ANNEX

The common European risk classification scheme

The ERCS shall consist of the following two steps:

STEP 1: Determination of the values of the two variables: severity and probability.

STEP 2: Scoring of the safety risk within the ERCS matrix based on the two determined values of variables.

STEP 1: DETERMINATION OF THE VALUES OF THE VARIABLES

1. Severity of the potential accident outcome

1.1. Identification

The identification of the severity of the potential accident outcome shall follow the following two steps:

(a) a determination of the most likely type of accident that the occurrence under assessment could have escalated to (the so called key risk area);

(b) a determination of the potential loss of life category based on aircraft size and proximity to populated or high-risk areas.

There are following key risk areas:

a. airborne collision: a collision between aircraft while both aircraft are airborne; or between aircraft and other airborne objects (excluding birds and wildlife);

b. aircraft upset: an undesired aircraft state characterised by unintentional divergences from parameters normally experienced during operations, which might ultimately lead to an uncontrolled impact with terrain;

c. collision on runway: a collision between an aircraft and another object (other aircraft, vehicles, etc.) or person that occurs on a runway of an aerodrome or other predesignated landing area. It does not include collisions with birds or wildlife;

d. excursion: an occurrence when an aircraft leaves the runway or movement area of an aerodrome or landing surface of any other predesignated landing area, without getting airborne. It includes high-impact vertical landings for rotorcraft or vertical take-off and landing aircraft and balloons or airships;

e. fire, smoke and pressurisation: an occurrence involving cases of fire, smoke, fumes or pressurisation situations that may become incompatible with human life. This includes occurrences involving fire, smoke or fumes affecting any part of an aircraft, in flight or on the ground, which is not the result of impact or malicious acts;

f. ground damage: damage to aircraft induced by operation of aircraft on ground on any other ground area than a runway or predesignated landing area, as well as damage during maintenance;

g. obstacle collision in flight: collision between an airborne aircraft and obstacles rising from the surface of the earth. Obstacles include tall buildings, trees, power cables, telegraph wires and antennae as well as tethered objects;

h. terrain collision: an occurrence where an airborne aircraft collides with terrain, without indication that the flight crew was unable to control the aircraft. It includes instances when the flight crew is affected by visual illusions or degraded visual environment;

i. other injuries: an occurrence where fatal or non-fatal injuries have been inflicted, which cannot be attributed to any other key risk area;

j. security: an act of unlawful interference against civil aviation. It includes all incidents and breaches related to surveillance and protection, access control, screening, implementation of security controls and any other acts intended to cause malicious or wanton destruction of aircraft and property, endangering or resulting in unlawful interference with civil aviation and its facilities. Includes both physical and cyber security events.

The potential loss of life shall be categorised in the following way:

(a) more than 100 possible fatalities – where the occurrence under assessment involves at least any of the following: — one large certified aircraft with more than 100 potential passengers on board; — an equivalent size aircraft for cargo; — one aircraft of any type in a heavily populated area or in a high-risk area or both; — any situation involving any type of aircraft where more than 100 fatalities may be possible;

(b) between 20 to 100 possible fatalities – where the occurrence under assessment involves at least any of the following: — one medium certified aircraft with 20 to100 potential passengers on board or equivalent size for cargo aircraft; — any situation where 20 to 100 fatalities may be possible;

(c) between 2 to 19 possible fatalities where the occurrence under assessment involves at least any of the following: — one small certified aircraft with up to 19 potential passengers on board; — an equivalent size for cargo aircraft; — any situation where 2 to 19 fatalities may be possible;

(d) 1 possible fatality – where the occurrence under assessment involves at least any of the following: — one uncertified aircraft, that is aircraft not subject to European Union Aviation Safety Agency certification requirements; — any situation where a single fatality may be possible;

(e) 0 possible fatalities – where the occurrence under assessment involves personal injuries only, regardless of the number of minor and serious injuries as long as there are no fatalities.

1.2. Determination

The severity of the accident shall result in one of the following severity scores:

— ‘A’ which stands for no likelihood of an accident;

— ‘E’ which stands for an accident involving minor and serious injury (not life changing) or minor aircraft damage;

— ‘I’ which stands for an accident involving a single fatality, life changing injury or substantial damage accident;

— ‘M’ which stands for a major accident with limited amount of fatalities, life changing injuries or destruction of the aircraft;

— ‘S’ which stands for a significant accident with potential for fatalities and injuries;

— ‘X’ which stands for an extreme catastrophic accident with the potential for significant number of fatalities.

The severity score shall be calculated by combining the key risk area and the potential loss of life as laid down in the following table:

KEY RISK AREA CATEGORY SEVERITY SCORE Airborne collision More than 100 possible fatalities X Between 20 to 100 possible fatalities S Between 2 to 19 possible fatalities M 1 possible fatality I Aircraft upset More than 100 possible fatalities X Between 20 to 100 possible fatalities S Between 2 to 19 possible fatalities M 1 possible fatality I Collision on runway More than 100 possible fatalities X Between 20 to 100 possible fatalities S Between 2 to 19 possible fatalities M 1 possible fatality I 0 possible fatalities E Excursions Between 20 to 100 possible fatalities S Between 2 to 19 possible fatalities M 1 possible fatality I 0 possible fatalities E Fire, smoke and pressurisation More than 100 possible fatalities X Between 20 to 100 possible fatalities S Between 2 to 19 possible fatalities M 1 possible fatality I Ground damage Between 2 to 19 possible fatalities M 1 possible fatality I 0 possible fatalities E Obstacle collision in flight More than 100 possible fatalities X Between 20 to 100 possible fatalities S Between 2 to 19 possible fatalities M 1 possible fatality I Terrain collision More than 100 possible fatalities X Between 20 to 100 possible fatalities S Between 2 to 19 possible fatalities M 1 possible fatality I Other injuries Between 20 to 100 possible fatalities S Between 2 to 19 possible fatalities M 1 possible fatality I 0 possible fatalities E Security More than 100 possible fatalities X Between 20 to 100 possible fatalities S Between 2 to 19 possible fatalities M 1 possible fatality I 0 possible fatalities E

2. Probability of the potential accident outcome

The probability of the worst likely accident outcome shall be obtained by using the ERCS barrier model defined in Section 2.1.

2.1. ERCS barrier model

The purpose of the ERCS barrier model is to assess the effectiveness (that is the number and the strength) of the barriers in the safety system laid down in the Table in Section 2.1.1 which were remaining between the actual occurrence and the worst likely accident outcome. Ultimately, the ERCS barrier model shall determine how close the occurrence under assessment has been to the potential accident.

2.1.1. Barriers

The ERCS barrier model consists of 8 barriers, ordered in a logical sequence and weighted as per the following table:

Barrier number Barrier Barrier weight 1 ‘Aircraft, equipment and infrastructure design’, includes maintenance and correction, operation support, the prevention of problems related to technical factors that could lead to an accident. 5 2 ‘Tactical planning’, includes organisational and individual planning prior to the flight or other operational activity that supports the reduction of the causes and contributors to accidents. 2 3 ‘Regulations, procedures, processes’, includes effective, understandable and available regulations, procedures and processes that are complied with (with the exclusion of the use of procedures for recovery barriers). 3 4 ‘Situational awareness and action’, includes human vigilance for operational threats which ensures identification of operational hazards and effective action to prevent an accident. 2 5 ‘Warning systems operation and action’ that could prevent an accident and which are fit for purpose, functioning, operational and are complied with. 3 6 ‘Late recovery from a potential accident situation’ 1 7 ‘Protections’, when an event has occurred, the level of the outcome is mitigated or prevents the escalation of the occurrence by intangible barriers or providence 1 8 ‘Low energy occurrence’ scores the same as ‘Protections’, but for low-energy key risk areas only (ground damage, excursions, injuries). ‘Not applicable’ for all other key risk areas. 1

2.1.2. Barrier effectiveness

The effectiveness of each barrier shall be classified as follows:

— ‘Stopped’ if the barrier prevented the accident from occurring;

— ‘Remaining Known’: if it is known whether the barrier remained between the occurrence under assessment and the potential accident outcome;

— ‘Remaining Assumed’: if it is assumed that the barrier remained between the occurrence under assessment and the potential accident outcome;

— ‘Failed Known’: if it is known that the barrier has failed;

— ‘Failed Assumed’: if it is assumed that the barrier have failed even if insufficient or no information is available to determine this;

— ‘Not Applicable’: if the barrier is not relevant to the occurrence under assessment.

2.1.3. Barrier assessment

The barriers shall be assessed in two steps:

Step 1: To identify which of the barriers defined in the table in section 2.1.1. (1-8) stopped the occurrence from escalating into the potential accident outcome (referred to as the ‘stopping barrier’).

Step 2: To identify in accordance with section 2.1.2 the effectiveness of the remaining barriers. The remaining barriers are those barriers listed in the table in section 2.1.1 which are placed between the stopping barrier and the potential accident outcome. The barriers listed in the table in section 2.1.1 which are placed before the stopping barrier shall not be considered to have contributed to the prevention of the accident outcome and consequently those barriers shall not be scored as ‘Stopped’ or ‘Remaining’.

2.2. Calculation

The probability of the potential accident outcome is the numerical value resulting of the following steps:

Step 1: A sum of all the barrier weights (1 to 5) laid down in the table in section 2.1.1 of all the assessed barriers that were scored either ‘Stopped’, ‘Remaining known’ or ‘Remaining assumed’. The ‘Failed’ and ‘Not Applicable’ barriers shall not be counted for the final score, as those barriers could not have prevented the accident. The resulting barrier weight sum is a numerical value between 0 and 18.

Step 2: The barrier weight sum corresponds to a barrier score between 0 and 9 as per the following table, covering the full range between strong and weak remaining barriers.

Barrier weight sum Corresponding barrier score 0 No barriers left. Worst likely accident outcome realised. 0 1-2 1 3-4 2 5-6 3 7-8 4 9-10 5 11-12 6 13-14 7 15-16 8 17-18 9

STEP 2: SCORING OF THE SAFETY RISK WITHIN THE ERCS MATRIX

The safety risk score is a two-digit value where the first digit corresponds to the alphabetic value resulting from the calculation of the severity of the occurrence (severity score A to X) and the second digit represents the numerical value from the calculation of the corresponding score of the occurrence (0 to 9).

The safety risk score shall be put into the ERCS matrix.

For each given safety risk score there is also a numerical equivalent score for aggregation and analysis purposes which is explained below under ‘Numerical equivalent score’.

The ERCS matrix reflects the safety risk score and the numerical associated figures of an occurrence as follows:

In addition to the safety risk score and to facilitate the determination of the urgency of the recommended action to be taken about the occurrence, the following three colours could be used in the ERCS matrix:

Colour ERCS score Meaning RED X0, X1, X2, S0, S1, S2, M0, M1, I0 High risk. Occurrences with the highest risk. YELLOW X3, X4, S3, S4, M2, M3, I1, I2, E0, E1 Elevated risk. Occurrences with intermediate risk GREEN X5 to X9, S5 to S9, M4 to M9, I3 to I9, E2 to E9. Low risk occurrences

The green area of the matrix contains lower risk values. They provide data for in-depth analysis on safety related occurrences that could, either in isolation or in conjunction with other events, increase the risk values of such occurrences.

Numerical equivalent score

Each ERCS score is assigned a corresponding numerical value of risk magnitude to facilitate the aggregation and numerical analysis of multiple occurrences with an ERCS score:

ERCS Score X9 X8 X7 X6 X5 X4 X3 X2 X1 X0 Corresponding numerical value 0,001 0,01 0,1 1 10 100 1000 10000 100000 1000000 ERCS Score S9 S8 S7 S6 S5 S4 S3 S2 S1 S0 Corresponding numerical value 0,0005 0,005 0,05 0,5 5 50 500 5000 50000 500000 ERCS Score M9 M8 M7 M6 M5 M4 M3 M2 M1 M0 Corresponding numerical value 0,0001 0,001 0,01 0,1 1 10 100 1000 10000 100000 ERCS Score I9 I8 I7 I6 I5 I4 I3 I2 I1 I0 Corresponding numerical value 0,00001 0,0001 0,001 0,01 0,1 1 10 100 1000 10000 ERCS Score E9 E8 E7 E6 E5 E4 E3 E2 E1 E0 Corresponding numerical value 0,000001 0,00001 0,0001 0,001 0,01 0,1 1 10 100 1000

Both column 10 and the row A in the matrix bear the value 0 as the corresponding numerical value.