INTERNATIONAL JOURNAL OF SYSTEMS APPLICATIONS, ENGINEERING & DEVELOPMENT

Issue 2, Volume 2, 2008

Airport system analysis: a probabilistic risk

assessment model
L. Guerra, T. Murino, and E. Romano

the expected loss would result in quantifying the risk exposure

index. Risk assessment is an essential process in defining
policy for risk management. By identifying the nature and the
potential impacts on consumers or employees, risk assessment
can assist regulatory authorities and business organizations to
determine what kind of actions are needed [15].
Risk and safety have always been considered critical in civil
aviation [33].
Particularly, an airport is a multifunction distributed system
(Fig. 1) that is part of a much larger system.

AbstractRisk reduction is one of the key objectives pursued by

transport safety policies. Particularly, the formulation and
implementation of transport safety policies needs the systematic
assessment of the risks, the specification of residual risk targets and
the monitoring of progresses towards those ones. Risk and safety
have always been considered critical in civil aviation. An increase in
airport capacity usually involves changes to runways layout, route
structures and traffic distribution, which in turn effect the risk level
around the airport. For these reasons third party risk becomes an
important issue in airports development. Currently, were moving to a
wide adoption of Safety Management Systems (SMS) which carries
with it a need to undertake risk assessments, either qualitative or
quantitative. The purpose of this paper is to describe and analyse
safety aspects in civil airports. To avoid subjective interpretations
and to increase model accuracy, risk information are collected and
evaluated in a rational and mathematical manner. The method may
be used to draw risk contour maps so to provide a guide to local and
national authorities, to population who live around the airport, and to
airports operators.

KeywordsAirports, Civil Aviation, Risk Assessment,

Risk Management.
I. INTRODUCTION

(1) Passenger Terninal

Complex
(2) Car Park Building 1, 2
(3) Airport Operation
Building
(4) Aeronautical Radio of
Thailand
(5) Novotel Suvarnabhumi
Airport Hotel
(6) Free Zone
(7) Domestic Cargo
(8) TG Technical
Department
(9) TG Ground Service
Equipment
(10) TG Operation Center

reduction is one of the key objectives pursued by

transport safety policies. Particularly, the formulation and
implementation of transport safety policies need the
systematic assessment of the risks, the specification of
residual risk targets and the monitoring of progresses towards
those ones. Furthermore, targeting phase needs a deep analysis
to balance efforts, achievability, public and political
acceptability of the policies to be implemented [31].
Risk assessment ranges from the interpretation of the
available data concerning frequent threats to the estimation of
very rare events likelihood: combining these information with
ISK

(11) Bangkok Flight Services

(12) BAFS
(13) Public Transportation
Center
(14) LSG Sky Chefs

(21) Airport Maintainance

Facilities/AMF
(22) ASIG
(23) Bangkok air Catering

(15) Airport Rescue & Fire

Fighting Station
(16) TG Catering
(17) DCAP
(18) Suvarnabhumi Postage
(19) Longterm Parking Area
(20) Meteorological Facilities

Fig. 1 - Suvarnabhumi Airport, Bankok

You can think of it as being at the centre of a dynamic

network made up of all the sources of cargo, passengers and
the other people who travel to and from the airport: visitors,
cleaners, et alia. But that is just the ground system. Many of
these networks are interconnected and they create a huge
communication network: the nodes are the airports with their
hinterlands, and the links are made up of aircrafts [30].
Airports presence causes a convergence of air traffic over

Manuscript received March 11, 2008; Revised received April 21, 2008
L. Guerra is PhD student at the Department of Materials Engineering and
Operations Management, University of Naples Federico II, Naples, 80128
Italy (e-mail: [email protected]).
T. Murino is lecturer at the Department of Materials Engineering and
Operations Management, University of Naples Federico II, Naples, 80128
Italy (e-mail: [email protected]).
E. Romano is PhD at the Department of Materials Engineering and
Operations Management, University of Naples Federico II, Naples, 80128
(corresponding author, phone: +39081-7682629; e-mail: [email protected]).

52

INTERNATIONAL JOURNAL OF SYSTEMS APPLICATIONS, ENGINEERING & DEVELOPMENT

Issue 2, Volume 2, 2008

Authority, provides sufficient assurance for th general public

to use the services without having to worry about doing their
own risk assessments of the transport infrastructure before
deciding how to travel [31].
Currently, were moving to a wide adoption of Safety
Management Systems (SMS) which need to undertake risk
assessment activities, either qualitative or quantitative.
As an example in the UK, the Civil Aviation Authority
(CAA) describes the means of implementation of SMS by an
aircraft operator [8]. Risk assessment is an essential part of
such a system, and CAP712 therefore includes a risk
tolerability matrix for use when quantifying risk.

the surrounding area so, people who lives in that area are
unconsciously exposed to aircraft accidents risk. Actually,
local risk levels are higher than might be expected. In fact,
even if it is true that the accident per flight index is very low
(typically 1 per 106), statistics demonstrate that accidents
mostly happen during take-off and landing phases and hence,
close to the airport (Fig. 2).
Taxi,
load,
parked

Takeoff

Initial
climb

Climb
(flaps
up)

Cruise

Desc.

Initial
appr.

Final
app.

Land.

Accidents

5%

12%

5%

8%

6%

3%

7%

6%

45%

Fatalities

0%

8%

14%

25%

12%

8%

13%

16%

2%

Exposure = % of flight
time based on flight
duration of 1,5 hours

TABLE 1 - WORLD WIDE AIR TRAFFIC

(BLN. PASSENGERS/KM, NO CHARTER FLIGHTS), ICAO, 2006.
Effective

1%

1%

14%

57%

11%

12%

3%

Air Company
and
Geographic Area

1%

Fig. 2 - Statistical Summary of Commercial Jet Airplane Accidents, Boeing,

2005.

Moreover, the low probability of an accident per movement

if combined with the high number of flight operations
(typically several hundreds of thousands) may suggest the
probability of one accident to be higher than we could expect.
Risk level around large airports are, in effect, of the same
order as those associated with participation in road traffic.
An increase in airport capacity usually involves changes to
runways layout, route structures and traffic distribution, which
in turn effect the risk level around the airport. For these
reasons third party risk becomes an important issue in airports
development.
In the late 90s the worlds airline fleet consisted of more
than 15.000 aircraft, flying a network of approximately 15
million km and serving nearly 10.000 airports. The sector
directly employed more than 3.3 million people, with over 1.4
million in USA (Table 1) [3]. About 12 billion people and 23
million tonnes of freight are being moved annually. The
freight part represents approximately one third of value of the
worlds manufactured exports.
A variety of international institutions, organisations and
agencies deal with forecasting future trends, including
International Civil Aviation Organization (ICAO) and
International Air Transport Association (IATA). The airspace
manufacturers such as Airbus Industry, Boeing and Rolls
Royce also make projections.
Historically, when there has been relatively rapid growth in
air transport, it has often been followed by a series of
accidents. The occurrence of such events has stimulated the
introduction of technical and operational measures. As a
result, overall safety has improved over time. However
technical and technological limits are near to be reached and
this is demonstrated by the slowdown of aviation safety
improvements in the last few decades [35]. A formal risk
assessment carried out by the service providers, with support
from equipment suppliers, and accepted by a Regulatory

1995

2005

Mean Annual
Variation (%)

Expected
2006

2007

2008

Africa

49,9

84,8

5,4

90,7

96,4

101,9

Asia/Pacific

556,5

967,4

5,7

1036,1

1105,5

1176,3

Europe

565,4

1004,9

5,9

1070,2

1136,6

1204,8

Middle East

66,9

168,9

9,7

189,2

209,0

228,9

North American

900,6

1334,5

4,0

1394,6

1454,5

1517,1

Latin America/
Carribean

108,9

159,2

3,9

167,2

175,0

182,4

WORLD

2248,2

3719,

5,2

3947,8

4177,0

4411,2

The discipline of risk assessment has been applied in the

aircraft systems as required for aircraft certification under
FAR23, FAR25 in U.S.A and under EASA Certification
Specification (CS)-23/25 in Europe. Techniques to
accomplish safety assessment are quoted by the SAE in their
Aerospace Recommended Practice (ARP)-4761.
Flight Operations Risk Assessment System, known as
FORAS [16], is a risk management tool to encode human
knowledge about a type of risk. The FORAS methodology
employs a fuzzy expert system to identify the factors which
have the greatest impact on overall risk.
A different approach has been adopted by Kawasaki [25]
who developed the Aviation Safety Risk Model (ASRM). This
system is based upon the Human Factors Analysis &
Classification System (HFACS) proposed in [35]. HFACS is a
classification scheme which has been developed to capture
and analyze the different types of human error that may occur.
The framework draws on [27], in which was developed the socalled Swiss-cheese model of accident causation. ASRM
was originally developed for military use (US Naval
Aviation), but it has been used more widely within the
aviation industry. The ASRM uses Bayesian Belief Networks
to model the uncertainty within the model, using either data or
the opinion of experts.
An additional technique has been adopted by Bazargan and
Ross [5]. They used the proportional occurrence of causal
factors obtained from accidents reports, where fatalities or
serious injuries were reported. These information are then
combined with experts judgments on the relative importance
53

INTERNATIONAL JOURNAL OF SYSTEMS APPLICATIONS, ENGINEERING & DEVELOPMENT

Issue 2, Volume 2, 2008

the fact that there is risk if there exists a potential source of

damage, or hazard. When an hazard exists (e.g. a system
which in certain conditions may cause undesired
consequences), safeguards are typically devised to prevent the
occurrence of such hazardous conditions and its associated
undesired consequences.

of the flight attributes using the Analytical Hierarchy Process

(AHP) by Thomas Saaty.
The purpose of this paper is to describe and analyze safety
issues in airports paying attention to the following aspects:

a strategic approach to improve airport safety, which

includes the use of failure and hazard analysis
techniques and fast time simulation modeling;
safety of land side operations;
certification aspects.

To avoid subjective interpretations and to increase model

accuracy, however, risk information were colleted turning to
data records and statistically analyzed. Results were used to
draw risk contour maps so to provide a guide to local and
national authorities, to population who live around the airport
and to airports operators.
The paper is organized as follows: in Section II some
definitions will be provided about risk management and risk
assessment specifying some terms used in the civil aviation
field; in Section III gathered data will be analyzed using some
safety data records and arranged in some useful tables; in
Section IV the probabilistic model will be presented and
remarked.

B
C
D
E

II. DEFINITIONS
A risk is the combination of the probability, or frequency,
of occurrence of a defined hazard and the magnitude of the
consequences of the occurrence [8].
The combination of these parameters determinates a two
dimensional quantity. So, if the risk is to be reduced, it can be
either be done on the severity axis, on the likelihood axis, or
considering both of these dimensions. The last approach may
be considered the best one to risk reduction.
For natural hazards such as an earthquake, typically we
cannot do anything to reduce the likelihood, but there is much
that can be done to reduce the consequences: special building
regulations can be put in place and earthquake kits can be
pre-distributed to inhabitants. Alternatively, there is much that
can be done to reduce the chances of happening of a midair
collision of two aircraft: the air traffic control system and onboard radars deal with monitoring and maintaining both
vertical and horizontal separation.
Generally speaking, risk assessment procedure aims [30]:

TABLE 2 - LIKELIHOOD ESTIMATE GUIDE

LIKELIHOOD
DEFINITION
RATING
Is expected to occur in most circumstances.
Almost Certain
(100/year)
Will probably occur in most circumstances.
Likely
(10/year)
Might occur at some time.
Possible
(1/year)
Could occur at some time.
Unlikely
(1/10 years)
May occur only in exceptional circumstances.
Rare
(1/100 years)
TABLE 3 - CONSEQUENCE ESTIMATE GUIDE
CONSEQUENCE
DEFINITION
RATING
Risk impact would be negligible or no risk
Insignificant
impact can be identified to community or
business.
Risk impact would result in few consequences,
Minor
such as minor disruption to community and/or
business, but of limited overall consequence.
Risk impact would result in some
Moderate
consequences, such as short-term disruption to
community and/or business.
Risk impact would result in serious
Major
consequences, such as medium-term disruption
to community and/or business.
Risk impact would result in disastrous
Catastrophic
consequences, such as long-term disruption to
community and/or business.

However, the presence of an hazard does not suffice itself

to define a condition of risk. Indeed, there is the possibility
that the hazard evolves from potential to actual damage. Thus,
the notion of risk involves some kind of loss or damage that
might be received and the uncertainty of its transformation in
an actual loss or damage so:
Risk = Damage + Uncertainty
This qualitative analysis is reflected in various dictionary
definitions of risk, such as: possibility of loss or injury and
the degree of probability of such loss.
However, let x and p respectively be a given damage and
the probability of receiving such damage. From a quantitative
point of view, a measure of the associated risk R is:

to derive the likelihood value and the severity of

consequences value for each hazard;
to use gathered information as a means of prioritizing
actions, for example i.e. which hazard is more time
consuming and should be tackled as first one?;
to specify mitigating features as appropriate to each
hazard;
to predict the effectiveness of those features in
reducing the risk.

R = x p

(1)

In practice, the perception of risk is such that the relevance

given to the damage x is far greater than that one given to its
probability of occurrence p so that (1) is slightly modified to:

A first, intuitive definition of the term risk, comes from

54

INTERNATIONAL JOURNAL OF SYSTEMS APPLICATIONS, ENGINEERING & DEVELOPMENT

Issue 2, Volume 2, 2008

R = p x , k >1
k

protection, residual risk management. Finally, an informative

and operative definition of risk should allow answering the
following questions:

(2)

By so doing, numerically larger values of risk are

associated to larger consequences.

Which sequences of undesirable events transform the

hazard into an actual damage?
What is the probability of each of these sequences?
What are the consequences of each of these
sequences?

The risk is, then, defined in terms of a set of triplets:

R = {( St , Pt , X t )}

(3)

where si is the sequence of undesirable events leading to

damage, pi is the associated probability and xi is the
consequence.
In relationship to the kind of event, it is possible to define
three typologies of risk:
Fig. 3 A simple scheme to evaluate risk magnitude and likelihood, European
Cooperation for Space Standardization [29]

When considering complex systems, the above quantitative

definitions must be extended to account for the fact that
typically more than one undesirable events exist and could
happen. With n undesirable events associated with the
considered activity, with a part of a given system or with a
specified worker (composite risk), (1) changes in:

The last category is the object of the proposed model and

we will refer to them simply as risk of accident. In the case in
which the risk index was higher than a specified threshold,
some actions will be highlighted to attenuate its value
accordingly to the previously mentioned approach.
In this paper, events are classified according to the
definitions furnished by the National Transportation Safety
Board (NTSB) and the International Civil Aviation
Organization (ICAO):

R = xt pt

Conventional risks: they are relative to very frequent

events and they interest one or two people;
Specific risks: they are relative to continuous or
frequent events with modest damages in brief times;
Great potential risks: they are connected to very rare
events with serious damages.

(3)

t =1

and similarly it is done for (2).

These quantitative definitions of risk are easily shown to be
little informative for the purposes of risk analysis, risk
management and regulation definition.
Suppose were considering two different systems A and B
and let it be RA = RB as defined by (1). Let the risk of A be due
to a potentially large consequence xA occurring with small
probability pA and vice-versa for the risk of B. Then, if we
wish to act on the design, operation and regulation of the two
systems in order to reduce the associated risks, we will act
differently knowing the different nature of the risk in those
cases. To reduce RA we would implement mitigation and
restraining systems/politics which to limit its consequences
(protection), on the contrary, if we were to reduce RB we
would allocate additional redundancies and improve the
reliability of the components so to reduce the probability of an
accident (prevention). Thus, if we simply know the value of R,
we may not be effective in reducing it by limiting its
probability or by mitigating its consequences; hence, the
importance of keeping separate the two terms of the risk, p
and x. The situation is, naturally, worse in the case of the
composite risk. Note also that, generally speaking, a good
approach to risk reduction is: prevention, mitigation,

55

Airplane accident: this is an occurrence associated

with the operation of an aircraft where as a result of
the operation of an aircraft, any person (either inside
or outside the aircraft) receives fatal or serious injury
or any aircraft receives substantial damage. The
occurrence is also not caused by the deliberate action
of one or more persons and that leads to damage or
injury;
Hull loss (Serious Incident): An aircraft damaged to
the extent that it is not economically feasible to repair
it. This would include aircraft that are destroyed or
aircraft that are missing.;
Substantial damage (Incident): Damage or structural
failure that negatively affects an aircrafts structural
strength, performance, or flying characteristics, and
which would require significant repair or
replacement of the affected component or system.
Substantial damage excludes damage to landing gear,

INTERNATIONAL JOURNAL OF SYSTEMS APPLICATIONS, ENGINEERING & DEVELOPMENT

Issue 2, Volume 2, 2008

wheels, tires, and flaps. It also excludes bent

aerodynamic fairings, dents in the aircraft skin, small
punctures in the aircraft skin, ground damage to
propeller blades, or damage to only a single engine;
Fatal accident: An accident that results in fatal
injury;
Fatal injury: An injury that results in death within 30
days as a result of an accident;
Serious injury: An injury sustained in an accident
that:

III. SAFETY DATA RECORDS

The airport risk assessment includes a series of connected
activity:

events historical analysis;

accident frequencies determination;
magnitude and the risk evaluation.

Information were acquired investigating:

9 Requires hospitalization for more than 48 hours

that begins within 7 days of the date of injury;
9 Results in a fracture of any bone (except simple
fractures of fingers, toes, or nose);
9 Produces lacerations that result in severe
hemorrhages or nerve, muscle, or tendon
damage;
9 Involves injury to any internal organ;
9 Involves second or third degree burns over 5%
or more of the body;
9 Involves verified exposure to infectious
substance or injurious radiation.

aircraft accidents causes;

accident location;
accident consequences.

In terms of data used in this phase, one the most regular

sources of accident data is the Statistical Summary of
Commercial Jet Accidents [6]. This data represents
information drawn from worldwide aircraft operations from
1959 to 2003. It presents data on the types of accidents and
the phase of flight in which they occurred. Similar reports are
available from the UK CAA Safety Regulation Group, which
has produced reports containing data drawn from accident and
incident sources world-wide, in the Global Fatal Accident
Review CAP681 [7]. This report is significant in that it
contains judgments of the causal factors of each fatal accident
to aircraft >5.7 tonnes. It also contains circumstantial factors
which could have had a bearing on each accident.
So, accident data are obtained, when available, from
government accident reports. Otherwise, information is
solicited from operators, manufacturers, various government
and private information services (Table 4).
Such information is inferred by a historical analysis of the
events, making reference to:

Moreover, when building a large system from a number of

smaller ones we find that many of the hazards arise from the
intra-system interfaces [30].
When performing a risk assessment, then, we can start
identifying those interfaces and the hazards arising from them.
Where a system is made up of subsystems from different
suppliers their domains of influence also need to be
considered. An airport has a lot of interfaces with outside
world: air traffic control has radio and telephones, there are
navigational aids that communicate with aircraft (instrumental
landing systems), there are road/rail links, etc. We will
consider only one airside interface, the runway (Fig. 4): which
is the interface between the air navigation system and the
ground handling area.

1. local files (ANSV);

2. world files (AAIB, AAIU; ATSB; NTSB; TSB, etc.).
In order to structure a tool which could allow a brief, but
exhaustive, description of the analyzed data and could be a
useful support to record the first news of our investigations, a
report has been compiled (Fig. 5).
In this report the ID_NUMBER is the code of the analyzed
report whereas the field DATE AND HOUR indicates the date
and the time in which the accident has happened (in
conformity with the prescriptions of the ICAO Annex 13, it is
express in local or coordinated universal schedule UTC,
Universal Time Coordinated). LOCATION is the place in
which the accident is occurred and AIRCRAFT_ID is the
typology of aircraft interested by the accident (in our case
commercial airplanes such as: Boeing, Airbus, Mac Douglas).
The field CLASS indicates the class of the aircraft defined
in relationship to its maximum take-off weight (MTOW),
identified by the following letters:

Fig. 4 Perth airport runway

56

A: aircrafts with MTOW < 6.750 Kg with only one

INTERNATIONAL JOURNAL OF SYSTEMS APPLICATIONS, ENGINEERING & DEVELOPMENT

Issue 2, Volume 2, 2008

engine;
B: aircrafts with MTOW < 6.750 Kg and two
engines;
C: aircrafts with 6.750 kg < MTOW < 136.000 kg;
D: aircrafts with MTOW > 136000 Kg and more than
two engines.

TABLE 4 THE 15 WORST AVIATION DISASTERS (2007-1995), BOEING

STATISTICS

Fatal

Date

Location

Carrier

Type

349

11/12/1996

New Delhi, India

Saudi / Kazastan

B747 / Il76

275

02/19/2003

Shahdad, Iran

Islamic Revolution's
Guards Co.

Il-76MD

265

11/12/2001

Queens, New York

American Airlines

A300

234

09/26/1997

Buah Nabar,
Indonesia

Garuda Indonesia
Airlines

A300

230

07/17/1996

East Moriches, New

York

Trans World Airlines

B747

229

09/02/1998

Off Nova Scotia,

Canada

Swissair

MD11

228

08/06/1997

Agana, Guam

Korean Airlines

B747

227

01/08/1996

Kinshasa, Zaire

African Air

AN32

225

05/25/2002

Off Penghu, Taiwan

China Airlines

B747

217

10/31/1999

Nantucket,
Massachusetts

EgyptAir

B767

203

02/16/1998

Taipei, Taiwan

China Airlines

A300

199

07/17/2007

Sao Paulo, Brazil

TAM Brazil

A320

189

09/11/2001

Arlington, Virginia

American Airlines

B757

189

02/06/1996

Puerto Plata,
Dominican Republic

Alas Nacionales
(Birgenair)

B757

170

08/22/2006

Donetsk, Ukraine

Pulkovo Airlines

Tu-154M

Fig. 5 - A synthetic scheme to collect a principal factors concerning aircraft

accident

In the field FLIGHT PLAN theres a synthetic description

of the flight plan performed by the plane. Particularly it
records the departure airport and his id code, intermediary
airports, the destination airport and the flight typology.
METEOROLOGICAL_CONDITIONS are the conditions
recorded in the site of the accident when the event occurred.
Particularly, they regard the presence and height of the clouds,
visibility, wind direction and intensity, precipitation,
temperature and dewy point. In the field SYNTETIC EVENT
DESCRIPTION theres a brief but exhaustive description of
the accident dynamic. In such description they are underlined:

FLIGHT_CONDITIONS are the meteorological conditions

before and during the event distinguished in:

run off: it is frequent in the case of long landing or

aborted take-off;
veer off: it is relative to an aircraft side off and can
happen both in take-off phase and landing. It can be
due to a high value of the transverse component of
the wind, to a mechanical breakdown, etc;
short landing: it happens when an airplane touch the
ground before the runway threshold. It is mainly due
to bad meteorological conditions;
run incursion: it occurs both in take-off phase and
landing phase. It can concern both aircrafts or other
vehicles.

VFR (Visual Flight Rules): it deals with a flight

performed with the visual references aid. Naturally
the possibility to effect visual flights is possible only
when theres enough visibility (VMC, Visual
Meteorological Condition). In the checked aerial
spaces the least VMCs are: flight visibility in 8 Km,
distance from the clouds 1,5 Km in horizontal
direction and 300 m in vertical direction. In Italy the
visual flight rules are forbidden on the night time and
the flight have to sustain under the 600 ms of height,
cannot be landed in VFR with visibility to the ground
lesser than 8 Km and with ceiling lesser than 450m;
IFR (Instrument Flight Rules): when the flight is
performed using radiofrequency aids (VOR, NDB,
DME, TACAN, etc.).

in the landing phase, the touchdown point in which

the accident happened and the stop point in which the
aircraft or eventually major debris were reinvented;
in the take-off phase, the point in which the airplane
withdrew its gears, the point in which the accident
happened and the stop point in which the aircraft or
eventually major debris were reinvented.

In this report the PROBABLE CAUSES that caused the

accident were reported too. In Table II a database built on
1,843 events involving commercial aircraft, world-wide, for
which a specific cause is known is reported. Military, private
plane, helicopter and small air taxi accidents are not included.

In the field MANOUVRE_CONDITIONS the maneuvers

that the aircraft was performing during the accident are
reported (landing and takeoff in IFR or VFR conditions, taxi,
etc.). The EVENT_TYPE is the typology of aircraft accident:
57

INTERNATIONAL JOURNAL OF SYSTEMS APPLICATIONS, ENGINEERING & DEVELOPMENT

Issue 2, Volume 2, 2008

Essentially we refer to human factors, mechanical factors or

environmental factors. Even if these factors are not
interdependent, they can interact. The reduction in accidents
attributable to human errors is not as much as function of
interventions aimed at aircrew, as it is improvements made to
the aircraft. After all, it is known that the opportunities for
human errors considerably grow up when a mechanical failure
occurs. So, it would appear that many of the interventions
aimed at reducing the occurrence or consequence of human
errors have not been as effective as those directed at
mechanical failures [35]
However, mechanical and environmental factors are
obviously unchangeable in the brief period: theres only the
possibility to act on human errors applying preventive
measures that aim to reduce the accidents.

Cause
Pilot Error
Pilot Error
(weather based )
Pilot Error
(mechanical based)
Total Pilot Error
Other Human Errors
Weather
Mechanical Failure
Sabotage
Other

damp, to point out that the surface showed

changes of color because of the damp;
9 wet, to point out that the surface is full water,
but there is no puddles;
9 water patches, to point out that on the surface
they were visible puddles;
9 flooded, to point out that on the surface they
were visible ample zones covered with water.
In case of some ice on the runway the terms used are: rime
or frost, dry snow, wet snow, slush, ice, compacted or ruled
snow, frozen ruts or ridges.
The EVENT_SCHETCH is a graphical representation of the
accident in which the points discussed in the synthetic
description of the accident and some photographic
documentation are reported.

TABLE 5 - CAUSES OF EVENTS (%)

1950s 1960s 1970s 1980s 1990s 2000s Total
41
37
29
30
31
30
33
11

17

15

16

19

19

16

59
4
14
20
3
0

57
7
11
19
4
2

48
10
10
21
9
2

50
6
12
21
10
1

56
7
9
21
7
1

52
9
8
25
6
0

53
7
11
21
7
1

A. Experimental analysis: acquisition and elaboration data

For each event the proposed report has been compiled.
Acquired data allowed to establish that the 46,4% of the 1.174
commercial airplanes accidents concerned the airport (58,5%
concerning the RWY, 33,6% concerning the apron and 7,9%
concerning the TWY) and the 18,1% the approach paths.
As concern risk events typology: 40,1% are accident,
54,7% are incident and 5,2% are serious incident.
From these results emerges that during the taxing
maneuvers, from and for the runway, and those of standstill in
the terminal area, there arent human damages if we except for
fear or light injuries. On the other hand, the accidents during
the take-off or landing phases are characterized by an high
percentage of injuries and deaths. Indeed, in this paper apron
maneuvers have not been considered.
Investigating causes of those fatal aircraft accidents is
difficult because they generally stem from a complex system
of mutually dependent, sequential factors. These factors can
be classified in several ways. At first, according to the current
state-of-knowledge, they can be categorized into:

As concern failures typology, the following classification

can be made:

active failures (errors or active drawbacks): errors or

drawbacks that have an immediate negative effect;
latent failures: failures existing before the event.

A description of the features interested by the accident is

reported in the AIRPORT FEATURES INTERESTED field:
RWY, TWY, Apron or also the zone where the accident
occurred, as well as the state in which was found during the
accident. Some interesting airport features about runways are:

allows a precise approach without any decision

height and a RVR between 200 and 50 meters;
the pavement conditions during the accident. To
define aforesaid conditions we referred to the ICAO
terminology. The followings terms have been used:

a synthetic description of the geometric

characteristics: length, width, longitudinal and
transversal inclination, presence of stop way and his
dimensions, TORA (Take Off Run Available), TODA
(Take Off Distance Available), ASDA (Accelerate
and Stop Distance Available), LDA (Landing
Distance Available), runway instrumentations, ILS
system for landing. Particularly, in relationship to the
runway visual range and to the decision height, the
ILS is divided in ILS of CAT I, it allows a precise
approach till a height of decision of 60 meters and a
RVR of the 800m, ILS of 2CAT II, it actually allows
a precise approach till a decision height of 30 meters
and a RVR of the of 400 meters, ILS of CAT III, it

known and avoidable;

unknown and unavoidable causes.

The former should be considered conditionally in the sense

that immediately after an accident the real causes are seldom
fully known but as the investigation progresses they become
known and avoidable. Then, with respect to accident type, the
main causes can conditionally be classified into:

58

human errors;
mechanical failures;

INTERNATIONAL JOURNAL OF SYSTEMS APPLICATIONS, ENGINEERING & DEVELOPMENT

Issue 2, Volume 2, 2008

represented by human errors, in the take-off theres no

difference between mechanical failures and human errors.

hazardous weather;
sabotages or military operations.

IV. RISK ASSESSMENT METHODOLOGY

Data considered in this paper concern commercial aircrafts
involved in runway accidents during take-off or landing
phases. Specifically weve not considered:

Fig. 6 Aircraft events distribution

the missed collisions on the runway between two

aircrafts or between an aircraft and any other vehicle
on the runway;
the accidents in the take-off phase that havent
brought any harmful effect;
the accidents in which the aircrafts, during the
landing phase, suffered failures and went out the
runway without any other problem.

The model to assess airport risk around the runway is

composed by three main elements:

Fig. 7 - Distribution of the ICAO events with respect to some airport intrasystems

A. The aircraft accident probability model

The aim of the paper is to determine a partition of the area
surrounding the runway so to trace some isofrequency lines
characterized by the same aircraft accident probability (as
shown in figure 2).
The model is the result of a careful analysis of the
incidental phenomenon and particularly of the dynamics that
brought to the aircraft accident, both in the take-off and in the
landing phases. Gathered data analysis pointed out some
important variables to be considered in evaluating aircrafts
such as the touchdown point or the point in which there was
the interruption of the take-off phase, the aircraft (or major
debris) stop point. However an accident can occur randomly,
at any time and in any point of the space. Past aircraft
accidents had these features. Therefore it is possible to make a
dicretization of the considered area (the runway and its
surrounding) and to perform a frequency analysis for each
patch (Fig. 9).
Particularly, fixing a Cartesian reference system (x, y) with
the x axis lengthwise fixed on the runway, and y axis
orthogonally fixed at the beginning of the runway, we split the
area determining a squared/rectangular grids. So, it will be
possible to calculate the probability that an airplane (or major
debris), which belongs to the ith class, involved in a generic
accident, will stop in a specific point B (the center of the
generic patch of the grid) if the same airplane touched the

Fig. 8 Distribution of the ICAO events with respect to RWY system

As concern data about the accidents happened on the

runway, a 75% of these ones happen in the landing phase and
the remaining 25% in the take-off phase. Considering the
single maneuvers:

the probability model to evaluate the occurrence of a

particular kind of aircraft accidents;
the accident location probability model to determine
the frequency of an occurrence in order to evaluate
the index p in (1);
the accident consequence probability model in order
to evaluate the index x in (1).

in the landing phase, the 66% of the accidents are

due to human errors, 20% to mechanical failures and
14% to meteorological conditions;
in the take-off phase, the 45,5% of the accidents are
due to human error, 45,5% to mechanical failures and
9% to meteorological conditions.

Therefore, while in landing phase the main cause is

59

INTERNATIONAL JOURNAL OF SYSTEMS APPLICATIONS, ENGINEERING & DEVELOPMENT

Issue 2, Volume 2, 2008

obtained and used with the probability scheme. For example

on 11/07/2001 in Fiumicino Airport (Rome) an accident
interested a MD-11 airplane. Runway 16C dimensions were
9.850 ft (length) and 150 ft (width). Dividing these dimensions
by the "standard runway" dimensions it were obtained the
following values: Cx = 1,015, Cy= 1,000.

ground or aborted the take-off in point A (the center of the

generic patch of the grid).

1) The proportional accident model

This model involves the statistical modeling of the
occurrence of air accidents over time. A Poisson process is
often deployed. Such a process is based on the following
assumptions:

Fig. 9 - Discretization of the interested area. Capodichino Airport, Naples

Then we can assume:

PrIi {B} =

ni
Pr i {I } Pr i {A} Pr i {B / A}
ni

(4)

where:

ni
is the percentage of the airplanes belonging
ni
to the ith weight class related that land or take-off
from the considered airport;

ni
Pr i {I } represents the proportion of aircraft
ni

In Poisson processes the time intervals between two

consecutive events is exponentially distributed, indicating
non-memory properties: this means that future events do not
depend on the number of previous events or on the time in
which previous events happened. This would logically seem
to be the case with air accidents. Mathematically, let T be the
random variable representing the time interval between any
two consecutive events. This variable is exponentially
distributed. The probability that no accident will occur in a
time interval t is:

that crashed within the airport surrounding, that runoff the runway, etcSo, this term represents the
particular type of accident the aircraft may have;

Pr i {A} is the probability that the airplane belonging

to the ith weight class touches the ground in the

landing phase or aborts the take-off in a point of a
specific patch of the grid represented by the point A;

an event can occur randomly, at any time and in any

point of the space. Past aircraft accidents had these
features: they occurred in a random way in different
countries of the world;
the occurrence of an event in a given time or space
interval, is independent on what happened in any
other non-overlapping interval. Air accidents, except
very rare mid-air collisions, have occurred as the
series of independent events in time and space;
the probability of an event occurring in a small
interval t is proportional to t and can be calculated
by t where is the mean rate of occurrence of the
event. It is assumed constant and equal to 1/Ta, where
Ta is the average time interval between two
consecutive events. The probability of two or more
occurrences in t is negligible.

Pr i {B / A} is the probability that the airplane

belonging to the ith weight class, departing from the

point A stops (or major debris stoop) in a point of a
specific patch of the grid represented by the point B.

P (T > t ) P ( X t = 0 ) = e t

(5)

where, Xt is the number of air accidents in time interval t and

is the average accident rate. Similarly, the probability of the
occurrence of at least one event in time t is:

Adding, for each point B, representative of a particular

patch of the grid, the probabilities determined with (4) and
considering each weight class category, cumulative
probabilities are calculated. Finally, the above mentioned
isofrequency lines were obtained enveloping the points
characterized by the same cumulative probability.
Since examined data interested different runways (with
different length and/or width), it was necessary to
adimensionalize distances information. To such purpose we
introduced the "standard runway" with a length of 10.000 ft
and a width of 150 ft. Comparing these dimensions with the
real ones, the scale coefficients (Cx and Cy) have been

P (T t ) = 1 P (T > t ) = P ( X t 0 ) = 1 e t

(6)

The probabilistic assessment of accidents uses a sample of

101 accidents over the period 1995 - 2003. The distribution of
the time intervals between these events is shown in Fig. 10.
A simple calculation provides an estimation of the average
accident rate = 7.851 accidents per year.
60

INTERNATIONAL JOURNAL OF SYSTEMS APPLICATIONS, ENGINEERING & DEVELOPMENT

Issue 2, Volume 2, 2008

30

60

90

120

150

180

210

240

270

300

330

360

0,8
0,75
0,7

Relative number of observation

0,65
0,6
0,55
0,5
0,45
0,4

38

Empirical data

38

Theoretical data

0,35
0,3
0,25
0,2

14

0,15
0,1

0,05

165

195

225

255

285

315

0
15

45

75

105

135

The time between the air accidents (days)

Fig. 10 - Distribution of time intervals between consecutive air accidents

(1995 2003)

An analysis of the time intervals between accidents,

regardless of the aircrafts type, shows that they are
independent and exponentially distributed (a 2 test confirms
the hypothesis matching the empirical and theoretical data
set):

02.(0510 ) = 16.9191; 2 = 15.706 2 < 02.(0510 )

Fig. 11 Touchdown points analysis, partial data.

(7)

So, the observed pattern of accidents can be treated as

Poisson processes. Using the exponential distribution showed
in Fig. 10, it is possible to assess the probability of an air
accident occurrence. If there will be any improvement in
safety features, then this distribution can be used for assessing
the probability of future events.
Fig. 12 Global touchdown points distribution

2) Model formulation: Pri {A}, landing phase

Sample data relative to touchdown points (Fig. 12, Fig. 12)
is divided in two sub-sets corresponding to C (Fig. 13) and D
(Fig. 14) weight class.
To draw these distributions a fixed number of touchdown
distance intervals has been defined. In order to avoid having
empty intervals (a little number of intervals) or information
loss about the distribution function (an elevated number of
intervals) the number of intervals and their wideness were
defined by the relationships:

k = 1+ 3,3 log10 ni
x xmin
x = max
k

(8)

Fig. 13 Touchdown points distribution, C weight class

(9)

where ni is the total number of landings related to the above

mentioned weight aircraft classes.

Fig. 14 - Touchdown points distribution, D weight class

61

INTERNATIONAL JOURNAL OF SYSTEMS APPLICATIONS, ENGINEERING & DEVELOPMENT

Issue 2, Volume 2, 2008

Some statistical tests (2 and Kolomogorov-Smirnov) were

performed to prove that these distribution could be considered
normal distribution with average and standard deviation
varying according to the weight class:

f ( x) =

1 x 2

, < < +; > 0

f ( x; ) =

(9)

= 2,02, = 1,79 for the C weight class;

= 1,58, = 1,16 for the D weight class.

(13)

and:

and:

e x x 1
( )

= 6 for C weight class aircrafts, for any stop point

distance from the touchdown point A;
= 8 for D weight class aircrafts and touchdown
point distance lesser or equal to 2.000 ft.

Therefore the probability that an aircraft touches the

runway in the point A is obtained by the following relation:

x
x

x xA + =
Pr i ( A) = Pr x A
2
2

xA +

x
2

1 x 2

1
2
x 2 e

xA

(10)
Fig. 15 Stop point distribution for C weight class airplanes on x axis

For D weight class aircrafts accidents with a touchdown

point distance far than 2.000 ft, preliminary data distribution
analysis suggest a normal approximation with = 8,05 and
= 1,46.
Therefore the probability that an aircraft that touched the
runway in point A stops in the point (xB; 0) is given by:

3) Model formulation: Pri {B/A}, landing phase

Also in this case, to define a statistical model that could
allow determining the probability that an airplane of the ith
weight class stops in point B, after it has touched the runway
in point A, for each weight class of aircrafts and for each
touchdown zone, the stop distances were computed along the
x and y axes in homogeneous intervals:

xmax xmin
k
y ymin
y = max
k

Pr i {x B / A} =

x
2

e x x 1
x ( ) dx

xB

x =

(11)

(14)

for C weight class aircrafts and for D weight class aircrafts

with stop distance lesser or equal to 2.000 ft. For D weight
class aircrafts with stop distance higher than 2.000 ft, the same
probability is given as:

with:

k = 1+ 3,3 log10 nij

xB +

(12)

Pr {x B / A} =
i

xB +

x
2

x
xB
2

where nij is the sample numerousness related to the ith weight

class and to the touchdown interval j.
So, as previously done, global distributions on x axis and y
axis were divided in two sub-sets corresponding to C and D
weight classes. For example Fig. 15 reports the stop point
distribution (airplane or major debris) for C weight class
airplanes.
Statistical tests demonstrates that this distribution may be
approximated by a standard Gamma function:

1 x 2

dx

(15)

Likewise along the y axis, sample data are distributed as a

normal function with:

62

= 0,856 and = 1,439 for C weight class aircrafts

and touchdown point distance lesser or equal to 800
ft;
= 0,380 and = 1,434 for C weight class aircrafts
and touchdown point distance between 800 and
2.000 ft;
= - 0,309 and = 2,408 for C weight class aircrafts

INTERNATIONAL JOURNAL OF SYSTEMS APPLICATIONS, ENGINEERING & DEVELOPMENT

Issue 2, Volume 2, 2008

and touchdown point distance far than 2.000 ft;

= - 0,248 and = 2,321 for D weight class aircrafts
and touchdown point distance lesser or equal to
2.000 ft;
= - 0,44 and = 0,983 for D weight class aircrafts
and touchdown point distance far than 2.000 ft.

Therefore the probability that an aircraft that touched the

runway in point A stops in the point (0; yB) is given by:

Pr i {y B / A} =

yB +

yB

and touchdown point distance far than 4.500;

= 1,563 and = 3,898 for D weight class aircrafts
and touchdown point distance lesser or equal to
4.500 ft;
= 0,167 and = 0,518 for D weight class aircrafts
and touchdown point distance far than 4.500 ft.

and the probability function is as in (18).

y
2

1 y

1
e
y 2

(18)

dy

Finally, the probability that a C weight class airplane, which

touched the runway in point A, will stop in the point B (xB; yB)
is given by:

Pri {B / A} =

xB +

x
2 x 1

xB

yB +

e x
dx
( )

yB

y
2

1 y

1
e
2

dy

(19)

instead, for D weight class airplane the same probability is

given by:

Pri {B/ A} =

xB +

x
2

2
1 x

1
e
x 2

xB

dx

y
2

yB +

2
1 y

1
e
y 2

yB

dy

(20)

4) Model formulation: Pri { A} and Pri {B/A},take-off

phase
Following an analogous procedure, it has been possible to
verify that the distances at which the take-off was aborted are
distributed according to a normal function, with:

Fig. 16 Take-off abort points analysis, partial data

= 5,09 and = 2,72 for C weight class aircrafts;

= 5,16 and = 3,17 for D weight class aircrafts

Finally, the probability that an aircraft, which aborted the

take-off manoeuvre in A, will stop in the point B (xB; yB) is
given by:

Then, the probability function is expressed as in (10).

As it concerns the probability function that determines the
aircrafts (or major debris) stop points distribution, statistical
tests indicates that it may be approximated by a standard
Gamma function with:

xB +

x 1

e x
Pr {B / A} =
dx
x ( )
i

xB

= 5 for C weight class aircrafts = 5 ;

= 4 for D weight class aircrafts = 4 .

yB +

y
2

1 y 2

1
2
e
y 2

yB

dy

(21)

B. Results analysis
The model we described in the previous sections,
determines the probability that an airplane (or major debris) of
the ith weight class, that touched the ground in a point of a
specific grid patch, which is represented by its center (A), will
be found in another grid patch, represented by its center (B).
The same approach could be used for an airplane taking-off
from the runway.
If we consider a specific airport (in our case we considered
Capodichino Airport, Naples, Fig. 17) cumulating risk

The probability function is then as in (14).

Along the y axis data are distributed as normal function
with:

x
2

= 0,050 and = 1,464 for C weight class aircrafts

and touchdown point distance lesser or equal to
4.500 ft;
= -0,428 and = 0,920 for C weight class aircrafts
63

INTERNATIONAL JOURNAL OF SYSTEMS APPLICATIONS, ENGINEERING & DEVELOPMENT

Issue 2, Volume 2, 2008

propose a magnitude scale based on the number of people who

live in the area surrounding the airport, which has to take in
account their staying time too. Particularly as concern the area
surrounding Capodichino airport, we determined the number
of people inside each possible accident location multiplying
the housing density of the area (ISTAT data, mean Naples
density = 8.315 inhabitants/km2), by the size of the area.

accident probabilities we drew some isofrequency lines to

identify area with higher accident probabilities (Fig. 18).

Fig. 17 Capodichino Airport, Naples (Google Map shoot)

Particularly we considered the following air traffic:

68% aircrafts belonging to C weight class airplanes;
32% aircrafts belonging to D weight class airplanes.
Fig. 19 Housing density, Campania, ISTAT 2005.

If the above repartition changes the boundaries may change

too.

Such value was multiplied by the permanence coefficient

(CP) given by the ratio between the effective permanence time
(PT, hours), established on the basis of the inhabitants class,
and the twentyfour hours in the day, multiplied by 1000.
Therefore, for the resident people it will be CP = 1000, for the
students it will be CP = 660, for the employees it will be CP =
330, for the people on the aircraft it will be CP = 1.
The overall risk is then obtained multiplying CP by the
respective accident probability.
V. CONCLUSION
Risk reduction is one of the key objectives pursued by
transport safety policies. Risk assessment is an essential
process in defining policy for risk management. By
identifying the nature and the potential impacts on consumers
or employees, risk assessment can assist regulatory authorities
and business organizations to determine what kind of actions
are needed
When building a large system (the airport) from a number
of smaller ones, we find that many of the hazards arise from
the intra-system interfaces.
Data confirms that in the airports case the runway is the
most critical intra-system to deal with.
In this paper we proposed a probabilistic method to analyze
accident probability deduced by real data analysis which can
be coupled with any method to assess accident magnitude.
The model helps to determine the probability that an
airplane of the ith weight class, that touched the ground in a
point of a specific grid patch, which is represented by its
center (A), will be found in another grid patch, represented by

Fig. 18 - Isofrequency lines around the airport applying the model

In fact in the aircraft accident probability model it is

hypothesized a relation between the probability of finding the
wreckage in the point B (P(B)) and the mix index traffic
k

( ni

/ ni ).
i =1

C. Evaluation of accidents consequences

There are many different ways in order to assess the
consequences of an airplane accident, either qualitative or
quantitative, even if it is rather a difficult issue. We may
64

INTERNATIONAL JOURNAL OF SYSTEMS APPLICATIONS, ENGINEERING & DEVELOPMENT

Issue 2, Volume 2, 2008

[22] Kanafani A., The analysis of hazards and the hazards of analysis:
reflections on air traffic safety management, Institute of Transportation
Studies, University of California, Berkeley, Working paper UCB-ITSWP-84-1, 1984.
[23] Kuhlmann A., Introduction to Safety Science. New York: Springer,
1981.
[24] Lazarick R., Systematic Assessment of Airport Risk, presented at the
16th Annual Security Technology Symposium, FAA Aviation Security
R&D, Williamsburg, Virginia, June 2000.
[25] Luxhj J.T., Probabilistic Causal Analysis for System Safety Risk
Assessments in Commercial Air Transport, in Proc. of the Workshop on
Investigating and Reporting of Incidents and Accidents, Williamsburg,
Sep 2003.
[26] Owen D., Air Accident Investigation: How Science Is Making Flying
Safer. Patrick Stephens Limited, Yeovil, 1998.
[27] Reason J., A human error, New York: Cambridge University Press,
1990.
[28] Rosenberg, B., Air safety: the state of art, Aviation Week and Space
Technology pp.51-66, 1987.
[29] Space Project Management, Risk Management, European Cooperation
for Space Standardization Requirements & Standards Division ECSS-M00-03B, Noordwijk, The Netherlands, 16 August 2004.
[30] Spriggs J., Airport Risk assessment: Examples, Models and
Mitigations, presented at the 10th Safety-critical Systems Symposium,
Southampton, England, 2002.
[31] Trbojevic V., Linking risk analysis to safety management, presented at
the 7th International Conference on Probabilistic Safety Assessment and
Management, Berlin, 2004.
[32] Tocchetti. A., Infrastrutture ed impianti aeroportuali. Napoli: Guido
Angeli Editore, 1983.
[33] Wagenmakers J.H., A review of transport airplane performance
requirements might bene t safety, Flight Safety Digest, vol.19, pp.1-14,
2000.
[34] Wiegmann D.A., Shappell S.A.. Applying Reason: The Human Factors
Analysis and Classification System (HFACS), Human Factors and
Aerospace Safety, vol.1, no.1, pp. 59-86, 2001.
[35] Wiegmann D. A., Shappell S. A., A human error approach to aviation
accident analysis: The Human Factors Analysis and Classification
System. London: Ashgate Publishing, 2003.
[36] Zanelli S., Affidabilit e sicurezza nellindustria di processo. Pisa:
Zanichelli editore, 1998.
[37] Huan-Jyh Shyur (2008) A quantitative model for aviation safety risk
assessment, Computers and Industrial Engineering Volume 54, Issue 1
(February 2008).
[38] Ginalber luiz de Oliveira Serra (2007), Proposal of Numerically Robust
WSEAS
Algorithm
for
Stochastic
Systems
Identification,
TRANSACTIONS on ELECTRONICS.
[39] Mirela Voicu, Gabriela Mircea (2005), Algorithms for exploiting
WSEAS
TRANSACTIONS
on
multidimensional
databases,
INFORMATION SCIENCE and APPLICATIONS Issue 12, Volume 2.
[40] Gao Shiqiao, Liu Haipeng, Jin Lei (2006), Fuzzy Dynamic
Characteristic of Concrete Material under Impact Loads WSEAS
TRANSACTIONS on APPLIED and THEORETICAL MECHANICS
Issue 1, Volume 1.

its center (B). The same approach could be used for an

airplane taking-off from the runway.
In this way some isofrequency lines (Fig. 18) to identify
area with higher accident probabilities can be drawn.
This model represent a quantitative tool that can be used
both in airport designing (to acquire specific information
about safety distances between support/civil structures and the
runway, to analyze the impact of future airport re-layouts on
safety) and in airport operations management (to take
decisions about incoming and departing air traffic mix, to
support risk managers in the assessment phase).
REFERENCES
[1]
[2]

[3]
[4]
[5]

[6]
[7]
[8]

[9]

[10]

[11]

[12]

[13]
[14]
[15]

[16]

[17]

[18]
[19]
[20]
[21]

AA.VV., Method for assessing Third Party Risk Around Airports,

National Aerospace Laboratory, Netherlands, 2002, unpublished
AA.VV., Assessing risk and setting targets in transport safety
programmes, presented at the European Transport Safety Council,
Brussels, 2003.
Air Transport Action Group, The Economic Benefits of Air Transport,
Geneva, 1996, unpublished.
Barnett A., Air safety: end of the golden age?, Chance: New
Directions for Statistics and Computing, vol. 3, no 2, pp. 8 12, 1990.
Bazargan M., Ross D. L., A Comparative Risk Measure for General
Aviation, presented at the 17th International Conference on Multiple
Criteria Decision Analysis, Whistler, Canada, Aug 6-11, 2004.
Boeing, Statistical Summary of Commercial Jet Airplane Accidents
Worldwide Operations 1959-2003, Seattle, May 2004.
CAA Safety Regulation Group, Global Fatal Accident Review 19801996. Civil Aviation Authority Rep. CAP 681, Gatwick, 1998.
CAA Safety Regulation Group, Safety Management Systems for
Commercial Air Transport Operations, Civil Aviation Authority Rep.
CAP 712, Gatwick, 2002.
Cole J., Overview of aviation safety issues, presented at the 7th Annual
Aviation Forecast Conference, National Air Traffic Controllers
Association, Washington, 1997.
Corrie S.J., Potential growth in air travel demands renewed effort to
improve safety record, International Civil Aviation Organization
Journal, vol.7, no.9, pp. 7-9, December 1994.
Dose A., Safety is best served by paying close attention to the key
elements in its management, International Civil Aviation Organization
Journal, vol.20, no.21, 1995.
Edkins G.D., The Indicate safety program: evaluation of a method to
proactively improve airline safety performance, Safety Science, vol. 30,
no.3, pp. 275295,1998.
Erto P., Probabilit e statistica per le scienza e lingegneria, Milan:
McGraw-Hill, 1999.
Evans A.W., Risk assessment by transport organizations, Transport
Reviews, vol.17, no.2, pp. 145-163, 1996.
Floyd P., Nwaogu T.A., Salado R., George C., Establishing a
comparative inventory of approaches and methods used by enforcement
authorities for the assessment of the safety of consumer products
covered by the Directive 2001/95/EC on general product safety and
identi cation of best practices, Final Report Prepared for DG/SANCO,
European Commission by Risk & Policy Analysts Limited, United
Kingdom, 2006.
Hadjimichael M., McCarthy J., Implementing the Flight Operations
Risk Assessment System, presented at the 57th International Air Safety
Seminar Shanghai, China, Nov 2004.
Gibbons J.H., Airport System Development: OTA-STI-231, presented
at Office of Technology Assessment Congress, Washington D. C.,
August, 1984. Library of Congress Catalog Card Number 84-601101.
Guidelines to Safety Assessment, Group of Aerodrome Safety
Regulators, WP093, May, 2006.
Guldenmund F.W., The nature of safety culture: a review of theory and
Research, Safety Science, vol. 34, no.1-3, pp 2215-2257, 2000.
Hale A.R., Heming B.H., Carthey J., Modelling of safety management
systems, Safety Science, vol. 26, no. 1-2, pp. 121-140, 1997.
Janic M., An assessment of risk and safety in civil aviation, Journal of
Air Transport Management, vol.6, no. 1, pp. 43-50, January 2000.
65