N°6 January 2008

COLLISIONCOLLISION AVOIDANCEAVOIDANCE “Hindsight” The ability or opportunity to understand and judge THETHE RUNWAYRUNWAY ANDAND YOUYOU an event or experience after it has occured. ByBy IanIan WigmoreWigmore SeeSee pagepage 2222 THE APPLICATION OF OFFSET TRACKS IN EUROPEAN AIRSPACE BY ROLAND RAWLINGS See page 8

AIRBUSAIRBUS AP/FDAP/FD TCASTCAS MODE:MODE: AA NEWNEW STEPSTEP TOWARDSTOWARDS SAFETYSAFETY IMPROVEMENTIMPROVEMENT ByBy PaulePaule BotarguesBotargues SeeSee pagepage 2525

EUROCONTROL DAP/SSH January 2008 Advertisement

January 2008 Page 2 HINDSIGHT N°6 Contents

CONTENTS

Editorial Coding of Subject Matter Must we avoid conflict? 4 Left side, right side, wrong side? 5 To aid identification of subject matter, The application of offset tracks in each article is coded and marked by a coloured icon which appears at its European airspace 8 head. The sunshine is back 12 Changes to ICAO rules regarding TCAS RAs 14 Loss of Contact us 38 Separation Disclaimer 39

121.5 Safety Alerts Visual misidentification of aircraft Level Bust livery 16 Guarding 121.5 MHz 17 Call Sign Confusion 18 Level Restrictions - Amendments to Runway ICAO PANS-ATM 19 Incursion

The Briefing Room - Learning From Experience Displaying ACAS RAs to the con- Controlled Flight into Terrain troller: A human factors perspective 20 The runway and you 22 Airbus AP/FD TCAS mode: a new ......

. . . .

......

. .. .

. . .

step towards safety improvement 25 . .

.. .

. .

. .

. . .

Airspace Infringement . .

.

.

. .

. .

. .

...... Mid-air collisions, elephants, and . systems approaches 28 Alert controller prevents CFIT accident 31 Avoiding the conflict 34 Wake Vortex Turbulence

Editorial Team Editor in Chief Tzvetomir Blajev Human Factors Editorial Secretary Ian Wigmore Editorial Committee Bengt Collin; Dominique Van Damme; Yvonne Page; Jacques Air Ground Communication Beaufays; Max Bezzina; Alexander Krastev; Gilles Le Galo; Philip Marien; Stanislaw Drozdowski; Charlie Goovarts; Francois Cervo Other Management Board Jacques Beaufays; Antonio Licu; Manfred Barbarino; Gilles Le Galo; Tzvetomir Blajev

HINDSIGHT N°6 Page 3 January 2008 Editorial

MUST HINDSIGHT ALWAYS AVOID COLLISIONS?

By Tzvetomir Blajev Eurocontrol Co-ordinator Safety Improvement Initiatives and Editor in Chief of HindSight

Sit down and relax - I am going to write about collisions of opinions. Should HindSight allow controversial opinions to be published? To answer this question I need to answer another one first - What exactly is HindSight? The short answer is in the title of my first editorial of HindSight Edition 1 - “HindSight is a wonderful thing”. A somewhat longer answer is provided below.

HindSight is an “Aviation Safety Magazine for Air Traffic Controllers”. The concept is based on carefully balancing the style, content and scope around the four dimensions in the above sentence. Those dimensions are represented by tensions and are elaborated below:

1. Aviation Safety Magazine for Air Traffic Controllers.

Air Traffic Control point of view VERSUS Other points of view - pilots, airports, etc.

2. Aviation Safety Magazine for Air Traffic Controllers.

What we have learned from the past - VERSUS What may come in the future - lessons learned from investigations, new concepts, procedures, equipment reporting and normal operations and lessons learned from risk assessment

3. Aviation Safety Magazine for Air Traffic Controllers.

Presenting the “official” EUROCONTROL VERSUS Providing a forum for discussion and position and sticking closely to expression of opinions not necessarily technical documents endorsed by EUROCONTROL

4. Aviation Safety Magazine for Air Traffic Controllers.

Delivering to the practitioners the VERSUS Reflecting on what the “theory” practical “do's and don'ts” that can be says and giving the floor to researchers used directly in everyday practice and scientists.

Now back to the question. Must we avoid conflict? Is there censorship? My belief is that: HindSight must avoid: emotional conflict on a personal level. misleading the reader about standard procedures. HindSight should promote: argument based on facts. disagreement on matter of opinion. healthy and constructive discussion.

Enjoy the reading!

January 2008 Page 4 HINDSIGHT N°6 Editorial

FRONT LINE REPORT: LEFT SIDE, RIGHT SIDE, WRONG SIDE?

By Bert Ruitenberg

Bert Ruitenberg is a TWR/APP controller, supervisor and ATC safety officer at Schiphol Airport, Amsterdam,The Netherlands. He is the Human Factors Specialist for IFATCA and also a consultant to the ICAO Flight Safety and Human Factors Programme.

It was a quiet Sunday afternoon, late Until that day in March 1977, aircraft March 1977. Winter in the Netherlands collisions to me seemed like something was slowly giving way to spring, and I from the past. Admittedly there had was driving in my car to Eindhoven Air been a mid-air near Zagreb as recent Force Base where I had recently qualified as September 1976, but as a member as an Air Traffic Control Officer. Although of the troops in a NATO Air Force I sort it was a weekend, during which no mil- of accepted that such things would itary activities were expected, I had to go occur in Eastern Bloc countries.Tenerife tory carriage of ACAS to cargo aircraft, to the Tower to facilitate the arrival of a brought home to me the reality that since one of the two aircraft involved civil business jet from a company that aviation accidents can occur anywhere was a freighter without TCAS. shared the airport with the Royal in the world. Netherlands Air Force. Suddenly the What the accidents in Linate (2001), radio programme that I was listening to And indeed aircraft collisions (invol- Überlingen (2002) and Brazil (2006) in my car was interrupted for an extra ving commercial flights) have kept have painfully demonstrated is that news bulletin: there had been an acci- occurring since then, although they having TCAS in aircraft does not in dent involving two Boeing 747s on the still are rare occasions. In 1986 there itself help prevent a collision. In Linate runway at Tenerife, and one of the air- was a mid-air near Cerritos (Ca, USA), in the accident occurred on the ground, craft was Dutch. 1996 a mid-air near New Delhi, in 2001 i.e. a situation for which TCAS was not a runway collision at Milan Linate, in designed. In the Überlingen scenario I remember finding this news bulletin 2002 a mid-air near Überlingen, and in the TCAS in both aircraft worked per- quite shocking: even though at the time 2006 a mid-air over the Amazon in fectly according to specification, but I had been an ATCO for just a couple Brazil. sadly one of the flight crews involved of months, I realised that the scenario had not received the training to that had unfolded at Tenerife was a pro- It almost goes without saying that all adequately interpret its advisories. And fessional nightmare for every ATCO in those accidents were duly investigated, in the mid-air over the Amazon, pre- the world - this was the sort of thing that and the safety recommendations from liminary findings indicate that the we were trained to prevent, but here it the investigation reports have transponder and TCAS of one of the appeared to have happened with all the undoubtedly contributed to enhancing two aircraft was not functioning at the dire consequences. For the rest of that aviation safety around the world. In fact time of the accident, rendering the air- day I tried to listen to as many news bul- it was the Cerritos accident in 1986 craft electronically invisible to the letins on radio and TV as I could, to learn that resulted in the mandatory carriage other aircraft. more about the circumstances of the of Airborne Collision Avoidance accident. (This was 1977 - Internet and Systems (ACAS), of which the Traffic Which brings me to another common CNN didn't yet exist, so radio and public Alert and Collision Avoidance System factor in the New Delhi and Brazil mid- TV were the main information sources (TCAS) is the most widely used appli- airs: the aircraft were on exact recipro- for such events!) cation. The 1996 accident near New cal tracks. In the old days, when navi- Delhi resulted in extending the manda- gation was based on radio beacons

HINDSIGHT N°6 Page 5 January 2008 Editorial

such as NDBs and VORs, it was very rare are following the advisories, and the way centreline, i.e. a certain distance for aircraft on opposite tracks to pass "downlink" can still coincide with away from the centreline. Again on first exactly at the same position. There instructions from the controller(s) that glance most aviators will say this is a would usually be some inaccuracy in may or may not contradict the brilliant solution to re-create the the navigation systems as a result of advisories. So where's the gain? situation where there is some lateral air which the aircraft would pass each between passing opposite aircraft (in other laterally with some air in Another work-around discussion, addition to the vertical spacing). But between (as well as the vertical related to the New Delhi and Brazil here's the catch: depending on which spacing applied by ATC). If for some accidents, is the one about having air- side of the road the car traffic is in their reason the vertical spacing was lost, craft routinely fly "offset" from the air- country of origin, pilots will tend to there was still a good chance the air- craft would not collide because of that lateral inaccuracy. But not so in 1996 and beyond: the on-board navigation systems (INS, IRS, satellite) have become so accurate that aircraft are usually following the exact centreline of the assigned route - which of course removes the unintended-but-very-wel- come safety feature of having air between aircraft due to lateral inaccu- racy. If vertical separation nowadays is lost for some reason, the chance is very high that the aircraft will collide - the New Delhi and Brazil accidents provide tragic evidence of this.

The Überlingen accident has triggered a discussion about displaying TCAS advisories on the screens of air traffic controllers. At first glance that seems like a brilliant work-around to over- come some of the inherent flaws in the TCAS design, but on giving it some deeper consideration it may not be as simple a solution as it would seem. In my humble opinion, all it will do is shorten the time between the genera- tion of the advisory and informing ATC about it (which currently is done by R/T by the pilots concerned, at their earliest convenience). Other than that it resolves nothing, I think - ATC still doesn't know whether or not the pilots

January 2008 Page 6 HINDSIGHT N°6 Editorial

apply an offset that is either left or In the discussion about offset flying 45 metres roughly equals 0.025 NM, so right of the airway centreline…. (OK, there also appears to be some debate even if the regulators were to knock allow me to explain if you didn't get as to the distance to be used in the off- themselves out and opt for an offset that: picture two opposite aircraft of set. One mile, half a mile, less or maybe that is four times the required mini- which one is flying half a mile left of more - many figures are mentioned. mum, the distance would be 0.1 NM. the airway centreline. Now move the The discussion involves aspects such as This number is far less than any of the other aircraft half a mile right of the disturbance of the traffic picture on the numbers I've heard used in the current centreline, and see where they both screen of ATCOs, spacing with adjacent discussions. It would hardly disturb any end up!) routes, and whether or not the offset ATCO's traffic picture, and it would should be transparent to the pilots (i.e. hardly interfere with any spacing And here is some further information should the pilots even know that an requirements for adjacent routes. Feel on this offset flying: a number of airline offset is applied?). I'm not going to free to enter this viewpoint in any pilots are applying this already in real offer a solution to the discussion here, discussion on offset flying you may find life under their own authority - but but I'd just like to point out that the yourself involved in, and don't forget to apparently without realising the wing span of the world's largest insist on agreeing to all apply the off- left/right offset anomaly as described operational aircraft, the Antonov 225, is set on the same side of the centreline! above. I'd say some international just under 90 metres. Theoretically this regulation is required for routine offset implies that any distance larger than flying, and rather urgently too! half that span, i.e. anything more than 45 metres, should do the trick - as long as agreement is reached about appli- cation of the offset on the left or right side.

HINDSIGHT N°6 Page 7 January 2008 Editorial

THE APPLICATION OF OFFSET TRACKS IN EUROPEAN AIRSPACE by Roland Rawlings

Roland Rawlings is Navigation Manager within DAP/APN and as such is responsible for Navigation Strategy including the aviation applications of GNSS. This work addresses navigation issues for all phases of flight.

In his editorial Left Side, Right Side, makes up the majority of ECAC opera- Wrong Side? Bert Ruitenberg draws tions has not hitherto been studied. As attention to a safety concern that has a result no review has been under- arisen out of the improved perform- taken of the implications of such off- ance of aircraft navigation systems, sets and there exists no standard which allows aircraft to maintain tracks advice to pilots on such offset applica- with a degree of precision that was tions. unimaginable until recently. Calls for increased use of offsets The raw GPS position performance is intensified after the 29 September 2. a safety study to identify the lateral now better than 10 metres, and with 2006 mid-air collision in Brazil between overlap risk for opposite-direction automatic coupling, the accuracy with a Boeing 737-800 and an Embraer traffic taking into account GPS which an aircraft follows a defined Legacy 600 Business jet. The crash lateral accuracy as well as potential track can be within the dimensions of occurred while the two aeroplanes, mitigations. the airframe. This leads to a concern as which were being flown in opposite to the operational safety, especially directions, were on the same route and For the purpose of those studies, seven since, at cruise altitudes, a vertical at the same altitude. With previous bidirectional routes within the ECAC separation of 1,000ft between generations of navigation capability airspace were selected. The reason for opposite-direction aircraft cannot be the navigation inaccuracies meant that only selecting bidirectional routes is confirmed visually. there was only a very small probability that for single-direction routes the risk that such an error would result in a of collision due to a vertical error is A solution which has already been collision. Today, with the improved very low, since when the flight level implemented unofficially by some lateral and vertical accuracy, the risk of orientation scheme is employed air- pilots is to offset tracks by a small a collision resulting from such error is craft will have 2000 ft vertical separa- amount in order to ensure lateral significantly higher. tion, and when all flight levels are separation in the event of a flight level employed the low speed differential error. This action termed Strategic EUROCONTROL has recently under- between aircraft flying in the same Lateral Offsets, and for simplicity taken two studies to address these direction provides the risk mitigation. termed just “offsets” in this article, concerns with regard to ECAC airspace. should not be confused with tactical These are: It is important to note that in the core offsets applied by ATC to support ATM area of ECAC only 10% of routes are functions such as aircraft overtaking 1. an investigation of the operational bidirectional, the others being single- manoeuvres. The procedures for such and technical implications of the direction. The routes studied are the offsets have been developed for introduction of offset routes on air- seven busiest bidirectional routes remote and oceanic operations. craft onboard equipment, in- (more than 100 flights in one direction However, the applicability of such off- cluding a review of the capability per day) within the ECAC airspace. sets for high-density operation such as of existing FMS equipment; and, Outside of the core area and below FL

January 2008 Page 8 HINDSIGHT N°6 Editorial

290, a greater proportion of routes are The studies identified the following this could create memory/database dual-direction but the density of traffic points: problems. In proposing offset is low. 1. Investigation of the implications routes there is a risk of exceeding of the introduction of offset routes database capacity. One day's worth of traffic from seven on aircraft onboard equipment. segments of these routes was gathered Where there is an offset capability, and an investigation was made as to At present almost 20% of aircraft in for all but a small percentage of air- the aircraft onboard equipment used ECAC cannot carry out automatic craft the offset capability is for a on those routes and the navigational offsets and software upgrade (after minimum offset of 1 NM. Only a accuracy. This data was used to under- delivery) is expensive. For instance, small number of FMS types can take a risk analysis for opposite- by creating offset routes, the num- perform offset increments from 0.1 direction traffic. ber of waypoints will also expand; NM

Note: Red: routes with more than 100 flights per day in one direction Orange: routes with between 50 and 100 flights per day in one direction Green: routes with between 20 and 50 flights per day in one direction

Bidirectional routes in Europe with more than 20 flights a day

HINDSIGHT N°6 Page 9 January 2008 Editorial

There are a large number of ways offsets of 0.5 and 1 NM. An overall must be taken to ensure that offsets in which the offset is implemented factor of approximately seven is are not applied where they would be and this impacts the continuation obtained for offsets of 1.0 and 2.0 detrimental to safety. of offset during and after a turn NM. and the application of offset on CONCLUSION SIDS and STARS. For example some However, it is important to note the systems continue offset during a following: The safety analysis demonstrated that turn or on entry to STARS whilst a similar or even a larger the use of offsets in an ECAC environ- others cancel the offset. The decrease in risk can be ment has a very small effect on the differing implementations of entry expected from replacing the safety risk owing to the preponderance and exit of offsets (automatic bidirectional routes by pairs of of the risk arising from crossing traffic. and/or manual, intercept/rejoin unidirectional routes, which However, there could be a risk reduc- angle, etc.) could result in aircraft reduces the passing frequency; tion through the use of offsets when flying offsets where this is inappro- the use of direct routings, a they are applied correctly. In addition priate. common practice in the core they do provide better visual cues to part of ECAC, reduces the risk of the pilot as regards the separation of 2. Lateral overlap risk estimation and lateral overlap by the lateral aircraft. mitigations. dispersion of traffic; in an ECAC environment, offsets As a result, there appears to be no The lateral overlap risk has been would not significantly change intrinsic reason why offsets cannot be estimated from the combination of the system safety as crossing supported if it can be confirmed that the probability of lateral overlap traffic generates the dominant correct application can be assured. and the opposite-direction passing risk; frequency. In such estimations, it in many parts of ECAC, route Since the use of offsets could influence has been assumed that over 80% of spacing is at or close to the system safety there is a need to the aircraft would be using GNSS- minimum that can be develop criteria enabling the identifica- based navigation. The estimation supported by the navigation tion of where and how offsets can be has then been compared against performance requirement. The safety employed, and any limitations the upper bound of the global application of offsets in this that need to be applied. It will also be system performance specification situation would increase the necessary to define operational proce- for RVSM, showing that this has risk associated with the passing dures and training requirements for been exceeded. traffic on the neighbouring their application to ensure that such track. This is particularly im- offsets can be employed in a safe The effect of two track offsets to portant considering the offset manner. the right of the flight direction on capability of the large majority the probability of lateral overlap for of RNAV systems today is a ACCORDINGLY, THE FOLLOWING opposite-direction traffic has then minimum of 1 N mile. STEPS ARE PROPOSED BY been examined. Very small offsets EUROCONTROL: of 0.1 and 0.2 NM were found to Nevertheless, in view of the fact that reduce the probability of lateral there does remain an operational risk, That the number of bidirectional overlap for aircraft on the same albeit low, it would not be appropriate routes should be further reduced. track by a factor of approximately to ignore a potential means for risk This is already the target adopted three. A further factor of approxi- reduction. However, the contribution to by the Route Network mately two can be gained using safety will be relatively small and care Development Subgroup of the

January 2008 Page 10 HINDSIGHT N°6 Editorial

Airspace and Navigation Team and That if after review it is deemed the findings summarised above appropriate to allow offsets in give fresh impetus to this work. specific situations, the following will need to be developed by the That the remaining bidirectional appropriate Subgroup of ANT: routes should be further studied to establish whether offsets could be development of implementa- applied without reducing safety. tion rules; Specifically this would need con- development and publication sideration of the wide variety of of ATC and Pilot Procedures; implementations of offsets and the development of guidance impact of applying offsets on these material on the application of tracks and on neighbouring tracks. Strategic Lateral Offsets; It would also need to study the preparation of Pilot and ATC impact on safety of failing to awareness material. correctly cancel offsets in areas where offsets reduce system safety.

HINDSIGHT N°6 Page 11 January 2008 Editorial

THE SUNSHINE IS BACK

By Bengt Collin

Bengt Collin works at EUROCONTROL as an expert on the Advanced Surface Movement Guidance and Control System (A-SMGCS) Project (part of the Airport Operations Programme (APR)), and also for the Directorate of ATM Programmes (DAP/SSH).

Disclaimer: Although being based on a THE INBOUND CREW real incident, the characters in the story are completely made up by the author. “Why is white chocolate white, cocoa Any similarity with the persons involved isn't white is it?” He thought about this is entirely coincidental. just before landing. Now they had vacated the runway and they THE INVESTIGATOR contacted the ground controller. The controller cleared them to their stand It was winter; she walked alone in the at the south of the airport, and endless forest. The sound from her instructed them to hold before inter- boots on the dry snow was comforting; section Alfa. On taxiway Zulu south- THE GROUND CONTROLLER it brought back memories from her bound he instructed the first officer to childhood. It was not a lot of snow, just switch off the left engine, he saw an air- The atmosphere in the tower was slow enough to cover the ground and make craft crossing Alfa ahead of him, from but focused; everything was like a the pine trees look like in a Disney Terminal 2 to the outer taxiway, and normal day. He had been a controller movie. She loved walking by herself, it another on the apron, well to the left all his life and was very experienced. helped her to relax, she worked in a of a parked aircraft close to Alfa. He While other people would love every beautiful city, but it was a city filled could see the follow-me waiting at the second in tower, he thought of it as just with noise and stress; she preferred the entrance of the south ramp.The aircraft another routine day; in fact he some- countryside. Her phone rang, in a that crossed his taxiway ahead of him times even complained about the need second all the peacefulness was gone; turned north on the outer parallel taxi- of being there. He worked on one of she needed to return to Stockholm. way, suddenly he passed an aircraft on two ground positions; the traffic was the left, close… average, nothing special ever happened; another day closer to retire- ment. A few conflicts to sort out, easy job, the same job he did day in day out.

THE OUTBOUND CREW

“Why is the sun always shining in Stockholm?” the first officer thought to himself, the weather having been brilliant every time they had visited in the last few months. He never had time to visit the city; he liked coming here and the people he met were always very nice and professional. Perhaps next summer when it was warmer; out- side it was minus 4.

January 2008 Page 12 HINDSIGHT N°6 Editorial

Five minutes later all his thoughts were instruction to hold at an intermedi- focused on the flight; they push backed ate point: the clearance should be and requested taxi instructions for to the intermediate point instead. departure.They received and read back the instruction for runway 08, it was Controllers should not deviate from not via the published standard route standard taxi routes unless but via intersection Alfa; they did not absolutely necessary. complain, it was a shorter route. The captain was taxiing the aircraft. Just before leaving the apron, approaching Alfa, the first officer suddenly saw an aircraft coming from the right on taxi- way Zulu: “it is not stopping, STOP!” he shouted. It passed three metres ahead of them.

SUMMARY

Three aircraft were taxiing out from the ramp. It is believed that the inbound flight crew saw number one and three, but not number two, the conflicting aircraft (hidden behind an aircraft parked on gate 59G). Although the read-back was correct and they were very familiar with the airport, the pilots on the inbound aircraft did not hold as instructed before Alfa. The aircraft passed, without braking, a few metres in front of the second outbound air- craft, which braked hard to avoid a collision. The follow-me vehicle waiting at the south ramp, clearly visible ahead of the inbound aircraft, may have contributed to flight crew's distraction.

Why did this happen, and how can it be prevented in the future?

The investigation board recom- mended:

A clearance should not be given to a holding point or gate with an

HINDSIGHT N°6 Page 13 January 2008 Editorial

CHANGES TO ICAO RULES REGARDING TCAS RAS

By Stanislaw Drozdowski

Stanislaw Drozdowski is an ATM Expert at EUROCONTROL HQ in Brussels, working in the area of ground and airborne safety nets. Previously, he worked as a system engineer with Northrop Grumman and as an Air Traffic Controller in Poland and New Zealand.

In the last issue of HindSight, in my arti- another aircraft above were sometimes cle about TCAS and STCA (see TCAS reported as “TCAS Climb”. In fact the air- and STCA - not just anagrams, craft was still climbing but at a lower HindSight 5, July 2007, page 19) I rate. This gave the controller a false remarked that ICAO rules concerning indication that the TCAS resolution was RA reporting would change in the near telling the pilot to continue the climb future. ICAO has now published the towards the other aircraft. That caused, changes that will become applicable in some cases, the controller to issue an on 22 November 2007. Below is the instruction during the RA, resulting in summary of the changes to ICAO confusion on the flight deck and PANS-ATM (Doc 4444) and ICAO PANS- prolonged radio exchanges. In the event that the controller issues OPS (Doc 8168). a clearance or instruction contradictory On the other hand, controllers should to the TCAS RA, the flight crew will PHRASEOLOGY note that the new phraseology may follow the RA and inform the limit their awareness as to the direction controller: The first change concerns the RA of the movement of the aircraft report phraseology. The new phrase- responding to the RA. “UNABLE, TCAS RA” ology is: The pilots are now required to expli- The controller response to that RA “TCAS RA” citly announce the TCAS “Clear of con- report is an acknowledgement flict”message when the conflict is over: (“Roger”). The controller response to the RA report is an acknowledgement “CLEAR OF CONFLICT, RETURNING TO Previously, the “unable” phraseology (“Roger”). (assigned clearance)” included the direction of the RA (e.g. or “Unable, TCAS climb”) - this change is This change was implemented to “CLEAR OF CONFLICT, (assigned clear- in line with the RA reporting changes simplify RA reporting. Previously, pilots ance) RESUMED” as described above. were required to include the direction of the movement in their RA report (i.e. The controller response to the “Clear of WHICH RAs MUST BE “TCAS Climb” or “TCAS Descend”). That Conflict” report is an acknowledge- REPORTED? sometimes led to ambiguous situations ment (“Roger”) or provision of an alter- as no phraseology existed to report the native instruction. The second significant change most common RAs (Adjust Vertical concerns the types of RAs that must be Speed) and pilots often improvised The clear indication of RA termination reported. Previously, the pilots were their reports creating extra confusion will now allow the controller to required to report all RAs to ATC. With in the situation that was already stress- recognise when the RA is completed the change applicable on 22 ful for the controller. For example, and when he/she can start issuing November 2007 the pilots will report “Adjust vertical speed” RAs calling for clearances or instructions to the only those RAs that require a deviation the reduction of the climb rate due to affected aircraft. from the current ATC clearance or

January 2008 Page 14 HINDSIGHT N°6 Editorial

instruction (“As soon as possible, as manoeuvre induced by the RA. The tion may be inadvertently inaccurate as permitted by flight crew workload [the controller shall resume responsibility the position and altitude information pilots shall] notify the appropriate ATC for providing separation for all the are delayed in surveillance processing. unit of any RA which requires a devia- affected aircraft when: In some case controllers found issuing tion from the current air traffic control a) the controller acknowledges a traffic information difficult due to the instruction or clearance”). report from the flight crew that the proximity or overlap of the aircraft aircraft has resumed the current labels and symbols on the screen. Also, This change should eliminate reports clearance; or traffic information and the visual acqui- of RAs that are not significant for ATC, b) the controller acknowledges a sition of the intruder could prompt the i.e. those not leading to deviation from report from the flight crew that the pilots to stop responding to the RA.The the current clearance. That should aircraft is resuming the current amended paragraph 15.7.3.2 reads as cover the majority of RAs issued to the clearance and issues an alternative follows: fast climb or descending aircraft clearance which is acknowledged approaching their cleared level while by the flight crew.” “When a pilot reports an ACAS another aircraft is immediately resolution advisory (RA), the controller above/below. ICAO believed that these PROVISION OF TRAFFIC shall not attempt to modify the aircraft reports caused unnecessary workload INFORMATION flight path until the pilot reports “Clear for the flight crews and for ATC and has of Conflict”. therefore excluded them from the Until now, controllers were required to reporting requirement. provide traffic information to the air- Note - the most important principle of craft responding to the RA. This this paragraph remains in force - once an It should be noted that in some cases requirement has been removed as it is RA has been reported, the controller shall pilots may have difficulty to determine believed that at that point ATC traffic not attempt to modify the aircraft flight whether the RA is requiring a deviation information provides little added value path, until the pilot announces “Clear of from the current ATC clearance. to the flight crew and might be Conflict”. distracting. Moreover, traffic informa- WHEN DOES THE CONTROLLER CEASE TO BE RESPONSIBLE?

A change has been made clarifying the controller responsibility during an RA. Now, the defining moment when the controller ceases to be responsible is the departure from clearance or pilot report of an RA.

The amended paragraph 15.7.3.3 now reads: “Once an aircraft departs from its ATC clearance or instruction in compliance with an RA, or a pilot reports an RA, the controller ceases to be responsible for providing separation between that air- craft and any other aircraft affected as a direct consequence of the

HINDSIGHT N°6 Page 15 January 2008 121.5 Safety Alerts

121.5 SAFETY ALERTS

SAFETY REMINDER THE PROBLEM POTENTIAL SOLUTIONS

MESSAGE SUMMARY When being provided with local traffic For these reasons, ATC must take information by the aerodrome or particular care, when describing VISUAL MISIDENTIFICA- ground controller, confusion and ambi- aircraft in local traffic information, TION OF AIRCRAFT guity have been reported as regards particularly as regards the use of the aircraft livery of the traffic in ques- conditional clearances. LIVERY tion. Therefore, where it is deemed by Origin: Aircraft Operator When issuing local traffic informa- ATC necessary, as a means of pro- Issued: 26/04/2007 tion in the aerodrome control viding additional clarity, to refer an service (including the use of condi- aircraft's operating agency name or tional clearances), ICAO PANS-ATM radiotelephony designator in either provides that the aircraft type local traffic information or during represents an integral element. coordination between control PANS-ATM also provides, in the positions in the aerodrome control context of essential local traffic, tower, ATC should ensure (prefer- that the traffic is to be described ably by visual observation) that the "so as to be easily identified". To aircraft's livery is in fact consistent this end, controllers often provide, with the livery that would be in addition to the aircraft type, the expected for the aircraft in name of an aircraft's operating question. agency or the operating agency's corresponding radiotelephony Regarding conditional clearances, designator, e.g. “FOLLOW THE controllers and pilots will recall that BRITISH AIRWAYS A340”. they are required to visually identify the aircraft/vehicle causing As a result of recent developments the condition. It is of utmost in areas of commercial cooperation importance that this identification among many aircraft operating procedure is carried out correctly. agencies, liveries of commercial air- There must be no doubt as to craft are often no longer entirely whether the correct object has consistent with the expected been identified. liveries of their operating agencies.

The photographs below illustrate this point well. In either case, it would be hard to decide immediately which air- craft the instruction “FOLLOW THE LUFTHANSA” or “FOLLOW THE AIR CANADA” applied to.

January 2008 Page 16 HINDSIGHT N°6 GUARDING 121.5 MHZ

REQUEST FOR 121.5 MHz in areas or over routes normal level when the distraction where the possibility of interception of has ceased and on one occasion, SUPPORT MESSAGE aircraft or other hazardous situations this contributed to loss of SUMMARY exist, and a requirement has been communication and subsequent established by the appropriate interception of an aircraft; GUARDING 121.5 MHZ authority. Note: Interference or inappropriate use of 5.2.2.1.1.3 Recommendation - Aircraft the emergency VHF frequency should Origin: European ANSP on flights other than those specified in always be reported to the appropriate Issued: 12/06/2007 5.2.2.1.1.1 and 5.2.2.1.1.2 should guard national authorities. [Ed.] the emergency frequency 121.5 MHz to the extent possible. some operators also monitor other THE PROBLEM frequencies when possible, e.g. 5.2.2.1.3 Aeronautical stations shall 123.45 in remote geographic areas; A European Air Navigation Service maintain a continuous listening watch all aircraft operating in U.S. airspace Provider, within the context of a signif- on VHF emergency channel 121.5 MHz are required to maintain a listening icant number of “loss of communica- during the hours of service of the units watch on frequency 121.5; tion” events, shared the findings made at which it is installed. some operators reported that mon- locally: itoring of 121.5 or 123.45 had enabled them to assist, or be There is no firm requirement for air- SUPPORT REQUESTED assisted by other aircraft following craft to guard 121.5 MHz except for loss of communication; designated areas, long over-water Readers were requested to share their the use of ACARS often enables the flights and areas where there is a national and company provisions emergency frequency to be risk for interception; however, there regarding monitoring of 121.5 MHz. guarded continuously because the is a recommendation to do so. second VHF radio is not required As regards aeronautical stations, for weather broadcast, etc.; they are required to guard RESPONSE one ANSP stated that in their 121.5 MHz. region, emergency calls are Responses were received from a wide responded to by the Flight range of operators and ANSPs: Information Centre, who coordi- ICAO PROVISIONS IN ANNEX 10 nate response with other stations if VOLUME II two operators stated that it was necessary. For operational reasons, company policy to monitor the monitoring of 121.5 MHz is not 5.2.2.1.1.1 Aircraft on long over-water 121.5 MHz continuously; compulsory for other national flights, or on flights over designated 12 operators stated that company Aeronautical Stations; areas over which the carriage of an policy was to guard 121.5 MHz one responder commented that, if emergency locator transmitter is whenever feasible; a significant number of losses of required, shall continuously guard the only one operator reported that it communication occur, efforts VHF emergency frequency 121.5 MHz, was company policy not to moni- should be focussed on finding the except for those periods when aircraft tor 121.5 MHz; reasons for the losses of communi- are carrying out communications on several operators pointed out that cation and appropriate remedial other VHF channels or when airborne it was often necessary to reduce solutions. equipment limitations or cockpit the volume on the emergency duties do not permit simultaneous frequency below the normal guarding of two channels. audible threshold due to inter- ference or inappropriate use of the 5.2.2.1.1.2 Aircraft shall continuously frequency. Sometimes, pilots forget guard the VHF emergency frequency to restore the volume to the

HINDSIGHT N°6 Page 17 January 2008 CALL SIGN CONFUSION

SAFETY REMINDER THE PROBLEM Recognising the risk associated with similar call signs MESSAGE SUMMARY There have been an increasing EUROCONTROL is investigating the number of similar call signs possibility of implementing system CALL SIGN CONFUSION instances reported to solutions aimed at removing the EUROCONTROL. The reports are risk potential as early as the flight Origin: European Safety Programme provided within the voluntary planning phase and by involve- Issued: 09/10/2007 safety incident reporting and data ment of CFMU. sharing initiative. European Action Plan for Air The use of similar call signs by air- Ground Communications Safety craft operating in the same area on the same RTF frequency often While pursuing long term strategy gives rise to potential and actual for removing the hazard at the flight safety incidents. source, we would like to remind the Aircraft Operators, ANSPs and The danger of an aircraft taking national authorities about the and acting on a clearance intended recommendations and best for another is obvious. The practices contained in the following are some of the potential European Action Plan for Air outcomes of such a situation: Ground Communications Safety the aircraft takes up a heading available on: or routing intended for http://www.eurocontrol.int/ another; safety/gallery/content/public/ the aircraft commences a library/AGC_action_plan.pdf climb/descent to a level to which it has not been cleared; Training and awareness material is the aircraft leaves the appro- available on www.allclear.aero. priate RTF frequency; in responding to a message, the aircraft blocks a transmission; the intended recipient does not receive the clearance, and fails to take up the desired heading or routing, or fails to climb or descent to the cleared level; the controller misunderstands the intentions of aircraft under his/her control; the controller issues a clearance to the wrong aircraft, and/or fails to issue a clearance to the intended aircraft; the workload of controllers and pilots is increased because of the necessity to resolve the confusion.

January 2008 Page 18 HINDSIGHT N°6 LEVEL RESTRICTIONS - AMENDMENTS TO ICAO PANS-ATM

SAFETY WARNING CLIMB ABOVE LEVEL LEVEL RESTRICTIONS ISSUED PUBLISHED IN SID EXPLICITLY BY ATC MESSAGE SUMMARY When given a clearance to a level In all cases, level restrictions issued LEVEL RESTRICTIONS - higher than that specified in a SID explicitly by ATC in air-ground AMENDMENTS TO ICAO or initially cleared, follow the communications shall be repeated published profile unless restric- by ATC in conjunction with sub- PANS-ATM tions are specifically cancelled. sequent level clearances in order Example of phraseology to cancel for such level restrictions to remain Origin: EUROCONTROL Airspace Network level restrictions could be: in effect. Example of phraseology Planning & Navigation which would have the effect of Issued: 26/10/2007 First transmission cancelling level restrictions could be: “CLIMB TO 6000 FEET KODAP 1 AMENDMENT TO ICAO DEPARTURE” First transmission PANS-ATM Second transmission “CLIMB TO FL 210 CROSS ALPHA AT There was a potential for FL 100 OR BELOW” unintended level deviations due to “CLIMB TO FL 210 LEVEL RESTRIC- flight crews and controllers TIONS KODAP 1 DEPARTURE Second transmission interpreting the continued validity CANCELLED”. of level restrictions differently. “CLIMB TO FL 250”

To ensure an unambiguous under- DESCENT BELOW LEVEL standing of the PANS-ATM PUBLISHED IN STAR provisions pertaining to the validity/applicability of level restric- Follow the published vertical tions, new procedures (ref.: PANS- profile of the STAR unless ATM paragraphs 6.3.2.4, 6.5.2.4, specifically cancelled by ATC and 11.4.2.5.2.5 and Chapter 12) were always apply minimum levels developed (applicable on 22 based on terrain clearance. November 2007). Example of phraseology to cancel level restrictions could be: Some elements of the procedures are outlined below. “DESCEND TO 5000 FT LEVEL RESTRICTIONS KODAP 1 ARRIVAL CANCELLED”.

HINDSIGHT N°6 Page 19 January 2008 The Briefing Room - Learning from Experience

DISPLAYING ACAS RAS TO THE CONTROLLER: A HUMAN FACTORS PERSPECTIVE by Doris Dehn

Doris Dehn is a cognitive psychologist specializing in Human Factors in Air Traffic Management. She has worked at the Institute for Aeronautics and Astronautics at the Berlin University of Technology, the National Aerospace Laboratory of the Netherlands, and is now a Human Factors Expert at EUROCONTROL.

Downlink of ACAS Resolution tion of traffic by modifying aircraft Advisories (RAs) for display to the flight paths. The pilot is required to controller - commonly referred to as RA follow ATC instructions. With an RA, the downlink - is a topic most controllers controller must not try to ensure will have an opinion on. On one side of separation of the aircraft affected any becoming aware of an RA is via the the spectrum, there are those who more.The pilot is required to follow the pilot report. But what if the report from maintain that RA downlink creates RA and disregard any ATC clearances. the pilot is incomplete, incorrect, more problems than it solves. On the delayed or even missing? This is more other side, there are those who would So, how do controllers and flight crew than just an academic question - data like to see RA downlink implemented know about this fundamental change derived from incident reports as soon as possible. What can be said in responsibility? For the pilot, it seems published by the Swiss Aircraft about RA downlink from a human to be straightforward: Any RA needs to Accident Investigation Bureau indicate factors perspective? be followed (unless of course doing so that only 28% of RAs are reported would jeopardise the safety of the air- correctly and in time. The number of THE PROBLEM: ACAS RAS plane). Thus, if an RA is issued, the pilot RAs that are never reported is equally INITIATE A DRASTIC CHANGE knows that it takes precedence over high at 28% (see graph below). IN RESPONSIBILITY the ATC instruction (provided, of course, that they are given appropriate Unfortunately, there is no quick fix to The existence of an ACAS RA has direct ACAS training). make pilot reports timely and consequences for the tasks of both the accurately in all cases. Rigorous pilot aircrew and the air traffic controller: For the controller, the situation is more training on ACAS procedures will pilots are required to immediately complicated: currently, the only way of probably help to improve RA reporting, comply with all RAs, even if they are contrary to ATC clearances or instruc- tions. The controller, on the other hand, is not allowed to modify the aircraft flight path “once an aircraft departs from ATC clearance in compliance with an RA or a pilot reports an RA” [ICAO Doc 4444: PANS-ATM, para. 15.7.3.3].

Thus, the occurrence of an RA fun- damentally changes pilot and con- troller tasks and responsibilities. Analysis of RA reports in Switzerland from 1999 to 2003 Without an RA (that is, under normal [Graph based on data available on www.bfu.admin.ch] circumstances), the controller's first and foremost task is to ensure separa-

January 2008 Page 20 HINDSIGHT N°6 The Briefing Room - Learning from Experience

but it is unlikely to sort out the troller/pilot responsibility. What it can First of all, not all RAs require a depar- problem completely. For the pilot, an do, though, is to make the controller ture from the ATC clearance and, hence, RA is a stressful situation and - for very aware that a departure from ATC affect controller responsibility. This is good reasons - RA reporting has a clearance is due to an RA and, thus, that one reason why in the future pilots will lower priority than complying with the the condition for a shift in responsi- limit RA reporting to those RAs that RA and trying to avoid a collision. bility has been met. cause a departure from ATC clearance Therefore, it is reasonable to assume [ICAO Doc 8168: PANS-OPS, Volume I, that there will be always some delayed, If the RA downlink occurs before the Part III, Section 3, Chap. 3, applicable as incorrect or even missing RA reports. pilot report or the aircraft manoeuvre of 22 November 2007]. In order to (and thus before controller responsi- avoid inconsistencies between pilot RA DOWNLINK: A POSSIBLE bility ceases), it still has a benefit: it reporting and RA downlink, it may be SOLUTION? informs the controller on the direction better to restrict RA downlink of the RA. This makes it rather unlikely accordingly. In the light of the above, the potential that the controller will issue an instruc- benefit of RA downlink is rather tion that contradicts the RA. Another concern relates to the obvious: it gives the controller more situation where the pilot does not reliable and timely information on an So far, the argument is based on a con- comply with the RA. If the pilot neither RA. And this information is crucial for sideration of pilot and controller tasks follows the RA nor reports it, the con- establishing that ATC is no longer and the information needed to per- troller is still responsible for the responsible for an aircraft. One could form them. But do we actually have separation of that aircraft. RA downlink argue, though, that there is another evidence for the suggested benefits of may lead the controller to mistakenly way of establishing that responsibility RA downlink? believe that the pilot will comply with has ceased - the controller observes the RA and hence that responsibility the aircraft depart “from ATC clearance There is, in fact, data that supports the has ceased. Although this is a valid in compliance with an RA”. But hang on: benefits of RA downlink. In a series of concern, the underlying problem how can the controller know that the EUROCONTROL simulations carried out seems to be independent of RA down- aircraft departed from the clearance within the Feasibility of ACAS RA link. Can the controller be responsible because of an RA (and not for any Downlink Study (FARADS) project, it for separation of an aircraft whose pilot other reason), if there is no pilot was found that RA downlink increases ignores an RA? And what if the pilot of report? the controllers' understanding of the the conflicting aircraft intends to traffic situation related to the RA event. follow the RA? Thus, we are brought back to the initial And, more importantly, it decreased the argument: an RA triggers a fundamen- number of contradictory clearances to CONCLUSION tal change in pilot and controller an aircraft involved in an RA encounter. responsibility.The only way for the con- Furthermore, no evidence was found RA downlink is undoubtedly a complex troller to learn about this change is the that RA downlink narrows the con- topic. Nevertheless, the complexity pilot report, but pilot reports are often trollers' attention to the RA event, and arises from the intricacies related to delayed, incorrect or missing. In this prevents them from attending to other integrating ACAS with the ground situation, RA downlink can help the traffic in the sector. (human-machine) system, rather than controller to identify that he or she is the downlink itself. In spite of this, there not responsible for aircraft separation SOME CAVEATS AND is evidence for benefits of RA downlink: any more. CONSIDERATIONS RA information can help the controller identify that he or she is no longer To be very clear: on the basis of current In spite of the encouraging results so responsible for aircraft separation and, and new ICAO regulations, RA down- far, there are issues related to RA down- thus, can decrease the likelihood of link would not affect the status of con- link which need further consideration. contradictory clearances.

HINDSIGHT N°6 Page 21 January 2008 The Briefing Room - Learning from Experience

THE RUNWAY AND YOU

by Ian Wigmore

After thirty years flying with the Royal Air Force, Ian Wigmore commenced a career in civil aviation, working for two airlines before joining ERA as Air Safety Manager. He cur- rently works as an aviation consultant specialising in airline safety.

It is an interesting fact that most air But if an incursion takes place as a clear traffic controllers think of the runway result of their (incorrect) actions or as their territory - like the area inside omissions, even though an accident the fence around their gardens at was avoided, the feeling of failure is home. They protect it from intruders immense. Despite all their training and with as much care as they use to keep experience they have somehow com- stray dogs off their roses, or small boys mitted a fatal (or near-fatal) error; they out of their apple trees (well, with a lot have let themselves down and under- more care really). mined that essential trust between pilot and controller. incident shift, which began at 2245.The The runway is the springboard from controller stated that he tried to avoid which all flights depart and to which I want to look briefly at some runway midnight shifts whenever possible they later return, and it is the con- incursion incidents which took place in because of fatigue; at the time of the trollers' job to manage aircraft so that USA in recent years. There are common incident he was feeling tired, in part the maximum use is made of the run- features in them all - features for which because he knew he “…had to be up way consistent with safety. They rightly we should be on the look-out - which all night long on a double quick turn- take pride in their skill in keeping con- we should try to eliminate from our around.” flicting traffic apart. They are acutely own operations. aware of the danger of allowing an air- DENVER INTERNATIONAL craft or vehicle to enter the active run- SEATTLE/TACOMA AIRPORT, SEPTEMBER 25, 2001 way when it is in use by another air- INTERNATIONAL AIRPORT, craft. JULY 8, 2001 A Boeing 757 departed from runway 8 in night-time VMC. Runway 8 had been Runway incursions don't happen very A controller issued a taxi clearance to closed because of construction work- often, but when they do, they always a Boeing MD-80 to cross runway 34R at ers and equipment operating near its leave the controllers involved asking the same time that a Boeing 767 was departure end and, during takeoff, the themselves if they could have been at on short finals to the same runway. The aircraft passed within 32 feet of lights fault. They know that there could have pilots in the landing aircraft reported that had been erected to illuminate the been an accident, so even if their per- applying maximum braking to avoid a construction area. The controller hand- formance was perfect and they should collision with the crossing aircraft, and ling the 757 was aware of the runway have a clear conscience, they still find the 767 stopped only 810 feet short of closure and had instructed the crew to themselves worrying in case there was the MD-80. On the night of the taxi to a different runway. However, some little extra thing that they could incident, the controller was working his after the crew requested take off on have done. There are many sleepless third shift in 2 days, with an 8-hour rest runway 8, the controller agreed and nights when the whole scenario is period between shifts. The day before instructed the crew to taxi and take off relived while they examine their every the incident, he had worked from 1400 from the closed runway. The controller action with an intensity hardly to 2200, slept between 4 and 5 hours had worked a shift at the tower from matched by the investigation board, to at home, worked from 0555 to 1355 the 0530 until 1330 the day before the see if it could have been improved or day of the incident, slept 3 hours at incident and then had a 9-hour rest augmented in some way. home and then returned to work the period during which she obtained

January 2008 Page 22 HINDSIGHT N°6 The Briefing Room - Learning from Experience

between 60 and 90 minutes of sleep. the previous day until 2130 and was This latter accident prompted the NTSB She then returned to work the incident then off duty for 9 hours. Because of to write to the FAA and the US con- shift, which began at 2230.When asked commuting and personal activities, he trollers' union, and their letter2 and why the incident occurred, the con- slept only about 4 hours before associated data merit serious study. In troller stated that she was “…probably returning to work for the incident shift, this letter, the NTSB noted that all four tired, not alert enough.” which began at 0630. He reported that controllers involved in the incidents he felt “semi-rested”during his shift but described above were working rapidly LOS ANGELES INTERNATIONAL was “not as sharp as he could have rotating counterclockwise3 shift AIRPORT, AUGUST 19, 2004 been.” He stated that the second shift schedules and had received scheduled had been a quick turnaround with “no rest periods of 9 hours or less before A controller cleared a Boeing 737 to coffee.” coming to work. They stated that “in taxi onto and take off from runway 24L view of the high percentage of con- at the same time that a Boeing 747 had The effects of fatigue on controller per- trollers who work such schedules and been cleared to land on the same run- formance have been under study in research carried out by FAA's Civil way and was on a short finals. The USA for many years, and the issue was Aerospace Medical Institute, the pilots in the landing aircraft saw the raised again following the fatal probability is very high that controllers 737 taxi onto the runway and dis- accident involving a Comair CRJ-100 are sometimes working when they are continued their approach about 12 which crashed while attempting to significantly fatigued and are commit- seconds before the impending take off from the wrong runway at ting fundamental errors directly as a collision would have occurred, passing Lexington Blue Grass airport on August result of being fatigued.” approximately 200 feet above the 737 27, 2006. During its investigation, the during the go-around. The controller NTSB learned that the air traffic con- According to the NTSB letter, one con- had worked a shift the previous troller who cleared the accident aircraft troller who committed an error that led evening from 1530 until 2330, then for takeoff had worked a shift from to a runway incursion event reported went home and slept between 5 and 6 0630 to 1430 the day before the that, although he had been diagnosed hours before returning to work the accident, then returned 9 hours later to with a sleep disorder 7 years before the incident shift, which began at 0730.The work the accident shift from 2330 until incursion, he had discontinued the controller described the portion of his the time of the accident at 0607 the treatment prescribed by his doctor shift before the incident as a “hard day” next morning. The controller stated within two years because of side and attributed his error, in part, to that his only sleep in the 24 hours effects and had not sought further fatigue. before the accident was a 2-hour nap medical evaluation. When asked about the previous afternoon between these controller awareness of fatigue-related CHICAGO O'HARE two shifts. In its final report on this issues, a supervisor on duty during the INTERNATIONAL AIRPORT, accident1, the NTSB concluded that the incident involving this controller said MARCH 23, 2006 controller did not detect the flight she did not know the extent to which crew's attempt to take off on the controllers were aware of fatigue- A controller cleared an Airbus A320 to wrong runway because, instead of related issues, that controllers did not cross runway 4L and, less than 15 monitoring the airplane's departure, he discuss fatigue among themselves, and seconds later, cleared a Boeing 737 to performed a lower-priority administra- that they were “just used to being take off on the same runway. The pilots tive task that could have waited until tired.” A controller who was on duty in the departing 737 observed the he transferred responsibility for the air- during another runway incursion was A320 moving toward the runway, plane to the next ATC facility. The also asked about controller awareness rejected the takeoff, and stopped extent to which fatigue was a factor in of fatigue-related issues. He stated, before reaching the taxiway intersec- the controller's decision could not be “Recently they mentioned something tion where the A320 was to cross. The established. to us about fatigue, but it's never been controller had worked an 8-hour shift an issue.”When queried about whether

1 The final report was not posted on the NTSB website at the time of writing, but the statements quoted are contained in http://www.ntsb.gov/recs/letters/2007/a07_44_48.pdf 2 See http://www.ntsb.gov/recs/letters/2007/a07_30_32.pdf, which also contains references to the full incident reports. 3 Counterclockwise shift schedules are characterised by progressively earlier start times

HINDSIGHT N°6 Page 23 January 2008 The Briefing Room - Learning from Experience

he felt fatigued during midnight shifts, 24/7 basis, then most controllers will potential dangers; then controllers the controller stated, “Yes, but not so have to work anti-social shifts and should be helped to develop personal where I can't do my job.” A supervisor some measure of fatigue is bound to strategies to deal with fatigue. on duty during the same incursion result. In its way, fatigue in aviation can EUROCONTROL has done some ex- incident commented, “controllers here be as dangerous as it can behind the cellent work in this area; for example, don't think fatigue is a problem.” wheel of a car: the difference is that we their brochure: Fatigue and Sleep can't pull over to the side of the road Management contains an in-depth The letter continues: “When faced with when we feel drowsy - we have to do study of the effects of sleep circadian disruption and short rest something else about it. deprivation, written in an easy-to-read periods, it is essential that controllers style, and associated with practical tips use personal strategies to maximise There may be room for improving work to help the controller. These tips are restorative sleep and minimize fatigue. schedules to minimise the occurrence published separately in an associated However, some controllers may have of fatigue, and this should be the leaflet. personal habits that exacerbate the subject of on-going discussions fatigue caused by shift work. For between employers and unions, based Team Resource Management (TRM) is example, the controller involved in the on the reported experiences of con- another important tool in this battle, March 23, 2006, runway incursion had trollers. Controllers should be en- encouraging controllers and super- only 9 hours off duty before reporting couraged to report incidents when visors to work together as a team to for the incident shift. He arrived home they feel affected, even though no eliminate error. If TRM is a new concept from his previous shift about 2200, error results, so that adjustments to to you, have a look at the engaged in routine activities at home, work schedules target the real danger EUROCONTROL TRM leaflet. You can fell asleep while watching television areas. find all these products on the New between 0100 and 0130, and slept only Human Factors Documents website4. 4 hours before getting up to prepare At the same time, efforts should be More detailed information on running for his next shift, which began at 0630. made to combat the effects of fatigue. TRM courses can also be found on the That he obtained only 4 hours of sleep A first step should be to increase Human Factors Publications website5. before his next shift suggests that this awareness of the problem and its controller may not have been using effective personal strategies to obtain adequate sleep. This practice may not be unusual. In fact, few controllers interviewed by the NTSB during the investigation of recent runway incursions have reported using comprehensive personal strategies for maximizing restorative sleep between shifts.”

Controller fatigue is just as much of a problem in Europe as it is in the USA; although like the Americans, it is not a subject that we discuss widely. Most controllers accept fatigue as a fact of life, inextricably associated with their job, and perhaps they are right. After all, if civil aviation is to operate on a

4 http://www.eurocontrol.int/humanfactors/public/standard_page/10_newsletter_other.html 5 http://www.eurocontrol.int/humanfactors/public/site_preferences/display_library_list_public.html

January 2008 Page 24 HINDSIGHT N°6 The Briefing Room - Learning from Experience

AIRBUS AP/FD TCAS MODE: A NEW STEP TOWARDS SAFETY IMPROVEMENT by Paule Botargues

Paule Botargues works in the Engineering Automatic Flight System Department of AIR- BUS France. She is in charge of the multi-program development of the AP/FD TCAS Mode and also of research activities for the auto flight system.

TCAS has been introduced in order to quite unfamiliar to pilots, and disrupts reduce the risks associated with mid-air the current flying technique they had collision threats; today this safety goal at the time of the RA occurrence, which has been reached. Yet many incidents adds to their stress level. (“near misses”) do still occur despite the presence of TCAS. AIRBUS has carried out an in-depth analysis of the need expressed by air- The in-line operational feedback lines' pilots regarding human factor analysis shows that there are some studies linked to TCAS system and rec- the V/S target associated to the RA, opposite reactions, many late reactions ommendations given by airworthiness with the adequate authority. and overreactions from aircrews to authorities. The result of this study is TCAS Resolution Advisories (RA) the development of a new concept to If the FD is ON and AP is OFF, the leading to injuries in the cabin, undue support pilots flying TCAS RAs: the TCAS mode automatically engages aircraft trajectory deviations from the AP/FD TCAS mode. on the FD; the FD crossbars provide latest ATC clearance and even to an unambiguous order to the pilot altitude busts, as well as lack of proper The AP/FD TCAS Mode is a guidance who has to simply fly and centre communication from the crew to the mode built-in the Auto Pilot computer the crossbars so as to control the ATC when an RA occurs. which allows the pilot to automatically V/S of the aircraft to the V/S target fly the RA if the AP is ON or to hand- of the RA (into the green “fly to” This feedback shows that the root fly the RA by obeying the Flight vertical speed zone and out of the cause of such crew misbehaviour is the Director command bars if the AP is OFF. red vertical speed zone). surprise and stress created by the RA, which directly affects the performance The AP/FD TCAS guidance mode con- If the AP and FDs are OFF at the of the pilot. trols the vertical speed (V/S) of the air- time of the TCAS RA, the FD bars craft on a vertical speed target adapted will then automatically reappear The present RAs are indicated to the to each RA, which is acquired from with TCAS mode active, assisting pilots by an aural message specifying TCAS. It is designed to respect the TCAS the pilot as here above. the type of the Advisory (Climb, hypothesis regarding the dynamics of descent, monitor, adjust…), and by the reaction as well as to minimise the The AP/FD TCAS mode behaviour can green/red zones on the Vertical Speed deviations from the latest ATC clear- now be detailed regarding the kind of Indicator (VSI) specifying the ance, as recommended by the proce- RA triggered by the TCAS: manoeuvre the pilot has to fly; in order dures. The AP/FD “TCAS” mode is auto- In case of a Corrective RA to fly this required manoeuvre the pilot matically triggered in any of the (e.g.“CLIMB”, “DESCEND”, “ADJUST”, has to switch both Auto Pilot (AP) and following TCAS RA cases: etc. aural alerts), the aircraft vertical Flight Director (FD) to off, and adjust If the AP is ON, the TCAS mode speed is initially within the red VSI the pitch of the aircraft so as to get the automatically engages on the AP; zone. The requirement is then to fly proper V/S. This flying technique is the AP then guides the airplane to out of this red zone to reach the

HINDSIGHT N°6 Page 25 January 2008 The Briefing Room - Learning from Experience

in accordance with last ATC clearance: The AP/FD longitudinal mode reverts to the “vertical speed” (V/S) mode, with a smooth vertical speed target towards the FCU target altitude (eg +/or - 1000 ft/mn). The ALT mode is armed to reach the FCU target altitude (last clearance altitude provided by ATC). The lateral mode remains unchanged. Figure - PFD upon a Corrective TCAS RA "ADJUST V/S, ADJUST" This design ensures that the aircraft green one, near the boundary of vertical speed as is, out of this red will be guided back towards the the red/green V/S zones to VSI zone. Consequently in case of a initially cleared altitude by ATC, as minimise the vertical deviation Preventive RA: expected. from initial ATC clearance. The current AP/FD longitudinal Consequently in the case of a mode is kept, if it ensures that It should be noted that the AP/FD TCAS Corrective RA: current vertical speed is Mode described above comes in The TCAS longitudinal mode maintained. If not, the current addition to the whole already existing engages. It ensures a vertical longitudinal mode reverts to TCAS RA features (traffic on Navigation guidance to a vertical speed the “vertical speed” (V/S) mode Display, aural alerts, vertical speed target equal to red/green with a target synchronised on green/red zones materializing the RA boundary value ± 100 ft/mn the current vertical speed. on VSI). within the green vertical speed The TCAS mode is automatically zone, with a pitch authority armed, in order to raise crew The operational benefits of the AP/FD increased up to 0.3g. awareness on the RA situation, TCAS mode solution are numerous; it All previously armed modes are and because a Preventive RA addresses most of the concerns raised disarmed except the altitude may turn into a Corrective RA if by the in-line experience feedback: capture mode (ALT) in case of the collision risk situation gets the "ADJUST V/S" RA, which more severe. It provides an unambiguous flying prevents undue altitude busts: All previously longitudinal order to the pilot, and thus the vertical speed 0fpm is never armed modes are automatically eliminates risks of confusion during within the Red V/S zone of such disarmed, except for ALT mode; the RA and once Clear of Conflict. RA. indeed a Preventive RA never The current engaged lateral forbids a level off, which means The flying order is adjusted to the mode remains unchanged. that the vertical speed 0fpm is severity of the RA; thus it reduces never in the Red VSI zone. the risks of overreaction by the In the case of a Preventive RA (e.g. Keeping ALT armed thus crew, minimises the deviations “MONITOR V/S” aural alert), the air- prevents undue altitude busts. from trajectories initially cleared by craft vertical speed is initially out of ATC, it adapts the load factor of the the red VSI zone. The requirement Once Clear Of Conflict, the ex- manoeuvre and reduces pertur- is then to maintain the aircraft pectation is to resume navigation bations in the cabin.

January 2008 Page 26 HINDSIGHT N°6 The Briefing Room - Learning from Experience

Figure - FMA upon a TCAS RA sequence

The availability of such an AP/FD late reactions to TCAS RAs AP/FD TCAS Mode was demonstrated TCAS mode makes it possible to overreactions to TCAS RAs to a large panel of airlines (Air France, define simple procedures for the opposite reactions to TCAS RAs North West Airlines, Lufthansa, British aircrews, eliminating any disruption misbehaviour when CLEAR of Airways, KLM, SAS, United Airlines) and in their flying technique: the CONFLICT was perceived by them as a simple and procedure is simply to monitor the lack of adequate communica- intuitive solution really consistent with AP or to hand-fly the FD bars when tions with ATC. current Airbus auto flight system and TCAS mode engages while cockpit philosophy. All of them agreed monitoring the VSI scale. Finally it is important to underline that that AP/FD TCAS Mode represents a the introduction of the AP/FD TCAS fundamental safety improvement in Such simple and straightforward mode is transparent from the con- reacting to TCAS-RAs. procedures reduce pilot stress and troller point of view as far as this mode possible associated confusion (as is guiding on (or performing) a for example with the "Adjust V/S manoeuvre, which is the same as the Adjust" RA). Therefore the APFD one expected today without such a TCAS mode should reduce system. significantly:

HINDSIGHT N°6 Page 27 January 2008 The Briefing Room - Learning from Experience

MID-AIR COLLISIONS, ELEPHANTS, AND SYSTEMS APPROACHES

By Barry Kirwan

Barry Kirwan is the Coordinator for Safety & Human Factors Research at the EUROCON- TROL Experimental Centre, Bretigny, France. [email protected]

Could a civil mid-air collision experiencing just one part of the same happen tomorrow in Europe? elephant and that none of their Have we done everything we can to explanations are complete. prevent such an accident? I won't labour the metaphor. Suffice it to These are two questions which sit say, systems approaches entail looking uncomfortably with me, because in my at the whole problem in all its richness Bert Ruitenberg's 'off-set' solution [this personal opinion (I have to state this) and complexity, to determine a solution. issue] can be added, along with his the answers 'Yes' and 'No' don't fit If there is no single 'magic bullet' solu- caveat that the same off-set rule must where I would like them to, even more tion, then inter-related solutions must be applied internationally). than five years after Überlingen, and be developed: a 'system' of safety even after strenuous efforts by many defences. 'Compartmentalised' safety IMPROVED ACAS REVERSAL people (myself included). Several of the won't work on complex problems. It will LOGIC discussions in this issue of Hindsight fail. already point out why it is difficult to The first, TCAS reversal, could have improve the situation: more traffic, more The Überlingen accident involved a prevented the Überlingen accident if it conflict complexity; no more obvious tragically unfortunate interaction had worked comprehensively (i.e. for all 'low-hanging fruit', etc. Okay, but we still between the controller and TCAS scenario geometries) at the time. Work need to improve. So what do we do? (amongst other factors), and high- since the accident has striven to close When you have a really complex lighted a fatal vulnerability in the mid- the gaps in the reversal logic so that a problem, people may say to you - 'take air collision defence system, which situation with geometry and develop- a systems approach'.This sounds boring principally involves controllers, pilots, ment like Überlingen would indeed be and unlikely to deliver, however - so first, STCA and TCAS. The central prevented if the same conditions arose. a little on elephants, a story you may 'morphology' concerned the pilot It is however not yet clear when the new already know… following a controller's resolution rather logic will be implemented. than his TCAS RA. Since 2002 and Three blind men encounter an persisting until today, there have been a AUTOMATED DOWNLINK OF elephant. The first touches its trunk number of incidents, including some ACAS RA and says that an elephant is like a very close near-misses, which continue palm tree, another touches its side and to follow this 'failure path', despite The second, downlinking of the TCAS says that an elephant is like a rough major efforts by ICAO to reinforce the Resolution Advisory or RA, is a more wall. Another feels its tail and says that rule of 'Follow the RA'. The threat of complex area, and also discussed in this an elephant is like a piece of rope. Each another mid-air collision involving a Issue (see Doris Dehn's article). At first comes into contact with a different controller and TCAS may have reduced, sight it seems logical that if the con- part of the elephant and is convinced but has certainly not gone away. So, troller had been aware of the TCAS RA, that their own explanation is correct what are the options? A number exist: he would not have given contrary and that the others are wrong. None of some we're looking at, some not. Here instructions. But in the details of them realises that they are all are some to put on the table (to which EUROCONTROL's RA downlink study

January 2008 Page 28 HINDSIGHT N°6 The Briefing Room - Learning from Experience

and in the complex and tight timing of CONTROLLER PRACTICES TO AUTOMATE TCAS RESOLUTION real incidents and accidents, it is not MANAGE SPECIFIC HIGH-RISK EXECUTION always so clear cut. Hence for the RA SITUATIONS downlink concept, the jury is still out, The fifth option, that of automated awaiting further and more precise The fourth is an interesting area in that TCAS, is contentious but an obvious evidence. This further evidence is likely although it was discussed in the solution for many who have considered to be in two main forms. The first is a original post-Überlingen High-Level that if the human was taken out of the better understanding of what incidents Action Group on ATM Safety (AGAS) equation in this narrow, time-stressed and near-incidents actually occur, so forum, it has received comparatively and unclear situation, then the world that RA downlink (or other approaches) little attention. The approach would might, on balance, be a safer place. can be formulated on a more evidence- entail controllers giving lateral resolu- Application of such full automation based understanding of the problem. tions when aircraft are getting close (probably with pilot veto [i.e. return to This is not easy since the events of enough for TCAS to occur (since TCAS manual] available) is not without interest are rare and do not occur to only gives vertical dimension instruc- precedent (e.g. automated aircraft order, but a study to do this is being tions).This would necessitate either that landings), but requires a significant launched by EUROCONTROL. The controllers have prior criteria for safety advantage (e.g. an order of second form of evidence relates to a deciding when to give lateral instruc- magnitude, or a 'factor of ten' safer than risk-based model and results confirming tions only, or else STCA predicts time to non-automation) to be demonstrated to that the benefits of RA downlink out- TCAS RA and informs the controller. The overcome concerns relating to trust in weigh any potential side-effects. There controller would also benefit from automation and automation failures. are still some open issues as to what (down-linked) information about air- Even if we in ATM are not considering represents the right risk framework and craft TCAS serviceability. this option, we can be sure at least some model with which to judge any inter- of our wider aviation partners are (e.g. vention, but work is in progress. There are some potential disad- Airbus), and we should therefore vantages, e.g. lateral resolutions may not investigate the likely impacts on ATM. IMPROVED STANDARDISATION be as effective (fast) as vertical ones OF STCA LOGIC depending on altitude and speed as IMPROVED UNDERSTANDING OF well as conflict geometry (see UK CAA SEPARATION ASSURANCE The third, namely enhancement and SRG CAP 717 - Radar Control Collision harmonisation of STCA, can help reduce Avoidance Concepts, 2006); a pilot who The sixth approach attempts to move the exposure to TCAS by warning con- initiates a lateral manoeuvre then gets the problem upstream, and focuses on trollers more efficiently in advance of a TCAS vertical instruction may have enhancing controller separation TCAS activation (i.e. STCA and the con- significant difficulties complying with assurance procedures based on a better troller resolve the situation before TCAS the latter; potential impacts on third- understanding of how assurance is triggers).This area has great safety merit party aircraft in busy airways, etc. Yet currently achieved, and the nature of in its own right, but is unlikely to reduce there is a certain logic that suggests that vulnerabilities in such assurance exposure sufficiently to remove lateral instructions could avoid the processes, based on the analysis of data completely the specific threat of Überlingen-type accident. Such a lateral from actual ACCs. This work comple- negative interactions between con- dimension would also constitute a more ments studies of actual incidents. trollers (and STCA) and TCAS (also clearly coordinated air-ground concept Incidents deal with events 'after the fact' because, as my colleague Ben Bakker of conflict and collision avoidance. Even - often investigations find it hard to commented to me, there are inevitably if the lateral solution does turn out not uncover what was happening before, some conflict geometries where STCA to be a good idea, it should be and therefore ignore what constitutes may not occur before TCAS). examined seriously with other potential 'normal' separation assurance practices. solutions, because it might lead on to From a systems perspective, if you want better remedies. to put something right, it is not enough

HINDSIGHT N°6 Page 29 January 2008 The Briefing Room - Learning from Experience

to look always at what is going wrong - 'pop-ups') that arise in the STCA/TCAS could probably go further. Clearly in this 'normal' behaviour must also be timeframe (MAC-3mins), so again these respect we also need constructive analysed, otherwise assumptions about tools can only be part of a larger engagement with the ANSPs we aim to how controllers control traffic may be integrated solution set, but could add serve, as is already happening for incorrect. It is also important to under- significantly to safety. example through the SPIN (Safety-nets stand the variability in ACC working Performance Improvement Network) practices and separation assurance in SELF SEPARATION LOGIC initiative. Europe (including use of safety nets), in case there is not a 'one size fits all' The eighth approach is free flight There is also a clear need for a better solution. A good example of beginning (possibly also including advanced ASAS understanding of separation assurance, to understand what is actually - Airborne Separation Assurance) as well as loss of separation, so that we happening in separation assurance, wherein the pilots are in control of their can make the right decisions based on albeit from the safety event perspective, own separation. This could prevent con- the best evidence available. is the NATS article in this issue. troller-TCAS interactions (though there EUROCONTROL is currently seeking to might be ASAS-TCAS ones), but is look deeper into these two sides of the IMPROVED CONFLICT probably many years away, and so does same coin, with ANSP partners. Once DETECTION AND RESOLUTION not help with the immediate threat. such an understanding exists, different TOOLS 'solutions' and 'solution partnerships' WHERE FROM HERE? can be evaluated, improved, modified, The seventh approach also attempts to shelved, or even discarded - to design tackle problems 'upstream' and so I am clearly proposing that a more an optimal system of safety defences. reduce the number of times STCA and integrated approach be adopted - that TCAS are called into action. Tools such the different people and groups holding Returning to my two uncomfortable as Medium-Term Conflict Detection different parts of the elephant work questions at the start of this article, the (MTCD) and Tactical Controller Tool (TCT together somehow, with a single aim of answer to the first is likely to remain a - under development) may offer developing a Coordinated Safety 'Yes' for some time, since removing the significant promise for safety more Defences System, which includes safety possibility completely is very difficult to generally. A key question for such tools nets, their interactions, and barriers achieve. However, it would be good to however, as found in real-time further 'upstream' (separation assurance have the same affirmative response to simulations in 2006 at the tools and practices). Within the second question. EUROCONTROL Experimental Centre EUROCONTROL things are already (EEC), is what is the best timeframe for moving firmly in this direction, but such tools? Again, it is here that a better understanding of actual tactical control and separation assurance is needed. Often, new tools are aimed at 8-20 minutes' advance prediction, yet the EEC study in 2006 suggested 4-7 minutes was what the controllers actually needed and wanted (TCT can work in this shorter timeframe). Probably both are needed, when con- sidering Planner and Executive (Tactical) controllers. Even if such tools do work most of the time, there will inevitably be encounters and conflicts (e.g. so-called

January 2008 Page 30 HINDSIGHT N°6 The Briefing Room - Learning from Experience

ALERT CONTROLLER PREVENTS CFIT ACCIDENT

The incident described below involved an correctly. During this descent, the air- set to the standard pressure setting of Airbus A310 passenger flight to craft was cleared to descend further to 1013 hPa and not the Birmingham Birmingham Airport in November 2006. an altitude of 2,500 ft and this was QNH of 982 hPa. The PF initiated a The account of the incident is reprinted again acknowledged correctly by the climb and he and the PNF set the from UK AAIB Bulletin 4/2007, omitting PNF. Birmingham QNH and crosschecked only the introductory information. the altimeters. The PNF informed the At 2043 hrs the crew were instructed controller “JUST GOT IT NOW AND SYNOPSIS to turn right onto a heading of 060° CLIMBING READING 2,000 FEET”. The and to reduce speed to 180 kt; the air- controller responded “YOU CAN LEVEL The aircraft was being radar vectored craft turned onto the base leg and OFF AT TWO THOUSAND FEET PLEASE for an ILS approach to Runway 15 at continued its descent. The controller, TO INTERCEPT THE GLIDEPATH AT NINE Birmingham Airport. The radar con- who was also controlling several other MILES YOU ARE NOW CLEAR OF THE TV troller had cleared the crew to descend aircraft, saw F-OJHH descend through MAST”. The PNF acknowledged the to an altitude of 2,500 ft, but noticed 2,500 ft. He transmitted “5020 CLEARED instruction and they were then cleared that the aircraft continued to descend ALTITUDE TWO THOUSAND FIVE to descend on the ILS. The crew below the cleared altitude. He HUNDRED FEET SAY AGAIN TWO continued with the approach and instructed the crew to climb and THOUSAND FIVE HUNDRED FEET”.The landed without further incident. repeated the QNH, which the crew had PNF responded, “TWO FIVE HUNDRED not set. With the correct QNH set the 5020 TWO THOUSAND FIVE HUNDRED”. WEATHER aircraft climbed and levelled at 2,000 ft, Seeing the aircraft still descending the as instructed by the controller. Having controller transmitted “YES IF YOU The synoptic situation at 2100 hrs on intercepted the localiser they were COULD CLIMB BACK UP TO TWO the day of the incident showed a low cleared to descend with the ILS and a THOUSAND FIVE HUNDRED PLEASE pressure system (969 hPa) centred near normal landing was completed. AND TURN RIGHT NOW ONTO ONE Eire. A broad warm sector was covering TWO ZERO DEGREES”. The PNF the southern half of the British Isles HISTORY OF THE FLIGHT responded to the instruction after a with a light to moderate south-south- short pause. Seeing the aircraft still westerly flow over the Midlands and The aircraft was on a scheduled flight descending, the controller repeated, Southern England. Weather conditions from Tehran to Birmingham Airport. “5020 YOU ARE STILL DESCENDING over the Midlands were cloudy with The commander was the Pilot Flying CLIMB TWO THOUSAND FIVE outbreaks of rain, mainly in the West (PF) and the co-pilot was the Pilot Not HUNDRED FEET ACKNOWLEDGE”. This Midlands. The surface visibility was Flying (PNF). The crew contacted the was acknowledged again by the PNF generally 25 km but locally 10 to 15 km Radar controller at 2037 hrs as they but the aircraft still continued to in rain. The mean sea level pressure in were approaching FL80. They descend. The controller instructed the the Birmingham area was 982 hPa with confirmed that they had received the crew that there was a mast 4 nm due the Barnsley Regional Pressure Setting, ATIS and repeated the QNH of 982 hPa. east of their position which was 1,358 valid from 2000 hrs to 2100 hrs, of 974 They were instructed to maintain FL80 ft amsl, and that they should climb hPa. and their present heading. immediately. The PNF acknowledged this instruction. The 2020 hrs weather report at The controller intended to provide Birmingham Airport recorded a surface radar vectors for the aircraft to Suspecting that the crew had not set wind from 160º at 10 kt, with the intercept the localiser for Runway 15 at the QNH, the controller transmitted visibility greater than 10 km in light a distance of 9 nm. At 2038 hrs he “5020 QNH 982 CONFIRM YOU ARE rain, few clouds at 1,600 ft with cleared the aircraft to descend to an INDICATING ONE THOUSAND FIVE scattered cloud at 2,200 ft, the altitude of 4,000 ft on the QNH of 982 HUNDRED FEET”. At this point the crew temperature was 12ºC, the dew point hPa, which the PNF acknowledged realised that the altimeters were still was 11 ºC and the QNH was 982 hPa.

HINDSIGHT N°6 Page 31 January 2008 The Briefing Room - Learning from Experience

TV Mast

Extract from the UK AIP, published with the permission of UK CAA, showing the ILS approach procedure to RWY 15 at Birmingham Airport. The television mast is circled in red.

ALTIMETER SETTING ANALYSIS and that indicated on the altimeters. Consequently, thus when the altime- The Standard Operating Procedure The crew had not changed the altime- ters were indicating 2,500 ft the aircraft (SOP) for altimeter setting in the ter setting from the standard setting of had actually descended to 1,570 ft. As descent was set out by the operator in 1013 hPa to the Birmingham QNH of the aircraft continued its descent the descent checklist of the normal 982 hPa when first cleared to descend below its cleared level of 2,500 ft the procedures. This requires both the PF from a flight level to an altitude. Based radar controller notified the crew and and PNF to set the QNH when cleared on an average height of 30 ft per hPa, warned them of the mast ahead. by ATC to descend from a flight level a height difference of 930 ft existed Having realised that the altimeter sub to an altitude. between the aircraft actual altitude scale setting was incorrect the crew

January 2008 Page 32 HINDSIGHT N°6 The Briefing Room - Learning from Experience

initiated an immediate climb, re-set the altimeters to the correct QNH and followed the controller's instructions.

The crew could not recall any distractions or unusual flight deck activity at the point at which they would normally have adjusted the altimeter sub-scales.

LESSONS LEARNED

The following extracts from EUROCONTROL Level Bust Briefing Note ATM2 are relevant:

“3.1. The controller has no way of knowing if, after a correct readback, a pilot has misunderstood his clearance or is likely to deviate from it (e.g. because he has mis-set air- craft equipment).

“3.2. The controller can reduce the incidence of level busts by monitoring the flight path of aircraft under his control to the extent that his work-load permits.

“3.3. A busy controller cannot be expected to monitor continuously the progress of all flights under his control. Some form of prioritisation is usually necessary, and experienced controllers often do this subconsciously.

”3.5. Priority in monitoring will be given to aircraft whose clearance has recently been changed from a stable situation (e.g. level flight on flight plan route) to a changing situation (e.g. climbing, descending, or changing routing).”

HINDSIGHT N°6 Page 33 January 2008 The Briefing Room - Learning from Experience

AVOIDING THE CONFLICT

By Anne Isaac and Victoria Brooks Conflict resolution, which is the to scan the most relevant data. most obvious skill of controllers, is Anne's early experience in ATM and air- demonstrated when measures are Secondly, controllers may fail to line operation was followed by six years taken in order to prevent the recognise the important with the Human Factors team at EURO- further development of a conflict information. CONTROL where she was associated with situation. the development of tools and techniques If the relevant information is to help identify human error and risky detected the controller then needs performance in the ATM environment, as Conflict avoidance, is used to well as developing the Team Resource prevent the situation in the first to recognise it as a problem or risk. Management (TRM) concept for place by using proactive control European ATM. Anne now heads a team actions such as heading or level The main problem with these activities in Human Factors integration within the assignments. for experienced controllers is the issue Division of Safety in NATS, UK. of time, often requiring tasks to be When analysing these two strategies it prioritised. High workload also Victoria is a safety analyst at NATS; based is easy to recognise how complex increases the risk of reacting to in the Safety Analysis section, working in avoiding the conflict can be. situations instead of anticipating them. the area of understanding safety per- formance. Conflict resolution can be described The existence of monitoring aids and simply as a three-stage activity, conflict-detection tools such as It would seem strange to an outsider although at each stage there are medium-term conflict detection that ANSPs spend an enormous several things that may go wrong. (MTCD) also invite controllers to not amount of time and resources on actively scan for conflicts but depend selecting and training professionals to on the tools to warn them. Even safety separate aircraft, only to have in- nets such as short-term conflict alert creasing numbers of incidents which (STCA) may have this effect, which involve STCA and TCAS intervention. should be prevented. This is not unique to Europe and it is almost impossible to calculate how Conflict avoidance, on the other hand, many conflicts are not resolved in a is potentially a more robust technique; timely manner, but the estimate is however it does require the controller somewhere in the region of 10 for to control defensively and proactively, every 100,000 movements. This is that is to set up the traffic in such a way exactly why the air traffic control Conflict resolution firstly relies on that should a plan fail, separation system finds it so difficult to detection, which means the controller would be maintained. This technique is implement further safety strategies must know what to look at and for, illustrated in the following figure. and often struggles to find the balance when to look and actively 'see' what is between safety and service. If con- being searched. Here we have the first trollers got it wrong more often we problem, since incident statistics would be in a better position to demonstrate that one of the reasons implement more robust safety nets. for the highest number of errors in ATC incidents is to 'not see' the information But why do controllers get it wrong at at all. There are many reasons for this: all? The answer in some part lies in the often difficult balance between conflict Firstly if the technology does not resolution and conflict avoidance. display the relevant information in an intuitive way, controllers may fail

January 2008 Page 34 HINDSIGHT N°6 The Briefing Room - Learning from Experience

Comparing this with the conflict space, one of the leading contextual work is based on the relative heading resolution model, it can be seen that factors in ATM incidents.This is a highly of two aircraft; the alert is then controllers would be expected to challenging area to tackle and classified as head-on, crossing or catch- invest more time in monitoring the demands highly collaborative decision- up as the following diagram indicates. situation, which of course means a making, learned over a lengthy period trade-off with other activities or in of time. some cases deferring other activities until the original task is complete. So what do we know about conflict However if a clear set of roles and resolution at the moment? Recent responsibilities is given and practiced work with regard to STCA has revealed by the controlling team, the some interesting trends, although how investment would ultimately mean less robust these are and how they can be risky and more proactive controlling. generalised is too early yet to assess. The analysis described here is taken One challenging factor is the year-on- from a small sample of STCA alerts in year increase of traffic. It is not sur- one area of our airspace, and focuses The vertical geometry is based on the prising that this increase in demand on the geometry of encounters. altitude change over the last five radar decreases the possibilities of using cycles before an alert. The geometry of conflict avoidance techniques. Another The analysis of STCA alerts requires the each aircraft is then classified as area that hampers the use of conflict lateral and vertical geometries to be climbing, descending or level. avoidance is the complexity of air- defined. The lateral geometry in this

HINDSIGHT N°6 Page 35 January 2008 The Briefing Room - Learning from Experience

In terms of the lateral geometries of the alerts studied, 55% were crossing, 22% were catch-up and 23% were head-on.

The above figure illustrates the find- possibly the result of a 'pop-up', for In terms of the vertical geometries of ings of these geometries. example, either a fast moving military the alerts; 65% of encounters were encounter, an encounter with a sudden where one aircraft was level and the The version of STCA used in this study change in lateral or vertical geometry, other was either climbing or uses a two-stage alert, changing from or an airspace infringement. And the descending. white to red. It is assumed that in the remainder of the alerts began white first stage of the alert, white, controllers before becoming red.

It is difficult to make any substantial claims from one set of data, but further analysis will add to the understanding of what controllers do, particularly when the alert goes white and what, if anything, changes their strategy when the alert becomes red.

If we return to the original discussion of conflict resolution versus conflict avoidance, it would seem that developing techniques to allow con- trollers to exploit conflict avoidance strategies within their time constraints would be a more proactive approach Combining the lateral and vertical will acknowledge the alert and act to to ATM safety. How we do this, of geometries of the alerts shows that resolve the potential conflict as course, is another story - watch this approximately 80% of crossing required; indeed 97% of alerts that space! encounters involved one or both air- were white remained white until they craft that were climbing or descending. were resolved. A small percentage of alerts went straight to red, which meant there was little pre-warning;

January 2008 Page 36 HINDSIGHT N°6 Back issues

HINDSIGHT N°6 Page 37 January 2008 Back issues - Contact

CONTACT US

The success of this publication depends very much on you. We need to know what you think of HindSight. Do you find the contents interesting or boring? Are the incident descriptions easy to follow or hard to understand? Did they make you think about something you hadn't thought of before? Are you looking forward to the next edition? Are there some improvements you would like to see in its content or layout?

Please tell us what you think - and even more important, please share your difficult experiences with us! HindSight back issues: We hope that you will join us in making this publication a success. if you are interested in ordering the entire Please send your message - rude or HindSight collection, just send an email to: polite - to: [email protected] [email protected]

Or to the postal address: Rue de la Fusée, 96 B-1130 Brussels

Messages will not be published in HindSight or communicated to others without your permission.

January 20072008 Page 38 HINDSIGHT N°6 Disclaimer

DISCLAIMER

© European Organisation for Safety of Air Navigation (EUROCONTROL) January 2008.

This publication has been prepared by the Safety Improvement Sub-Group (SISG) of EUROCONTROL. The authors acknowledge the assistance given by many sources in the preparation of this publication.

The information contained herein may be copied in whole or in part, providing that the copyright notice and disclaimer are included.

The information contained in this document may not be modified without prior permission from EUROCONTROL.

The views expressed in this document are not necessarily those of EUROCONTROL.

EUROCONTROL makes no warranty, either implied or expressed, for the information contained in this document; neither does it assume any legal liability or responsibility for the accuracy completeness and usefulness of this information.

HINDSIGHT N°6 Page 39 January 20072008 Putting Safety First in Air Traffic Management

January 2008 EUROCONTROL