ASICBA: A WAY TO ADD VALUE TO AERONAUTICAL SAFETY

.Prof. Renato Picardi Politecnico di Milano – Mr. Massimo Brunetti - Mr. Claudio Terranova ASICBA (www.asicba.org), is a two-year EU-funded research project under FP6, started on 15th January 2005 and the partners in the consortium are: Airclaims (Ascend), D’Appolonia (Project Leader), ECORYS, Geasar, LOT, Meridiana, NLR and Politecnico di Milano Abstract The main concept in ASICBA approach is to express safety effects in monetary terms and then to compare them with associated costs and benefits. The model developed consists of a scenario based risk-model to asses potential risk reduction, a cost model translating risk reduction in monetary terms and a cost-benefit trade off by a CBA computation. The Decision Support System tool is an electronic handbook, incorporating a data pool to assist in estimating costs, benefits and risk reduction, and provides the user with a report showing the CBA result together with all data and formulas used. Introduction Cost-benefit analysis of safety measures is a relatively new concept in the aviation community. Decisions on safety related matters, for instance, are often taken without knowing precisely how safety benefits relate to the costs they induce. In order to analyze in a deeper way the relationship between these two different aspects, a specific project called ASICBA has been realised. In this project, a methodology has been developed to assess the effects of safety improvement measures offering the opportunity to make a balanced trade-off between safety and investment costs. The main concept in the approach is to express the safety effects in monetary terms and then to compare those with the associated costs of the safety measures. The aim of this paper is to present a general overview of the methodology adopted by the ASICBA consortium and to offer to the reader some information about the results achieved.

The methodology in brief The model developed in ASICBA has been set-up as an integrated model and consists of three main building blocks:

1. scenario-based risk model; 2. cost model;

3. cost-benefit trade-off.

Figure 1:General outline of the approach

In the first phase, the user has to define the safety measures to be assessed with the model as starting point for both the risk and cost model. The risk model has been created in order to assess the potential risk reduction of the safety measure; its output feeds into a cost module that contains a database of accident costs translating the risk reduction in monetary terms. Therefore a safety improvement is represented by a reduction of probability that the event could happen; the cost reduction instead can be considered the safety value of the introduction of the safety measure. Other impacts of the safety measures as investment costs, operational costs, certification costs, and other benefits, maintenance optimization and fuel

78/07

Aerotecnica Missili e Spazio Vol. 86 4/2007 195

costs reductions and operational benefits are also taken in consideration in order to be assessed. At the end, all costs and benefits are then combined in a CBA computation to obtain an actual result. Methodology more in detail Entering deeper into the core of the method, it is possible to describe the guidelines adopted in the ASICBA method. At first, it is necessary to define the base case. The base case represents the situation that would exist if the new system, procedure, facility or device were not undertaken. An estimation of incremental costs and benefits has meaning only relative to this base case. However, it is unrealistic to assume that the base case is a static state. Ongoing developments, for instance in the growth of air traffic volume, technology advances and so on should be taken into account in the base case. The set of assumptions about the most likely future of the air transport system must be explicitly stated at the outset of the analysis. The alternative that has been evaluated in the cost-benefit analysis are referred to as the ‘project case’. Depending on the number of improvement alternatives, there are one or more project cases, which can all be compared with the base case. The project case is the practical elaboration of the improvement alternative. The description of the project case must be very specific and must be clearly defined in order to make a credible quantitative risk and cost analysis, and subsequent cost-benefit trade-off. To identify which costs and benefits are really applicable to the specific base case and project case, it is necessary to define the scope of the analysis that largely depends on the type of stakeholder. Since, each stakeholder has its own interest, this leads to different views on safety and to different ways in which decisions that may affect safety are being made.

There are a number of different stakeholders that could be affected by improvements in air transport safety: • Airlines • Passengers • Air Navigation Service Providers (ANSP) • Airport operators • Regulators / Authorities • Society / Third parties • Aircraft/system manufacturers • Insurers

Benefits will often not be obtained immediately after the introduction of the measure. In the CBA, the trade-off between the costs on the one hand and the benefits of the measure on the other is made over a certain time horizon. The time horizon can vary from project to project and can also depend, for instance, on the type of stakeholder. Airlines are currently operating in a very competitive market where yields are small and budgets are tight. Investments must pay off in a short time. A typical time horizon for airlines may be 5 years. However, when looking at the project from a societal perspective, something an international regulator would do, a quick pay-off of an investment is not necessary and long-term benefits are included in the analysis. Therefore, often a longer time horizon is taken for societal CBAs, for instance 25 years. Risk model In order to assess the impact of certain measures on the level safety, a scenario-based risk model has been developed. The proposed architecture adopted in ASICBA for this model extends conventional risk analysis techniques, based on fault and event trees, by introducing a hybrid causal model of event sequence diagrams, fault trees and influence diagrams. An ESD is a flow chart with paths leading to different end states. Each path through the flowchart is a scenario.

R. Picardi, M. Brunetti, C. Terranova

196 Aerotecnica Missili e Spazio Vol. 86 4/2007

Along each path, pivotal events are identified as either occurring or not occurring. The event sequence starts with an initiating event, such as a perturbation that requires some kind of response from operators or pilots or one of more systems.

Figure 2: Structure of a generic Event Sequence Diagram

The ESD represents possible paths in which the effects of an initiating disturbance are handled by the aviation system, where some paths lead to accidents, while others lead to successful mitigations. A safety improvement is represented in the model by a reduced probability of the occurrence of an accident end state. Thirty-one generic accident scenarios have been identified describing among others: • Controlled Flight Into Terrain (CFIT), • loss of control, • mid-air collision, • collision on ground; and • structural failure.

Initially the building blocks of the scenarios are kept broad and generic to cover many ‘similar’ situations. The possible causes and contributing factors of these events are not directly of interest at the scenario level; they are added by means of fault trees and influence diagrams. For each ESD, probabilities for the initiating events and pivotal events have been derived using the NLR Air Safety Database.

This database contains information about western-built jets and turboprops involved in commercial operation and the timeframe under consideration focussed on 1985 – 2005. Generally speaking, the accident and incident databases have been used mainly to quantify the right-hand side of the ESDs (the end states) and the operational data to quantify the left-hand side of the ESDs (starting with the initiating events). The probabilities that have been derived are incorporated as default values in the risk and cost database that is used to obtain the results. The effect of a safety measure on the accident probability is determined by estimating the effect of the measure on the likelihood of occurrence of the initiating events and/or the pivotal events. This will then result in a change in likelihood of the end states. Cost model The next step in the approach is to link the risk model to the cost model. That is possible because each ESD in the risk model terminates in end states that describe the consequences of the series of events. Therefore, for each end state an impact vector is determined that indicates the magnitude of the consequences on all actors involved. They have been defined: Direct • Aircraft • Occupants • Operation of aircraft involved

Indirect • Other airlines/aircraft • Airport • Third party

The severity of the impact is indicated by a number ranging from 0 (no impact) to 4 (maximum impact).

R. Picardi, M. Brunetti, C. Terranova

Aerotecnica Missili e Spazio Vol. 86 4/2007 197

Direct

Aircraft Occupants Operation

aircraft involved

4

>75% damage (beyond

economical repair)

=>80% killed or seriously injured.

>4hrs delay (Flight

aborted)

3 50% damage 40 % killed or seriously

injured (i.e. 10 to 80%)

2 hrs < delay < 4 hrs

2 15% damage 5% killed or seriously

injured (i.e. 1 to 10%)

30min < delay < 2hour

1 1% damage <1% killed (and/or <5%

seriously injured) 15min < delay

< 30min

0 No Impact

No impact (no fatalities or seriously injured but could have a few minor injuries

No Impact (less than

15min delay)

Figure 3a: Direct group of actors

Indirect

Other airlines Airport Third party

4 Many flights cancelled

Airport closed for 12 hours and runway closed

for 10 days

>10 killed or seriously injured

3 Many delays Airport closed for 2

hours and runway closed for 2 days

1 <= killed or seriously injured <

10

2 Less than many delays

Airport closed for 30 minutes and runway closed for 12 hours

Some property damage and/or minor injuries

1 Little delays Runway closed for 3 hours

Some property damage

0 No Impact No Impact No Impact

Figure3b: Indirect group of actors

The severity levels for the different groups can be independent. To assess the costs related to accidents, for each of the groups of actors, 24 relevant heads of costs have been identified. Each group is associated with one or more heads of costs. Next, for each severity level for such a group, the costs are determined.

Figure 4: Aircraft related cost for the different severity level

Finally, the estimated costs are allocated to stakeholders. Not all accident costs are borne by the same stakeholder. In order to assess the viability of a safety measure for one particular stakeholder only those costs have to be taken into account that are relevant for this stakeholder like airline, passengers, airport operator, regulator, etc. CBA Computation The risk model provides an accident likelihood and severity (impact vector) both before and after the application of the safety measure; also, for each “Impact Vector”, the associated accident costs are calculated. It is possible to express the effect of the safety measure in monetary terms by multiplying the difference between the step with the safety measure applied and the one without that. This can be considered the safety value of the measure, and it is a benefit in the CBA calculation. The safety value is combined with the other required inputs (such as the investments costs of the safety measure, as well as operational costs and potential operational benefits) for the CBA calculation. These other inputs are not predetermined in the model, so it is necessary that the user provides them during the approach. With these inputs, the final calculation can be made. In the CBA the trade-off between the costs on the one hand and the benefits of the measure on the other hand is made over this time frame. The outcome is expressed in terms of the internal rate of return or the benefit to cost ratio. Decision Support System The DSS is the final product of ASICBA project. It is an Decision Support System that, using a friendly graphical interface Flash® based, guides the user through the different steps necessary to assess the cost effectiveness of safety measures. The tool is provided in the form of an Electronic Handbook which incorporates a data

R. Picardi, M. Brunetti, C. Terranova

198 Aerotecnica Missili e Spazio Vol. 86 4/2007

pool to assist in the estimation of costs, benefits and risk reduction arising from the implementation of specific safety measures. The DSS has been designed to respond to the needs of all aviation stakeholders while also having the flexibility to enable individual stakeholders to apply it in their own, perhaps more limited, specific situations. At first, the user has to answer to some questions, submitted by the system, in order to identify his effective needs and thereby to reduce the number of possible risk and cost models to be analyzed to just those which are thought to be relevant to his specific problem. To the user is then given the opportunity to review the various default values used in the models and replace them with values which might be more applicable to the user's specific case. Finally the DSS provides the user with a Microsoft Excel® report that contains all data - either default or specified by the user - and formulas used to calculate the final results. Conclusions In ASICBA project, the approach adopted is that safety effects can be expressed in monetary terms, and thus can be compared with the associated costs of safety measures. The safety effect in monetary terms can be considered the safety value (benefit) of the measure. Combined with other costs and benefits, like investment costs, operational costs and operational benefits, the CBA calculation can be made. Hence, the economical viability of introducing a safety measure is determined, which serves as one of the inputs in the decision-making process. The DSS, developed in ASICBA project, is a very useful instrument for all stakeholders to carry out a cost-benefit analysis that includes the safety effects. The tool contains a broad set of default values, which are subject to change as the user sees fit, e.g. for customising to its own specific situation. The tool has been designed to be easily useable by people who are not a

computer expert and, with its simple interface, guides the user through the various steps of conducting a cost benefit analysis. ASICBA consortium hopes that this tool could be used every time it is necessary to decide about safety investments, offering additional information for better informed decision making. References 1. ASICBA (J.W. Smeltink, A.L.C. Roelen, R. Piers, R. Lebouille

and P. Hayes), A method for assessing safety improving measures, Deliverable D3.1, NLR-WP 3- D3.1 to appear.

2. ASICBA (A. Perassi, E. Noce and S. Genta) DSS Users Guide, Deliverable D4.4, DAPP-WP 4-D44 V0.1.

3. ASICBA (R. Piers, R. Lebouille, J.W. Smeltink, A.L.C. Roelen, R. Picardi and C. Terranova), Synthesis of the results issued from the 1st workshop series, Deliverable D5.1, ECORYS-WP 5- D5.1 v3.0, January 2006.

4. ASICBA (R. Piers, R. Lebouille, J.W. Smeltink and A.L.C. Roelen), Synthesis of the results issued from the 2nd workshop series, Deliverable D5.2, ECORYS-WP 5- D5.2 v1.0.

5. ASICBA (R. Piers, R. Lebouille, P.Hayes, J.W. Smeltink A.L.C. Roelen,A. Perassi, E. Noce, M Brunetti and C. Terranova), Database of risks and costs, Deliverable D5.3, ECORYS-WP 5- D53 V0.1.

6. R.Piers, R. Lebouille, A. Roelen and J. Smelting, Safety has Value! An approach for the assessment of he costs and benefits of safety measures, Presented at ICRAT conference by R. Piers for ECORYS.

7. www.asicba.org .

R. Picardi, M. Brunetti, C. Terranova

Aerotecnica Missili e Spazio Vol. 86 4/2007 199