies Wake
Vortex Safety Management System (WV SMS) recommendations for use by ATM
service providers. These recommendations are established using ESARR3 guidance
material for use of safety management systems for ATM service providers.
Five wake vortex safety policy statements are proposed. Among other aspects, these
include the requirement to use ground based wind prediction system when aircraft
separation minima are to be reduced in the airport environment. Data on actual aircraft
separation shall then be gathered using a flight track registration system and analysed
continuously. Deviations from the prescribed wake vortex separation minima shall be
reported to the national ATM safety regulatory body (and ICAO and EUROCONTROL).
Wake vortex safety achievement is addressed by analyzing competency, safety
occurrences, quantitative safety levels, system safety assessment and documentation.
In this context, one should be aware that a wake vortex reporting scheme (with forms
and a procedure for handling incidents and accidents) has recently been set up by
ICAO. Quantitative wake vortex safety levels for single runway arrivals have been
derived in 2002 by NATS as part of the S-Wake study using UK London Heathrow
data. The EUROCONTROL Safety Assessment Methodology (SAM) is available for
producing a Functional Hazard Assessment (FHA) and Preliminary System Safety
Assessment (PSSA) of proposed ATM operations for reduced wake vortex separation.
Wake vortex safety assurance is addressed by analyzing safety surveys, safety
monitoring, safety records and risk management processes. Guidance for the design
and set up of an ANSP wake vortex safety survey are given. Details are provided for
data collection, data processing and statistical treatment of data to be processed and
used as part of a WV SMS. For wake vortex safety monitoring, ANSPs may collect and
analyze: flight identification data, actual aircraft separation data, meteorological data,
wake vortex encounter engineering data, wake vortex evolution data, traffic statistics
data, operational practices and procedural data, aircraft configuration data, wake
turbulence report forms, as well as data from hazard / risk identification brainstorms.
- 6 -
Wake vortex safety promotion is addressed via lesson dissemination and safety
improvement. Exchange of wake vortex safety information to the ANSP management,
operations and maintenance can be achieved through publication of wake vortex safety
articles as part of safety bulletins, safety alerts and safety performance reports.
It can be assumed that all ATM service providers have already implemented an
operational SMS and Normal Operations Safety Surveys (NOSS) are being carried out.
It is now recommended to add the Wake Vortex component to such NOSS. With
respect to regular wake vortex encounter reporting, ANSPs are recommended to
adhere to the wake vortex encounter reporting scheme recently implemented by ICAO
(except where a national scheme already exists that satisfies this recommendation).
In case a new ATM operation with reduced aircraft separation (preferably supported by
new wake vortex advisory systems) has actually been approved, a gradual transition
phase from the current operation towards the new operation is proposed. During such
transition phase, ANSPs are recommended to:
o Perform quarterly wake vortex safety surveys to assess wake vortex safety of
normal operations, using (wake vortex safety related) data available from air traffic
controller logs, ANSP wake vortex safety survey checklists and questionnaires,
ANSP wake encounter reporting forms, and flight track registration system data.
o Perform a yearly analysis of wake vortex safety. In addition to the ANSP internal
data sources, this could require data from ICAO ADREP, JRC ECCAIRS, the NLR
ASR database, pilot wake encounter reporting forms, Quick Access Recorder
(QAR) data, meteorological data sources, and possibly WAVENDA analysis.
After the introduction of reduced aircraft separation (at least until it can be concluded
that the actual implementation has actually been safe for a couple of years), the
following wake vortex safety information will need to be provided on a regular basis:
o Wake vortex safety survey results as part of quarterly safety bulletins;
o Wake vortex safety alerts to the air traffic controllers in case of safety findings
and/or safety recommendations resulting from the wake vortex safety surveys;
o Wake vortex safety performance results as part of a yearly performance report.
Guidance for the design and set up of an ANSP wake vortex safety survey (including
e.g. checklists, questionnaires) is given. It is noted that the still ongoing safety research
in the CREDOS project may result in new wake vortex safety findings. It is therefore
recommended to define the detailed content of the safety surveys checklists and
questionnaires on the basis of results from the CREDOS FHA, PSSA and Safety Case.
- 7 -
Table of Contents
Acronyms 3
Executive summary 5
1 Introduction 11 1.1 Background 11 1.2 Objectives 12 1.3 Approach and methodology 12 1.4 Document structure 12
2 Safety management system framework 13 2.1 Introduction 13 2.2 ESARR 3 16
3 Wake vortex safety management 18 3.1 Wake vortex safety policy 18 3.2 Wake vortex safety achievement 19 3.3 Wake vortex safety assurance 21 3.4 Wake vortex safety promotion 22 3.5 Implementation of a WV SMS by ANSPs 23
4 Wake vortex safety data collection 24 4.1 Introduction 24 4.2 Flight identification data 24 4.3 Aircraft separation data 24 4.4 Meteorological data 25 4.5 Wake vortex evolution data 26 4.6 Wake vortex encounter engineering data 26 4.7 Operational practices and procedural data 27 4.8 Aircraft configuration data 27 4.9 Wake turbulence report form data 28
5 Wake vortex safety data analysis 29 5.1 Introduction 29 5.2 Quarterly wake vortex safety surveys 29
- 8 -
5.3 Yearly analysis of wake vortex safety 31 5.4 Wake vortex safety publications 35
6 Conclusions and recommendations 36 6.1 Conclusions 36 6.2 Recommendations 37
7 References 39
Appendix A ICAO wake encounter reporting forms 41
Appendix B UK wake encounter reporting forms 46
Appendix C ATC-Wake risk requirements 50
- 9 -
List of Figures
Figure 1 Safety management process [26] ................................................................. 14 Figure 2 Generic safety management framework [27]................................................. 16 Figure 3 ESARR 3 safety management framework [2]................................................ 17 Figure 4 Example minimum longitudinal spacing versus ICAO WV radar separation
minima........................................................................................................................ 31 Figure 5 Relative wake encounter rates versus separation minima deviation (based on
voluntary wake encounter report analysis performed by NATS).................................. 32 Figure 6 Crosswind Distribution for Voluntary Reported Encounters compared with the
London-Heathrow crosswind climatology (analysis performed by NATS).................... 33 Figure 7 Statistical analysis of ETWIRL data-base (120 samples) [33] with flight data
recordings of wake vortex encounters ........................................................................ 33 Figure 8 Statistical analysis of the altitude at which wake encounters occur ............... 34 Figure 9 Statistical analysis of maximum attained roll angle (from NATS)................... 34
- 10 -
List of Tables
Table 1 Flight identification parameters ...................................................................... 24 Table 2 Aircraft separation parameters....................................................................... 24 Table 3 Meteorological parameters............................................................................. 25 Table 4 Wake vortex evolution parameters................................................................. 26 Table 5 Wake encounter parameters.......................................................................... 26 Table 6 Operational practices and procedural parameters.......................................... 27 Table 7 Aircraft configuration parameters ................................................................... 27 Table 8 Wake turbulence report parameters............................................................... 28 Table 9 Example departure information (from runway log or FTRS extrapolation) ...... 30 Table 10 Example wake vortex safety performance indicators.................................... 30 Table C-11 Risk requirements (per queued aircraft movement) .................................. 51 Table C-12 ESARR 4 severity classification scheme in ATM ...................................... 51 Table C-13 Frequency categories used in the ATC-Wake study ................................. 53
- 11 -
1111 Introduction
1.1 Background
With the steady increase in air traffic, airports are under continuous pressure to
increase aircraft handling capacity. One potential approach is to reduce the wake
vortex separation times between aircraft at take-off without compromising safety. The
CREDOS project aims to develop and validate a new operation for Air Traffic Control
(ATC) that would allow variable aircraft wake vortex separation times, as opposed to
the fixed times presently applied at airports. The present separation of two to three
minutes between departing aircraft is designed to counter problems aircraft may
encounter in the wake of large aircraft. For airports with CREDOS in use, the aim is to
reduce the time separation between aircraft departing at single runways to about 60 -
100 seconds for all aircraft types in the presence of sufficient crosswind.
It is noted that, generally, the approval process for such newly proposed ATM
operation (with supporting systems and procedures) for reduced aircraft separation
requires the availability of safety documentation, including e.g. predictive (system)
safety studies and a safety case. A number of steps are required (and also executed
within CREDOS). Following development of an operational concept, it has e.g. to be
shown that the proposed system or procedure is predicted to be safe for operational
use. The international regulatory framework is provided by EUROCONTROL [32] and
ICAO [29, 30, 31]. It has to be noted that the national authorities will have to approve
the introduction in a certain country based on applicable international standards and
practices and acceptable means of compliance. In general, predictive safety studies
shall be based on a risk management process, that includes e.g. the identification of
risks, the assessment of the likelihood of (risk) events, the (definition of) criteria for
assessing acceptability of identified risks, and the policy for risk mitigation. This can
e.g. be done by an absolute and/or a relative approach, respectively showing that wake
vortex induced risk event probability:
1. does not exceed some pre-defined, and agreed upon, Target Level of Safety;
2. does not increase with the introduction of the new CREDOS operation.
In addition to the above described process (which is described in detail in CREDOS
deliverables D4-4, D4-6, D4-7, and D4-12), this study will focus on the specification of
a Wake Vortex Safety Management System (WV SMS) for use by ATM service
providers that fall within the jurisdiction of the national ATM safety regulatory body.
- 12 -
1.2 Objectives
The objective of this task is to provide recommendations for a Wake Vortex Safety
Management System (WV SMS) for Air Navigation Service Providers with respect to:
o Wake vortex safety policy;
o Wake vortex safety achievement;
o Wake vortex safety assurance;
o Wake vortex safety promotion.
1.3 Approach and methodology
The Wake Vortex Safety Management System will be established using ESARR3
guidance material for the use of safety management systems for ATM service
providers. As such, it will deal with safety policy, safety achievement, safety assurance
and safety promotion. This study will include the specification of details for wake vortex
safety data collection, data processing and statistical treatment of data to be processed
and used as part of the management system. Such data can be used for wake vortex
reporting systems, safety occurrence investigation and safety monitoring.
1.4 Document structure
The structure of the document is as follows:
o Section 2 describes a generic safety management framework;
o Section 3 provides guidelines for the set up of a safety management system;
o Section 4 contains an overview of different wake vortex safety data sources;
o Section 5 gives guidance for usage and treatment of collected wake vortex data;
o Section 6 contains the conclusions and recommendations;
o Section 7 provides the list of references;
The appendices contain ICAO and UK wake encounter reporting forms, as well as
wake vortex risk requirements used in the European Commission ATC-Wake project.
- 13 -
2222 Safety management system framework
2.1 Introduction
In recent years, Safety Management Systems (SMS) have become widely used in
aviation. After introduction in other domains, it is now also promoted by ICAO, FAA,
IATA, FSF and national authorities to support/manage safety improvements. ICAO
defines a SMS as "an organized approach to managing safety, including the necessary
organizational structures, accountabilities, policies and procedures" [26]. ICAO's
SARPs require, among other aspects, that States establish a safety programme, with
provisions for activities as incident reporting, safety investigations, safety audits and
safety promotion. ICAO states that implementing such activities in an integrated way
requires a coherent Safety Management System for individual operators, maintenance
organizations, ATM service providers, and certified aerodrome operators. As a
minimum, such SMS shall:
o identify safety hazards;
o ensure that remedial actions necessary to mitigate the risks/hazards are
implemented; and
o provide for continuous monitoring and regular assessment of the safety level
achieved.
ICAO provides a conceptual framework for establishment of a SMS, which is build on 3
cornerstones for managing safety in an explicit, proactive, systematic manner:
o a comprehensive corporate approach to safety;
o effective organizational tools to deliver safety standards;
o a formal system for safety oversight.
A conceptual overview of the continuous safety management loop process is sketched
in Figure 1, where it is assumed that this process is evidence based and requires
analysis of data to identify hazards. Risk assessment techniques are used to prioritize
and reduced potential consequences of the hazards [26].
Establishing a safety management system
ICAO provides ten steps for integrating the various elements into a coherent Safety
Management System. ICAO highlights that not all steps need to be implemented
- 14 -
simultaneously. ICAO provides confirmation checklists for each of the ten steps to
monitor the implementation progress. The SMS implementation steps are [26]:
o Step 1 Planning
o Step 2 Senior's commitment to safety
o Step 3 Organization
o Step 4 Hazard identification
o Step 5 Risk management
o Step 6 Investigation capability
o Step 7 Safety analysis capability
o Step 8 Safety promotion and training
o Step 9 Safety management documentation and information management
o Step 10 Safety oversight and safety performance monitoring
Figure 1 Safety management process [26]
Operating a safety management system
ICAO maintains an Incident/Accident Data Reporting (ADREP) system based on the
European Co-ordination Centre for Aviation Incident Reporting Systems (ECCAIRS)
software, for use by the States. ICAO provides a number of practical considerations for
operating a safety management system.
- 15 -
Some of them are listed below [26]:
o Safety office (functions);
o Safety manager;
o Safety committees;
o Safety management training;
o Conducting a safety survey;
o Disseminating safety information;
o Written communication;
o Safety promotion;
o Management of safety information (databases);
o Safety management manual.
Safety management systems for different operators
The ICAO Safety Management Manual provides recommendations for establishment of
a safety management system applicable to
o Aircraft operators;
o Air Traffic Services;
o Aerodrome operators; and
o Aircraft maintenance.
Aircraft operators deal with hazard and incident reporting, Flight Data Analysis (FDA)
or Flight Operations Quality Assurance (FOQA) programme, Line Operations Safety
Audit (LOSA) programme and a safety cabin programme. Air Navigation service
providers deal with safety performance indicators and safety targets, risk assessment
and management, safety organization, incident reporting systems, safety oversight,
emergency response safety investigation, managing changing procedures, threat and
error management, and Normal Operations Safety Surveys (NOSS). Operators can
only provide the means for controlling those hazards that originate within the scope/
boundaries of their system. In this context, it should be noted that aircraft operators
and air traffic service providers are most relevant for development of a WV SMS.
It should be noted that slightly different notions of safety management systems are
used throughout the aviation industry. A generic safety management framework may
e.g. also be described as consisting of the following basic elements [27, see Figure 2]:
o Establishment of safety policy and safety objectives;
o Hazard/threat identification and risk inventory;
o Accidents, incidents, and safety performance indicators;
o Risk assessment;
- 16 -
o Safety monitoring;
o Decision making;
o Safety directives, actions and measures;
o Safety recommendations.
Figure 2 Generic safety management framework [27]
2.2 ESARR 3
The EUROCONTROL Safety Regulatory Requirement (ESARR) 3 concerns the
required use of Safety Management Systems (SMS) by ATM service providers [1]. It
defines safety management as "that function of service provision, which ensures that
all safety risks have been identified, assessed and satisfactorily mitigated". The
ESARR 3 specifies scope, rationale, applicability, safety requirements, safety objective,
implementation, exemptions and additional material in relation to the use of SMS.
ESARR 3 describes four elements: safety policy, safety achievement, safety
assurance, and safety promotion. Figure 3 provides an overview of the main elements
of ESARR 3.Safety requirements for each of three main European Air Traffic
Management Programme (EATMP) safety principles are highlighted in green (safety
achievement), purple (safety assurance), and blue (safety promotion) respectively.
Note that the scope of this study is limited to the development and specification of a
WV SMS for ANSPs only, as CREDOS deals with a newly proposed ATM operation.
- 17 -
Figure 3 ESARR 3 safety management framework [2]
The applicability of ESARR3 to wake vortex induced incident/accident risk will be dealt
with in the following. Recommendations for each of the four main elements (safety
policy, safety achievement, safety assurance, safety promotion) will be given.
- 18 -
3333 Wake vortex safety management
3.1 Wake vortex safety policy
The EATMP safety policy [see Figure 3] states that:
o Safety must be managed in an explicit, proactive manner;
o Everyone has an individual responsibility for his/her own actions;
o Managers are responsible for the safety performance of their own organisations;
o Safety should be afforded the highest priority over commercial, operational,
environmental or social pressure.
o The principle safety objective is to minimise the ANSPs contribution to the risk of an
aircraft accident as far as practicable.
IFALPA [6] and FAA [7] state that safety shall always be the primary consideration if
wake turbulence separation is planned to be reduced in order to increase aerodrome
capacity and no planned penetration of wake vortices of any intensity is permitted. On
the other hand, one may note that in the United Kingdom it was recognized that "the
spacing minima cannot entirely remove the possibility of a wake turbulence encounter"
and "the objectives of the minima are to reduce the probability of a vortex wake
encounter to an acceptably low level, and to minimise the magnitude of the upset when
an encounter occurs" [34] (i.e. although of course it is never planned that an aircraft will
fly through a vortex, there is a probability that it may do so with current separations).
Reduction of the aircraft separation without taking wake vortex safety improvement
actions and measures is difficult to motivate. A conditional reduction of the wake
turbulence separation minima is being investigated in CREDOS [1] as possibility to
reduce the delays while maintaining safety. In this respect, the following wake vortex
safety policy statements are proposed for use by Air Navigation Service Providers:
1. Reduction of the aircraft separation minima in the airport environment shall be
based on ground based wind prediction systems which are capable of issuing wake
vortex advisory and warning information to each of the human actors involved in
the ATM operation under consideration. Such systems shall use the concept of
wake avoidance, i.e. be based on wake transport forecast and wind now-cast
information for planning/alerting purposes. These predictive systems shall predict
the prevalence of circumstances under which reduced separation can take place.
2. Where possible, ground based wind prediction systems for wake avoidance shall
be supplemented by ground based wake vortex detection systems. Use of airborne
- 19 -
wake vortex detection, warning and avoidance systems by airlines is recommended
as airborne safety net in support of ATC decided reduced aircraft separation only.
3. In case reduced aircraft separation is being applied, data on actual aircraft
separation (longitudinal, vertical and horizontal) shall be gathered and analysed
continuously. Any deviations from prescribed (reduced) separation minima shall be
reported to the national ATM safety regulatory body, who may subsequently report
this to ICAO and EUROCONTROL (especially in case of major infringements).
4. Data on wake vortex induced incidents/accidents (i.e. wake vortex safety
occurrences) shall be gathered and shall comprise an air traffic controller reporting
part and a pilot reporting part (see the examples in Appendices B and C). Where
possible, analysis of wake vortex encounters reports shall include a statement of
the severity of the encounter and the associated causal factors.
5. As part of the annual safety report to the national ATM safety regulatory body (and
possibly EUROCONTROL), specific attention (safety analysis) shall be given to
wake vortex incidents and accidents. Where possible, such reporting shall be done
according to internationally harmonised standards/rules.
3.2 Wake vortex safety achievement
With respect to safety achievement, ESARR3 deals amongst others with Competency,
Safety Occurrences, Quantitative Safety Levels, and System Safety Assessment and
Documentation. The applicability of each to CREDOS is discussed in the following.
o Competency. The air traffic controllers and pilots should be trained, motivated and
competent (possibly licensed) before the CREDOS system and operation is being
introduced. Note that this requirement is embedded in the scope of the EATMP
Human Factors and Training reference documentation. As such, it will need to be
dealt with during the production of the following CREDOS deliverables:
o Human Machine Interface Design [18];
o Human Factors Case [20].
These should include an assessment of the training requirements applicable to
wake vortex training (initial and recurrent training and examinator qualifications).
o Safety Occurrences. Wake vortex safety occurrences should be investigated and
necessary action taken. According to ESARR 3, this would need to include:
- 20 -
o Wake vortex reporting system(s);
o Wake vortex occurrence investigation;
o Wake vortex safety recommendations;
o Reporting to regulators and the Safety Regulator Commission (SRC);
o Exchange of wake vortex safety data (between units, with Eurocontrol).
Appendix A provides example wake turbulence encounter reporting forms as
recommended by ICAO, following State Letter AN 13/4-07/67 [12]. Appendix B
provides example wake turbulence encounter report forms as used in the United
Kingdom [9, 10] from November 2007 onwards. It is to be used by Air Traffic
Controllers (SRG 1422) and pilots (SRG 1423) respectively, when filing a report on
wake turbulence encounters in accordance with EU Directive 2003/42 [11].
o Quantitative Safety Levels. Whenever practicable, quantitative wake vortex safety
levels should be derived and maintained. NATS has derived such quantitative wake
vortex safety levels as part of the S-Wake study using UK Heathrow data [22]. Over
the period 1995 until 1999, minor incidents occurred with a risk event probability of
5×10-4 and major incidents with a risk event probability of 1×10-5.
Definitions for the risk metrics are provided in Appendix C and Speijker et al. [8].
o System Safety Assessment and Documentation. The introduction of the CREDOS
operation is subject to the availability of Safety Analysis documentation. The
CREDOS project includes the production of the following deliverables
o Generic Functional Hazard Assessment (FHA) [23];
o Generic Preliminary System Safety Assessment (PSSA) [24].
Development and transfer to operations is not foreseen within the CREDOS time
frame. A System Safety Assessment (SSA) will need to be produced by an ANSP,
for submission to (and approval by) the national ATM safety regulatory body.
Note that ICAO commenced a wake vortex reporting scheme to collect wake vortex
encounter data [12]. Pilots and ANSPs or aircraft operators who are aware of such
occurrences should fill out the relevant reporting forms and submit them to the
authority of the country of occurrence. The national authorities, who have received
reports on wake turbulence encounter, are asked to subsequently send the reports to
ICAO using on-line reports via Internet (http://www.icao.int/fsix/wakevortex.cfm).
- 21 -
3.3 Wake vortex safety assurance
With respect to the principle of safety assurance, ESARR3 deals with Safety Survey,
Safety Monitoring, Safety Records, and Risk Management Process. The applicability of
each of these four factors to CREDOS is discussed in the following.
o Safety Surveys. Routine periodical surveys/audits should be carried out to collect
and analyse wake vortex safety data during normal operations. The purpose is to
supply the SMS with reliable and valid information on the occurrence of threats,
errors and undesired states and their management. This would include the
development of guidance material (or a software tool) for the monitoring of the
wake vortex safety when the CREDOS system is used. Periodical wake vortex
surveys will provide pro-active status reports to be used as diagnostic tool,
measuring e.g. the safe application of reduced aircraft separation. In general,
safety surveys/audits aim to show that a system has actually been safe.
o Safety Monitoring. Methods should be put in place to detect changes in systems or
operations which may require corrective actions to be taken. In the context of wake
vortex safety monitoring this could include the following parameters/data:
o Flight identification data;
o Actual aircraft separation data;
o Meteorological data;
o Wake vortex encounter engineering data;
o Wake vortex evolution data;
o Traffic statistics data;
o Operational practices and procedural data;
o Aircraft configuration data;
o Wake turbulence report form data;
o Information/evidence on the separation minima in use (reduced or not?).
Methods will need to be developed for the collection, processing and statistical
treatment of such data to be used as part of the WV safety management system.
o Safety Records. Maintenance of (wake vortex) safety records throughout the entire
life cycle of a system should provide evidence and argumentation demonstrating
that a system is safe for operational use. The Safety Case Development Manual
[25] describes how to develop a Safety Case so as to demonstrate the safety of a
new or modified system (it describes how to present safety assessment results).
The CREDOS Preliminary Safety Case [25, page 10] deals with the demonstration
- 22 -
of the safety of a new concept (substantial change to the current ATM system). In
general, such Preliminary Safety Case shows that a system is predicted to be safe.
Besides a validated set of Safety Requirements (from the PSSA), it should also
include guidance material for the implementation of these Safety Requirements as
well as recommendations for development of a full Safety Case (including SSA).
o Risk Management Process. The process should include e.g. the identification of
risks, the assessment of the likelihood of (risk) events, the (definition of) criteria for
assessing acceptability of identified risks, and the policy for risk mitigation. This can
e.g. be done by showing that wake vortex induced risk event probability:
o does not exceed some pre-defined, and agreed upon, safety requirement;
o does not increase with the introduction of the new CREDOS operation.
Appendix C provides the risk requirements as used in the ATC-Wake study [8].
3.4 Wake vortex safety promotion
With respect to the principle of safety promotion, ESARR3 deals with Lesson
Dissemination and Safety Improvement. The applicability of each to CREDOS is
discussed in the following.
o Lesson Dissemination. The lessons arising from safety occurrence investigations
as well as safety surveys, safety data exchange and other data sources should be
disseminated widely. The following CREDOS safety deliverables are public:
o Safe separation distances for departure [16];
o Risk modelling and risk assessment [17];
o Safety management system recommendations [19];
o Safety case [21].
Safety lesson dissemination is also widely addressed via the external interface of
CREDOS WP5, through which a communication plan, marketing plan, ATCO
information package and a pilot information package will be disseminated. A
demonstration and safety briefings of CREDOS are foreseen in relation to the
experiments on the NLR Air Traffic Control Research Simulators (NARSIM).
o Safety Improvement. Staff (e.g. pilots, air traffic controllers, researchers) should be
encouraged to propose solutions to identified hazards where they appear needed.
This could include voluntary reporting of potentially unsafe elements of the
CREDOS system at various stages of its development by the involved actors.
- 23 -
3.5 Implementation of a WV SMS by ANSPs
Sections 3.1 to 3.4 deal with the core elements of a wake vortex safety management
system for ATM service providers, i.e. safety policy, safety achievement, safety
assurance and safety promotion. A complete WV SMS would require the following:
1. The ATM service provider under consideration has already implemented an
operational SMS. Normal Operations Safety Surveys (NOSS) are being carried out
on a regular basis, the resulting data are fed into the SMS database, and the
Safety Manager is willing to add the Wake Vortex component to the NOSS.
2. The ATM service provider maintains a database with incidents and accidents. This
database is accessible for the air traffic controllers, who are willing to report on
wake vortex encounters and wake vortex separation infringements using dedicated
reporting forms (see Appendices B and C for some examples). Safety performance
indicators and targets are maintained and updated regularly.
3. Airlines are willing to provide Flight Data Analysis (FDA) or Flight Operations
Quality Assurance (FOQA) data on wake vortex encounters for safety research
investigation purposes and for inclusion into the ANSPs WV SMS database.
Relevant data from the LOSA programme is also made available, if necessary.
4. Supporting software and data(bases), such as ADREP, ECCAIRS, ASR, QAR,
FANOMOS, WAVENDA and other sources are all easily available to the ANSP.
One should be aware that some of these assumptions are more realistic than others.
As all the ANSPs in the ECAC region are formally required to implement the ESARRs,
it seems reasonable to assume that most ATM service providers are using an
operational SMS and are also maintaining a database with incident and accidents.
However, the willingness of airlines to make Flight Data Analysis (FDA) on wake vortex
encounters available is, at present, relatively low due to confidentiality issues. In
addition, it is noted that the use of supporting software and data(bases) may depend
on commercial arrangements with the owners. Nevertheless, as wake vortex safety
awareness within the aviation community increases, it would be reasonable to hope
that the above requirements for a complete WV SMS are satisfied in the near future.
This study therefore focuses further on the specification of details for wake vortex
safety data collection, data processing and statistical treatment of data to be processed
and used as part of a SMS. Such data can be used for wake vortex reporting systems,
wake vortex safety occurrence investigation and wake vortex safety monitoring. The
next section deals with potential categories of wake vortex safety data to be collected.
- 24 -
4444 Wake vortex safety data collection
4.1 Introduction
The following categories of wake vortex safety monitoring data are to be collected:
flight identification data, aircraft separation data, meteorological data, wake vortex
encounter engineering data, wake vortex evolution data, operational practices and
procedural data, aircraft configuration data, wake turbulence report form data (see
Section 3.3), and whether or not reduced separation (e.g. CREDOS) is being applied.
Data sources are dealt with in sub-sections 4.2 to 4.10. In case more than one data
source is available, the most likely source is used as basis. Section 5 describes the
usage of traffic statistics together with all collected data for the purpose of wake vortex
reporting, safety occurrence investigation and safety monitoring.
4.2 Flight identification data
Table 1 Flight identification parameters
Parameter Data source
Runway Runway log
Date (dd-mm-yyyy) Runway log (according to UTC)
Time (hour : minutes) of
departure (or arrival)
Runway log (according to UTC)
Flight number (callsign
and/or SSR code)
Runway log and/or Flight Track Registration System (FTRS)
Aircraft type Runway log and/or Flight Track Registration System (FTRS)
4.3 Aircraft separation data
Table 2 Aircraft separation parameters
Parameter Data source
Take off clearance leader aircraft (time) Runway controller log
Take off clearance follower aircraft (time) Runway controller log
Start of roll leader aircraft (time) Model and/or FTRS extrapolation
Start of roll follower aircraft (time) Model and/or FTRS extrapolation
Flight time (hour : minutes) Model and/or FTRS extrapolation
Lift off speed leader aircraft (kts) Model and/or FTRS extrapolation
Lift off speed follower aircraft (kts) Model and/or FTRS extrapolation
Acceleration thrust/drag leader aircraft (N) Pilot (flex/reduced thrust take off or not)
- 25 -
Acceleration thrust/drag follower A/C (N) Pilot (flex/reduced thrust take off or not)
Longitudinal separation (Nm) Flight track registration system (FTRS)
Vertical separation from leader aircraft (ft) Flight track registration system (FTRS)
Time separation from leader aircraft (s) Flight track registration system (FTRS)
Leader aircraft height (ft) Flight track registration system (FTRS)
Leader aircraft lift-off point (m) Model and/or FTRS extrapolation
Follower aircraft height (ft) Flight track registration system (FTRS)
Follower aircraft lift-off point (m) Model and/or FTRS extrapolation
Note that multi-lateration or surface movement radar data could also provide many of
the parameters listed in Table 2 (e.g. time of start of roll, take off, and also from what
point on the runway the aircraft actually rotated).
4.4 Meteorological data
Table 3 Meteorological parameters
Parameter Data source
Distance from threshold (m) Quick Access Recorder (QAR)
Air temperature (°C) Quick Access Recorder (QAR)
Air pressure (hPa) Quick Access Recorder (QAR)
Wind direction (°) Quick Access Recorder (QAR)
Wind speed (kts) Quick Access Recorder (QAR)
IMC or VMC UK wake encounter pilot report form
QNH UK wake encounter report forms
Wind shear reported or experienced UK wake encounter report forms
Air turbulence UK wake encounter pilot report form
Visibility Wake encounter report forms
Cloud Wake encounter report forms
Dew point Wake encounter report forms
Brunt-Väissällä frequency (N) Quick Access Recorder (QAR)
Turbulent Kinetic Energy (TKE) Model and/or Doppler radar or QAR data
Eddy Dissipation Rate (EDR) Model and/or Doppler radar or QAR data
Note that some of the parameters listed in Table 2 are also easily available from
Meteorological Terminal Aerodrome Reports (METARs) or the Automatic Terminal
Information Service (ATIS) for surface parameters (e.g. the QNH).
- 26 -
4.5 Wake vortex evolution data
Table 4 Wake vortex evolution parameters
Parameter Data source
Leader aircraft type Runway log and/or FTRS
Leader aircraft weight (kg) Quick Access Recorder (QAR)
Leader aircraft speed (kts) Quick Access Recorder (QAR)
Wind direction (°) Quick Access Recorder (QAR)
Wind speed (kts) Quick Access Recorder (QAR)
Air vertical motion Quick Access Recorder (QAR)
Note that some of these parameters could be made available through the use of down-
linked Mode-S (although wind speed and direction is not yet a mandatory parameter).
4.6 Wake vortex encounter engineering data
Table 5 Wake encounter parameters
Parameter Data source
Leader aircraft type Runway log and/or FTRS
Follower aircraft type Runway log and/or FTRS
Follower aircraft weight (kg) Quick Access Recorder (QAR)
Start time of encounter (date; time) Quick Access Recorder (QAR)
Height of encounter (ft) Quick Access Recorder (QAR)
Geographic location of encounter QAR and/or wake encounter report forms
Encounter duration (s) Quick Access Recorder (QAR)
Maximum attained roll angle (°) Quick Access Record er (QAR)
Maximum attained pitch angle (°) Quick Access Recor der (QAR)
Maximum attained yaw angle (°) Quick Access Recorde r (QAR)
Maximum loss of height (ft) Quick Access Recorder (QAR)
Induced load Quick Access Recorder (QAR)
Induced roll rate Quick Access Recorder (QAR)
Note that most of these parameters are obtained from Quick Access Recorder (QAR)
data. In this respect, one should note that the NLR Wake Vortex Encounter Data
Algorithm (WAVENDA), which is based on analysis of collected QAR data, provides
enhanced insight into aircraft upsets. WAVENDA helps to decide whether aircraft
upsets should be considered as caused by wake vortices (or not) [14, 35].
- 27 -
4.7 Operational practices and procedural data
Table 6 Operational practices and procedural parameters
Parameter Data source
Phase of flight ICAO wake encounter pilot report form
Turn indication, if applicable ICAO wake encounter pilot report form
Holding pattern, if applicable ICAO wake encounter pilot report form
Type of approach, if applicable UK wake encounter pilot report form
Position relative to glide path, if appl. ICAO wake encounter pilot report form
Position relative to centre line, if appl. ICAO wake encounter pilot report form
Cruise airway or route, if applicable UK wake encounter pilot report form
Lateral offset, if applicable UK wake encounter pilot report form
Control/recovery action taken, if appl. ICAO wake encounter pilot report form
Generating aircraft in sight, if appl. ICAO wake encounter pilot report form
Estimated relative separation (hor, vert) Wake encounter report forms
Reduced separation in operation CREDOS HMI data (derived from e.g. data
underlying the green/red interface (D4_5).
4.8 Aircraft configuration data
Table 7 Aircraft configuration parameters
Parameter Data source
Indicated Airspeed ICAO wake encounter pilot report form or
Mode-S data
Autopilot Wake encounter pilot report forms
Autothrottle UK wake encounter pilot report form
Gear UK wake encounter pilot report form
Flap UK wake encounter pilot report form
Slat UK wake encounter pilot report form
Spoiler UK wake encounter pilot report form
Note that most of the parameters listed in Table 7 could also be obtained from Quick
Access Recorder (QAR) data (or possibly from Mode-S data).
- 28 -
4.9 Wake turbulence report form data
Table 8 Wake turbulence report parameters
Parameter Data source
Roll angle (left/right or both) (°) Air Safety Repo rt (ASR) database
Yaw angle (left/right or both) (°) Air Safety Repor t (ASR) database
Pitch up/down Air Safety Report (ASR) database
Loss of altitude (ft) Air Safety Report (ASR) database
Increase/loss of speed (kts) Air Safety Report (ASR) database
Increased rate of descent Air Safety Report (ASR) database
Stall warning (stick shaker) Air Safety Report (ASR) database
Bank angle warning Air Safety Report (ASR) database
Compressor stall Air Safety Report (ASR) database
Engine shutdown Air Safety Report (ASR) database
Auto Pilot and Auto Throttle disengage Air Safety Report (ASR) database
Flight crew aileron input Air Safety Report (ASR) database
Flight crew rudder input Air Safety Report (ASR) database
Auto Pilot disengage – manual action Air Safety Report (ASR) database
Flight crew flying off-track action Air Safety Report (ASR) database
Buffeting ICAO wake encounter pilot report form
- 29 -
5555 Wake vortex safety data analysis
5.1 Introduction
Implementation of wake vortex safety management as part of the ANSP SMS is felt to
be a necessary prerequisite before reduced wake vortex separation can be authorised
by the national CAA and may be introduced. Further guidance with respect to wake
vortex data analysis as part of the ANSP SMS is provided in the following sections.
Section 5.2 contains guidance for ANSP internal wake vortex safety surveys. This is
given as first indication to assess whether or not the ANSP deals adequately with wake
vortex safety. In case, it is concluded that wake encounters have occurred, further
analysis by the ANSP (or even national air transportation safety board) will be needed.
This may require wake vortex data (analysis) from external data sources so as to avoid
further wake encounter accidents. Guidance for such analysis is provided in Section
5.3. Finally, Section 5.4 addresses potential regular wake vortex safety publications, to
be established using the results from the wake vortex safety data analysis activities.
5.2 Quarterly wake vortex safety surveys
It is recommended to perform quarterly wake vortex safety surveys. In any case
immediately starting after the introduction of reduced aircraft separation, but possibly
also before the introduction of reduced separation so that there is a baseline for
comparison. The following ANSP internal wake vortex data sources may be available
for analysis:
o Air traffic controller logs;
o ANSP wake vortex safety survey checklists and questionnaires;
o ANSP wake encounter reporting forms (see Appendices B and C);
o Flight track registration system data (e.g. from FANOMOS).
Tables 9 and 10 and Figure 4 provide some guidance for the design and set up of an
ANSP wake vortex safety survey. Additionally, it is recommended to design a checklist
and a questionnaire and to perform some statistical analysis on relevant causal factors
and on actual aircraft separation data collected with a flight track registration system.
The definition and content of the wake vortex safety survey checklist and questionnaire
should be based on the outcome of the CREDOS safety case (including the Functional
Hazard Assessment (FHA) and the Preliminary system Safety Assessment (PSSA).
- 30 -
Table 9 Example departure information (from runway log or FTRS extrapolation)
No. Causal factor
1 Time needed by pilots to go through a before take off checklist
2 Time between ATCo take off clearance and pilot take off decision
3 Time between pilot take off decision and aircraft start of roll
4 Time between take off clearance and actual aircraft lift off
5 Time between two sequential aircraft start of roll's
6 Time between two sequential aircraft lift off's
Note that parameters 1 and 2 in Table 9 are also used for runway capacity studies. In
the context of a wake vortex safety survey they are relevant because they influence the
actual time difference between successive aircraft taking off from the same runway. In
case the values for these parameters 1 and 2 are relatively large, this could imply that
there is a large difference between the time period between successive ATCo take off
clearances and successive aircraft starts of roll (and therefore also aircraft lift offs).
Table 10 Example wake vortex safety performance indicators
No Safety performance indicator
1 Number (or likelihood) of minor incidents (if reported and/or estimated)
2 Number (or likelihood) of major incidents
3 Number (or likelihood) of hazardous accidents
4 Number (or likelihood) of catastrophic accidents
5 Number (or likelihood) of non adherence to ICAO WV radar separation minima
Figure 4 provides some example empirical cumulative probability distributions and
histograms for the (minimum) actual separation distance between aircraft along the ILS
glide path. A distinction is made between heavy, medium, and light aircraft (in
accordance with the ICAO wake turbulence categorization). The green lines refer to the
ICAO WV radar separation minima for specific aircraft pairs. Such Figures provide
insight into the probability of non adherence to the ICAO separation minima. Further
analysis of possible submitted wake encounter reports over the associated time frame
will likely provide insight into the reasons for, and consequences of, non adherence.
For the example provided as Figure 4, the percentage of non adherence to ICAO
separation minima is especially high for the aircraft pairs: Heavy-Medium, Heavy-Light,
Medium-Light. In case the associated number of reported incidents would be low, there
would thus be a rationale to reduce ICAO separation in certain circumstances.
- 31 -
Figure 4 Example minimum longitudinal spacing versus ICAO WV radar separation minima
5.3 Yearly analysis of wake vortex safety
It is recommended to perform a yearly analysis of wake vortex safety, immediately
starting after introduction of reduced aircraft separation. In addition to ANSP internal
wake vortex safety data, this could require (wake encounter) data from other sources:
o ADREP information (via International Civil Aviation Organization);
o ECCAIRS information (via the European Union & Joint Research Centre)
o ASR information (via Netherlands National Aerospace Laboratory NLR);
o Pilot wake encounter reporting forms (via airlines, national CAA or ICAO);
o Quick Access Recorder (QAR) data (from the involved airlines);
- 32 -
o Meteorological information from e.g. TAF, METSEL, METAR, ACTUAL,
AIRMET, SIGMET, VOLMET, SWC, LLFC, wind profilers, Doppler radar.
o WAVENDA information (via Netherlands National Aerospace Laboratory).
The following statistical results shall at least be produced (see also Section 4):
o Statistical analysis of wake encounter severities (percentages and/or frequencies
as well as maximum attained roll/pitch/yaw angles and maximum loss of height);
o Distributions for location and heights of wake encounters (distinguish between e.g.
minor - and major incidents and the hazardous - and catastrophic accidents);
o Correlation of wake encounter rates with flight phase and responsible controllers;
o Correlation of wake encounter rates with aircraft types (leader / follower aircraft);
o Correlation of wake encounter rates with meteorological conditions;
o Correlation of wake encounter rates with separation times and distances;
o Correlation of wake encounter rates with operational practices and parameters;
o Correlation of wake encounter rates with aircraft configuration parameters.
Example results are provided in Figures 5 to 9 below. Figure 5, which is based on
voluntary wake encounter reports as analyzed by NATS, gives the relative wake
encounter rates as a function of the deviation from the wake vortex separation minima.
Figure 6 shows the distributions of crosswinds at encounter and also the overall
crosswind climatology at Heathrow as derived from Flight Data Recorder data.
61.7
11.7
5.13.5
1.7 1.0 0.8 0.7 0.5 0.7 0.5 0.20.0
10.0
20.0
30.0
40.0
50.0
60.0
70.0
<-20 -20-15 -15-10 -10-5 -5-0 0-5 5-10 10-15 15-20 20-25 25-30 >30
Deviation from Separation Minima (seconds)
Nor
mal
ised
Rat
e
Wake Vortex DataJan 1995 - July 2002
Separation DataSep 2001 - Aug 2002
Figure 5 Relative wake encounter rates versus separation minima deviation (based on voluntary
wake encounter report analysis performed by NATS)
- 33 -
Figure 6 Crosswind Distribution for Voluntary Reported Encounters compared with the London-Heathrow crosswind climatology (analysis performed by NATS)
Figure 7 gives a histogram of wake encounter altitudes (again based on voluntary
wake encounter reports (from ETWIRL [33]). The Figure shows that most wake
encounters are reported near the runway threshold (at low altitudes).
0
5
10
15
20
25
Altitude of Encounter (Feet)
Cou
nt
Figure 7 Statistical analysis of ETWIRL data-base (120 samples) [33] with flight data recordings
of wake vortex encounters
0
5
10
15
20
25
30
35
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
Crosswind (knots)
Fre
quen
cy (
%)
Crosswind at Encounter
Crosswind Distribution at LHR (0ft - 4000ft)
- 34 -
Figure 8 shows the percentage of encounters as function of reporting height and it can
be seen that around one quarter of all reports are from wake encounters at less than
500ft (data from the voluntary reported wake vortex database managed by NATS).
Figure 8 Statistical analysis of the altitude at which wake encounters occur
Figure 9 with the relationship between roll angle and percentage reported encounters
shows that the number of reports received increases as roll angle decreases until less
than 10 degrees. Information on the height above ground might be very beneficial.
Figure 9 Statistical analysis of maximum attained roll angle (from NATS)
Note that the type of information provided as example in this Section is also available
from a variety of other sources, most notably studies from NLR [15], the Flight Safety
Foundation [19], and NATS [22]. Differences between the results could occur, due to
differences in the applicability and the content of the databases under investigation.
- 35 -
5.4 Wake vortex safety publications
Exchange of wake vortex safety information to the ANSP management, operations and
maintenance is to be achieved through publication of wake vortex safety articles as
part of safety bulletins, safety alerts and safety performance reports. After the
introduction of reduced aircraft separation (and at least until it can be concluded that
the actual implementation has actually been safe for a couple of years), the following
wake vortex safety related information will need to be provided on a regular basis:
o Wake vortex safety survey results as part of quarterly safety bulletins;
o Wake vortex safety alerts to the air traffic controllers in case of safety findings
and/or safety recommendations resulting from the wake vortex safety surveys;
o Wake vortex safety performance results as part of a yearly performance report.
- 36 -
6666 Conclusions and recommendations
6.1 Conclusions
This study has specified recommendations for a Wake Vortex Safety Management
System (WV SMS) for use by ATM service providers. The WV SMS recommendations
have been established using ESARR3 guidance material for the use of safety
management systems for ATM service providers and deals with safety policy, safety
achievement, safety assurance and safety promotion.
Five wake vortex safety policy statements have been proposed. Among other aspects,
these include the requirement to use ground based wind prediction system when
aircraft separation minima are to be reduced in the airport environment. Where
possible, such systems might be supplemented by ground and/or airborne wake vortex
detection, warning and avoidance systems. Data on actual aircraft separation shall
then be gathered using a flight track registration system and analysed continuously.
Any deviations from the prescribed wake vortex separation minima shall be reported to
the national ATM safety regulatory body and EUROCONTROL.
Wake vortex safety achievement has been addressed by analyzing competency, safety
occurrences, quantitative safety levels, system safety assessment and documentation.
Guidelines with respect to the first are provided by the EATMP Human Factors and
Training documentation, which is being applied to the wake vortex safety domain. A
wake vortex reporting scheme (with forms and a procedure for handling incidents and
accidents) has recently been set up by ICAO (since November 2007), though it should
be noted that wake encounter reporting is ongoing in the UK since the early 1970's.
Quantitative wake vortex safety levels for single runway arrivals have been derived in
2002 by NATS as part of the S-Wake study using UK London Heathrow data. The
EUROCONTROL Safety Assessment Methodology (SAM) is available for producing a
Functional Hazard Assessment (FHA) and Preliminary System Safety Assessment
(PSSA) of newly proposed ATM operations for reduced wake vortex separation.
Wake vortex safety assurance has been addressed by analyzing safety surveys, safety
monitoring, safety records and risk management processes. Guidance for the design
and set up of an ANSP wake vortex safety survey has been given. It is recommended
to design a checklist and a questionnaire and to perform some statistical analysis on
relevant causal factors and on actual aircraft separation data collected with a flight
track registration system. Details have been provided for the data collection, data
- 37 -
processing and statistical treatment of data to be processed and used as part of a WV
SMS. For wake vortex safety monitoring purposes, ANSPs may collect and analyze:
flight identification data, actual aircraft separation data, meteorological data, wake
vortex encounter engineering data, wake vortex evolution data, traffic statistics data,
operational practices and procedural data, aircraft configuration data, wake turbulence
report forms, as well as data from hazard / risk identification brainstorms.
Wake vortex safety promotion has been addressed via lesson dissemination and safety
improvement. Exchange of wake vortex safety information to the ANSP management,
operations and maintenance can be achieved through publication of wake vortex safety
articles as part of safety bulletins, safety alerts and safety performance reports.
6.2 Recommendations
As all the ANSPs in the ECAC region are formally required to implement the ESARRs,
it can be assumed that ATM service providers have already implemented an
operational SMS. Normal Operations Safety Surveys (NOSS) are being carried out. It
is now recommended to add the Wake Vortex component to such NOSS. With respect
to regular wake vortex encounter reporting, ANSPs are recommended to adhere to the
wake vortex encounter reporting scheme recently implemented by ICAO (except where
a national scheme already exists that satisfies this recommendation). ANSPs who are
aware of such occurrences should fill out reporting forms and submit these to the
national regulator (who will subsequently submit these to ICAO).
In case a new ATM operation with reduced aircraft separation (preferably supported by
new wake vortex advisory systems) has actually been approved, a gradual transition
phase from the current operation towards the new operation is proposed. During such
transition phase, ANSPs are recommended to:
o Perform quarterly wake vortex safety surveys to assess wake vortex safety of
normal operations, using (wake vortex safety related) data available from:
o Air traffic controller logs;
o ANSP wake vortex safety survey checklists and questionnaires;
o ANSP wake encounter reporting forms;
o Flight track registration system data.
o Perform a yearly analysis of wake vortex safety. In addition to the above ANSP
internal data sources, this could require (wake encounter) data from:
o ICAO ADREP data;
o JRC ECCAIRS data;
o NLR ASR database information;
- 38 -
o Pilot wake encounter reporting forms;
o Quick Access Recorder (QAR) data;
o Meteorological data sources;
o WAVENDA analysis.
After the introduction of reduced aircraft separation (at least until it can be concluded
that the actual implementation has actually been safe for a couple of years), the
following wake vortex safety information will need to be provided on a regular basis:
o Wake vortex safety survey results as part of quarterly safety bulletins;
o Wake vortex safety alerts to the air traffic controllers in case of safety findings
and/or safety recommendations resulting from the wake vortex safety surveys;
o Wake vortex safety performance results as part of a yearly performance report.
Guidance for the design and set up of an ANSP wake vortex safety survey (including
e.g. checklists, questionnaires) has been given. It is noted that the still ongoing safety
research in the CREDOS project may result in new wake vortex safety findings. It is
therefore recommended to define the detailed content of the safety surveys checklists
and questionnaires based results from the CREDOS FHA, PSSA and Safety Case.
- 39 -
7777 References
[1] CREDOS Annex I, Description of Work.
[2] ESARR3: Use of safety management systems by ATM service providers.
[3] EATMP Safety Policy, SAF.ET.ST01.1000-POL.
[4] EATMP Safety Policy: Implementation Guidelines, SAF.ET.ST01.1000-GUI.
[5] Eurocontrol Generic Safety Management Manual, Edition 0.1, February 2006.
[6] IFALPA wake vortex policy, 1998.
[7] FAA Flight Standards wake vortex policy, 1997.
[8] L.J.P. Speijker, G.B. van Baren, A. Vidal, R.M. Cooke, M. Frech, O.
Desenfans; ATC-Wake safety and capacity analysis, ATC-Wake D3_9 (also
published by National Aerospace Laboratory NLR as NLR-TP-2006-252)
[9] UK Civil Aviation Authority; Wake turbulence encounter reporting form - Air
Traffic Control, SRG 1422, Issue 1, November 2007.
[10] UK Civil Aviation Authority; Wake turbulence encounter reporting form -
Pilots, SRG 1423, Issue 1, November 2007.
[11] EU Directive 2003/42/EC of the European Parliament and of the Council of 13
June 2003 on occurrence reporting in civil aviation, L167/23 - L167/36.
[12] ICAO; State Letter AN 13/4-07/67, 26 October 2007.
[13] A.D. Kershaw, S.M. Mason; Specification of 2001 Heathrow airport arrival
database (LHR 2001), DO & SA TN-0001, S-Wake Technical Note SW_TN_
512_1, November 2000.
[14] H. Haverdings; Specification of the WINDGRAD algorithm, NLR-CR-2000-
143, March 2000.
[15] A. Balk; Airline data analysis, CREDOS D1_3, March 2008.
[16] Safe separation distances for departure, CREDOS D3_10.
[17] Final report for WP3 Risk modelling and risk assessment, CREDOS D3_11.
[18] Human Machine Interface Design, CREDOS D4_5.
[19] Flight Safety Foundation; Flight Safety Digest - Special Double Issue on Data
show that U.S. wake turbulence accidents are most frequent at low altitude and
during approach and landing, March-April 2002, Vol. 21, No. 3-4.
[20] Human Factors Case, CREDOS D4_10.
[21] Safety case, CREDOS D4_12.
[22] S.M. Mason, A.D. Kershaw; Assessment of safety requirements, DO & SA
TN 0002, , S-Wake Technical Note SW_TN_411_2, 13 December 2000.
[23] Generic Functional Hazard Assessment (FHA), CREDOS D4_6.
[24] Generic Preliminary System Safety Assessment (PSSA), CREDOS D4_7.
[25] Eurocontrol Safety Case development manual, Edition 2.1, October 2006.
- 40 -
[26] ICAO; Safety Management Manual (SMM), Doc 9859, AN/460, First Edition,
2006.
[27] P.J. van der Geest, M.A. Piers, H.H. de Jong, M. Finger, D.H. Slater, G.W.H.
van Es, G.J. van der Nat; Aviation safety management in Switzerland -
Recovering from the myth of perfection, NLR CR-2003-316.
[28] B. Elsenaar et al., WakeNet2-Europe Research Needs, Part II - Specialist's
reports, Section 3 Regulatory framework and means of compliance, 2006.
[29] ICAO; Annex 14 - Aerodromes.
[30] ICAO; Procedures for Air Navigation Services - Air Traffic Management
(PANS-ATM), Doc 4444.
[31] ICAO; Air Traffic Services Planning Manual, Doc 9426.
[32] EUROCONTROL; ESARR4 -Risk Assessment and mitigation in ATM
[33] J. Turner; European Turbulent Wake Incident Reporting Log (ETWIRL): a new
pan-European wake vortex reporting system and database, 1998.
[34] UK CAA; Aeronautical Information Circular (AIC) 17/1999, 25 February 1999.
[35] WAVENDA algorithm performance tests, CREDOS D2_3, 2008.
- 41 -
Appendix AAppendix AAppendix AAppendix A ICAO wake encounter reporting forms
WAKE VORTEX ENCOUNTER REPORTING FORM FOR PILOTS
Date of incident Date and Time
Time (UTC)
Make
Model
Aircraft Type
Series
Height □ m or □ ft
Altitude □ m or □ ft
Altitude
Flight level
Location
State
Airport
Geographic
Position
Runway □ L □ C □ R
Phase of flight □ take-off
□ initial climb
□ climb
□ cruise
□ descent
□ holding
□ approach
□ final
□ touch-down
□ taxiing
□ other
Were you turning? □ yes □ no □ L □ R
Which holding pattern
were you in, if any?
Were you: □ high □ low □ on the glide path
Were you □ left of □ right of □ on the centre-line
Weight kg
IAS kts
Details
Heading degrees
- 42 -
Other What led you to suspect
wake vortex as the cause
of the disturbance?
Did you
experience
vertical
acceleration?
□ yes □ no Please describe:
What was the
change in
attitude? Please
estimate angle.
Pitch:
Roll:
Yaw:
Was there any
change in
altitude?
□ yes Please describe:
□ no
□ n/a
Was there
buffeting?
□ yes
□ no
□ n/a
Was there stall
warning?
□ yes
□ no
□ n/a
Was the
autopilot
engaged?
□ yes
□ no
□ n/a
What control
action was
taken?
□ none
□ go-around
□ runway change
□ other
Please describe briefly:
Could you see
the aircraft
suspected of
generating the
wake vortex?
□ yes
□ no
□ n/a
- 43 -
If yes, what was
it?
Make -
Model -
Series -
Where was it
relative to your
position?
Separation distance:
clock reference:
Were you aware
of the preceding
aircraft type
before the
encounter?
□ yes
□ no
□ n/a
— — — — — — — —
- 44 -
WAKE VORTEX ENCOUNTER REPORTING FORM FOR AIR NAVIGATION
SERVICE PROVIDERS (ANSPs)
Date of incident Date and Time
Time (UTC)
Make
Model
Series
Phase of flight □ take-off
□ initial climb
□ climb
□ cruise
□ descent
□ holding
□ approach
□ final
□ touch-down
□ taxiing
□ other
Encountering
Aircraft Type
Runway □ L □ C □ R
Make
Model
Series
Phase of flight □ take-off
□ initial climb
□ climb
□ cruise
□ descent
□ holding
□ approach
□ final
□ touch-down
□ other
Generating
Aircraft Type
Runway □ L □ C □ R
Location Location
- 45 -
State
Airport
Vertical
Horizontal
Spacing between
aircraft
Any additional
information related to the
encounter
Wind
Visibility
Cloud
Temp
Weather
Dew Point
- 50 -
Appendix CAppendix CAppendix CAppendix C ATC-Wake risk requirements
Introducing and/or planning changes to the ATM system cannot be done without
showing that minimum risk requirements will be satisfied. This can be done through a
qualitative and/or quantitative safety assessment. The main issue is the choice of the
safety criteria. The risk assessments in the ATC-Wake project intend to be compliant
with the ESARR 4 requirements posed by EUROCONTROL’s Safety Regulation
Commisssion (SRC). Following the ESARR4, a safety assessment requires the
following risk criteria aspects:
• A severity classification,
• A frequency classification,
• A risk tolerability scheme.
The ESARR 4 requirements also states that a combination of quantitative (e.g.,
mathematical model, statistical analysis) and qualitative (e.g. good working processes,
professional judgement) arguments may be used to provide the required level of
assurance that safety objectives and requirements have been met. To assess safe and
appropriate separation minima, a quantitative assessment will need to be performed. In
the ATC-Wake qualitative safety assessment, the ESARR 4 severity classification, has
been used. Five severity classes are distinguished: accident, serious incident, major
incident, significant incident, no safety effect. The definitions of occurrence, accident,
and incident are specified in the ESARR2. For execution of the quantitative safety
assessment, the incident/accident has been determined on basis of risk probabilities
followed by a comparison with risk criteria. The following classification, which is based
on ICAO Annex 13 for incident/accident investigation and JAR 25.1309 for aircraft
system hazard categorisation, are used:
• Catastrophic accident: aircraft encountering wake hits ground, with loss of life;
• Hazardous accident: the wake vortex encounter results in one or more on-board
fatalities or serious injuries (but no crash into the ground);
• Major incident: the wake vortex encounter results in one or more non-serious
injuries, but no fatality, on-board the encountering aircraft;
• Minor incident: the wake encounter results in inconvenience to occupants or an
increase in crew workload.
The method proposes that all four risk requirements are to be satisfied, i.e. the most
stringent requirement will determine the required separation minima (see Table C-1).
- 51 -
Table C-11 Risk requirements (per queued aircraft movement)
Risk event Proposed Target Levels of Safety
Catastrophic Accident 0.9 × 10-8
Hazardous Accident 3.0 × 10-7
Major Incident 1.0 × 10-5
Minor Incident 5.0 × 10-4
This approach supports two commonly accepted rationales for acceptance of a new
system (or procedure) by showing that the number of induced risk events:
• does not exceed some pre-defined, and agreed upon, safety requirement;
• does not increase with the introduction of a new ATM procedure.
ESARR 4 documentation has been used to derive appropriate risk criteria for use in the
ATC-Wake qualitative safety assessment. In this respect, the results intend to be
compliant with the ESARRs. The severity classification is taken directly from the
ESARR4 (Table C-2). The frequency classification has been derived from the ESARRs
to judge the acceptability of a number of conflict scenarios that may occur.
Table C-12 ESARR 4 severity classification scheme in ATM
Severity class
Nr Term
Examples of effects on operation
1 ACCIDENT • One or more catastrophic accidents.
• One or more mid-air collisions.
• One or more collisions on the ground between two aircraft.
• One or more Controlled Flight Into Terrain.
• Total loss of flight control.
No independent source of recovery mechanism, such as surveillance or ATC and/or flight crew procedures can reasonably be expected to prevent the accidents.
2 SERIOUS INCIDENT
• Large reduction in separation (e.g., a separation of less than half the separation minima), without crew or ATC fully controlling the situation or able to recover from the situation.
• One or more aircraft deviating from their intended clearance, so that abrupt manoeuvre is required to avoid collision with another aircraft or with terrain (or when an avoidance action would be appropriate).
3 MAJOR INCIDENT
• Large reduction (e.g., a separation of less than half the separation minima) in separation with crew or ATC controlling the situation and able to recover from the situation
• Minor reduction (e.g. a separation of more than half the separation minima) in separation without crew or ATC fully controlling the situation (without use of collision / terrain avoidance manoeuvres).
- 52 -
4 SIGNIFICANT INCIDENT
• Increasing workload of the air traffic controller or aircraft flight crew, or slightly degrading the functional capability of the enabling CNS system.
• Minor reduction (e.g., a separation of more than half the separation minima) in separation with crew or ATC fully controlling the situation and fully able to recover from the situation.
5 NO SAFETY EFFECT
No hazardous condition, i.e., no immediate direct or indirect impact on the operations.
Frequency classification
In the ATC-Wake qualitative safety assessment, frequency classes need to be defined
for severity outcomes of conflict scenarios. The severity and frequency classes
together are used to define risk tolerability. The ESARR 4 requirements do not specify
these frequency classes, but only provide the maximum tolerable probability of ATM
directly contributing to an accident of a Commercial Air Transport aircraft. The ESARR
4 requirements currently leave freedom to define the details of risk criteria that are
required to conduct a safety assessment, such as maximum tolerable probabilities of
incidents and risk budgets of conflict scenarios. According to the ESARR 4
requirements, the maximum tolerable probability of ATM directly contributing to an
accident of a Commercial Air Transport aircraft is 1.55×10-8 accidents per flight hour or
2.31×10-8 accidents per flight. These maximum tolerable probabilities are based on:
• historical accident data in the ECAC region over the period 1988 to 1999,
• a target for the maximum ATM direct contribution to the total number of accidents
of 2%, which is based on historical data for accidents with at least one ATC primary
cause and a factor that accounts for allowance of variations in the scope of source
data (ATS, ASM and ATFM in addition to ATC), for statistical error, and for
adopting a conservative approach to offer additional protection to the future,
• requirement that the number of accidents in 2015 may not be higher than in 1999,
• an annual traffic increase of 6.7% for the period 1999 to 2015.
The scope of the ATC-Wake qualitative safety assessment is wider than accidents and
incidents with a direct ATM contribution, such as used in the ESARR 4 requirements. It
is not limited to occurrences where at least one ATM event or item was judged to be
directly in the causal chain of events, but aims to cover ATM direct and indirect
occurrences. However, a maximum tolerable accident probability of ATM indirectly
contributing to an accident of a Commercial Air Transport aircraft has not been
specified by the ESARR4 requirements. A target of 1.55×10-8 accidents per flight hour
or 2.31x10-8 accidents per flight is for the maximum tolerable probability for accidents
with direct and indirect ATM contributions was therefore used. This is a conservative
approach, which obviously implies that the ESARR4 requirements are satisfied.
- 53 -
The target levels of safety are expressed in occurrences per flight. The current
qualitative safety assessment does not consider the risk of a whole flight, but considers
the risk of the ATC-Wake operations. As such it is needed to determine what budget of
the total ATM related risk of 2.31x10-8 accidents per flight can be provided to the
presently assessed operations. In the ATC-Wake qualitative safety assessment the risk
is evaluated per conflict scenario. For this purpose, it is assumed that the ATM related
risks of a whole flight can be represented by 25 conflict scenarios, and that each has
an equal risk budget. Using these assumptions the maximum tolerable probability of an
ATM related accident is about 1×10-9 accidents per conflict scenario. In line with risk
criteria of JAA, in the qualitative safety assessment it is assumed that the maximum
tolerable probabilities of serious and major incidents are, respectively, a factor 1×102
and 1×104 higher than for accidents. The frequency terms and the associated
probabilities as derived in this section are shown in Table C-3.
Table C-13 Frequency categories used in the ATC-Wake study
Frequency category Probability of occurrence
PROBABLE Higher than 10-5 per conflict scenario
REMOTE Between 10-7 and 10-5 per conflict scenario
EXTREMELY REMOTE Between 10-9 and 10-7 per conflict scenario
EXTREMELY IMPROBABLE Lower than 10-9 per conflict scenario