GM1 ATS.OR.210(a) Safety criteria

ED Decision 2017/001/R

SAFETY CRITERIA IN TERMS OF PROXIES FOR SAFETY RISKS

(a)     In the safety assessment of functional systems, it may not always be possible or desirable to specify safety criteria in terms of quantitative values of risk. Instead, safety criteria may be defined in terms of other measures that are related to risk. These measures are called proxies and they need to meet the requirements for a proxy as stated in AMC2 ATS.OR.210(a). For examples of their use, see GM1 to AMC1 ATS.OR.205(b)(4).

(b)     A proxy is some measurable property that can be used to represent the value of something else. In the safety assessment of functional systems, the value of a proxy may be used as a substitute for a value of risk, providing it meets the requirements for a proxy as stated in AMC2 ATS.OR.210(a). Examples of proxies are the frequency of airspace infringements, runway incursions, false alert rate, head-down time, limited sight, level of situation awareness, fraction of read back errors, reduced vigilance, amount of turbulence, distraction of controller’s attention, inappropriate pilot behaviour, system availability, information integrity and service continuity.

An example of the concept of using a different but specific quantity to assess an actually relevant quantity is the transposition/measure of an aircraft’s altitude which is in terms of barometric pressure or the transposition/measure of an aircraft’s airspeed which is in terms of dynamic pressure.

(c)      A proxy is a measure of a certain property along the causal trajectory between the hazard/event and the harmful effects of the hazard/event in question (see Figure 5). The causal relationship between the proxy and the accident must be justified in the safety case, i.e. it must satisfy AMC2 ATS.OR.210(a). This means that the accident trajectory must be modelled and analysed such that the causal relationship can be assured but without the need to evaluate the quantitative nature of this relationship. It is assumed that since the proxy lies between the hazard/event and the accident, then there is a quantitative causal relationship between the rate of the hazard/event’s occurrence and the rate of the proxy’s occurrence. As a consequence, the variation of values of the proxy correlates with values of the hazards/events rate of occurrence and the value of the rate at which the harmful effects occur, i.e. the accident rate, and this relationship is a monotonically increasing one. This means that when the proxy value, e.g. Proxy₁, increases/decreases, the associated risk value of the related accident, e.g. Accident₁, increases/decreases accordingly.

Figure 5: Use of proxies along accident trajectories

(d)     Proxies might be preferred where the extra effort needed to identify, describe and analyse a complete set of sequences of events from the occurrence of a hazard to the occurrence of an accident or incident has no added value in the safety assessment. The intrinsic reasons for the amount of the extra effort are the number of significantly different event sequences, the complexity of some accident scenarios, the existence of many barriers preventing the occurrence of a hazard developing into an accident and the lack of evidence on the probability of some events or the frequency of occurrence of some external circumstances and factors. The usage of proxies might then make the safety assessment more tractable and comprehensible and increase the quality of the risk analysis.

(e)     The main advantages of proxies are the easy recognition of safety issues by operational staff involved in the safety assessment, and the direct focus on the analysis and mitigation of the identified hazards and safety issues introduced or affected by the change.

(f)      The main disadvantage of using proxies is that it is not possible to express risk by a uniform measure. However, the value of the proxy should be measurable.

(g)     For further details on the use of proxies, please refer to GM1 to AMC1 ATS.OR.205(b)(4), which contains two examples to assist in the selection and use of proxies in safety analysis.