Night Operation: a successful Hazard

mitigation example in Flight Inspection.

Andrea Gioia is a Captain and the Safety Officer within ENAV S.p.A. Flight Inspection and Validation Department. He
is also a former airline pilot with over 7500 hours of total flight time holding an EASA and a FAA ATPL. His interest in
Safety started during the early phase of his career. He attended several courses including Basic and Advanced Aviation
Safety Management System and Operational Risk Management held by the Italian Flight Safety Committee. He also
attended the 49° Flight Safety Officer Qualification Course held by the Italian Air Force Flight Safety Inspectorate. During
the 2016 IFIS he presented a paper on Safety Management System customized for a Flight Inspection Organization.

Abstract

As traffic in aviation is continuing to increase throughout the world, more and more airports require to perform calibration
at night. This solution is obviously cost-effective from an air traffic management point of view; however, this can be very
challenging for flight inspection organizations.

This paper will explain the risk assessment process followed in one flight inspection organization according to the hazard
identified, the mitigation action taken, and the safety performance indicators chosen. It will describe
Standard Operating Procedures and policies adopted, and training provided on peculiar threats, such as night visual
illusion, laser attack, and fatigue awareness. Even though certain maneuvers, such as the clearance below path check, are
not possible, the majority of the flight check can be performed at night within an acceptable level of safety and with very
little, if any, effect on airport efficiency.

The need for mitigation

On July 7, 2017, about midnight Pacific daylight time, a very experienced crew, flying a perfectly functioning and modern
airplane, was cleared for the FMS bridge visual approach runway 28R at San Francisco International Airport. At 300 ft
above the ground and 0.7 NM from the threshold the crew mentioned seeing lights on the runway and requested
confirmation that the flight was cleared to land, they were just one minute away from what could have been the biggest
accident in the aviation history. The Airbus A320 was, in fact, lined up with Charlie, a taxiway parallel to the landing
runway, and initiated a go around 89 ft above the ground overflying four wide body airplanes that were waiting for
departure on the taxiway. This serious incident is still under investigation however since it already happened it is
reasonably possible that it could happen again under similar or worse circumstances.

Flying during night time is demanding no matter what type of operation is being conducted. However, they are even more
challenging for a flight inspection organization since the airplane has to fly outside the standard routes and possibly lower
than the applicable IFR minima, therefore the associated risks must not be underestimated. Before even starting the risk
assessment process, it is important to evaluate the real needs that may lead to the decision to perform the flight check at
night in lieu of daytime. The first and most obvious reason is the amount of traffic that insist in a specific airport during
the twenty-four hours period. Any delay to commercial air traffic due to flight check ultimately results in a cost for both
the airline and the air navigation service provider. At the same time, the flight inspection mission can be delayed by
scheduled traffic and, as a result, face longer and expensive additional flight time to complete the tasks assigned. As
important as balancing the cost between air traffic management and flight inspection is to find the correct balance between
protection and production of the operations. According to the airport’s schedule the least busy time of the day could be
between two and five in the morning however this is also the worst time of the day when it comes to pilot’s fatigue.
Scheduling the flight check shortly before or after this time interval could result in the best compromise between all needs.
ICAO suggests that safety has to be cost effective, this principle is applicable both to the Safety Management System and
to the Fatigue Risk Management System as they seek to achieve a realistic balance between safety, productivity and costs.
The risk assessment process, in addition to mitigate safety hazards associated to the operations, can be used to find the
best solution between calibration requirements, costs of flight inspection and efficiency of the airport capability.
Risk management

“Safety risk management is a generic term that encompasses the assessment and mitigation of the safety risks of the
consequences of hazards that threaten the capabilities of an organization, to a level as low as reasonably practicable
(ALARP)”. In order to effectively manage safety risks, the organization has to identify both hazards and consequences
related to the specific operation being analyzed and assess the safety risk according to probability and severity. Once the
level of risk has been defined it can be accepted as it is, not accepted or, in most cases, managed or mitigated to a lower
level according to the diagram shown in the picture below.

The Risk Assessment process is an essential part of the Safety Management System and, therefore, should include all
levels of the organization. A brainstorming between all personnel involved can be a good way to initiate a risk assessment
process as different professionalism can help to identify a more complete list of hazards and consequences.
“Brainstorming is an unbounded but facilitated discussion within a group of experts. A facilitator prepares prompts or
issues ahead of the group session and then encourages imaginative thinking and discussion between group members
during the session. The facilitator initiates a thread of discussion and there are no rules as to what is in or out of scope
from the subsequent discussion. All contributions are accepted and recorded and no view is challenged or criticized. This
provides an environment in which the experts feel comfortable in thinking laterally.” Thinking outside the box is essential
to proactively foresee consequences that are not obvious, as a predictive approach to Safety suggests. For example, visual
illusion during night time are not uncommon, laser attack to airplanes have lately become a serious threat to aviation but
what is the probability that a laser attack may lead to a visual illusion? What is the severity of the consequences if these
two undesirable events happen at the same time? In other words, if it does happen that two hazards combine what is the
final risk associated? In order to answer these questions, the assessor can refer to his personal knowledge and experience
to the best of his judgment. Even though this method is normally accepted especially if the assessment is being performed
on very peculiar and uncommon operations, it remains on a personal level. It is highly recommended to research any
outside evidence to support the assessment. A good source of information is obviously the web where it is not only
possible to find regulations and advisory material from National Civil Aviation Authority or Aviation Safety Agencies
but, sometime, researches from different areas of expertise that can match safety hazards related to the assessment.
According to this view, the risk assessment can start from the personal prospective of a group of experts within the
organization, thereafter it should be integrated with as many objective evidences as possible in order to evaluate, with a
quantitative method, different variables that could otherwise be analyzed only on a qualitative level.

Unlike the final outcome of the assessment, which ICAO indicates in the risk assessment matrix, the Safety Management
Manual only requires that “each risk mitigation exercise will need to be documented as necessary. This may be done on
a basic spreadsheet or table for risk mitigation involving non-complex operations, processes or systems. For hazard
identification and risk mitigation involving complex processes, systems or operations, it may be necessary to utilize
customized risk mitigation software to facilitate the documentation process.” There are many tools that can be used both
to keep track of the process and, most important, to facilitate a schematic approach to the assessment. “Bowtie is a visual
tool which effectively depicts risk providing an opportunity to identify and assess the key safety barriers either in place
or lacking between a safety event and an unsafe outcome”.
As shown in the picture above, the first step is obviously to identify the Hazard, in other words, the potential source of
harm. In the Bow-Tie method it is possible to evaluate more than one hazard in the same scheme as long as all of them
lead to the same undesirable event. The center of the “tie” is the top or undesirable event which is defined as the point in
time when the control over the Hazard is lost, it describes the undesired system state. It is important to mention that one
hazard can be related to more than one undesirable event, in which case each event requires a scheme on its own. On the
left side of the scheme there are the threats or safety events that, if not managed with preventive barriers, have the potential
to trigger the undesirable event. “Risk management is about controlling risks. This is done by placing barriers to prevent
certain undesirable events from happening. A control can be any measure taken that acts against some undesirable force
or intention, in order to maintain a desired state. In the Bow-Tie methodology there are preventive or proactive barriers
(on the left side of the Undesirable Event) that prevent the Undesirable Event from happening. There are also corrective
or reactive controls (on the right side of the Undesirable Event) that prevent the Undesirable Event from resulting into
unwanted Outcomes or reduce the consequence severity of the Outcomes.” Choosing the appropriate barrier and
mitigation is not an easy task, they have to be cost effective and easy to be implemented within the company’s procedure.
Sometime barriers may be perceived as an additional task to be performed or, even worse, as an obstacle to operational
procedure; if this is the case, the effectiveness will be totally lost. To focus on the Potential Outcome, the possible
consequences of losing control over the hazard, may be helpful to facilitate the effort needed to prevent an undesirable
event. Safety is a top down process therefore the commitment of the top management of the organization in promoting
the barrier and mitigation needed is essential.

Fatigue Risk Management

Night operations are strictly related to fatigue. ICAO Doc 9966 Manual for the Oversight of Fatigue Management
Approaches defines fatigue as “a physiological state of reduced mental or physical performance capability resulting from
sleep loss, extended wakefulness, circadian phase, and/or workload (mental and/or physical activity) that can impair a
person’s alertness and ability to adequately perform safety related operational duties”. A brief introduction to sleep science
and circadian rhythm is essential to better understand this definition. Sleep is a reversible state in which conscious control
of the brain is absent and processing of sensory information from the environment is minimal. The brain goes “off-line”
to sort and store the day’s experiences and replenish essential systems depleted by waking activities. A complex series of
processes characterized by alternation between two different brain states: non-REM sleep and REM sleep. Non-Rapid
Eye Movement sleep is a type of sleep associated with gradual slowing of electrical activity in the brain. As the brain
waves slowdown in non-REM sleep, they also increase in amplitude, with the activity of large groups of brain cells
(neurons) becoming synchronized. Non-REM sleep is usually divided into four stages, based on the characteristics of the
brainwaves. Stages 1 and 2 represent lighter sleep. Stages 3 and 4 represent deeper sleep and are also known as slow-
wave sleep. On the other hand, Rapid Eye Movement sleep is a type of sleep during which electrical activity of the brain
resembles that during waking. However, from time to time the eyes move around under the closed eyelids — the “rapid
eye movements” — and this is often accompanied by muscle twitches and irregular heart rate and breathing. A normal
night of sleep includes several non-REM/REM cycles that last approximately 90 minutes.
The figure shows on the vertical axis sleep stages and time of the day on the horizontal axis. As non-REM stages increase
in time, the body has a natural tendency to wake up. The best time to leave the bed is when a full cycle is completed and
the transition from light sleep to awake is ideal. Some cellular phone applications use this concept to improve the quality
of sleep. On the opposite, interrupting a sleep cycle will result in a feeling of weariness, if the interruption falls within
stage three or four of a REM cycle the person will probably experience a transient sense of disorientation, grogginess and
performance impairment known as sleep inertia. Reducing the quantity or the quality of sleep, even for a single night,
will have an effect on a crew member performance that should be considered by the organization in scheduling operational
duties. Recovering from a sleep loss may take up to 72 hours: during the first night slow wave sleep is restored, during
the second night REM sleep returns to normality but it takes a third night in order to recover the correct REM/non-REM
cycle. As human being, we are designed to be awake during the day and sleep during the night according to a circadian
body clock, a neural pacemaker in the brain that monitors the day/night cycle via a special light input pathway from the
eyes. Our neurons are rhythmic, generating electrical signals faster during the day than during the night. Unfortunately,
it is not possible to directly measure the electrical activity of the circadian body clock, however core body temperature is
often used as a marker. The daily minimum in core body temperature corresponds to the time in the circadian body clock
cycle when people feel most sleepy and are least able to perform mental and physical tasks. This is sometimes called the
Window of Circadian Low (WOCL), it is a time of high risk for fatigue-related error and usually falls between three to
five a.m. when a person is fully adapted to the local time zone.

“The aviation industry provides one of the safest modes of transportation in the world. Nevertheless, a safety‐critical
industry must actively manage hazards with the potential to impact safety. Fatigue is now acknowledged as a hazard that
predictably degrades various types of human performance and can contribute to aviation accidents or incidents. Fatigue
is inevitable in a 24 / 7 industry because the human brain and body function optimally with unrestricted sleep at night.
Therefore, as fatigue cannot be eliminated, it must be managed.” In order to effectively manage fatigue a tool to ensure
that crew members are sufficiently alert so they can operate to a satisfactory level of performance should be used.
According to its definition, the Fatigue Risk Management System (FRMS) perfectly match this need. FRMS is defined
as: a data-driven means of continuously monitoring and managing fatigue-related safety risks, based upon scientific
principles and knowledge as well as operational experience that aims to ensure relevant personnel are performing at
adequate levels of alertness. It applies principles and processes from Safety Management Systems (SMS) to manage the
risks associated with crew member fatigue. In other words, FRMS and the SMS should be strictly related as they share,
for the most part, the same structure.
The FRMS Policy should clearly define the operator’s commitment and approach to the management of fatigue risk, state
the safety objectives, include an effective safety reporting and identify a clear line of accountability and responsibility for
the management as well as crew members and all other personnel. The documentation of the FRMS includes: the policy,
accountabilities, responsibilities and authorities related to all the processes and procedures, the training programs, the
collected data and the recommendations that may be issued. Scheduled and actual flight times, duty period and rest periods
should be recorded according to National regulations. Both SMS and FRMS rely on the concept of an effective safety
reporting culture, where employees have been trained and are constantly encouraged to report hazards whenever observed
in the operating environment. The Fatigue Risk Management is based on a three-step hazard identification process:
reactive, where reports and internal audits are analyzed for data collection; proactive, based on crew fatigue survey,
available scientific studies and analysis of planned versus actual time worked; predictive, which takes into account factors
that, even if not directly related to flight operations, are known to affect fatigue. Fatigue surveys are a very good source
of information as they are based on the real operational scenario as it is perceived from the employees, they can be
retrospective to investigate past experiences, or prospective where the crew is required to report fatigue across a duty
period. Sometime more than one survey can be offered during the same duty period to investigate how the awareness on
fatigue changes in different times of the shift. The first step to assess how fatigue during night operation in a flight
inspection organization is perceived by the crew is to ask directly to the personnel. Forwarding a questionnaire and
encouraging fatigue reports after real night flight inspection mission has two important benefits. First, as already
discussed, the front line, being directly involved, is the best source of information and, possibly, mitigation action to be
taken. Secondly, meeting people’s needs is essential to promote a positive fatigue risk management within the
organization. The Hazards identified should be assessed according to their probability and severity of the possible
consequences very much like in the SMS. Mitigation strategies will be selected and implemented in accordance. In order
to verify that the FRMS is functioning as intended, a safety assurance process is essential. Performance can be monitored
through Safety Performance Indicators (SPI) that measures the effectiveness of the mitigation taken. Each SPI should be
compared to a target value, within a predetermined time period or number of events, in order to promptly identify and
correct any underestimated risk. An example of SPI within the FRMS can be the number of fatigue reports received within
a six months period, the organization has to decide a target value of acceptability based on the size and operations carried
out. The target value can be changed yearly in order to be more effective, if within the previous year no report was
received the value can be reduced, on the contrary, if the number of reports was significantly higher than the target value
chosen it can be increased, however a revision of the associated risk should be carried out in order to understand if the
mitigation actions were not effective or the target value was erroneously chosen. It is important to mention that the number
of reports can vary according to a number of factors and the maturity of organization’s reporting system and culture, it is
impossible to have a direct correspondence between reports and events however the system is efficient only if it depicts
the reality. A big number of reports can indicate a good safety culture within the organization on the contrary the absence
of reports does not necessarily mean that there are no events, it is possible, yet undesirable, that they are not reported.
Changes within the organization that might affect the FRMS should also be investigated.

A big effort is required at the beginning to implement the FRMS and commence night operation, nevertheless, the process
require to consider any new airport if not any night flight inspection exercise as a change that needs to be assessed. A
periodic review of the system should be carried out in order to identify areas of amelioration and grant a continuous
improvement. The last part of the FRMS refers to promotion, channels used to inform the personnel as well as the
management should be identified and described in detail. A fatigue training program should also be developed based on
the specific needs of the organization. A basic education should include the dynamics of sleep loss and recovery, the
effects of the daily cycle of the circadian body clock, the influence of workload, and the ways in which these factors
interact with operational demands to produce fatigue. It also important to provide information on how to manage personal
fatigue and sleep issues. Training is essential to increase awareness on fatigue and help the crew not to underestimate the
associated risks.

In a small organization, if not in contrast with National regulation and in order to be sustainable, the FRMS could be
included within the SMS. The structure, procedures and records of the FRMS can be contained in a dedicated manual or
added to the SMS manual, as long as this is available to all personnel. A good implementation strategy is to create a
Fatigue Safety Action Group that coordinates fatigue risk management activities. All the FRMS components can be
integrated as a subset of the Safety Management System. The figure below summarizes the basic structure of the FRMS
SAG.
Since fatigue is very hard to be detected and evaluated on a personal level, it is an organization responsibility to clearly
define maximum duty time limits and minimum rest periods adjusting National Regulation to the specific tasks performed.
In particular, pre and post flight operation should be included and standardized in the daily flight duty period. Nutrition
is another important factor in human performance, proper food as well as time to eat should be provided to the crew. In
addition to managing the FRMS, the Fatigue SAG can develop a specific flight time scheme taking into account the
special operation carried out from a flight inspection organization. The number of sectors as well as the number of
approaches should be limited during a night shift and reported in the scheme.

Special training for night operation

Safety barriers will be discussed in more details later on, however there is no doubt that training is the most efficient
barrier above all. In addition to the requirements of the FRMS, a special training customized for flight inspection night
operation should be dispensed to flight crews. Once again training needs can be selected according to the data collected
from the front line, for example many flight inspection operators reported difficulties in reading the numbers from the
flight inspection system computer’s monitor during the night flights. The answer to this problem can be found by
explaining the physiology of the eye and the difference between day and night vision. Innumerable light-sensitive nerves
called “cones” and “rods” are located at the back of the eye or retina, a layer upon which all images are focused. These
nerves connect to the cells of the optic nerve, which transmits messages directly to the brain. The cones are located in the
center of the retina, and the rods are concentrated in a ring around the cones.

The function of the cones is to detect color, details, and faraway objects. The rods function when something is seen out
of the corner of the eye or peripheral vision. They detect objects, particularly those that are moving, but do not give detail
or color—only shades of gray. Both the cones and the rods are used for vision during daylight. Although there is not a
clear-cut division of function, the process of night vision is placed almost entirely on the rods. The rods are distributed in
a band around the cones and do not lie directly behind the pupils, which makes off-center viewing (looking to one side of
an object) important during night flight. During daylight, an object can be seen best by looking directly at it, but at night
there is a blind spot in the center of the field of vision, the night-blind spot. This clearly explains why the flight inspection
operators have a hard time looking directly at the screen. As shown in the picture the night-blind spot increases with
distance, it is important to be aware of this physiological limitation both for the pilots and the operator. To mitigate the
limitations of night vision, the use of a scanning technique that allows lateral view should be trained. Another important
aspect related to night vision is the ability of the eye to adapt at darkness, the pupils need up to ten minutes to enlarge and
increase the capacity of seeing at night, the eye becomes up to one hundred times more sensitive. As a result, it is important
to avoid looking at strong lights as this may cause a temporary blinding effect and select the correct light intensity within
the cockpit. A hazard related to visual impairment, which can cause distraction, blindness and even eye damage is laser
attack. A special training should be provided on preflight and mitigation action to be taken. Avoidance is the key word
so it is important to check aeronautical charts and NOTAMs for permanent laser activity before flight and avoid the direct
exposure to the laser beam if possible. Mitigation procedures should be developed and should include the transfer of the
controls to the non-flying pilot and the immediate interruption of the flight inspection profile, possibly using the autopilot.
An unauthorized illumination of an aircraft by a laser is considered as an aircraft incident and therefore a pilot
experiencing a laser illumination occurrence is required to take a follow-up action through reporting the details of the
incident to the appropriate ATC unit. One last area that should be covered by the training is night visual illusion. There
is a large number of illusion that may occur during the profiles flown in a flight inspection mission. A black-hole approach,
for example, occurs when the landing is made from over water or non-lighted terrain where the runway lights are the only
source of light. Without peripheral visual cues to help, orientation is difficult. The runway can seem out of position (down-
sloping or up-sloping) and in the worst case, results in landing short of the runway. In order to mitigate this risk, the PAPI
should be operative and in use for the runway that is inspected. From the flight inspection operator’s point of view, a dark
night with no outside reference may result in spatial disorientation, in this case not looking outside and referring only to
the flight inspection computer’s moving map can be an acceptable mitigation. Large city can present sometime the
opposite lighting environment, the runway is the weakest source of light. In this case the airport can be hard to be seen
and the PAPI can only be helpful on short final, so a strict adherence to the instruments is essential during all phases.
Another common source of illusion are the roads around the airport, sometime they may be parallel to the landing runway
causing confusion. Also, in this case it is important to rely on the instruments for accurate position awareness.

Night Risk Assessment customized for Flight Inspection

As mentioned at the beginning, flight inspection is normally conducted outside the normal profiles flown by commercial
aircraft therefore a customized risk assessment is required. In addition, not only flight profiles but also every airport may
present different hazards according to the surrounding environment. As a result, every night flight inspection exercise
will require a unique risk assessment for the airport and runway of intended operation. The night risk assessment in the
figure is based on the bow tie methodology adapted on an Excel spreadsheet, in particular every line is actually a bow-tie
of its own. The operational scenario refers to the airport and the Hazard considered is the flight inspection profiles flown
at night for a specific runway, this two information are reported on the top row of the sheet along with the date of the
assessment and the revision number.

The undesirable event is reported in the center column, it can be the loss or the reduction of vertical separation with
obstacles. However, according to the risk matrix, any potential outcome that may lead to a catastrophic outcome will fall
in the intolerable region and therefore must be excluded. The clearance below path for example can only be inspected
during the day, possibly on the positioning flight to the airport. Scenarios that include mountain terrain within the areas
interested by the flight inspection should be carefully evaluated and usually require a day light inspection. In some cases,
an airport will allow night operation only for a specific runway, for example in Milan Malpensa the area south of the
airport is in a valley, very few mitigations are required. On the contrary, the north sector is close to the Alps therefore the
flight inspection will be split in two sectors, one for the localizer coverage during the day and the remaining part during
the night flight. Usually coverage at 17 NM and 25 NM is not a big concern for Air Traffic Control because the airplane
is far from the airport and lower than all other traffic, maneuvers close to the runway are postponed so the safety of the
inspection is granted with little impact on the airport capacity. Barriers are located on the left of the Undesirable Event
and are split in two columns, existing and additional barriers. In addition to specific ones, generic barriers valid for all
night flight inspection should be described in the Operation Manual and in the Standard Operating Procedures. In
particular the OM should describe the rules to be followed: activity at night shall be conducted according IFR; for all the
profiles that are outside the normal containment areas of the published procedures, a visual approach clearance may be
asked by the crew to the relevant ATC Unit in compliance with National Regulation requirements; familiarization with
the airport and surrounding environment is required; a safety assessment involving Flight Operation Post-Holder, Crew
Training Post-Holder, Safety Manager and Standard Office is mandatory; special training tailored on the specific
operational environment shall be dispensed by the Crew Training Department; the standard office will adapt the flight
inspection maneuvers check list according to the barriers and mitigation contained in the risk assessment. In addition, a
list of airports where night flight inspection is prohibited should be included in the Manual. The familiarization
requirement with the airport and surrounding environment can be satisfied by previous experience at the same airport or
by a daylight arrival at the airport if the weather conditions grant an environment assessment of the crew during the
approach and the landing phases. A briefing regarding all relevant airport and airspace data, as well as obstacle relevance
evaluation, both natural and man-made, must always be conducted before the flight. To facilitate this task the flight
inspection check list can contain a number of notes to highlight the prohibited, restricted and dangerous areas as well as
the position and altitude of the highest obstacles relevant to the area of operation. Any general restriction for the flight
inspection profiles should also be reported, for example the altitude for the crossover at 17 NM and 25 NM should be
1000ft higher than the altitude used during normal operation, the crossover at 6 NM can be performed at 8 NM at a greater
altitude of approximately 900ft and, 75 μA below path are allowed only with automatic offset guidance coupled with
autopilot, finally, for the reasons already described, PAPI light for the inspected runway must be operative during the
flight. SOPs can contain barriers as well as mitigation, the first category is referred to all the procedures implemented to
obtain a higher level of safety. Sometime complex problems require simple solutions, a verbal confirmation before a flight
path is initiated, between the pilots, to confirm that the runway is insight, the visibility allows proper separation with the
obstacles and the fatigue level is acceptable may seem a banal, however, sharing the information included in this cross
check, forces the crew to pay attention to essential aspects that may be underestimated during frenzy operation. Mitigation
are placed to the right of the undesirable event; the detailed procedures should be described in the SOPs. In most cases
the best mitigation, if something is not exactly as expected, is to interrupt the profile initiating a missed approach in order
to reposition the aircraft in an IFR holding at the appropriate MHA, giving enough time to the crew to analyze the situation
and chose the proper course of action. The number of maneuvers discontinued within a six months period can be a very
useful safety performance indicator, if this number is relatively high it is a significant indication that the barriers are not
effective. In general, a missed approach should be initiated any time the visual reference is lost, a laser attack is suspected,
unknown traffic is reported in the vicinity, any fatigue induced error is detected and any warning from a Terrain Avoidance
system activates. Ground proximity warning system (GPWS) and Advanced GPWS systems, known as Terrain
Awareness and Warning System (TAWS) or Enhanced Ground Proximity Warning System (EGPWS) provide the flight
crew with alerts to help preventing controlled flight into terrain accidents. These systems can be erroneously perceived
as a barrier, in other words the crew may have a false feeling of safety that may lead to use the indication on the display
as a reference for terrain separation. The crew should maintain own visual separation from the obstacles, this provision
can be considered a barrier, if for any reason an alert is generated by GPWS and EGPWS/TAWS it should be interpreted
as a real warning of an incoming threat, using the system as a mitigation. Since the system is meant to warn the pilots of
any unforeseen circumstance that may position the aircraft closer to ground than it should be, the mitigation is effective
only if the crew promptly respond to the warning by climbing to a safer altitude.

As already mentioned, each horizontal line in the table can be considered a bow-tie related to the undesirable event in the
center and the safety event that is reported on the left. The values of probability and severity reported in the table are
estimated in accordance with ICAO Annex XIX definitions and the Safety Management Manual. Since severity is related
to the consequences of the potential outcome, once this value has been determined it will not change. Likelihood, instead,
depends on barriers and mitigation therefore the assessment of the final value requires to combine all the data. In
particular, the first probability column (PBY1) express the probability that the undesirable event happens according to
the existing barriers in correlation to the safety event on the left; the second probability column (PBY2), shows the same
index after, if any, additional barrier is implemented, if none this value will be the same as PBY1; a third probability
column (PBY3) refers to the probability that a potential outcome takes place according to the existing mitigation; if any
additional mitigation is taken a fourth column (PBY4) will express the associated reduction otherwise it will show the
same value as PBY3. The last cell on the right will express the result of the assessment, the final probability will be the
product of PBY2 multiplied by PBY4, divided by the total probability index; the final severity will be in accordance with
the consequences of the potential outcome. The exercise has to be performed for each line, the highest risk present in the
residual risk column will determine the overall risk for the scenario analyzed.
Conclusion

The real challenge related to risk assessment is to find effective barriers and mitigations. Reducing risk to a value As Low
as Reasonably Practicable is not an easy task. Safety is based on effective reporting, at the end of the day the best reward
for a well-done risk assessment is a positive feedback coming from that colleague who was skeptic, is shifting the
prospective from undesirable to desirable.

Bibliography

ECAST Safety Management System and Safety Culture Working Group Guidance on Hazard Identification – March 09
FAA Airplane Flying Handbook, Night Operations (chapter 10) – 2016
IATA Fatigue Safety Performance Indicators (SPIs): A Key Component of Proactive Fatigue Hazard Identification
Edition one - 2014
ICAO Laser Attacks Safety Guidelines – March 2017
ICAO Annex XIX Safety Management – First Edition – 2013
ICAO Safety Management Manual (DOC 9859) – Third Edition – 2013
ICAO Fatigue Risk Management Systems — Manual for Regulators (DOC 9966) First Edition – 2012
ICAO Manual for the Oversight of Fatigue Management Approaches (DOC 9966) Second Edition – 2016

Sitography

https://www.caa.co.uk/Safety-initiatives-and-resources/Working-with-industry/Bowtie/About-Bowtie
http://humansystems.arc.nasa.gov/groups/tlx/