This section details the abbreviations and acronyms used throughout this review document:
Acronym
AAS
ABL
A-CDM
AMAN
APC
ATC
ATCO
DAS
DFS
ECCAIRS
EU
FC
FTS
ICAO
IRM
ISMS
ISO
LOSA
LVNL
NNHS
OTP
OVV
ROT
RP
SMS
TOP SAG
TTO
VNV

Meaning
Amsterdam Airport Schiphol
Analysebureau luchtvaartvoorvallen / Aviation Occurrence Reporting Bureau
Airport Collaborative Decision Making
Arrival Manager
Apron Control
Air Traffic Control
Air Traffic Control Officer
DFS Aviation Services GmbH
Deutsche Flugsicherung GmbH
European Coordination Centre for Accident and Incident Reporting Systems
European Union
Flight Crew
Fast-Time Simulation
International Civil Aviation Organization
Integrated Risk Management
Integral Safety Management System
Integral Safety Office (operational function of the ISMS)
Line Operations Safety Audit
Luchtverkeersleiding Nederland / Air traffic control the Netherlands
Nieuw Normen- en Handhavingstelsel / New standards and enforcement system
On Time Performance
Onderzoeksraad voor Veiligheid / Dutch Safety Board
Runway Occupancy Time
Reference period
Safety Management System
TOP Safety Action Group
Target Time Over
Vereniging Nederlandse Verkeersvliegers / Association of Dutch Pilots

Figure 1. Common Risk Matrix for joint sector ISMS
Figure 2. Flight crew, ATC and airport operations hazards with respect to runway (combination)
changes
Figure 3. Plotting of commonly agreed risk classifications of the Flight Crew, ATC, and Airport
Operations hazards and corresponding operational outcomes
Figure 4. Example of the expected effectiveness mitigating measures on three hazards
Figure 5. Plotting of ATC_OB_1 & ATC_IB_1 risk classification taking into account the measures
being implemented

In this document DFS Aviation Services GmbH presents the results of the review carried out on the
process, methodology, findings and actions of previous analyses and mitigations regarding
operational risks introduced by the significant number of runway combination changes at Schiphol
airport, as well as the impact brought by the 4th runway rule to those risks.
The Risk analysis of runway combination changes at Schiphol airport (referred to as Risk analysis)
was entrusted to the company MovingDot by the Integral Safety Management System (ISMS) and
came to address some of the concerns of the Dutch Safety Board (OVV) regarding air traffic safety
at Schiphol.
The Risk analysis confirms that current runway combination changes are a source of safety risks at
the airport. However, the majority of these risks are acceptable. Only the risk of operational
complexity and workload is recommendable to be reduced. This was confirmed by a ‘first’ external
review carried out by Helios, who made recommendations such as to better consider future growth
in the analysis or to assure risk reduction by implementing risk mitigation actions.
A series of measures were defined in a Risk reduction action plan (referred to as action plan)
performed by an ISMS taskforce led by LVNL.
The Risk analysis comes to provide evidence that in-progress and future endeavours in the action
plan are going to have a positive impact, not only on the risk of operational complexity and workload
(slightly between the ‘acceptable’ and the ‘tolerable’ region of the Risk Matrix), but also on the rest
of detected risks of runway combination changes.
LVNL shows efforts to accommodate the requirements of local residents by reducing the use of a
fourth runway. The measures to that purpose have been defined in “The fourth runway rule and the
Schiphol operations” (referred to as Fourth runway rule), some of them applicable from summer
2019.
This review addresses the interest of the Dutch Ministry of Infrastructure and Water Management
(referred to as Ministry) to ascertain the activities carried out to manage safety risks in the scope of
runway combination changes and fourth runway operations.
The interest is also drawn to make sure that risks keep being controlled after implementation of the
measures. This includes the assurance of compatibility of measures between the action plan and the
Fourth runway rule. In essence, that Safety remains uncompromised in a future at Schiphol, including
a context of traffic growth.
The results of the DFS Aviation Services GmbH review show that both the Risk analysis and action
plan have followed an adequate methodology; that safety risks of runway combination changes are
acceptable (only operational complexity in the ‘tolerable’ area), and that current processes in place
assure controllability of future risks.
Some of the measures in the action plan have already proven a positive safety impact on reducing
risks. Future control is assured by means of current processes to manage safety risks (e.g. change
management) and continuous monitoring (e.g. KPI/trends), and the actions thereby.
Within the Risk analysis, the 4th runway rule was just a reason (part of the ‘noise abatement
regulations’) for runway changes, and hence a parameter to determine the risk. The risks that may
arise from future measures/solutions (mid-term measures) to reduce the use of the fourth runway
are also kept under control by means of the processes in place at LVNL to manage changes to the
functional system.
The measures in the action plan and the Fourth runway rule need to be considered complementary,
as together they intend to reduce the use of a fourth runway, while reducing the operational
complexity and increasing existing capacity.

On April 2017 the Dutch Safety Board (Onderzoeksraad voor Veiligheid, OVV) published the report
“Schiphol Air Traffic Safety”, which was preceded by an investigation to identify vulnerabilities in the
safety system around Schiphol. During its investigation, the OVV detected that there were safety
risks that needed to be “tackled integrally and systematically”, and suggested to reduce the number
of runway configuration changes. In addition, they pointed out that no party at Schiphol had taken
responsibility in the past for the integral safety of air traffic at and around the airport. The role of the
Ministry was also questioned for not acting as the party with final responsibility, and missing the
holistic view of aviation safety at Schiphol. Following the recommendations of the report, the sector
parties (operational stakeholders) at Schiphol built the ISMS to bring safety management at Schiphol
to an integral level.
As part of its tasks, the new ISMS sought to tackle OVV concerns on the number of runway
configuration changes. Because this was not available yet, first an assignment to perform a study on
the safety risks of these changes was given to an external party (MovingDot), which produced the
Risk analysis of runway combination changes at Schiphol airport. Contrary to the OVV report, the
Risk analysis showed no major concerns. This report was therefore then submitted for an
independent review by another external consultant (Helios). Inputs from that review were taken into
account and the Risk analysis was accordingly updated. Although the risks were classified as
acceptable (and one partly in the tolerable region) in the ISMS Risk Matrix, the decision was made
to develop a Risk reduction action plan to substantiate future reduction of detected safety risks.
The OVV also made clear its preoccupation with regards to the safety effects that may be imposed
by the ‘new standards and enforcement system’ (NNHS) in effect at Schiphol airport, which contains
the so called ‘4th runway rule’. The OVV states that “the Ministry leaves the role of safety watchdog
in the Schiphol Community Council to LVNL”. The NNHS contains agreements between the sector
and the Schiphol Community Council about the strict noise preferential runway use system. The
Ministry has proposed that future growth of air traffic at Schiphol will depend on a trade-off between
noise abatement and network quality, which may include aspects such as safety or residents health.
It is however yet uncertain to what extent all those aspects will play a role.
Following the OVV concerns, the Ministry intends to further improve oversight of air traffic safety at
Schiphol. At the beginning of summer 2019, LVNL issued the document “The fourth runway rule and
the Schiphol operations”, containing sector measures “to reduce the number of aircraft movements
on the fourth runway in 2019 compared to the preceding years and to comply completely with the
fourth runway rule in 2020”. Within this context, DFS Aviation Services has been entrusted by the
Ministry with the task of making a new independent review, of both the Risk analysis (initiative from
ISMS) and “The fourth runway rule and the Schiphol operations” (LVNL). The Ministry seeks for an
external opinion that provides a critical view, assurance and recommendations as to whether: the
Risk analysis has been performed in a coherent and concise manner; safety risks have been properly
detected and managed; traffic growth is compatible with current safety risks; and additional measures
to reduce the use of the 4th runway take account of their impact on the safety risks related to runway
combination changes.

The review has been performed based on the following documents:



Summary Schiphol Air Traffic Safety; Onderzoeksraad voor Veiligheid (OVV), Dutch Safety
Board; final version; The Hague (Netherlands), April 2017
Decision sheet “Joint sector TOP SAG 02.07.18, Runway Changes, The acceptability of the
risk”; Jasper Daams, Integral Safety Office (ISO); version 0.4; Document number: TOP SAG
201802; 02 July 2018















Decision sheet “Joint sector TOP SAG 03.12.18, Review runway combination changes”; J.
Daams (ISO); version 2.0; Document number: TOP SAG 201813DS; 03 December 2018
Review of “Risk Assessment Runway Change Schiphol”, Review for Schiphol airport; Helios;
final version; Reference number P2651D001; Farnborough (United Kingdom), 17 December
2018
Decision sheet “Joint sector TOP SAG 22.03.19, Runway Combination Changes”; J.
Daenen; version 4; Document number: TOP SAG 201907DS; 22 March 2019
Risk analysis of runway combination changes at Schiphol airport, Operational Impacts;
MovingDot; Document ISMS-201803; version 1.2; 23 April 2019 (referred to as Risk
analysis)
Runway combination changes Schiphol, Risk reduction action plan; ISMS Taskforce,
Document ISMS-201909R; final version; 27 May 2019 (included in Risk analysis, referred to
as action plan)
Decision sheet “Joint sector TOP SAG 20.06.19, Runway Combination Changes”; J. Daenen
(measures), J. Daams (risk assessment); Document number: TOP SAG 201914DS; 20 June
2019
The fourth runway rule and the Schiphol operations, A reflection on measures and effect;
LVNL, Reference number SCM/CMA/6000; version 1.0; 19 July 2019 (referred to as Fourth
runway rule)
Schiphol Safety Improvement Covenant, Convenant veiligheidsverbetering Schiphol;
Ontwikkeling integraal veiligheidsmanagementsysteem Schiphol en Analysebureau
Luchtvaartvoorvallen; 02 July 2018 (referred to as Covenant)

In addition, two meetings were held:



28.08.2019 – The Hague, DFS reviewers and representatives of the Ministry. Discussion on
the scope and objectives of the review.
12.09.2019 – LNVL at Schiphol, DFS reviewers and representatives of the Ministry, LVNL,
ISMS and MovingDot. Chronological course of events and documentation produced;
discussion about the process of elaboration of the Risk analysis; discussion about specifics
of ATC operations with runway combination changes and the use of a fourth runway.

Expected issues to be addressed in the review are presented as questions in the ‘Request for
quotation’ document from the Ministry:
Runway combination changes









Has the analysis been performed in a good, solid manner in accordance with the applicable
(international) methodologies?
Have all relevant stakeholders with an SMS been interviewed and have they properly been
involved in the analysis?
Have all concerns, points of attention and recommendations from the Dutch Safety Board
regarding the safety impact of runway combination changes been properly included in the
analysis of MovingDot and the subsequent review by Helios?
Are additions to the analysis required in this context?
Is it ensured that the risks remain controlled, also when there is growth in air traffic?
Are the identified risks sufficiently and adequately covered by the proposed measures and
solutions in the risk reduction action plan?
Have the solutions been properly mapped in terms of effectiveness, costs / benefits,
feasibility, support, enforceability, sustainability and side effects?



Are other measures and solutions conceivable within the current operational concept that
could reduce the identified risks?

Fourth runway rule




What measures are necessary according to the ISMS parties to comply with the ‘fourth
runway rule’?
Have the safety risks of these measures been adequately identified?
Are there going to be additional measures implemented to manage these risks?

Interdependence




Has an adequate assessment been made as to whether the measures related to compliance
with the ‘fourth runway rule’ have a potential (negative) effect on the risks associated with
runway combination changes and vice versa?
Have additional measures been taken to manage these risks?

This section reviews and evaluates the Risk analysis carried out by MovingDot. On the one hand, it
evaluates (subsection 3.1) how the Risk analysis takes account of the concerns, points of attention
and recommendations of the OVV drawn in the "Schiphol Air Traffic Safety" report. On the other
hand, a review is made (subsection 3.2) of the process itself used to carry out the risk analysis, from
the methodology applied, the process used to manage the safety risks, and up to the determination
of the applicable risk reduction measures in the action plan.
Note that Helios already did a first review of the Risk analysis. The elements considered to still be
valid are going to be mentioned, as well as disagreements with their viewpoint. We acknowledge that
the recommendations given by Helios and the action plan have been thereafter implemented and
developed respectively in parallel. Our review is therefore based on the latest version of the Risk
analysis report.

The OVV investigation detected a series of circumstances as a source of complexity of operations
at Schiphol, e.g. “large number of daily runway configuration changes, traffic crossing the take-off
and landing runways each day, deviations from procedures to handle the traffic, and capacity
shortages at air traffic control”1.
The Risk analysis evaluates the safety risks brought by the runway combination changes. In a first
step, a research was conducted to gather relevant information. Runway usage data, A-CDM data
and event data were collected to identify causal or contributing factors related to runway changes. In
addition, the operational stakeholders provided their input (by means of interviews) on the issues
that affect them with regards to runway changes.
The analysis of these elements showed that, indeed, the operational complexity associated with
runway combination changes at Schiphol has a slight impact on safety risks. In fact, and whereas
the rest of risks derived from hazards are acceptable, the hazard “airport and operational complexity
and workload” is the single one which is partly placed between the ‘acceptable’ and ‘tolerable’ region
in the ISMS common risk matrix. Such was a decision taken in a workshop by the representatives of
the involved stakeholders.
The Risk analysis also takes consideration of the circumstances ‘adding’ complexity to the operation
at Schiphol. These are in many cases large in scope and cannot be addressed with simple actions
or mitigations. For instance, it is well known the lack of airport infrastructure at Schiphol: “LVNL
experiences the manoeuvring space at the airport as limited due to a lack of aircraft stands.
Amsterdam Airport Schiphol recognises that the existing tight infrastructure increases complexity
and limits air traffic and safety. The Association of Dutch Pilots (VNV) also notes that airborne
operations are becoming more complex […]”2. The OVV adds in its summary report in English:
“Schiphol is approaching the limits of its ability to handle air traffic safely within the current operational
concept”1. Hence, the Risk analysis is performed within the current whole context of operations, and
bearing in mind the restrictive elements beyond its control.

1 Summary Schiphol Air Traffic Safety, Consideration, p. 5
2 Translation Tight space (Krappe ruimte) in Chapter 2, Veiligheid vliegverkeer Schiphol, Onderzoeksraad voor
Veiligheid (OVV), The Hague, April 2017

Unlike the first review of the Risk analysis by Helios, there are at this point specific mitigation
measures defined in the Risk reduction action plan. These measures reduce the risks related to
“airport and operational complexity and workload”. However, they are also applicable to the rest of
risks identified by the involved stakeholders when doing the risk analysis. The applicability of
mitigations is also analysed within the current operational context; taking as baseline the yet
unchanged scenario. During the Risk analysis, a first risk matrix was drawn to show the risks of
identified hazards, and later a second one was built to reflect the expected risk reduction (after
mitigations). The latest risk matrix shows a shift of operational complexity, as well as other risks,
towards the ‘acceptable’ region (Figure 5).

One of the concerns of the OVV is related to what they call an “increase in the number of significant
incidents”1. This is also covered in the Risk analysis. As part of the Data derived observations, the
analysis provides a quick view on runway changes related events stored in ECCAIRS at Schiphol for
the period 2012-2017. The analysis detected 71 events. It is important to highlight that these do not
represent actual incidents; they are events varying from ‘no safety impact’ to ‘limited safety impact’.
Therefore they do not reflect in any case a catastrophic or significant outcome.
When the OVV states an “increase in the number of significant incidents”1, it is to understand that
the term ‘significant’ could be an allusion to an increase on the amount of reported incidents in the
previous years, as it does not fit with common understanding of the concept ‘significant incident’. An
example of description of a significant incident can be found in current applicable Reg. (EU)
1035/20113 4. The data provided in the Risk analysis are far from proving the existence of significant
incidents.
The data does show there has been a noticeable increase in the number of occurrence reports
related to runway changes since 2014. This is not a proof of increase of the so called ‘incidents’ in
the OVV report. Operational stakeholders have made efforts in the last years to promote a positive
safety culture in their organisations as to create a climate of trust that improves the occurrence
reporting systems. It is then not surprising that organisations show an improvement in the number of
reports received. This improvement is particularly noticeable since 15 November 2015, when the
mandatory reporting system of aviation events introduced by Reg. (EU) 376/2014 5 became effective.
It is unknown if OVV have based their assumption on other kinds of reported or assessed incidents,
which is unlikely since the introduction of the mandatory reporting by regulation.

The OVV shows concern for the impact of air traffic increase on safety. In that sense, Helios review
recommended to take the future growth of Schiphol into the analysis as part of the ‘hazard
identification and risk assessment process’. We must differ in that sense. This is not a traditional risk
assessment for changes to the functional system, in which a future scenario or situation is taken into
account to provide assurance of safety of a change. In this case the Risk analysis evaluates the risks
of runway changes in the current operational scenario.
Helios recommendation to consider future traffic growth was incorporated when doing the Risk
reduction action plan. In this report the ISMS taskforce (led by LVNL) provides historical/statistical
data to prove a declining trend on the runway (combination) changes and late runway changes given
3 Regulation (EU) 1035/2011 of 17 October 2011 laying down common requirements for the provision of air

navigation services.
4 Significant incident in Regulation (EU) 1035/2011: “Significant incident involving circumstances indicating
that an accident, a serious or major incident could have occurred, if the risk had not been managed within
safety margins, or if another aircraft had been in the vicinity”.
5 Regulation (EU) No 376/2014 of the European Parliament and of the Council of 3 April 2014 on the
reporting, analysis and follow-up of occurrences in civil aviation.

to pilots. They also justify the current stability of the operation and sustainability of the capacity at
Schiphol. The measures introduced in the action plan aim at maintaining this stability. In addition,
the Risk analysis emphasizes that “no significant traffic growth is foreseen […] in the foreseeable
future”6. We agree with the fact that a significant traffic growth cannot take place above 500.000 air
traffic movements as per current restrictions through 2020, which would not make much difference
with current operational scenario. Besides, the Risk analysis justifies that “Should there be
(significant) growth, the existing process for determining declared capacity ensure that potential
safety impacts are considered”6.
However, the means used to demonstrate future levels of safety are not fully predictable. The
analysis of traffic growth complies in general terms with the description of a ‘predictive’ analysis, but
it is somehow more ‘descriptive’. Whereas a predictive analysis as per ICAO SMM 4th Edition implies
to “extract information from historical and current data and use it to predict trends and behaviour
patterns”7, the descriptive statistics “are used to describe or summarize data in ways that are
meaningful and useful”, “tools such as tables and matrices, graphs and charts and even maps are
examples of tools used for summarizing data”8.
We can see that the figures provided in the action plan 9 (e.g. average amount changes in runway
combination per day, percentage of Schiphol outbound flights with a runway change) show a positive
trend within the last years. However, there is no certainty that trends are going to be the same during
and after implementing the mitigations in the action plan. Assurance of future safety levels is assured
by means of monitoring the relevant KPIs (e.g. number of late runway changes), and taking required
actions if needed. At the same time, and according to applicable European regulations, each change
the functional system has to be assessed individually by each operational stakeholder to provide
assurance that risks remain to an acceptable level.
The Schiphol Safety Improvement Covenant (referred to as Covenant) also claims that “within the
framework of the ISMS, safety is analysed in its entirety by the sector parties in the event of major
changes”10. Additionally, the ISMS itself aims to “[…] monitor the safety risks that affect several sector
parties operating at Schiphol, for example by means of […] - joint prevention or control of the risks
identified and analysed; - the evaluation of the effectiveness of the measures taken and, if necessary,
the updating of the measures”11.

The Risk analysis does not hide the fact that frequent runway combination changes might be seen
as a contributor to complexity and workload for air traffic controllers (ATCOs), as well as for flight
crew (FC) during critical flight phase (approach, take-off preparation). The analysis on event data
shows that human factors are identified as being a causal or contributory factor in events associated
with runway changes: “Crew error and workload account for a noticeable portion of the identified
effects”12.
Nonetheless, findings in the Risk analysis state that runway changes are not considered an issue for
pilots as long as they are timely made aware of them. Likewise, ATCOs are already used to runway
changes procedures as part of their routine. However “LVNL supports the conclusion that frequent
runway combination changes poses a challenge for the operational staff, whose main consideration
6 Risk analysis, 5.5. Resilience in ‘5. Risk analysis’, p. 37
7 6.2.3 Predictive analysis, ICAO Safety Management Manual (SMM), Fourth Edition, 2018, p. 6-3
8 6.2.1 Descriptive analysis, ICAO Safety Management Manual (SMM), Fourth Edition, 2018, p. 6-3
9 Risk analysis, K.5. Mitigations in ‘Annex K. Risk reduction action plan’, p. 109-113 & Action plan, 4.

Mitigations, p. 26-31
10 Article 9. Integral safety analysis (1), Convenant veiligheidsverbetering Schiphol – Ontwikkeling integraal
veiligheidsmanagementsysteem Schiphol en Analysebureau Luchtvaartvoorvallen, 02-07-2018
11 Article 6. ISMS (c), Convenant veiligheidsverbetering Schiphol
12 Risk analysis, 4.2.3.3. ABL event data in ‘4. Data and stakeholder-based findings’, p. 27, 28

is to maintain a stable and predictable flow of traffic”13. At the end of the analysis there were three
main areas uncovered requiring attention: runway use stability, runway change (clearance) timing,
and workload/human error. These areas were collectively tackled by the measures defined in the
action plan.
Regarding the workload/human error area, and besides the rest of planned measures in the action
plan, a better timely coordination with flight crew can be achieved, for instance, by means of
Programs aimed at increasing joint awareness; another example given is that maintenance and
improvement of operational stability by LVNL include ‘system upgrades’ on AMAN and A-CDM to
improve the planning processes14. All in all, the proposed measures aim at reducing complexity and
workload to humans involved in operations.

Based on OVV recommendations, the key operational stakeholders at Schiphol have built the ISMS
and taken note of the concerns regarding the current number of runway configuration changes. The
Risk analysis is a singular initiative to understand the level of risk taken by the same operational
parties. We perceive this as an action to contradict some conservative assumptions made by OVV
and/or substantiate an acceptable level of safety within the current operational context. Although
integration is not exempt from difficulties, there is so far no denying that the action taken is an
enviable sign towards a better integration of stakeholders. The Risk analysis shows data inputs from
airlines, ATC and airport operator; the common risk matrix was the result of a joint decision-making
process and the results of risk workshops were commonly agreed.
On the other side, the Ministry has been singled out for not playing the role of ultimate responsible
and not having the overall picture of safety at and around Schiphol. By seeking for an external review
of the Risk analysis, and at least in this matter, the Ministry shows intentions to take part in this
process of management of risks, as supervisor for the traffic growth and accountable for the
maintenance of air traffic safety at Schiphol.

Helios opened a debate on the name given to the Risk analysis, as to whether call it better ‘analysis’
than ‘assessment’. We do not completely share the opinion that a traditional safety risk assessment
as per ICAO SMS methodology was not held. The study is not only an analysis of historical data
(statistics, events). MovingDot also conducted interviews with operational stakeholders (airlines,
airport, ATC), and took Helios' recommendations into account to add the inputs of foreign/non-home
based carriers. Subsequently, the Risk analysis was followed by the Risk reduction action plan, which
detailed the mitigations measures applicable to the detected risks. At this point, the process followed
to perform the Risk analysis is closer to the Safety Risk Management process as per ICAO SMS,
based on “hazards identification, safety risk assessment, safety risk mitigation and risk
acceptance”15.
The ICAO Safety Management standards are applicable to aviation stakeholders individually. The
ISMS does not behave as a single entity with developed safety risks assessment procedures. They

13 Risk analysis, K.3. Background in ‘Annex K. Risk reduction action plan’, p. 89 & Action plan, 2. Background,

p. 5
14 Risk analysis, K.5. Mitigations in ‘Annex K. Risk reduction action plan’, p. 113 & Action plan, 4. Mitigations,

p. 31
15 2.5. Safety Risk Management, ICAO Safety Management Manual (SMM), Fourth Edition, 2018, p. 2-10

provide a joint approach to safety risks. The ISMS
has modelled a common Risk Matrix16 where the
parties plot the results of assessments once they
have reached an agreement. This sustains the
claim that the system is closer to ICAO standards
than previously expressed by Helios. The results
of the Risk analysis were discussed in a workshop
of the ISMS partners to determine the risk levels
and place them in the matrix. This is a qualitative
process, which does not deviate in any case from
the standard: “Safety risk assessments sometimes
have to use qualitative information (expert
judgement) rather than quantitative data due to
unavailability of data. Using the safety risk matrix
allows the user to express the safety risk(s)
associated with the identified hazard in a
quantitative format”17. In fact, the Risk analysis is
Figure 1. Common Risk Matrix for joint sector ISMS
not missing the quantitative data. The qualitative
assessment is supported on both historic data and expert judgement.
In line with ICAO SMM 4th Edition, the Risk analysis performed, and the initiative itself to build an
ISMS is in line with expected future developments in the aviation sector with regards to an Integrated
Risk Management (IRM). This claims that a “successful risk management in aviation should aim for
overall risk reduction in the system, including all of the involved functional systems”, which is
achieved through “the quantitative and qualitative analysis of both the inherent risks, and the
effectiveness and impact of sector-specific risk management processes”18.

As part of their Safety Management Systems (SMS), aviation stakeholders perform studies in which
they apply a safety risk management process when doing management of changes; the so called
safety case or safety assessment. The organisations generally gather the required information to
support their assessment from either internal sources or by requesting other providers impacted by
the change (e.g. data, workshops). Although the information can come from different sources, the
study is performed by a single entity.
As aforementioned, the Risk analysis does not address a specific change; it is rather a holistic picture
of the acceptability of existing risks related to runway combination changes. The OVV concerns
address therefore a broader scope of risks than just those of a single stakeholder. This comes to
justify the need for a joint analysis which includes the main three main contributors to operations:
airlines, airport and ATC. As Helios suggests, additional stakeholders could have been included (e.g.
ground movers, runway inspection car drivers, maintenance staff). However, our viewpoint is that the
airlines, airport and ATC bear the biggest burden of the safety risk, and have the main resources to
provide appropriate mitigations. The solutions provided in the action plan are an enabler to reduce
the risks of runway changes by means of improving operations.
The initiative for such Risk analysis was easily facilitated by the recent creation of the ISMS. This
study could have been assigned to any of the involved stakeholders. However, it is worth
acknowledging their decision to outsource the project, and get the general picture of the risks of
runway combination changes from an external and unbiased consultant (MovingDot).

16 Risk analysis, 2.2. Risk analysis in ‘2. Methodology’,

p. 13

17 9.4.6. Safety risk assessment and mitigation, ICAO SMM, Fourth Edition, 2018, p. 9-17
18 1.4. Integrated Risk Management, ICAO SMM, Fourth Edition, 2018, p. 1-7

The three stakeholders have contributed to the analysis with event data, statistics and interviews.
The quality of data collected is considered sufficient to support the detection of hazards and
assessment of safety risks. There is always the option of adding extra sources of information, but it
is important to keep in mind whether it brings additional relevant elements that support the arguments
of the analysis. For instance, Helios recommended to feed the assessment with Line Operations
Safety Audits (LOSA) from additional airlines that operate in and out of Schiphol. The result was that
“airlines participating in the Chief Pilot’s meeting (input from foreign/non-home-based carriers) at
LVNL were asked via a survey about their LOSA data. Of eight respondents, three airlines confirmed
to have a LOSA programme, but none of them identified any events due to runway changes”19.
The statistics provide an overview of numbers and duration/timings of runway changes for the period
2016-2017. These data is supported by runway (combination) change related events from the three
parties. Together this information seems adequate to contextualise the tendency (how, when…) in
which the runway changes take place, as well as the consequences (impact, events) they may cause
or contribute to trigger. An important element that has been followed in this process is to correlate
findings based on observations with information provided (interviews) by the representatives of the
different operational stakeholders. These contributed, for instance, to apply more focus on the
workload and crew error that can be caused by runway combination changes.

The logical step after processing the data is to identify the hazards. We must agree at this point with
the approach taken by MovingDot. They cover a broad scope of operations at Schiphol, including
airport, ATC and airlines. It is precisely that what seems appropriate for this case. In a mere safety
assessment for changes, the hazards are generally narrowed to a specific change to the functional
system. However in this case, and besides not facing a change, we are speaking about three (main)
stakeholders, whose functional systems might be affected by hazards generated by the runway
combination changes. Although together, the hazards have been assigned to stakeholders, but they
are all connected by the same root cause and potential undesirable outcomes20.

Figure 2. Flight crew, ATC and airport operations hazards with respect to runway (combination) changes 21

19 Risk analysis, 4.2.3.4. Airline LOSA data in ‘4. Data and stakeholder-based findings’,

p. 28

20 The Risk analysis also reiterates in several parts “whereas a hazard might be categorized as FC or ATC,

their causes and/or operational outcomes are intertwined and therefore a hazard might be applicable to both.
As such, common aspects could potentially lead to undesirable outcomes if left unaddressed.”
21 Risk analysis, 5.1. Identified hazards in ‘5. Risk analysis’, p. 31

The amount of hazards seem adequate to the scope of the assessment. Additional hazards could
always be found, but they do not assure an assessment improvement. The point of hazard detection
is to stress the most likely conditions with a potential damaging outcome, as seem to be reflected in
the Risk analysis hazard detection.

The risks of harmful effects introduced by the detected hazards were later analysed in a safety risk
management workshop with stakeholder representatives. As aforementioned, a qualitative approach
is fairly accepted. Risks are a combination of the probability/likelihood and severity of occurrence of
a harmful effect. These have been well detailed in Initial risk indications of safety impacts (section
5.2. of the Risk analysis), providing the result of the risk levels. The results have been plotted in a
specific position of the matrix by agreement of the representatives. In this way, differences in risk
matrices of stakeholders are accounted for.
In other safety assessments (e.g. changes to functional system, at level of individual stakeholders),
the severity and likelihood are usually given specific quantitative values. The combination of both is
what provides a specific special plot in a risk matrix. The method followed in the Risk analysis was
different: “Each plot was positioned and sized (in the matrix) until common agreement was
reached”22, but it gets the same outcome results. The risk is classified on the basis of estimated
likelihood and severity.

Figure 3. Plotting of commonly agreed risk classifications of the Flight Crew, ATC, and Airport Operations hazards and
corresponding operational outcomes22

The report makes clear that the majority of detected risks are acceptable. Their hazards are plotted
in the acceptable region of the matrix. The hazard “Airport and operational complexity and workload”
is the only one between the ‘acceptable’ and ‘tolerable’ region. It carries the highest risks, but it is in
an area that does not strictly need to be mitigated. The operational complexity at the airport and the
present workload are tolerably safe. However, the scope of this risk, as well as the Risk analysis as
a whole, are clearly sensitive subjects. It makes good sense that the decision of the TOP SAG was
to mitigate not only the tolerable risk, but also to further assure acceptability of the rest of risks.

22 Risk analysis, 5.2 Initial risk indications of safety impacts in ‘5. Risk analysis’, p. 33

The Risk reduction action plan can be looked as the compendium of efforts that are being carried
out to better improve the management of current and future safety risks. Interestingly, the majority of
proposed measures are not directly aimed at reducing the risks related to runway combination
changes. The action plan does not hide the fact that most of the mitigations are part of the
“performance improvement plan for reference period 3 (RP3, EU regulation No 390/2013) that LVNL
provides to the Ministry”23. The strategy is then to make use of planned improvements at Schiphol to
increase safety levels and mitigate current and future safety risks as a whole. Thus, this is expected
to help controlling the risks related with runway combination changes.
The discussion can always be open as to whether different or additional more specific measures
could be considered. There is sometimes the misconception that extra risk reduction measures
equals to safer operations, such as e.g. reducing the number of runway combination changes. In
spite of that, the Risk analysis shows that, even though relevant, the number is not the main concern.
In reality, the areas worth of attention are “runway use stability, runway change (clearance) timing,
and workload/human error”24. According to the ISMS taskforce, better predictability of runway
changes would help limiting the number of runway changes to those operationally necessary.
Together with timely communication (with flight crew), these elements are expected to optimise
human factors and provide a more stable traffic situation.
The proposed measures aim at tackling those areas collectively, which would reduce the risk of
“airport and operational complexity and workload”, as well as others. We do not disagree with that
approach. The reasons given for runway changes are weather, noise abatement regulations, runway
conditions, availability of landing aids and capacity demand25. It makes sense that the means to
address the risks are diverse, and should include the joint forces and resources of involved (as well
as impacted by the risks) stakeholders. Note that causes and/or operational outcomes of hazards for
FC or ATC are intertwined. Individual measures may slightly improve the situation but they do not
seem to provide a long term solution, moreover when expecting traffic growth26. The approach
proposed by the taskforce is that the result of the mitigations on reducing the risks of runway changes
depend on a collective effort to improve the predictability and stability of the operation.
The action plan has made a fair assessment of effectiveness of the risk reduction measures. The
measures are expected to reduce the likelihood of hazards occurrence. Once again, this has been
made qualitatively by means of expert judgement. We agree on the ‘difficulty’ that relies on trying to
demonstrate the effectiveness of some strategic (long-term) solutions, which is also comparable to
the analysis performed for the initial risk indication and plotting of results in the risk matrix. Therefore,
it seems acceptable that the solutions are assessed qualitatively according to their expected
outcomes. In this process, the effect of each measure has been individually assessed for every
hazard. The results have been drawn in a table showing that all proposed solutions have either a
positive (+) or neutral (o) effect (Figure 4).
According to these conclusions, the risk matrix was updated (Figure 5) in the Risk analysis to show
that “none of the mitigations is expected to increase the risk of the identified hazards” 27. On the
contrary, the resulting matrix shows that measures currently being implemented are shifting the risk
23 Risk analysis, K.5. Mitigations, K.6. Conclusions and recommendations in ‘Annex K. Risk reduction action

plan’, p. 103, 115 & Action plan, 4. Mitigations, 5. Conclusions and recommendations, p. 20, 34
24 Risk analysis, ‘6. Conclusions’, p. 39 & Risk analysis, K.3. Background in ‘Annex K. Risk reduction action
plan’, p. 90 & Action plan, ‘2. Background’, p. 6
25 Risk analysis, ‘3. Runway usage’, p. 14 & Risk analysis, A.1. Runway (combination) usability criteria, A.2.
Runway changes factors in ‘Annex A. Runway usage at Schiphol airport’, p. 44 ,45
26 e.g. unlike in the past, LVNL is nowadays responsible for all runway crossings or runway entries,
irrespective of runway status. In the past, AAS’ APC was responsible for runway crossings of non-active
runways. “It has proven an effective mitigation for preventing tows entering an active runway”. Such solutions
are limited in extent, and do not provide a long term reduction of risk of runway changes.
27 Risk analysis, 5.4. Risk re-classification in ‘5. Risk analysis’, p. 36

“airport and operational complexity and workload” towards the ‘acceptable’ region, as well as further
improving acceptability of other drawn risks in the matrix.

Figure 4. Example of the expected effectiveness mitigating measures on three hazards28

Figure 5. Plotting of ATC_OB_1 & ATC_IB_1 risk classification taking into account the measures being implemented 29

The assessment of measures is made having account of the positive effect of the initiatives in the
LVNL performance improvement plan. The Risk analysis claims that “various already implemented
system and procedural changes have a positive safety impact on several of the identified hazards”30,
“Recent implemented risk reduction actions have contributed to increased ATC stability” 31. The
results of the assessment of measures are therefore based on the assumption that current and future
improvements are going to have a direct positive effect on the overall risk reduction of runway
combination changes.
The traffic growth is considered in the action plan, but as previously mentioned (section 3.1.3), it is
based on a descriptive analysis of statistical data. The data is showing a decrease in runway
combination changes and late runway changes given to pilots. We understand that a complete
assurance of a positive effect cannot be provided in the Risk analysis. Hence, a continuous

28 Risk analysis, K.5. Mitigations in ‘Annex K. Risk reduction action plan’, p. 114 & Action plan, 4. Mitigations,

p. 32
29 Risk analysis, 5.4. Risk re-classification in ‘5. Risk analysis’, p. 37
30 Risk analysis, 5.5. Resilience in ‘5. Risk analysis’, p. 38
31 Risk analysis, 6.1. Runway use stability in ‘6. Conclusions’, p. 40

monitoring is going to be performed at level of both ISMS32 and operational stakeholders33 to detect
potential negative effects and risks during and after the implementation of the measures. By these
means the current risks remain controlled, and new actions would be taken if risks emerged in the
future.
The implementation of the measures might be subject to shortcomings or drawbacks. It is convenient
not to forget that they depend on availability of stakeholders resources, and it is unpredictable at
what point they are to be fully deployed. Costs, feasibility, support, enforceability, sustainability and
side effects are not part of the report. Many of the measures are strategic improvements, and it is to
assume that elements like costs or side effects have been considerably analysed by the responsible
stakeholder for their implementation. The fact that 8 out of the 11 measures are being currently
implemented34 proves their feasibility. The monitoring tasks take account of the effectiveness of the
measures and risks throughout their implementation.
In the same way, safety assessments for changes to functional systems are also a means of
assurance. These make sure of controlling the safety risks arising from changes at stakeholder level.
Besides, safety is also “analysed in its entirety by the sector parties in the event of major changes”10.
So far the Risk analysis claims that “there are no significant know changes that might have an impact
on the outcomes of the risk analysis”6. In addition, this is supported by the fact that “per regulatory
restrictions, no significant traffic growth is foreseen for Schiphol in the foreseeable future”. We agree
that a sudden situational change is unlikely in the future. The management of safety risks within a
context of progressive and expected traffic growth is sufficiently covered by current monitoring
activities, at stakeholder and ISMS level.
We acknowledge that the risks detected in the Risk analysis are acceptable (and only one tolerable),
that stakeholders are committed to implement the measures to further reduce the risks and that
effectiveness of measures and risk control is assured by means of monitoring. Nevertheless, and it
is not a must, the effect of some measures could be further analysed to provide assurance and
predictability by means of a Fast-Time Simulation (FTS). In a predictive analysis “some systems
allow users to model different scenarios of risks or opportunities with different outcomes”7. The FTS
can build up a scenario with the feasible proposed measures for a simulation and provide the
complete future operational complexity at Schiphol. A future scenario of increased planning and
improved systems/infrastructures could in return provide assurance of reduction of runway
combination changes. The solutions that could be feasibly modelled are: 1. Continued development
of AMAN, 2. Continued development of CDM, 5. Deployment of a second departure runway during
daytime and 10. Increased capacity of airport infrastructure.
A FTS could be built in three scenarios:
1. Current scenario: model an average day in the current operational context.
2. Current scenario with expected traffic growth: check complexity and effects of an increase
in traffic in current scenario.
3. Future scenario with implemented measures and expected traffic growth: assurance of
effectiveness of proposed measures and verification of a reduction in complexity.
A simulation would be an add-on to provide predictability to the Risk analysis and assurance of
effectiveness of the selected measures regarding a reduction of the airport complexity, as well as a
potential use reduction of runway combination changes. This is just a tool for drawing the expected
outcome of the measures. In any case, the safety risks will keep being controlled by the
aforementioned means of monitoring at level of stakeholders and ISMS.

32 As part of the Covenant, the ISMS assumes responsibility to provide assurance of the measures derived

from safety risks that affect several sector parties operating at Schiphol.
33 e.g. “Use of a second departure runway is actively monitored by LVNL, with potential impacts being
evaluated and documented”30 (runway combination changes trends); relevant reported events
34 Risk analysis, 5.4. Risk re-classification in ‘5. Risk analysis’, p. 36

The NNHS intends to resolve “the unintended side effects of the current system of enforcement
points which caused more noise impact”35. New rules have been designed that dictate the preferred
runway use, so air traffic management now always takes place in the most noise preferential way. In
this context, the block system followed at Schiphol makes sometimes necessary the use of a fourth
runway on a temporary basis to ensure a smooth transition between outbound and inbound peaks.
The 4th runway rule of the NNHS sets a “maximum for the number of aircraft movements that will be
handled on the fourth runway in one day and over the course of a year, during periods that two takeoff runways and two landing runways are simultaneously in use” 36.
The standard for such use came from a petition of some parties (particularly the residents delegation)
collaborating in the negotiations of the 2008 Alders Agreement. According to the residents’
delegation, this was intended to guarantee the rest periods of the surrounding residents37. Contrarily,
the LVNL report states that the 4th runway rule “does not necessarily contribute to a reduction in the
total number of noise-affected dwellings, people severely annoyed and people who are severely
sleep-disturbed”38.
Within the Risk analysis of runway combination changes, the 4th runway rule, as well as the other
rules, are just a parameter that was taken into consideration to analyse the current complexity of
operations. The noise abatement regulations (as referred in the Risk analysis) are part of other given
reasons for runway changes, being a source that potentially leads to the hazards. As aforementioned, ATCOs are nowadays used to runway changes procedures. However, the interviews
held with operational stakeholders underlined that there is “the perception that with the growth of
Schiphol these political agreements increasingly restrict the efficiency of Schiphol. At times it is
perceived that not the most optimal runways (wind-wise) are activated due to noise restrictions”39.
Whereas this might be the perception from stakeholders, there are studies (specify) that reflect the
efficiency of the NNHS in contraposition to a system based on the used of 4 simultaneous runways:
2 inbound and 2 outbound.

The aviation sector at Schiphol is aware that, in the current situation, the 4 th runway rule will lead to
“technical and operational bottlenecks, as well as political and administrative discussions” 40 in case
no supplementary measures are applied. In the meeting at Schiphol it was clear that an increase in
traffic in the current scenario may require a further use of the fourth runway. However, the sector
parties evidence their intentions to accommodate the demands of the NNHS. The report from LVNL
address (possible) measures to reduce the use of the fourth runway. These could be called mid-term
and short-term measures.
The mid-term would be those needing longer collective efforts of Schiphol parties. The majority of
these measures concern changes to the functional system, which require a longer implementation
process, including an assessment of safety risks (safety assessment, section 3.2.2):

35 3.4. The new standards and enforcement system (NNHS), The fourth runway rule and the Schiphol

operations, LVNL, Version 1.0, 19 July 2019, p. 17
36 [Foot. 35], p. 18
37 3.5. The fourth runway rule, The fourth runway rule and the Schiphol operations, LVNL, Version 1.0, 19 July
2019, p. 18
38 3.6. Summary, The fourth runway rule and the Schiphol operations, LVNL, Version 1.0, 19 July 2019, p. 23
39 Risk analysis, 4.1. Operational stakeholder identified issues with regards to RWY changes in ‘4. Data and
stakeholder-based findings’, p. 16
40 4. Measures to reduce use of the fourth runway, The fourth runway rule and the Schiphol operations, LVNL,
Version 1.0, 19 July 2019, p. 25






Measure A: increasing (peak) hourly capacity
Measure B: more efficient use of existing capacity
Measure C: forcing 2+1 runway use by imposing strict regulations
Measure D: delaying inbound traffic by means of holding 41

These solutions do not generate a safety impact for the time being. They would be the result of
ongoing/future projects at Schiphol. In fact, some of the initiatives to deploy these measures are
shared with those from the previously mentioned performance improvement plan (section 3.2.6), e.g.
capacity management, A-CDM, AMAN. We cannot but agree with LVNL concerning the effectiveness
or feasibility of the proposed solutions. Measures A and B aim for increasing peak hourly capacity
and more efficient use of existing capacity. As discussed in the meeting at Schiphol, a configuration
of 2+1 runways without dependence of a fourth one is only possible if operations take place 100%
according to planning or is sufficient slack (firebreaks) are incorporated in the planning. This also
includes a responsibility on the part of the stakeholders to operate more according to plan. The
collection of projects that attempt to increase capacities, predictability and planning are expected to
allow reducing dependency on the fourth runway. Measures C and D should be avoided from a
network quality standpoint, but are still necessary.
The short-term measures are the set of measures that have been applied from the beginning of
summer 2019. They are not independent new measures. Instead, they either apply or are
contributors to the previous ones:





Set of measures section 1: systematic improvement of On Time Performance (OTP).
Contributes to measure B
Set of measures section 2: imposing operational control measure for runway use. Expression
of measure C.
Set of measures section 3: trial flights according to Target Time Over (TTO). Contributes to
measure B.
Set of measures section 4: reducing the Runway Occupancy Time (ROT). Contributes (as
an enabler) to measure A.42

Unlike mid-term measures, these ones do not imply a change to the functional system. As stated in
LVNL report and reconfirmed during the meeting at Schiphol, the measures implemented last
summer “use current and existing methods, techniques and ways of working” 43. In this kind of
scenarios we generally agree that implementation does not need to be preceded by an exhaustive
evaluation of safety impacts. The safety paragraphs of each measure in the report declare absence
of safety effects and conformity with safety standards. It seems also that there is a monitoring of
these measures to avoid future impacts on safety risks. For instance, within the control measures for
runway use, the report mentions that the number of late runway changes are going to be monitored.
‘Increase of late runway changes’ or ‘workload for the ATCO’ would be risks derived from the
measure. LVNL claims to keep track of these measures are part of their SMS monitoring activities
(KPIs/trends, occurrence reporting).

Besides the short-term measures in place since summer 2019, the mid-term measures are also
expected to be implemented to further reduce the use of the fourth runway. Unlike short-term
measures, mid-term measures require changes to the functional system. LVNL will have to perform
the proper safety assessments whenever the new changes are planned. As aforementioned,
operational stakeholders are required to carry out safety assessments for changes as per ICAO
(international) standards and European regulations. This implies that safety risks from mid-term
41 [Foot. 40], p. 25-34
42 5. Set of measures for summer 2019, The fourth runway rule and the Schiphol operations, LVNL, Version

1.0, 19 July 2019, p. 35-42
43 [Foot. 42], p. 35

measures are going to be managed and controlled by LVNL (or other stakeholders, if impacted) from
the moment they are to be implemented within their specific functional system.
There is also a global view at ISMS level of how new improvements/changes impact the overall risks
at Schiphol. If changes derived from mid-term measures had an impact at global Schiphol level,
these would be analysed by the sector parties10. We cannot either forget that the ISMS monitors the
safety risks that affect several sector parties and evaluates the effectiveness of measures taken 11
(section 3.1.3). Hence, management and control of safety risks derived from the mid-term measures
are assured at stakeholder and ISMS level, by means of both the safety risk assessment of changes
and the subsequent monitoring activities. Once implemented, the measures will be tracked by both
entities and, if required, updated. We agree that, by these means, safety risks are consequently
controlled.
It is important to reiterate that short-term measures are not and will not be a safety concern as long
as they do not imply a change to the LVNL functional system and they keep using current methods,
techniques and ways of working. These measures are being currently monitored to track trends and
effectiveness.
The majority of mitigation measures defined in the action plan do not have an impact on the solutions
to reduce the use of the fourth runway. Only two measures are overlapped: the “deployment of the
second runway during day time” (in Risk analysis) and “imposing control measures for runway use”
(in Fourth runway rule). On top of deploying a second runway during daytime, there is currently an
operational control measure that puts a limit to the use of the fourth runway from 15:30h. These two
measures are actually complementary. According to discussion in the meeting, setting a limit to the
use of the fourth runway after 15:30h is expected to reduce complexity of operations, as well as the
psychological pressure and workload of the ATCO. It is recommendable to track the effectiveness of
these two measures. Besides regular monitoring44, it would also be recommendable to make a
specific review or survey within a year time on the specific impact of concentrating 4 th runway
operations up to 15:30h.

44 “Use of a second departure runway is actively monitored by LVNL, with potential impacts being evaluated
and documented”; Risk analysis, 5.5. Resilience in ‘5. Risk analysis’, p. 38

After having reviewed the safety achievements reached so far by the ISMS, we acknowledge the
taken steps to foster safety of operations at Schiphol airport. Bringing the key stakeholders (ATC,
airport, airlines, ground handlers, refuelling services) to the table in one body is a decisive step
towards ensuring the future viability of airport safety.
In our view, the Risk analysis sets a course towards evaluating future challenges. The main one
being to cope acceptable risk levels with future traffic growth, network quality and noise abatement
regulations.
As part of their business development, the sector evidences to be working on improvements that
reduce the assessed risks of runway changes. The activities and methodology followed in the Risk
analysis are adequate to the scope of the subject. The three key stakeholders have contributed to
provide and contrast data, but also to agree on the level of risk of the detected hazards.
The measures described in the action plan are capable to address the concerns regarding the
runway combination changes. Most of them are part of the LVNL performance improvement plan.
They are not mere mitigations, but rather pending improvements at the airport, the implementation
of which encompasses the risks of operational complexity, as well as other detected risks, from its
root. The majority of measures are already in process of implementation and some system and
procedural changes have proven a positive safety impact on reducing the risk. The effect of these
solutions has been assessed by the sector at ISMS level and it is estimated to reduce the risk of
several hazards (in the risk matrix), including the risk of operational complexity and workload.


The effectiveness of measures in the action plan and the control of safety risks of runway
combination changes are assured by both the ISMS and the SMS of operational stakeholders. This is done via continuous monitoring (KPIs/trends, occurrence reporting), change
management processes and the safety check prior to the declared capacity for slot allocation
at Schiphol. These processes guarantee that risks are identified and mitigated before the
increase in air traffic. The Ministry should oversee these safety assurance activities.

Within the Risk analysis, the fourth runway rule is just part of the noise abatement regulations, which
are a parameter taken into account during the assessment of safety risks. The LVNL report Fourth
runway rule reflects the service provider commitment to accommodate the needs of the NNHS and
to further reduce the use of the fourth runway. It has become evident that the measures implemented
on summer 2019 did not imply safety risks, as they made use of techniques, methods and ways of
working in place at LVNL. On the contrary, mid-term measures involve carrying out changes to the
LVNL functional system. According to standards and European regulations, the safety risks will have
to be assessed and, if required, mitigated in a safety assessment for changes.


Similarly to the action plan, the effectiveness of measures and control of safety risks
from the Fourth runway rule are assured by means of continuous monitoring and the change
management processes. The short-term measures are currently being monitored by LVNL
(e.g. workload to the ATCO, deviations in trends). The mid-term measures will be first subject
to a safety assessment for changes, and also monitored once implemented.



Has the analysis been performed in a good, solid manner in accordance with the
applicable (international) methodologies?

[Section 3.2.1] The analysis has been performed according to the main steps of a Safety Risk
Management process as per ICAO SMS. The ISMS does not behave as an individual stakeholder
with an SMS, but the analysis has suitably followed the same steps: “hazards identification, safety
risk assessment, safety risk mitigation and risk acceptance”15.


Have all relevant stakeholders with an SMS been interviewed and have they properly
been involved in the analysis?

[Section 3.1.5] The Risk analysis is the result of a joint effort of the three key operational
stakeholders at Schiphol: ATC, airport and airlines. They are part of the ISMS, a fact that has
facilitated collaboration. The Risk analysis shows data inputs from the three stakeholders: data
collected (runway changes frequency/timing, event data) and interviews (first with stakeholders’
representatives, and later a meeting was held with Chief pilots of airlines). The common risk matrix
used in the analysis is the result of a joint decision-making process at ISMS level. The findings,
results and arguments from data gathered were commonly agreed by the three collaborating parts.


Have all concerns, points of attention and recommendations from the Dutch Safety
Board regarding the safety impact of runway combination changes been properly
included in the analysis of MovingDot and the subsequent review by Helios?

[Section 3.1] The final version of the Risk analysis and action plan address through their respective
reports the OVV concerns regarding operational complexity at Schiphol, which is in fact the detected
risk between the ‘acceptable’ and ‘tolerable’ region in the risk matrix; increase in number of events
since 2014; the future levels of safety in a context of traffic growth; and the human factor concerns
related to high workload/pressure and complex, dynamic operations. The Risk analysis was modified
after the review by Helios. The analysis, for instance, extended the data sources and took account
of future traffic growth in the action plan.


Are additions to the analysis required in this context?

[Section 3.1.3 & 3.2.6] The Risk analysis and action plan provide all required information as per the
methodology described. There is only one aspect that could be suitably enlarged: to provide a further
predictive analysis regarding the effectiveness of defined solutions within a context of traffic growth.
The future trends of runway changes are based on the expectation that past data is going to keep
the same tendency (e.g. reduction of the percentage of Schiphol outbound flights with a runway
change). This is a fair approach having consideration that trends and effectiveness of measures are
going to be actively monitored, and safety risks controlled. However, a predictive exercise could
supplement the current analysis.
Recommendation: Perform a FTS of the current and future operational complexity at Schiphol.
There are mainly four measures that could be feasible modelled. The FTS scenarios could assist in
providing assurance of the expected effectiveness of measures, as well as of a reduction of runway
combination changes.


Is it ensured that the risks remain controlled, also when there is growth in air traffic?

[Section 3.2.6] The effectiveness of the defined solutions in the action plan is going to be monitored
from the moment of their implementation. A continuous monitoring (KPIs/trends, occurrence
reporting) is going to be performed at level of both the ISMS and operational stakeholders to detect
potential negatives effects and risks. By these means the current risks remain controlled, and new
actions would be taken if risks emerged in the future.
Additionally, both the ISMS and stakeholders (within their SMS) carry out management of changes:
either major changes affecting different sector parties or changes to the stakeholder functional
system, respectively. This implies making an assessment of the safety risks and taking required
measures, if necessary. On a daily basis, risks are managed by a safety check prior to the declared

capacity for slot allocation. These processes guarantee that risks are identified and mitigated before
an increase in air traffic.
Recommendation: It is a good monitoring practice and safety assurance to keep a risk assessment
up to date. This is a common practice at DFS, even if the risk are found acceptable. It is therefore
recommended to make a periodic review of the Risk analysis (e.g. in 3-4 years) time to update data,
check effectiveness of the measures and validate the reduction of risks.


Are the identified risks sufficiently and adequately covered by the proposed measures
and solutions in the risk reduction action plan?

[Section 3.2.6] Indeed, the proposed measures have been confirmed to reduce the identified risks.
The Risk analysis has detected three areas worth of attention that contribute to the risks: “runway
use stability, runway change (clearance) timing, and workload/human error”24. The measures aim at
tackling these areas collectively. They are expected to increase the predictability of a runway change,
which would help limiting the number of runway combination changes to those operationally
necessary. The expected effectiveness of these measures has been assessed at ISMS level, and
they were found to reduce the risk of “operational complexity and workload” to the ‘acceptable’ region
of the matrix, as well as further reduce other (already acceptable) detected risks.


Have the solutions been properly mapped in terms of effectiveness, costs / benefits,
feasibility, support, enforceability, sustainability and side effects?

[Section 3.2.6] The measures have been mainly mapped in terms of effectiveness and benefits.
Costs, feasibility, support, enforceability, sustainability and side effects are not part of the report.
Many of the measures are strategic improvements. Therefore, it is to assume that elements like costs
or side effects have been considerably analysed by the responsible stakeholder for their
implementation. The fact that 8 out of the 11 measures are being currently implemented proves their
feasibility.


Are other measures and solutions conceivable within the current operational concept
that could reduce the identified risks?

[Section 3.2.6] No additional measures are envisaged within the current operational concept. There
is sometimes the misconception that extra risk reduction measures equals to safer operations, such
as e.g. reducing the number of runway combination changes. In spite of that, the Risk analysis shows
that, even though relevant, the number is not the main concern. Besides specific solutions (e.g.
deployment of a second departure runway during daytime), many of the defined measures are part
of a strategic improvement plan. These measures are going to contribute improving the identified
areas worth of attention: “runway use stability, runway change (clearance) timing, and
workload/human error” 24.



What measures are necessary according to the ISMS parties to comply with the ‘fourth
runway rule’?

[Section 4.2] LVNL has defined two sets of measures to reduce the use of the fourth runway. The
first are mid-term measures: “A. increasing (peak) hourly capacity; B. more efficient use of existing
capacity; C. forcing 2+1 runway use by imposing strict regulations; and D. delaying inbound traffic
by means of holding”41. The second are short-term measures: “1. Systematic improvement of On
Time Performance (OTP); 2. Imposing operational control measure for runway use; 3. Trial flights
according to Target Time Over (TTO); and 4. Reducing the Runway Occupancy Time (ROT)” 42.
Short-term measures are in place since summer 2019 and they are contributors to future mid-term
measures.



Have the safety risks of these measures been adequately identified?

[Section 4.2] The measures in the Fourth runway rule report are defined within the organisational
envelope of LVNL. The safety risks of the foreseen measures do not have to be specifically identified
in the report, as they are managed within their SMS.
We agree that the short-term measures are not a trigger for safety risks, because they “use current
and existing methods, techniques and ways of working”43. For instance, setting a limitation of use of
the fourth runway until a certain time (15:30h) does not require changes; it makes use of current
methods and ways of working to adapt to the measure needs. Nevertheless, the report has included
safety paragraphs for each measure to declare absence of safety effects and conformity with safety
standards.
On the other side, the mid-term measures require to perform changes to the functional system. The
changes triggered by these measures will be subject to safety assessments for changes according
to international standards (ICAO) and European regulation. Within this process, safety risks are
identified and assessed.


Are there going to be additional measures implemented to manage these risks?

[Section 4.2] Again, the short-term measures do not foresee any (additional) measure, because they
are not a source of safety risks. Contrarily, the mid-term measures may require, if necessary, to
define and implement mitigating measures in the scope of the safety assessment and change
management process.



Has an adequate assessment been made as to whether the measures related to
compliance with the ‘fourth runway rule’ have a potential (negative) effect on the risks
associated with runway combination changes and vice versa?

Such assessment has not been made. However, it is implicit in the nature of the LVNL measures
that part their purpose is going to contribute reducing the risks of runway combination changes. The
measures intend to increase and make a more efficient use of existing capacity, allowing to depend
less on the fourth runway, thus potentially reducing operational complexity.


Have additional measures been taken to manage these risks?

[Section 4.3] No additional measures are required. The aim of the measures related to the Risk
analysis is to reduce the risks of runway combination changes. The three key operational
stakeholders contribute to their implementation. On the other side, the LVNL measures aim at
reducing the use of the fourth runway. The measures in both reports can be considered
complementary, according to the expected positive effect of LVNL measures on the use and increase
of existing capacity. What could be potentially measured is the effect of an overlap of solutions by
the same stakeholder. At this moment LVNL apply “deployment of the second runway during day
time” (in Risk analysis) and “imposing control measures for runway use” (in Fourth runway rule). The
use nowadays of the fourth runway has been limited during daytime until 15:30h.
Recommendation: Track the effectiveness of the two measures. Besides regular monitoring 44, it is
recommendable to make a specific review or survey in a year time on the specific impact of
concentrating 4th runway operations up to 15:30h.