599
1 INTRODUCTION
Transport trafficsafety is one of the most important
goals of organization, management and supervision
systemsindifferentmodesoftransport.Proposalsfor
new organizational and technical solutions are often
the result of the analysis of the causes and
circumstances of accidents, especially the most
serious, which resulted
in numerous fatalities.
Examplesofmajortransportaccidentsthatresultedin
key changes in safety perception were: an air traffic
accident in Tenerife in 1977 (Netherlands Aviation
Safety Board 1978), the Estonia ferry disaster in the
Baltic Sea (Joint Accident Investigation Commission
1997),catastropheofSenegaleseferryMVLeJoola
off
the coast of Gambia (Republique du Senegal 2002),
thetraindisasterinUfanearChelyabinskinRussiain
1989 (Surhone et al. 2010), aircraft collision over
Überlingen(Brooker2008).Anexampleofasolution
resultingfromthe last of these cases was systematic
and comprehensive regulation of the use of
traffic
collision avoidance systems for aviation TCAS
(Federal Aviation Administration 2011). A major
change introduced into procedures was the rule of
absolutesubordinationtothecommunicatesofTCAS
system, even in the case of different air traffic
controllercommand.
Accidents investigation is usually conducted in
termsofsearchingforthe
reasonsandcircumstances
favourabletotheseevents.Thesestudiesarecarried
outwithintheexistingorganizationalstructuresthat
make use of well‐established and legally sanctioned
methods and procedures. They are directed at
determining the causes of accidents and to make
preventiverecommendationsaimedtoeliminatethese
causes, and indirectly prevent
the formation of
analogouseventsinthefuture.
In transport, there are numerous safety barriers
established‐technical, procedural, organizational,
Method of Serious Traffic Incidents Analysis with the
Use of Stochastic Timed Petri Nets
J
.Skorupski
WarsawUniversityofTechnology,FacultyofTransport,Poland
ABSTRACT:Oneoftheprimarysourcesofin
f
ormationandinspirationinthecreationofnew,moresecure
solutions in traffic organization are the occurrences with most serious consequences called accidents (air),
serious accidents (rail) or catastrophes (road, sea). Accidents investigation is usually conducted in terms of
searchingforthereasonsoftheseevents and to make preventive recommendations
aimedateliminationof
thesecauses.Inthispaper,itisproposedtodrawmoreattentiontotheeventsofsomewhatlessseverityofthe
consequences‐serious incidents (air), traffic conflicts (road) and incidents (rail, maritime). A model of real
serioustrafficincident,createdwiththeuseofstochastic,timed
Petrinetsispresented.Simulationexperiments
werecarriedout,whichallowedfordeterminationoftheprobabilityoftransformationoftheincidentintothe
accident.Theproposedmethodofanalyzingserioustrafficincidentsalsoallowstodeterminetheeffectiveness
ofthebarriersthathavepreventedanaccidentinarealoccurrence.
http://www.transnav.eu
the International Journal
on Marine Navigation
and Safety of Sea Transportation
Volume 7
Number 4
December 2013
DOI:10.12716/1001.07.04.16
600
management‐in order to prevent accidents with
catastrophicconsequences.Inthispaperamethodof
traffic incidents analysis is proposed. Of course,
incidents(seriousincidents)arealsoexaminedbythe
aforementioned institutions. This examination,
however, as in the case of accidents is focused on
searching for reasons. Analysis of the
incidents,
however, also allows for exploration of possible
scenarios for the development of the incident and
checkingwhatothereffectsitcouldbringabout.This
approachallowsevaluatingandverifyingwhetherin
thisparticularcase,notransformationoftheincident
into accident was the result of hedging activities, or
whether
it was a coincidence. In the latter case one
shouldsuggestpreventiverecommendationsrelating
totheseeventsthatdidnotactuallyoccurred.Inother
words,itcomestothebeliefthatsetupsafetybarriers
will work forever. Also in slightly different
circumstances, such as worse weather conditions, or
worsetechnical
conditionofthevehicle,etc.Thefact
that safety barrier worked in a particular incident
does not give us a guarantee that it will be in any
case.
In this paper it is proposed to analyze serious
incidents quantitatively. The proposed approach is
illustrated in the example of air traffic.
The term
ʺserious air traffic incidentʺ usually involves a very
dangerous event in which almost all barriers to
protect against accidents have failed (in most cases
except one). This allows to attempt to quantify the
likelihood of failure of each of the elements of the
safetyassurancesystem.Unfortunately,in
mostcases,
we do not have enough data that allows for a
statistical determination of the frequency of events
thatmakeuptheaccidentscenarios.Therearealsono
measurement methods that can achieve such data.
This is due to two reasons. The first is the
extraordinary rarity of these events,
and, until
recently, a lack of public awareness of the need to
report events of less important safety consequences.
The second reason is very frequent participation of
thesocalledhumanfactorintheseevents(Kobyliński
2009).Analysisoftheprobabilityofparticularhuman
action or the probability of
human error is very
uncertain and subjective. The only available method
ofobtainingrealknowledgeaboutsucheventsisthe
use of experts’ opinions. These, obviously, are
characterized by a lack of precision and clarity not
allowingtheuseofsuchmethodsintheprobabilistic
analysis(Berg2013).
This paper is
divided into five sections. The first
containstheintroductiontotheresearchproblem.The
secondpartdealswiththeprinciplesandpracticeof
investigating the causes of aviation accidents. The
third section shows the process of formation of a
serious incident and the essence of traffic incident
analysis focused on
searching for the quantitative
assessmentoftheeffectivenessofthesafetybarriers.
The fourth presents a simple example of a serious
incidentanalysis,explainingthemethodofanalysisof
the effectiveness of safety barriers. The fifth section
containssummaryandpresentationofthefindingsof
theresearch.
This paper is an
updated and revised version of
(Skorupski 2013). The update takes into account
recentactivitiesandinsightsregardingpossibilitiesto
use stochastic, timed Petri nets in serious traffic
incidents analysis. Moreover, it reflects questions
which arise at the TransNav 2013 Conference in
GdyniainJunethisyear.
2 AIRTRAFFICACCIDENTS
ANDINCIDENTS
INVESTIGATION
Polishaviationregulations define threecategoriesof
events(AviationLaw2002):
accident‐an event associated with the operation
of the aircraft, which occurred in the presence of
people on board, during which any person has
sufferedatleastofseriousinjuriesoraircraftwas
damaged,
serious
incident‐anincidentwhosecircumstances
indicatethattherewasalmostanaccident(suchas
a significant violation of the separation between
aircraft, without the control of the situation both
bythepilotoftheaircraftandthecontroller),
incident‐aneventassociatedwiththeoperationof
an aircraft other
than an accident, which would
adversely affect the safety of operation (e.g. a
violationofseparation,butwiththecontrolofthe
situation).
Airtrafficeventsinvestigationisregulatedbothby
international and national regulations: Annex 13 to
the Chicago Convention (ICAO 2001) and EU
Regulation 996/2010 on the investigation and
prevention of accidents in civil aviation (European
Union 2010). These documents define the basic
principles of accidents and incidents investigations,
whichinclude:
keyroleofEASA,
cooperation between committees investigating
accidentsindifferentcountries,
theabsoluteneedforreportingincidents,
recommendationsforaccidentprevention.
The basic
legal act of national importance
ʺAviationLawʺinPartVIʺAirNavigationʺinChapter
3,ʺManaging the flight safety and investigating
accidents and incidentsʺ regulates the operation of
accident investigation committee (Aviation Law
2002). Detailed rules of proceeding are defined in
Regulationofthe MinisterofTransporton accidents
and
incidents(MinisterofTransport2007).
In recent years, much emphasis is put on a
proactive approach to ensuring the safety of air
traffic.Itisbasedonpreventivereportingofdamages
and failures, which is obligatory to those who have
theabilitytodetectthembeforetheycausedangerous
trafficevent.
However,formanyyears themostimportantand
the most seriously considered are the
recommendationsissuedbytheStateCommissionfor
AircraftAccidentInvestigation(PKBWL)asaresultof
the study of the reasons for air events. The PKBWL
consist of: chairman, two deputy, secretary and
members‐expertsinthe
fieldofaviationlaw,flight
training,airtraffic,aviationtechnologymaintenance,
aircraftconstruction,andaviationmedicine. Insome
cases additional assistance of experts is necessary,
both from the above mentioned areas and from the
field of navigation, rescue, meteorology and
aeronauticalcommunications.
601
Generally an air traffic event examination
procedurebeginswiththenotificationtotheaccident
investigation committee. Then the chairman of the
committee shall qualify the event by severity of its
effects. Accidents and serious incidents are
investigated by PKBWL. Incidents and other events
(such as damages or defects detected) examination
maybeprovidedbytheuserofaircraft,airnavigation
servicesprovider,airportmanagement.
The basic principle of PKBWL operation is to
improve the safety of air transport, rather than find
andpunishtheguilty.Forthisreason,theregulations
specifythepurposeoftheCommission,statingthatit
does
not adjudicate the guilt and responsibility. At
the same time law guarantees full security and
freedomoftestimonyforallpeopleco‐operatingwith
the Commission (including the participants of the
event),byintroducingaclausethatthereleaseofthe
results of Commission’s investigation can be made
only with the
consent of the court. And the court
whiledecidingwhether to releasetheresultsshould
take into account whether such making information
public is more important than the negative
consequences that may result for the air transport
safety.Additionalprotectionisgrantedtomembersof
theCommission,whichmustnot
bequestionedas a
witnessastothefactswhichmightrevealtheresults
ofinvestigation.
All these factors make the study of the causes of
airevents,carriedoutinaccordancewiththerigorsof
thislegislation,anextremelyeffectivewaytodiscover
the mechanisms that lead to accidents. Preventive
recommendations lead to the elimination of these
mechanisms and thereby reduce the number of
events.
However,analysisofCommissionʹsreportsshows
thattheserecommendationsarefocusedonthecauses
andcircumstancesleadingtotheevent.Inthecaseof
incidents and serious incidents it is implicitly
assumed that organizational,
technical and human
barriers which worked properly and prevented the
development of incident into accident, will work
properlyinothersimilarsituations.Thisassumption
may not be true. One can identify many cases of
similar incidents in which a barrier in one of them
worked, and in another did not. Analysis
of the
effectiveness of these key barriers in air traffic
incidents enables the quantitative assessment, which
isverydifficultusingothermethods.
3 ANALYSISOFAIRTRAFFICINCIDENTS
As mentioned in previous sections, this paper
proposesananalysisofseriousincidentsnotonlyin
terms of reasons of their occurrence,
but rather the
probability of their transformation into an accident
withconsequencesoflossoflifeorseriousdamageto
equipment.In(Skorupski2012a)amodel(intheform
of Petri net (Jensen 1997)) of conversion of incident
into accident was presented. The actual incident
occurred at Chopin Airport in Warsaw,
where a
simultaneous takeoff of two aircraft on two
intersecting runways occurred. Fault tree of this
incidentisshowninFigure1.
Figure1.Faulttreeofseriousincident344/07.
In this tree, we can distinguish the events that
make up the incident. The most important are:
occupyingatthesametimetwointersectingrunways
(events1and2inFigure1)andthekeyeventforthe
creationofanincident‐acceptationbytheB737crew,
clearancefortakeoffissued
tootheraircraft(event3).
Qualitative analysis of this event was performed by
PKBWL. It should be noted it is not involved in
quantitative analysis, which means that it does not
consider how the proposed preventive
recommendations reduce the likelihood of an
accident. They are looking for such events (actions,
omissions, organizational errors etc.), which
eliminationwouldbreak thecausalsequenceleading
totheincident.
From the point of view of the method of serious
incidentsanalysis,asproposedinthispaper,themost
importanteventismarkedbynumber4inFigure1.It
represents the most important safety barrier,
which
protectedbeforetheaccident (Lower et al. 2013b).It
turns out that preventive action aimed at the
eliminationofthepossibilityofbreakingthisbarrier
movestheevaluationofprobabilityofaccidentsinto
theareaofvery rarevalues.Accordingtoprobability
scale used in this paper it means
reduction of
incident‐accidenttransformationprobability toabout
10
‐7
.Thismeansasignificant increase in the level of
safety.Elimination(orreductionofthelikelihood)of
the barrier breaking is practically possible. Pilot
training should be carried out to increase the
convictionoftheneedtomonitortheairfieldduring
the taxiing procedure and while waiting for
permission to
take‐off. One can also consider the
introductionofrecommendationtocarefullyobserve
other traffic into the operating instructions. Usually,
thereareseveralscenarios that lead to the failureof
all barriers. These scenarios can be analyzed using
eventtreemethod(ETA).Anexampleoftheanalysis
is presented in
(Lower et al. 2013a). This analysis
allows to determine the probability of conversion of
the incident in the accident, but also to quantify the
effectivenessofthebarrier.Inthecaseofhighriskof
breakingthebarrier,proposeofpreventivemeasures
in relation to the events that have played a
positive
role in preventing the accident should be also
considered. In this case, those measures should be
based on strengthening the effectiveness of the
barrier. This is a novel approach, but it seems
appropriateandeffective.Itmaygivebetterresultsin
prevention than the standard prophylactic
recommendation for reasons
of incidents. Especially
B737stops
B737interrupts
take
‐
off
ATCorders
to stop take
‐
ATC
not
FD
warns
ATR
warns
FD
accepts
4.ATR
sees
B737take‐
off phase I
B767take‐
off phase I
2.B767at
RWY 33
Clearancefor
B767 to take
‐
off
1.B737at
RWY 29
3.B767
clearance
B767
interrupts
B767
hears
B767stops
602
as one can learn the quantitative characteristics
(probability)characterizingsuchevents.
Speaking about the risk of breaking the safety
barrier one should understood the combination of
probabilityofbreakingitandpossibleconsequences.
We can determine the probability by event tree
analysis.Determiningtheconsequences may require
further analysis of
aircraft movements dynamics or
use of other methods to estimate the effects of an
accident, for example evaluation by experts
(Hanninenetal.2012).
4 EXAMPLEOFTRAFFICINCIDENTANALYSIS
In this section serious air traffic incident will be
presentedandanalyzedwiththeuseofPetrinets.The
incident
happened at Chopin airport in Warsaw. A
method described in (Skorupski 2012b) was used
duringanalysis.
4.1 Thecourseand thecircumstancesoftheincident
AnexampleconcernstheincidentNo.291/05,which
tookplaceinwinterconditions,on31December2005
(CivilAviationAuthority,2008).Therewasonlyone
aircraft
involved‐Boeing757‐200(B757).Duringthe
take‐offoperation,inaccelerationphase,thecrewfelt
a sudden shudder to the left and immediately
performed a rejected take‐off procedure. The
maximum velocity of the aircraft was 70 knots. The
crew of another aircraft, waiting for permission to
take‐off,
reported by the radio that they can see
flamesintheleftengineofB757.
Afterdiscontinuationofthetake‐off,theplanehas
beensurveyed.Nodamageswerefound.Enginetest
has also been performed. Its operating parameters
were consistent with the standard, resulting in the
crewfoundthatthe
engineisworkingproperly.The
crewreportedtobereadytotake‐offagain.Duetothe
large number of operations on that day, expected
waitingtimeforpermissiontotaxiwas45minutes.In
this situation, captain made a consultation with an
experienced mechanic, after which he decided to
canceltheflight.Asaresultofthisdecision,theplane
was suspended in operation and two days later a
detailed borescope study of left engine was made.
Borescopes are commonly used in the visual
inspection of aircraft engines, aeroderivative
industrialgasturbines,steamturbines,dieselengines
andgenerallyincases
wheretheareatobeinspected
isinaccessiblebyothermeans.Theinspectionshowed
serious damage to the compressor blades, which
excludedfurtheruseofthisengine.
The period of suspension in operation of the
aircraftwasusedtocarryoutthesurveyoftheright
engine,whichdidnot
showanyirregularitiessofar.
During the survey serious damages to the right
enginecompressorbladeswerealsofound.Theywere
of the same nature as in the left engine. This
precluded also the right engine from further
operation.
4.2 Thecausesoftheevent
PKBWL investigated this event and determined
that
the most likely cause of the incident was a collision
withaforeignobjectofasoftnature,pulledintoboth
engines during the take‐off operation. As a result,
therewasa densityshock,local airdensityincrease,
causingoverloadandbreakageoftherotorbladesin
both
engines. Contributing factors to the creation of
suchasituationwere:winterweatherandrelease of
the parking brake while switching aircraft’s thrust
automaton, which increases the likelihood of snow
andicetobesuckedintotheengine.
4.3 Analysisofthecausesoftheeventandactivitiesofthe
Commission
Asalwaysinsuchcases,PKBWLwasfocusedonthe
causes of the incident. The Commissionʹs report
shows that its actions were in full effect. The cause
wasaspirationofsnowduringtake‐off.Commission
adopted, as always in such situations, preventive
recommendations.Theyconsistedof:
recommendationto
usetheinformationaboutthe
circumstancesofthiseventforpilotsandtechnical
crewtraining,aswellasthepersonnelresponsible
forthewintermaintenanceattheairport,
considerationofthepossibility tochangeinternal
procedures and equipment to improve winter
maintenanceoftheairport,
considerationtoimproveprocedures
ofreporting
technical problems, and their removal by the
technicalstaffofthecarrier.
As one can see, preventive recommendations are
focusedmainlyontheeliminationofeventsthatled
totheincident.Inthiscase,toeliminatethepossibility
of aspiration of snow into the engine. It should be
noted,however,thateventsaffectingthesafetyofthe
travellingpassengers,tookplacealsointhecockpitof
theB757andduringtechnicalinspection.Ananalysis
oftheincident,alongwiththemodeloftransforming
itintoanaccident,usingPetrinetsispresentedbelow.
4.4 Modelofincident
The process
of transformation of analyzed incident
intoaccidentcanbemodelledwithPetrinet:
(1)
where:
P–setofplaces,
T–setoftransitions,
,
I,O,arefunctionsrespectivelyofinputandoutput:
I,O:T→B(P),whereB(P)isthemultisetovertheset
P, and functions I, O are determined for transition
Tt
as:
–inputsetoftransitiont,
–outputsetoftransitiont,
603
–initialmarking,
– delay function, specifying static
delayτ(t)oftransitiontmovingtokenstopla cep,
–randomvariable,describingrandom
time of realization of traffic event (transition) t
leadingtotrafficsituation(place)p,
Г–nonempty,finitesetofcolours,
C–functiondetermining whatcolourtokenscan be
storedinagivenplace:
: ΓCP
,
G – function defining the conditions that must be
satisfiedforthetransition,beforeitcanbefired; these
are theexpressions containing varia bles belonging
toГ,forwhichtheevaluationcanbemade,givingas
aresultaBooleanvalue,
E – function describing the so‐called weight of
arcs,
i.e. expressions containing variables of types
belongingtoГ,forwhichtheevaluationcanbemade,
giving as a result a multiset over the type of colour
assignedtoaplacethatisatthebeginningortheend
ofthearc,
R–setoftimestamps(alsocalled
timepoints),closed
undertheoperationofaddition
R R
,
r0–initialtime,
rR
.
Petri net model of this incident is shown in
Fig. 2.
dt
dt
dt
dt
dt
dt
()
dt
dt
dt
dt
dt
ACK
WAIT
@+(51*1440)
INSP
WAIT
@+3000
INSP
R
INSP
L
@+200
MECH
@+3
ATC
@+45
INSP
RDY RL
INT
INSP
RDY L
INT
SAFE
UNIT
T_INSP
INT
SUSP
INT
TTS
INT
RFTO
1@0
INT
1 1`1@0
Figure2.Basicmodelofairtrafficincident291/05
Thismodelallowstracingthecourseoftheactual
incident,withouttakingintoaccountothereventsthat
couldchangeit.Parametersofthemodelpresentedin
Figure 2 reflect of both the static and dynamic
phenomenaoccurringintheanalysedincident.
Designationofplacesisasfollows:
RFTO‐aircraftready
fortakeoff(p1),
TTS‐aircraftcrewknowsthetimetobeginningof
taxiingprocess(p
2),
SUSP‐aircraftuseissuspended untilleftengine
borescopesinspection(p
3),
INSP RDY L‐aircraft is ready for left engine
borescopesinspection(p
4),
T_INSP‐aircraft starts waiting for admission to
flight(p
5),
INSP RDY R‐aircraft is ready for right engine
inspection(p
6),
SAFE‐there is no takeoff before detection of
failuresinbothengines(p
7).
Designationsoftransitionsareasfollows:
ATC‐controller’sdecisiontowaitfortaxiing(t
1),
MECH‐consultation with an experienced
mechanic(t
2),
INSPWAIT‐waitingfortheborescopesinspection
oftheleftengine(t
3),
INSPL‐leftengineborescopeexamination(t
4),
ACKWAIT‐waitingforauthorizationtousethe
aircraft(t
5),
INSPR‐rightengineinspection(t
6).
4.5 Simulationexperiments
By using CPN‐Tools software package‐a tool for
creationandsimulationofmodelsusingPetrinets,a
number of simulation experiments were conducted.
Theirgoalwasto:
find the probability of transformation of the
incidentintoaccident,wheremanyelementsofthe
model were treated
as random values, but with
expected values equal to those actually observed
intheincident,
seek the barrier, which appropriate functioning
haspreventedthecreationofanairaccident,and
which caused that in fact only a serious incident
occurred.
Theplanofexperimentsassumedmodificationof
the model
resulting from scenarios of conversion of
theincidentintoanaccident.Thefollowingscenarios
wereconsidered:
1 Thereisasmalltrafficattheairport‐inthiscase
the time necessary to begin taxiing at the second
attempttotake‐off wouldbesmallandthecaptain
would have decided to
begin the take‐off
procedureinsteadofconsultingthesituationwith
themechanic.
2 The captain does not choose to consult the
problem with an experienced mechanic‐being
sure that the positive results of left engine
inspectionensuresafety.
3 Rightenginesurveyisnotperformed‐incase of
quick
repairoftheleftengine.
Toperformanalysisoftheabovescenarios,itwas
necessarytomodifythebasicmodelinsuchawayas
totakeintoaccounttheprobabilityofeachevent,and
to reproduce a random durations of events. Both
groups of values have the large impact on
the
probability of conversion from the incident into an
accident.Petrinetforexaminationofscenarios1to3
isshowninFigure3.
604
0
0
0
0
0
0
()
0
0
0@+expTime(60)
@+(2*1440)
@+200
@+3
SAM
SAM
UNIT
SAM
SAM
SAM
SAM
0
0
SUSP
INSP
WAIT
INSP
RDY L
INSP
L
@+(rnd(30)*1440)
intTime()>30*1440
0
UNIT
()
pr>=10
@+3
SAM
PR.ran()
intTime()>20
pr<10
@+3
pr
UNIT
()
pr
0
MECH
intTime()<=20
()
RFTO
ATC
TTS
LONG
CONS
NO
CONS
FATAL
Fusion 1Fusion 1
NO
MECH
T_INSP
ACK
WAIT
INSP
RDY RL
INSP
R
NO
INSP R
FATAL
Fusion 1Fusion 1
SAFE
intTime()<=30*1440
10000` 0@0
10000 10000`0@0
Figure3.Modelofairtrafficincident291/05foranalysisof
transformationofincidentintoaccident.
ComparedtoFigure2therearenewplacesinthis
model:
CONS‐pilotisconsideringtheconsultationwitha
mechanic(p
8),
FATAL‐take‐off with inoperative engine was
performed,whichwouldbelikelytoresultinan
accident(p
9),
Therearealsoadditionaltransitions:
NO MECH‐pilot decides to begin the second
take‐off without consulting the situation with a
mechanic, because of short waiting time to begin
taxing(t
7)
LONG‐recognitionofthetaxiwaitingtimetobe
long,thatmakesthepilottoconsiderthedecision
toundertakeconsultationswiththemechanic(t
8),
NO CONS‐captain decides not to take the
consultationwiththemechanic(t
9),
NO INSP R‐decision not to examine the right
engineduetothe short waitingtime fordecision
allowingtheuseofanaircraft(t
10).
Analysis of a simple event tree aimed at
determinationofprobabilities of theabovescenarios
indicatesthatthetotalprobabilityoftakingoffwitha
damagedenginecanbedescribedbytheequation:
(2)
where
P
a, Pb and Pc are the probabilities of the scenarios,
respectively1,2and3.
Aftertransformationweobtain
(3)
Assumingthatthesecondattemptoftake‐offwith
severelydamagedoneortwoengineswouldcausean
accident,formula(3)isalsoa formulafordetermining
the likelihood that analyzed incident becomes an
accident.
Simulation experiments required modification of
themodelshowninFigure3inthefollowingway
1 Modification of function describing an arc
between transition t1 (ATC), and the place p2
(TTS). The parameter of function expTime
appearing in this expression, determines the
expectedtime,afterwhichthebeginningoftaxiing
for take‐off is possible. In the case of very low
traffic,thistimewillbecloseto0;
otherwiseitcan
reachvaluesgreaterthan60minutes.
2 Probability of consulting the decision with a
mechanic is modelled using PR.ran function that
generatesarandomvalueuniformlydistributedin
the range [0..100]; it can be identified with the
values of probability. Depending on the value of
generatedrandomvariable
pr,whichisthelabelof
theoutputarcsfromplacep8(CONS),thevalues
of function G for arguments t2 (MECH) and t9
(NO_CONS) determine the probability of
consultationwithamechanic(transitiont2MECH)
ornoconsultation(transitionst9NO_CONS).
3 Time of suspension in service of the
aircraft is
represented by the value of function
X(ACK_WAIT, INSP_RDY_R). Function rnd
appearing in this expression determines the
random duration of the aircraft remaining in the
suspension, expressed in number of days. This
random variable is described with a Poisson
distributionwithaparameterwhichisalsothernd
functionparameter.
Theresultsofthe10,000simulationrunsshowthat
at accepted values of probability and time constants
of the dynamic analysis, the likelihood of
continuationofairplaneoperationwithatleastoneof
the engines being defective is 0.62. It should be
assumed that such an event would end in
the
destructionoftheengineduringthenexttake‐off,and
this would result in the inevitable accident with
catastrophic consequences. It is therefore the
probability of converting the incident into accident
determined by simulation, at random values
characterizing the events in the formation of the
incident. It was adopted that
the expected values of
random variables characterizing the dynamic events
(in time domain) are equal to the values observed
duringtheactualincident.
Sensitivityanalysisofthelikelihoodofconversion
of the incident into accident, according to the
application of additional measures (in an ad hoc or
systemic manner) to
eliminate specific threats
(scenarios) was also conducted. For example, the
relationship between probability P
k and traffic
volumewithcorrespondingtothistimeofwaitingto
begin taxiing (scenario 1) is shown in Figure 4.
Probabilityofconversionoftheincidentintoaccident,
depending on the likelihood of resignation from the
consultationwiththemechanic,whichcorresponds to
a probability of the scenario 2 is
shown in Figure 5.
Dependence of P
k on the waiting time for
authorizationfortheplaneto operate (scenario 3) is
showninFigure6.
605
Figure4.RelationbetweenPkandestimatedtimetobeginof
taxiprocedure.
Figure 5. Relation between Pk and probability of
consultationwiththeexperiencedmechanic.
Figure6.RelationbetweenPkandtimetoendofsuspention.
5 SUMMARYANDCONCLUSIONS
The analysis of scenarios, transforming the incident
intoaccidentclearlyshowsthepotentialofanalyzing
incidentsthatcanbeusedtoimprovetransportsafety.
Cited in Section 3, the analysis of incident 344/07
shows the dependence of the possibility of an
accidentontheactionsofATR
72aircraftwaitingin
linefortake‐off.Itsactivityintheobservationofthe
neighbourhoodareawascrucialtoavoidanaccident.
However,this barrier isnotpermanent. The pilot of
this aircraft could be busy with his own take‐off
procedureandcouldnotobservethesituationon
the
runways.Onemightthenconsidertheintroductionof
suchaprocedural requirement. The analysis of only
thereasonsforsuchanincidentdoesnotresultinthis
kindofsafetyrecommendations.
Thesefindingsareconfirmedbytheanalysisofthe
incident 291/05, which uses different analytical
methodsanddifferenttypes
ofmodelling.According
to the author, this suggests that in many similar
situationsoftrafficincidents, also in other modes of
transport, it is possible to receive interesting and
importantresults.Theessentialcommonelementmay
be a demonstration of effectiveness of the various
barriers aimed at preventing accidents with
catastrophicconsequences.Sampleanalysisresultsfor
thecaseinquestionarepresentedinSection4.
REFERENCES
AviationLaw2012.Actof3July2002,Journal of Laws,No.
130,item.1112.
Berg H.: Human Factors and Safety Culture in Maritime
Safety(revised).TransNav,theInternationalJournalon
Marine Navigation and Safety of Sea Transportation,
Vol.7,No.3,pp.343‐352,2013
Brooker, P. 2008. The
Uberlingen accident: Macro‐level
safetylessons,SafetyScience46(2008),p.1483‐1508.
CivilAviationAuthority2008.StatementNo.7ofPresident
oftheOfficeofCivilAviationfrom24April2008onair
eventNo.291/05,Warsaw.(inPolish)
Joint Accident Investigation Commission of Estonia,
FinlandandSweden1997.Final
reportonthecapsizing
on 28 September 1994 in the Baltic Sea of the ro‐ro
passengervessel,EditaLtd,Helsinki.
Hänninen M., Kujala P., Ylitalo J., Kuronen J.: Estimating
theNumberofTankerCollisionsintheGulfofFinland
in2015. TransNav,the InternationalJournal onMarine
Navigationand
SafetyofSeaTransportation,Vol.6,No.
3,pp.367‐373,2012
Kobylinski, L. 2009. Risk analysis and human factor in
prevention of CRG casualties. TransNav, the
International Journal on Marine Navigation and Safety
ofSeaTransportation,Vol.3,Number4,December2009.
EuropeanUnion2010. Regulation(EU)No996/2010of
the
EuropeanParliament and ofthe Council of 20October
2010 on the investigation and prevention of accidents
and incidents in civil aviation and repealing Directive
94/56/EC, Official Journal of the European Union, L
295/35
Federal Aviation Administration 2011. Introduction to
TCASIIversion7.1,US DepartmentofTransportation,
DOT
HQ‐111358.
International Civil Aviation Organisation 2001. Aircraft
Accident and Incident Investigation, International
StandardsandRecommendedPractices,Annex13tothe
ConventiononInternationalCivilAviation.
Jensen, K. 1997. Coloured Petri Nets. Basic Concepts,
Analysis Methods and Practical Use. Monographs in
TheoreticalComputerScience.SpringerVerlag.
Lower,M.,Magott,J.
&Skorupski,J.2013a.AnalysisofAir
TrafficIncidentswiththeUseofFuzzySets,Reliabilityof
Critical Infrastructure, Proceedings of the XLI Winter
SchoolonReliability,Szczyrk.
Lower, M., Magott, J. & Skorupski, J. 2013b. Air Traffic
Incidents Analysis with the Use of Fuzzy Sets, in: L.
Rutkowskiet
al.(Eds.):ICAISC2013,PartI,LNAI7894,
p.306–317,Springer‐Verlag.
MinisterofTransport2007.Regulationof18thJanuary2007
onaccidentsandincidents,JournalofLaws,No.35,item
225.
606
NetherlandAviationSafetyBoard1978.Finalreportofthe
investigationintotheaccidentwiththecollisionofKLM
flight 4805 and Pan American flight 1736 at Tenerife
airport,ICAOCircular153‐AN/56.Amsterdam.
Republique du Senegal 2002. Raport d’Enquette du
Comission d’Enquette technique sur les causes du
naufrageduJoola.
Dakar.
Skorupski, J. 2012a. Method of analysis of the relation
between serious incident and accident in air traffic,
AdvancesinSafety,ReliabilityandRiskManagement(ISBN
978‐0‐415‐68379‐1), p. 2393‐2401, CRC PressBalkema,
London.
Skorupski, J. 2012b. Modelling of Traffic Incidents in
Transport, TransNav International Journal on Marine
NavigationandSafetyof Sea Transportation,vol.6,No.3,
2012.
Skorupski, J.2013. Traffic IncidentsAnalysis as a Tool for
ImprovementofTransport Safety.in: WeintritA.(ed.):
Navigational Problems. Marine Navigation and Safety
of Sea Transportation, p. 101‐108, CRC Press/Taylor &
FrancisGroup/Balkema,Leiden.
Surhone,L.M.,TimpledonM.T.&MarsekenS.F.2010.Ufa
TrainDisaster,VDMPublishing,2010.
