Title: CARA: A Human Reliability Assessment Tool for Air Traffic Safety Management - Technical Basis and Preliminary Architecture

Author(s): Barry Kirwan, Huw Gibson

Publication Event: Proceedings of the Fifteenth Safety-critical Systems Symposium, Bristol, UK

Publication Date: 2007-03-13

Resource URL: https://scsc.uk/r170.pdf

Abstract:

This paper aims to serve as the basis for development of a sound Human Reliability Assessment (HRA) capability for Air Traffic Management (ATM) applications in safety case and Human Factors assurance work. ATM is considered a ‘high reliability’ industry, although recent ATM-related accident occurrences have shown that such a status can never be assumed, and there is a continual need to look for safety vulnerabilities and mitigate them or their effects. Clearly, however, ATM is very human-centred, and will remain so at least in the mid-term (e.g. up to 2025). The air traffic controller has shown great capacity for safety over the years, and this must be maintained against a background of continually increasing traffic levels (currently running at 4 - 18% per year in Europe) and automation support aimed largely at enhancing capacity. Other industries have for several decades made use of HRA approaches. Such approaches aim to predict what can go wrong, and how often things can go wrong, from the human perspective. Such a capability is useful to ensure that safety cases of current and future systems are not ignoring the key component in the ATM system, the human controller. However, it is not simply a matter of taking a HRA method off-the-shelf from another industry - ATM performance is very different from, say, nuclear power operation, rail transport, petrochemical or medical domain performance (domains where HRA has matured or is evolving). There is therefore a need to consider what approaches have been tried in such industries, and to learn from what has, and has not worked, and then fit and adapt a method that will serve ATM's needs. Additionally, whilst error types (what we do wrong) are relatively well-understood in ATM through incident experience, the likelihoods or probabilities of such errors, which are the cornerstone of any HRA method, are far less known. This is particularly so because error recovery in ATM is very strong. Although other industries have such probabilistic human error 'data', ATM has almost none, and so it will take some time to develop an approach for ATM (since data from other industries may not be relevant). Nevertheless, preliminary studies have occurred using incident information from an Air Traffic Control Centre, error recordings from a real time simulation, and expert judgement protocols for an ATM safety case. Such initial studies do suggest that development of a HRA capability for ATM is feasible. This paper therefore sets out to review HRA in other industries and to determine the overall architecture and style of HRA approach or approaches that are needed for ATM. It will then go on to give a vision of what such approaches would look like. Later companion reports will then focus on the development of these approaches, and their demonstration in safety case contexts.