Runway Protection Zones (RPZs) Risk Assessment Tool Users’ Guide (2016)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

4 Runway Protection Zones (RPZs) Risk Assessment Tool Users’ Guide 1.4 Definitions Accident: An occurrence associated with the operation of an aircraft which takes place between the time any person boards the aircraft with the intention of flight and all such persons have disembarked and in which any person suffers death or serious injury or in which the aircraft receives substantial damage. Consequence: Potential outcome(s) of a hazard. Corrective Action: Action to eliminate or mitigate the cause or reduce the effects of a detected nonconformity or other undesirable situation. Hazard: Any existing or potential condition that could lead to injury, illness, or death to people; damage to or loss of a system, equipment, or property; or damage to the environment. A hazard is a prerequisite to an accident or incident. Incident: An occurrence other than an accident, associated with the operation of an aircraft, which affects or could affect the safety of operations. Incompatible Land Use: Land uses identified by the FAA memorandum, “Interim Guidance on Land Uses within a Runway Protection Zone,” as incompatible (e.g., transportation facilities, aboveground utility infrastructures, and hazardous material storage). Landing Overrun (LDOR): A type of excursion where the landing aircraft leaves the end of the runway before stopping. Landing Undershoot (LDUS): A type of excursion where the landing aircraft touches down before the beginning of the runway. Likelihood: The estimated probability or frequency, in quantitative or qualitative terms, of a hazard’s occurrence. Normal Operations Data (NOD): A schedule of movement records at the airport prepared in a specific format usable by the software Population Density: Number of people present per unit area. The adopted unit area in this study is square feet. Risk Assessment: Assessment of a system or component and involving identification of unwanted events and their associated likelihoods. Root Cause: A factor (e.g., event, condition, organizational) that contributed to or created the proximate cause and subsequent undesired outcome and, if eliminated or modified, would have prevented the undesired outcome. Typically, multiple root causes contribute to an undesired outcome. Safety: The state in which the risk of harm to persons or of property damage is reduced to, and maintained at or below, an acceptable level through continuing hazard identification and risk management. Safety Management System: The formal, top-down business-style approach to managing safety risk that includes systematic procedures, practices, and policies for managing safety (e.g., safety risk management, safety policy, safety assurance, and safety promotion). Safety Risk: The composite of the likelihood of the potential effect of a hazard and the pre- dicted severity of that effect. (For example, an overrun by an aircraft landing on an icy runway would be considered a safety risk. The hazard is “icy runway,” and the safety risk is the “overrun.” For the safety risk assessment, the consequences of an overrun should be identified and their likelihoods evaluated.) þÿRunway Protection Zones (RPZs) Risk Assessment Tool Users  Guide Copyright National Academy of Sciences. All rights reserved.

Introduction 5 Safety Risk Management: A formal process, within the SMS, composed of (1) describing the system; (2) identifying the hazards; and (3) assessing, analyzing, and controlling the risk. Severity: The degree of loss or harm associated with the outcome of a hazard or outcome in terms of degree of loss or harm. Safety Gain: The degree to which the safety risk is reduced. Takeoff overrun (TOOR): A type of excursion where the aircraft taking off leaves the end of the runway prior to becoming airborne. Takeoff overshoot (TOOS): An event where the aircraft taking off crashes beyond the end of the runway after becoming airborne. Worst Credible Outcome: The most unfavorable outcome or combination of outcomes reasonably expected to occur. þÿRunway Protection Zones (RPZs) Risk Assessment Tool Users  Guide Copyright National Academy of Sciences. All rights reserved.

6 C H A P T E R 2 Managing safety is an inherent function of airport operations and oversight which, for U.S.-certificated airports, is regulated by Title 14 Code of Federal Regulations (CFR) Part 139. Part 139 ensures airport surfaces, navigational aids, markings, and lighting comply with established standards and guidelines. Part 139 compliance is founded on frequent inspections, observations, repairs, and detailed record-keeping. Although certificated airports are required to comply with such regulations, studies show the benefits of managing safety at non-certificated airports as well. For example, business benefits may be gained by lower insurance costs through demonstration of active control of safety risks. Also, managing safety risks can lead to improved safety and health of airport employees and improved quality of the work environment, which can result in lower employee turnover or absenteeism. Managing safety risks, regardless of regulatory requirements, is a good business practice that can reward airport sponsors in many ways. SRM introduces an additional layer of safety management by establishing a formal risk pro- gram founded on data collection, trending, and analysis that results in data-driven, risk-based decision making. Although regulations are mostly rooted in reaction to observed safety hazards, the SRM combines the reactive approach with a proactive approach in identifying potential safety risks and providing a formal framework to analyze them. This chapter summarizes risk and SRM concepts as prescribed by the FAA. 2.1 SRM Concepts A typical SRM program is defined as one that uses established processes to (1) proactively identify, describe, and assess hazards; (2) rank and prioritize risks; (3) develop and apply mitiga- tions; and (4) continuously improve safety through monitoring. These are broken into manage- able concepts below. Use Established Processes To ensure that consistency exists within the SRM, processes used to identify safety concerns and hazards and to determine risk outcomes need to be documented and applied consistently throughout the organization. This includes establishing standards, creating meaningful defini- tions and guidance for decision making, and developing progressive safety limits or thresholds. Proactively Describe, Identify, and Assess Hazards A hazard is any situation or condition that can cause injury, damage, or disruption of normal operations. Hazards can exist in various forms and functions throughout any operation; carefully describing the boundaries or characteristics of a specific hazard is important when assessing Risk Assessment and Safety Risk Management (SRM) þÿRunway Protection Zones (RPZs) Risk Assessment Tool Users  Guide Copyright National Academy of Sciences. All rights reserved.

Risk Assessment and Safety Risk Management (SRM) 7 safety. For example, existing hazards at airports can include runway surfaces contaminated because of ice, snow, rain, concrete deterioration, and so forth. These hazards are controlled through various procedures, such as Part 139 inspections, preventive maintenance, or pilot reports. Potential outcomes of a hazard are identified, and the severities of the consequences for each outcome are assessed along with their likelihood of occurrence. The FAA recommends that the worst credible outcome be considered for the analysis. Question: How should an aircraft crash be analyzed with respect to the people on the ground? Answer: Potential outcomes associated with an aircraft crash range from fatality to no damage or injury depending on the circumstances of the event. The worst credible outcome is fatality as proven in historic events. Fatality should be selected as the consequence, and the likelihood of it occurring should be assessed. Rank and Prioritize Risks Risk is the combination of potential severity and likelihood of an outcome occurring. Deter- mining risk is the result of analyzing the worst credible outcome and the likelihood of it occur- ring and subsequently plotting that information on a standard scale risk matrix to determine its magnitude. The most accurate risk analysis outcomes are founded on quantitative (measurable) data, but in many cases, only qualitative information is available. Develop and Apply Mitigations Once a hazard’s risk has been determined, management can decide, based on agreed responses to risk rank, what additional mitigations may need to be implemented to control the underlying hazard. The degree to which mitigations are implemented is directly related to the risk tolerance of the airport. Selection of an appropriate risk tolerance is a strategic policy decision that sets the tone for the entire organization in dealings with risk and should be supported and approved by executive management. Continuously Validate Effectiveness of Mitigations through Monitoring One of the most concrete aspects of proactive safety is the ability to determine if the mitiga- tion has been successful. This information can be used to change operations and maintenance practices and build a safety repository that improves safety decisions. 2.2 Applying SRM Figure 2.1 presents the five steps in the application of a formal SRM program. These steps are described in more detail in the text that follows. Step 1: Describe the System When a safety concern is identified, describing where it fits into the organization is important. The “5-M model” can be used to describe the system. The 5-M model includes descriptions of man, machine, mission, media, and management (SMS Desk Reference, 2012). Describing the system should provide enough background information about the safety concern to ensure rel- evant operations, procedures, people, facilities, and so on are understood and documented. It is also important to set boundaries to ensure specific and unique hazards can be identified. For example, if a safety issue is raised relating to snow removal on a particular taxiway, the bound- ary or limit would be to identify hazards relating to snow removal activities within the identified taxiway and not as part of the entire airfield snow removal operation. þÿRunway Protection Zones (RPZs) Risk Assessment Tool Users  Guide Copyright National Academy of Sciences. All rights reserved.

8 Runway Protection Zones (RPZs) Risk Assessment Tool Users’ Guide Step 2: Identify Hazards At the core of SRM is the ability to identify and quantify hazards. A hazard is any real or poten- tial condition that can cause injury, illness, or death to people; damage to or loss of a system, equipment, or property; or damage to the environment. A hazard is a prerequisite to an accident or incident (SMS Desk Reference, 2012). In common language, risks and hazards may be used to denote the same concept; however, in the context of SRM, hazards are defined as existing or latent conditions that do not become a risk until something occurs that could lead to a negative outcome. Types of airside hazards that exist at airports include foreign object debris (FOD), prop wash, jet blast, fuel spills, and complex airfield geometry. Part 139 provides the safety over- sight to manage these hazards, but, at times, existing controls fail, and hazards result in negative outcomes. Being able to determine and proactively assess hazards helps to manage safety. Steps 3 and 4: Analyze and Assess Risks To identify risk, information is gathered, analyzed, and assessed to determine potential sever- ity and likelihood of a negative outcome occurring. The results of the analysis are usually assessed using a risk matrix. To prioritize and mitigate risks, it is important to develop a standard method with which to analyze the risk. The definitions used to classify safety risks should be applied consistently to all types of risks within the airport’s system to ensure that risk analysis is evenly applied across opera- tions. Certain thresholds are used to categorize high, medium, and low risks. Existing resources can be adapted or modified to create a useful and reasonable means to measure risk. For example, FAA’s definitions for severity and likelihood (found in FAA Order 5200.11) offer a foundation from which airports can expand or customize for their specific use (see Tables 2.1 and 2.2). Source: Modified from FAA Office of Airports SMS Desk Reference, 2012. Figure 2.1. SRM 5-step process. Minimal (5) Minor (4) Major (3) Hazardous (2) Catastrophic (1) Did not require or refused treatment Onsite treatment only Further treatment or evaluation required by advanced medical staff One fatality or multiple serious injuries Multiple fatalities Table 2.1. Example severity levels for use in risk matrix. þÿRunway Protection Zones (RPZs) Risk Assessment Tool Users  Guide Copyright National Academy of Sciences. All rights reserved.

Risk Assessment and Safety Risk Management (SRM) 9 The risk matrix can be unique to each airport’s needs. The matrix should include various sever- ity as well as likelihood definitions. The goal is to create a matrix with sufficient level of details to rank risk and assess hazards by using quantitative and qualitative means. The most important aspect of differentiating risk ranking are the criteria used to establish thresholds. Developing thresholds helps to categorize and prioritize risks and support decisions about mitigations, including assigning labor and material costs. Applying thresholds is helpful when quantitative data are limited and typically are most useful to help describe thresholds that exist between what is considered negligible (low) and unacceptable (high). When the levels of both severity and likelihood are established, the risk tolerance of the airport is formed by ranking the cells within the matrix. The cells are usually categorized in three categories (i.e., low, medium, high) or five categories (i.e., low, low-medium, medium, medium- high, high). The risk matrix recommended by the FAA, shown in Figure 2.2, uses three levels. The matrix is color-coded with low risk shown as green, medium risk shown as yellow, and high risk shown as red. Once thresholds are established, it is best to test them on the many safety risk programs, including construction, wildlife, and operations, to determine if additional refinement is needed. Often, county, city, and authority risk departments already have established limits used to manage corporate risk and these can be additional useful resources in establishing thresholds. Step 5: Mitigate and Monitor Risks Once hazards have been quantified through the risk analysis and assessment steps, the results are used to determine what new or additional mitigations, if any, need to be developed and implemented. Mitigations provide additional safety layers to eliminate the hazard, prohibit the hazard from leading to a negative outcome, or reduce the severity of the outcome. Controlling or reducing all risk outcomes can be difficult, and no single mitigation is perfectly reliable. Development of multiple mitigations can reduce the various possible negative outcomes. Mitigations can range from very complex solutions (e.g., re-engineering airfield geometry as in FAA’s Runway Incursion Mitigation program) to simpler solutions (e.g., improved coordination When driving, we conduct an SRM each time we merge into traffic. Oncoming vehicles, pedestrian crossings, construction activities, and poor visibility are some of the hazards we watch out for. We constantly analyze and assess the risk of scenarios (such as another vehicle striking the car due to excessive speed), measure the severity of the effect in terms of potential injury, and then consider how to mitigate the risk (by, for example, slowing down or stopping instead of merging into traffic and using brake lights to alert the following vehicles). Other risk mitigation measures include the use of airbags, antilock brakes, and plenty of tread on tires. Table 2.2. Example likelihood levels for use in risk matrix. Frequent (A) Probable (B) Remote (C) Extremely Remote (D) Extremely Improbable (E) Likely to occur more than once a week or every 2,500 departures, whichever occurs sooner Expected to occur about once every month or 250,000 departures, whichever occurs sooner Expected to occur about once every year or 2.5 million departures, whichever occurs sooner Expected to occur about once every 10- 100 years or 25 million departures, whichever occurs sooner Expected to occur less than every 100 years (Source: FAA Order 5200.11 Change 2). þÿRunway Protection Zones (RPZs) Risk Assessment Tool Users  Guide Copyright National Academy of Sciences. All rights reserved.

10 Runway Protection Zones (RPZs) Risk Assessment Tool Users’ Guide and communication between airport operations and air traffic controllers during construction- related closures). Regardless of the mitigation, the most important aspect is to develop reasonable solutions that fit the purpose and are cost-effective. After mitigations are developed, documented, and assigned for implementation, their effec- tiveness is monitored regularly. Monitoring may be more frequent during the early stage of implementation, reduced later, and then either ended or incorporated into general operations as a standard procedure. If monitoring indicates the mitigation is not working as designed or as planned, additional review and analysis are conducted and new, revised, or supplemental mitigations can be added. Hazards, risk rank, and associated mitigations can be documented in a spreadsheet or as part of an airport’s operations database. 2.3 Acceptable Level of Risk One question that often arises in risk assessment and selection of mitigations is how much risk is acceptable. In other words, what is an acceptable level of risk for the people on the ground exposed to airport operations? Although ICAO requires that member states establish a safety program to achieve an acceptable level of safety in aviation operations, it leaves it to each state to determine what level is acceptable (ICAO Doc 9859, Chapter 6). Adopting an acceptable level of risk is a strategic policy decision that should be made at the top executive level of the organi- zation. Establishing a target level of safety (TLS) is directly related to the acceptable level of risk for the organization. To establish an acceptable level of risk, safety performance indicators must first be defined. Safety performance indicators are used to measure the safety status of the aviation system. These indicators could be clearly described quantitative and qualitative measures. Then, safety targets should be established. Often, organizations implement stepwise targets that ultimately reach Source: FAA Order 5200.11 Change 2 Figure 2.2. Example of a risk matrix. þÿRunway Protection Zones (RPZs) Risk Assessment Tool Users  Guide Copyright National Academy of Sciences. All rights reserved.

Risk Assessment and Safety Risk Management (SRM) 11 the acceptable level. The status of the organization is periodically monitored by performance indicators, and the effectiveness of the mitigation measures and controls embedded in the orga- nization is evaluated. The FAA Office of Flight Standard Services quotes the following two general safety perfor- mance indicators that are widely used in aviation (Order 8000.368A): • Fatal accident per 100,000 departures • Accident per one million passenger miles The FAA introduced a new safety performance indicator, fatalities per 100 million persons on board, in the 2008-2012 Flight Plan. The associated safety performance target was to reduce the 2007 rate (8.8828 fatalities per 100 million persons on board) by half, reaching a rate of 4.4414 by 2025 (Order 8000.368A). The International Air Transport Association (IATA) has suggested an acceptable level of 0.37 hull losses per million flights of western-built jets which translates into one accident per 2.7 million flights. The regulatory focus so far has been on the risk associated with the people on board. Relevant acceptable level of risk should be deduced with respect to the people on the ground that could be used with the risk assessment results attributed to the land uses around the airports. þÿRunway Protection Zones (RPZs) Risk Assessment Tool Users  Guide Copyright National Academy of Sciences. All rights reserved.

12 C H A P T E R 3 Various data elements are required to run the risk analysis using the RPZ Risk Assessment Tool (RPZ_RAT). The required data can be put into four categories: airport, movements, weather, and land use. The following sections describes elements of data for each category and potential sources from which to obtain them. 3.1 Airport Data The RPZ_RAT requires identification of the airport category. The categories are defined according to the type of activities and the number of passenger boardings [e.g., commercial service, primary, cargo service, reliever, and general aviation (GA) airports]. Primary commercial service airports have more than 10,000 annual passenger boardings. Primary commercial service airports with at least 0.05% of national annual passenger board- ing are designated as hub airports and are further classified as large, medium, and small hub airports, based on annual boardings. The tool distinguishes between primary commercial air- ports with a hub designation and the remaining airport categories. The research team found it was less likely for a movement to result in an accident at a hub airport than at airports in other categories. The tool requires airport elevation, rounded to the nearest foot, as an input. Elevation affects aircraft performance, such as distances required for landing and takeoff. Users should also gather basic information about the airport runways, including runway designations, declared accelerated stop distances available (ASDA), declared landing distances available (LDA), aircraft approach category (AAC), airplane design group (ADG), and visibility minimums. These data are available from sources such as the FAA Airport/Facility Directory (d-A/FD) and AirNav websites. Another important input is the current annual traffic volume at the airport. This includes the total number of landings and takeoffs on all runways. Given that current traffic volume may change over time, the tool makes it possible to account for the expected traffic growth in the future. The user should obtain the average annual percentage that the traffic is expected to grow over a long period. This is usually available from various airport planning studies as well as FAA sources such as Terminal Area Forecast. The annual traffic growth used in the tool is the average over the long term (20+ years). Short-term traffic growth estimates may skew the findings of the risk analysis. Gathering Software Tool Input Data þÿRunway Protection Zones (RPZs) Risk Assessment Tool Users  Guide Copyright National Academy of Sciences. All rights reserved.