NATS Safety Plan€¦ · 1 Performance through Innovation NATS Safety Plan 2014-2016 March 2014...

1

Performance through Innovation

NATS Safety Plan2014-2016

March 2014

Prepared by:Brendan BoothTim WatsonSteven Buckingham

11

1. Introduction and Context 4

2. Targets and Understanding Risk 6 2.1 Understanding Risk 6 2.2 Measuring Performance vs Targets 7 2.3 Single European Sky Safety Targets 9

3. Safety Strategy 10 3.1 People Create Safety 11 3.2 Safety Intelligence 12 3.3 Challenging and Learning 13 3.4 Tailored and Proportionate 14

4. Developing the Safety Plan 15

5. Tactical Safety Improvement 17

6. Strategic Safety Improvement 25 6.1 New Technology and Operating Concepts 26 6.2 Understanding and Managing Change and Transition 28 6.3 Safety Collaboration 30

7. Improving Safety Capability 31 7.1 Human Performance 31 7.2 Managing Safety and Performance 34 7.2.1 Evolving our SMS 34 7.2.2 Performance Measurement 35

Throughout this plan you will see the following theme icons which show how the strategy is linked to our activities. The strategy themes are outlined in section 3.

Table of Contents

2

As we evolve to address the challenges which face our industry, be they new regulations, technologies, markets, services, the environment or further cost efficiencies, one constant is that safety must remain foremost in our thoughts and actions. In the midst of all this change, our commitment to safety will remain unwavering.

The NATS Safety Strategy and the NATS safety plan will help us ensure that we deliver on this commitment. In the following pages we set out our plan for managing the risks of today and for ensuring we have the right capability to manage the risks of tomorrow.

The Safety Strategy challenges us to evolve how we think about safety and aspires to be a catalyst for change. The NATS Safety Plan is part of that change. I encourage you to read it to help you understand the part you will play as we continue to strive for the very highest standards in safety.

Richard DeakinCEO NATS

Our Deploying SESAR programme is gaining momentum and as we accelerate the technological change in our operations we must ensure that we continue to be safe. The NATS Safety Strategy and Safety Plan will help us achieve our goals by challenging how we think about and manage safety.

The development of new measures of safety performance will allow us to refine our operational baseline for safety. This will enable us to better understand our operational needs and improve how we design future technological and airspace developments.

I want these designs for operational improvements to align with and objectively understand and optimise the complex relationship between capacity, safety and the environment.

This is not going to happen overnight but I believe that through this safety plan there is a real opportunity to make a step change in how we design and deploy operational changes and maintain our excellent safety performance.

Martin Rolfe MD NATS Operations

We are continuing to develop the products and services which we offer and safety will always be fundamental to this.

It is the people in our organisation who deliver safety and we need to ensure that they remain highly capable. This Safety Plan sets out how NATS will remain at the forefront of safety management by making use of the latest technologies and by having staff who have high levels of capability and professionalism to ensure we continue to be safe in future.

Catherine Mason MD NATS Services

Foreword

3

Our safety commitment is to strive continually to improve our operational safety performance and to minimise our contribution to the risk of an aircraft accident as far as is reasonably practicable. In order to fulfil this commitment, we have a formalised, explicit and proactive approach to systematic safety management which:

• Defines the safety organisation with clear lines of safety accountability;

• Promotes a climate of safety awareness and understanding throughout the organisation;

• Monitors achievement against safety objectives and predictive indicators of safety performance;

• Ensures that everyone understands the role they play in delivering operational safety performance, has the capability to discharge their role and recognises that they have an individual responsibility for the safety of their actions;

• Encourages all staff to report operational safety concerns within a Just Culture such that appropriate improvement actions can be taken;

• Seeks out and adopts good operational and safety management practices;

• Engages with external stakeholders to share safety improvement opportunities; and

• Complies with all applicable safety standards and requirements.

As Chief Executive, I am totally committed to this safety policy and to the provision of the necessary resources to support its implementation and maintenance.

Richard DeakinCEO NATS

NATS Safety Policy

4

1. Introduction and ContextSafety is NATS first key priority and we are committed to continual improvement. Our safety performance is good however we cannot be complacent. The Safety Plan provides a high level view of how we intend to meet the challenges of delivering safe services.

Safety is a key priority for NATS and we are committed to continual improvement. Our safety performance in recent years has seen significant improvement, having reduced the annual number of safety events by 32% and the weighted severity of events by over 50% since 2006.

However, we cannot be complacent. We recognise that continuous safety improvement is now much more challenging as the number of adverse events decreases, and that the changing world of Air Traffic Management (ATM) is driving a significant evolution in our operations during the remainder of the decade. Examples of this ATM evolution are:

• New airspace structures and optimised network operations to reduce CO2 emissions and increase airspace and airport capacity in support of the UK Future Airspace Strategy;

• Increased ATC automation to enable our operation to handle forecast traffic increases safely;

• A move towards more strategic controlling utilising trajectory based operating methods in order to optimise aircraft trajectories across our airspace;

• Closer integration of operations and technology amongst Air Navigation Service Providers (ANSPs) in line with the Single European Sky initiative;

• Increased complexity and interconnectedness of the networked systems we use to provide our services that will change our operating environment in ways that are not yet foreseen;

We will continue to raise safety standards in this new environment and to monitor this, we have set an ambitious safety target to reduce safety risk, the accident risk per flight, in line with currently predicted traffic growth of 13% by 2020.

This Safety Plan gives a high level view of how we intend to meet the challenge of delivering this safety improvement. At its heart is the new Safety Strategy which calls for a new approach and way of thinking about safety.

While our traditional safety thinking, based on addressing ‘things that go wrong’, has served us well, the combination of very few incidents, future traffic growth and significant operational change demands an additional and different approach.

We will continue to focus on the key risk areas in our ATC operations, putting in place a robust set of tactical (short-term) and strategic (longer-term) actions to address identified risks.

We will implement our new Safety Strategy that will include focusing on ‘things that go right’. With so few ‘things that go wrong’, we now need a broader understanding of how safe we are. The logic is that by paying attention to things that work well, we can expand best practice whilst still learning when errors occur. Essentially, this is an evolution of our current safety approach built around strengthening the role of people in delivering safety and the robustness of systems and procedures. But it also injects a more intelligent, holistic and adaptive approach to measuring and managing safety. This new approach will look at safety in our organisation at a much more detailed level and with a new perspective but to achieve the same end.

This different understanding of safety will be the catalyst for meeting our ambitious safety target by 2020.

Safety is NATS first key priority.

5

How this Safety Plan has been developedThis document lays out the overall plan for the next three years, setting out the ways in which we intend to tackle the challenges of delivering further safety improvement.

The diagram (right) illustrates how the various company strategies, plans and sources of safety in NATS will interface and be influenced by the NATS Safety Plan.

Driving this Safety Plan is the new Safety Strategy to 2020 which provides a vision and framework as to how safety in NATS should evolve in the future.

• Reinforce what we already do well;

• Present a challenge to the way we think about safety to address problems on the horizon;

• Improve our knowledge of what makes us safe, and how to act on that knowledge to improve safety.

There will be a two way flow of information between the NATS Safety plan and the Unit Safety and Business Plans. In the first instance the NATS Safety Plan is underpinned bottom-up by the Unit Safety and Business Plans in that they identify the main risks to our operations and underlying causal factors. In the second instance the NATS Safety plan provides the top-down strategic direction to the Unit Safety and Business Plans to increase long term resilience and safety margins within our operations.

Altogether, this approach to safety improvement will create the right environment for our Service Lines to deliver safety into the future.

We will continue to raise safety standards in this new environment and have set an ambitious target to reduce accident risk per flight by 13% by 2020.

“

”

Unit Safety & Business Plans

NATS Safety Plan

NATS Safety Strategy

NATS Service Line Strategies & Plans

Every 3 years with annual review

To 2020

Every 1-2 years with annual review

The Safety Plan in NATS’ planning process

6

All NATS Incidents are firstly defined by Event Type and then investigated to identify the human performance and contextual issues which then leads to the attribution of the SSE or RAT assessment, and the appropriate mitigations

2.1 Understanding RiskUnderstanding our risk is crucial to the effective development and implementation of this Safety Plan. It ensures we are targeting our actions at our key risks as well as helping us in monitoring and refining how well we are tackling them.

Since 2006, we have used a Safety Significant Events scheme as a surrogate measure of the risk of an accident. We have then sought to control the risk of an accident by controlling the number and severity of incidents within the SSE scheme. The SSE scheme categorises safety incidents based upon severity (1-4) and separation distance (a-d), where 1a is the most severe and 4d the least severe. From this data we have generated a ‘Weighted SSE Index’ that adds annual SSE scores to provide a measure of safety performance, distinguishing between ‘all causes’ and those events that are attributed wholly or partly to NATS. The weighted SSE Index has been a useful way of expressing risk as a single value, but we recognise its limitations as safety performance improves and the scheme becomes more and more exposed to single one-off unwanted events.

We are now moving to a harmonised system of classifying risk associated with incidents and events – known as the Risk Analysis Tool (RAT) methodology. The RAT is a European standard which ensures that the wider aviation industry employs a common and consistent framework for assessing the severity of incidents. The RAT has been adopted by the European Commission as the European safety key performance indicator, and by other ANSPs – including the FAA – to consistently assess safety performance.

From January 2015, the NATS safety outcome performance indicator will be the RAT score. During 2014 we are conducting a detailed analysis of our performance, as measured by the RAT, in order to determine the performance levels against which we will set and monitor our strategic target. We will also apply RAT to our historic SSE performance since 2011 to provide comparative performance data.

2. Targets and Understanding RiskOur primary objective is to further improve on our already high safety performance by reducing safety risk year-on-year in proportion to traffic growth. Our safety target is to reduce safety risk in line with predicted traffic growth, which is predicted to be 13% by 2020.

NATS/Dual

Non-NATS - NATS

/Dual Non-NATS - NATS






/Dual Non-NATS

2006 - 2007 - 2008 - 2009 - 2010 - 2011 - 2012 - 2013 SSE4a/b 37 121 44 108 43 111 25 91 24 94 17 93 28 62 41 85

SSE3a/b 39 25 40 30 40 22 20 24 18 12 21 8 32 14 24 12

SSE2a/b 21 15 16 16 15 9 5 6 7 7 9 7 5 5 8 7

SSE1a/b 0 7 1 5 1 4 0 5 2 1 1 1 0 2 1 0

Total SSE1-4a/b 97 168 101 159 99 146 50 126 51 114 48 109 65 83 74 104

97

168

101

159

99

146

50

126

51

114

48

109

65

83

74

104

0

20

40

60

80

100

120

140

160

180

Num

ber o

f Eve

nts

Safety Significant Events 2006 to 2013Break down by severity and attribution

Events• Level Busts• Infringements• Runway Incursions• Ground Incidents• Civil/Military Interaction• Operational Interfaces• Pilot/Controller Interaction• Airprox

“Safety Significant Events and Risk Analysis Tool” assessments

Mitigation Activities• Training• Procedures• Equipment• Working with others

Causal Factorsassociated with:• Human Performance - Controller - Engineer - Pilot - Ground personnel - Driver - Airline personnel - Airport personnel

• Organisation - Training - Supervision - Management

• CNS Equipment/System - Hardware - Software - HMI - Procedures - Rules

• Environment - Airspace and Traffic - Weather - Airports - Interface

NATS/Dual

Non-NATS - NATS







/Dual Non-NATS

2006 - 2007 - 2008 - 2009 - 2010 - 2011 - 2012 - 2013 SSE4a/b 37 121 44 108 43 111 25 91 24 94 17 93 28 62 41 85

SSE3a/b 39 25 40 30 40 22 20 24 18 12 21 8 32 14 24 12

SSE2a/b 21 15 16 16 15 9 5 6 7 7 9 7 5 5 8 7

SSE1a/b 0 7 1 5 1 4 0 5 2 1 1 1 0 2 1 0

Total SSE1-4a/b 97 168 101 159 99 146 50 126 51 114 48 109 65 83 74 104

97

168

101

159

99

146

50

126

51

114

48

109

65

83

74

104

0

20

40

60

80

100

120

140

160

180

Num

ber o

f Eve

nts


NATS/Dual

Non-NATS - NATS







/Dual Non-NATS

2006 - 2007 - 2008 - 2009 - 2010 - 2011 - 2012 - 2013 SSE4a/b 37 121 44 108 43 111 25 91 24 94 17 93 28 62 41 85

SSE3a/b 39 25 40 30 40 22 20 24 18 12 21 8 32 14 24 12

SSE2a/b 21 15 16 16 15 9 5 6 7 7 9 7 5 5 8 7

SSE1a/b 0 7 1 5 1 4 0 5 2 1 1 1 0 2 1 0

Total SSE1-4a/b 97 168 101 159 99 146 50 126 51 114 48 109 65 83 74 104

97

168

101

159

99

146

50

126

51

114

48

109

65

83

74

104

0

20

40

60

80

100

120

140

160

180

Num

ber o

f Eve

nts


7

2.2 Measuring Performance vs TargetsOver the last 7 years we have improved our safety performance as measured by the SSE scheme both in terms of the number of events and the severity as shown in the chart below. We have been especially successful in working with industry to reduce the risk generated by non-NATS sources.

Understanding our risk is crucial to the effective development and implementation of this safety plan.

“

”

0

100

200

300

400

500

600

700

800

900

0

5

10

15

20

25

30

35

40

45

Jan-

06

Apr-0

6

Jul-0

6

Oct

-06

Jan-

07

Apr-0

7

Jul-0

7

Oct

-07

Jan-

08

Apr-0

8

Jul-0

8

Oct

-08

Jan-

09

Apr-0

9

Jul-0

9

Oct

-09

Jan-

10

Apr-1

0

Jul-1

0

Oct

-10

Jan-

11

Apr-1

1

Jul-1

1

Oct

-11

Jan-

12

Apr-1

2

Jul-1

2

Oct

-12

Jan-

13

Apr-1

3

Jul-1

3

Oct

-13

Wei

ghte

d SS

E In

dex

(12

mon

th ro

lling

tota

l)

Num

ber o

f Eve

nts

SSE1a/b SSE2a/b SSE3a/b SSE4a/b Weighted SSE Index - All Attribution Weighted SSE Index - NATS attribution

2006 2007 2008 2009 2010 2011 2012 2013

8

As our performance improves we are increasingly affected by diminishing returns, as recognised in our strategic target. The chart below indicates that NATS is on track to achieve its current target of a 10% reduction in the NATS Safety Index between 2011 and 2015. Beyond that, implementing this Safety Plan is the means to meet our safety improvement target to 2020. This target will be defined during 2014.

As our performance improves we are increasingly affected by diminishing safety improvement returns.

“

”

Actual, Target and Stretch Target Safety Index for NATS

0

100

200

300

400

500

600

700

800

Jan

Mar

M

ay

Jul

Sep

Nov

Ja

n M

ar

May

Ju

l Se

p N

ov

Jan

Mar

M

ay

Jul

Sep

Nov

Ja

n M

ar

May

Ju

l Se

p N

ov

Jan

Mar

M

ay

Jul

Sep

Nov

Ja

n M

ar

May

Ju

l Se

p N

ov

Jan

Mar

Mar

May

Ju

l Se

p N

ov

Jan

Mar

May

Ju

l Se

p N

ov

Jan

Mar

M

ay

Jul

Sep

Nov

Ja

n M

ar

May

Ju

l Se

p N

ov

Jan

Mar

M

ay

Jul

Sep

Nov

Ja

n M

ar

May

Ju

l Se

p N

ov

2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019

Wei

ghte

d SS

E In

dex

NATS

Non-NATS

Target Stretched Target

10%

40%

10%

40%

During 2014 we will define a meaningful RAT based method to measure the reduction in safety risk, the accident risk per flight, in line with currently predicted traffic growth of 13% by 2020.

CP2 CP3/RP1 RP2

During 2014 we will define a meaningful RAT based method to measure the reduction in safety risk, the accident risk per flight, in line with currently predicted traffic growth of 13% by 2020.

9

2.3 Single European Sky Safety TargetsNATS must also comply with the requirements of the Single European Sky Performance Implementing Rule. This requires NATS to achieve targets set on Key Performance Indicators (KPIs) for Effectiveness of Safety Management (EoSM), application of the Risk Assessment Tool (RAT) and the application of a Just Culture.

The SES Performance Scheme for the next Regulatory Period (RP2 2015-19) aims to stimulate and ensure proactive safety

management, with an emphasis on automated reporting / monitoring together with the creation of a climate where people feel confident in reporting safety issues.

The European Commission and UK and Irish regulators have published Functional Airspace Block (FAB) performance targets for safety key performance indicators (KPIs) as shown below. Additionally, there are a sub-set of performance indicators (PIs) to be monitored at local level (where local means FAB in this context), with a corresponding National component. Targets for Airfields with over 70K movements, not covered by the FAB Performance Plan, are expected to have very similar targets.

SES Performance Scheme – Safety Targets 2015-19

KPI (FAB Monitoring)

Measure Target

Effectiveness

of Safety

Management

(EoSM)

Air Navigation Service Provider (ANSP) score (level A-D) detailed in Appendix 1 to AMC 3 SKPI -

EoSM - ANSP level.

By 31 December 2019 at the latest, ANSPs shall achieve at least Level D for the management

objectives ‘safety policy and objectives’, ‘safety risk management’, ‘safety assurance’, and ‘safety

promotion’ and at least Level C for the management objective ‘safety culture’.

Level C for the Safety

Culture Management

Objectives (MO)

Level D for all other MOs

Application

of Severity

Classification

Scheme

Application of the severity classification based on the Risk Analysis Tool (RAT) methodology

to the reporting of occurrences – as a minimum Separation Minima Infringements, Runway

Incursions and ATM-specific occurrences:

By 31 December 2017 and 2019 at the latest, ANSPs shall report to NSAs the ‘ATM Ground’

severity using the Risk Analysis Tool methodology for the classification of at minimum 80%

and 100% respectively of the annually reported separation minima infringements and runway

incursions with categories A, B and C; and

By 31 December 2017 and 2019 at the latest, ANSPs shall report to NSAs the ‘ATM Ground’

severity using the RAT methodology for the classification of at least 80% and 100% respectively

of the annually reported ATM-specific occurrences with the categories AA, A, B and C.

By 2017, 80% of SMIs,

RIs and ATM-specific

occurrences

By 2019 100% of SMIs,

RIs and ATM-specific

occurrences

Just Culture Joint Just Culture training requirements at ANSP levelFAB target set by CAA

SARG and IAA SRD

PI (National Monitoring) Target

Separation minima infringements – and automated data recording for monitoring where available

There are no targets

for the PIs

Runway incursions – and automated data recording for monitoring where available

Airspace infringements

ATM specific occurrences at ATS units

Level of occurrence reporting

Together with our European partners we should use metrics and measures carefully and ensure that they drive the right behaviours, system outcomes and performance.

“

”

10

Understanding that people are our strength not our weakness

Changing how we monitor, measure and control safety in our operation

Improving how we learn from and collaborate with others to address the risks in ATM. Creating a questioning and challenging culture

Evolving to an adaptable and progressive safety management system fit for the challenges of the future

3. Safety StrategyThis section summarises the company’s safety strategy which is the catalyst for change, and sets out the supporting ‘enabling actions’ which this plan implements. In thinking about safety in a new way, our new safety strategy introduces 4 key themes to guide development of a new safety philosophy in NATS and the ATM industry. These themes, illustrated below, will underpin delivery of our Safety Plan.

Reference Document A. NATS Safety Strategy

11

3.1 People Create SafetyThe safety of our services, as judged on past performance, is rightly perceived and talked about within NATS as being good, but we must guard against any complacency in our organisation. We need to be watchful for an over reliance on past successes in our attitudes to safety in the future.

The use of advanced automation sees greater integration between human and technical support systems and means that the non-operational functions of the organisation will have a considerably more significant role in shaping safety of the future.

The Piper-Alpha, Challenger, Columbia, Nimrod and Mid Staffordshire investigations, among others, have also highlighted the importance of organisational culture, managerial capability and leadership in delivering safety. We must continue to nurture the culture of our organisation towards a self-critical and informed view of safety.

The People Create Safety theme of the Safety Strategy highlights the key point that our people are our strength, not our weakness.

There are 4 underlying ideas to this theme.

1. Safety comes from individuals taking personal responsibility and ownership – making the future operation safer becomes everybody’s responsibility, not just those at the front-line. Through safety awareness and capability programmes, we will ensure that everyone is knowledgeable about safety risks, understands their role in controlling them effectively and has the capability and authority they need to act.

2. Reinforcing the right actions and behaviours – our safety ethos will be well understood and applied company wide, with individuals and teams proactively working together to deliver a safe service. Every individual’s actions will reflect their real commitment to safety, which includes a culture where people feel comfortable in challenging any adverse performance or behaviour.

3. Our leaders set the tone for safety – the company’s managers ultimately set the culture of the organisation through their commitment to safety. They must ensure that safety is not done in isolation but integrated into how we do business. Decision-making and target setting must drive the right behaviour across the company, avoiding creating perverse incentives that distract people from delivering a safe service.

4. Safety cannot be tacked on as an afterthought or done in isolation – it must be integrated into how we do business. This means that it is fully embedded in our processes. We recognise that safety is good business; not just in avoiding accidents or incidents, since doing safety properly and early-on results in more effective products and services.

Key Enabling ActionsDialogue on the new Safety Strategy

New safety leadership programme to promote behavior change

Higher profile safety communications

Whole company safety culture, not just operations

Develop roles and capabilities for future technology

Enhanced safety data meaningful to people’s roles

We need to be watchful for an over reliance on past successes in our attitudes to safety in the future.

Individual actions and behaviours reinforce our organisational principles and values.

“

”

12

3.2 Safety IntelligenceThe traditional approach to safety monitoring and measurement that NATS has evolved to use has been one which identifies and counts the number of times we fail to provide a safe service. When we have an adverse event our focus has been on what we did wrong, what failed or malfunctioned. We strive to learn the lessons of these events and then, through incident investigation, try to identify the root cause and eliminate it or improve the barriers to trap the event before it could become an incident again.

This has been highly effective. As is observed in the recorded data, we are experiencing record low numbers of safety events. However, if we have no adverse events it makes understanding how safe we are very difficult. Furthermore, given the number and the nature of the changes the ATM operation is about to undergo, can we really infer our future performance from the past?

The Safety Intelligence theme of the Safety Strategy describes how we need to adopt new measures not only to understand how safe we are, but also to understand what safety is. We are challenging ourselves to think about safety in a new way so that we achieve the same purpose, safe services, but from a new perspective.

There are 3 underlying ideas behind this theme.

1. Safe system performance comes from the same processes which yield success and failure – we must build an understanding of why and how, for the vast majority of the time, things go right in our day-to-day operations and do not result in incidents. This means developing new ways of measuring how our everyday performance produces a safe operation. To be meaningful in our future operating environment, we must look at the ATM system as a whole rather than mainly focusing on the human contribution. Nonetheless, it will still be important to learn the lessons from unexpected events, as we do today.

2. Apply this understanding of normal, day-in-day-out performance to be even safer – based on this more complete picture of good performance, we can aim for a more consistent, robust and repeatable level of safety performance across our operations. This view of safety performance will also enable us to anticipate risk, by highlighting instances where we might be eroding our safety margins and anticipates the impact of changes in our operation. Based on this improved understanding, we should be able to explicitly and dynamically control risk using a wider variety of proven actions.

3. New ways of assuring systems – we also need to take this new view of safety into the design and assurance of the systems which we use in the operation. Rather than just focusing on how they can fail, we need to ensure that we embed safety benefits in the design of new systems from the start.

Key Enabling ActionsSafety observations (Day to Day) supported by objective safety data with automated data capture

Investigations of ‘normal everyday’ operational performance

New indicators that amplify ‘weak signals’ to safety performance

Easier access to safety data via Business Intelligence (BI) project

Developing new ways of measuring how our everyday performance produces a safe operation.

Understand why, and how, for the vast majority of the time, things go right.

“

”

13

3.3 Challenging and LearningNATS operates in a wider world. We are increasingly collaborating with other organisations on, for example, systems development or sharing of airspace. The rules and our regulators are changing.

The Challenging & Learning theme describes how we will respect that others will own risks that influence our operations. It describes how we will be even more questioning of others and make sure we challenge the rigour and pace of risk mitigation by them. But we must also learn from and collaborate with others where a risk or a benefit is truly shared so that we can ensure it is properly addressed to the benefit of aviation safety.

It is also clear that we need to be at the forefront of safety management and safety innovation. This will put us in a position of strength when we are challenged by others as to the safety, cost and efficiency of our services.

This theme also takes an inward look at NATS. We should continue to foster a culture of challenge and questioning in the organisation to guard against complacency and to support us in striving for better, safer, more efficient levels of performance. It is also about supporting a diversity of views across the organisation so that we have broad expertise to draw upon when addressing the challenges we face.

There are 3 underlying ideas behind this theme.

1. Learning from, and collaborating with, others to address shared risks and make aviation safer – we need a more systemic approach to learning from others so we share insight and understanding of how safety is produced by the ATM System. We must ensure we are receptive to others, learning from and collaborating with them where a risk is truly shared so that we can ensure it is properly addressed to the benefit of aviation safety.

2. Challenging others to address their risks – our industry partners will also be responsible for risks that affect our operations. Therefore, we must make sure that ownership is clear. We must challenge the rigour and pace of risk mitigation by them to ensure they deliver the safety improvement we require.

3. Challenge ourselves – equally, we should continue to challenge the status quo within our organisation, constantly looking for great safety practices and innovative ideas that deliver safety improvement.

Key Enabling ActionsLeading role in CANSO Safety activities

Encourage and support “Safety 2” work by Eurocontrol and other ANSPs

Safety KPIs and PIs for future regulatory control periods

Prioritise risks to be tackled by others

Improved safety lessons learning amongst industry partners (Airlines, Airports & Regulators)

Safety 2 innovation programme

Welcoming and encouraging challenge from across the organisation when it makes us safer.

“

”

14

3.4 Tailored and ProportionateThe ATM world is undergoing a significant revolution and we observe that the pace of change is out-growing our current Safety Management System. The SMS was not designed to cope with the increasing levels of automation, complexity and connectivity across ATM systems. It is not ideally suited to the strategic partnerships and collaborative system developments which deliver the harmonised systems we need at a cost we can afford.

Ever increasing cost pressures from our customers and regulators mean we must ensure our safety actions are appropriate. We must be intelligent and surgical in our approach, so that we do not waste resources on the wrong action or the wrong risk. When we do take action to change how we deliver a safe service it has to be proportionate to the risk.

The Tailored and Proportionate theme identifies 3 ideas for change.

1. Evolve our safety management system – so that it is adaptable, progressive and fit for the challenges of the future. It should be built around a set of fundamental principles that allow many different ways of providing the assurance we need. Our SMS should also be sufficiently portable that we can use it in the variety of regulatory environments where we do business.

2. Integrate our safety and business processes – to ensure safety requirements are met as efficiently as possible, we need a more tailored approach to integrating safety into how we undertake projects, make changes or introduce new procedures. This integrated approach, with safety considered from the outset, rather than being a ‘bolt-on’, will enable more proportionate and structured decisions in design, procurement, planning, maintenance, contracting and partnerships – saving money while improving safety outcomes.

3. Influence regulation – rules do not necessarily make us safer, so in concert with our industry partners we should continue to influence regulatory rule-making to ensure it is tailored and proportionate to our safety improvement goals.

Key Enabling ActionsSMS made more proportionate

Incorporate safety into all aspects of how we do business

• SMS incorporated into NATS Management System and project processes

• Embed ‘safety by design’

• Targeted training on safety / safety by design

• Safety intelligence improves benefits process

• Phase review process supports the Safety Strategy

New assurance codes of practice for ATM

Our efforts must be proportionate to the risk.“”

15

Safety Strategy

Tactical Safety Improvements

Focused on key risk areas

Strategic Safety Improvements

Improving Safety Capabilities

NATS LTIP Delivery

NATS Unit Safety Plans

Safety Improvement Actions

NATS Business Plans

Industry Safety Projects

In The AirLevel Busts, Airspace Infringements,Pilot/ATCO Interaction

New Technology and Operating ConceptsEnabling us to become even safer

Human PerformanceThe right tools, capabilities and operating environment for safety improvement

Managing Safety & PerformanceEvolving SMS to ensure it is effective in our new operating environment

Performance measurement to support the “Safety Intelligence” theme

Understanding and Managing Change and TransitionThe supporting activities to understand safety benefits and automation, and deliver safe transitions

Safety CollaborationWorking proactively with partners to further improve aviation safety

On The Ground Runway Safety, Airport Incidents

At Our InterfacesOperational Interfaces, Civil / Military Interaction, Oceanic Airspace

In Our OperationsHuman Performance, System Integrity / Behaviour

1 2 3

Safety Strategy





NATS LTIP Delivery



NATS Business Plans












1 2 3

Safety Strategy





NATS LTIP Delivery



NATS Business Plans












1 2 3

Safety Strategy





NATS LTIP Delivery



NATS Business Plans












1 2 3

The main components of the Safety PlanThe Safety Plan is constructed around 3 main areas as illustrated in the diagram below:

1. Tactical Safety Improvement – addresses our prime responsibility for managing the safety risk in our operations. This improvement focuses on short-term and on-going tactical measures undertaken at operational units which are primarily focused on the key day-to-day risks to our operations. These have been grouped in 4 broad risk areas (in the air, on the ground, in the operations room, and at our interfaces);

2. Strategic Safety Improvement – reflects our commitment to continuous and sustainable improvement in safety performance, in particular, taking advantage of new technology and operating concepts for ATM, enhancing our understanding of change and transition, and increasing safety collaboration on sharing data and industry best practice;

3. Improving Safety Capabilities – addresses the key underlying drivers of safety improvement, namely Human Performance and Managing Safety. Human Performance will ensure we will develop the right tools, capabilities and operating environment to deliver continuous safety improvement. Managing Safety will evolve our Safety Management System (SMS) to ensure it is effective in our new operating environment and develop new ways of understanding how our performance produces a safe operation.

The main actions in each of these areas are summarised in the following sections of the Plan.

4. Developing the Safety PlanIn creating the NATS Safety Plan we have focused on three key areas Tactical Safety Improvement, Strategic Safety Improvement and Improving Safety Capability. Each of these areas is essential in continuing to deliver the highest levels of safety performance.

Safety Plan Main Components

16

Unit Safety PlansAll our units have their own Safety Plans: the Swanwick and Prestwick Centres, our Airport ATC Units and our Engineering and Training organisations. These Plans govern their local actions to improve safety, both their immediate tactical actions focused on their localised risks and their more strategic actions specifically identified to address the safety improvement areas.

To ensure that there is safety ownership at the individual Units we have Unit Safety Plans which manage the immediate and localised risks to that unit. This is also a proportionate approach to risk management and reflects the view that the people who are best placed to address a risk are those affected by it.

The activities undertaken by our operational units are essential to improving our safety performance.

“

”

17

Safety Strategy





NATS LTIP Delivery



NATS Business Plans












1 2 3

Safety Strategy





NATS LTIP Delivery



NATS Business Plans












1 2 3

Safety Strategy





NATS LTIP Delivery



NATS Business Plans












1 2 3

Safety Strategy





NATS LTIP Delivery



NATS Business Plans












1 2 3

5. Tactical Safety Improvement

NATS operational safety priorities focused on the key risk areasNATS has built up a deep understanding of the key risks to the operation. Whilst we are proposing that we take a new approach to safety we will not discard this knowledge. Our top operational safety risks, as we currently understand them, are grouped into 4 broad risk areas illustrated on the following pages.

The actions that target specific problems are set out in Unit Safety Plans at our Centres and Airport ATC units. They include both short and long term actions and are delivered through working with industry partners (airlines, airports, military, business and general aviation) to collaboratively tackle key risk areas. We also work with various European and international partners to address issues at our ATC interfaces.

Maintaining a focus on known operational risks is a key component in delivering improvement in our safety performance. This section outlines the key risks and our plans for managing them.

18

Key Actions• Support the CAA to further extend risk awareness

activities with the GA community and to take proportionate action, where necessary, in order to reduce risk

• Improve the detectability of all aircraft to create a ‘complete known aviation environment’

• Make available all data in the ‘known aviation environment’ to all participants, enabling new technology solutions to reduce infringement rates

• Continue to deploy alerting tools and employ defensive controlling techniques to mitigate the impact of events.

2. Controlled Airspace InfringementsControlled airspace infringements continue to be a major aviation safety risks, caused by aircraft inadvertently entering protected airspace zones around busy airports, especially in southeast England.

We have deployed technology in recent years to significantly reduce the risk, including:

• A Controlled Airspace Infringement Tool (CAIT) to warn controllers of impending infringements

• A web-based flight planning tool for GA pilots that alerts them if their flight plan transits controlled airspace

• A GPS-based device to enhance pilot situational awareness on airspace types and boundaries while airborne.

Key Actions• Minimise the inherent risk in airspace design – via

our major airspace programmes (London Airspace Management Programme (LAMP) and Northern Terminal Control Area (NTCA))

• Continue technology deployment to alert controllers in advance when the potential for a level bust arises

• Support operators and pilots to always use the best known methods to ensure conformance to their cleared levels.

In The Air

1. Level BustsLevel busts are caused by aircraft unexpectedly deviating from their cleared altitude and which may then come into conflict with others. The risk is greater in terminal airspace where aircraft vertical profiles are constantly changing, and because traffic density is such that aircraft flying through their cleared height are more likely to come into conflict.

Recent industry-wide initiatives have raised controller and pilot awareness of the contributory factors, with procedural and airspace changes reducing the opportunity for level busts to occur. We have also implemented technology solutions to assist in early detection and resolution of level busts. Joint industry work continues (with NATS supporting others through the Safety Partnership Agreement) on incidents caused by altimeter setting errors, non-standard radio phraseology and non-standard procedures.

We will continue to focus on the airborne risks in our operation, taking action that is proportionate to the risk.

“

”

19

Key Actions• Industry action to reduce interface risk is being

coordinated by an SPA Pilot – Controller interface Working Group jointly led by NATS and Flybe

• A set of training initiatives to improve pilots’ and controllers’ understanding of each other’s operating environments

• Specific improvements in the London Terminal Control Thames operation to mitigate the risks

• Engage pilots operating close to Controlled Airspace to increase their awareness of the safety risk and reduce unpredictability

• Continuation of Farnborough LARS service to assist aircraft in Class G airspace from infringing controlled airspace.

3. Pilot / Controller InteractionThere are three instances where pilot / controller interaction continue to be a concern for NATS. These are non-scheduled flights unfamiliar with operations in complex airspace, the increase in the number of aircraft into and out of airfield outside controlled airspace, and unpredictable interactions of Visual Flight Rules (VFR) aircraft with controlled airspace.

A. Non-scheduled flights unfamiliar with operations in complex airspace:

The pilot/controller interface is vulnerable to non-scheduled flights being unfamiliar with operations in complex airspace, where any non-compliance or misunderstanding of procedures in densely used airspace can cause safety incidents.

B. Increase in the number of aircraft into and out of airfields outside controlled airspace:

There is added complexity to the ATC operation when coordinating the joining and leaving of controlled airspace by aircraft operating to airfields outside controlled airspace (e.g. Southend, Oxford, Cambridge).

These aircraft are often climbing in to controlled airspace from beneath radar coverage and also have to be sequenced with traffic patterns established to feed airports inside controlled airspace.

C. Unpredictable interactions of Visual Flight Rules (VFR) aircraft with controlled airspace:

There are potential risks from General Aviation aircraft operating VFR near to Controlled Airspace interacting with structured IFR traffic, where unexpected manoeuvring by VFR traffic can trigger a TCAS alert in an IFR aircraft requiring avoiding action. Such interactions include VFR transit routes close to airport arrival / departure routes, and VFR helicopter flights (police, media, etc.) that operate in close proximity to IFR traffic.

Maintaining a strong relationship and good understanding between the pilot and the controller is essential to improving safety.

“

”

20

Key Actions• Implement a systematic end-to-end approach

to managing runway safety – from how aircraft are delivered to the runway and working through how they interact with other aircraft and vehicles using the runway

• Work with stakeholders to understand specific risks at airports and introduce targeted processes and actions to reduce risk

• In conjunction with airport operators, introduce technology-based runway safety nets designed to support the human in the complex runway environment

• Identify and manage the risks specific to each airport’s operating environment

• Work with airports, airlines and ground handling companies to develop and implement prevention strategies.

On the GroundDespite making good progress in the last few years On the ground risk remain an ongoing concern for NATS. There are two key issues Runway Incursion incidents and broader airport incidents.

4. Runway Safety - Runway Incursion IncidentsRunway safety-related events remain a serious safety issue, where the unintended presence of an aircraft or vehicle on the runway (a runway incursion) is the major risk. Contributing factors include lack of situational awareness by pilots / drivers, complex airport layouts, poor visibility and misunderstood ATC clearances.

There are various UK, European and global runway safety initiatives. We continue to work with our stakeholders on technology, procedures and analysis in support of the European Action Plan for the Prevention of Runway Incursions (EAPPRI) and we have an Airport Safety Improvement Team to focus on solutions at our airport ATC units.

5. Airport IncidentsAirport safety incidents include any safety related event on the aerodrome other than the runway. Specific risk events include:

• Taxiway conflictions between aircraft or vehicles

• Unauthorised or incorrect pushback of aircraft from stands

• Winter operations – the combination of extra vehicles and manoeuvring area restrictions (for snow/ice clearance) together with poor surface conditions

• Airport infrastructure changes and the management of Work in Progress – which increases the potential for errors by pilots and drivers.

Industry action will continue to address these risks through initiative coordinated by the CAA-led Ground Handling Operations Safety Team (GHOST).

The airport environment is a key focus of our risk management activities.

“

”

Introduce technology-based runway safety nets.

21

Key Actions• Use analysis, feedback and everyday observations

to focus on the interfaces which create the highest safety risk

• Improve interface ANSPs’ understanding of procedures and methods of operation that reduce the risk of incidents

• Share safety data and develop joint safety plans with interface ANSPs.

At Our Interfaces

6. Operational InterfacesA key area of risk is the interface between controllers, sectors and units where we must ensure that air traffic is properly coordinated and handed over as expected.

Our ‘safety in the wild’ initiative has examined key interfaces with adjacent Centres (Brest, Reims, Maastricht, Dublin and Shannon) and introduced changes to reduce interface issues. We also have joint Operational Techniques Groups (OTGs) with ANSPs to share data, address issues and reduce risks.

7. Civil/Military InteractionUnexpected interactions between civil and military aircraft, both within and outside CAS, remain a key risk, with risk greater in Prestwick’s airspace due to the higher levels of military activity. Key causes of incidents include an absence, or break down in coordination, high performance military manoeuvring close to civil aircraft, and military single pilot performance in high workload.

The centralisation of military ATC at Swanwick presents a number of opportunities to enhance the interface between military and civil controllers at Swanwick, however we must be careful to ensure that this is not at the expense of risk in Prestwick airspace.

Key Actions• Maintain a strong partnership with the military

to improve understanding of risks and key risk reduction measures

• Improve communication links between en-route airspace control and military pilots and controllers

• Improve controller understanding of military aircraft operations and co-ordination when sharing airspace.

Continuing to work closely with our partners inside and outside our operation.

“

”

22

Key Actions• Improve error capture with systems that provide

controllers with accurate position data and timely communication

• Monitor and communicate individual airline operator safety performance and trends.

8. Oceanic AirspaceA. Oceanic Errors – Aircraft deviating from their planned flight profile:

Oceanic operations differ from domestic operations due to the lack of radar coverage and VHF communication. Although separations are larger, any deviation by aircraft from planned flight profiles can remain undetected and unresolved. Particular risks are large height deviations and gross navigational errors resulting in the erosion of separation.

We work with airspace users, ANSPs and international aviation safety organisations to address safety risks in oceanic airspace. We also have a pro-active awareness programme to help educate airlines, flight crew and operators on the potential issues, risks and solutions when flying within oceanic airspace.

In Our Operations

9. Human PerformanceA. Non detection of alerts by controllers:

A number of systems generate alerts to direct controllers’ attention to potentially hazardous situations detected by the system. Systems include Short-Term Conflict Alert (STCA), iFACTS, Mode-S deviations, the Controlled Airspace Infringement Tool (CAIT) and Airspace Infringement Warning (AIW) tool at Airports.

Analysis of incidents where non-responses by controllers was a causal factor has highlighted an excessive number of alerts, many of them seemingly unnecessary to the controller (including false alerts and incorrect alerts). While alerts are prioritised according to criticality, nuisance alerting is a recognised factor in missed alerts.

Key Actions• Improve the visualisation of high priority alerts

• Re-examine alert thresholds and filtering rules to reduce the number of unnecessary alerts.

B. Incidents at the Oceanic / Domestic airspace interface:

Any breakdown in communication and understanding between Oceanic and Domestic Control Centres leads to poor coordination between centres and limited error trapping capability at the interface. We will continue to address this risk through:

• A major effort with Spain to address errors at the Madrid / Shanwick airspace interface, which has significantly reduced errors across the boundary

• Improving our controllers’ understanding of complexities across the 10 West domestic / oceanic airspace interface.

Key Actions• Improve adjacent ANSP’s understanding of Shanwick oceanic operations and interfaces

• Improve working methods across our oceanic / domestic airspace interface.

The Oceanic environment is unique in our operation and requires specially tailored solutions.

“

”

23

Key Actions• Enhance Swanwick controllers’ knowledge of the

iFACTS system

• Develop robust mitigations to specific risks or causal factors associated with automation

• Feed lessons learned into the NATS automation work programme.

B. Controllers using tools differently than designed:

While ATC automation is not new to NATS, tools such as iFACTS have increased controllers’ dependence on automation to support their decision-making. Recent evaluation at Swanwick has highlighted a number of potential issues regarding how controllers are currently using automation in iFACTS. These include:

• Confusion over responsibility (who is making the decision - the technology or the human)

• Mismatch between operational models held by human and those used by the technology

• Changes in controller capability over time

• Difficulty in providing operational oversight.

C. Workload management:

Controllers adapt their decision-making and performance in the face of dynamic, ever-changing traffic environments and against concurrent task demands, interruptions, system constraints and time pressures. Predicting traffic flows and consequent workload levels is therefore a major part of the day-to-day management of our operations rooms.

However, there are still situations where the air traffic situation and task demands pose complexity problems for the controller which, depending on their skill and experience, may result in ‘overload’ with a potential risk to safety. There are also instances of ‘underload’ where low workload causes controllers to lose concentration or become distracted from their primary task.

Key Actions• Address overload and underload hotspot sectors

• Improve controllers’ responses when becoming overloaded

• Enhance investigations and learning capability to improve our understanding of workload factors.

While alerts are prioritised according to criticality, unnecessary alerting is a recognised factor in missed alerts.

While ATC automation is not new to NATS, tools such as iFACTS have increased controllers’ dependence on automation to support their decision-making.

“

”

While alerts are prioritised according to criticality, unnecessary alerting is a recognised factor in missed alerts.

24

D. Rate and control of change:

Deployment of SESAR into our operations in the period to 2020 will require big changes to systems, airspace and methods of operation (MOPs). The rate at which such change can be accommodated in already busy operations rooms will create significant challenges for all those involved with the potential to add more risk.

While our operational change processes have proved to be extremely robust in the past, we will need to ensure we have a full understanding of the potential safety risks of the planned rate of change so that appropriate mitigations can be applied.

Key Actions• Develop a better understanding of how the rate of

change can impact on the continued safety of our operation

• Enhance development, delivery and transition approaches to ensure risks are effectively controlled / mitigated.

(See section 6.2 Understanding and managing change and transition)

Key Actions• Increase controller training and awareness of

anomalous radar performance

• Address Mode-S transponder issues that cause missing data.

10. Technical Systems - Integrity and BehaviourSafety is highly dependent upon our operational systems and infrastructure performing their required functions consistently and effectively. We have comprehensive safety assurance processes that ensure our operations remain safe in the event of critical malfunctions or failures. However, there are instances where systems appear to be operating normally but with features that mean the controller is not getting full / correct information, for example:

• Anomalous radar propagation that can cause false primary radar echoes in certain atmospheric conditions

• Missing data on controllers’ displays due to random loss of data content, despite the high degree of error protection built into systems.

We have comprehensive safety assurance processes.

Change is a constant in our business. Successfully managing that change is an essential part of our safety activities.

“

”

25

6. Strategic Safety Improvement

Europe’s Single European Sky initiative is beginning to take major steps towards implementation of the next generation ATM systems and operating methods through SESAR’s deployment phase. This begins during the life of this Safety Plan. One of the key performance targets of the SESAR work programme is to improve Europe’s overall ATM safety performance by a factor of ten while air traffic volumes triple beyond 2030.

In doing all this, the SESAR programme is taking a considered approach to safety involving technology, concepts, humans and collaboration. Likewise, this Safety Plan shows that we are taking a similar approach towards meeting our internal safety target. In particular, this Plan draws together the high level activities contained in our Operational Evolution Plan and the Long Term Investment Plan (LTIP) including both airspace and

technology developments, as well as collaborative industry actions to address safety improvement areas in line with the State Safety Plan and Future Airspace Strategy (FAS).

In particular, future ATM technology will be a step-change from current technology creating a number of critical challenges concerning human performance and safety management. These are covered separately in section 7 of this Plan. Section 6 focuses on the new technology and operating concepts for ATM, and the increased collaboration on sharing safety data and industry best practice, which are a key feature of the Challenging and Learning theme of the Safety Strategy.

Safety Strategy





NATS LTIP Delivery



NATS Business Plans












1 2 3

Safety Strategy





NATS LTIP Delivery



NATS Business Plans












1 2 3

Safety Strategy





NATS LTIP Delivery



NATS Business Plans












1 2 3

Safety Strategy





NATS LTIP Delivery



NATS Business Plans












1 2 3

To ensure we continue to improve safety in our ever changing operational environment, we have a programme of strategic safety improvements addressing new technology and operating concepts, our understanding of change and transition, and industry wide collaboration.

26

6.1 New Technology and Operating Concepts

Investing in technology and new concepts that will enable us to become even saferOver the next decade, there will be a significant evolution in ATM; our operations will be very different from today. The SESAR initiative is bringing new ‘trajectory operations’, ATM concepts underpinned by new technologies. This 3 year plan lays the foundations for delivery of these significant changes, which are a step change over previous technological evolutions in ATM.

The following are the key themes of this work:

• Systemising the operation – introducing new airspace structures that optimise aircraft trajectories, reduce operational complexity and lower the risk of unplanned interactions;

• Introducing a new ATC working environment and technology (tools) for future trajectory operations – supporting the controller in planning and maintaining safe separation between aircraft, highlighting potential conflicts between aircraft at an early stage;

• Improving safety nets – strengthening defences by upgrading safety nets or introducing new ones.

We will seek to exploit new technology using the increasing sophistication of airborne avionics capabilities, satellite navigation and datalinks to enhance efficiency and capacity in a safe manner.

All this is underpinned by an analysis framework that links system developments and investments to ensure that we can handle future traffic levels without increasing the risk.

Our strategic investments

1. Airspace:NATS plans to systemise the most congested airspace in Terminal Manoeuvring Areas (TMAs) through major redesign projects that also fundamentally change the way we handle traffic. Built around performance based navigation (PBN) where aircraft fly precise trajectories, aircraft will fly pre-determined conflict free routes and profiles to provide capacity and predictability while limiting the need for controller intervention with no detriment to their workload. These airspace developments – part of the UK aviation industry’s Future Airspace Strategy (FAS) – will make a significant contribution to reducing risk within TMA.

The main airspace programmes (LAMP, NTCA and ScTMA) will introduce new airspace structures / routes, enhancing resilience in the ATM system.

Upper airspace will see the first introduction of trajectory operations where controllers use system tools that enable aircraft to fly conflict free direct routes. Oceanic airspace will see wider introduction of satellite based communications and surveillance technologies that will enhance safety for aircraft operating in North Atlantic airspace.

Key Airspace Projects with Safety BenefitsHigher Transition Altitude (an enabler to LAMP)

London Airspace Management Programme (LAMP)

Northern Terminal Control Airspace (NTCA)

Scottish TMA (ScTMA)

Our strategic safety improvements are aligned to the themes of our Safety Strategy.

“

”

27

2. New ATC working environment and technology:NATS will be introducing, across our operations, an advanced trajectory-based flight data processing system (iTEC) together with a suite of controller support tools based upon accurate trajectory prediction, conflict detection and conformance monitoring.

It will be deployed first in Prestwick Upper Airspace, which will lay the foundations of the new capabilities. Enhanced versions will be progressively deployed through the rest of Prestwick airspace, Terminal Control and Area Control to deliver trajectory operations.

Trajectory operations will allow traffic interactions to be better planned and moderated, with smoother flows and less spikes of intense activity. Specifically, safety improvements will come from:

• Separation monitoring – prediction of potential interactions and conflicts between aircraft based upon their current clearances and predicted profiles

• Conformance monitoring – alerting controllers to actual or predicted deviation from an aircraft’s expected or intended behaviour.

In Oceanic airspace, the COAST project (Collaboration on Oceanic Airspace & System Tools) will deliver an enhanced Oceanic system that improves controller-to-controller co-ordination across boundaries and includes capabilities for satellite-based communication and surveillance. These capabilities will improve error capture and resolution.

All of these changes will help to ensure the human (ATCO/pilot) has more time to think and plan and will be less likely to face periods of peak workload or unexpected traffic activity. As ever, we must be mindful of the risk associated with significant change and ensure that we continue to conduct robust change management.

3. New safety nets:While our systems and procedures are designed to meet the required level of safety performance without depending on safety nets, we have ground based safety nets to detect and safely recover a dynamic situation.

NATS main safety net is the Short Term Conflict Alert (STCA) system at Centres and Airport ATC which is continually enhanced to exploit advances in technology such as down-linked data from aircraft systems.

Over the next few years we will seek to deploy a suite of new safety nets to support improved safety of our operations, which includes:

• Airspace Penetration Warning – alerts controllers when aircraft are at risk of infringing protected airspace

• Base of Radar Coverage Proximity Warning – alerts controllers when aircraft under their control are flying too close to the base of controlled airspace

• Approach Path Monitoring – alerts controllers when aircraft on final approach are flying too close to the ground or an obstacle

• Runway Incursion Protection and Alerting System – detects runway incursions to assist in preventing potential conflicts between aircraft or vehicles on or close to the runway.

Key Airspace Projects with Safety BenefitsiTEC Advanced Flight Data Processing and New Controller Working Position (CWP)

Prestwick Upper Airspace (PUAS)

COAST (Oceanic Airspace)

Trajectory operations will allow traffic interactions to be better planned and moderated, with smoother flows and less spikes of intense activity.

“

”

28

6.2 Understanding and Managing Change and Transition

1. Quantifying and delivering the safety benefitsNATS LTIP processes, which have served us well, already include safety risk assessment and identification / delivery of benefits. Evidence-based risk assessment and modelling covers aspects such as system performance, resilience and human / automation issues to support system assurance. Specific quantitative safety benefits are identified and validated and are ‘owned’ by the project’s end-customer (the Unit Manager) who quantifies the level of benefit to be achieved and remains accountable for their delivery throughout. These processes are however limited in the types of data they use and have limited impact in delivering safety at the design stage using safety by design concepts.

We will enhance these processes by applying insight gained as part of our new ‘safety intelligence’ approach to estimate the safety levels and benefits in our new ATM systems more accurately. This enhanced understanding will feed our safety by design approach, and we will also draw on our work in the SESAR programme to introduce new methods to validate and deliver the safety benefits of key investments in our future operating environment.

2. The implications of increased automationThe underlying principle of air traffic control is that the human is in control. The performance of our controllers is very high, but approaching the boundary of human performance in terms of ability to take-in all the required information and to integrate it when formulating plans for controlling traffic.

We have highlighted the potential safety benefits of introducing greater automation to help controllers, for example providing earlier warnings of potential conflicts and enabling controllers to handle more aircraft safely.

To ensure this automation delivers the desired outcomes we have a series of questions we must answer. Are we using the automation to provide information/advice or becoming reliant on the automation to make decisions?

When this happens, who is then really in control, is it the controller or is it the automation? Does the controller really understand what the automation is doing and can they step in when necessary to take over the automated benefits, a number of questions need to be addressed. These include, at what point does the controller stop functions? What happens when the automation fails or is no longer available? Above all, how do we gain assurance that the ATM system continues to be safe in this future world of increased automation?

We therefore have a major programme of work to consider the implications of introducing more automation into the controller’s work environment.

3. Managing change and transitionsNATS has an ambitious strategy to complete SESAR deployment into our operations by 2020. The major steps in deploying SESAR concepts will require big changes to systems, airspace and methods of operation (MOPs). The rate at which such change can be accommodated in already busy operations rooms will create significant challenges for all those involved. The scale and complexity of change and the rate of transition into operational service may cause a variety of things to come together that creates more risk.

While our operational change processes have proved to be extremely robust in the past, we will need to ensure we have a full understanding of the potential safety risks of the planned rate of change so that appropriate mitigations can be applied. Here our ‘safety intelligence’ view should be able to provide a better understanding of the impact of change on the safety of our operations, as well as how we can control risk based on proven actions that we know will deliver safety.

In order to deliver the pace and level of change, NATS needs to enhance our capability to deliver overall change programme in a carefully managed way, with projects delivery and front-line operations working in a fully integrated way. The processes for requirements, design, simulation and validation, and transition need to seamlessly work together to ensure that new solutions are safe and fit for purpose for front-line operations in their new operating environment.

NATS have extensive experience of managing change and transition, but we are no complacent. We recognise the importance of a continued focus during this period of constant evolution.

“

”

29

4. Managing new risksNATS aim will be to ensure that safety improvement activities mitigate all of our current risk areas. However, new risks are likely to emerge due to the wide-ranging changes in technology and concepts of operation coming from a wide range of sources that will affect our operating environment, for example:

• The degree of variation in equipage of aircraft may be wider than before which demands more flexibility as we move towards PBN, trajectories, datalink and other strides forward in the aviation system;

• Remotely Piloted Aerial Systems (RPAS) may change our operating environment in ways that are not yet predictable;

• The complexity of networked systems may make it harder to predict system behaviour and secondary effects of changes, outages or unexpected events and will challenge our assurance arrangements;

• The potential for the launch and recovery of reusable space aircraft from UK locations.

Key Actions – Understanding and managing the change to our operation A better understanding of the risks of automation has been achieved, and lessons learned to date have been applied

Safety risk of the planned rate of change for the next 5 years is understood and appropriate mitigations applied

Current training methods for new technology have been reviewed and improvements identified.

The underlying principle of air traffic control is that the human is in control.

Using sources of intelligence both inside and outside the company, we can anticipate and account for new risks.

“

”Therefore, it is even more crucial for us to accurately monitor the performance of our operation so that any unexpected changes in safety performance due to the changing environment can be identified early so that remedial action can be taken.

30

6.3 Safety Collaboration

Working proactively with industry partners to further improve aviation safetyAviation safety is a shared responsibility. We cannot take on the challenge of delivering the next step in safety performance alone – it is essential that we work collaboratively with others in our industry, across disciplines and internationally to deliver the change in safety thinking that is needed. This is a key to the Safety Strategy captured in the “Challenging and Learning” theme.

Many of the risks to aircraft receiving our ATC services originate outside NATS, and so it is essential to work with others to address those issues effectively. Therefore, much of our safety improvement activity will involve airlines and airports, other sectors such as military, business and general aviation, as well as European and international partners.

Our safety partnershipsIn NATS we have significant expertise to contribute to safety partnerships. We also value the complementary expertise that we know exists in other organisations.

The Safety Partnership Agreement (SPA) is an industry partnership where NATS works proactively with the aviation community to ensure common agreement on risk priorities and mitigations, and to jointly implement near-term safety improvements. The SPA’s current focus is on pilot-controller interfaces, runway safety, aircraft speed and airspace safety. We also participate in UK industry groups working on specific aviation risks, such as the Runway Incursions Steering Group (RISG) and the Airborne Collision Action Group (ACAG).Additionally, we will continue to work in partnership with:

• The CAA Safety & Airspace Regulation Group (SARG) to ensure that new regulation enables a sensible and pragmatic approach to safety to be taken by UK air traffic service providers;

• The Civil Air Navigation Services Organisation (CANSO) to improve the measurement and prediction of ATM risk and drive risk reduction at European and global levels;

• The European Aviation Safety Agency (EASA) and the European Commission to assist in development of a European ATM safety regulatory framework that supports the delivery of operational safety improvements;

• The SESAR programme to deliver its safety benefits;

• The Irish Aviation Authority (IAA) other ANSP Alliance partners and our customers to improve safety through the UK-Ireland Functional Airspace Block and across alliance partners’ airspace;

• Airport operating companies where we provide the ATC services to tackle risks in the airfield environment.

Aviation safety is a shared responsibility.

Collaborating with our customers, partners and stakeholders is a key element of our strategy and plan.

“

”

31

Safety Strategy





NATS LTIP Delivery



NATS Business Plans












1 2 3

Safety Strategy





NATS LTIP Delivery



NATS Business Plans












1 2 3

Safety Strategy





NATS LTIP Delivery



NATS Business Plans












1 2 3

Safety Strategy





NATS LTIP Delivery



NATS Business Plans












1 2 3

7. Improving Safety Capability

7.1 Human Performance

People at the heart of how we design, operate, manage and maintain our ATC systemAs is set out in the “People Create Safety” theme in the Safety Strategy, people are our strength and will remain pivotal to safe and efficient air traffic management. Safety in NATS will increasingly be delivered by everyone from the operational controllers who control aircraft, supported by assistants and supervisors together with network managers who manage traffic flows and engineers who manage systems.

Our operations rooms have a focused and dynamic environment, responding to the demands of traffic peaks and troughs. It embodies the typical issues inherent in an industry that relies heavily on human performance and skill. These include sustaining skills and competence, effective supervision, efficient rostering and workload management, and managing alertness and fatigue.

However, the introduction of increasingly sophisticated technology and new airspace designs will place new demands upon people. The required levels of human performance will not emerge by chance. Therefore, our strategy is to implement a new ‘human performance framework’ that provides a foundation for helping people to do their jobs and maximise their performance.

The more we increase our overall safety capability, the safer we will become.

32

Human performance frameworkOur objective is to maximise human performance across the organisation and minimise our safety risk against a backdrop of significant change. The new framework is designed to ensure that the total ATM system (people, procedures and technology) works in harmony to deliver safety, as illustrated in the diagram and summarised below.

1. Provide the right TOOLS:

This starts from understanding what the task is and how it will change, and then ensuring we select and design tools that will assist people in that task, removing by design any human vulnerability in the system. We engage users in the whole process, providing prototypes and simulators to assist decision-making. And we ensure that the technology is introduced properly, with a robust safety case for its full operational use and an effective conversion training programme that delivers the right capability during transition and change.

Key ActionsIntroduce new measures of Human Performance which focus on how Controllers undertake their role safely and effectively every day

Provide assurance that new technologies, airspace and procedures are designed, implemented and operated such that the Human Performance is optimised

How well people are prepared for the task

Selection, training, competence, awareness etc

How well people are supported by the organisation

Leadership, culture, motivation, reward etc

How well people are supported by the things they

use to do their job

HMI, technology, airspace, procedures etc

We ensure that the whole working environment is appropriate for people working safely and effectively individually and in teams.

“

”

33

2. Provide the right CAPABILITY:

We first identify the competencies that are needed in our future operations and by when, so we have a full picture of how capabilities will change over time. We then select people with the right raw capability to develop these competencies. We ensure we train them effectively, taking best advantage of advanced training and simulation facilities, which continues through their careers via on-going operational training and professional development. All this is underpinned by a comprehensive approach to standards and competency to verify our capability levels.

3. Provide the right ENVIRONMENT:

We ensure that the whole working environment is appropriate for people working safely and effectively individually and in teams. This includes managing work patterns, fatigue and well-being. We make sure that the right safety culture is in place that encourages open reporting and lesson learning. Our leadership inspires high levels of safety and ensures that the safety organisation and accountabilities are clear and effective.

Key ActionsAppropriate ops room safety behaviours are embedded and measured

Operational staff individually identify their personal training needs

Improved training in visual scanning techniques for new controllers

Easier access to continuous professional development via CBT

Improved Team Resource Management (TRM) in sector management and Oceanic operations

Lesson learning techniques enhanced

Enhance the capability and effectiveness of the Unit Competency Scheme

Deployment of the Safety Capability Programme

Key ActionsLeadership training is provided for operational leaders

Organisational Culture is measured and improved

A Fatigue Risk Management system is implemented

Controller workload is routinely measured and managed

Our leadership inspires high levels of safety.

Our Human Performance framework seeks to maximise how the performance of the human within the total ATM system.

“

”

34

7.2 Managing Safety and Performance NATS produced one of the first Safety Management Systems (SMS) for an air traffic organisation in 1991. SMS are the way organisations like NATS ensure they explicitly manage the safety of their operations. It operates a continuous cycle of monitoring performance to understand our safety risks, improving safety where risks are identified, controlling the implementation of change, and actively managing operational risk during service delivery.

As set out in the “Tailored and Proportionate” and “Safety Intelligence” themes of the Safety Strategy, we recognise that our SMS needs to evolve to remain effective.

7.2.1 Evolving our Safety Management System (SMS)Evolving our SMS to ensure it is effective in our new operating environment

Our future SMS needs to provide us with the right safety assurance, not necessarily more assurance.

We have been looking at how we can learn from safety approaches in other industries, and whether the assurance provided is better and more cost effective. This includes learning from the successes and failures of other industries introducing automation, which should help us to formulate safety assurance methodologies for introducing greater automation into air traffic systems.

We have also been developing new strategies and techniques for safety management in conjunction with other likeminded organisations within CANSO. This includes a benchmark standard for SMS maturity within ATM that has already been adopted by EASA and the EC as one of the Safety KPIs for the Single European Sky. The standard has raised the bar by including new areas such as Safety-by-Design and Fatigue Risk Management. We will encourage regulators to follow this industry lead in improving safety management.

All this work paves the way for us to think differently about how we manage safety and risk in the future.

1. A new SMS framework

We will be re-building our SMS to make it more relevant to our future ATM and business environment, and to provide a much clearer linkage to international ICAO and EASA standards.

Firstly, we will make our SMS more integrated with our business processes. Instead of standalone safety management, we will embed the key attributes for safety directly within the procedures that are used in the NATS Management System (NMS) so that we have one integrated set of actions rather than several parallel processes. The main benefit is that, instead of today’s generic safety processes, different business areas can have proportionate processes which deliver the goals for safety in the manner most appropriate to that specific area of our business.

Secondly, we will streamline our SMS to make it more appropriate and effective in our future environment, and to be visibly compliant with international standards. This will result in fewer and clearer sub-divisions of the SMS as illustrated in the diagram. This new SMS construction will be more efficient and make practical sense to everyone in the business, as well as making it easier to engage with regulators and stakeholders.

New Proposed SMS Framework

35

2. Improving the Risk Classification Scheme

We need to improve the quality and application of our risk assessment and mitigation schemes to ensure they are ‘fit for purpose’ for the new operational environment we are creating in deploying SESAR. A 3-step approach is planned:

1. Improving capability and understanding – we initially provide professional training and workshops to improve the capability of our safety assessors and designers in applying our current risk assessment and mitigation schemes, in preparation for (action 2)…

2. Enhancing existing risk assessment and mitigation schemes – we provide additional tools to designers in the way assurance is provided for systems, based on a qualitative approach using a reference system such as the Common Safety Methodology for Risk Assessment and Mitigation developed by NATS in conjunction with CANSO.

3. Finally, adopting a SESAR aligned risk classification scheme – this is a longer-term goal to eventually move to a risk (severity) classification scheme based on the SESAR barrier model. The key advantages are that it is more flexible and will allow the application of more of our ‘safety intelligence’ to the risk assessment process, and that we can re-use assurance provided elsewhere that conforms to the SESAR standard (e.g. by other ANSPs) without having to re-engineer it for use in NATS.

7.2.2 Performance MeasurementThe implementation of “Safety Intelligence”

Data collection and analysis is fundamental to driving safety improvement. It enables us to define measures of safety performance that are necessary for effective safety management and decision-making as our operations evolve over the next few years.

1. Evolving our capability to report, investigate and analyse safety events

NATS continuously gathers data on events that occur within the ATM environment. Through a robust reporting, investigation and analysis regime we ensure our continued understanding of the risks in our operation. This knowledge contributes to ensuring we take appropriate improvement actions.

a. Safety Tracking and Reporting (STAR) – Building on the existing reporting and investigation platform, STAR is being developed to enhance our ability to capture and analyse safety event data. This new platform will link our event data with our company wide Business Intelligence programme.

b. Risk Analysis Tool (RAT) – Over the last 3 years NATS has been leading the development of the Risk Analysis Tool across Europe. For NATS, RAT is essentially an evolution of our current Safety Significant Event scheme, taking account of the event investigation and analysis experience we have gained over the last 10 years. RAT provides a more comprehensive review of the level of risk associated with a safety event and where that risk manifests itself.

Data collection and analysis is fundamental to driving safety improvement.

36

2. A new proactive model / ensuring visibility of key data and information

In contrast to our current ‘safety significant event’ approach which can be considered reactive to risks, the next phase of ATM safety measurement will increasingly be predictive with a proactive model where we look for and mitigate risk. Our objective is to be able to predict what event is going to happen and when it is going to happen, so that we can proactively make changes in our safety processes without having to experience an incident.

Within NATS this proactive model is already under development. Our work to improve understanding of Human Performance in our operations has led us to introduce observation-based methods and data analysis – e.g. the Day-to-Day (D2D) safety survey and reporting of safety observations when no incident occurred. By conducting a series of targeted observations of normal ATC operations, we are provided with an overview of how well controllers manage on a daily basis the threats, errors and undesired states that arise within a unit’s particular operational context.

c. Business Intelligence (Safety) – In addition to observational data, we are enhancing our capability to capture system data with the introduction of our new Business Intelligence platform. This coupled with the improved Safety Tracking and Reporting Tool (STAR) will ensure our systematic capture and analysis of data is expanded in line with our ‘Safety Intelligence’ theme in the Safety Strategy. This will contribute to providing a proactive method of safety monitoring and improvement.

d. Improving use of Dashboards – With access to this broader array of data sources we will be able to develop a range of safety performance metrics. These metrics will continue to assess the outturn performance of the ATM system (e.g. Safety events), whilst introducing system and leading indicators. Additionally we are enhancing the ways in which we monitor the themes and trends identified as part of our steady state and change safety assurance activities.

We are developing a ‘safety performance dashboard’ to highlight key areas of performance. The initial dashboard themes are:

• Safety performance – the current status of our performance indicators, the set of indicators growing as we roll-out ‘safety intelligence’

• Leading indicators – these are a new set of factors that change ahead of a particular pattern or trend developing (good or bad), helping us to predict changes in performance

• System performance – how our safety systems are performing (e.g. ground safety nets and airborne TCAS)

• Top safety projects and initiatives – progress against key safety improvement goals and milestones and ensuring safe introduction of technology and concept changes

• Steady state safety assurance – application of our SMS, organisational culture and progress in addressing internal and external audit recommendations.

3. Safety data and information sharing

Another key element to our “Challenging and Learning” theme is collaboration across the aviation community on sharing safety data and analysis. The CAA is establishing an industry ‘Evidence Base’ to collect and share safety data and information. This is on top of European EASA (ECCAIRS) and US FAA (ASIAS) platforms that provide central repositories of safety information derived from EASA / FAA datasets and airline, airport, ANSP and manufacturers’ data.

Sharing information on industry trends and lessons learned helps to identify changing risks and prevention strategies, while fusion of data from different viewpoints provides a valuable insight on emerging vulnerabilities. Our aim, therefore, is to fuse the various aviation data sources in order to proactively identify safety trends and to assess the impact of changes in the aviation and ATM operating environment.

Key ActionsDeploy STAR into operational service

Develop our understanding of and targets based on RAT

Developing our safety performance dashboard to consider the full range of indicators

Our objective is to be able to predict what event is going to happen and when it is going to happen.

“

”

37

Afterword

NATS has achieved excellent levels of safety performance. However, the ATM world is undergoing unprecedented change and we must ensure that our methods of safety management remain appropriate and continue to inform us of and alert us to our risks.

We have set out our new safety strategy which we will act as a catalyst for a change in how we think about safety. The four themes of the NATS Safety Strategy recognise what we have done in the past and our current strengths but they also challenge us to think about safety in a different way.

When we started to develop the Safety Strategy we asked ourselves a number of questions. Foremost among those was: Will we be safe in future? We recognised that we cannot take safety for granted and just assume that the future will be safe. It will require hard work and commitment to make sure that it is. The NATS Safety Plan sets out how we will implement our Safety Strategy and bring it to life.

The Safety Plan is built around three pillars. One emphasises how we will continue to manage and control the risks which exist in today’s operation. The second pillar identifies our programme to deploy SESAR as a unique opportunity to make use of the latest technology to deliver further safety improvements. The third pillar ensures that we have the right capabilities to manage the safety of our future operations.

The NATS Safety Strategy and the Safety Plan will require your support and commitment to help deliver them and ensure that we continue to strive for the highest levels of safety performance which our customers, our regulators, the travelling public and our consciences require of us.

David HarrisonSafety Director NATS

38Version 1.0 - March 2014

NATS Safety Plan€¦ · 1 Performance through Innovation NATS Safety Plan 2014-2016 March 2014...

Documents

Transcript of NATS Safety Plan€¦ · 1 Performance through Innovation NATS Safety Plan 2014-2016 March 2014...