THE
CONTROLLER December 2009
Journal of Air Traffic Control
INTER-
TION OF AIR TRAFF ERA IC C FED
LLERS’ ASSNS. TRO ON
Also in this issue: 4 Interview Prof. James Reason 4 New York Hudson River Collision
NATIO NAL
4 SPECIAL SAFETY
Staff Planning Made Simple TrafficPlanner
The TrafficPlanner provides flow managers with a perfect overview of the future traffic situation. The TrafficPlanner calculates the workload impact for each working position, based on traffic load and complexity calculations. Adjustable parameters such as weather conditions, flight data, military activity and conflict detection are calculated and analysed by the system. The TrafficPlanner features intuitive traffic monitoring in an easy-to-use layout, featuring: r 0OMJOF SBEBS TDSFFO m TIPXJOH NPWJOH QSFEJDUFE BJS USBGàD r $PNQMFYJUZ MFWFMT JO DPMPVS HSBQIJDT r 4FDUPS MPBE àHVSFT JO DPMPVS HSBQIJDT r 0QUJNBM TFDUPS DPOàHVSBUJPO TVHHFTUJPO
Bidding
Roster Planning
OJT Planning
Developed by Air Traffic Controllers
Check In
BreakPlanner
Flow from A-Z Leave Planning
Duty Swapping
Contact : Integra - Michael Silau - oms@integra.dk - +4522666120
StatusChecker
Check Out
TrafficPlanner
Contents
THE
CONTROLLER
December 2009 4th quarter 2009 Volume 48 ISSN 0010-8073
THE
CONTROLLER December 2009
Journal of Air Traffic Control
4 SPECIAL SAFETY
Photo:
Looking for safer skies. Also in this issue: 4 Interview Prof. James Reason 4 New York Hudson River Collision
Photo credits:
dvmsimages/dreamstime
PUBLISHER IFATCA, International Federation of Air Traffic Controllers’ Associations. EXECUTIVE BOARD OF IFATCA Marc Baumgartner President and Chief Executive Officer Alexis Brathwaite Deputy President Alex Figuereo Executive Vice-President Americas (Henry Nkondokaya) Executive Vice-President Africa/ Middle East Raymond Tse Executive Vice-President Asia/Pacific Patrik Peters Executive Vice-President Europe Dale Wright Executive Vice-President Finance Scott Shallies Executive Vice-President Professional Andrew Beadle Executive Vice-President Technical Jack van Delft Secretary/Conference Executive EDITOR-IN-CHIEF Philippe Domogala Editorial address: Westerwaldstrasse 9 D 56337 ARZBACH, Germany Tel: +492603 8682 email: ed@ifatca.org
In this issue:
Foreword by Alex Figuereo .……..……………….….…………......… 4 Editorial by Philippe Domogala ……………………….…………......... 5 Obituary .……..……………….….…………...........…………………........ 6 Safety Safe or Unsafe – the Multimillion Dollar Question? by Marc Baumgartner …...................……………………………..... 7 The Blame Culture in Italy by Bruno Barra .…..............………...... 8 Safety in Russia by Eduard Kolodnyy .…....................................... 11 Safety Management Systems by Drazen Gardilči .....................… 12 NOSS – Normal Operation Safety Survey by Dr. Chris Henry ..… 14 JAL907 – 8 Years Later by Scott Shallies .............…..................... 16 Norwegian air traffic controllers praised for safety culture .......... 17 SKYbrary by Alexander Krastev ...…..........................................… 18 Are we too good? by Bert Ruitenberg ......................................... 20 Stop Bars and IFATC A by Raimund Weidemann ......................… 22 Interview with Prof. James Reason by Philippe Domogala .......… 26 Americas News Argentinean Safety Seminar by Alex Figuereo .......................... 21 MERCOSUR Single Sky and OACTAM by Alex Figuereo ......… 21 The Hudson River (New York) Collision by by Doug Church ..... 30 Books Review The Human Contribution (James Reason) …............................… 23 Aspects of Oral English Communication in Aviation (Franz Rubenbauer) ................….................................................. 23 Runway Safety Runway Safety Deficiencies by Capt Heriberto Salazar .......... 24 European News F unctional Airspace Blocks in Europe by Patrik Peters ....... 28 Asia Pacific News Target Level of Safety, Keeping On Target by John Wagstaff ……….……........................................ 29 SES/SESAR Fairy Tales and Legends by Marc Baumgartner ...............… 32 Africa News Safety Management Systems by Mick Atiemo ................ 34 Charlie‘s Corner ……….……....……………..........….........…........… 35
Residence: 24 Rue Hector Berlioz F 17100 LES GONDS, France Deputy EDITOR and Web sitE Philip Marien (EGATS) CORPORATE AFFAIRS Kevin Salter (Germany/UK) REGIONAL EDITORS Africa-Middle East: Mick Atiemo (Ghana) Americas: Doug Church (USA) Phil Parker (Hong Kong) Patrik Peters (Europe) COPY EDITORS Paul Robinson, Helena Sjöström, Stephen Broadbent, Brent Cash and Alexis Brathwaite PRINTING-LAYOUT LITHO ART GmbH & Co. Druckvorlagen KG Friesenheimer Straße 6a D 68169 MANNHEIM, Germany Tel: +49 (0)621 3 22 59 10 email: info@lithoart-ma.de
DISCLAIMER: The views expressed in this magazine are those of the International Federation of Air Traffic Controllers’ Associations (IFATCA) only when so indicated. Other views will be those of individual members or contributors concerned and will not necessarily be those of IFATCA, except where indicated. Whilst every effort is made to ensure that the information contained in this publication is correct, IFATCA makes no warranty, express or implied, as to the nature or accuracy of the information. No part of this publication may be reproduced, stored or used in any form or by any means, without the specific prior written permission of IFATCA.
VISIT THE IFATCA WEB SITES:
www.ifatca.org and www.the-controller.net
Foreword
Foreword from the Executive Board SAFETY: Air Traffic Controllers Involvement Absolutely Necessary Alex Figuereo, ^ by EVP Americas
Safety Group-Pan-American (RASG-PA) with little involvement from air traffic controllers. Why is this? In defining safety, ICAO Document 9859 says: “Safety is the state in which the risk of harm to persons or property damage is reduced to, and maintained at or below the acceptable levels through a continuing process of hazard identification and risk management”. Air traffic controllers and IFATCA have been identifying risks and hazards within the global ATM community, advising the aviation world on what is needed to improve safety in the Air Traffic Services. That is why we should be included more actively in projects such as GASR and RASG-PA. Air traffic controllers have always been at the forefront of promoting safety.
4 Alex Figuereo Photo: DP
Air traffic controllers have always been at the forefront of promoting safety. ICAO Assembly 32 (Resolution A32-11) established the ICAO Universal Safety Oversight Program (USOAP), which involves regular, compulsory, systemic and harmonized safety oversight in the Contracting States. The 1997 World Conference of Directors approved the implementation of this program when necessary as a part of a “Global Strategy for the Safety Oversight”; this was accepted as an important part of the future program. Assembly 35 approved the continuity and expansion of USOAP during 2005 to include all ICAO Annexes (Resolution A35-6). This Assembly resolution further directed the Secretary General to ensure a comprehensive systems approach that maintain as core elements the safety provisions con-
tained in Annex 1 _Personnel Licensing, Annex 6 _ Operation of Aircraft, Annex 8 _ Airworthiness of Aircraft, Annex 11 _Air Traffic Services, Annex 13 _ Aircraft Accident and Incident Investigation and Annex 14 _ Aerodromes to make all aspect of the auditing process visible to the Contracting States. During the last 4 years the ATM community have adopted several projects to improve safety, such as the Global Aviation Safety Roadmap (GASR) which has been produced and developed by the Industry Safety Strategic Group (ISSG) that includes well known stakeholders such as CANSO, IATA, IFALPA and others, but does not include air traffic controllers. Regionally, we have in Americas, the Regional Aviation
I had the opportunity to review the preliminary results of the USOAP of some Latin-American and Caribbean countries, specifically in the Air Navigation and Air Traffic Control Organization and most of the deficiencies, hazards and risks determined as the result of the Safety Oversight have been the same our Member Associations have claimed for years due to the lack of involvement of controllers in the decision making process locally and regionally in the development of a Safety Culture. However, there are countries such as United States, Dominican Republic and Cuba that are exceptions. These countries have included controllers and ATC experts on the improvement of their whole national Safety System and the results of their oversight program (in Air Navigation, specifically) have been amazing. All states should follow the lead of these countries and make sure that their air traffic controllers are included in all safety projects. We need to accept that as members of a community, we are all in this together. ^
evpama@ifatca.org
THE
4
CONTROLLER
Editorial
Editorial Is Air Traffic Control Safe? Philippe Domogala, ^ by Editor ^A very “safe” controller.
If you ask anybody on the street they will tell you that air traffic control is a very safety – related occupation, if not one of the most. This is the general public perception of our profession. But what is safety for us? Ask any controller around to define “Safety”, and you will see that almost everyone answers differently. There is in fact no agreed definition of safety. As Prof. James Reasons said: “Safety is a term defined more by its absence than its presence.“ We have devoted this whole issue to safety – to ATC related safety to be more precise. Because while doing research for this theme I made a strange discovery: I wanted to include articles and interviews on different perceptions of Safety from other industries, like oil exploration, maritime, nuclear power plants, etc. The reality I discovered is that no one really wants to discuss their own Safety with an “outsider”. I find this a real pity because I am sure there certainly are things to learn from them. I was told for instance that the oil company SHELL has a zero accident policy. This is quite different from our 10 to the minus 7, 8 or 9 we apply in ATM. Also while researching, I was surprised to read in a recent EASA document (*) that with TCAS, the probability of a mid-air collision is 2.7x10-8 per flight hour due to the identified deficiencies within the current version 7.0 software, which translates to one accident every 3 years. How can we claim to be safety conscious if we accept such parameters? (The European Safety Agency also concludes this is unacceptable and is proposing, like ICAO, to mandate a new version 7.1 to reduce those numbers.) We also see that the accidents are back. Since 2007 the accident numbers are on the rise again, and we had a concentration in the first 6 months of 2009. In a recent speech (**), Capt. Rory Kay, Safety Chairman of US ALPA, referring to an arti-
Photo Credit: DD
Are we, in ATC, much safer than we were, say 20 years ago? cle by David Learmount in the “Flight Global Magazine” said: “Unless there is a dramatic improvement between now and the end of 2010, then this decade will become the first since the second world war when global airline safety rates did not improve.“ He asked if we have reached the point of diminishing return, where safety is now as good as it going to get? He concluded by saying that pilots were victims of a new disease called “automation addiction“, that pilots were becoming over-reliant on automated systems. Could the same be true for air traffic control? Are we, in ATC, much safer than we were, say 20 years ago? Or are we, just like the pilots, pressed to move more and more aircraft, closer to one another (RNP, RVSM, etc) and relying on automation and automated tools like TCAS and STCA for the safety part?
In this issue you will read many comments from various sources on how to maintain and improve safety. All are worth spending the time reading. There is also an exclusive interview of Prof James Reason on pages 26 and 27. We can see we still have a lot to learn before we can say we are one of the most safety – related professions. Enjoy this issue and be safe out there…^
ed@ifatca.org
Philippe
(*) EASA NPA 2009-03 on TCAS available on www.easa.eu.int (**) August 6, 2009 – Capt. Rory Kay closing speech at the 55th ALPA Air Safety Forum. Video of the speech avail on: www.alpa.tv/ALPAChannelPlayer.
THE
CONTROLLER
5
OBITUARY
Henry P. Nkondokaya IFATCA Executive Vice-President Africa Middle East
˚15 July 1955
✝ 6 September 2009
Henry P. Nkondokaya, Executive Vice President Africa Middle East died suddenly on 6 September 2009. It is difficult to put into words the shock one feels at the sudden death of someone with whom you are working closely and with whom you are making plans for the immediate and long-term future. It is all the more crushing when you admire that person so much for who he is and what he represents. Henry, a gentle man, a disciplined, thoughtful soul, had so much more to give, to his family, his association and country and to IFATCA. At his reelection at this year’s annual conference Henry expressed how proud he was that the Africa Middle East Region was now the largest in IFATCA. Henry understood what IFATCA meant for the future of air traffic controllers, especially those within the region he represented so admirably. He therefore committed himself to not only representing the needs of his region within IFATCA and the global aviation community, but to also build the capacity of his region to be able to continually speak for itself. He knew that numbers alone were not enough, so he worked hard at finding like-minded committed people to ensure the realization of the promise of IFATCA that he so clearly saw and fully embraced by making the tremendous sacrifice to serve at the level of the executive board.
was owed something simply because he was a controller. This is a sad time for IFATCA; this is a difficult time for our family. We have lost one of our own when he was most active, when we least expected, when we are least prepared for it. As colleagues of Henry on the executive board, it will be very difficult to immediately carry on without him. The executive board extends to Henry’s family and relatives our heartfelt condolences. Through the many years of working with Henry, we have come to respect and care deeply for him. We therefore can experience only but a hint of your loss. We ask that you take some comfort in the knowledge that Henry is one of those rare persons whose influence extends beyond the area in which he was born and
lived. His influence extends throughout Africa and the Middle East and into the global aviation community. His influence will extend beyond his life and for a long time to come. We thank you for sharing Henry’s goodness with us. To the members of the Tanzania Air Traffic Controllers’ Association and the Tanzanian Civil Aviation Authority we also express our condolences and thank you for the support that you provided to Henry so that he could do this job that he evidently loved doing to the best of his ability. We share with you the loss of a colleague, a friend and an exemplar. Henry P. Nkondokaya we will miss you; we will be poorer for your passing; we are better because you have lived. May your gentle soul rest in peace. ^
Henry was clearly a humble man, but once you had a conversation with him you immediately recognized his good nature and his respect for his fellow man. He was a thinking man, who considered all options and all views, ready to support and enact what he believed to be the best course of action. Above all, he strived to act with integrity; while he most definitely sought the best for his members and for air traffic controllers generally, he was always fair and did not expect that controllers within his region or any controller for that matter
Photo: DP
4 Safety
Safe or Unsafe – the Multimillion Dollar Question? Marc Baumgartner, ^ by President and CEO IFATCA Setting the Theme All aviation professionals try to be the winner in safety. However, in most cases, we only find out our safety score after the event! Aviation has the highest safety record per km travelled. But, how is it that safety is still a ‘fuzzy’ concept? Why is it that nobody can tell what is safe and predict a safe outcome with the same certainty that we know the sun will rise or set? Many readers will not agree with me, especially all the aviation professionals, and in particular air traffic controllers. Safety is not really predictable and we struggle to define safety precisely. There are indeed commonly developed and accepted definitions, e.g. ICAO talks about ‘the condition in which the risk of harm or damage is limited to an acceptable level’. Safety is of course a very serious issue, especially when we are talking about air traffic control. The longer we try to define it, create it and defend it as the basis for our profession, the more it is like buying a lottery ticket. At least, for me, every time I buy a lottery ticket I see myself as a future multimillionaire. It is only following the lottery draw that I know whether buying a ticket was worthwhile. Establishing what is safe or the construction of safety follows a similar pattern. All the professionals will try to be a 100% winner, something only the future can tell! The safety outcome is not predictable, and only is measurable once the event has passed. Weick has defined safety is a ‘dynamic non-event’. However, from an intellectual point of view, how can a ‘non-event’ be ‘dynamic’? According to Weick, it is dynamic because processes remain under control due to the continuous adjustments, adaptations and compensations made by the human elements of the system. It is a ‘non-event’ because “normal” outcomes claim little or no attention. The paradox is rooted in the fact that events claim attention, while non-events, by definition, do not.
Maria o: © a/ Phot ide Silv m o la Ade stime.c m drea
So, if safety is a ‘non event’, why do we see it as the ‘holy grail’, our multimillion lottery ticket? Or does achieving safety give us the same thrill as when we buy a lottery ticket? Are we perhaps imagining what we would do with the gain? Moving away from the art of air traffic control to the science of air traffic management with its increased automation will we be buying lottery tickets to keep the dynamic nonevent’s sufficiently in line with mathematical models? Will this justify investments in future technology to keep us all ‘safe’? For quite some time, this has been the question for me. Can we actually develop models, approaches, information and/or communication campaigns preparing our profession and our industry for the next step of automation? Do we understand the approach to increase the intricacies of a set of systems which will reach levels of complexity which are currently unknown in our working environment? Recent publications by researchers like Dekker, Hollnagel, Reason and others are assisting in understanding what is at stake and providing us with a scientific approach to what we are doing and what will be done. We are currently in the transition period towards a safety management process. It is very helpful as it explains our activity and its related risk in a focused way. But the question still remains on how to manage your winning lottery ticket ahead of the potential gain? In the quest to improve the dynamic nonevents, we are not alone. Bert Ruitenberg, our Human Factors specialist, wrote an ar-
ticle entitled “safety was 16 today”. Safety measurement is a science and it is reactive and serves (in the new business world) to determine the performance bonuses of our ANSP CEO’s. ICAO recommends a safety management approach. CANSO asks for a changed business model where liberalised and economical performance will assist improvements to safety. Eurocontrol proposes a new methodology to bring us a step further in predicting and shaping the safety outcome with an Aerospace Performance Factor. So let us, as IFATCA, remain on the forefront to be among the potential winners in safety, by continuing to educate, influence and participate in shaping the safety discussion. Oh, and by the way, did I forget to mention: 100% of lottery winners did buy a ticket! ^
pcx@ifatca.org
Does achieving safety give us the same thrill as when we buy a lottery ticket?
THE
CONTROLLER
7
4 Safety
The Blame Culture in Italy Two Accidents and Subsequent Convictions Illustrate Severe Shortcomings
^ by Bruno Barra, President ANACNA (Italy Controllers Association) Linate Accident On 8 October 2001 an SAS MD87 collided on take off on the runway in Milan Linate airport with a German Cessna Citation 500 taxiing. All occupants of both aircraft and 4 on the ground were killed (118 persons). The Citation pilot took a wrong taxiway, crossed the active runway stop signs and penetrated the runway. Visibility in the fog was 50 to 100m and the airport was operating as CAT 3. The Citation pilot was only CAT 1 qualified. No ground radar was available. (source ansv, report available on: www.ansv.it)
The Italian Supreme Court confirmed an earlier ruling of the Milanese Appeals Court: the ground controller on duty that day was sentenced to three years imprisonment. Seven others from various organizational levels in ENAV (Air Navigation Service Provider) and SEA (Airport Handling Agent), were also convicted. No one from ENAC (Italian Civil Aviation Organization) was found guilty, contrary to the outcome of earlier trials.
The Supreme Court ruled that while the controller operated with adequate professionalism, he lacked the ability to “imagine” that the CESSNA was on the wrong taxiway, without radar and no visibility (fog). This unjust outcome appears to be largely the result of the outdated Italian justice system, not having implemented European and ICAO just culture regulations. The Courts’ full motivation takes up around 200 pages. Focussing on the part of the controller, the judges stated: “it is possible that at the base of the accident, more concurring clauses can be identified to identify the human errors combined by the controller and the Cessna pilots, the lack of ground radar and the misleading signals…on the R6 taxiway”. Similar to what the judges underlined in the appeal with regards to “the existing procedures at Linate for aircraft movement in the airport area and in take off position were adequate and functional” and that “the accident did not occur because of the application of inadequate procedures, but
Photo: ENAV
because the procedures were not followed carefully and breached”. Contrary to the earlier trials, where – based in ANACNA’s opinon on an inadequate and deceiving technical consultancy – the ground controller’s personality and alleged incompetence were focussed on, this verdict did not question his experience, skill and professionalism. The appeal did however confirm the controllers’ sentence owing to one identified fault: the pilot reported a sign which did not appear on any map and was therefore unknown to them and the controller. The Supreme Court of Cassation stated that “…no pilot, in normal conditions and knowing where he/she was, would have communicated such a report to the Tower…” In the given circumstances (a position report that didn’t make sense, not being able to physically see the aircraft and without ground radar), the controller should have realised the dangerous situation: “he only had one possibility and one duty: to immediately stop the airplane … until the position had not been identified”. We have to ask ourselves whether it is possible that someone, who the Court itself believes to have elevated professionalism, behaved in such a grave, negligent and imprudent manner. Furthermore, not considering the continuous attempts to steer public opinion towards blaming a single person, what proved to the Supreme Court that this call was so clear to the controller that
THE
8
CONTROLLER
4 Safety it had to at least presented a warning to him? Quite honestly: nothing! The controllers’ defence proved the unreliability of the evidence presented throughout, even using phonetic analysis. But to no effect. It is amazing that the Supreme Court did not even comment on this information in their final judgement. Some superficial arguments would not have manifested themselves, according to us, if the Court of Milan, during the preliminary investigations and the first degree trials had relied on their objective, independent experts (as is customary). Instead, they relied on the narrative of a single consultant, chosen by the public prosecutor. Some important considerations: • This single technical consultant was a professional pilot and a member of ANSV (Italian Safety Agency). Both the ANSV initial report and the technical one for the public prosecutor were very similar, as they were written from the same point of view. Based on this, ANACNA forwarded a complaint to the European authorities. • Complex cases like these require specialist technical expertise. With such a central role, it is essential for this expertise to be completely objective. • With this in mind, serious doubts are justified: specialized competencies are required for each of the particular sectors involved. Therefore, there is a need for experts, preferably belonging to professional orders or associations, who have documented technical experience in their field. • The magistrate’s auxiliary consultants are “trial subjects” and they certainly cannot be confused with professional experts such as pilots and controllers. • The SAFREP (safety reporting) task force has reminded member states - in agreement with the 2003/42/EC Regulations - to employ only resources with a specific investigational and analytical competence for a surveillance and technical investigation, in order to be able to properly evaluate the dynamics of an event. Recently, the European Commission made the responses given to public consultation promoted in the months of January - March 2007 public. These were proposals to modify the regulations 94/56/EC and 2003/42/EC and even in this context, the indication that investigators of air traffic incidents must be trained and have the correct ability to perform this difficult profession sharing similarities in all European Countries. • A list of specialists that have a sole European certification would, perhaps, avoid what one of the nation’s most qualified
experts on flight security defined as “the dangerous category of the ‘self-referenced experts’, who, without having ever followed a specialization course like those of accident investigators for each of the various fields of civil aviation (operations, maintenance, air traffic control, training, meteorology etc.).”… [These] ‘technical consultants’ of the many 4 The tail of the OE-FAN. ‘ambitious’ public prosecutors present against useless criminalizain Italian justice [system], invent thesis and tion and automatically opentheories of accusation for “front line oping of judicial procedures erators” that, due to bad luck, committed against pilots, air traffic (according to their point of view) “errors” controllers and other staff where they do not exist, or at least, they responsible for flight operaare not grave faults, nor international viotions. Many others, such as lations, but simply (and not always) simple the President of NTSB, the human errors to evaluate according to the Flight Safety Foundation, “Human Factor” techniques, and not in a IFATCA and IFALPA have tingling hand-cuff manner. (Captain Renzo made similar statements. Dentesano in ANACNA Convention on • The motivation for the fiApril 6th 2006) nal sentence appears to be Issues in the trial that followed this accident, equally inadequate, from have according to ANACNA, certainly not the just culture principle supbeen comforting. plied by Eurocontrol: “a just • In the first degree judgement, the decision culture is defined as one in was, as mentioned above, mainly based on which front-line operators or the sometimes inconsistent and contradicothers are not punished for tory evaluations expressed on what hapactions, omissions or decipened from the same technical consultant sions taken by them that are who assisted the Public Prosecutor, and commensurate with their who then assisted the Substitute General experience or training, but Prosecutor in the appeal. The court, then, where gross negligence, wildid not take into account the observations ful violation and destructive of consultancy of other parts in the trial. acts are not tolerated”. The Court itself did not question For ANACNA, we can see a verdict that did the controller’s experience not take into account accepted just culture and professionalism. Cerprinciples: tainly, the fact that he did • From the preliminary investigation, the not perceive something that trial violated what was contained in the is outside of norms and opEuropean 94/56/EC and 2003/42/EC regerational procedures as an ulations. ANACNA reported the lack of alarm signal cannot, surely, segregation between the technical/adminbe considered gross negliistrative investigation and judicial one (see gence or wilful violation; also recommendations AIG ICAO), as well • Italy’s breach of contract and as deficiencies in the role and competence its insufficient “legal system”, of the investigators; along with its inadequate cul• Considering that the Court of Appeal beture, are also highlighted in lieved the controller to be adequately prothe 2006 ICAO audit and in fessional, the motivation for sentencing him Eurocontrol’s 2006 and 2008 appears to be in complete contrast with Performance Review Reports ICAO recommendations, which advises (PPR)
THE
CONTROLLER
9
4 Safety The Cagliari Accident On 24.02.2004, an Austrian Cessna Citation 500 (OEFAN) collided with the top of Monte Sette Fratelli at 3300 ft, 18 NM before Cagliari airport while performing a visual approach at night. All 6 occupants died. The pilot, initially cleared for an instrument approach, reported the field in sight and requested a visual approach. The controller replied “Confirm able to maintain your own separation from obstacles, Sir, performing visual APP runway 32?” The pilot replied “Affirm”. (ANSV final report available on www. ansv.it)
On March the 17th, 2008, Cagliari court sentenced the two controllers on duty to 3 years imprisonment (reduced to 2 years due to the choice of reduced procedure). They also had to pay 75,000 Euros in civil damages and trial expenses. This sentencing created awe and drew reactions from everyone in aviation circles in Italy. Main argument for the verdict was the authorization, even if requested by the pilot, for a visual approach at night “without supplying the pilot with all the necessary information on the orography* of the land.”
Photo: ENAV
The controllers had followed the technical rules and regulations they had. This was also testified by the courts’ experts. The “topographical information on the land’s orography“, which the controllers omitted to communicate to the pilot, are part of additional conditions relevant night visual approaches. They were issued by the former D.G.A.C. of the Ministry of Transport, to all Italian airports and by extension to Italian airlines companies. They specify the applicable conditions in which the pilots can safely perform a visual approach at night in Italy. The evidence highlighted that those additional conditions were not present in the ATC technical regulations in Cagliari, nor were they ever brought to the attention of the controllers. The convicted controllers scrupulously applied what was in their manual regarding visual approaches at night, as one can see in the transcript. ANACNA thinks that the Italian Safety Agency (ANSV) did not fulfil its institutional duty of verifying the real causes at the origin of this accident, avoiding doubts regarding eventual technical causes. Even considering that the investigation report and its safety recommendations should not, in any case, apportion blame, ANACNA believes that the lack of a conclusive report by ANSV on the true causes of this accident, along with clearly specifying the real responsibilities of the controllers, would have helped the magistrates to better understand the ATC technical norms. Confusing the technical, administrative with the judicial one has probably influenced the ANSV investigation, seeing the fact that the sentence given, and its motivations were essentially based on a different interpretation of technical norms that regulate the ATS services On this, it is necessary to recall that ANSV duties and finalities are in complete contrast with the EU Regulation 94/56/CE, which specifies: 1) as it is the state’s organism who is in charge of the investigation, its investigators must have absolute independence and autonomy in order to avoid any conflict of interest, pressures or interventions from any other party whose interests may enter in conflict with the mission assigned to them;
2) the sole objective of the technical investigation is to draw lessons that allow to prevent future accidents and incidents. The analysis of the event, the conclusions and the safety recommendations should not be aimed at establishing errors or at evaluating responsibilities. So for an Investigation Agency such as ANSV to collaborate with a public prosecutor could well point technical reports towards establishing errors and identifying responsibilities. This verdict did not take into any consideration ICAO and EU community regulations regarding just culture. From the beginning, this trial appeared to be an exaggerated attempt to criminalize professionals who operated with diligence. The behaviour of the controllers that day was in accordance to the technical rules and regulations in force at the time in their unit. • The exaggerated severity of the sentence has confirmed the lack of Italy’s institutional will to conform to ICAO and European directives which aim at encouraging the development of a just culture and the creation of a punishment risk free environment. It does not focus on the faults of components of the system (those responsible for front line operations), but it aims at guaranteeing an exhausting and regular interexchange of matters regarding safety. • None of the above mentioned institutions (ENAC, ANSV, ENAV, AMI) responsible for guaranteeing fight safety, have performed the necessary clarifying technical role in this matter, supplying explanations regarding the procedure to follow when a pilot’s request of a night visual approach. • More than one year after publication of EU directive 2003/42/CE, still no intention was apparent to introduce a reporting system (mandatory and voluntary). *Orography (from the Greek όρος, hill, γραφία, to write) is the study of the formation and relief of mountains and can more broadly include hills, and any part of a region's elevated terrain. ^
brunobarra@ymail.com
THE
10
CONTROLLER
4 Safety
Safety in Russia Some Concerns, but Improvements on the Way Eduard Kolodnyy, ATC Instructor of ^ by Training Center Rostov-on-Don, Russia Safety in aviation – it’s something the whole world strives for, but, unfortunately, we never get 100% result: the only way to achieve it is to stop all flights. Russian media are very quick to accuse air traffic controllers in an accident or incident. They conveniently forget that safety was not assured before flight: terrorists on board, aircraft maintenance issues and/or pilot competencies and so on. In any case, I would like to be responsible only for providing separation and information to the pilots. So, what kinds of difficulties do we face providing safe air traffic services in Russia? To start with, we still operate in meters. Only in Kaliningrad and Rostov-on-Don FIR to cross over the Black Sea, we use feet and RVSM. Pilots seem ill-prepared for flying in regions where we use the metric system as it is still a source of many level busts. A second problem is that most airports in Russia basically have only one runway. This can make it quite challenging to find a suitable alternate airfield for a modern large airliner in a non-standard, or even emergency, situation. Our separation minima haven’t been revised for decades. For example, the longitudinal separation minima between the two aircraft at the same flight level must be 30 kilometers (16 miles), instead of 5 or 10 miles like all over the world. If it’s less, a level change is the only solution.
The problem of getting English language proficiency still exists, but it’s not as critical as before. A bigger problem, one that we don’t immediately know how to solve, is the controller shortage: it’s probably time to improve pay and conditions in order to retain existing controllers and attract new colleagues. Implementation of new procedures such as, RVSM, RNAV, ADS-B, OLDI, airspace structure and classification, radar vectoring, etc is dragging on and people are getting tired of waiting for them. At the same time, new and updated documentation has to make it trough the many levels of bureaucracy, which quite often, doesn’t work. But, no matter what, air traffic controllers in Russia continue to provide a level of safety not worse than in other countries all over the world. And I’d like to emphasize, that these problems are of a temporary nature and not the fault of our air traffic controllers! We are going to get over all difficulties and we hope to do it as soon as possible. I can say, that Russia recently: • started to modernize and consolidate ATC centers; • built new ATC center in Moscow; • is improving the structure of routes and introducing new straight routes; • is establishing a new navigation and air traffic control equipment; • finally, has finished civil-military integration and cooperation. It looks as if we’re starting to speak the same language. All of this has a positive effect on safety. It’s very difficult to write about safety in Russia when to get to Vladivostok from Moscow you need 9 hours flight, but I’d like to say a few words about my Area Control Center
4 Controllers in Russia.
Photo: Ed. K.
at Rostov-on-Don. My center is situated in the south of Russia and occupies a very large territory extending to 1100 kilometers East to West and 1000 kilometers South to North. There are 14 sectors in the center and we use a system installed by the Spanish company “Indra”. Now we use protocol OLDI with Ukraine and hope to do it with Turkey soon. Over the Black Sea RVSM is now in use. There are many air traffic controllers who have studied English language in Great Britain and USA. I hope that by the 2014 Winter Olympic Games in Sochi, we will use all the advanced procedures in our center and I am sure that the controllers in Russia are able to provide the necessary level of safety now and in the future.^
kolodnyi@mail.ru
4 Aircraft at Arkhangelsk airport. Photo: sukhoi
THE
CONTROLLER
11
4 Safety
Safety Management Systems ICAO Sees Errors as Part of a Bigger Picture
^ by Drazen Gardilči, ICAO caught it. But I didn’t. I was busy, talking to many other airplanes, coordinating, whatever. I didn’t.
Photo: DP
It is often said that there are two types of controllers: those who’ve had an operational error, and those who will. Unfortunately, I’m one of the former. When I was still an en-route radar controller I let an airplane go into the next FIR at the coordinated altitude but at the wrong fix. Fortunately, there were no other aircraft involved.
Routine Our routine was pretty well established: one airway was inbound the other outbound. It all worked well for me until the day when a general aviation jet tracked to our normally inbound fix after take-off. The departure controller had given the pilot a clearance to the inbound fix. No doubt about it, as the last controller talking to that aircraft, I should have
The process of finding me guilty was the easy way out.
After the incident, I was pulled off the boards and given administrative duties. The incident was investigated and dissected; the usual suspects were rounded up. In the end, it was determined that I was the only guilty one. Everyone else was clean. They gave me intensive remedial training, told me to pay closer attention to the route on the strip, to ensure proper coordination, and not to do it again. I was then given a new check ride which I passed, and I was back to work in a week. End of story right?
Easy Way Out Well, in retrospect I think, “not quite.” Looking at the incident now with my Safety Management Systems (SMS) mind in place, I think the process of finding me guilty was the easy way out. Further, and more critical, the situation or environment that allowed my operational error to occur was left in place. This “latent” situation continued to exist to nab another unsuspecting controller in the future. Like me, other controllers had the system rigged against them. Rigged to fail and point the accusing finger to the last link in the event chain, in this case the controller. It is a tribute to controllers’ skills that more errors don’t occur in places like that. As they say, “that’s the way it was.” Back in the (not so) old days, accident and incident investigations were geared to find the “who” before anything else. But those investigations were seldom interested in finding out the WHY and the HOW. Prime aim was to hand out the appropriate sanctions and move on. It’s only when the concept known as the “organizational accident” evolved, that things began to change. This idea of the organizational accident forms a cornerstone of the SMS approach to safety.
Reason The “organizational accident,” is a postulate developed by a professor named James Rea-
son back in the 1980’s. He proposed that incidents and accidents do not occur in a vacuum. In other words, the ultimate “culprit,” say in a controller operational error is not just the controller, but usually the whole organization that allowed that controller to get into a position where an incident occurred in the first place. Now don’t get me wrong. I am not saying that controllers are completely blameless in operational errors and that their organizations are responsible. All the “organizational accident” concept proposes is that controllers (or pilots for that matter) don’t make errors in a vacuum. They are part of a system, and as part of that system they cannot necessarily be the only guilty party when something goes wrong. Consequently, proper incident investigations need to look at organizational or systemic issues as a matter of principle.
Environment & Defence What is that system one may ask. According to Reason, it begins with the highest management levels of the organization. The executives in the organization make management decisions and put organizational processes in place to allow the operation to be carried out. These management decisions and processes create a set of working conditions. Within this environment, workers in the normal discharge of their duties make errors and engage in violations. (Yes, violations. You know those shortcuts you take even though you know they are not right?) In order to minimize the impact of these errors and violations, defences are put in place by management. These defenses consist typically of measures using technology, or training or regulations. In spite of these measures, accidents or incidents pass through these filters (defences) and result in incidents like mine or worse, in accidents. This means that the controller or pilot’s discharge of his/her duties is only the last link in an organizational process. In other words, the controller or pilot error at the end of the chain is most often the result of an organizational process that allowed the last line of defence to be broached. Any error or violation needs
THE
12
CONTROLLER
4 Safety
Photo: Gaute Bruvik/Avinor
to be looked at in the context of the system in which the pilot or controller is operating. This is the concept of the “organizational accident” and forms the anchoring concept of the SMS now being required by ICAO.
Systematic Approach As it can be deduced from the foregoing, maintaining a safety level and ensuring that the same incident or accident does not occur again is not satisfied simply by the investigation of accidents and incidents after they occur. The emerging approach to safety management proposes to look at the organization behind the operation. Normal dayto-day operations need to be monitored in order to identify trends that could lead to incidents or accidents. This is the core of the Safety Management Systems concept. The SMS concept constitutes a systematic approach to the management of safety by service organizations. At its core, SMS maintains an acceptable level of safety performance based on a continuous process of hazard identification and risk analysis. When necessary, mitigation measures are defined and implemented. A SMS is a continuous process that never ends.
Systemic Issues Going back to my operational error, there were a number of systemic issues behind the handling of this aircraft that resulted in my
operational error: why did clearance delivery give the aircraft the route, why did the aircraft request a direct to the inbound fix and why was it given a clearance to the inbound fix? Why was this shouted across the control room instead of coordinated properly? Why did the assistant controller coordinate the aircraft at a fix that was not the outgoing fix? And why did I not see that the aircraft was going out the wrong fix? All these were “working conditions” engendered by our training and tolerated by the supervisors in that control room. I am not trying to provide easy excuses for controller errors, my own included; I am simply trying to illustrate how an SMS approach may have worked on an incident that I experienced. Even though I made the error, it could be argued that the management system at my facility had a part to play by allowing to exist in that control room an environment (working conditions) that was not conducive to the optimal provision of air navigation services.
Next Generation? All this aside, I firmly believe that the ICAO requirement to apply the SMS concept to the provision of air navigation services is a huge step in the right direction. If properly implemented, controllers can only benefit. On the other hand, we need to be realistic.
This concept will be very tough to implement. The notion of the organizational accident, the idea that management share the responsibility for operational errors when applicable, the concept of a just culture, the idea of the protection of sources of information, etc, are proposals that may require a generational change to become realities. But we must start somewhere. A journey of a thousand miles begins but with one little step. Mr. Drazen Gardilčić, is an air traffic controller with over 22 years of experience in the FAA and nearly 5 years with ICAO. He also hold an FAA license as a multi-engine, commercially rated IFR pilot and FAA Airframe and Power-plant maintenance technician's licenses. ^
DGardilcic@icao.int
… may require a generational change to become realities.
THE
CONTROLLER
13
4 Safety
NOSS -
Normal Operation Safety Survey An Implementation Update Dr. Chris Henry, Scientific Advisor of the University of Texas to the ICAO ^ by NOSS Study Group. Edited by Bert Ruitenberg, IFATCA HF Specialist The Normal Operation Safety Survey (NOSS) is a tool for the collection of safety data during normal ATC operations. In the past, the ATC industry has largely relied on post-hoc investigation reports to further its understanding of safety. While rich in information, these reports only capture rare events, and are reactive by nature. NOSS aims to inform an organization about safety matters by using trained ATC staff from within the organisation to take a structured look at normal ATC operations. This process allows identifying safety deficiencies in a proactive manner. NOSS can also help the exporting of best practices to other parts of the organization. NOSS is premised on the Threat and Error Management (TEM) Framework, which frames human performance from an operational perspective by simultaneously focusing on the environment, as well as how controllers respond to that environment. TEM posits that threats and errors are part of everyday operations and must be managed by controllers in order to maintain safety margins. NOSS is envisioned to be a periodic safety program. Observations are typically limited to a 2-3 month period, after which the data is verified during the data cleaning roundtables and a
report is produced. The data within this report can be used as a standalone or in conjunction with other sources of information to implement safety change. The focus of NOSS is the larger system as opposed to the individual controller, which means that NOSS provides information that can feed multiple areas including training, procedures, airspace design, and equipment design. The effectiveness of these changes can be monitored through other SMS sources and more fully assessed during a follow up NOSS, which is recommended approximately three years subsequent to the initial NOSS.
NOSS Deployments & Findings To date, NOSS has been deployed in Australia, Canada, Finland (limited trial), New Zealand and the United States, with future deployments being discussed in numerous countries. The following section highlights some noted areas of contribution as reported by the participating ANSPs: NOSS provides an objective data source that serves as a check to other sources of information – In many cases, NOSS findings have substantiated and complimented already existing sources of information. Specifically, NOSS has validated incident trends while at the same time providing another level of detail by highlighting some of the behaviors and issues leading up to the incidents. Additionally, numerous ANSPs cited the benefit of NOSS as an objective source of information. Many ATC staff are at least implicitly, if not explic-
4 A380
taking off.
Photo: eads
itly, aware of a wide range of issues regarding operations within their airspace. When it comes to generating action and change, however, the opinions of a group of people do not always provide the same catalyst as objective data. ANSPs have reported that having issues documented in an objective manner has greatly enhanced their abilities to make improvements towards those issues. NOSS can identify threats within the operating environment - Many safety data streams tend to be “error-centric,” while neglecting the threats that can potentially lead to errors and safety breakdowns. Any effective means of reducing errors requires attempts to modify the environmental conditions that can contribute to errors. While safety managers often respond to errors in a reactive manner, it may be possible to manage threats that controllers must deal with more proactively. Put another way, safety managers must deal with errors and events after they have already transpired. Threats, on the other hand, reflect the working conditions controllers deal with daily, and may be subject to interventions or mitigation strategies in a more proactive manner, thus making life a little easier for controllers.
Strengths or Best Practices Because NOSS gathers data during routine operations, it is possible to gather information on positive aspects of system and controller performance. This information is useful in two ways. First, it informs an organization of what they are doing well thus allowing them to direct their limited safety resources elsewhere. Second, the best practices which are identified can be spread – to other controllers, facilities, and ANSPs. A nice example of spreading best practices focuses on
THE
14
CONTROLLER
4 Safety 4 TWR Air traffic controller at work.
vulnerabilities that have consistently been identified surrounding position relief briefings. During a NOSS, one workgroup was found to have particularly effective briefings due to the procedures and practices employed by controllers in that workgroup. These procedures and practices have been adopted throughout that facility, and have since been spread to other facilities where position relief briefings have been identified as a vulnerability.
Feedback on the Quality and Usability of Procedures If for example 5% of observed controllers do not follow a particular procedure, there may be a problem with those particular controllers. If, however, 50% of controllers do not follow a particular procedure, the problem most likely resides with the procedure. The procedure may be poorly understood or timed, or may be a poor fit for the operating environment. Poor adherence rates can identify problematic procedures or procedural drift. The data and contextual information provided by NOSS has also led to procedural change in matters including provisions for a data assistant or the splitting of sectors, letters of agreement to reduce coordination, and protocols for the release of equipment for maintenance.
Equipment and Workspace Interactions NOSS has highlighted a number of issues pertaining to the equipment and workspace used by controllers. For example, at several ANSPs where frequent, spurious conflict alerts occurred, controllers responded to such alerts in a very casual manner thus reducing the effectiveness of the tool in the event of an actual conflict. NOSS has also identified problems more specific to the physical workspace in which controllers work. At one ANSP, controllers were having difficulty reading information from parts of the radar display due to glare. As a result, special lighting was installed on the affected operating positions in an effort to reduce the glare problems. The NOSS results at another ANSP indicated that noise within the operations room floor was one of
the more pervasive threats experienced by controllers which resulted in the installation of noise dampening panels.
Degree of Transference of Training to the Line Training and jeopardy check situations assess whether training concepts have been learned and ensures that controllers have the capability to perform their duties. These formal assessments, however, may not be reflective of normal operating practices when controllers often adopt practices that differ “from the book.”
Understanding of Controller Shortcuts and Workarounds As a result of experience, controllers develop shortcuts and workarounds to work more efficiently. These shortcuts frequently involve contraventions of procedures, and are seldom seen during checks/audits, where performance is typically “by the book.” Through a trusted process such as NOSS, it is possible to observe such shortcuts and workarounds. Some may be deemed as effective and can be communicated to others within the organization as a “better way of doing things.” Poor shortcuts and workarounds that have shortcomings in their safety assumptions can also be identified and addressed.
Facilitate Information exchange with Airspace Users Currently, more than 50 airlines from all over the world have conducted the Line Operation Safety Audit (LOSA), which is the flight operations equivalent of NOSS. The common use of a similar methodology and the TEM framework has enhanced the information shared between several ANSPs and major airspace users on the challenges they present to one another’s operations.
Intangibles Many Service Provisers who have conducted NOSS have reported benefits outside of the changes that occurred as a result of the report and data. These benefits have ranged from the experiential effects of individual observers who initiate discussions and grassroots change efforts within their working group based on
Photo: Gaute Bruvik/ Avinor
What makes NOSS unique: 1. Over-the-shoulder observations with clearly defined stop rules during normal shifts 2. Joint management / controller association support 3. Voluntary participation 4. De-identified, confidential, and non-disciplinary data collection 5. Systematic observation instrument based on the Threat and Error Management (TEM) framework 6. Trained and standardised observers 7. Trusted data collection sites 8. Data verification process 9. Data-derived targets for safety enhancement 10. Feedback of results to the controllers Only a data collection method for monitoring safety in normal ATC operations that meets all ten characteristics mentioned above can use the name NOSS. (Source: ICAO Doc. 9910).
what they observed to larger organisational benefits related to creating mechanisms to utilize safety information to enact change. Perhaps the most encouraging intangible benefit was highlighted by the president of a controllers association who stated that NOSS helped create the trust within the organization that was necessary to undertake other efforts such as a Just Culture Program. More information about the NOSS methodology is available in ICAO Doc. 9910 – Normal Operations Safety Survey (NOSS). This manual is a comprehensive “How to..” guide that addresses all aspects of the preparation, execution and follow-up of a Normal Operations Safety Survey. ^
henry@nosscollaborative.org
THE
CONTROLLER
15
4 Safety 4 Artist's conception of the near miss. Photo: Wikipedia/GNU
JAL907 – 8 Years Later The Aftermath of this Highly Publicized Safety Event Scott Shallies, ^ by IFATCA EVP Professional
Back in 2005, my predecessor as EVPP, Doug Churchill wrote an article for The Controller titled “The JAL Case… Four Years Later”. Well, a further four down the track, it is time to again review what is happening in this important case.
last year, whereby the High Court, which revised the original not guilty verdict of the Tokyo District Court, found the controllers guilty of negligence. Our Japanese colleagues have appealed this decision to the Japanese Supreme Court and we are still awaiting the outcome of this.
The Event
The Follow-up
Firstly, to recap the event itself: on the 31st of January 2001 there was a near mid-air collision between two Japan Airlines aircraft over Yaisu, Japan (west of Tokyo). Eighty-eight passengers and twelve cabin crewmembers were injured. Charges were laid against the two Air Traffic Controllers on duty on the grounds of professional negligence. There have been a number of legal proceedings since that time, in 2001, 2005 and more recently
Throughout this saga, IFATCA and IFAPLA have cooperated in a number of actions to raise the professional concerns that both organisations have about the legal proceedings. Earlier this year, I had the privilege to participate in a number of events in Tokyo in conjunction with the Japanese Association and an IFAPLA Board member. Presentations were made to a representative from the Supreme Court, the Police Agency, the Transport Safety Bureau and the Civil Aeronautics Board to express our concerns about the legal proceedings and the adverse impact they will have on aviation safety.
The sole purpose of an accident/incident investigation according to Annex 13 is the prevention of similar occurrences.
Unjust Culture? Our concerns are of course summed up by the term “Just Culture”, or unfortunately in this case, the lack of it. IFATCA has defined Just Culture as: A culture in which front line operators or others are not punished for actions, omissions or decisions taken by them that are commensurate with their experience and training, but where gross negligence, wilful violations and destructive acts are not tolerated. Matters such as the JAL907 case, where aviation professionals are subject to criminal prosecution, are against the spirit and intent of ICAO Annex 13, Aircraft Accident and Incident Investigation. The sole purpose of an accident/incident investigation according to Annex 13 is the prevention of similar occurrences. Clearly, bringing criminal charges against controllers who were acting within the bounds of their experience and training does nothing to aid prevention. In fact it quite evident that criminal prosecutions are a barrier to open and successful investigations. As ICAO itself notes in the introduction to Attachment E to Annex 13: “The protection of safety information from inappropriate use is essential to ensure its continued availability,
THE
16
CONTROLLER
4 Safety since the use of safety information for other than safety-related purposes may inhibit the future availability of such information, with an adverse effect on safety. This fact was recognized by the 35th Assembly of ICAO, which noted that existing national laws and regulations in many States may not adequately address the manner in which safety information is protected from inappropriate use”.
Complex Chain We know that mistakes and errors in the air traffic control environment are rarely caused by a single element. We also know that the Accident Report into the near miss gave a number of contributing factors to the cause of the incident; these including pilot’s actions, controllers’ actions, controllers’ operational procedures, lack of proper training for the controllers, and lack of definitive procedures for pilots to follow after a TCAS RA. No complex, dynamic system can ever be completely fail-safe. In order to improve system safety, with the emphasis on prevention, all contributing elements need to be closely examined. Directing blame to any one system component at the outset, is not appropriate, or productive. As we noted in our press release issued in January this year “From the current research of highly respected safety experts, it is now accepted that in high reliability organisations that demand a high level of safety, human lapses are a normal part of the system; system failures, however, are not solely due to a single action. System failures are due to systemic problems that emanate from a complex
chain of events. The single lapse by a human within that chain is a consequence rather than a cause of the systemic failures”.
Missing the Point Punitive action against any individuals in this or similar cases will NOT help develop SAFETY in the local or global aviation community. There was no intent to cause harm, no wilful violation of rules or procedures and no gross negligence in this matter. There was a failure of system safety nets to prevent the event unfolding as it did. There is an opportunity to learn from this, to improve, to make things SAFER. Prosecuting individual air traffic controllers for a simple human error is NOT improving safety. Such punitive action is detrimental to the full, open and honest reporting of safety matters, including human error. Such punitive action does NOT fit the global aviation communities understanding and expectations of JUST CULTURE. A culture in which front line operators or others are not punished for actions, omissions or decisions taken by them that are commensurate with their experience and training, but where gross negligence, wilful violations and destructive acts are not tolerated.
Verdict And so for now, we continue to wait. Wait to hear the verdict of the Supreme Court, wait to hear the fate of our fellow controllers, and wait to see how the Supreme Court decision will be perceived in the international aviation community. Will the Japanese Su-
4 Tokyo ACC.
Photo: Hiro Tade
preme Court be perceived as a enlightened body, cognisant of the ICAO requirements for incident and accident investigations being for the purpose of prevention, not prosecution? We certainly hope so, for the good of our colleagues who live under the continued threat of prosecution and loss of liberty and for the good of aviation safety in Japan. Or will another dark chapter be written in this unfortunate saga? I know that you all join with me in wishing our colleagues well, and letting them know that the thoughts of all controllers are with them. ^
evpp@ifatca.org
Norwegian Air Traffic Controllers Praised for Safety Culture In cooperation with Eurocontrol and the University of Aberdeen, Avinor, (the ANSP of Norway) recently carried out a survey of its own safety culture - two years after the previous one. Workshops were carried out to verify and expand on the responses given at the air traffic control centres in Oslo and Stavanger. A preliminary report shows clear progress following targeted efforts in the last two years, which included a nationwide campaign at towers, air traffic control centres and in technical regions. The actual campaign has consisted of the safety staff at ANS visiting all the units around the country. Through meetings with the air traffic controllers, air traffic controller assistants, engineers and local unit manage-
ment, everyone was given a presentation on safety culture and human factors as a basis for creating awareness, understanding and a commitment to continuous improvement of safety through development of a sound safety culture, says Knut Skaar, CEO ANS.
4 AVINOR safe and happy controller.
Photo: Gaute Bruvik/Avinor
Dr. Barry Kirwan, head of Safety Research at EUROCONTROL, believes the results of the survey reveal a high degree of trust between co-workers, and between employees and the management in the entire organisation, which is a precondition for further improvement. He adds that the ANS division in Avinor is in the process of achieving a best in class safety culture compared to other service providers in Europe. ^
THE
CONTROLLER
17
4 Safety
SKYbrary A Single Entry Point to Aviation Safety Knowledge Alexander Krastev, ^ by SKYbrary Content Manager The Need for an Aviation Safety Knowledge Base How often do we hear people say in the aftermath of an accident “This is a known issue”? Well, the fact that accidents continue to happen indicates that important information is not always readily available to those who need it at the time they need it. How easily can a pilot, a controller or a safety manageer find information on a specific problem? Where can he/she find examples of incident and accident reports, advice on best practices, answers to particular questions, training material, or links to other information sources? Most aviation organisations publish their own journals and documents on their websites but don’t link very well to other sources. How can we ensure that our collective knowledge and experience is shared and globally accessible to anyone interested in it? Furthermore, how Photo: © Sandra Cunningham | Dreamstime.com
can we ensure that the knowledge helps shape behaviour and promote best practice?
A “One Stop Shop” for Aviation Safety Knowledge EUROCONTROL’s Safety Improvement SubGroup (SISG) identified the need for some kind of knowledge repository to ‘store’ safety related data as early as 2004. It would provide a central location for service providers to share solutions to common safety problems. The first step in that direction was the launch of the HindSight magazine in the beginning of 2005. Work on an on-line safety knowledgebase started late 2005 with the development of the concept and platform design. The website, in the meantime called SKYbrary (shortened from Sky Library), was officially launched in May 2008.
Wiki The safety knowledgebase adopted the concept of a wiki. It consists of a hyperlinked network of articles and documents. An article is the building nucleus of the knowledge base. It can contain links to other related articles, to documents stored on the SKYbrary bookshelf or to external safety data sources. Anyone can comment, propose modification to an existing article or submit a new one, including new topics. However, unlike other wiki’s, a robust content control process ensures the needed quality, reliability and consistency of stored safety data. Visitors can browse selected portals and categories of information, look at recent Safety
Alerts issued by EUROCONTROL, or access a growing bookshelf of reference documents, including accident & serious incident reports. SKYbrary provides coherent links from knowledge articles to direct behaviour influencing applications like e-learning modules, videos, posters and presentations.
Beyond ATC Soon, it was obvious that the knowledgebase needed to reach beyond the air traffic control community: the aviation system as a whole could benefit from such a repository, which is why all hazards and safety risks associated with commercial air transport operations, not just air traffic management, were put in the focus of the content development. The SKYbrary initiative rapidly gained the support of both ICAO and Flight Safety Foundation, which was crucial for enhancing credibility as well as for providing access to existing knowledge. The partnership was subsequently extended to include the UK Flight Safety Committee and the European Strategic Safety Initiative led by EASA. While SKYbrary is useful for anyone interested in aviation safety, the content development efforts mainly target three major groups: • Operations – air traffic controllers, pilots, ATC operations line mangers, chief pilots, operational experts • Safety – safety managers, incident investigators, flight safety officers, safety experts, safety regulators • Training – training experts, instructors.
Portals The initial main focus of SKYbrary, i.e. operational issues (i.e. risks) of concern to the SISG currently covers 14 principle categories: Airspace Infringement, Air-Ground Communications, Bird Strike, Controlled Flight into Terrain, Fire, Ground Operations, Human Factors, Level Bust, Loss of Control, Loss of Separation, Runway Excursion, Runway Incursion, Wake Vortex Turbulence and Weather.
THE
18
CONTROLLER
4 Safety Along with articles on each of the subjects, an extensive set of incident/accident reports provide illustrative examples and support lesson dissemination. In addition to Operational Issues, two further portals were created, notably the Enhancing Safety and Safety Regulations portals. The Enhancing Safety portal provides access to a wealth of articles and other materials on proactive safety improvement grouped in several categories, such as Airworthiness, Flight Technical, Safety Management, Safety Nets, Theory of Flight, and Safety Culture. The Safety Regulations portal, as the title indicates, enables users to access safety regulatory requirements issued by authorised organisations, such as European Commission, EUROCONTROL, JAA. Although this is the least developed portal for now, it provides comprehensive information about the Single European Sky initiative and legislation.
Reference Besides the primary risk related articles, SKYbrary offers to all users numerous ancillary articles that provide further explanation of terms and definitions used in the primary articles, but also articles of a more encyclopaedic nature, such as aircraft types and performance. The information architecture of SKYbrary is subject to constant review as the volume of knowledge grows and feedback is received from users. It also provides access to various toolkits and expert support functionalities that can help aviation professionals enhance their knowledge and skills. Examples of these are the Level Bust toolkit, Air-Ground Communications tookit, the ICAO search centre and OGHFA (Operator’s Guide to Human Factors in Aviation).
ICAO Search Centre The ICAO search centre enables quick reference to ICAO Standards and Recommended Practices (SARPS) and Procedures for Air Navigation services (PANs). The database of SARPS and PANs to be searched through is limited to those considered essential for aviation safety - the Annexes to the Chicago Convention, PANS OPS (Doc. 8168), PANS ATM (Doc. 4444), etc. Users can search for keywords through the ICAO documents listed on the search page (http://www.SKYbrary.aero/sissy/home/). Each hit shows as an excerpt from a document - a paragraph that contains the keywords searched for. Unfortunately, ICAO prohibits making the full document available in any form, but the site provides a handy reference of where to find the info.
Human Factors The OGHFA is an extraordinary collection of valuable information related to human factors made available to the entire aviation community through SKYbrary. Recognising the prevalence of human factors issues in aircraft accidents and incidents, the Flight Safety Foundation has released it to bridge the gap between theory and practice and to improve the safety and efficiency of commercial aviation. OGHFA gathers available scientific information and makes it understandable and accessible for aviation operators. It includes more than 100 articles and supporting visual aids which present human factors issues. The articles are divided into four categories: • Crew Action and Behaviour • Personal Influences, involving the “internal state” of each crewmember, such as knowledge, stress, fatigue, awareness and many other factors • Organizational and Environmental Influences, including factors beyond the control of the crew but under the control of the airline • Information Influences, including the content and form of information available to a crew, such as checklists, manuals, navigational charts, and other items.
Challenges for SKYbrary Collecting, organising, delivering and maintaining aviation safety knowledge in such a way that it does not remain static is an enormous challenge. It took two years of considerable effort to get SKYbrary ready for launch. A great deal has been achieved since then but for the project to go forward, we need greater engagement from the aviation community in order to build the depth and breadth of knowledge that we aspire to. ^ SKYbrary is freely accessible at: www.SKYbrary.aero
Moreover, integration of new SKYbrary tools and information services is underway. The tests of the prototype of a “safety case” module have been accomplished recently. Once integrated the new feature will enable SKYbrary users to browse the database of hazards and safety cases made available as an output of risk assessments.
Priorities While the framework of the SKYbrary knowledgebase is becoming mature, the subject coverage is not yet uniform across portals and categories. The short-term content development priority is focussed on the major killers in the aviation industry: • Loss of Control (LOC) • Controlled Flight Into Terrain (CFIT) • Runway Excursion (RE) • Runway Incursion (RI) • Loss Of Separation (LOS)
THE
CONTROLLER
19
4 Safety
Are we too good? Why Doing Favours Might not be the Safe Thing to do
^ by Bert Ruitenberg, IFATCA Human Factors Specialist The full-length version of this article appeared in issue 8 of Hindsight, produced by Safety Improvement Sub Group (SISG) of EUROCONTROL and is issued twice a year. More info via HindSight.magazine@ eurocontrol.int Air traffic controllers take great pride in their job and try to provide the best possible service at all times. This personal pride translates to what their ‘clients’ range from offering shortcuts (direct routings) in the air or (during taxiing) on the ground, offering alternative runways for departure or landing, to even offering the use of a single runway in the opposite direction of the one active at that time.
Goodies Reasons for offering those “goodies” are usually not selfish: there is a genuine feeling that we offer these as a favour to the crews, airlines and passengers. It could save them a couple of minutes of taxi time, get them airborne a minute or so earlier, or save them a minute or two of flying time. The International Air Transport Association, IATA, sent out an appeal a few years ago to air traffic controllers to try and shave off 1 minute of flight time for every flight they handled. So this kind of “micro improvement” must be important to ATC’s customers!
puts of the pilots. But those days are gone: aircraft nowadays are complex digital machines, operated by computer systems that are managed by the pilots.
Harder Simply put: in the old days, it just was necessary for the pilots to understand the change and carry it out. Today however almost any “real time” change requires an update of the FMS – in addition to having to understand the change the pilots must also re-program the aircraft in order to be able to accommodate it. An in-depth look at the LOSA Archive, Archie for short, reveals some interesting statistics. LOSA is the Line Operations Safety Audit, an airline safety programme to monitor safety in normal operations. It is endorsed by ICAO and maintained by Dr. James Klinect and his team at the LOSA Collaborative at the University of Texas, Austin, Texas. Archie only records flights where no reportable safety incident occurred – just successful operations from A to B... In Archie's data, a late runway change is identified as an “ATC threat to the flight crew2” in 13% of the flights – which means that on average one in every eight flights faced a late runway change. One in every eight! Digging a bit deeper: of the late runway changes, 39% occur after pushback and 61% occur late in the descent or approach (i.e. below FL200, including multiple runway changes after Top of Descent).
4 In addition to having to understand the
change the pilots must also re-program the aircraft. Photo: eads
Runway Changes Archie goes on: of the 843 late runway changes, 17% were ‘mismanaged’ by the flight crews, meaning the flight crew committed one or more errors that are linked to the late runway change. This makes “late runway change” the most often mismanaged threat in the LOSA Archive – other mismanaged threats average around 10-12%. Remember these were “normal flights” without reportable safety incidents. In the 17% of mismanaged late runway changes, crews must therefore have been able to successfully manage their errors - otherwise their flights wouldn't be included in Archie. That implies the crews’ workload must have increased between the moment the late runway change was given to them, and the moment at which the operation was returned to normal again. A higher than usual workload in what is universally regarded a critical phase of flight. Is that what we want to achieve when we try to provide the best possible service to pilots?
Less is More! As with late runway changes, some flight path alterations are unavoidable. Pilots as well as controllers have to manage those situations to the best of their abilities. But for the “unforced” ones, which controllers think are a favour, Archie's statistics tell us that ATC may need to reconsider: it may actually be a bigger favour NOT to offer pilots an alternative runway, direct or level change. From a safety perspective, it may be a case of “less is more”! ^
bertruitenberg@cs.com
But are such micro improvements, especially when this is done at short notice, really that beneficial at all? Modification of existing (and understood) plans1 of pilots used to be fine in the days when aircraft were analogue machines that were operated by manual control in “mental model” A “threat” in this respect is something that originates from outside the flight deck and that has to be managed by the flight crew in order to maintain the margins of safety for the flight.
1 2
20
THE
CONTROLLER
4 Americas News
Argentinean Air Traffic Controllers Association Organizes Safety Seminar Alex Figuereo, ^ by EVP Americas The Argentinean Air Traffic Controller Association organized a seminar on safety on Sept 10, 2009 in Buenos Aires, attended by the Presidents of many South American Controllers Associations, IFATCA and also the MERCOSUR Controllers Associations. IFATCA was represented by Bert Ruitenberg, who gave a nice presentation of NOSS (Normal Operations Safety Survey), EVP Americas (Setting the Standards for an Efficient ATC System in Latin America) and R. Bruce Magallon de la Teja from COCTAM (Importance of becoming a Professional ATC College in our Region and Mexico ATCO’S experience). Fernando Reyes from Uruguay MA presented “Why Military Administra-
Photo: Argentina ATCA
4 Buenos Aires 2009. tion in Civil Aviation Collapse in MERCOSUR” and “Safety in ATC” was presented by Gabriela Logatto. The seminar has been a great opportunity to gather South American countries such as Uruguay, Paraguay, Brazil, Argentina and Bolivia in the same place. It’s been important for them to see IFATCA’s presence there. We had the chance to talk about the importance of continuing to be within the federation. The goal is going to be expanding this Buenos Aires experience and to promote IFATCA and our profession as
much as we can. Paraguay and Bolivia are willing to host the next meetings and we expect to gather more and more countries from the continent. ^
MERCOSUR Single Sky and OACTAM Alex Figuereo, ^ by EVP Americas New Initiatives for South America Controller associations that are affected by MERCOSUR ( a regional trade agreement between Argentina, Brazil, Paraguay and Uruguay to promote free trade) created an organization called OACTAM. They organized a meeting last September in Buenos Aires, Argentina. The meeting was attended by Argentina, Bolivia, Brazil, Paraguay, Uruguay and many observers. Mr. Rodriguez, former representative of Argentina to IATA, expressed his concerns on the lack of harmonization in the region. He argued that for once for all South American controller associations must stand up for the development of new strategies to improve the ATM system. OACTAM supports the concept of MERCOSUR Single Sky which is likely to evolve into UNASUR
THE
CONTROLLER
(Union de Naciones Suramericanas which includes Argentina, Venezuela, Colombia, Ecuador, Brazil, Bolivia, Ecuador, Surinam, Paraguay, Guyana and Chile). UNASUR Single Sky enhances the number of countries involved geopolitically. Harmonization is the main objective of this project; Latin American controllers are really concerned on what is going on in Europe with SESAR and in the United States with NEXT GEN, wishing to start developing the concept and to involve the whole sub continent in the next air navigation challenges. Measured with SWOT (where we can determine the Strengths, Weakness, Opportunities and Threats of a project) Analysis, Mercosur Single Sky could be possible. Most of the South American countries have cultural similarities and they mostly have the same technical needs but the project’s threats and weaknesses could be the military operation of ATC in countries such as Brazil, Argentina, Uruguay and others.
ommends it and Latin America shouldn’t stay behind. North America, Central America and the Caribbean (NACC Region) are archieving the first step, starting with radar data sharing. In a few years, the needs of the modern ATM/CNS systems and the demands of increasing traffic are going to force the winds of change in this particular and turbulent region. The next meeting is in Ascuncion, Paraguay in November, with the second in La Paz, Bolivia (February or March 2010). ^
Nevertheless, the air navigation world is moving towards harmonization. ICAO rec-
evpama@ifatca.org 21
4 Safety
Stop Bars and IFATCA 4 Stop bar Photo: NATS
Raimund Weidemann, ^ by IFATCA Representative at the ICAO Operations Panel What are Stop Bars? Stop bars are defined as a row of red, unidirectional, steadyburning in-pavement or elevated lights installed across an entire taxiway, and elevated steadyburning red lights on each side. (see photo) They were originally developed as a safety net to prevent traffic (aircraft or vehicles) inadvertently entering an active runway. In other words, red stop bars are a measure to prevent runway incursions. Very often stop bars are used especially under low visibility conditions (LVP) or at night, but as runway incursions can occur under any weather conditions and at any time of the day there have been considerations and trials lately with modified stop bars operated in a 24/7 mode.
How are Stop Bars operated? According to ICAO provisions in Annex2, Annex 14, PANS ATM and Manual for Prevention of Runway Incursions stop bars should be switched on to indicate that all traffic shall stop and switched off to indicate that traffic may proceed. Aircraft or vehicles should never be instructed to cross illuminated red stop bars when entering or crossing a runway. In the event of unserviceable stop bars that cannot be deselected, contingency measures, such as follow-me vehicles, should be used.
Air traffic controllers should never instruct a pilot or vehicle driver to cross an active stop bar. 22
Why did Stop Bars come to the Attention of IFATCA? Tower controllers from different parts of the world have reported the following problems: • Absence of stop bars at runway entry points at some airports (partly or even total) • Insufficient stop bar and HMI design (stop bars not switchable from the tower or only switchable together with other parts of the lighting system) • Unacceptable procedures for stop bar operation at some airports (pilots or vehicle drivers are routinely instructed to cross active stop bars) • Inadequate or no contingency procedures for the case of stop bar malfunctions • Inconsistencies in ICAO provisions on stop bars throughout different ICAO documents (Annexes, Manuals, PANS ATM)
What has been done within IFATCA to tackle the Problem with Stop Bars? The IFATCA Global Airport Domain Team has distributed a survey on the usage of stop bars throughout selected Membership Associations. The results of the survey were presented at the 48th IFATCA Conference in April 2009. It was confirmed that the reported problems with stop bars exist at various airports. Recommendations how to improve the situation and proposed solutions are provided in the conclusion section of the survey. The IFATCA survey on stop bars can be downloaded directly from the IFATCA Web site. The IFATCA representatives to the ICAO Operations Panel (OPSP) and to the ICAO Aerodromes Panel (AP) have
presented working papers in the working group meetings of the respective panels to bring the problem to the attention of ICAO and to propose a review and extension of ICAO provisions on stop bars. Objective is to make ICAO provisions on stop bars consistent and unambiguous, and to cover aspects like extended stop bar operation in a 24/7 environment. The IFATCA Technical and Operations Committee (TOC) is working on a study in regard to the operational use of stop bars, which will be presented at the 49th IFATCA Conference in Punta Cana next year.
What are the Next Steps? IFATCA will actively follow and influence the work on stop bar provisions at ICAO level. TOC will finalise the study on stop bar usage for presentation and decision during the 49th IFATCA Conference. IFATCA may consider extending the survey on stop bars to more Membership Associations in order to get an updated and more complete picture about the situation on stop bars. IFATCA will follow the developments in regard to operation of modified stop bars in a 24/7 environment. ^
raimund.weidemann@t-online.de
4 Jet stopping at a stop bar. Photo: Sukhoi
THE
CONTROLLER
Books Review
The Human Contribution: Unsafe Acts, Accidents and Heroic Recoveries By James Reason
^ Reviewed by Philippe Domogala, Editor We all know professor Reason (see interview on pages 26-27). His latest book, The Human Contribution, is as fascinating as his reputation. It is not an easy read, especially for nonEnglish speakers, but realistic enough to keep you reading it until the end. The purpose of the book is to explore the human contribution to both the reliability and resilience (the positive capacity of people to cope with stress) in complex systems such as ours. Until now, many (including Prof. Reason himself) considered the human as a hazard, whose unsafe acts could cause accidents. This book explores another, less explored perspective: the so-called heroic recoveries, i.e. when people saved the day instead of causing a catastrophe.
The book explains the difference between the man as a hazard and as a hero. It explains some accidents but then details some heroic recoveries, not only in aviation. Prof. Reason explains how it is possible to learn from these heroic recoveries and how these actions can be taught to achieve resilience. The last chapter of the book is particularly important for us in ATC. It is called “In search of safety“ and is really something everyone involved in safety management should read. With Christmas approaching, if you want to make a present to your CEO, this book would be a good choice. After all, the controller workforce is not causing incidents, but preventing much more by their actions everyday.
Photo: ashgate
The Human Contribution: Unsafe Acts, Accidents and Heroic Recoveries By James Reason ISBN 978-0-7546-7402-3 296 pages Published by ASHGATE, UK. To order contact www.ashgate.com ^
Linguistics and Flight Safety: Aspects of Oral English Communication in Aviation by Franz Rubenbauer
^ Reviewed by Philippe Domogala, Editor This small book is very interesting as it explains why verbal communications are so vital in our profession and reinforces the need to use standard phraseology in today’s aviation circles. The author is an IFR pilot with university degrees in various subjects, currently working for the German CAA. We all know how successful verbal communications, not only on the R/T, are essential in air traffic control, and how misunderstandings can lead to loss of life. Many accidents have communications as causal factors and this book goes into some of those accidents and discusses the ambiguities in communications that led to those accidents. It also covers the newly introduced
Photo: shaker
ICAO proficiency tests and its implications. This book connects two systems, the language one and the aeronautical one. It explains how English is applied in aviation and how miscommunications occur. Overall, it’s a good research book that gives a scientific background, including facts of interests to those who are trying to implement a single language in ATC. Aspects of oral English communication in Aviation by Franz Rubenbauer ISBN: 978-3-8322-8233-2 108 pages Published by SHAKER, Germany To order contact www.shaker.de ^
THE
CONTROLLER
23
4 Runway Safety
Runway Safety Deficiencies IFALPA Insists on Mitigations to Prevent Incursions. Capt Heriberto Salazar, B737 Aeromexico and Vice-chairman ^ by of the Aerodrome & Ground Environment Committee (AGE) IFALPA believes that runway safety issues are among the most serious threats to aviation safety. A significant percentage of accidents are as a result of runway safety deficiencies.
Runway Incursion ICAO document 9870, the Runway Incursion Prevention Manual, is based on the Eurocontrol action plan and FAA initiatives, focusing on short and medium term preventive actions. These might be the best achievable at present, but the real solutions lie in designing out the problem which requires a more systemic approach focusing on the future. IFALPA’s preferred solution is to design airports in such a way that Taxiways crossing runways should be avoided whenever possible, by the construction of “end-around” or “perimeter” taxiways. When a crossing is unavoidable, it should be done at a low energy point on the runway, at either runway end or entrance. Taxiways for a runway shall be restricted to those required for lining up, for take off and shall be perpendicular to that runway. Many airports were constructed more than 30 years ago; during these years aviation traffic has grown exponentially. Many airports around the world still have the original signs and markings, and they are no longer ICAO compliant. Leaving a pilot to interpret
the meaning of these non-standard signs and markings is an unnecessary hazard that may lead to a significant safety event. IFALPA considers the use of non-standard signs and markings a threat for its pilots and is requesting their standardization around the globe. Local Runway Safety Teams need to include pilots to ensure that ICAO standards are respected. Maybe for some airport administrators and Air Traffic Controllers, their airport is perfectly logical, but what would happen if we move the Controller to different airports, two or three times a day, so she or he would have to control traffic from a variety of different platforms at different airports? How would their expert knowledge of their home base get applied in different circumstances? The expertise developed at the home airport could even be dangerous elsewhere. The design of an airport can make a significant difference to the number of Runway Incursions experienced. The statistics show that airport configurations where a runway has to be crossed as part of normal operations are more vulnerable to runway incursions. Accident statistics also show that risk increases when there are sudden changes to traffic throughput (e.g. Tenerife 1977) or unusual local circumstances. While appropriate operational procedures are essential, airport design that eliminates runway crossings are what IFALPA is asking for from airport operators around the world At legacy airports that do have runway crossings today IFALPA supports some easy solutions that will help to reduce Runway Incursions:
nex 14 compliant signs and markings are used at all airports.
ICAO Annex 14 Standard Signs and Markings
The use of aircraft lights serve two basic goals, SEE and BE SEEN. As a direct effect, the aircraft will be more conspicuous and that is essential for other aircraft, ground crew, vehicle drivers and ATC to aid visual detection. Navigation (position), anti collision, strobe, logo, taxi, turnoff and landing lights are useful aids to make aircraft more
Signs and Markings are the body language of an airport and are as important as the use of standard ICAO phraseology. Local words or signage are only meaningful to local pilots. IFALPA requests that only ICAO An-
STOP BARS Use of STOP BARS operated 24 hours per day in all weather conditions are considered a significant safety benefit by Pilots and Drivers working on the manoeuvring area and therefore Air Traffic Controllers. Controller workload is considered acceptable given an appropriate procedure and co-location of the stop bar switches with the Controller working position. IFALPA requests that Stop Bars are used 24 hours per day to protect the runway.
Taxiway Nomenclature Complex taxiway environments, with illogical naming conventions applied, e.g. taxiways with similar, or the same designations, as another part of the same airport, lead to pilot and driver confusion and a loss of situational awareness by all. The misunderstanding of taxiway clearances leads to navigation errors on the ground, runway incursions daily and occasionally to accidents. To reduce such incidents and accidents all taxiways and especially taxiways that enter and exit the runway should be instinctive and logical to the pilots, air traffic controllers and vehicle drivers. That requires logical routings with logical nomenclature. To do this IFALPA has developed a policy to help airport administrators to do this. ICAO is requested to update Annex 14 accordingly.
Aircraft Lights
Photo: Phil P.
THE
24
4 Capt Salazar
CONTROLLER
4 Runway Safety conspicuous and show intention of movement. Adherence to IFALPA Policy is strongly recommended to aircraft operators and aircraft manufacturers to help standardize operating procedures.
Runway Excursion During the last decade the number of fatal and non-fatal accidents has been reducing, According to FSF, more than 90 per cent of runway accidents are runway excursions. During the last few years catastrophic accidents have occurred where commercial aircraft run off at the end or depart the side of the runway. Runway excursion accidents are primarily caused by either an incorrect approach/landing technique or an uncontrollable aircraft on the runway To reduce the risk of a runway excursion, there are some measures that the aviation industry can emphasize.
Stabilized Approaches These are essential for safe landings: when these parameters cannot be maintained a Go-around should be executed. Standard operating procedures should include the operator’s policy with regard to the decision to go around encouraging the crews to do so in case the approach is not stabilized. ATC has a role to play as an aid to avoid rushed approaches. Runway changes after top of descent, especially last minute changes, can cause a lack of situational awareness and rushed approaches. These are contributing factors to unsterilized approaches. Landing clearance
should be given above an altitude that can jeopardize the decision of Go-around. PAPI or VASI lights system should be operated during day and night, irrespective of the visibility condition, and should be used during the visual part of every approach.
Runway Surface Condition IFALPA believes that the effect of all natural or unnatural contaminants on aircraft performance should be assessed, whenever it is not possible to fully clear the runway, taxiway or apron of these contaminants. The effects of displacement and impingement drag on aircraft performance should be assessed as well the effects of any contaminants on aircraft braking. Aircraft cross wind capability has been demonstrated during test flights. These flights were ONLY conducted by test pilots and on a “test” runway; this doesn’t mean that the same operation capability can be achieved on a contaminated runway and/or after a long duty day with a 10 time zone difference.
Training To provide adequate safety awareness among crews, operators should set up a training program to develop theoretical knowledge of runway excursions and the importance of effective CRM leading to a solid understanding of the excursion risk.
Improving Post Accident Survivability Human life can be saved even after a serious runway excursion accident by adopting risk reducing measures. These include, but are not limited to the runway environment, emergency plans, (cabin) crew performance and aircraft structure. The runway environment should be constructed for optimum survivability following a runway excursion or other accident. In addition to the runway strip as defined by ICAO, this should include a runway end safety area (RESA). IFALPA policy is that the minimum acceptable RESA is 240m beyond the 60m runway strip and twice the width of the correspond-
ing runway. This area should be laid out to optimize survivability; in other words, flat, firm, ground capable of supporting the heaviest RFF equipment at the airport and free of nonfrangible objects. An alternative means of compliance is the installation of an arrestor bed which will provide the same level of protection as a 240m RESA. Other factors, for example safety minded construction zoning in the airport vicinity will further mitigate risk. Emergency exercises must form a part of every airport’s Emergency Plan. Such an exercise must be carried out, in full, on a regular basis and involve all personnel and agencies that would be expected to attend an actual airport emergency. Table top exercises are of some value, but they should never replace regular full scale exercises. For more information refer to: • Uses of aircraft external lights see 09AGEBL01 • IFALPA’s RESA policy see 08POS01 • Airport nomenclature see IFALPA Annex 14 para 5.4.3 Taxiway Designation ^
Photo: FAA data
THE
CONTROLLER
25
4 Safety
Interview with Prof. James Reason SAFETY and Human Factors in 2009
^ by Philippe Domogala, Editor 4 Prof. James Reason James Reason was Professor of Psychology at the University of Manchester (UK) from 1977 to 2001. He is now a lecturer and a consultant in various organizations such as UK NATS. Philippe Domogala: Prof Reason, Everybody knows you after the now famous cheese model, and it is used in almost every safety course on the planet. In your latest book (The Human Contribution: Unsafe Acts, Accidents and Heroic Recoveries (see the review on page 23 of this issue) you alter the general view of humans as a hazard, producing errors and violations. Instead, you introduce the notion of the human as a hero, compensating and recovering system errors. Looking at Capt Sullenberger’s actions in that Hudson river ditching, one could agree with you entirely. But looking at the latest aviation accidents this year, is that really so? James Reason: The hazardous human and the heroic human are two sides of the same human factor coin. Everyone is capable of errors, violations and unsafe acts in general. They have occupied centre stage so far because most of the data are event-dependent, i.e., they depend on accident reports. But as the Capt. Sullenberger event (and many others) has shown, people are also capable of pulling back troubled
systems from the edge of disaster. After 40 years of studying unsafe acts and system failures, I find the heroic recoveries much more interesting, and perhaps equally important in the human factors of safety. In my 11 case studies, I set out to find the common factors. But I actually found very few. One was the possession of realistic optimism; that is something that is the opposite of despair. In most other respects, there were wide situational differences in contributing factors, type of decision-making involved and management style. The contrast, for example, in the leadership styles of Captain Rostron of the Carpathia ship (see note 1) and Capt Al Haynes of the United Airlines DC10 (see note 2) is very marked. The former (as far as we know) didn’t consult, but simply issued a string of detailed instructions relating to the handling of the vessel, preparations for receiving survivors, and the like. Al Haynes on the other hand consulted widely with his crew members. I doubt whether everyone is capable of making heroic recoveries, or whether someone who was heroic on one occasion could repeat his/her success at another time. It was horses for courses. The right people in the right place at the right time were doing the right things. Your question implies a conflict, but the hazardous and the heroic human are not mutually exclusive (e.g. the crew of the Gimli Boeing 767 Glider ( see note 3 ) were implicated in the running out of fuel as well as the miraculous recovery). Ph.: In your book you also talk about the tension between internal and external factors. For the time being at least in Air traffic Management (ATM) we do not believe that safety is generative Maybe it is already in some places pro-active - however it is by far not where one would expect. How do you see that we will automate more working steps in ATM without necessarily the state of generative safety required being used?
The problems arise when the acquisition of new automation is traded off to achieve reduced separations.
What in your views should Air Traffic Management Service Providers do to cope with the production pressure (less costs, less delay etc.) and at the same time invest into the future tools - keeping safety in mind. JR: I agree that few if any ATM systems are generative, but many are responsibly proactive (NATS, for example, is surprisingly well led and has turned itself around almost 180 degrees in the decade I have been associated with them). The rest of the questioning seems to depend on the relationship between production and protection (discussed in my former book: Managing the Risks of Organizational Accidents pp. 3-6). Maybe in the long run protection and production can go hand in hand; but, in the short-term, there are always conflicts. When I first started working with ATM, I naively supposed that it was all about protection—maintaining separations, regulating flow and ensuring safe approaches and landings. But then I realised that it’s also very much about revenue-earning production: pushing as many aircraft as possible through closely defined pieces of sky. Thus there is a clear tension between revenue-earning and separations. Automation—collision predictions, and the like—are seen as added defences to the increasing volume of traffic, and indeed they are. The problems arise when the acquisition of new automation is traded off to achieve reduced separations. The ATM system, as a whole, is made safer by effective automation, but only if the original separations are maintained. Building in the human factor to such auto-
THE
26
Photo: JR
CONTROLLER
4 Safety mated systems should be kept in mind from the outset. Automation, as we have seen from the history of Airbus and other such systems, is a double-edged sword. It can help and it can cause harm. Ph.: Do you see any difference between “apportioning blame”, “determining responsibility” and “holding someone accountable” after a safety event? If so, what is the difference? JR: Clearly there is a difference between these phrases. Professionals like Controllers are clearly accountable but they need not be blameworthy. Blaming is bad news all around (the ghastly fate of the Ueberlingen controller marks one end of that spectrum). I have identified what I’ve called the ‘vulnerable system syndrome’ (see the Human contribution book). Blame lies at the heart of the syndrome, denial and the blinkered pursuit of the wrong kind of excellence are the other two. Together they interact to fuel the blame cycle. Ph.: In your view how far should resilience be build into the new automated ATC systems in order that these systems can recover? JR: Resilience, robustness and the ability to continue in the face of operational stresses and strains are the proper goals of a safety management system (see both books). Target zero (no accidents) is unattainable. Not only that, it misrepresents the nature of the safety war. There will be no decisive battles like Waterloo. It is a guerrilla war which we all ultimately lose (entropy gets us all in the end). The best we can hope for is to be on the last helicopter out of Saigon.
Automation in ATM can and does have enormous benefits; but there will also be human factors traps and surprises. Ph.: What advice would you give top management, CEOs of Air Traffic Service Providers, etc, when introducing the new very advanced automated systems in gestation? JR: I’d get them to read about the ironies of automation (see Managing the Risks of Organizational Accidents’ book, Chapter 3 pp. 42-46). Automation in ATM can and does have enormous benefits; but there will also be human factors traps and surprises. Ph.: Finally on a lighter note, I see that in your book, you added a cheddar layer to your famous Swiss Cheese model, and even a mouse nibbling that slice. Are we to expect from you more of these cheese stories in the future?
cue of the sinking Titanic. He saved 705 persons. NOTE 2: Capt Haynes was in 1989 flying a United DC10 from Denver to Chicago when the number 2 (tail) engine exploded in mid flight, severing all 3 hydraulic systems (the probability of losing all 3 hydraulic systems was calculated as 10-9 or one in a billion!) Using dissymmetrical power on the 2 remaining engines he managed to crash land in Sioux City. Of the 296 on board 185 persons survived.
JR: Yeah, well, the cheeses could be past their sell-by dates (according to Sidney Dekker, though I said it first). Swiss cheese did not apply too well to the Ueberlingen tragedy, or at least not with regard to the proximal events. But maybe I should explore the French dimension: Brie and Camembert, soft cheese?
NOTE 3: In 1983, an Air Canada B767 from Edmonton to Ottawa ran out of fuel mid way at 41.000 ft due to a combination of inoperative fuel gauges and miscalculations pounds/kilos. The crew successfully landed, without engines, on a disused runway in Gimli, Manitoba. ^
NOTE 1: Capt Rostron was in 1912 commanding the Ship‘ Carpathia” that diverted through an iceberg field to come to the res-
ed@ifatca.org
Photo: JR
THE
CONTROLLER
27
4 European News Photo: © Norebbo | dreamstime.com
Functional Airspace Blocks in Europe Human Centered & Operationally Driven?
^ by Patrik Peters, European Editor Europe suffers from its fragmented airspace with a high number of service providers. The establishment of the European Union with the Treaty of Maastricht in 1993 was a fundamental step towards harmonization, having effects on the organization of European airspace. The idea of Functional Airspace Blocks (FAB) was born by the Single European Sky initiative when airline operations suffered from increasing delays due to airspace saturation. A reconfiguration of the upper airspace into functional airspace blocks was seen as the enabler for more capacity. The framework regulation decided that a “functional airspace block means an airspace block based on operational requirements, reflecting the need to ensure more integrated management of the airspace regardless of existing boundaries.” As it left room for interpretation, the operational requirements were not always the driving factor behind alliances formed to satisfy this regulation. Through the pressure of the European Commission politics gained importance and focus was more put on economical aspects, supported by the need to maintain profitability in a competitive market situation.
FABs will not achieve more improvements than bi- or multilateral harmonisation plans.
NUAC – Nordic Upper Area Control Center – is an initiative launched by Sweden and Denmark and will become one of the service providers within NEFAB. The service providers of both countries, LFV (S) and NAVIAIR (DK), have decided to proceed with the operational alliance option after having also considered a merger scenario. The initiative is one of the most advanced within Europe. The BALTIC FAB combines the airspace of Poland, Lithuania and Latvia, where traffic growth, before the economic crisis, was very high. It could foster significant performance improvements in the area, despite its relatively small size. In the north-western region of Europe we find the UK-IRELAND initiative, which is based on a cooperation long existing. Currently significant performance improvements are being sought for, beyond the very modest ones identified in the cost benefit analysis (CBA). FABEC – FAB Europe Central – is by far the largest initiative. Owing to its size (Germany, The Netherlands, Belgium, Luxembourg, France, Switzerland) and central position it accounts for 37% of flight-hours and costs in Europe and is seen as the biggest capacity enabler in the densest part of the continent. FAB-CE, the FAB Central Europe, kind of replaces the initiative formerly known as CEATS (Central European Air Traffic Services). States involved (Austria, Czech Rep., Croatia, Hungary, Slovak Rep., Slovenia, Bosnia & Herzegovina) want to learn from their experience made with the previous undertaking, but need to seek further benefits, as those identified in the CBA are relatively low.
This year, the PORTUGAL-SPAIN FAB has launched a feasibility study including a CBA making use of simulation tools. Significant performance improvements need to be generated to exceed the already existing cooperation. The BLUE-MED FAB combines the airspace of Italy, Malta, Greece and Cyprus with Albania, Egypt, Jordan and Tunisia as associated partners. This FAB initiative crosses the border to Africa. Performance benefits appear to be very modest. High performance benefits though might be seen in the DANUBE FAB of Bulgaria and Romania. IFATCA is concerned as missing guidance has created wrong expectations among politicians and public. FABs will not achieve more improvements than bi- or multilateral harmonisation plans. It is therefore essential to reduce fragmentation at operational level with operational solutions. Additionally several FAB initiatives lack real financial benefits. Imposed pressure of the European Commission requires many institutional and cross-border legal issues to be solved to comply with the implementation by 2012. IFATCA agrees to enable optimum use of airspace – taking into account traffic flows and military requirements – focusing on the harmonisation of sector complexity and workload. We believe that capacity gains are to be achieved through compatible ATM systems and improved communication. ^
evpeur@ifatca.org
Photo: EUROCONTROL
Today we count nine different FAB initiatives in Europe:
NEFAB – North European FAB – is a combined effort of the Nordic states Denmark, Sweden, Norway, Finland, Estonia and Iceland. A cost benefit analysis has been undertaken last summer and work has now advanced to a feasibility study, which is to be completed by May 2010.
4 The European FABs THE
28
CONTROLLER
4 Asia Pacific News
Target Level of Safety, Keeping On Target ^ by John Wagstaff, Former IFATCA EVP Asia Pacific Background At the ICAO APANPIRG 20 Meeting at the ICAO Asia Pacific Regional Office in Bangkok, Thailand, at the beginning of September 2009, the West Pacific/South China Sea RVSM Scrutiny Group (WPAC/SCS RVSM SG) was disestablished following its success over the past 2 years in reducing the collision risk value in RVSM airspace to a value below that of the Target Level of Safety (TLS). Although this was a significant achievement in a comparatively short time span in ICAO terms, the real success of this group was in the unprecedented co-operation and co-ordination that was undertaken by all parties involved under the leadership of ICAO. The WPAC/SCS airspace includes portions of the Oakland and Anchorage FIRs, the FIRs of Japan, Taiwan, Hong Kong, the Philippines, Indonesia, Vietnam, Malaysia, Singapore and part of China – an area approximately equivalent to the landmass of Canada and the USA. However at all of the six WPAC/SCS RVSM SG meetings, one of the states, Taiwan, could not attend as it is not an ICAO member. Hence one of the key players in both the north-south and east-west traffic flows could not participate in the discussions. IFATCA is a professional body and an apolitical organisation. Many years ago IFATCA established the precedent that through the North East Asia Traffic Working Group (NEAT) and subsequently the East-Asia ATM Traffic Man-
Photo: Phil P.
agement and Co-ordination Group (EATMCG), the MAs of Japan, Taiwan, Hong Kong and the Philippines together with the respective State authorities regularly meet to discuss important operational issues that cannot be fully addressed in ICAO meetings. Through constructive dialogue held over many meetings, important decisions have been reached and complex problems have been resolved. The outcomes were reported to ICAO, where the IFATCA initiative was gratefully acknowledged.
Target Level of Safety Those with a degree in advanced mathematics may be able to understand the following formula for calculating the collision risk for passing and crossing traffic as part of the Target Level of Safety (TLS) equation:
However for the average controller it will suffice to give the ICAO definition – Target Level of Safety A generic term representing the level of risk which is considered to be acceptable in certain circumstances. The ICAO metric for the Target Level of Safety for RVSM operations is 5.0 x 10-9 fatal accidents per flight hour due to all causes.
West Pacific/South China Sea RVSM Scrutiny Group At the ICAO APANPIRG 17 Meeting in 2006 there was concern that the total risk reported by the West Pacific/South China Sea FIRs exceeded the ICAO TLS metric (it peaked at 13.6 x 10-9 in 2006). The Meeting established the WPAC/SCS RVSM SG to address this serious safety problem.
4 Hong Kong FLAS
The Group quickly identified the number of Large Height Discrepancy (LHD) reports as one of the primary problems. Due to the modified single alternate FLOS that was adopted by the WPAC/ SCS FIRs at the time of RVSM implementation in 2002, there was now a need for flights passing to or from adjacent FIRs that utilised different RVSM FLOS’s to change
levels. The timing of these transitions and the associated ATC workload were the root cause of many of the LHDs with the potential for many conflictions if the transition and necessary coordination were not completed in time. The Group agreed that a revised FLOS should be introduced, but with the increase in flights and many new significant traffic flows, it was not viable to adopt a common single alternate FLOS, therefore after much discussion, deliberation and co-ordination, a consensus was finally reached. On 2 July 2008 the WPAC/SCS FIRs implemented a revised FLOS and the total risk for the airspace in December 2008 was 4.81 x 10-9, a value within the ICAO metric.
Conclusion With the co-operation and coordination of the states and the active participation of IFATCA in the WPAC/SCS RVSM SG, the TLS has been met and the overall safety criteria has been significantly improved. However there are other issues in the region that still need to be resolved and IFATCA will be participating in the newly established Southeast Asia Route Review Task Force as both the voice of the operational controller and as the liaison through EATMCG to ROCATCA and the Taiwan authorities. ^
john.wags@gmail.com
Target Level of Safety A generic term representing the level of risk, which is considered to be acceptable in certain circumstances.
THE
CONTROLLER
29
4 Americas News
The Hudson River (New York) Collision What Happened? Doug Church, USA National Air Traffic ^ by Controllers Association (NATCA)
NATCA believes the main contributing factor in the Aug. 8 mid-air collision between a Piper airplane and a sightseeing helicopter […] was flawed procedures. Just to be clear, right upfront: NATCA believes the main contributing factor in the Aug. 8 mid-air collision between a Piper airplane and a sightseeing helicopter in the Visual Flight Rules airspace above the Hudson River – separating New York City from New Jersey – was flawed procedures that prevented controllers at Teterboro Tower in New Jersey from giving instructions to climb before switching control of the aircraft to controllers at Newark Tower, who have jurisdiction for flights before they enter this tightly compacted area of uncontrolled airspace over the Hudson. We realize that for our brothers and sisters around the world, it may be tough to ignore the sensational New York tabloid newspaper headlines and the reporting in foreign media outlets of this high-profile accident, particularly in Italy, where five of the victims in the helicopter were visiting from. The headlines – initially fueled by a poorly worded report from the U.S. National Transportation
Safety Board (NTSB) – have clouded the important issues of airspace and procedures and, in our view, rushed to judgment and wrongly implicated a NATCA-represented controller from Teterboro Tower in the accident for an alleged “inappropriate” phone conversation with an airport employee during much of the Piper’s brief time in the air. As of this writing, the controller was suspended with pay. But NATCA, which will represent the controller in the due process afforded him in the Federal Aviation Administration’s (FAA) internal hearing on this matter, believes this is a red herring. Instead, what we’re dealing with here is an aviation tragedy that resulted from a chain of several extremely rare and unfortunate events that included the pilot of the Piper not making radio contact with Newark controllers, who would have climbed him above the exclusion zone and on his route of flight southward to coastal New Jersey, out of harm’s way. Also now becoming an issue, after the NTSB’s Sept. 16 testimony at a U.S. House of Representatives Aviation Subcommittee hearing, is the audio quality of the Piper’s readback to Teterboro controllers of his assigned radio frequency to reach Newark Tower, which came piped into Teterboro Tower’s loudspeaker at the same time as Newark Tower was calling Teterboro to inquire about the Piper. Pilots in this particular airspace, called the Class Bravo Exclusion Zone (below 1,100 feet), are required to use “see and avoid” VFR procedures and are advised to tune into a common radio frequency to check in and report their positions. The burden of separation is, of course, entirely on the pilots.
Clearance from ATC is required to enter and operate within the Class Bravo airspace that begins at 1,100 feet above the exclusion zone. Under the procedures in place on Aug. 8, Teterboro controllers did not have the authority to climb VFR aircraft into Class Bravo airspace. Therefore, the transition into Class Bravo requires a handoff of control from Teterboro to Newark. On Aug. 8, the Teterboro controller initiated a timely handoff to the Piper, which the Newark controller accepted. The Newark controller was expecting radio contact from the Piper, which never came. Although controllers at both Teterboro and Newark attempted to re-establish radio communications with the pilot, they were unable to contact him. At the time of the collision, the pilot was not in communication with air traffic control. After the accident, the FAA convened a task force to examine the airspace with the goal of developing recommendations to make this historically safe airspace even safer. NATCA was represented on the panel by Newark controller Edward Kragh. On the very first day the task force met, it was unanimously decided that the current procedures were flawed and that under those flawed procedures, the Aug. 8 accident could not have been prevented.
THE
30
CONTROLLER
4 Americas News in the 39-day-old investigation that the pilot of the Piper read back an incorrect frequency during the radio switch to Newark. The readback was not heard or corrected by the controller, according to ATC recordings, the NTSB testified.
The FAA’s task force recommended several changes to training, procedures and airspace structure. NATCA supports these recommendations and we agree that their implementation will make the Hudson River Exclusion Zone safer. But further analysis is required before the recommendations can be implemented. Much of the media coverage has centered around a central dispute that NATCA has had with initial findings of the NTSB as to whether the Teterboro controller could or should have warned the Piper about possible traffic conflicts ahead of it already in the Exclusion Zone. The NTSB’s first written public statement on the accident, released on Aug. 14, stated erroneously that the Teterboro controller could have warned the Piper about the accident helicopter before switching radio control of the plane to Newark. In fact, the accident helicopter didn’t appear on radar until seven seconds after radio control was switched.
This was a disturbing development because the NTSB, which in its initial phase of investigating heard the exact same audio recording of the event as our controller in the Teterboro tower cab on Aug. 8, did not hear any readback error. The Teterboro controller told NTSB investigators in his interview that he believed the readback to have been correct. Something must have changed between Aug. 8 and Sept. 16. Either a separately recorded tape (with clearer quality audio) was uncovered, or the NTSB worked to enhance the quality of its existing tape. Either way, whatever the NTSB learned was not what the Teterboro controller heard in real time on Aug. 8. If it wasn’t on the ATC tape, then the controller didn’t have a chance to hear it. If the NTSB had to go to another source for this new information, then it is not pertinent.
If it wasn’t on the ATC tape, then the controller didn’t have a chance to hear it. As we filed this story on Oct. 1, the investigation continued and the NTSB likely will need several months to complete its work and issue findings of probable cause. NATCA will continue to work to publicly defend the Teterboro controller, who did his job on Aug. 8. What we hope happens soon is the implementation of new procedures at Teterboro that will enable controllers to have the ability to prevent this type of accident from ever happening again. ^
dchurch@natcadc.org
NATCA made extensive attempts to privately convince the NTSB to issue a correction to its statement and believed on Aug. 15 that such a correction was forthcoming. But it didn’t happen, leaving NATCA in the very rare and excruciatingly difficult position of deciding whether or not to refrain from publicly correcting the NTSB’s statement, an action that we knew would surely cost us our coveted status as an official “party” to the NTSB investigation. However, remaining silent would have allowed the media storm to rage, wrongly and unfairly trying and convicting the Teterboro controller of direct responsibility for not acting to prevent the crash. Ultimately, we decided to publicly correct the report and ask the NTSB to clarify its statement. We got our wish on the afternoon of Aug. 17 but not before the NTSB removed us from the investigation. Adding to our perception of a rush to judgment by the NTSB in its public statements was the Congressional hearing on Sept. 16 at which the NTSB revealed for the first time
All photo credits: ntsb
THE
CONTROLLER
31
4 SES/SESAR
Fairy Tales and Legends ^ by Marc Baumgartner, President IFATCA Photo: © Loveliestdreams | dreamstime.com
Why Fairy tales and Legends are important – a philosophical contribution to the future of Air traffic Management in Europe in the light of the Single European Sky II (SES). I was sitting on our terrace at home one day working on a speech, when suddenly my daughter came running and shouting “I don't want to kiss; I don't want to kiss this slug”. She had found a slug in the plants on our terrace and she was scared to kiss him. Somebody told her if she wanted to be a real princess she needed to kiss a slug at least once a week. I told her that this is nonsense and princesses, frogs and slugs who suddenly transform themselves into princes only exist in fairytales. She calmed down and was intrigued by what I was doing. Now if you think that explaining what is good or bad or the morale of a fairy tale to a 5 year old girl might be difficult or complicated then try to explain to the same child what the future of ATM would look like.
The Vision • The whole ATM system will be performance based, and changes based on performance cases (which includes safety cases). • A high level of automation will be required in meeting the highest ATM performance requirements. • Air traffic control (reactive, tactical) will be replaced by Air Traffic Management (proactive, strategic). • Management by Trajectory will form the basis of all controllers’ activities. • Airspace will be dynamic (move around). • UAV in non-segregated airspace.
• Local/Regional Implementations. The following list of changes will not be implemented globally by 2030 but it will be expected that there will be a number of such implementations around the globe. - Airports will be controlled from a remote facility (virtual towers). - Completely automated separation provision. In other words the separator is not the controller or the pilot but is in fact automation. • Less controllers needed: this has been the universal claim of all “advances” in ATM; however, because it has not been achieved in the past does not mean it cannot be achieved in the future. IFATCA needs to assess each claim on its merits and may well find that by 2030 there is a significant change in the number of controllers required. For many of us this sounds like a fairy tale, my daughter did of course not understand anything – therefore I tried to tell her in the form of a fairy tale what is currently going on in Europe as she understood that I would be in Belgium how maybe in the future we will talk about an urban legend, a Babylonian project or a phenomena called SES II, SESAR?
4 Flying horses. and navigate from one stable to the other. The beautiful princes had to give the magnetic fountain gold pieces that kept the magnetic fountains working day and night. The beautiful princes had been once rich when the kings (states) had money to pay them the food for the flying horses. At a certain stage the king was fed up with flying horses, as they were polluting the air and made a lot of noise with their “neigh/guffaw” and he preferred the high speed rabbits (trains). One day the King decided that the princes with their flying horses had to find their own way to finance the food for the horses. As the flying horses were expensive and a luxury the princes decided that they needed to find a solution to their new problem. They went to an old man called Schumann who was known to be a magician. But he had gone away on a long journey.
Telling you a fairy tale of the current work around SES of our public service called ATM might inspire you to take a little distance to think out of the box, think the unthinkable and help the others dream their dreams. This has the advantage for me the storyteller, that I can be cruel, that not everything needs to be explained and that there is not necessar4 Marc Baumgartner ily any logic to be applied – but there might be a moral…
Photo: Iran ATCA
Once upon a time there was a kingdom of many kingdoms with two tribes. One tribe had two beautiful princes (AEA/IATA) who had a fleet of flying horses, one nicer than the other. The other tribe lived in small stone towers and in caves, which owned powerful magnetic fountains (ANSP). The flying horses needed these magnetic fountains to be able to get full speed
THE
32
CONTROLLER
4 SES/SESAR Your flying horses will be more efficient and you will become richer. But there was a young girl in his house…The princes were not sure if they should tell the girl their story as she appeared very young, but she was very beautiful and seemed strangely wise, and could speak 27 languages. She convinced the princes to trust her. She told the princes of her plan ’the Single Sky’. Once the beautiful princes had left, the girl took a big book, Schuman’s book, which was full of magic recipes. The girl started to look for the right recipe. After many moons, she found it and summoned the princes. She told them “I have found the solution. You know that your horses need the magnetic fountains to fly correctly – but the princes owning the magnetic fountains have never told us their secret from where they got the magnetic fountains. In the name of my master, I will ask them to change the way they use their magnetic fountains. We will ask them to reduce the magnetic force – which will make your horses fly in a direct line. We will then pay them less gold. Your flying horses will be more efficient and you will become richer!” After the princes had left however, the girl started having doubts… She wasn’t really
sure of her plan… After all, she was not really an expert at recipes. Despite her doubts, she published a decree in the name of the master. She sent an invitation to all the kings in all the kingdoms to come and hear her new plan. All the Kings came, bringing along with them the beautiful princes and the princes owing the magnetic fountains and the dwarfs riding the flying horses (Pilots), the dwarfs looking after the magnetic fountains (Engineers) and those who had the secret of guiding the flying horses (Controllers). They all came in their best attire, discussed for two moon cycles and went back home and started to work according to the plan. But some of the dwarfs – especially those who had the secret of guiding the flying horses were unhappy and told the kings and the princes that the girl was a danger and they were scared that plague and problems would hit the various kingdoms. They complained that the girl did not want to listen, unlike the elves in the marble palace (Eurocontrol) who had always listened to them. Slowly the kings and princes saw that the plan was not working. The girl was afraid. She needed a second plan. She had found a recipe for a powerful stone called the SESAR Stone. It could tie the flying horses and magnetic fountains into a big spider web which didn't need the dwarfs anymore. She used all the gold the kings had given to Schumann to feed this stone and to develop knots and ropes to tie all the
flying horses to the magnetic fountains. But sadly this was not enough. The plan had already brought disease to the dwarfs, the flying horses and the magic fountains. They were so sad: they had no energy and couldn’t work as they did before. The kings, princes and dwarfs became afraid. They decided that something had to be done. The only solution was to weaken the girls’ power and control her stone. The kings and princes decided not to pay her anymore gold for the magic plan. In the end, the girl saw that she made a big mistake. She was so sad that she decided to leave Schuman’s house and move to a land far far away. The beautiful princes with their flying horses accepted that the princes with the magnetic fountains would not give away their secret. They accepted that they had to pay them for using the magnetic fountains. But the best thing was, they did not have to pay gold to the girl, and they did not have to pay gold for the SESAR Stone. So they all lived happily ever after. My daughter thought that you could sleep well after such a bed time story … ^
pcx@ifatca.org
4 A European marble palace. Photo: EUROCONTROL
THE
CONTROLLER 33
33
4 Africa News
Safety Management Systems The Way Forward – also from an African Perspective
^ by Mick Atiemo, Africa Regional Editor
4 Artist rendering of an A400 landing in the desert.
Photo: eads
A Safety Management System (SMS) is a proven, systemic way of safety assurance. It has been adopted as an ICAO requirement for all service providers to implement such a system, with the aim to provide a continuous improvement in all aspects of safety.
processes will lead to quality in safety standards. We all know that safety can't be or isn't absolute; we must keep improving it.
A Safety Management System is a series of processes that identify safety hazards, implement remedial actions that restore or improve safety, and continuously monitors and assesses safety performance. Main aim is continuous improvement of the overall safety performance. The basic components of such a system are risk management, safety assurance and safety promotion. The management of the organization must accept responsibilities and also commit to the system. Risk identification and assessment must be done in a professional (i.e. fairly and competently) manner. Only by consistently applying these
In our part of the world where the basics are even lacking, one wonders how such a system will operate and what will be achieved. Where we are now, coupled with our slow pace of development in the industry, there is a long way to go and a lot of work to be done. The will, commitment and non-interference of management and a total organizational support, safety is everybody business. Findings and recommendations of assessments and investigations are important and must be accepted and taken seriously. The era where recommendations are kept in files as papers while hazards persist, must be considered as past and our attitude towards safety must change for a more proactive look.
Promotion of safety is also important because the understanding and or appreciation of safety by all staff of the organization is necessary for SMS, all must be educated and professionally trained.
The promotional aspect of the system is also very crucial as we need the expertise, this we do not have. We need well-trained professionals to set up such a system, not the
paying of lip service. Training is the base on which every discipline or work stands and for that matter S M S. Inadequate or piece meal type of training will not make the system give the required impact. The continuous up grade or up date to get abreast and keep pace with worldwide development is necessary. We can also not rule out consultancy service when setting up such a system. Training they say is rewarding, not costly. The education of all staff of the organization to know that safety is a team business. Safety must be quality and assured of, we must therefore make serious effort to establish these systems to improve safety in our part of the world which is behind in all aspects of world development and for that matter safety in the aviation industry. The sharing of expertise, knowledge, information and experience, among regional neighbors must be encouraged. A well-established SMS will go a long way to improve safety. It is hoped that we here in West Africa especially will take this concept seriously in order to take safety to a higher and reliable level. ^
kwapong05@yahoo.com
THE
34
CONTROLLER
Charlie’s Corner 4 D-FUKK…
Safe Charlie
It could have been worse. Photo: DP
Safe in all Languages
Loosing Pieces of Aircraft
Some passengers on an Aer Lingus Airbus A320 flight from Dublin to Paris last September began shouting out and crying as they thought their plane was about to ditch. The drama followed an initial announcement made in English, telling passengers to return to their seats because of turbulence while flying over the Irish Sea. But then the cabin crew accidentally played out a recorded emergency landing warning in French. Around 70 French passengers were reported to be “freaked out” on hearing the warning. One English-speaking passenger said: “The French man sleeping next to me woke up and looked very startled.” He then translated what had been said, that the plane was about to make an emergency landing and to await instructions from the pilot. “I got quite alarmed. The woman behind me was crying. All the French totally freaked out.” The plane was just 20 minutes into its flight to Paris when the bungled announcement was broadcast. The Irish airline's cabin crew quickly realized their mistake and swiftly apologized in French. Later an airline spokesman said: “There was a malfunction of the public address system“
In the September 2008 edition of Charlie’s, I reported about a French ATR 42 that lost a landing gear wheel somewhere between Paris and Lyons, which was never found. Well, that same company (Airlinair) this time lost a cargo access door from one of their ATR72s last September. The large door fell on a house near Valence (France). Fortunately nobody was hurt, it only broke some roof tiles. I guess the maintenance guy in charge of safety in that airline must be looking for a new job.
4 A330 cabin secure? Here you go!
Cheap Repairs This photo was taken by a passenger. Someone repaired a cracked winglet with duct tape. The notion of safe repairs is very flexible in that airline apparently (which shall remain nameless)
Bad Luck Sometimes you must have luck in order to be safe they say. Well in Germany, unlike in many other countries, you cannot choose your aircraft registration. This guy spent 4 years and thousands of hours restoring with love an old North American Harvard T6, and when he applied for registration look what he got! It could have been worse, yes, and that is what everyone is telling him.
Overheard on the Frequency:
Photo: Frank Notes
Photo: pilotsengineerstechinfosite
Flying through Syrian airspace requires pilots to advise ATC of aircraft type and registration, so the correct route charges can be calculated. An American carrier was over-flying at 0200 in the morning. Syrian Controller – Ah… confirm you are a B767, registration N12345A? Pilot – (Slow American drawl)... Man, you’ve got good eyes! ••••••••••••••••••••••• Dublin ACC (Ireland): Pilot: “ Control, we’re getting some music on the frequency here.” ACC: “ Yeah, we’ve been getting reports of that alright. The music any good?” Pilot: (very serious tone) “ It seems like choir or church music.” ACC: (mocking) “ Eh, yeah, you should be hitting motown in a minute.”
Cabin Secure In this airline, if you report a problem, they take it seriously: 6 maintenance guys are coming immediately to fix the problem and they even take a photo as proof! I will fly in this Airbus A330 anytime! ^
charlie@the-controller.net
THE
CONTROLLER
35