- Email: [email protected]
Risk assessment modeling in aviation safety management
ARTICLE IN PRESS
Journal of Air Transport Management 12 (2006) 267–273 www.elsevier.com/locate/jairtraman
Risk assessment modeling in aviation safety management Wen-Kuei Lee Department of Industry and Business Management, The Open University of Kaohsiung, 436 Daye North Road, Siaogang, Kaohsiung 812, Taiwan
Abstract Safety risk management is important in aviation. This paper develops a quantitative model for assessing aviation safety risk factors as a means of increasing the effectiveness of safety risk management system by integrating the fuzzy linguistic scale method, failure mode, effects and criticality analysis principle, and as low as reasonably practicable approach. The model is developed by evaluating all related estimation factors based on their importance, how hazardous they are, their detectability, probability, criticality, and frequency. An empirical study demonstrates the modeling process. r 2006 Elsevier Ltd. All rights reserved. Keywords: Risk assessment; Safety management; FMECA principle; ALARP approach
1. Introduction Safety analysis of accidents is an important but challenging issue in the civil aviation industry. Air passenger transportation is growing, with annual increases exceeding 5% forecast for the next 20 years. From a safety perspective, this means that continuous improvement is necessary to maintain high safety levels (Button et al., 2004). During recent decades, the focus has been on qualitative analysis or post-event studies of accidents. Nevertheless, whether considering the qualitative/quantitative analysis or the post-event/pre-event approach, these methods are generally based on either reactive or proactive analysis (Lee and Chang, 2005b). The reactive approach is a method of taking precautions following a loss, and its efficacy in preventing air accidents is limited by its ex post facto nature. Consequently, a before-the-fact diagnostic and predictive method may be more useful for safety risk management (SRM). In Taiwan, the Civil Aeronautics Administration (CAA) has promulgated some fundamental SRM measures for use by airlines and airports. It even announced a reward system integrated with the allocation of aviation resources, such as air routes, operational rights, and flight frequency quotas, to monitor SRM performance. The airlines and airports, however, lack an adequate
E-mail address: [email protected]. 0969-6997/$ - see front matter r 2006 Elsevier Ltd. All rights reserved. doi:10.1016/j.jairtraman.2006.07.007
method for accurately assessing the significance of SRM systems. From the perspective of prevention, if risks can be efficiently diagnosed before serious failure occurs the incident may be markedly reduced. The failure mode, effects and criticality analysis (FMECA) principle is a useful tool for considering risk. It has been extensively applied in the national safety defense (US Department of Defense, 1980). Subsequently, the FMECA was universally used in high risk industries, for example nuclear energy, chemical engineering, and petrochemical manufacturing. However, in it for multiple estimation factors has a fatal weakness—the dilution phenomenon. To avoid this, Lee and Chang (2005b) designed a unique method of formulating the combined measurement scores. To obtain a rapid and convenient risk analysis model, the graphic analysis integrated the as low as reasonably practicable (ALARP) approach. ALARP evolved from the safety case concept developed in the UK (Health and Safety Executive, 1992). Through proper application of graphic analysis, the SRM overseer can monitor individual risk factor without constraints of time and place and immediately adopt the preventive measures to avoid imminent accidents. Finally, because of the intangible nature of judging measurement scores of aviation risks for certain estimation factors, such as importance and detectability, and to reflect the inherent subjectivity and imprecision of even expert judgments, the fuzzy linguistic scale method (Buckley,
ARTICLE IN PRESS 268
W.-K. Lee / Journal of Air Transport Management 12 (2006) 267–273
1984) can be used to derive fuzzy judgments. The fuzzy membership functions can be deduced, and then the a-cut technique is used to calculate the risk levels of the risk factor.
unable to rise/fall, attrition, etc., are called failure modes. Numerous random factors also affect risk factor failure, for example artificial operations, weather effects, mechanical faults, and organizational culture.
2. Methodology
2.2. Constructing risk assessment model
2.1. Nouns definition
The level of risk (LoR) index, an integrated concept (Fig. 1), is deduced from the risk gradient (RG) and risk magnitude (RM) indexes. The RG index comprises endogenous estimation factors, and the RM index comprises exogenous estimation factors. To avoid the dilution effect, this study proposes a coordinate-combination method for constructing the risk-space diagram (RSD), and then employs the Euclidian distance formulae to calculate the RG and the RM indexes. To reflect the subjectivity and imprecision of the questionnaire survey and routine inspection, the judgments made by experts and inspectors regarding the scores of each fuzzy estimation factor, excluding probability and frequency, are represented using a fuzzy linguistic scale. The triangle fuzzy questionnaire surveys are used to obtain the fuzzy measurement scores owing to their ease of comprehension and operation. A five-point linguistic scale {very high, high, middle, low, and very low} is used for designing the fuzzy questionnaires (Buckley, 1984). The triangle fuzzy measurement scores of importance (I~mkj ) are provided by Eq. (1), and the sub-total triangle fuzzy measurement scores (Amk, Bmk, Cmk) are then determined by Eq. (2), where Bmk is calculated using geometric means. Given (1) I~mkj ¼ Amkj ; Bmkj ; C mkj ; 8m; k; j,
To develop the risk assessment model, all considered estimation factors are assessed in terms of importance, hazardousness, detectability, probability, criticality, and frequency. These are divided into two groups. The endogenous group, comprising importance, hazardousness, detectability based on the absolute judgments of experts, and probability, the four of which must generally remain constant during a risk assessment period. The exogenous group, containing criticality based on inspectors’ absolute judgments, and frequency, both of which must change according to each inspection result. To reflect the inherent imprecision of the survey and inspection process, these expert assessment and inspector examination results are represented by triangular fuzzy numbers, while probability and frequency are crisp values. ~ represents the safety signifiThe factor importance (I) cance of a risk factor; a high degree of influence of the significance is positively associated with high importance. ~ indicates the possible The failure hazardousness (H) severity of the disaster resulting from the failure of a risk factor. Degree of hazardousness may vary among risk factors. Some risk factors may cause only light injury or light property damage or loss, while others may cause heavy casualties or considerable property damage or loss. The greater the level of death or injury and property damage or loss resulting from the failure, the higher the ~ of a risk factor hazardousness. The failure detectability (D) indicates whether the failure can easily be detected. If the failure can easily be detected, then it has low detectability. The probability (P) of air accidents represents the number of global air accidents occurring during a risk assessment ~ represents the extent of period. The failure criticality (C) risk factor failure. The inspector must clearly detect and record the failure, the failure mode, and its criticality during the routine examination. The failure frequency (f) of a risk factor refers to the number of failures per unit during a risk assessment period. The measurement unit can be the number of take-offs and landings, the flight-hours, the number of departures, and the duration of air traffic control. The failure frequency is calculated for each risk factor based on different failure criticalities. Failure follows a malfunction, fault, breakdown, bad reaction, or loss of normal function of a risk factor. Most failures are discovered during routine maintenance, repair, and inspection. Numerous types of failure exist, including the fuselage fractures, the mechanical breakdowns, failure of landing gear to rise/fall normally, attrition of tire integrity, and so on. These types of fractures, breakdowns,
then
Amk ¼ min Amkj ; k ¼ 1; ; K; j 2 N mk , !1=N mk N mk Y Bmk ¼ Bmkj , j¼1
C mk ¼ max C mkj ;
k ¼ 1; ; K; j 2 N mk ,
Risk gradient (RG) index a. Factor Importance of a riskfactor b. Failure hazardousness of a risk factor c. Failure detectability of a risk factor d. Probability of air accidents Level of risk (LoR) index
a. Failure criticality of a risk factor b. Failure frequency of a risk factor Risk magnitude (RM) index Fig. 1. The integrated concept of level of risk (LoR) index.
ð2Þ
ARTICLE IN PRESS W.-K. Lee / Journal of Air Transport Management 12 (2006) 267–273
where I~mkj represents the fuzzy importance of the jth expert, the kth linguistic scale of risk factor m; Nmk represents the number of the kth linguistic scale for assessing the importance of risk factor m. Subsequently, the fuzzy membership functions are used to calculate the aggregate triangle fuzzy measurement scores (I~m ) by ( ) K X ½N mk ðAmk ; Bmk ; C mk Þ =nI I~m ¼ k¼1
¼ ðI mL ; I mM ; I mR Þ; 8m, ð3Þ PK where nI ¼ k¼1 N mk . The aggregately triangle fuzzy measurement scores of hazardousness ½H~ m ¼ ðH mL ; H mM ; H mR Þ and detectability ½D~ m ¼ ðDmL ; DmM ; DmR Þ can be obtained in the same way. Finally, the a-cut technique (defuzzified method) is employed to calculate the left-hand values (I amL , H amL , and DamL ) and right-hand values (I amR , H amR , and DamR ) of the triangle fuzzy measurement scores of estimation factors by
H amL H amR
for each risk factor. In RSD, the suffix L on each axis denotes the left-hand value of each estimation factor, while the suffix R denotes the right-hand value of each estimation factor; the superscript L in quadrant space denotes the leftbound RG Lm index, while the superscript R represents the right-bound RG R m index. Each risk factor has its RSD. The RG Lm index comprises I amL , H amL , DamL , and P. Meanwhile, a a a the RG R m index comprises I mR , H mR , DmR , and P. L a a a a Consequently, RG m (I mL , H mL , DmL , P ) and RG R m (I mR , a a H mR , DmR , P) represent respectively the coordinatecombination functions of the left-bound and right-bound RG indexes of risk factor m under a-cut. Here, the probability (P) is included in these functions and its left-hand and right-hand values are equivalent for all risk factors. The probability can be based on the global air accidents. Janic (2000) designed the probability distribution function based on global air accidents during 1965–1998, and adopted regressive analysis to deduce the global probability of an accident occurring by PðTptÞ ¼ 1 exp0:020t ;
I amL ¼ I mL þ aðI mM I mL Þ; I amR ¼ I mR aðI mR I mM Þ;
8m,
8m,
ð5Þ
DamL ¼ DmL þ aðDmM DmL Þ; DamR ¼ DmR aðDmR DmM Þ;
tX0,
(7)
ð4Þ
¼ H mL þ aðH mM H mL Þ; ¼ H mR aðH mR H mM Þ;
269
8m,
ð6Þ
where 0.0oao1.0, and is considered a risk control variable. The coordinate-combination method is used for avoiding dilution. Fig. 2 shows the concept upon which it is based. Each coordinate axis represents a different estimation factor, and all axes construct a RSD of an RG index
where t is a time variable (expressed in days). Consequently, the probability is 0.0198 per day ðt ¼ 1Þ, 0.0392 per 2 days ðt ¼ 2Þ, and so on. Finally, the Euclidean distance formulae is used to calculate the distances between xamL and xamin , xamR and xamin , xamax and xamin by vffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi,vffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi u X u X X uX 2 u 2 L t t a a RG m ¼ xmL xmin xamax xamin ; x¼1
x¼1
x¼1
x¼1
vffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi,vffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi u X u X uX X 2 u 2 R t t a a RG m ¼ xmR xmin xamax xamin ;
8m,
8m. ð8Þ
(0.0,0.0,1.0)
Dm
(0.0,1.0,1.0)
G:1.0(1.0,1.0,1.0)
(1.0,0.0,1.0) D mR RGmR
D mL O:0(0.0,0.0,0.0) I mR
RG mL
H mR
(0.0,1.0,0.0) Hm
H mL
I mL Im
(1.0,0.0,0.0)
(1.0,1.0,0.0)
Fig. 2. The RSD possessing three estimate factors.
where x denotes endogenous estimation factors; xamax are the maximum values of x under a-cut, which generally equal 1.0 (standardized); xamin are the minimum values, which generally equal 0.0. The denominators are the standardized formulae. The RSD of RM index resembles Fig. 2, but it is really a two-dimensional diagram. The RM index comprises C~ m and fm. The criticalities (C~ m ) are the aggregate triangular fuzzy measurement scores given by C~ m ¼ ðC mL ; C mM ; C mR Þ;
(9)
8m.
Subsequently, the left-hand values (C amL ) and right-hand values (C amR ) under a-cut are calculated by C amL ¼ C mL þ aðC mM C mL Þ; C amR ¼ C mR aðC mR C mM Þ;
8m.
ð10Þ
ARTICLE IN PRESS W.-K. Lee / Journal of Air Transport Management 12 (2006) 267–273
270
Furthermore, the Euclidean distance formulae are provided by RM Lm
sffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi,sffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi Y Y 2 2 P P ¼ yamL yamin yamax yamin ; y¼1
y¼1
y¼1
y¼1
sffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi,sffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi Y Y 2 2 P P yamR yamin yamax yamin ; RM R m ¼
8m;
8m; (11)
where y denotes the exogenous estimation factors; RM Lm represents the left-bound RM index of risk factor m under a-cut, and RM R m represents the right-bound RM index of risk factor m under a-cut. The denominators are also the standardized formulae. Following the calculation of RG and RM indexes, the LoR indexes are constructed by qffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi 2 2 LoRLm ¼ RM Lm RG Lm 2 ; 8m; qffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi (12) R 2 R 2 2 ¼ RM RG LoRU ; 8m; m m m where LoRLm represents the lower-bound LoR index of risk factor m under a -cut, and LoRU m represents the upperbound LoR index of risk factor m under a-cut. 2.3. Constructing risk-monitoring diagrams and analyzing risks The ALARP approach is an effective tools for analyzing safety risks in personal insurance or environmental monitoring systems (Tam et al., 1996). Lee and Chang (2005b) have applied this approach to develop a risk-monitoring diagram (RMD) in aviation SRM, which integrates the RG and RM indexes into the LoR index for each risk factor. In RMD, the two boundaries that divide the three zones are the LoRLm index and the LoRU m index given by Eq. (12). The two oblique lines represent the RM index. Notably, the baseline of the inversed triangle increases with the RG index. Upon checking the status of a risk factor, the inspector must transform the inspected result into the LoR index (the new LoRU m index is then called RS-line). Generally, the inversed triangle can be separated into zones: 1. Top zone—intolerable region (InTo-region ): If this region contains the RS-line, the inspected result (the U new LoRU m index) exceeds the set LoRm index. Consequently, the SRM overseer must immediately adopt appropriate measures to eliminate the impact of failure. 2. Middle zone—as low as reasonably practicable region (ALARP-region): If this region contains RS-line, the SRM overseer only needs to monitor the new risk status. However, more rigorous measures must be adopted when the RS-line approaches the upper section of this region.
3. Bottom zone—broadly acceptable region (BA-region): If this region contains the RS-line, no measures need to be taken. Meanings vary among regions, and the related measures that need to be adopted also differ. Anyhow, if airlines and airports apply this model, the checklist of FMECA for each risk factor needs to be established first. To monitor the RS-line, it is necessary to implement routine inspection work to collect and completely record the failure data. Particularly, the SRM overseer would need to continually analyze the risk status and adopt appropriate measures to prevent worsening failure. 3. Empirical study 3.1. Screening risk factors and deducing RG indexes While the proactive function emphasizes all aviation safety factors are treated as risk factors. Previous studies were unable to determine which classifications were correct with respect to risk factors (Lee and Chang, 2005b). The Boeing company separated aviation safety factors into seven groups crew, airline flight operations, airplane design and performance, airplane maintenance, air traffic control, airport management, and weather information. Heinrich (1959) sorted them into five types: human, machine, mission, management, and environment, and Edwards (1988) categorized them into four types: livewire, hardware, software, and environment. Meanwhile, the International Air Transport Association (IATA) classified them into five categories human, organization, machine, environment, and insufficiency (HOMEI). Among these categorizations, the categorization of the IATA is the most widely applied and used here (Civil Aeronautics Administration, 1999; Civil Aeronautics Administration, 2001) to derive these screened risk factors. However, only 14 risk factors (mechanical category) are selected. Table 1 lists the defuzzified measurement scores of importance, hazardousness, and detectability with respect to expert questionnaire surveys the risk factors, with a ¼ 0:5. The experts included 21 airline safety supervisors, 10 academics, 13 research department and Aviation Safety Council (ASC) experts, 11 directors of safety management departments in the Taiwanese CAA and two international airports. The survey process from March to June 2004 contained two stages of interviews and mailings; the first aimed to screen the estimation factors (Lee and Chang, 2005a), and the second was to obtain the measurement scores of considered risk factors. In the second stage, a total of 55 copies were issued, and 45 were returned. The effective response rate was around 81.82%. Since routine inspection work is executed everyday, the probability is 0.0198 per day. In Table 1, the average scores of importance and hazardousness all exceed 0.70, meaning that these two estimation factors are highly represented. The average scores of detectability are almost all below
ARTICLE IN PRESS W.-K. Lee / Journal of Air Transport Management 12 (2006) 267–273
271
Table 1 The defuzzified measurement scores of endogenous estimate factors and P (a-cut ¼ 0.5) Risk factors of machine (Fm)
F1 Airplane structure F2 Engine system F3 Landing gear and tire system F4 Flight control system F5 Navigation system F6 Hydraulic pressure system F7 Fuel system F8 Automatic driving system F9 Defending ice, eradicating ice or rain system F10 Fire and smog warning system F11 Cabin pressure, lubrication, and electricity system F12 Ground proximity warning system (GPWS) F13 Auxiliary approaching system F14 Early-alarm measures (TCAS, ASDE)
Importance (Im)
Hazardousness (Hm)
Detectability (Dm)
Left-hand
Right-hand
Left-hand
Right-hand
Left-hand
Right-hand
0.735 0.752 0.682 0.737 0.656 0.650 0.667 0.567 0.691 0.771 0.628 0.675 0.621 0.663
0.873 0.887 0.836 0.874 0.804 0.798 0.815 0.730 0.833 0.903 0.780 0.832 0.789 0.823
0.773 0.725 0.652 0.726 0.631 0.629 0.679 0.544 0.717 0.775 0.636 0.705 0.630 0.672
0.892 0.860 0.810 0.864 0.781 0.781 0.826 0.700 0.857 0.889 0.786 0.839 0.774 0.821
0.576 0.471 0.356 0.415 0.394 0.359 0.381 0.366 0.392 0.390 0.374 0.341 0.354 0.350
0.724 0.652 0.575 0.627 0.587 0.561 0.580 0.584 0.566 0.585 0.582 0.542 0.555 0.545
Prob. (P)
0.020 0.020 0.020 0.020 0.020 0.020 0.020 0.020 0.020 0.020 0.020 0.020 0.020 0.020
Table 2 The RGm, RMm, and LoRm indexes (a-cut ¼ 0.5) Fm
F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 F13 F14
Risk gradient (RGm)
Risk magnitude (RMm)
Level of risk (LoRm)
Left-bound
Right-bound
Critical ranking
Left-bound
Right-bound
Lower-bound (C)
Upper-bound (D)
Critical ranking
Interval
0.606 0.573 0.504 0.558 0.496 0.487 0.513 0.434 0.535 0.580 0.484 0.517 0.476 0.503
0.721 0.698 0.649 0.690 0.632 0.625 0.649 0.584 0.661 0.698 0.626 0.650 0.618 0.642
1 2 7 4 10 12 8 14 5 3 11 6 13 9
0.477 0.477 0.477 0.477 0.477 0.477 0.477 0.477 0.477 0.477 0.477 0.477 0.477 0.477
0.566 0.566 0.566 0.566 0.566 0.566 0.566 0.566 0.566 0.566 0.566 0.566 0.566 0.566
0.369 0.382 0.405 0.387 0.408 0.411 0.403 0.425 0.395 0.379 0.411 0.401 0.414 0.406
0.436 0.445 0.463 0.448 0.469 0.472 0.464 0.484 0.459 0.445 0.471 0.463 0.474 0.466
1 2 7 4 10 12 8 14 5 3 11 6 13 9
0.067 0.063 0.058 0.061 0.061 0.061 0.061 0.059 0.064 0.066 0.060 0.062 0.060 0.060
The aggregately triangle fuzzy measurement scores of criticality and frequency are hypothetical values set as (0.60, 0.75, 0.85).
0.5000
InTo-region RS-line 0.721
0.4357 0.4000 ALARP-region 0.3687 Level of risk (LoR)
0.50, indicating that it is easy to examine the failures for these 14 risk factors. Using the data in Table 2, all left-bound and right-bound RG indexes are calculated using Eq. (8). Risk factor F1 has the highest (RG Lm , RG R m ) ¼ (0.606, 0.721) indexes. Column 4 of the table reveals the critical-ranking order of these risk factors according to the decreasing order of RG R m indexes. Risk factor F1 is the most critical, followed by F2, and F10. Based on the ranking, the SRM overseer can adopt different measures relevant for different risk factors.
0.606
LoR mL
0.3000 ……
BA-region 0.2000
3.2. Deducing RM indexes and LoR indexes Owing to the scarcity of safety inspection data, hypothetical data is used to obtain the C~ m and fm measurement scores for deducing the RM indexes. The aggregately triangle fuzzy measurement score of failure criticality is assumed to be (0.60, 0.75, 0.85), and the failure frequency is given by 1/365 (times/days) ¼ 0.00274 for each
LoRmU
0.1000
0.0000 Risk gradient (RG) Fig. 3. The RMD of risk factor F1.
ARTICLE IN PRESS W.-K. Lee / Journal of Air Transport Management 12 (2006) 267–273
272
risk factor. The RM Lm and RM R m indexes are calculated using Eq. (11), with a ¼ 0:50. The LoRLm and LoRU m indexes are thus obtained from Eq. (12), with a ¼ 0:50. Table 2 lists 0.5000
InTo-region
the results. While all of the hypothetical RM indexes are the same, the LoR indexes differ among the risk factors. The critical-ranking order of these factors ranked in increasing order of the LoRU m index shows factor F1 has the lowest LoRU index. Accordingly, the RS-line (new m LoRU index) of risk factor F exceeds this lowest threshold 1 m by more than other risk factors. Comparatively, risk factor F8 has the highest LoRU m index, so its RS-line has difficulty exceeding this threshold. A higher RG R m index will produce a lower LoRU index. This result fits with the aviation SRM m theorem. The SRM overseer must adopt more rigorous measures to monitor risk factors when LoRU m index is low. Furthermore, the final column of Table 2 displays the interval between the LoRLm and LoRU m indexes. When the hypothetical RM indexes are the same, if the interval is larger, the deduced ALARP-region of RMD is wider and its LoRU m index is lower (Figs. 3 and 4). In this situation, the RS-line of this kind of risk factor easily falls into the InToregion, and should be considered a more critical risk factor.
0.584
0.4844
Level of risk (LoR)
0.4252 0.4000
ALARP-region
RS-line
0.434
BA-region 0.3000
0.2000
0.1000
3.3. RMDs and risk-monitoring strategies 0.0000
The RMDs of risk factor F1 and F8 are shown in Figs. 3 and 4. Risk factor F1 has the lowest LoRU m index, while risk factor F8 has the highest one. Clearly, a rigorous riskmonitoring strategy must be adopted for risk factor F1, but a slack strategy can be adopted for risk factorc F8. Matching up the RMD can enable the SRM overseer to clearly monitor the status of each risk factor. Table 3 lists the variations of the LoRU m indexes for the 14 risk factors by varying the a-cut value, which can be varied between 0.0 and 1.0. When a-cut is increased, the low LoRU m index is further reduced. On the other hand, the LoRU m index is increased while a-cut is decreased. For example, if a-cut varies from 0.50 to 0.65 for risk factor F1, the LoRU m index is reduced from 0.436 to 0.430. Consequently, more rigorous risk-monitoring measures are adopted when the larger a-cut value is used, while otherwise looser measures are adopted. Numerous results are obtained given different a-cut values for each risk factor. This study emphasizes critical U risk factors with high RG R m index or low LoRm index require close monitoring. Fig. 5 displays the relationships between a-cut values and ( LoRLm , LoRU m ) indexes of risk factor F1. For risk-monitoring, the SRM overseer can
Risk gradient (RG) Fig. 4. The RMD of risk factor F8. Table 3 The variations of LoRU m indexes by varying a-cut
F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 F13 F14
LoRU m a ¼ 0.8
a ¼ 0.65
a ¼ 0.5
a ¼ 0.35
a ¼ 0.2
0.424 0.434 0.454 0.437 0.459 0.461 0.454 0.474 0.448 0.432 0.460 0.453 0.464 0.456
0.430 0.430 0.459 0.443 0.464 0.466 0.459 0.479 0.454 0.439 0.466 0.458 0.469 0.461
0.436 0.445 0.463 0.448 0.469 0.472 0.464 0.484 0.459 0.445 0.471 0.463 0.473 0.465
0.442 0.451 0.467 0.454 0.474 0.477 0.468 0.489 0.464 0.452 0.477 0.468 0.479 0.470
0.447 0.456 0.471 0.459 0.478 0.482 0.472 0.494 0.470 0.458 0.482 0.473 0.483 0.475
upper-bound
lower-bound
0.500 Level of Risk (LoR)
Fm
(0.3, 0.4435) (0.5, 0.4357)
0.450
(0.8, 0.4240)
0.400
RS-line
(0.8, 0.3971) 0.350
(0.5, 0.3687) (0.3, 0.3496)
0.300 0.0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1.0
Fig. 5. The relationship of a and LoR index of risk factor F1.
ARTICLE IN PRESS W.-K. Lee / Journal of Air Transport Management 12 (2006) 267–273
adjust the a-cut value to yield different LoRU m indexes to facilitate risk monitoring for each risk factor. Acknowledgements The author would like to thank the National Science Council of the Republic of China, Taiwan, for financially supporting this research under Contract no. NSC 95-2416H-408-001. Directors of the Safety Management Department in the Taiwanese CAA and airports, airline safety supervisors, academic professors and experts in the research department and the Aviation Safety Council are thanked for their assistance in problem formulation and data collection. References Buckley, J.J., 1984. The multiple judge, multiple criteria ranking problem: a fuzzy set approach. Fuzzy Sets and System 13, 25–37. Button, K., Clarke, A., Palubinskas, G., Stough, R., Thibault, M., 2004. Conforming with ICAO safety oversight standards. Journal of Air Transport Management 10, 251–257.
273
Civil Aeronautics Administration, 1999. Airport Risk Management Reference Manual. Civil Aeronautics Administration, Taipei. Civil Aeronautics Administration, 2001. Airport Risk Self-Superintending System. Civil Aeronautics Administration, Taipei. Edwards, E., 1988. Introductory overview. In: Winner, E.L., Nagel, D.C. (Eds.), Academic Press Human Factors in Aviation. Academic Press, New York. Heinrich, H.W., 1959. Industrial Accident Prevention. McGraw-Hill, New York. Health and Safety Executive, 1992. The Tolerability of Risk from Nuclear Power Stations. Health and Safety Executive, London. Janic, M., 2000. An assessment of risk and safety in civil aviation. Journal of Air Transport Management 6, 43–50. Lee, W.K., Chang, Y.H., 2005a. Applying the fuzzy FMECA to access the risks of flight-safety. Civil Aviation Journal Quarterly 7, 1–22. Lee, W.K., Chang, Y.H., 2005b. Risk assessment model on flight-safety management. Transportation Planning Journal 34, 145–176. Tam, V., Moros, T., Webb, S., Allinson, J., Lee, R., Bilimoria, E., 1996. Application of ALARP to the design of the BP Andrew platform against smoke and gas ingress and gas explosion. Journal of Loss Prevention in the Process Industries 9, 317–322. US Department of Defense, 1980. Procedures for Performing a Failure Mode, Effects and Criticality Analysis. MIL-STD-1629A, Washington, DC.
Journal of Air Transport Management 12 (2006) 267–273 www.elsevier.com/locate/jairtraman
Risk assessment modeling in aviation safety management Wen-Kuei Lee Department of Industry and Business Management, The Open University of Kaohsiung, 436 Daye North Road, Siaogang, Kaohsiung 812, Taiwan
Abstract Safety risk management is important in aviation. This paper develops a quantitative model for assessing aviation safety risk factors as a means of increasing the effectiveness of safety risk management system by integrating the fuzzy linguistic scale method, failure mode, effects and criticality analysis principle, and as low as reasonably practicable approach. The model is developed by evaluating all related estimation factors based on their importance, how hazardous they are, their detectability, probability, criticality, and frequency. An empirical study demonstrates the modeling process. r 2006 Elsevier Ltd. All rights reserved. Keywords: Risk assessment; Safety management; FMECA principle; ALARP approach
1. Introduction Safety analysis of accidents is an important but challenging issue in the civil aviation industry. Air passenger transportation is growing, with annual increases exceeding 5% forecast for the next 20 years. From a safety perspective, this means that continuous improvement is necessary to maintain high safety levels (Button et al., 2004). During recent decades, the focus has been on qualitative analysis or post-event studies of accidents. Nevertheless, whether considering the qualitative/quantitative analysis or the post-event/pre-event approach, these methods are generally based on either reactive or proactive analysis (Lee and Chang, 2005b). The reactive approach is a method of taking precautions following a loss, and its efficacy in preventing air accidents is limited by its ex post facto nature. Consequently, a before-the-fact diagnostic and predictive method may be more useful for safety risk management (SRM). In Taiwan, the Civil Aeronautics Administration (CAA) has promulgated some fundamental SRM measures for use by airlines and airports. It even announced a reward system integrated with the allocation of aviation resources, such as air routes, operational rights, and flight frequency quotas, to monitor SRM performance. The airlines and airports, however, lack an adequate
E-mail address: [email protected]. 0969-6997/$ - see front matter r 2006 Elsevier Ltd. All rights reserved. doi:10.1016/j.jairtraman.2006.07.007
method for accurately assessing the significance of SRM systems. From the perspective of prevention, if risks can be efficiently diagnosed before serious failure occurs the incident may be markedly reduced. The failure mode, effects and criticality analysis (FMECA) principle is a useful tool for considering risk. It has been extensively applied in the national safety defense (US Department of Defense, 1980). Subsequently, the FMECA was universally used in high risk industries, for example nuclear energy, chemical engineering, and petrochemical manufacturing. However, in it for multiple estimation factors has a fatal weakness—the dilution phenomenon. To avoid this, Lee and Chang (2005b) designed a unique method of formulating the combined measurement scores. To obtain a rapid and convenient risk analysis model, the graphic analysis integrated the as low as reasonably practicable (ALARP) approach. ALARP evolved from the safety case concept developed in the UK (Health and Safety Executive, 1992). Through proper application of graphic analysis, the SRM overseer can monitor individual risk factor without constraints of time and place and immediately adopt the preventive measures to avoid imminent accidents. Finally, because of the intangible nature of judging measurement scores of aviation risks for certain estimation factors, such as importance and detectability, and to reflect the inherent subjectivity and imprecision of even expert judgments, the fuzzy linguistic scale method (Buckley,
ARTICLE IN PRESS 268
W.-K. Lee / Journal of Air Transport Management 12 (2006) 267–273
1984) can be used to derive fuzzy judgments. The fuzzy membership functions can be deduced, and then the a-cut technique is used to calculate the risk levels of the risk factor.
unable to rise/fall, attrition, etc., are called failure modes. Numerous random factors also affect risk factor failure, for example artificial operations, weather effects, mechanical faults, and organizational culture.
2. Methodology
2.2. Constructing risk assessment model
2.1. Nouns definition
The level of risk (LoR) index, an integrated concept (Fig. 1), is deduced from the risk gradient (RG) and risk magnitude (RM) indexes. The RG index comprises endogenous estimation factors, and the RM index comprises exogenous estimation factors. To avoid the dilution effect, this study proposes a coordinate-combination method for constructing the risk-space diagram (RSD), and then employs the Euclidian distance formulae to calculate the RG and the RM indexes. To reflect the subjectivity and imprecision of the questionnaire survey and routine inspection, the judgments made by experts and inspectors regarding the scores of each fuzzy estimation factor, excluding probability and frequency, are represented using a fuzzy linguistic scale. The triangle fuzzy questionnaire surveys are used to obtain the fuzzy measurement scores owing to their ease of comprehension and operation. A five-point linguistic scale {very high, high, middle, low, and very low} is used for designing the fuzzy questionnaires (Buckley, 1984). The triangle fuzzy measurement scores of importance (I~mkj ) are provided by Eq. (1), and the sub-total triangle fuzzy measurement scores (Amk, Bmk, Cmk) are then determined by Eq. (2), where Bmk is calculated using geometric means. Given (1) I~mkj ¼ Amkj ; Bmkj ; C mkj ; 8m; k; j,
To develop the risk assessment model, all considered estimation factors are assessed in terms of importance, hazardousness, detectability, probability, criticality, and frequency. These are divided into two groups. The endogenous group, comprising importance, hazardousness, detectability based on the absolute judgments of experts, and probability, the four of which must generally remain constant during a risk assessment period. The exogenous group, containing criticality based on inspectors’ absolute judgments, and frequency, both of which must change according to each inspection result. To reflect the inherent imprecision of the survey and inspection process, these expert assessment and inspector examination results are represented by triangular fuzzy numbers, while probability and frequency are crisp values. ~ represents the safety signifiThe factor importance (I) cance of a risk factor; a high degree of influence of the significance is positively associated with high importance. ~ indicates the possible The failure hazardousness (H) severity of the disaster resulting from the failure of a risk factor. Degree of hazardousness may vary among risk factors. Some risk factors may cause only light injury or light property damage or loss, while others may cause heavy casualties or considerable property damage or loss. The greater the level of death or injury and property damage or loss resulting from the failure, the higher the ~ of a risk factor hazardousness. The failure detectability (D) indicates whether the failure can easily be detected. If the failure can easily be detected, then it has low detectability. The probability (P) of air accidents represents the number of global air accidents occurring during a risk assessment ~ represents the extent of period. The failure criticality (C) risk factor failure. The inspector must clearly detect and record the failure, the failure mode, and its criticality during the routine examination. The failure frequency (f) of a risk factor refers to the number of failures per unit during a risk assessment period. The measurement unit can be the number of take-offs and landings, the flight-hours, the number of departures, and the duration of air traffic control. The failure frequency is calculated for each risk factor based on different failure criticalities. Failure follows a malfunction, fault, breakdown, bad reaction, or loss of normal function of a risk factor. Most failures are discovered during routine maintenance, repair, and inspection. Numerous types of failure exist, including the fuselage fractures, the mechanical breakdowns, failure of landing gear to rise/fall normally, attrition of tire integrity, and so on. These types of fractures, breakdowns,
then
Amk ¼ min Amkj ; k ¼ 1; ; K; j 2 N mk , !1=N mk N mk Y Bmk ¼ Bmkj , j¼1
C mk ¼ max C mkj ;
k ¼ 1; ; K; j 2 N mk ,
Risk gradient (RG) index a. Factor Importance of a riskfactor b. Failure hazardousness of a risk factor c. Failure detectability of a risk factor d. Probability of air accidents Level of risk (LoR) index
a. Failure criticality of a risk factor b. Failure frequency of a risk factor Risk magnitude (RM) index Fig. 1. The integrated concept of level of risk (LoR) index.
ð2Þ
ARTICLE IN PRESS W.-K. Lee / Journal of Air Transport Management 12 (2006) 267–273
where I~mkj represents the fuzzy importance of the jth expert, the kth linguistic scale of risk factor m; Nmk represents the number of the kth linguistic scale for assessing the importance of risk factor m. Subsequently, the fuzzy membership functions are used to calculate the aggregate triangle fuzzy measurement scores (I~m ) by ( ) K X ½N mk ðAmk ; Bmk ; C mk Þ =nI I~m ¼ k¼1
¼ ðI mL ; I mM ; I mR Þ; 8m, ð3Þ PK where nI ¼ k¼1 N mk . The aggregately triangle fuzzy measurement scores of hazardousness ½H~ m ¼ ðH mL ; H mM ; H mR Þ and detectability ½D~ m ¼ ðDmL ; DmM ; DmR Þ can be obtained in the same way. Finally, the a-cut technique (defuzzified method) is employed to calculate the left-hand values (I amL , H amL , and DamL ) and right-hand values (I amR , H amR , and DamR ) of the triangle fuzzy measurement scores of estimation factors by
H amL H amR
for each risk factor. In RSD, the suffix L on each axis denotes the left-hand value of each estimation factor, while the suffix R denotes the right-hand value of each estimation factor; the superscript L in quadrant space denotes the leftbound RG Lm index, while the superscript R represents the right-bound RG R m index. Each risk factor has its RSD. The RG Lm index comprises I amL , H amL , DamL , and P. Meanwhile, a a a the RG R m index comprises I mR , H mR , DmR , and P. L a a a a Consequently, RG m (I mL , H mL , DmL , P ) and RG R m (I mR , a a H mR , DmR , P) represent respectively the coordinatecombination functions of the left-bound and right-bound RG indexes of risk factor m under a-cut. Here, the probability (P) is included in these functions and its left-hand and right-hand values are equivalent for all risk factors. The probability can be based on the global air accidents. Janic (2000) designed the probability distribution function based on global air accidents during 1965–1998, and adopted regressive analysis to deduce the global probability of an accident occurring by PðTptÞ ¼ 1 exp0:020t ;
I amL ¼ I mL þ aðI mM I mL Þ; I amR ¼ I mR aðI mR I mM Þ;
8m,
8m,
ð5Þ
DamL ¼ DmL þ aðDmM DmL Þ; DamR ¼ DmR aðDmR DmM Þ;
tX0,
(7)
ð4Þ
¼ H mL þ aðH mM H mL Þ; ¼ H mR aðH mR H mM Þ;
269
8m,
ð6Þ
where 0.0oao1.0, and is considered a risk control variable. The coordinate-combination method is used for avoiding dilution. Fig. 2 shows the concept upon which it is based. Each coordinate axis represents a different estimation factor, and all axes construct a RSD of an RG index
where t is a time variable (expressed in days). Consequently, the probability is 0.0198 per day ðt ¼ 1Þ, 0.0392 per 2 days ðt ¼ 2Þ, and so on. Finally, the Euclidean distance formulae is used to calculate the distances between xamL and xamin , xamR and xamin , xamax and xamin by vffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi,vffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi u X u X X uX 2 u 2 L t t a a RG m ¼ xmL xmin xamax xamin ; x¼1
x¼1
x¼1
x¼1
vffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi,vffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi u X u X uX X 2 u 2 R t t a a RG m ¼ xmR xmin xamax xamin ;
8m,
8m. ð8Þ
(0.0,0.0,1.0)
Dm
(0.0,1.0,1.0)
G:1.0(1.0,1.0,1.0)
(1.0,0.0,1.0) D mR RGmR
D mL O:0(0.0,0.0,0.0) I mR
RG mL
H mR
(0.0,1.0,0.0) Hm
H mL
I mL Im
(1.0,0.0,0.0)
(1.0,1.0,0.0)
Fig. 2. The RSD possessing three estimate factors.
where x denotes endogenous estimation factors; xamax are the maximum values of x under a-cut, which generally equal 1.0 (standardized); xamin are the minimum values, which generally equal 0.0. The denominators are the standardized formulae. The RSD of RM index resembles Fig. 2, but it is really a two-dimensional diagram. The RM index comprises C~ m and fm. The criticalities (C~ m ) are the aggregate triangular fuzzy measurement scores given by C~ m ¼ ðC mL ; C mM ; C mR Þ;
(9)
8m.
Subsequently, the left-hand values (C amL ) and right-hand values (C amR ) under a-cut are calculated by C amL ¼ C mL þ aðC mM C mL Þ; C amR ¼ C mR aðC mR C mM Þ;
8m.
ð10Þ
ARTICLE IN PRESS W.-K. Lee / Journal of Air Transport Management 12 (2006) 267–273
270
Furthermore, the Euclidean distance formulae are provided by RM Lm
sffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi,sffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi Y Y 2 2 P P ¼ yamL yamin yamax yamin ; y¼1
y¼1
y¼1
y¼1
sffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi,sffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi Y Y 2 2 P P yamR yamin yamax yamin ; RM R m ¼
8m;
8m; (11)
where y denotes the exogenous estimation factors; RM Lm represents the left-bound RM index of risk factor m under a-cut, and RM R m represents the right-bound RM index of risk factor m under a-cut. The denominators are also the standardized formulae. Following the calculation of RG and RM indexes, the LoR indexes are constructed by qffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi 2 2 LoRLm ¼ RM Lm RG Lm 2 ; 8m; qffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi (12) R 2 R 2 2 ¼ RM RG LoRU ; 8m; m m m where LoRLm represents the lower-bound LoR index of risk factor m under a -cut, and LoRU m represents the upperbound LoR index of risk factor m under a-cut. 2.3. Constructing risk-monitoring diagrams and analyzing risks The ALARP approach is an effective tools for analyzing safety risks in personal insurance or environmental monitoring systems (Tam et al., 1996). Lee and Chang (2005b) have applied this approach to develop a risk-monitoring diagram (RMD) in aviation SRM, which integrates the RG and RM indexes into the LoR index for each risk factor. In RMD, the two boundaries that divide the three zones are the LoRLm index and the LoRU m index given by Eq. (12). The two oblique lines represent the RM index. Notably, the baseline of the inversed triangle increases with the RG index. Upon checking the status of a risk factor, the inspector must transform the inspected result into the LoR index (the new LoRU m index is then called RS-line). Generally, the inversed triangle can be separated into zones: 1. Top zone—intolerable region (InTo-region ): If this region contains the RS-line, the inspected result (the U new LoRU m index) exceeds the set LoRm index. Consequently, the SRM overseer must immediately adopt appropriate measures to eliminate the impact of failure. 2. Middle zone—as low as reasonably practicable region (ALARP-region): If this region contains RS-line, the SRM overseer only needs to monitor the new risk status. However, more rigorous measures must be adopted when the RS-line approaches the upper section of this region.
3. Bottom zone—broadly acceptable region (BA-region): If this region contains the RS-line, no measures need to be taken. Meanings vary among regions, and the related measures that need to be adopted also differ. Anyhow, if airlines and airports apply this model, the checklist of FMECA for each risk factor needs to be established first. To monitor the RS-line, it is necessary to implement routine inspection work to collect and completely record the failure data. Particularly, the SRM overseer would need to continually analyze the risk status and adopt appropriate measures to prevent worsening failure. 3. Empirical study 3.1. Screening risk factors and deducing RG indexes While the proactive function emphasizes all aviation safety factors are treated as risk factors. Previous studies were unable to determine which classifications were correct with respect to risk factors (Lee and Chang, 2005b). The Boeing company separated aviation safety factors into seven groups crew, airline flight operations, airplane design and performance, airplane maintenance, air traffic control, airport management, and weather information. Heinrich (1959) sorted them into five types: human, machine, mission, management, and environment, and Edwards (1988) categorized them into four types: livewire, hardware, software, and environment. Meanwhile, the International Air Transport Association (IATA) classified them into five categories human, organization, machine, environment, and insufficiency (HOMEI). Among these categorizations, the categorization of the IATA is the most widely applied and used here (Civil Aeronautics Administration, 1999; Civil Aeronautics Administration, 2001) to derive these screened risk factors. However, only 14 risk factors (mechanical category) are selected. Table 1 lists the defuzzified measurement scores of importance, hazardousness, and detectability with respect to expert questionnaire surveys the risk factors, with a ¼ 0:5. The experts included 21 airline safety supervisors, 10 academics, 13 research department and Aviation Safety Council (ASC) experts, 11 directors of safety management departments in the Taiwanese CAA and two international airports. The survey process from March to June 2004 contained two stages of interviews and mailings; the first aimed to screen the estimation factors (Lee and Chang, 2005a), and the second was to obtain the measurement scores of considered risk factors. In the second stage, a total of 55 copies were issued, and 45 were returned. The effective response rate was around 81.82%. Since routine inspection work is executed everyday, the probability is 0.0198 per day. In Table 1, the average scores of importance and hazardousness all exceed 0.70, meaning that these two estimation factors are highly represented. The average scores of detectability are almost all below
ARTICLE IN PRESS W.-K. Lee / Journal of Air Transport Management 12 (2006) 267–273
271
Table 1 The defuzzified measurement scores of endogenous estimate factors and P (a-cut ¼ 0.5) Risk factors of machine (Fm)
F1 Airplane structure F2 Engine system F3 Landing gear and tire system F4 Flight control system F5 Navigation system F6 Hydraulic pressure system F7 Fuel system F8 Automatic driving system F9 Defending ice, eradicating ice or rain system F10 Fire and smog warning system F11 Cabin pressure, lubrication, and electricity system F12 Ground proximity warning system (GPWS) F13 Auxiliary approaching system F14 Early-alarm measures (TCAS, ASDE)
Importance (Im)
Hazardousness (Hm)
Detectability (Dm)
Left-hand
Right-hand
Left-hand
Right-hand
Left-hand
Right-hand
0.735 0.752 0.682 0.737 0.656 0.650 0.667 0.567 0.691 0.771 0.628 0.675 0.621 0.663
0.873 0.887 0.836 0.874 0.804 0.798 0.815 0.730 0.833 0.903 0.780 0.832 0.789 0.823
0.773 0.725 0.652 0.726 0.631 0.629 0.679 0.544 0.717 0.775 0.636 0.705 0.630 0.672
0.892 0.860 0.810 0.864 0.781 0.781 0.826 0.700 0.857 0.889 0.786 0.839 0.774 0.821
0.576 0.471 0.356 0.415 0.394 0.359 0.381 0.366 0.392 0.390 0.374 0.341 0.354 0.350
0.724 0.652 0.575 0.627 0.587 0.561 0.580 0.584 0.566 0.585 0.582 0.542 0.555 0.545
Prob. (P)
0.020 0.020 0.020 0.020 0.020 0.020 0.020 0.020 0.020 0.020 0.020 0.020 0.020 0.020
Table 2 The RGm, RMm, and LoRm indexes (a-cut ¼ 0.5) Fm
F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 F13 F14
Risk gradient (RGm)
Risk magnitude (RMm)
Level of risk (LoRm)
Left-bound
Right-bound
Critical ranking
Left-bound
Right-bound
Lower-bound (C)
Upper-bound (D)
Critical ranking
Interval
0.606 0.573 0.504 0.558 0.496 0.487 0.513 0.434 0.535 0.580 0.484 0.517 0.476 0.503
0.721 0.698 0.649 0.690 0.632 0.625 0.649 0.584 0.661 0.698 0.626 0.650 0.618 0.642
1 2 7 4 10 12 8 14 5 3 11 6 13 9
0.477 0.477 0.477 0.477 0.477 0.477 0.477 0.477 0.477 0.477 0.477 0.477 0.477 0.477
0.566 0.566 0.566 0.566 0.566 0.566 0.566 0.566 0.566 0.566 0.566 0.566 0.566 0.566
0.369 0.382 0.405 0.387 0.408 0.411 0.403 0.425 0.395 0.379 0.411 0.401 0.414 0.406
0.436 0.445 0.463 0.448 0.469 0.472 0.464 0.484 0.459 0.445 0.471 0.463 0.474 0.466
1 2 7 4 10 12 8 14 5 3 11 6 13 9
0.067 0.063 0.058 0.061 0.061 0.061 0.061 0.059 0.064 0.066 0.060 0.062 0.060 0.060
The aggregately triangle fuzzy measurement scores of criticality and frequency are hypothetical values set as (0.60, 0.75, 0.85).
0.5000
InTo-region RS-line 0.721
0.4357 0.4000 ALARP-region 0.3687 Level of risk (LoR)
0.50, indicating that it is easy to examine the failures for these 14 risk factors. Using the data in Table 2, all left-bound and right-bound RG indexes are calculated using Eq. (8). Risk factor F1 has the highest (RG Lm , RG R m ) ¼ (0.606, 0.721) indexes. Column 4 of the table reveals the critical-ranking order of these risk factors according to the decreasing order of RG R m indexes. Risk factor F1 is the most critical, followed by F2, and F10. Based on the ranking, the SRM overseer can adopt different measures relevant for different risk factors.
0.606
LoR mL
0.3000 ……
BA-region 0.2000
3.2. Deducing RM indexes and LoR indexes Owing to the scarcity of safety inspection data, hypothetical data is used to obtain the C~ m and fm measurement scores for deducing the RM indexes. The aggregately triangle fuzzy measurement score of failure criticality is assumed to be (0.60, 0.75, 0.85), and the failure frequency is given by 1/365 (times/days) ¼ 0.00274 for each
LoRmU
0.1000
0.0000 Risk gradient (RG) Fig. 3. The RMD of risk factor F1.
ARTICLE IN PRESS W.-K. Lee / Journal of Air Transport Management 12 (2006) 267–273
272
risk factor. The RM Lm and RM R m indexes are calculated using Eq. (11), with a ¼ 0:50. The LoRLm and LoRU m indexes are thus obtained from Eq. (12), with a ¼ 0:50. Table 2 lists 0.5000
InTo-region
the results. While all of the hypothetical RM indexes are the same, the LoR indexes differ among the risk factors. The critical-ranking order of these factors ranked in increasing order of the LoRU m index shows factor F1 has the lowest LoRU index. Accordingly, the RS-line (new m LoRU index) of risk factor F exceeds this lowest threshold 1 m by more than other risk factors. Comparatively, risk factor F8 has the highest LoRU m index, so its RS-line has difficulty exceeding this threshold. A higher RG R m index will produce a lower LoRU index. This result fits with the aviation SRM m theorem. The SRM overseer must adopt more rigorous measures to monitor risk factors when LoRU m index is low. Furthermore, the final column of Table 2 displays the interval between the LoRLm and LoRU m indexes. When the hypothetical RM indexes are the same, if the interval is larger, the deduced ALARP-region of RMD is wider and its LoRU m index is lower (Figs. 3 and 4). In this situation, the RS-line of this kind of risk factor easily falls into the InToregion, and should be considered a more critical risk factor.
0.584
0.4844
Level of risk (LoR)
0.4252 0.4000
ALARP-region
RS-line
0.434
BA-region 0.3000
0.2000
0.1000
3.3. RMDs and risk-monitoring strategies 0.0000
The RMDs of risk factor F1 and F8 are shown in Figs. 3 and 4. Risk factor F1 has the lowest LoRU m index, while risk factor F8 has the highest one. Clearly, a rigorous riskmonitoring strategy must be adopted for risk factor F1, but a slack strategy can be adopted for risk factorc F8. Matching up the RMD can enable the SRM overseer to clearly monitor the status of each risk factor. Table 3 lists the variations of the LoRU m indexes for the 14 risk factors by varying the a-cut value, which can be varied between 0.0 and 1.0. When a-cut is increased, the low LoRU m index is further reduced. On the other hand, the LoRU m index is increased while a-cut is decreased. For example, if a-cut varies from 0.50 to 0.65 for risk factor F1, the LoRU m index is reduced from 0.436 to 0.430. Consequently, more rigorous risk-monitoring measures are adopted when the larger a-cut value is used, while otherwise looser measures are adopted. Numerous results are obtained given different a-cut values for each risk factor. This study emphasizes critical U risk factors with high RG R m index or low LoRm index require close monitoring. Fig. 5 displays the relationships between a-cut values and ( LoRLm , LoRU m ) indexes of risk factor F1. For risk-monitoring, the SRM overseer can
Risk gradient (RG) Fig. 4. The RMD of risk factor F8. Table 3 The variations of LoRU m indexes by varying a-cut
F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 F13 F14
LoRU m a ¼ 0.8
a ¼ 0.65
a ¼ 0.5
a ¼ 0.35
a ¼ 0.2
0.424 0.434 0.454 0.437 0.459 0.461 0.454 0.474 0.448 0.432 0.460 0.453 0.464 0.456
0.430 0.430 0.459 0.443 0.464 0.466 0.459 0.479 0.454 0.439 0.466 0.458 0.469 0.461
0.436 0.445 0.463 0.448 0.469 0.472 0.464 0.484 0.459 0.445 0.471 0.463 0.473 0.465
0.442 0.451 0.467 0.454 0.474 0.477 0.468 0.489 0.464 0.452 0.477 0.468 0.479 0.470
0.447 0.456 0.471 0.459 0.478 0.482 0.472 0.494 0.470 0.458 0.482 0.473 0.483 0.475
upper-bound
lower-bound
0.500 Level of Risk (LoR)
Fm
(0.3, 0.4435) (0.5, 0.4357)
0.450
(0.8, 0.4240)
0.400
RS-line
(0.8, 0.3971) 0.350
(0.5, 0.3687) (0.3, 0.3496)
0.300 0.0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1.0
Fig. 5. The relationship of a and LoR index of risk factor F1.
ARTICLE IN PRESS W.-K. Lee / Journal of Air Transport Management 12 (2006) 267–273
adjust the a-cut value to yield different LoRU m indexes to facilitate risk monitoring for each risk factor. Acknowledgements The author would like to thank the National Science Council of the Republic of China, Taiwan, for financially supporting this research under Contract no. NSC 95-2416H-408-001. Directors of the Safety Management Department in the Taiwanese CAA and airports, airline safety supervisors, academic professors and experts in the research department and the Aviation Safety Council are thanked for their assistance in problem formulation and data collection. References Buckley, J.J., 1984. The multiple judge, multiple criteria ranking problem: a fuzzy set approach. Fuzzy Sets and System 13, 25–37. Button, K., Clarke, A., Palubinskas, G., Stough, R., Thibault, M., 2004. Conforming with ICAO safety oversight standards. Journal of Air Transport Management 10, 251–257.
273
Civil Aeronautics Administration, 1999. Airport Risk Management Reference Manual. Civil Aeronautics Administration, Taipei. Civil Aeronautics Administration, 2001. Airport Risk Self-Superintending System. Civil Aeronautics Administration, Taipei. Edwards, E., 1988. Introductory overview. In: Winner, E.L., Nagel, D.C. (Eds.), Academic Press Human Factors in Aviation. Academic Press, New York. Heinrich, H.W., 1959. Industrial Accident Prevention. McGraw-Hill, New York. Health and Safety Executive, 1992. The Tolerability of Risk from Nuclear Power Stations. Health and Safety Executive, London. Janic, M., 2000. An assessment of risk and safety in civil aviation. Journal of Air Transport Management 6, 43–50. Lee, W.K., Chang, Y.H., 2005a. Applying the fuzzy FMECA to access the risks of flight-safety. Civil Aviation Journal Quarterly 7, 1–22. Lee, W.K., Chang, Y.H., 2005b. Risk assessment model on flight-safety management. Transportation Planning Journal 34, 145–176. Tam, V., Moros, T., Webb, S., Allinson, J., Lee, R., Bilimoria, E., 1996. Application of ALARP to the design of the BP Andrew platform against smoke and gas ingress and gas explosion. Journal of Loss Prevention in the Process Industries 9, 317–322. US Department of Defense, 1980. Procedures for Performing a Failure Mode, Effects and Criticality Analysis. MIL-STD-1629A, Washington, DC.