Version classiqueVersion mobile

Proceedings of the fourth Resilience Engineering Symposium

Erik Hollnagel
Éric Rigaud
Denis Besnard

Mapping Resilience through Automatic Safety Data Gathering

Simone Pozzi, Carlo Valbonesi, Valentina Beato, Rodolfo Volpini, Francesco Maria Giustizieri, Frederic Lieutaud et Antonio Licu


The paper discusses the use of safety data gathered through automatic devices to characterise the resilience level of the airspace. It reports the results of exploratory studies being carried out by the authors, in particular on the use of density maps to analyse the spatial and temporal dynamics of resilience.

Note de l’auteur

Note portant sur l’auteur1

Note portant sur l’auteur2

Note portant sur l’auteur3

Note portant sur l’auteur4

Note portant sur l’auteur5

Note portant sur l’auteur6

Note portant sur l’auteur7

Texte intégral

1 Introduction

1The structure of Air Traffic Management (ATM) as it is known today will undergo major changes both in Europe (the SESAR program) and in the USA (the NextGen programs). These initiatives aim to radically change the exiting transportation system, by intervening on technologies, procedures, role of human actors and organizational aspects.

2One of the key innovation drivers of both SESAR and NextGen is the shift from a structured route network to a trajectory-based network, where users (i.e. single flights) will be able to fly their selected trajectory, instead of following a predetermined route grid (made of airways and crossing points) across the sky (Joint Planning and Development Office (JPDO), 2008; SESAR, 2007). Trajectory-based operations will increase the flexible use of the airspace, but they will not result in a totally unstructured airspace. It is reasonable to expect that most characteristics of the current situation (e.g. bottlenecks, main traffic flows and crossing points, boundary points, etc.) will also emerge in the future scenario, resulting in a different structure, probably a highly flexible and changing one. While the proposed changes will most likely deliver a more flexible use of the airspace driven by users’ requests, it cannot be assumed that the resulting order is going to be a “good” one under all the different performance criteria

3(e.g. efficiency, predictability and safety among the main ones).

4The scenario envisioned by SESAR and NextGen entails a system with a bottom-up organisation (the flight structure emerges out of the single trajectories) and increased interconnections (less predefined boundary zones, information being shared by all the actors). Compared to the fixed route scenario, the structure and properties of the future aviation network system will emerge from the interactions among many elements, among which we may quote: users’ decisions and actions (i.e. pilots and air traffic controllers), trajectory-based operations, organizational changes, and the temporary deployment of different arrays of resources/tools to manage specific situations, weather and other environmental factors. The increase of the complexity degree will cause changes that will be hardly understood by relying on the analysis of single elements and will instead require the understanding of how all the new elements will interact together, thus offering an excellent opportunities for the application of the resilience engineering framework. In this perspective, making sense of large data sets -in contrast with the analysis of isolated occurrences -seems a promising way for unravelling the big picture of complex interactions emerging within the ATM system and practically monitor its resilience.

2 Automatic Safety Monitoring in ATM

5The explosion of digital technology has made data super-abundant and easier to collect. Organisations in every industry, in every part of the world invest an increasing amount of money on systems for data collection and analysis. This huge amount of information enables organisations to do things that previously could have not been done like spot business trends, objectively monitor performance levels, anticipate market demands and so on (Bollier, 2010; The Economist, 2010).

6ATM has just recently started to dedicate more attention to opportunities offered by analytics, especially when it comes to safety management. To comply with the regulatory requirements To comply with the regulatory requirements (e.g. the Commission Regulation (EC) No. 2096/2005 transposing ESARR3 into Common Requirements (Commission Regulation (EC) No 2096/2005, 2005)),and pursue the opportunities offered by the availability of large sets of digital data, EUROCONTROL has been actively investing in the development of Automatic Safety Data Gathering (ASDG) tools for more than ten years, and in particular it has developed and constantly upgraded the Automatic Safety Monitoring Tool (ASMT). ASMT has been designed to assist users in the collection and analysis of safety data, by constantly monitoring in quasi-real time radar tracks, flight plans and system alerts. ASMT can be connected to the operational ATM system to elaborate in quasi real-time data on radar tracks, flight plans and system alerts. It automatically detects operational and technical occurrences according to user-defined parameters. ASMT detects events through the computation of the current air traffic situation, continuously updated from the track and flight plan inputs. Currently ASMT gathers data on seven types of safety events. ASMT own modules detect four of these types: Proximity (e.g. separation minima infringements), Airspace Penetration, Altitude Deviation (e.g. level busts) and Rate of Closure. The recording of the three other types is triggered by system alerts, coming from the ATC system, e.g. the case of Safety Nets (Short Term Conflict Alert or Area Proximity Warning), or down-linked from aircraft, e.g. the case of ACAS-RA alert. More information on ASMT and on Automatic Safety Data Gathering can be found in (EUROCONTROL, 2006).

3 Maps of the Airspace Resilience

7In this section we will present some examples of how to use ASMT collected data to characterise airspace resilience. These examples are derived by previous works of the authors (Beato et al., 2010; Pozzi, Lotti, Matrella, & Save, 2008; Pozzi et al., 2011).

8A first example is in continuity with today’s safety approaches: counting safety-related events (near misses like losses of separation or safety nets alerts in the case under study) and thereby identifying bottlenecks or hotspots. In our experience with ASMT, this resulted in a geographical representation similar to a scatter plot (mapped on a geographical area). Hotspots are here defined by the sheer number of events, and they can be visually appreciated by simply looking at the map (Figure 1). We could say that this analysis approach is focused on the output produced by the dynamics of the ATM system, i.e. the safety occurrences themselves.

Figure 1. Geographical scatter plot for a data set of ATM safety events (safety nets activations) collected by ASMT

9A more refined representation can be obtained by shifting to using density estimation. While plotting single events may result in a cluttered image around major hotspots, with the introduction of density estimation we obtain a smooth function for the localization of hotspots. This, in addition to the ease of data interpretation, more importantly allows for the creation of isolines of constant density which are the key component for the definition of hotspots. Moreover, handling with smooth functions enables the estimation of density derivatives. Indeed, the height of the related density peak together with the value of the derivative of the density at a given distance from the peak could provide a method of characterizing a hotspot, based on the peaks steepness (Figure 2).

10The density maps can be the starting point for a markedly different approach to the interpretation of these data sets, more oriented to resilience engineering. Rather than focusing on events as a static output, we may instead study the dynamics of safety events distribution. If resilience can be defined as “the capability to recognise, adapt to and absorb variations, changes, disturbances, disruptions, and surprises” (Woods & Hollnagel, 2006), in the present case we could see resilience as the airspace capability to absorb, dissipate, or simply tolerate the occurrence of safety events without any major disruption. From this perspective, the single near misses do not count as negative events to be avoided. They should be instead considered as proxies for the normal performance of the system. In other words, the regularities in the safety events distribution can be considered indicators of the “normal” equilibrium (Hollnagel, 2006). These events are “produced” by the ATM system (most likely because of the interaction between human, hardware and procedural elements), thus they can be used as proxies to measure the system characteristics. Whilst it is unfeasible to directly measure the system equilibrium, safety events can be more easily observed and measured. Their patterns and dynamics reveal the adaptive capacity of the system, thus they may be analysed to describe some of the core features of its resilience (for an elaboration of the same issue see Woods, 2006). In this sense, safety events dynamics can be analysed by different perspectives: spatially (to what extent different portions of the airspace are connected), temporally (how density changes in time) and typologically (how different types of events are distributed in time and space).

Figure 2. Density map based on the same data set

11From the spatial point of view, we can differentiate between integrated and segregated hotspots. While some hotspots are isolated in space (see top-left of Figure 2), others appear to be connected with each other by a “crest” of medium density areas. In our data we could identify highly integrated hotspots, when the hotspot “peaks” lie on a medium density area, and medium integrated hotspot, lying on a medium to low density area. Other hotspots appear instead in segregated areas, meaning that they emerge as a peak out of very low density area. By adding the time dimension to the analysis, such a relationship can be used to describe how disturbances are likely to propagate in the airspace. Propagation may show two causal directions:

  • density accumulates from the “crests” to the hotspot: medium density crests engender high density hotspots, by crossing or merging in specific areas (see the big peak emerging in the central image of Figure 3);

  • density dissipates from the hotspot along some crests: first density accumulates in one specific hotspot, then it propagates with decreasingly less intensity along some crests (see how the two peaks in the left picture of Figure 3 dissolve in lower peaks as time progresses from left to right).

12Lastly, the typological dimension which could be based on ATM specific variables. Safety events in ATM are characterized by several variables like duration, warning time (in case of safety nets related occurrences) and many others. For those events in which a safe separation between two aircraft is not kept, one of the most interesting variable is the risk of collision which is “the risk classification of an aircraft proximity in which serious risk of collision has existed” (ICAO, 2007). A quantitative method for the evaluation of the risk of collision has been developed during the years by EUROCONTROL (EUROCONTROL, 2009). In a few words, risk of collision is the sum of the scores assigned to achieved separation (how large were the safety margins between the two aircraft in the worst point of the occurrence) and rate of closure (how fast the two aircraft were converging towards each other, i.e. how rapidly the safety of the encounter was degrading). In Figure 4 safety events of a specific hotspot are distributed by risk of collision.

Figure 3 The temporal evolution of safety event density over one area, 6 hours’ windows

13Therefore for each hotspot we could analyse the distribution of occurrences in terms of risk of collision. In this way it is possible to understand better the dynamics of risk distribution. For example, a high density peak could mainly consist of low risk events (with a low percentage of high risk ones) while, on the other hand, a low density area could feature mainly events with a high risk of collision. Over time it could be possible to observe how these values of risk of collision evolve, if they increase or decrease along the “crests” of the system.

Figure 4 The composition by risk of collision of a hotspot of safety events (crosses, empty circles and full circles corresponding respectively to low, medium and high risk of collision)

4 Conclusions and Next Steps

14Out of this analysis, we expect to obtain a characterization of the airspace in terms of degree of integration/segregation, analysed along the time dimension. Integrated areas will be defined as those where disturbances (e.g. high complexity) are propagated, while segregated areas contain the disturbances in limited space/time. The next step of this work will be to analyse the airspace using different proxies, possibly using both safety and performance ones (e.g. delays). The dynamics of the different proxies will then be correlated, to identify isomorphic aspects and main differences (i.e. one airspace may propagate safety disturbances, while effectively contain performance disturbances).

15However, the long term goal of such an analysis is not the system description per se, rather the identification of system dynamics and properties that can be used to exercise control (or at least prediction) on the system. Managing complex dynamic systems requires the ability to adjust not only the strategy, but most of all to change the relationship between all the different actors, between the different sets of resources, between different goals and priorities, to accommodate for the current demands posed by the system (Woods & Branlat, 2010). Ideally, the future ATM system manager (SESAR envisages the creation of the complexity manager role) should be able to intervene on the airspace resilience by varying the shape of its anisotropy, increasing integration between areas, or segregating disturbances in selected areas, etc.. For instance, s/he should be able to increase the segregation level to confine the propagation of disturbances, while increased integration may be used to avoid abrupt changes in the stress level of the system.

16In the ATM world this may entail acting on two levels:

  • Macro level: emergent properties are dealt at their same level of granularity. This may happen by dynamically restructuring the organisational layer, by varying the system boundaries and areas of responsibility, or by acting on the relative importance of the Key Performance Areas (e.g. the system may increase the priority of efficiency over predictability, or safety over flexibility, etc.).

  • Micro level: action is taken on the microscopic ingredients necessary to reproduce a macroscopic behaviour, either to prevent the latter from occurring, or to strengthen its occurrence. For instance, an ATM controller may selectively re-route aircraft to avoid additional stress on a specific crossing point.

17The analysis work should map the current airspace structure, but also uncover the causal relationship by which control can be exercised on these two levels.



Beato, V., Tedeschi, A., Valbonesi, C., Giustizieri, M.F., Volpini, R., Lieutaud, F., et al. (2010). Integration and Segregation in SNET High Density Areas. Paper presented at the EUROCONTROL 8th Innovative Research Workshop & Exhibition.

Bollier, D. (2010). The Promise and Peril of Big Data: Aspen Institute. Commission Regulation (EC) No 2096/2005. (2005). Laying down Common Requirements for the provision of air navigation services.

EUROCONTROL. (2006). ASMT Introduction.

EUROCONTROL. (2009). Risk Analysis Tool. Guidance Material.

Hollnagel, E. (2006). Resilience – the Challenge of the Unstable. In E. Hollnagel, D.D. Woods & N. Leveson (Eds.), Resilience engineering : concepts and precepts (pp. 9-17). Aldershot, UK; Burlington, VT: Ashgate Publishing Limited.

ICAO. (2007). Doc 4444 - Air Traffic Management.

Joint Planning and Development Office (JPDO). (2008). NEXTGEN Integrated workplan: a functional outline.

Pozzi, S., Lotti, G., Matrella, G., & Save, L. (2008). Turning information into knowledge. The case of Automatic Safety Data Gathering. Paper presented at the EUROCONTROL Annual Safety R&D Seminar, Southampton, UK.

Pozzi, S., Valbonesi, C., Beato, V., Volpini, R., Giustizieri, M.F., Lieutaud, F., et al. (2011). Safety Monitoring in the Age of Big Data. From Description to Intervention. Paper presented at the Ninth USA/Europe Air Traffic Management Research and Development Seminar (ATM2011).

SESAR. (2007). Definition of the future ATM Target Concept - D3.

The Economist. (2010). Data, data everywhere.

Woods, D.D. (2006). Incidents -Markers of Resilience or Brittleness? In E. Hollnagel, D.D. Woods & N. Leveson (Eds.), Resilience engineering : concepts and precepts (pp. 69-75). Aldershot, UK; Burlington, VT: Ashgate Publishing Limited.

Woods, D.D., & Branlat, M. (2010). Hollnagel's test: being 'in control' of highly interdependent multi-layered networked systems. Cognition, Technology & Work, 12(2), 95-101.

Woods, D.D., & Hollnagel, E. (2006). Prologue: Resilience Engineering Concepts. In E. Hollnagel, D.D. Woods & N. Leveson (Eds.), Resilience engineering : concepts and precepts (pp. 1-6). Aldershot, UK; Burlington, VT: Ashgate Publishing Limited.


1 Deep Blue Consulting and Research, Piazza Buenos Aires 20, Rome, Italy

2 Deep Blue Consulting and Research, Piazza Buenos Aires 20, Rome, Italy

3 Deep Blue Consulting and Research, Piazza Buenos Aires 20, Rome, Italy

4 ENAV, Via Salaria 716, Rome, Italy

5 ENAV, Via Salaria 716, Rome, Italy

6 EUROCONTROL HQ, Rue de la Fusée 96, Brussels, Belgium

7 EUROCONTROL HQ, Rue de la Fusée 96, Brussels, Belgium

Table des illustrations

Légende Figure 1. Geographical scatter plot for a data set of ATM safety events (safety nets activations) collected by ASMT
Fichier image/jpeg, 104k
Légende Figure 2. Density map based on the same data set
Fichier image/jpeg, 132k
Légende Figure 3 The temporal evolution of safety event density over one area, 6 hours’ windows
Fichier image/jpeg, 732k
Légende Figure 4 The composition by risk of collision of a hotspot of safety events (crosses, empty circles and full circles corresponding respectively to low, medium and high risk of collision)
Fichier image/jpeg, 202k

Le texte et les autres éléments (illustrations, fichiers annexes importés) sont sous Licence OpenEdition Books, sauf mention contraire.

Rechercher dans OpenEdition Search

Vous allez être redirigé vers OpenEdition Search