Safety and Resilience Bayesian Belief Network (SR-BBN) for ATM

This study delves into the realm of Air Traffic Management (ATM) and its criticality in ensuring the safety and resilience of aviation systems. Traditionally, safety has been approached reactively (Safety I), but with the complexities of socio-technical systems like ATM, a shift towards proactive measures is essential. This research explores Resilience Engineering (RE) and Safety II, emphasizing learning from a system’s adaptability in everyday situations. ATM, a multifaceted system, relies on technology, organization, and human interactions, striving to maintain equilibrium among these pillars for safe and efficient operations. Any changes to these elements can disrupt this balance, necessitating a systemic perspective. Safety in ATM depends on resource availability, timeliness, and coordination among organizations and humans, while resilient performance extends safety beyond the expected operating conditions. To unify safety and resilience, this study introduces the Safety Resilience-Bayesian Network (SR-BBN) model. This model integrates data-driven and knowledge-based approaches, categorizing variables into separations, external factors, nominal conditions, and Air Traffic Controller (ATCO) strategies. The SR-BBN model aids in predicting safety outcomes and identifies influential variables.


Introduction
The aviation industry has been characterized by a long-standing commitment to safety consciousness [1].The traditional approach, known as Safety I, has historically played a pivotal role in enhancing the safety of industrial systems.However, the modern Air Traffic Management (ATM) landscape introduces a complex socio-technical system, fundamentally distinct from its industrial counterparts.This divergence necessitates a paradigm shift toward embracing proactive safety measures, ushering in the era of Safety II and Resilience Engineering (RE).Safety I, rooted in reactivity, encounters limitations when confronted with the intricate dynamics of ATM [2].
This study embarks on an exploration of the integration of Safety II and RE principles into ATM, recognizing the criticality of learning from a system's ability to adapt seamlessly in everyday operational scenarios.
It aims to shed light on the transformative potential of the Safety Resilience-Bayesian Belief Network (SR-BBN) model in revolutionizing safety assessment and decision-making in this dynamic domain [3].
• Safety and Resilience Integration: The primary focus is on understanding how safety and resilience principles can be effectively integrated into the existing ATM framework.This integration extends to both data-driven and knowledge-based approaches.
• Data Sources: The study relies on data from operational ATM environments, emphasizing their relevance to safety and resilience indicators.The defined scope ensures a comprehensive exploration of safety and resilience within ATM, with a specific focus on the integration of these principles.It sets the boundaries for the study, providing a clear context for the subsequent methodology and conclusions.

Methodology
SR-BBN model combines data-driven and knowledge-based approaches to provide a comprehensive understanding of safety and resilience dynamics.
The process begins by selecting the input-output variables and scenarios for analysis.These choices are guided by the need to accurately represent the operational environment and identify critical safety and resilience indicators.Subsequently, data preparation becomes a crucial step to ensure that the model is fed with high-quality, relevant data.
The methodology involve the following parts:

Part 1: Data preparation
In the initial data preparation phase, critical tasks are undertaken to ensure data readiness for analysis.This phase involves the selection of input-output variables deemed essential, the judicious choice of representative scenarios for the ATM system, and the meticulous data preparation process.These preparatory steps collectively establish the foundation for subsequent analysis, facilitating the derivation of precise and meaningful insights into the safety and resilience of ANS/ATM operations.

Part 2: Capture ATCO Standpoint
In this part, the focus shifts to capturing the perspective of Air Traffic Controllers (ATCOs).Resilience variables that are suitable for integration into the SR-BBN model are selected.This information provides valuable insights into ATCO strategies and their impact on safety and resilience.

Part 3: Development of the SR-BBN
The core of the process is the development and training of the SR-BBN model.This step involves creating a Bayesian Belief Network that integrates safety variables obtained from safety analysis and resilience strategies identified as pivotal in describing resilient performance.
Once the SR-BBN model is developed, it is subjected to an assessment for a selected scenario.This assessment aims to evaluate the model's predictive capabilities and its ability to quantify safety and resilience within ATM operations.

SR-BBN Model
This section provides a comprehensive description of the SR-BBN model, which forms the core of the study's methodology.The model's structure, including its variables and their relationships, is detailed to offer a clear understanding of how safety and resilience are quantified within the ATM context.The SR-BBN model comprises three main groups of variables: • Variables Related to Separations: These variables account for planned and actual vertical and horizontal separations between aircraft pairs in their Closest Point of Approach (CPA).The planned separation refers to the minimum distance that the aircraft would have had if they had only followed their trajectory without any ATCO action.
• Variables Related to External and Nominal Conditions: These variables consider external factors influencing sector behavior, including severe weather conditions, sector capacity, and the number of concurrent aircraft.
• Variables Related to ATCO Strategies: This group focuses on the strategies employed by ATCOs in tactical horizons.Strategies include ODL (Opposite Direction Levels), vertical route management, lateral route management, tactical radar headings, sector split/reconfiguring the airspace, planned sector capacity (with its buffer), and regulation.The SR-BBN model structure allows for the collection of applied strategies and draws conclusions based on their combinations and active external conditions or priority separations.The strategies applied by the ATCO in a tactical horizon or by the ATM system in pre-tactical or even strategic horizon are summarize in the following table: The use of ODL to avoid conflict.

Strategy 2
Vertical route management Use of level changes to avoid conflict.

Strategy 3
Lateral route management Use of speed changes or lateral deviations to avoid conflict.

Strategy 4
Tactical radar headings Use of radar heading clearances to avoid conflict.

Strategy 5
Sector split/reconfiguring the airspace Change of configuration to deal with the excess of demand or unforseen problem.

Strategy 6
Planned sector capacity (with its buffer) Planification of the sectorisation is by nature a strategy that adds a buffer for contingency.

Strategy 7
Regulation Regulation or restriction that affects the operation.
Although there are 7 strategies, the first four are considered more tactical as the ATCO applies them to traffic.

Validation
The validation results offer critical insights into the integration of safety and resilience through the SR-BBN model within the context of Air Navigation Services (ANS) and ATM operations.
To demonstrate the synergy between safety and resilience, focus was placed on a scenario representing conditions before and after a significant change in the ATM system.One scenario was chosen, involving different strategies employed by the ATC system, thereby creating distinct operational conditions.
The scenario will focus on the sector and traffic conditions of the operation of Barcelona Central sector during hours of HIGH occupancy, BEFORE the change.
As explained above, the variable that refers to the sector configuration is strategy 5.When this variable is set to state zero the network reproduces the behavior of the sector BEFORE the change, and when is set to one it reproduces the behavior of the sector AFTER the change.Figure 2 represents the initial situation of the network with the state distribution of each of the variables before modifying the occupancy value, and corresponds to the behavior of the of Barcelona Central sector before the change.In this validation scenario, the value of the variable "Occupancy" is set to HIGH, as indicated in Figure 3, to represent the behavior of the same network and sector under high values of occupancy.The planned and actual horizontal separation variables in the CPA are practically unaffected in this case.However, in the case of vertical distances, it can be observed that the states that refer to greater separations between aircraft increase.
Thus, the variable that refers to the number of concurrent aircraft in the sector also increases, as is logical.

Sensitivity Analysis
To gain a deeper understanding of the factors influencing the actual horizontal and vertical separation variables within the CPA, a sensitivity analysis was conducted.This analysis focused on identifying the most influential variables affecting the target nodes.
Thus, the sensitivity analysis of the network shown in Figure 123 shows which variables have the greatest effect on the target nodes.
The red scale represents the importance of the variables.The node representing the number of aircraft in the sector at the same time is in grey.This colour indicates that it has no effect on the target variables, as it is an end node without any arrows reflecting that this node feeds another one.
The sensitivity analysis revealed that planned distances between aircraft in the CPA had the most significant influence on actual separation distances.Additionally, variables such as those related to event rate or specific conditions at the time of CPA and specific ATC strategies (e.g.Strategy 1, Strategy 3 and Strategy 4) showed substantial importance.Interestingly, the rate, a decision influenced by management, played a critical role in determining separation outcomes, highlighting the importance of strategic decisions in enhancing safety and resilience.

Implications and Insights
The validation results presented herein provide valuable implications and insights for ANS/ATM operations.They underscore the dynamic relationship between safety and resilience, particularly in response to changes within the system.
These findings emphasize the need for adaptive strategies and regulatory measures during periods of high demand and adverse weather conditions.Moreover, they highlight the critical role of planning and management decisions, such as the rate, in shaping safety and resilience outcomes.
The validation outcomes serve as a foundation for a broader understanding of safety and resilience in ANS/ATM operations, offering valuable guidance for organizations seeking to enhance their operational capabilities and adaptability, whether in response to system changes or in the design of new systems.These insights contribute to the ongoing pursuit of safer and more resilient aviation systems, ultimately ensuring the well-being of passengers and the efficiency of air travel.

Conclusions
In summary, it is evident that ANS/ATM operations can be significantly influenced by modifications within the ATC/ATM system.The Safety and Resilience (S&R) Approach emerges as a valuable framework for organizations aiming to assess the repercussions of such alterations.This approach entails the identification of strategies employed by both the organization and its human elements, translating these strategies into quantifiable data, and monitoring their implementation over time to effectively manage unforeseen circumstances and routine operations.Moreover, the S&R approach takes into account the sensitivity of safety outcomes to various operating conditions and the diverse actors involved in strategy execution.It is imperative to recognize operating conditions, encompassing supply-side factors and existing safety levels during current operations, while also discerning instances when the system operates in resilient or unsafe modes.Furthermore, the S&R approach proves invaluable in the context of designing a new system, facilitating the evaluation of safety levels under normal and abnormal conditions when specific strategies are altered due to system changes.This approach streamlines the process of eliciting data requirements at the system level during the initial stages, thereby facilitating assessments related to resilient performance and safety levels.To sum up, the S&R approach offers a comprehensive and indispensable methodology for organizations seeking to bolster safety and resilience in ANS/ATM operations, whether they are evaluating modifications to an existing system or embarking on the design of a new one.

Figure 1 :
Figure 1: Schematic simplification of the SR-BBN model

Figure 2 :
Figure 2: Initial SR-BBN network before the change

Figure 3 :
Figure 3: SR-BBN high occupancy before the change

Figure 4 :
Figure 4: Sensitivity analysis • Validation: The validation process is an integral part of this study, involving the development and assessment of the SR-BBN model.This model serves as a key component in quantifying safety and resilience within ATM.• Limitations: It is essential to acknowledge the limitations within the scope.While this study provides valuable insights, it focuses primarily on en-route airspace scenarios.The applicability of the developed models to airport environments is not covered in-depth.
• Practical Applications: The study explores how the SR-BBN model can inform decisionmaking and enhance safety and resilience in operational contexts.

Table 2 :
Main changes in the discrete variables