The common European risk classification scheme

The ERCS shall consist of the following two steps: STEP 1: Determination of the values of the two variables: severity and probability. STEP 2: Scoring of the safety risk within the ERCS matrix based on the two determined values of variables. STEP 1: DETERMINATION OF THE VALUES OF THE VARIABLES

1.Severity of the potential accident outcome

1.1. Identification The identification of the severity of the potential accident outcome shall follow the following two steps:

(a)a determination of the most likely type of accident that the occurrence under assessment could have escalated to (the so called key risk area);

(b)a determination of the potential loss of life category based on aircraft size and proximity to populated or high-risk areas. There are following key risk areas: a. airborne collision: a collision between aircraft while both aircraft are airborne; or between aircraft and other airborne objects (excluding birds and wildlife); b. aircraft upset: an undesired aircraft state characterised by unintentional divergences from parameters normally experienced during operations, which might ultimately lead to an uncontrolled impact with terrain; c. collision on runway: a collision between an aircraft and another object (other aircraft, vehicles, etc.) or person that occurs on a runway of an aerodrome or other predesignated landing area. It does not include collisions with birds or wildlife; d. excursion: an occurrence when an aircraft leaves the runway or movement area of an aerodrome or landing surface of any other predesignated landing area, without getting airborne. It includes high-impact vertical landings for rotorcraft or vertical take-off and landing aircraft and balloons or airships; e. fire, smoke and pressurisation: an occurrence involving cases of fire, smoke, fumes or pressurisation situations that may become incompatible with human life. This includes occurrences involving fire, smoke or fumes affecting any part of an aircraft, in flight or on the ground, which is not the result of impact or malicious acts; f. ground damage: damage to aircraft induced by operation of aircraft on ground on any other ground area than a runway or predesignated landing area, as well as damage during maintenance; g. obstacle collision in flight: collision between an airborne aircraft and obstacles rising from the surface of the earth. Obstacles include tall buildings, trees, power cables, telegraph wires and antennae as well as tethered objects; h. terrain collision: an occurrence where an airborne aircraft collides with terrain, without indication that the flight crew was unable to control the aircraft. It includes instances when the flight crew is affected by visual illusions or degraded visual environment; i. other injuries: an occurrence where fatal or non-fatal injuries have been inflicted, which cannot be attributed to any other key risk area; j. security: an act of unlawful interference against civil aviation. It includes all incidents and breaches related to surveillance and protection, access control, screening, implementation of security controls and any other acts intended to cause malicious or wanton destruction of aircraft and property, endangering or resulting in unlawful interference with civil aviation and its facilities. Includes both physical and cyber security events. The potential loss of life shall be categorised in the following way:

(a)more than 100 possible fatalities – where the occurrence under assessment involves at least any of the following: one large certified aircraft with more than 100 potential passengers on board; an equivalent size aircraft for cargo; one aircraft of any type in a heavily populated area or in a high-risk area or both; any situation involving any type of aircraft where more than 100 fatalities may be possible;

(b)between 20 to 100 possible fatalities – where the occurrence under assessment involves at least any of the following: one medium certified aircraft with 20 to100 potential passengers on board or equivalent size for cargo aircraft; any situation where 20 to 100 fatalities may be possible;

(c)between 2 to 19 possible fatalities where the occurrence under assessment involves at least any of the following: one small certified aircraft with up to 19 potential passengers on board; an equivalent size for cargo aircraft; any situation where 2 to 19 fatalities may be possible;

(d)1 possible fatality – where the occurrence under assessment involves at least any of the following: one uncertified aircraft, that is aircraft not subject to European Union Aviation Safety Agency certification requirements; any situation where a single fatality may be possible;

(e)0 possible fatalities – where the occurrence under assessment involves personal injuries only, regardless of the number of minor and serious injuries as long as there are no fatalities.

1.2 Determination The severity of the accident shall result in one of the following severity scores: ‘A’ which stands for no likelihood of an accident; ‘E’ which stands for an accident involving minor and serious injury (not life changing) or minor aircraft damage; ‘I’ which stands for an accident involving a single fatality, life changing injury or substantial damage accident; ‘M’ which stands for a major accident with limited amount of fatalities, life changing injuries or destruction of the aircraft; ‘S’ which stands for a significant accident with potential for fatalities and injuries; ‘X’ which stands for an extreme catastrophic accident with the potential for significant number of fatalities. The severity score shall be calculated by combining the key risk area and the potential loss of life as laid down in the following table:

2.Probability of the potential accident outcome The probability of the worst likely accident outcome shall be obtained by using the ERCS barrier model defined in Section 2.1.

2.1. ERCS barrier model The purpose of the ERCS barrier model is to assess the effectiveness (that is the number and the strength) of the barriers in the safety system laid down in the Table in Section 2.1.1 which were remaining between the actual occurrence and the worst likely accident outcome. Ultimately, the ERCS barrier model shall determine how close the occurrence under assessment has been to the potential accident.

2.1.1. Barriers The ERCS barrier model consists of 8 barriers, ordered in a logical sequence and weighted as per the following table:

2.1.2. Barrier effectiveness The effectiveness of each barrier shall be classified as follows: ‘Stopped’ if the barrier prevented the accident from occurring; ‘Remaining Known’: if it is known whether the barrier remained between the occurrence under assessment and the potential accident outcome; ‘Remaining Assumed’: if it is assumed that the barrier remained between the occurrence under assessment and the potential accident outcome; ‘Failed Known’: if it is known that the barrier has failed; ‘Failed Assumed’: if it is assumed that the barrier have failed even if insufficient or no information is available to determine this; ‘Not Applicable’: if the barrier is not relevant to the occurrence under assessment.

2.1.3. Barrier assessment The barriers shall be assessed in two steps: Step 1: To identify which of the barriers defined in the table in section 2.1.1. (1-8) stopped the occurrence from escalating into the potential accident outcome (referred to as the ‘stopping barrier’). Step 2: To identify in accordance with section 2.1.2 the effectiveness of the remaining barriers. The remaining barriers are those barriers listed in the table in section 2.1.1 which are placed between the stopping barrier and the potential accident outcome. The barriers listed in the table in section 2.1.1 which are placed before the stopping barrier shall not be considered to have contributed to the prevention of the accident outcome and consequently those barriers shall not be scored as ‘Stopped’ or ‘Remaining’.

2.2. Calculation The probability of the potential accident outcome is the numerical value resulting of the following steps: Step 1: A sum of all the barrier weights (1 to 5) laid down in the table in section 2.1.1 of all the assessed barriers that were scored either ‘Stopped’, ‘Remaining known’ or ‘Remaining assumed’. The ‘Failed’ and ‘Not Applicable’ barriers shall not be counted for the final score, as those barriers could not have prevented the accident. The resulting barrier weight sum is a numerical value between 0 and 18. Step 2: The barrier weight sum corresponds to a barrier score between 0 and 9 as per the following table, covering the full range between strong and weak remaining barriers.

STEP 2: SCORING OF THE SAFETY RISK WITHIN THE ERCS MATRIX The safety risk score is a two-digit value where the first digit corresponds to the alphabetic value resulting from the calculation of the severity of the occurrence (severity score A to X) and the second digit represents the numerical value from the calculation of the corresponding score of the occurrence (0 to 9). The safety risk score shall be put into the ERCS matrix. For each given safety risk score there is also a numerical equivalent score for aggregation and analysis purposes which is explained below under ‘Numerical equivalent score’. The ERCS matrix reflects the safety risk score and the numerical associated figures of an occurrence as follows:

In addition to the safety risk score and to facilitate the determination of the urgency of the recommended action to be taken about the occurrence, the following three colours could be used in the ERCS matrix:

The green area of the matrix contains lower risk values. They provide data for in-depth analysis on safety related occurrences that could, either in isolation or in conjunction with other events, increase the risk values of such occurrences. Numerical equivalent score Each ERCS score is assigned a corresponding numerical value of risk magnitude to facilitate the aggregation and numerical analysis of multiple occurrences with an ERCS score:

Both column 10 and the row A in the matrix bear the value 0 as the corresponding numerical value.