Emergency and Unusual Situations in the Air

EUROCONTROL HindThe ability or opportunity to understand and judge an event or experience after it has occuredight15

Emergency and unusual situations in the air

This is a dangerous issue by Professor Sidney Dekker 17 minutes by John Barrass The small technical problem... by Eileen Senger

Summer 2012 Contents Summer 2012

HindThe ability or opportunity to understand and judge an event or experience after it has occuredight15

4 coo’S Keynote Joe Sultana’s 4 Serious about safety by Joe Sultana keynote 6 editoRiaL 6 Surprise, surprise... by Tzvetomir Blajev p. 4 10 Emergency and unusual situations in the air by Carlos Artero 14 Sudoku of teamwork by Maciej Szczukowski 16 This is a dangerous issue by Professor Sidney Dekker 18 tHe VieW fRom aBoVe 18 Being prepared – for worse than ‘expected’! by Captain Ed Pooley

22 121.5 – Safety aLeRtS by Richard “Sid” Lawrence 22 Interceptions of Civil Aircraft – Operation of SSR and ACAS II 25 Reduced Runway Length Operations during Construction/ Front Line Reports Work In Progress – ATIS and Radiotelephony Messages by Carlos 28 caSe Study Artero 28 The garden party by Bengt Collin 31 Comment No. 1 by Captain Ed Pooley p. 10 33 Comment No. 2 by Dragan Milanovski 34 Comment No. 3 by Eileen Senger 36 Comment No. 4 by Sami Laine 37 taLeS of opeRationaL Safety 37 E.R. by Alberto Iovino 40 fRom tHe BRiefing Room 40 The small technical problem… by Eileen Senger This is a dangerous issue 42 It all went quiet by Harry Nelson 44 Emergency and unusual situations – whose world view? by Anne Isaac by Professor 48 TCAS II version 7.1 has arrived by Stanislaw Drozdowski 51 17 minutes by John Barrass Sidney Dekker 54 Beyond the outcome by Bert Ruitenberg p. 16 56 HindSigHt SituationaL eXampLe 56 Fixed wing or helicopter? 62 SKyBRaRy doWLoad 62 ATC Operations in Weather Avoidance Scenarios

2 Being prepared – for worse than ‘expected’! p. 18

editoRiaL team It all Editor in Chief: Tzvetomir Blajev Editorial Adviser: Captain Ed Pooley went quiet Graphic Designer: Frédérique Fyon p. 42 contact uS

The success of this publication depends very much on you. We need to know what you think of HindSight.

Do you fi nd the contents interesting or boring? Are the incident descriptions easy to follow or hard to understand? Did they make you think about something you hadn’t thought of before? Are you looking forward to the next edition? Are there some improvements you would like to see in its content or layout?

Please tell us what you think – and even more important, please share your diffi cult experiences with us!

We hope that you will join us in making this publication a success. Please send your message – rude or polite – to: [email protected] TCAS II version Or to the postal address: 7.1 has arrived Rue de la Fusée, 96 B-1130 Brussels p. 48 Messages will not be published in HindSight or communicated to others without your permission.

HindSight 15 Summer 2012 3 COO’s KEYNOTE Serious about Safety

I am delighted to be given the opportunity to provide my perspective, as Chief Operating Offi cer of the Directorate of Network Management of EUROCONTROL, on how we view safety. Simply put, our position is that we take safety very seriously because it is a cornerstone of our business.

mance. The new performance-based Joe Sultana is Chief Operating Offi cer of the Network Management Directorate. ATM world we are now in is a fact of life. He graduated with an Engineering Degree from the University of Malta in 1975 and joined the Air Traffi c Services Unit in Malta in the same year. He obtained ATCO Licences in Aerodrome, I mention performance only in pass- Radar and Area Control and was a Watch Supervisor for four years. In 1982, he was appointed ing and do not want to dwell on it too Head of Air Traffi c Services in the Maltese Department of Civil Aviation. much. But safety and performance are things which we deliver every day together: controllers, pilots, ANSPs, The Network Manager function is a key agement. But our work does not stop aircraft operators, airports and the component of the Single European there. We are also actively and directly Network Manager. As a network, we Sky. But what is the Network? It is the involved in operational safety, in the are as strong but also as weak as the European ATM system working as one identifi cation and management of component parts. Working together to coherent function providing a safe and operational safety hazards across the deliver both is the raison d’être of the expeditious service to civil and military Network. Our overview of European Network Manager. airspace users across the airspace of ATM operations and good channels of the 39 EUROCONTROL Member States. coordination with controllers and pi- HindSight is an important tool for We are living in a world where infor- lots give us a unique view of possible sharing what we in the industry col- mation fl ows instantly from one part risks and safety threats. lectively know about safety threats of the world to the other and where and the ways of managing them. It is people and organisations are more I am confi dent that the Directorate of primarily aimed at the people on the closely linked, better connected and Network Management of EUROCON- front end – air traffi c controllers – and able to infl uence each other. Safety TROL can answer these questions and it is read by thousands worldwide. The has to be addressed at local, European that we are up to the challenges they content of this issue is a very good and global level and we have to learn pose for us on a daily basis. We will example of how we facilitate the col- and constantly support each other. leave no stone unturned in our task of lection of the best pieces of informa- constantly improving Network safety. tion on a subject, carefully balancing The following questions drive our I believe safety is not a cost but a diff erent opinions and assembling it common safety approach: Is the Net- business done well. Having a high in a contemporary form. We are doing work safe? Where are the safety threats safety standard for ATM is the best this not only to discharge our formal in the Network? Where are the safety way to be more effi cient and eff ec- responsibilities but also to do all we opportunities? What should be done tive in managing the higher volumes can to have peace of mind and soul to keep the Network safe and improve? of traffi c. Take the example of adverse when we look at the contrails of air- Who do we tell to make it eff ective? weather avoidance. The better we are craft in the sky or the steady stream of prepared and the more effi ciently we inbounds at a busy airport. Keeping the Network safe is not a share and adopt good practices for task of the Network Manager in iso- ATCOs and ATC supervisors in situa- Take the journey with us, read the lation. Our role is twofold. On the one tions of weather avoidance, the more articles, think how this relates to your hand we support the various Network we can improve not only safety but work, discuss things with colleagues actors to improve their safety man- also overall local and Network perfor- and help us spread the knowledge.

4 HindSight 15 Spring 2012 5 EDITORIAL Surprise, surprise…

an training and everyday practice with same time coping, potentially, with impulses for autonomic, C normal operations provide the skills startle-triggered, reactions. and knowledge to deal with the unexpected, unfamiliar, and very often never- Let us take as an example the situation where the stall pro- experienced-before, situations? tection system of an aircraft has been activated. In the past pilots fl ying multi crew public transport aircraft were gener- Surprising situations do happen to us. ally advised that their response to such a warning should They sometimes trigger a physiological only involve the minimum reduction in aircraft attitude reaction known as the startle response. needed to recover from the ‘edge’ of the fully stalled con- This is a knee-jerk and instinctive reaction dition. This advice implied that the loss of aircraft altitude to a sudden, unexpected external resulting from the recommended response should be mi- stimulus like someone fi ring nimised. Thus implication soon became a widely accepted a gun behind us when we objective in its own right. The important strategy to recover were not expecting it. became obscured by a secondary consideration. The result was that pilots who did not understand the aerodynam- ics of the stall simply responded to this rare event in a way that failed Pilots and controllers are to restore a normal fl ight condition. What is really important is that if an sometimes confronted with initial response is not eff ective, the rapid-onset, dynamically result may be a much more diffi cult situation which in some fl ight con- developing situations with ditions can follow very fast.

Tzvetomir Blajev diﬀ erent, sometimes Do you believe that we in ATC never Editor in Chief of Hindsight opposing, strategies available. encounter similar situations? Re- Fellow of the Flight Safety Foundation ally? Think about the example in the case study of this edition of Hind- Sight. On initial contact with the crew there is an indication of ‘fuel at minimum’. What should The startle refl ex normally triggers within 100 milliseconds the Controller do fi rst? Give the requested ‘direct to the des- of the stimulus, it is pre-emotional and contains physiologi- tination’, ask if the crew wish to declare an emergency or cal and subjective dimensions. The subjective dimension fi rst coordinate with the adjacent ATC centre? The Control- is very similar to fear or anger. Startle prompts an increase ler elected to immediately give a direct route and this, in in the speed of your reaction and helps to focus attention. hindsight, may have helped to save the lives of the people The reaction is autonomic for at least the fi rst 1-3 seconds in the aeroplane. but may continue for as much as 20 seconds in extreme circumstances. In the jungle this is the fi ght-or-fl ight response Knowing in hindsight what happened and what would have when encountering something unexpected. And unexpect- been the best decision(s) is very easy, but how do we know ed in the jungle is rarely good. Even if it is good, it is better this when the decision is still to be taken? More than one to err on the safe side. Pure survival! option may seem credible and there may not be enough time to analyse them. Hindsight bias is one of those features Coming back to modern times – pilots and controllers are of human thinking that delivers results which are diff erent sometimes confronted with rapid-onset, dynamically de- from those we can get if we analyse the situation with the veloping situations with diff erent, sometimes opposing, help of statistics. The idea of ‘hindsight bias’, which also in- strategies available. How should the situation be assessed spired the name of our magazine, was formulated by two to fi nd the best strategy in a blink of an eye? And at the scientists in the 1970s – Amos Tverski and Daniel Kahneman.

6 Surprise, surprise…

A few months ago, Kahneman published another book1 which I would like to spend some time discussing from the perspective of our current theme. In his new book Kahneman describes our thinking process as consisting of two systems – System 1 and System 2. System 1 thinks fast, is unconscious, intuitive and eff ort-free. System 2 thinks slow, is conscious and analyti- cal. System 1 recognises patterns in a fraction of a second, and ‘automatically produces an adequate solution to the challenges’. System 2 is systematic but tires easily; therefore it usually accepts what the fast System 1 tells it.

These systems are not actually two distinctive agents in our head. Not really, says Kahneman. Rather, they are “useful fi c- sumes WYSIATI (“what you see is all there is”), and it has no tions” – useful because they help explain the traits of the doubt whatsoever in its thinking process. System 1 is noto- human mind. riously bad at the sort of statistical thinking often required for good decisions, it jumps easily to conclusions and it is One may think System 2 is in charge, but the reality is that subject to various irrational biases, including the already System 1 is the boss most of the time. This is for good rea- mentioned hindsight bias. Speed is achieved at the ex- sons, because System 1 is for the most part very good at pense of precision. System 1 is “quick and dirty”. We do not what it does; it is very sensitive to subtle environmental want our reaction in aviation emergency situations to be cues and signs of danger. It kept our ancient ancestors alive. like this, do we? There is simply too much going on around us for System 2 to analyse everything in depth. But System 1 does well most of the time; it is because of System 1 that we have our (good) performance and intui- Another benefi t of System 1 is the ‘expert intuition’ which tive expertise. Not relying on it will deny us all the benefi ts comes from experience. Expert intuition can be learnt as well. Kahneman implies that knowing the fallacy of our by prolonged exposure to situations that are “suffi ciently behaviour won’t help a lot to overcome it. It helps if more regular to be predictable”, and provided quick feedback then one person is involved and they cooperate. Because is given to the expert on whether he did the right or the it is easier to recognise someone else’s errors than our own, wrong thing. This is how experts develop their unconscious working in a trained team, with ongoing feedback mecha- “pattern recognition” mechanism to get the right answer nisms, is part of the ideal solution. quickly. A trained expert (Kahneman gives as an example a fi re-fi ghter) can unconsciously, and almost immediately, System 1 is always working, but the situations that happen produce the right response to complex emergencies. to us occur with varying degrees of surprise for it. Similarly, the amount of time available for our System 2 to take over All the marvels of System 1 come at a price. The high speed from System 1 and analyse in-depth the issue before mak- is paid for. System 1 works in an oversimplifi ed world, it as- ing a decision varies. I was thinking how to map graphically 44

HindSight 15 Summer 2012 1- “thinking fast and slow”, daniel Kahneman, new york, 2011 7 EDITORIAL

Surprise factor Te a m Knowledge- based Known, Pre-briefi ng Strategies Sometimes, I hope very rarely, the situ- Expected ation will develop suddenly and will be both unexpected and unknown. Then there is not much in the way of a pre- formed strategy available. What one Personal Analysis, Known, Intuitive needs to do is to prevent or reduce the Expertise Knowledge- drill-down Unexpected based likelihood of such situations. Skill-based Strategies There are known but unexpected situations with suffi cient time for personal refl ection but not for use of team re- Personal and Team, sources. An example of this would be Heuristic-based the Airbus 320 ditching in the Hudson Unknown, ? Strategies River in 2009 after the loss of almost Unexpected Common sense, rule of thumb, all engine thrust following a multiple- trial and error Available engine bird strike at low level. time Finally, there are those cases that Available time for Available time for combine unexpected but relatively No time, refl ection but not refl ection and for cooperative Sudden for cooperative frequent and known situations with strategies strategies sudden development and no time for refl ection. If these cannot be prevented then the best strategy is to train for them extensively so that an optimum reaction becomes second nature and is more likely to be intuitively applied if needed. This is the famous the distinctive situations, which are associated by the dif- rule for becoming an expert by spending 10,000 hours on ferent combinations of surprise for System 1 and available training and practice. Take your time! time for System 2. I have attempted to visually represent the diversity of these combinations above. Intuitive reaction is not always bad; it helped us survive in the Darwinian sense. Flying and providing air traffi c control There are situations, represented in green, where there is ei- to modern aircraft, however, is less of a reaction from the ther suffi cient time for the crew to adopt knowledge-based jungle and more about preparation. strategies or which can be reasonably expected, such as wind shear encountered when approaching to land at an It is true that the design of aircraft and ATC systems should airport with signifi cant convective weather in the vicinity. be human-centred, accommodating instinctive human In this latter case the expectation can trigger a pre-briefi ng reactions. But this assumes that someone will know ev- for the actions required if an actual encounter occurs, and erything about humans and their reactions and will suc- although the situation is sudden and there is no time for cessfully integrate this into the design of machines and pro- System-2 type of thinking, after the encounter the strategy cedures. Obviously, this is not fully achievable and there will is still knowledge-based. An example of such a team knowl- be situations that surprise us. If these situations have poten- edge-based strategy is the Airbus 380 emergency landing tially dangerous outcomes, if what is at stake is an accident, in Singapore in 2010. then when confronted with emergencies one should be equipped to adopt the best available strategy which mini- Other situations involve unforeseen or highly unlikely mises ‘blink’ and maximises ‘think’. The challenge is how to events but with suffi cient time available either for personal train the professionals to ‘think slow’ but faster. or team System-2 type thinking. The available knowledge- based strategies are generic rather than specifi c. Enjoy reading HindSight!

8 HindThe ability or opportunity to understand and judge an event or experience after it has occuredight15

HindSight 15 Summer 2012 9 EDITORIAL

Front Line Reports Emergency and unusual situations in the air

By Carlos Artero This article discusses not emergencies, but unusual situations. Fortunately, such situations do not happen very often, but we must be careful because they can appear at any time without notice.

t happened one morning in 2006. The sky was overcast starts, but departure ATC had told him to use the visual cor- Iaround the airport where I worked. Traffi c was so light ridors and stay below the overcast. that during the day one controller worked all positions, whilst at night two controllers were used. I had a strip indicating the expected arrival and when the plane did not call me, I tried to reach it on the radio but During the day, there was hardly any IFR traffi c, while at there was no response. I called the ATC of the departing air- night there were many cargo fl ights. However, there was port, who told me that traffi c had been told to contact me some VFR activity during the day, more in summer than in ten minutes ago. I tried to contact the plane again with no winter. VFR traffi c fl ying through our CTA was supposed success. to call, but sometimes didn’t. Departing traffi c often failed to say goodbye before losing radio coverage. The I looked at the fl ight plan. It was due to land at my airport, airport had no radar, and the ACC radar could not de- make a short stop and then fl y to Germany IFR. I asked the tect traffi c below 5000 ‘. airport offi ce why it was coming to us and they told me that it had to refuel before continuing because its departure airport had no fuel Carlos Artero available. This was a common story. has been an Air Traffi c Controller in AENA, I kept calling the plane from time Spanish Air Navigation Service Provider since to time, using tower, ground and I kept calling the plane 2005. He works in Barcelona and he has from time to time, using experience with Tower and Area Control. emergency frequencies. tower, ground and emergency frequencies. There was no answer, so I spent some time on the tele- That morning a southerly wind was blowing at 20 knots. phone to other airports in the area but nobody had any The clouds hovered over the mountains south of the fi eld. news about it. The cloud ceiling was low, but not low enough to prevent VFR operations. Knowing that the plane was going to Germany, I thought that perhaps the pilot had fl own directly to Germany, after The morning had passed peacefully when I received a call deciding that he had enough fuel to reach his destination or from the control tower of an airport 75 km to the south- intended to stop elsewhere to refuel en route. I also felt that east, which was surrounded by mountains and accessible the apparent unwillingness to fl y as fi led, VFR, to reach my via published visual corridors. My colleague there was co- airport might mean that the pilot is going to do whatever he ordinating a VFR fl ight coming to my airport. This traffi c had wants, so that required ATC contact may not be made before asked to fl y directly to the VOR where my airport approach reaching a French airport to refuel and fi le a new fl ight plan.

10 EDITORIAL

Emergency and unusual situations in the air

However, it was strange. He was due to fl y to my airport be- More time passed. The missing plane was not located cause he needed to refuel but he had not come. He had said either in Spain or beyond. The helicopters could not see goodbye to the departing airport, he had not contacted me much because the sky was completely covered and the or replied to my calls, he had a strong tailwind and there was clouds were low. According to the fl ight plan, the complete a thick cloud layer. Nobody had any news of him. It was about fl ight to Germany should have been completed by now. If time I activated the Uncertainty Phase, INCERFA. he had stopped to refuel in France, we would have known this from French ATC. So I called the ACC and declared I called the ACC, told them what was happening and declared DETRESFA. I learned that DETRESFA involves all State Se- INCERFA. I did not know exactly what that implied, but found curity Forces from Spain to Germany. The man at the ACC out later that INCERFA means that all airports and ACCs which asked me if I was sure. It was as if I were a boss or a director, may have encountered the ‘lost’ plane are contacted to see if whereas I was just a controller with not much experience, anyone knows anything about it. Suddenly, a lot of people who was working alone and had taken a decision without began to call me: ACCs, airports... . Honestly, I thought I might properly appreciating the consequences. I just replied that be screwing up, giving too much importance to plane that I was neither sure or unsure. The regulations clearly stated was no doubt fl ying peacefully over France to Germany, but when I had to declare DETRESFA, regardless of what I per- I saw that the situation was abnormal, the weather was bad sonally thought was going on. 44 and meanwhile I was complying with the safety protocol. If and when the aircraft were to be found, I would have done the right thing.

The ACC told me that there was no news after the established time for INCERFA, so I declared ALERFA. The ALERFA phase activates the Search & Rescue and State Security Forces and all ATC units along the whole route are contacted. I kept getting lots of calls from diff erent places, including the Search & Res- cue people.

Actually, we were all convinced that the plane was on the way to Germany, but ALERFA had been declared and the search by air and on the ground was initiated. A police helicopter arrived and, later on, a military Search & Rescue helicopter came from its base nearly 200 km away. The land teams were also mobilised. At this point I started to get scared. I hadn’t been an air traffi c controller for long, the destination of the plane was my airport and I had taken full responsibility for initiating the alert phases. In addition, I was alone. I should have called the Tower ATC Chief, but I didn’t think about it. Everybody called me: the helicopters on the frequency, people at the airport, the military and the ACC over the phone.

HindSight 15 Summer 2012 11 EDITORIAL

Emergency and unusual situations in the air (cont’d)

The DETRESFA phase was now active. This situation was that peak. When the cloud cleared a bit, they were able obviously now an incident, so I searched for the official to see the peak. And right there, the remains of the plane incident reporting form, which I had never filled in be- could be seen. fore, and I called the Tower Chief to ask how to fill it in. When the Chief learned that a DETRESFA was active, the first thing he asked was why he had not been advised of To sum up, I came to the following conclusions: the situation earlier. Of course he was right. I had been alone when he could have been with me. He had twen- n We must comply with all security protocols, ty-five years’ experience, had worked in several depart- whether we think a plane is safe or not. ments and knew a lot. n We must be careful and aware in everything we The Tower Chief came immediately to the airport. I told do, as we may be slow to act if we assume that him what had happened and he spoke to the ACC, the the abnormal situation is just an everyday military and diff erent people at the airport. Then he left problem, such as VFR traffi c leaving without and went to gather information from the airport. Soon he saying goodbye before leaving radio coverage. called me from the fl ying club, to tell me to call up the helicopters and tell them to look at a particular location. When n During any emergency situation, we must have this message was passed on, the helicopters confi rmed another person to help us. If we are working that they had been trying to check it but it was covered in on our own, we must secure the presence of at cloud. The location was a peak that rose above the other least one other person as soon as possible. mountains in the area where the terrain was fl at except at

In course of HindSight production Paul Neering, representing IFATCA, submitted a note to the article of Carlos. We thought it will be of benefi t to our readers to include the note in the content of this HindSight edition: A brave story by Carlos Artero. To my opinion there are however a few conclusions to be drawn before the ones mentioned in the article. It would also be interesting to know what changes in procedures and responsibilities were introduced after this accident. Are we talking history or do these circumstances still exist? (I’m afraid they do in many places).

n Training on incident and emergency procedures should be part of initial and refresher training. Even an ATCO with little experience should be convinced of and familiar with the actions to be taken, certainly in a situation of undesirable Single Person Operations (SPO). As described that wasn’t the case.

n What had happened to the quality of the handling of the emergency and the handling of other traffi c if traffi c had increased during the process? The many generated calls because of the emergency are already an extra workload by themselves. Calling in a second person during undesirable SPO should be part of the procedures at a well determined early point in time in the

process as well as the activation of traffi c fl ow regulation measurements to mitigate the risk of SPO in combination with the Editorial note Editorial handling of an emergency.

n Responsibilities of activation of SPO should be well described.

A lot less will then be left to personal interpretation.

12 EXPECT THE UNEXPECTED!

SAFETY ALERTS Keeping Your Heads Up!

All EUROCONTROL Safety Alerts available on: www.skybrary.aero Subscribe to:

HindSightwww.eurocontrol.int/safety-alerts 14 Winter 2011 EUROCONTROL13

AD01.indd 8 18/04/12 18:14 EDITORIAL Sudoku of teamwork

By Maciej Szczukowski I’ve never been a fan of a Japanese game called Sudoku. I’ve always felt that the “need“ to fi ll in a form with a scheme of numbers is fully satisfi ed by completion of my yearly tax returns and I don’t need to bother with any complex calculations, even if only for fun. A few weeks ago though, the circumstances of a rather dull meeting pushed me into trying it.

he fi rst attempt took me some time but the subsequent fi nding out that you can use three diff erent numbers in a T ones began to raise me above the “rookie” level. I found certain fi eld, have to either look for more information which myself switching from a narrow consideration of only 9 fi elds will lead you to the correct action or … resolve the problem (aviation experts might call it tunnel vision) to a broader per- by risking a particular decision which may not actually be ception of blank or already-fi lled in little boxes, all 81 of them. correct and accepting its consequences for the rest of the After a while, I could see that, actually, there is a certain system game. to it. And although it doesn’t lead to an instant solving of each puzzle, I found that using memory or concentration tricks could Flying in a multi-crew environment or providing ATC is sure- make the game more fun and less of a calculation challenge – in ly a “teamwork” activity. Sudoku can be teamwork as well, eff ect less stressful. with a bunch of friends standing behind your back saying “you should put number 2 there” or “look, this one is easy” On 1 November 2011, I had a morning shift at Warsaw airport But in all these activities there are always moments in which tower, which was supposed to terminate, with no adventures, at you, and only you, have to make a decision which may have 2.30 p.m. It was the only day of operational work during my new an uncertain outcome, in other words, take a chance. That rating course (which had lasted for about 40 days). And then in is the moment which you may have to solve your problem. the very last hour of this shift, with me on TWR position, unex- The Captain of LOT 16, though he took over an hour to try pected news about LOT 16, a Boeing 767 inbound from Newark to deal with the situation with the help of the crew, even- which eventually landed wheels-up, reached the tower. I am still tually made an approach with the gear up. It was only he wondering if I had no luck or all the luck in the world that I was who could decide. It was also only he who was then and at the tower at the time … remained afterwards responsible for the decision.

Why am I writing about these two – a simple game An air traffi c controller cooperates with his colleagues in, and a complex aircraft emergency? What do for example, establishing certain spacing minima on ap- they have in common? I would say that it is the proach but when it comes to making the decision whether problem of choice when no defi nitely right or not to fi t in a departure between two landing planes, it answer is apparent. Sudoku may sound trivial is an individual controller who has to solve the problem. At here but that is something that really fasci- that very moment only this particular decision counts. And nated me when I started playing. The rules if anything goes wrong, it is the controller who will have to are clear, the “game answer the questions “why” and “what for”. Not the team as plan” is simple – a whole. just like procedures or operational in- When I recall the day of the LOT 16 belly landing, I end up Maciej structions are (or at thinking about all the people involved in trying to help fi nd Szczukowski least should be). In the best possible outcome to the shared problem. Probably has been an Air Traffi c Controller, for over Sudoku, you select all the available manuals were open at the right page and 10 years, at Warsaw Okecie Airport, Warsaw, relevant informa- checked, both in the air and on the ground. Everybody was Poland. He also holds a PPL. tion, compute it in trying to recall their simulator and ground school training your brain and then, sessions for ideas. All of us were trying really hard to take

14 a broad view of all the 81 fi elds of our airfi eld-airspace-Sudoku board and gather as much information as possible from the fi elds already fi lled in. It was the teamwork we were trained to do.

However, I think that such an attitude, though widely accepted, leads to us missing an important point – our self-confidence. Many will agree that the “top ten” list A few weeks ago I played of distress situation terms includes “coordi- a game during a TRM (Team Re- nate”, “cooperate” and “collaborate”. I am sure source Management) session, in which a group that there is nothing wrong with that. We re- of people had 30 minutes to make a complex decision. For ceive lectures and do exercises in communica- the fi rst 15 minutes, I was quite passive and saw that, although tion, partnership and team actions but actually none of almost all the members of the group had a chance to talk, the them mention confidence, self-esteem, self-respect or group itself was not able to get any closer to the decision. After simply faith in, and pride in, our own decisions. In effect, 15 minutes I decided to send a rather explicit message to the and many situations prove this, we sometimes forget group and within the allotted time we came to a conclusion. about the thin line between the time for cooperation and Yes, it was only a game but still, though some of the opinions the moment of an individual decision and with it, aware- about my intervention were not pleasant, our lecturer told us ness of its importance and consequences. that if the leader had not stopped the unproductive part of the process, if a single mind had not guided the team and its Now the question is where is this line between the com- actions, we would have demonstrated more or less correct mon mind of a team and the single mind of a responsible teamwork but had no real product. In other words, nothing. pilot or controller? I recall one of many situations where this line was not defined. On 19 February 1996, a Con- The now very well known “ASSIST” scheme contains the letter tinental Airlines DC-9 performed a gear-up landing at “T”, which means “time”. I think it is a guide but also proof of Houston. Part of the background to this outcome is that the fact that we, as a team, need not only to work with each “the first officer was unwilling to overtly challenge the other but also to give each other time to work on our own captain’s decision to continuing the approach” though thought processes. This is not contrary to teamwork. It is to en- “he did attempt to communicate his concern […] to the sure that team members are eff ective contributors. And if we captain” (by asking few times “want to take it around?”, do not care about our own contribution, the team itself may “want to land it?” and “you want it?”)1. It has been found, not have enough time to act or may simply not see that their based on research, that the only value of challenging by help is needed. This is, of course, true not only for emergency monitoring pilots is to recognise hazards that flying pi- situations. And it was not only the fi rst day of November 2011 lots have missed; however, this ignores the value of in- that taught me this. Somehow, every game of Sudoku I play dependent thought and assessment by the monitoring reminds me about it too. pilot, and the potential ability of the monitoring pilot to influence the flying pilot’s decision-making through the power of suggestion.2 Likewise it is now known that an 1- ntSB aircraft accident Report, ntSB/aaR-97/01 “Wheels-up landing continental airlines flight individual may forget or incorrectly remember even re- 1943, douglas dc-9 n10556, Houston, texas, february 19, 1996”, pages 4 and 56 http://www.ntsb.gov/doclib/reports/1997/aaR9701.pdf cently acquired information, so that new information re- sembles other information processed recently.3 The last 2- fischer, u. and orasanu, J. (2000). “error-challenging strategies: their role in preventing and case definitely happens during intense teamwork, where correcting errors.” in proceedings of the international ergonomics association 14th triennial the pace of information exchange may be high whereas congress and Human factors and ergonomics Society 44th annual meeting, Santa monica, ca. individual thought processes, no less important after all, 3- Brown, S.c., and craik, f.i.m. (2000). “encoding and retrieval of information”, the oxford are unknown to the group. Handbook of memory (pages 93-107). new york: oxford university press.

HindSight 15 Summer 2012 15 EDITORIAL This is a dangerous issue

By Professor Sidney Dekker This issue of HindSight could turn out to be the most dangerous one yet. Here is why. A number of the stories shared in HindSight represent best practice in the fi eld. They make, either implicitly or explicitly, suggestions about how emergencies and unusual situations can be handled well. This seems like a really good idea. Share ideas, publicise best practice, learn from each other.

16 It is incredibly sad if a profession feels that it cannot safely share lessons about its best practices. It is even sadder that this is the result of self-censorship imposed for fear of prosecutors. Self- censorship is defi ned as the act of withholding, classifying or This is a dangerous issue hiding one’s own work out of fear of how others may react or use the information—but without overt or prior pressure from ntil I got a letter. The letter is from two practitioners these others, that is, from any specifi c body or institution or Uwho have written a book about best practices in their authority. Self-censorship has been more or less common in domain. Among these are best practices for handling emer- news reporting, in publishing, in politics, in science. Although gencies and unusual situations. The book is all but done, there may be good reasons for it in some cases (taste, decency, and ready to be published. The two authors write in this let- ethical considerations), self-censorship is often seen as suicidal ter how professional organisations, like those that air traffi c for democracy. It interferes with free speech, with democratic controllers have in their own countries and internationally, discourse, with openness of information. have pushed back really hard to prevent its publication. They do not want the book to come out. The reason is this. People who censor themselves may end up aff ecting a lot of The professional organisations who have objected to publi- other people when they don’t share what they have to say. But cation feel that the book, and the examples in it, could eas- then, you cannot blame them at all. With the judiciary increas- ily be used by prosecutors around the world. They fear that, ingly fi lling the moral vacuum in the wake of secularisation, we after an incident or accident, prosecutors will use the book’s face a stark and awful choice. Either we share our best practices case studies to demonstrate how the person in question did and learn from each other, but then we put individual prac- not adhere to best practice. The best practices in the book titioners at risk of prosecution. Or we don’t share and do not will be used to show the errors in judgment, the prosecut- give prosecutors the answers in the back of our book, but then able, criminal negligence of those involved in incidents or we might well get stuck below our best practice, eventually in- accidents. creasing risk for a lot more people.

So how do we get out of this situation? The risk, most promi- People who censor themselves nently, is in publishing stories about our own best practice as may end up aﬀ ecting a lot of other if they are authoritative, as if they are the fi nal word. Because then others can read those stories, compare them to evidence people when they don’t share of actual practice, and point out where our colleagues failed. What we need to do then, is make sure that our stories of best what they have to say. practice are never closed. That they remain forever open. What “best practice” is changes over time, it changes per perspective, per country, per operational centre. That way, we can never be Against the background of more and more criminalisa- pinned down by somebody who says: “this is your best prac- tion of professional errors, this makes sense. Their fears are tice!” We can always respond by saying, “Well, well-grounded. Prosecutors in a number of countries have yes, it was, according to that person at that been using incident and accident reports liberally as a ba- time. But look, here are twenty-six other sis for prosecution already. So it isn’t a large stretch of the publications on this particular practice, imagination that prosecutors would put the incident or and it reveals a lot more possibilities of accident report (which details how things were not done what ‘best’ means.” If we keep the notion well) next to a book that shows how things are practiced of best practice negotiable, we not only well. The gap between the two will be an index for the keep up the constant development and re- strength of their case against the practitioner in question. fi nement of our professional excellence. We can also keep our colleagues out of trouble. So publishing our best practices is like giving prosecutors all the answers in the back of our book – well before any test. The authors of the letter write, “Rather than alienat- ing several of our international professional organizations, we have decided to put the book on hold.” And then they Professor Sidney Dekker warn, “to retreat and isolate ourselves and train our next is Professor and Director of the Key Centre for Ethics, Law, Justice generations of practitioners with a litigious, defensive and Governance at Griffi th University, Brisbane, Australia. mindset will bring advanced knowledge [of our best prac- Author of best-selling books on human factors and safety, tices] to a halt.” he has had experience as an airline pilot on the Boeing 737.

HindSight 15 Summer 2012 17 THE VIEW FROM ABOVE Being prepared – for worse than ‘expected’! By Captain Ed Pooley OK, there is an Emergency – A multi crew public transport aircraft has declared a ‘MAYDAY’.

You have rapidly ‘woken up’ and are tem- roles between the two pilots – PF ‘pi- porarily saying goodbye to the predict- lot fl ying’ and PM ‘pilot monitoring’ – is able routines of your day-to-day comfort sensible. Often, it will be a good idea zone and beginning to respond – just as for the aircraft commander to remain you were trained to. or become PM so as to be able to stra- tegically manage the problem and But you know that as a controller you act as chief communicator with will, more often than not, be trying to the co- pilot fl ying / managing assist the pilots by doing whatever you the aircraft. This may help the can to reduce their suddenly increased clarity of communications workload without knowing the full facts to ATC from the aircraft of the situation they are facing. Some- since communications times, you know that awareness of more are then direct from of these facts would enable you to help the decision maker more. Other times, it may not – possibly instead of being (but certainly not necessarily) because routed through you cannot grasp the signifi cance of the junior pilot. ‘technical’ information. Either way, you usually (correctly) judge that the last However, what thing an overloaded fl ight crew need is I really want to any more than the minimum of R/T to ‘discuss’ is the pre- deal with. sumptions that a controller handling From the pilots’ perspective, I can an emergency might tell you that: reasonably make about the professionalism of the n They will frequently delay declar- fl ight crew they are trying to help. Hav- ing an emergency to the extent ing looked around at your fellow con- pilots who train in pairs in their simu- that you will suspect one exists trollers, you will probably have decid- lators, the value of the training to one before they do. ed long ago that some of them seem pilot is often at least partly dependent n If they want something specifi c to perform better under the pressure on the aircraft knowledge, manage- from you they’ll usually ask for it. of a relatively short lived emergency ment and handling skills (relative to n As they have absolutely no idea than others even though you’ve all re- rank and experience) of the other. how much you are likely to under- ceived the same training and passed stand about the technical details the same competency checks. If, as a controller, you make the as- of their emergency, they will usu- sumption that, by and large, the two ally communicate these based on Well surprise, surprise, it’s much the pilots don’t usually make emergency their assessment of ‘need to know’. same for pilots who, like controllers, situations worse even if their actions are trained and especially assessed in may have contributed to or even Many aircraft operators advise that at ways which largely remove any ele- caused them in the fi rst place, you may the onset of an emergency, a review of ment of surprise from what occurs. For be wrong. 44

18 HindSight 15 Summer 2012 19 THE VIEW FROM ABOVE

Being prepared – for worse than ‘expected’! (cont’d)

Interestingly, some pilots who realise obsessively, trained for happens but that they’ve messed up sometimes the response ‘on the day’ ignores al- perform with great skill when respond- most every critical element of that ing to the situation they’ve created. training. In June 2010, a ‘classic’ Boe- Many will remember the Air Transat ing 737 being operated by what was pilot who ran out of fuel on the way then the low cost division of Royal Air across the Atlantic in 2001 and then Maroc, Atlas Blue, hit a fl ock of geese successfully glided his Airbus A330 65 just after getting airborne at Amster- miles to a pretty creditable safe arrival dam. It took a full four minutes (which at Lajes in the Azores. Many other pi- is a very long time in an emergency) lots pull off successful outcomes after before the pilots got around to the the onset of sudden emergencies they thing they were persistently (and al- had no part in creating which invari- most obsessively under current regu- ably depend on both their fl ying latory requirements) trained to do fi rst skills and their knowledge of and without delay – to carry out the how planes fl y in gener- memory actions for the (single) en- al and how their par- gine failure that they recognised had ticular aeroplane resulted from bird ingestion. And in works. Recent what can only have been some sort examples in- of irrational panic response, the fi rst clude the well- action of the Captain, having just lost known post 50% of his thrust, was to order that the bird strike still in-transit landing gear be re-se- ditching in lected down because it was indicating the Hudson unsafe. Yet all landing gear indicates by a US Air- unsafe when it is moving to a selected ways A320 position. And even if the unsafe indi- in 2009 cation had been indicated by gear in a and the al- previously locked position, the imper- most as well ative after losing half your thrust near known British the ground is to climb to a safe height Airways Boeing using what remains and minimising 777 undershoot at drag by ensuring that the landing gear London Heathrow in 2008 fol- is up as quickly as it would normally be lowing almost complete fuel starva- after any take off and the failed engine tion due to fuel feed icing on short is ‘secured’. Those actions collectively fi nals. and signifi cantly reduce drag, which itself would otherwise reduce the rate But then there are ‘the others’. Some- of climb. thing which has been regularly, even In this case, ATC were aware straight away `what` had happened but could not have guessed what would come Captain Ed Pooley is an experienced airline pilot who for next. The requested and issued radar many years also held the post of Head of Safety for a large short haul airline operation. headings provided by ATC were com- He now works as an independent air safety adviser for a range of clients and is currently pletely ignored and as daylight faded, an erratic nine minute perambulation acting as Validation Manager for SKYbrary. began which took the aircraft over some of the suburbs of Amsterdam

20 at or below the height of the tallest buildings. It was accompanied by, at times, an almost continuous (and val- id) activation of the on board Ground Proximity Warning System (GPWS). In this particular instance, the applicable ATC procedures – give radar vectors – seem to have completely failed to take account of the risks of giving such vectors below MRVA (although at least in this case the aircraft was in VMC). The message here is that the controller could not have known and could hardly have expected what was actually happening on board the aeroplane even when it was already clear that there were some major control diffi culties.

and heading instrumentation for both standby compass which is diffi cult to use The controller could not pilots. The evident diffi culty which the in a turn.- quite possibly the combined crew were having in controlling their cause of his inability to fl y headings. De- have known and could aircraft manually using the standby spite the fl ight crew failing to recognise attitude display and the standby com- that their situation amounted to a MAY- hardly have expected pass was compounded by insuffi cient DAY scenario, instead describing it as just what was actually language profi ciency to properly com- a ‘navigation problem’, ATC also came in municate with ATC the nature and ef- for a bit of criticism on account of their happening on board the fects of their problem – surely an expe- slowness to recognise the de-facto emer- rience which many controller readers gency given that only the availability of a aeroplane even when it will have had at least once. Anyway, visual approach readily facilitated a safe was already clear that despite no emergency being declared, outcome. It was also suggested that ATC ATC (eventually) recognised the se- could have made more eff ort to facili- there were some major riousness of the circumstances and tate the positional awareness of pilots in provided a discrete radar frequency IMC rather than confi ning their guidance control diﬃ culties. to help achieve a safe return. With the solely to headings and track miles to go. fortuitous addition of VMC below 1500 feet aal, a safe landing was achieved However, these are just details from par- after 27 minutes of fl ight. ticular examples. What is the purpose in Back in 2007, the controllers at London telling you about the problem of what Heathrow were faced with a similar As with the Amsterdam event, the you don’t know? You certainly can’t do sort of situation in which an aircraft track fl own by the aircraft from take much about it. was being fl own erratically around off to touchdown and reproduced in some of the busiest airspace in Eu- the respective investigation reports is Or can you? Sometimes, when faced with rope, albeit at higher altitudes than in interesting to say the least. Contrary the unexpected, knowing what you don’t the Amsterdam example. In this case to the Amsterdam event however, the know is almost as important as what you it wasn’t a bird strike but a failure by right seat co pilot was and remained do know ….but do be careful how many the crew to set up the aircraft naviga- PF – but had to fl y from a standby at- questions you ask an overloaded crew if tion systems properly before the fl ight titude instrument available only in you can see some useful clues on your began which disabled normal attitude front of the aircraft commander and a radar screen.

HindSight 15 Summer 2012 21 121.5 – SAFETY ALERTS

Safety RemindeR meSSage Interceptions of Civil Aircraft - Operation of SSR and ACAS II

Released on 22 December 2011 By Richard “Sid” Lawrence Synopsis EUROCONTROL has learnt of incidences where ﬂ ight safety has been compromised and unnecessary TCAS Resolution Advisories (RAs) triggered during interceptions of civil aircraft because of misunderstanding regarding the operation of aircraft During the past few months the transponders and the properties of ACAS II. EUROCONTROL Safety Alert service has “been approached by a number of stake- holders requesting the promulgation of a Safety Alert covering a variety of topics. In ICAO Provisions – ACAS II the pages that follow, I will describe two of n PANS OPS (Doc 8168, Vol I), the Alerts that I hope will spark your interest. Defi nitions: “Airborne collision avoidance system (ACAS). An aircraft system based on secondary surveillance radar (SSR) transponder signals which operates As previously, my intention is to try and independently of ground-based equipment to provide advice to the pilot on po- bring new information to the table. The aim tential confl icting aircraft that are equipped with SSR transponders.” is to feature more in the way of feedback, Chapter 3, § 3.1.1 “Resolution Advisories (RAs)… propose vertical manoeuvres responses, comment and analysis to get the that are predicted to increase or maintain separation from threatening aircraft.” most from each Alert. n Annex 6, § 6.18.2: “…all turbine-engined aeroplanes of a maximum certifi cated take-off mass in excess of 5,700 kg or authorized to carry more than 19 passengers If you would like to know more about the shall be equipped with an airborne collision avoidance system(ACAS II).” EUROCONTROL Safety Alert service, register as a subscriber, submit a suggestion or have

a subject that you wish to consider then ICAO Provisions – Interception of Civil Aircraft

please contact me at richard.lawrence@ n Annex 2, Chapter 3, § 3.8.1, Note. “As interceptions of civil aircraft are, in all cas- eurocontrol.int. es, potentially hazardous, the Council has formulated special recommendations “ which Contracting States are urged to apply in a uniform manner”. The fi rst alert is a Safety Reminder Message, “Interceptions of Civil Aircraft – Operation of n Annex 2, Appendix 1, Attachment A, § 3, 3.2: “An aircraft equipped with an SSR and ACAS II” ... airborne collision avoidance system (ACAS), which is being intercepted, may perceive the interceptor as a collision threat and thus initiate an avoidance manoeuvre in response to an ACAS resolution advisory. Such a manoeuvre might be misinterpreted by the interceptor as an indication of unfriendly intentions. It is important, therefore, that pilots of intercepting aircraft equipped with a secondary surveillance radar (SSR) transponder suppress the transmission of pressure-altitude information (in Mode C) replies or in the AC ﬁ eld of Mode S re- Alternatively, register your interest through the EUROCONTROL Website – Safety Alerts Board plies) within a range of at least 37 km http://www.eurocontrol.int/safety/public/standard_page/safety_alert_board.html (20 NM) of the aircraft being intercept- or go to SKYbrary: ed.” (Note: Bold text is EUROCONTROL http://www.skybrary.aero/index.php/Portal:EUROCONTROL_Safety_Alerts emphasis) to access the Alerts featured here and all previous Alerts.

22 Interceptions of Civil Aircraft - Operation of SSR and ACAS II

n ICAO Doc 9863: Airborne Collision Avoidance System (ACAS) Manual, Appendix 7

“A7.2 ADVICE FOR NON-MODE S-EQUIPPED A7.3 ADVICE FOR MODE S-EQUIPPED FIGHTER FIGHTER AIRCRAFT AIRCRAFT

A7.2.1 Arrangements to be used by military fighter A7.3.1 Covert intercepts are intended to prevent the fighter aircraft for covert intercepts from responding to ACAS interrogations while the fighter can still respond to ATC ground-based interrogations. A7.2.1.1 When closing in on an aircraft to be intercepted, the military pilot disables Mode C. (Some military users switch the A7.3.1.1 In this case, the intercepting pilot will select an Inter- transponder off or to “Standby” resulting in no reply to any in- cept Mode. Under these conditions all replies to UFФ (short air-air terrogation.) In this procedure, the lack of altitude information surveillance) and UF16 (long air-air surveillance) interrogations will prevent all RAs. will be suppressed. Nevertheless the fighter’s transponder will respond to all ground-based ATC system interrogations. Therefore, A7.2.1.2 At least under peace-time conditions, Mode A trans- the fighter remains visible to ATC. missions should be enabled at all times to make the fighter aircraft visible for SSR/IFF ground radar systems (but without A7.3.1.2 The fighter with activated Intercept Mode will continue altitude information). to be a threat to all ACAS-equipped aircraft, if the Intercept Mode is not cancelled after the end of the mission. A7.2.2 Arrangements to be used by military fighter for demonstrative intercepts A7.3.2 Demonstrative intercepts are intended to keep the In- terceptor visible to both the intercepted aircraft and to ground A7.2.2.1 During this type of intercept, it is highly desirable to surveillance. avoid RAs, even though the intercepted aircraft detects the approaching Interceptor. There is no other alternative for non- A7.3.2.1 To avoid that an ACAS-equipped aircraft generates an Mode S-equipped fighters than to eliminate the altitude value RA against an approaching Mode S-equipped fighter, the height in Mode C messages. In this case, only the framing pulses will value in ACAS replies (DF 0 or 16) must be suppressed, but replies be transmitted. If there is no altitude value in the Mode C mes- are still available for Mode S ground interrogations. If there is no sages, ACAS will detect the military aircraft, but only TAs can be altitude information in the replies to ACAS interrogations, the generated. Ground-based systems can track the fighter aircraft, fighter will be recognized by ACAS, but only TAs can be generat- but without altitude information. ed. For ground-based Mode S interrogators there will be no difference from the normal behaviour, and the controllers have control A7.2.2.2 There should be an indication on the control panel or of the whole air situation. the IFF function display of the fighter aircraft when the altitude reply information is inhibited in this way. A7.3.2.2 A software change will be necessary to military Mode S transponders on fighter aircraft, and when the Intercept Mode is enabled there should be an indication within the pilot’s normal viewing area.” 44

HindSight 15 Summer 2012 23 121.5 - SAFETY ALERTS

Safety Reminder Message (cont’d)

ian counterparts. To enable this to happen safely there needs Analysis to be explicit and detailed cooperation and coordination between the military authorities controlling the interceptor and Regarding the actions when an RA is generated, according the civilian authorities controlling the intercepted aircraft (as is to PANS OPS, Chapter 3, § 3.2,(c) “…in the event of an required by ICAO Annex 2). RA, pilots shall respond immediately by following the RA as indicated, unless doing so would jeopardize the safety of Finally, military flight crews should also be aware that, since the aeroplane.” So, pilots will ‘’follow the RA’’. ACAS II will not track any aircraft with a vertical rate in excess of 10,000ft/min, operating outside these parameters during an Regarding the suppression of Mode C data, the situation intercept will render ACAS II ineffective. varies between those aircraft that are Mode S-equipped and those that are not. For the latter, depending on the type of intercept being conducted, the intercepting air- Your attention is required craft’s SSR Mode C should be inhibited as per ICAO Doc State Military and Civil Authorities are invited to take note 9863, § A7.2. This will preserve flight safety whilst still per- of the subject and ensure that their national regulations and mitting the prosecution of the intercept. administrative directives relating to the interception of civil aircraft comply with ICAO Annex 2 and follow the advice con- However, for those fighter aircraft that are Mode S- tained in ICAO Doc 9863. equipped the picture is less clear. Only very few air forces’ interceptors currently have the Mode S Intercept Mode Aircraft Operators and Air Navigation Service Providers are in- available and pilots of these aircraft can follow the advice vited to note the subject for information and awareness. in ICAO Doc 9863, § A7.3 above. This de-activates the air- to-air communication of Mode C data but preserves the air-to-ground link so that controllers can still see the inter- EUROCONTROL Comment ceptor and its altitude. For those Mode S-equipped fighters that do not have Intercept Mode capability, the issue is The interception of civil aircraft clearly requires close coop- that Mode S continues to send out altitude information to eration and coordination between the authorities prosecut- all air and ground receivers even if the Mode C element is ing the mission, i.e. the military pilots and military air de- suppressed. fence/ATC, and the civil ATC provider looking after the civil aircraft. The solution to this difficulty, adopted by a number of air forces, is for the interceptor to switch OFF the Mode S Within Europe, the NATO EUROCONTROL ATM Security Coor- transponder, in total, at the appropriate point in the inter- dination Group (NEASCOG) monitors these activities and takes ception. The pilot can still relay altitude information to the any necessary steps to ensure such operations are conducted military control authority who in turn can advise their civil- safely and efficiently.

Further reading

n SKYbrary - ACAS n EUROCONTROL ACAS II Training Brochure: http://www.eurocontrol.int/msa/gallery/content/public/documents/ACAS_training_ver20.pdf n ICAO Annexes 6 and 10 (Volume IV). n ICAO Doc 4444, PANS ATM. n ICAO Doc 9433 - Manual concerning Interception of Civil Aircraft: (4.1.2.16, Note).

24 Request for Support message Reduced Runway Length Operations during Construction/ Work in Progress – ATIS and Radiotelephony Messages

published on 17 January 2012 FAA Provisions FAA InFO Notice 11015 states that, “For runways that are undergoing construction or have Synopsis recently completed construction. Operators and pilots can expect to hear the following messages via the ATIS recording. In situations where the runway has been shortened, operators EUROCONTROL had been re- will hear “WARNING” and “SHORTENED” quested by IATA to raise awareness about an FAA InFo notice (11015 n For example: “WARNING, RUNWAY (number) has been SHORTENED, (length in feet) FEET dated 1 September 2011) which informed aircraft operators about AVAILABLE.” ATIS messages and additional R/T phraseology associated with In addition, it states that, ‘“SHORTENED” will be used as part of the take-off (or line up and reduced runway length operations wait) and landing clearance…’ during and following aerodrome/ runway construction work in the n For example: “RUNWAY (number) SHORTENED, CLEARED FOR TAKE OFF.” USA. Note: These procedures will apply for the duration of works or until a permanent short- ening of the runway is reflected accordingly in aeronautical publications. Purpose The purpose of this Request for ICAO Provisions Support message was twofold: ICAO Annex 11, Air Traffic Services, 4.3.7, states that ATIS broadcasts shall include, first to highlight the FAA approach “k) other essential operational information.’’ to advising reduced runway length available; and second to gain a ICAO Doc 4444, PANS ATM, 7.5.2 “Essential information on aerodrome conditions shall better appreciation of European include information relating to the following: practices, procedures and phrase- a) Construction or maintenance work on, or immediately adjacent to the movement area… ologies being applied in these h) any other information.” circumstances with a view to as- sessing if a consistent, harmonised ICAO Doc 4444, PANS ATM, 7.5.3: “Essential information on aerodrome conditions shall global position could/should be be given to every aircraft, except when it is known that the aircraft already has received all or considered. part of the information from other sources. The information shall be given in sufficient time for the aircraft to make proper use of it, and the hazards shall be identified as distinctly as possible. Note - “Other sources” include NOTAM, ATIS broadcast, and display of suitable signals.”

HindSight 15 Summer 2012 25 121.5 - SAFETY ALERTS

RequeSt foR SuppoRt meSSage (cont’d)

ICAO Doc 4444, PANS ATM, Phraseologies 12.3.1.10: “d) CAUTION CONSTRUCTION WORK (location; Summary of responses e) CAUTION (specify reasons) RIGHT (or LEFT), (or BOTH SIDES OF RUNWAY [Number]; There were only 8 responses to this particular RFS message: f) CAUTION WORK IN PROGRESS (or OBSTRUCTION) (position Four ANSPs, two civil aviation authorities and two aircraft op- and any necessary advice).’’ erators.

(EUROCONTROL Note: “Necessary advice” includes “essen- The general fi ndings were that: tial information” such as reduced TORA/LDA that may be associated with any WIP/construction work.) n ANSPs followed the existing ICAO provisions and phraseology. There was no call to introduce similar wording in Eu- rope. However, 2 CAAs (one European, one African) thought Analysis that it might be worth debating the merits of adopting the US FAA phraseology. When construction work reduces the length of the runway n ANSPs are aware of the impending proposed change to distance available for take-off and landing, it is imperative ICAO EUR SUPPS to replace “TAKE-OFF” with “TOR-AH” in the that this information is made available to aircraft opera- context of runway intersection departure clearance phrase- tors and fl ight crews in a timely manner. In turn they must ology. (See below for more about this specifi c issue) be aware of, and fully understand, the messages they may n One aircraft operator recommended that all runway dimen- hear/see on the ATIS/DATIS and/or receive from ATC as part sion changes should be promulgated in metres in addition of their air traffi c clearance. to feet.

There are existing ICAO provisions covering these circum- After discussions with EUROCONTROL Agency in-house runway stances and the FAA has complemented them by introduc- safety and procedures experts, it was decided that no further ing its own bespoke phraseology as a safety risk reduction follow-up action should be taken. However, the situation will measure. Flight crews should therefore be aware of specifi c continue to be monitored through mechanisms such as EVAIR (regional and local) procedures and phraseologies that ex- (EUROCONTROL Voluntary ATM Incident Reporting), the Safety ist to inform them about reductions in TORA/LDA associ- Improvement Sub Group (SISG) and the European Working ated with runway construction/WIP scenarios. Group for Runway Safety (EWGRS). At national/local level, Lo- cal Runway Safety Teams (LRST) can also maintain an overview. Information requested Air navigation service providers, aircraft operators, aerodrome operators, local runway safety teams, and national aviation authorities are invited to note the subject and submit their national/local procedures relating to such cases, including ATIS and/or ATC phraseology to be used and aerodrome (temporary) signage.

Respondents are also invited to indicate the need, or otherwise, for a more harmonised approach regarding the procedures and phraseology to be used in the circumstances described.

26 Further reading n FAA InFO Notice 11015 dated 1 September 2011. http://www.faa.gov/other_visit/aviation_industry/airline_operators/airline_safety/info n FAA Air Traffi c Organisation Policy Notice N JO 7110.564 - 22 September 2011. http://www.faa.gov/air_traffi c/publications/ n ICAO Annex 14, 2.8 Declared Distances. n ICAO Annex 14, 2.13 Coordination between Aeronautical Information Services and Aerodrome Authorities.

Reduced runway length operations – Intersection departures – revision to ICAO EUR SUPPS, ICAO doc 7030, phraseology

As part of the research for the Alert, it was found that the ICAO In addition, the EANPG recommended that the word “RE- EANPG (European Air Navigation Planning Group) was in the DUCED” should also be omitted in future since it was obvious process of proposing changes to the phraseology in the EUR that departing from an intersection would reduce the length SUPPS, ICAO Doc 7030, relating to the provision of information of the TORA. for intersection departures. An ICAO State letter was circulated in January 2012 asking Specifi cally, the EANPG had recommended that, to bring the States to comply with the revised phraseology. EUR SUPPS into line with the guidance in ICAO Doc 9870, Man- ual for the Prevention of Runway Incursions, the phrase “TAKE- To supplement the oral message, ICAO Annex 14, Aerodromes, OFF” should be removed from the EUR SUPPS phraseology for recommends that an intersection take-off sign should be pro- intersection departures because it contradicted the advice vided, when there is an operational need, to indicate the re- given in ICAO Doc 9870, which says that the words “TAKE-OFF” maining TORA for intersection take-off s. In addition, Annex 14 should only be used as part of a take-off clearance. Instead, the § 5.4.3.29 says that, “the inscription on an intersection take-off acronym TORA (to be pronounced “TOR-AH”) should be used. sign shall consist of a numerical message indicating the remaining take-off run available in metres plus an arrow, appropriately Thus, typical phraseology to be used by ATC to warn pilots of located and oriented, indicating the direction of take-off …”. reduced runway length from an intersection should be: ANSPs should cooperate with aerodrome operators to clarify “CALL SIGN, TORA (TOR-AH) RUNWAY 09, FROM INTERSECTION the signage requirements at individual aerodromes. ALPHA, 2800 METRES”.

...the word “REDUCED” should also be omitted in future since it was obvious that departing from an intersection would reduce the length of the ... neck of the giraﬀ e...

HindSight 15 Summer 2012 27 CASE STUDY Case Study - The garden party By Bengt Collin, EUROCONTROL

One hour after the time announced in Alberto, his butler, barbecued. After berto moaned before giving up. The the invitation, late visitors kept drop- some mild persuading he agreed to visitors seemed happy, he especially ping in. Irritating! Why couldn’t people use the new barbecue sauce found in noted Anne, dear old Anne. Instead show some respect? He was a well re- a glossy magazine, olive oil, garlic, soy of bringing her usual boyfriend, she spected man in his best years, known sauce and black pepper, all topped had brought a compact dog named for his strict principles. He was dressed with a large glass of Jack Daniels. Why Davidic. For the moment Davidic was in rather formal leisure clothing. Al- should Alberto always have a diff erent lying on the grass enjoying life, eating though the weather had stayed warm opinion? “It is unnecessary to use that a Chorizo sausage. At least the dog and dry, the sky was as blue as the wa- barbecue sauce, it’s too expensive”, Al- liked the new barbeque sauce! “He ter in his swimming pool. He would understands everything I say to him”, never dream of wearing shorts, shorts Anne explained. “He even understands are for boy scouts, not real men he French”. She was abruptly interrupted thought, overlooking his large man- by the noise from a big aircraft passing sion with a stiff upper lip. straight over them on a very low altitude. They are not allowed to fl y over here, it is forbidden. He would call the airport immediately and complain!

The airline had a restricted budget, not that this was unusual, a lot of companies were suff ering this way. Most of the aircraft were legacy types, not necessarily unsafe, just old. He did not really think much about it, he had been fl ying for the company for so long that he’d got used to the minor snags that were more of a routine than surprises out of the blue. Finally, following a delay caused by a problem with closing one of the cargo doors, they got airborne. They made a right turn northbound. “Gear up” he called, but they could still hear noise from outside. The gear is still down, his First Offi cer said, even though it was very obvious. The Cap- tain started picking up the emergency abnormal check list at the same time

28 as he was talking to his First Offi cer. They had never trained for situations The pilot of the diverting aircraft called like this in the simulator; it was always him, requesting an immediate turn and landing aids out of service, TCAS, engine failures, but never this. direct route to his new destination, “Recycle the gear”. This did not help, “Control E-line 123 fuel at minima”. the gear remained down, by how much they did not know. He could read his First Officer’s mind like an open He was working the South sector. approve the direct route, without re- book. “No, we do not need to return, The Planner informed him of a really knowing why. Perhaps it was his we can continue with reduced speed vision. One of the aircraft heading old training to react to trigger words, and at a lower altitude. Tell control we northbound, instead of passing at who knows? When he heard the word request flight level one one zero ini- high altitude, would be diverting to fuel, he defi nitely reacted. Today stu- tially and with lower speed. We don’t an airport in his FIR. It would enter at dents were instructed to ask whether want to end up back at an airport with a much lower fl ight level than nor- or not the pilots had declared an no engineering support”. The First Of- mal. His work went on like it always emergency, strict and time consum- ficer received the clearance. They’d did while he kept this information ing he thought. better contact their company about stored somewhere deep inside his the now-necessary transit stop, it was brain. Suddenly he started think- The First Offi cer calculated the fuel us- obvious they couldn’t reach the final ing about the time when during a ing the FMS; “we’ll be below minima if destination without refuelling. holiday he’d visited a bar in beau- we continue”, he quietly informed his tiful Leyton, a picturesque part of Captain. “We’re actually already below He was an experienced controller; east London. A tall, enormous scary the fuel level where the book says we after passing his final tests ten years looking guy had come up to the bar should divert to the nearest suitable ago, he’d always thoroughly enjoyed on his right-hand side, and ordered airport. But company ops has chosen his job. Now it was even better after a small bottle of Babycham (a light this for us, they initially thought we he’d met Sandra, another controller, a sparkling perry). Why was he think- could continue even further to one dark-eyed beauty with an impressive ing about things like that? Better intellect. He spent the first two hours not mention this to Sandra. The pilot 44 of his shift in the radar simulator; it of the diverting aircraft called him, was years since they’d had a full day’s requesting an immediate turn and periodic training. The shortage of con- direct route to his new destination, trollers was more or less permanent “Control E-line 123 fuel at minima”. and the increase in traffic didn’t make Although the aircraft was still in the Bengt Collin things better either. This year they airspace of the adjacent FIR, he ap- works at EUROCONTROL were being trained for radar failure. proved the request straight away. HQ as an Senior Expert Yet again, he thought; it had been the Long afterwards he thought about involved in operational same last year too. Might as well be why he had done that; nothing ATC safety activities. trained in the kitchen, one of his col- had forced him, nothing had indi- leagues commented; if you have no cated that something was seriously radar picture, why not sit somewhere wrong. He certainly wasn’t allowed Bengt has a long background as Tower and comfortable with a nice cup of cof- to do so without prior coordination, Approach controller at Stockholm-Arlanda fee and a sandwich, after all it’s only a after all the aircraft wasn’t in his own Airport, Sweden simulation, isn’t it? airspace. He had just felt he should

HindSight 15 Summer 2012 29 CASE STUDY

case study The garden party (cont’d)

of our standard airports”, the Captain replied. They were handed over to the next frequency, this time in the FIR of the destination airport and the exchange stopped. “Ask for a direct route”, the Captain instructed the First Officer. “We could always have Bol- libompa airport as a final alternate”. They received the direct route immediately; on box two, the Captain called on the approach frequency for the airport and, in an extremely modest and humble way, advised that if a direct approach to the closest runway wasn’t possible, they would have to divert to Bollibompa. Six minutes later the Fuel Low Level warning light came on. They’d never seen that warning before; of course they understood what this was – it was a far from ideal situ- avoid the restricted area. “We cannot There were five persons sitting to- ation. “How could we have used this turn E-line 123”. Cannot turn, why can’t gether in the warm meeting room much fuel?” the captain complained, he turn? “We are short of fuel E-line – the Chairman of the investigation whilst still maintaining a calm and re- 123”. What a shock, “OK copied, con- commission, himself, the area con- laxed demeanour, “you checked the tinue on present heading”. The Planner troller, a person from their union and fuel consumption in the FMS didn’t alerted the Supervisor. a secretary. you?” They still had more than 100 nm to fly. “I still don’t understand why the FMS “We have found two annoying dis- gave us inaccurate information”. The crepancies”, the Chairman, dressed The approach controller got the air- Captain started talking to himself in a grey suit, a blue shirt and a craft on his frequency. It was heading more than to his First Officer; “we green tie with a red big fish motif on 340º towards a short final for runway should make it anyhow, we’ve only it, spoke in a measured and formal 03; he needed to turn the flight slightly got 25 miles to go”. The First Officer de- way. He had a military bearing and to the left to avoid a Restricted Area scended the aircraft relatively slowly. exuded an air of ‘Old Spice’. just south of the airport. This area “I can see the runway”, the Captain had been introduced because of po- pointed straight ahead, “should be OK. “First we noticed”, the Chairman con- litical reasons some years ago, at least Is the cabin ready?” tinued, “that the aircraft was, with- that was what the rumours said. The out any coordination at all, allowed wealthy house owners living in this ex- “Cleared visual approach runway 03, to proceed directly to the revised clusive area didn’t like to be disturbed. contact tower 119,4”. He looked at the destination. Secondly, and this I find How, he always wondered, had they radar screen; the aircraft was passing even more disturbing and annoy- missed noticing that there was an air- straight through the Restricted Area. ing”, he talked straight out into the port close by? After all, the airport had room, keeping his eyes closed; “it been there long before they’d started “Thank you, cleared to land runway was cleared to cross the Restricted building their houses. He instructed 03, E-line 123”. They turned final 2 Area south of the airport. I have to the aircraft to turn 30 degrees left, miles from touch down, wheels down, inform you that we have received nothing happened. “Control E-line 123 all indications normal; one mile, the some serious complaints which as I we’d like to continue on present track” runway was waiting in front of them, speak are reverberating around the one of the pilots replied. What should a warm, happy welcoming runway. top floor, so you’d better be pre- he say, he had to turn. “E-line 123 turn Touch down! Finally touch down – the pared to face the consequences of left heading 310 now”, he could still engines stopped. your actions”.

30 CASE STUDY Case Study Comment 1 by Captain Ed Pooley

You have seen that this incident was a near disaster – how near we are not told but it doesn’t matter. The analysis of the circumstances up to the safe landing is the same as if the aircraft had run out of fuel and crashed on short fi nal.

So this was a ‘Serious Incident’ as de- approve penetration of the Restricted fi ned by ICAO Annex 13 and in real This knowledge-based Area. The remark about the crew not life would have generated an inde- decision-making got being trained to deal with the pre- pendent inquiry conducted by the cise ‘gear not locked up’ scenario is, State Accident Investigation Agency. lost en route and only by the way, not a factor with much Of course when this happens, if the bearing on the development of the involved parties have any corporate returned as things began event. The use of both the FMS and sense, they carry out their own inter- to get critical and there raw data manually checked to moni- nal review and seek to implement any tor fuel use when in an abnormal gear necessary corrective actions well be- was no longer any down fl ight condition is about pro- fore the Offi cial Investigation Report alternative plan left. fessionalism in decision-making and is published. This allows their ‘Safety fl ight management based upon basic Action’ to be noted in the Offi cial Re- system and aircraft knowledge. This port and the issue of any Safety Rec- pears to have been considered. No knowledge-based decision-making ommendations directed specifi cally just culture in sight…..No mention of got lost en route and only returned as at the agency involved to be avoided. the connection between what profes- things began to get critical and there sionals do and the eff ectiveness of was no longer any alternative plan Here we are focussed on aspects of the training they are provided with. left. the internal response of the ANSP1 And on what documented basis was and it’s not a pretty sight! It should the penetrated Restricted Area estab- The featured controller is ‘old school’ be clear to all that the attitude we lished? – his career began before the days of see displayed by the ‘Chairman’ of this institutional risk management and investigation represents an appalling What seems to have happened from the panoply of procedures which way of dealing with the aftermath for the fl ight crew perspective is a bad have been universally introduced to the front liner who had to deal with case of confi rmation bias2. A perfectly allow safety standards in ATM to be 44 it. No balance here! No context for reasonable decision by the pilot in the performance of the controller ap- command to press on in the direction of the original destination after the gear failed to lock up after take 1- Since a Regulator is not supposed to prejudice an off then degenerates into an attempt independent State investigation by carrying out one to reach the ‘ideal’ en route diversion. of their own in parallel and then discussing their Captain Ed Pooley ﬁ ndings with regulated personnel, i am assuming The key violation is the failure to di- that the reference to “caa” here is in respect of their vert to an alternative airport when the is an experienced airline pilot role as anSp. fuel on board reached the level where who for many years also held the post of Head 2- the state of mind in which you see what you expect to see rather than what is actually happen- a direct track to the nearest suitable of Safety for a large short haul airline operation. ing. in this case, a plan which had originally seemed airport was mandated by operator practicable has subsequently become objectively procedures. Once a direct route is ap- He now works as an independent air safety risky to continue with, but this risk is countered proved, confi dence that the doubtful adviser for a range of clients and is currently by an unconscious interpretation of the current acting as Validation Manager for SKYbrary. evidence as continuing to favour retention of the will be possible is restored and later now-ﬂ awed plan. the controller is eff ectively obliged to

HindSight 15 Summer 2012 31 CASE STUDY

Case Study Comment 1 (cont’d)

improved despite the concomitant Anyway, because the theme of this troller once there was no alternative, growth in traffi c. He certainly reacted HindSight is how controllers can and including allowing routing through inappropriately in granting the direct should respond to aircraft in actual the Restricted Area given that no ac- routing before the aircraft entered or potential diffi culty, I’m going to tual hazard to anybody was created his airspace without coordination. He focus on the actions of the featured by allowing this…. also ignores the absence of any decla- area controller. Did they help avert ration of urgency (PAN, PAN) or emer- an accident? Or did they encourage a gency (MAYDAY) from the aircraft in dysfunctional fl ight crew to press on A RECOMMENDATION support of the successive requests towards a potentially hazardous out- for expeditious routing, and responds come? Actually, I’d say the controller’s As I’m only allowed one, I’ll go for without the normal question on fuel initial response was counterproduc- a comprehensive and indepen- endurance which would follow a PAN tive to safety. Had he sought both a dently conducted review of how or MAYDAY declared because of con- declaration of urgency or emergency the ANSP conducts internal inci- cern about fuel endurance. and some more information from the dent investigations predicated on crew before giving a direct routing, a guarantee that the undoubted The Aircraft Operator doesn’t come this might, just might, have jolted recommendations for safety im- out of this saga too well either. How- the crew into realising that what they provement which it would gener- ever Operations Control seeks to as- were attempting was indeed a fool- ate would be adopted. But I’d also sist their en route pilots in command hardy violation. But of course nobody suggest the instant removal from by telling them what would be com- (except of course the Chairman of the ANSP payroll in any capac- mercially helpful, this should not be the ANSP Investigation!) would argue ity of the Investigation Chairman able to be perceived with the help given by the con- on the grounds that it’s probably as anything more unrealistic to expect him to be than assistance given capable of genuine attitudinal re- without knowledge of all the pertinent facts form. or their short-term forward projection.

But of course, the root cause of this incident is solely the pilot in command, who pressed on in the face of compel- ling evidence that it was foolhardy to do so. As often, not much notice was taken of the First Offi cer whose con- tributions were typically deferential – the oft-vaunted theory that a Co Pi- lot can readily infl uence the thinking of a pilot in command who has both much greater experience and individ- ually carries all the responsibility for the safe and expeditious operation of the fl ight is a lot more complex than is often admitted.

32 Case Study Comment 2 by Dragan Milanovski

A big plane at low altitude passing straight over the garden party spiced up the seemingly dull event. I also fi nd it very diffi cult to understand why someone would complain about an isolated case, probably interesting for most of the people at the party, and how a barbecue sauce can be too expensive?

The fortunate outcome of this incident evaluate diff erent options and provide scene was pretty much set, and there might lead us to believe that the ac- information later on. He could have were no other options. The story sug- tions taken by the two controllers were asked the transferring controller for gests that if this information had been appropriate to the situation and that the reason for the diversion. An aircraft available to the pilots, they would have by exercising their best judgment and experiencing a landing gear problem decided to divert to another airport expertise they signifi cantly contrib- (as described in the story) is likely to be (Bollibompa) where the risk of running uted to it. Furthermore, the controllers short of fuel and ask for direct routing. out of fuel before landing would have had to face consequences for infring- been a lot lower than in this case. ing “stupid” rules during the process, just because people with very little or Was it just their I have to rule out the stress/pressure no understanding of the job had pow- personal negligence, of having to deal with an unusual/ erful political infl uence. Typical… or emergency situation, especially for maybe not. ignorance, or perhaps the area controller, as well as inexperi- ence in the job. A bit of ignorance from Let’s look at whether the controllers something else? the approach controller probably from the story could/should have played a very small contribut- taken a diff erent course of action and ing role in the event (restricted rule out pure luck in combination with With this in mind, asking the previous area established due to po- favourable weather conditions. More controller for a release for turn makes litical reasons – according to importantly, let’s try to fi nd out why a lot of sense. Information about the his understanding), as well as they acted as they did. Was it just their suitable airports in the vicinity, which a bit of negligence from the personal negligence, ignorance, or could have been essential to pilots for area controller (allowing perhaps something else? decision-making, was not provided (al- his mind to wander to though it wasn’t essential in this case). 44 The area controller in charge of the More importantly, prior coordination South sector received a revision for a with the approach controller should fl ight about to enter at a much lower have taken place well in advance and fl ight level than expected and divert to the pilots should have been informed Dragan Milanovski an airport in his FIR. When the aircraft about the restricted area and the ex- is an ATC training expert at the EUROCONTROL Institute of called he reacted instinctively and ap- pected distance to fl y to touchdown. Air Navigation Services in Luxembourg. proved the direct routing as requested without prior coordination. The argu- The last opportunity was missed by Most of his operational experience comes from Skopje ment that he had no time (which at the approach controller when he re- ACC where he worked for a number of years on diff erent the end proved to be crucial), and that ceived an early call from the Captain. operational posts. he had to do it, is not entirely correct. He also did not inform the pilots about Valuable time, from receiving the revi- the restricted area and the 30 degree- Now, his day-to-day work involves ATC training design as sion until the initial call, was not used turn that the aircraft is expected to well as Initial Training delivery for Maastricht UAC. eff ectively to understand the situation, make later on to avoid it. After this the

HindSight 15 Summer 2012 33 CASE STUDY Case Study Comment 2 (cont’d) Case Study Comment 3 by Eileen Senger

thoughts of his new girlfriend while in posi- Communication seems to be good between the pilots tion). However, we have to look “at the top fl oor” for the main reason and possible con- but not between the fl ight crew and company ops... sequences. Ops make it clear what they want and The South Sector controller is in- The situation required immediate reactions, there does not seem to be any attempt formed of an imminent diversion but but as explained above, the reason why the to overrule that decision. Although it not of the reason why. He does not ask. controllers had to rely on their instincts is should always be the Captain who So when the aircraft concerned fi nally probably lack of appropriate knowledge and has the last word when it comes to calls in and surprises him with the rea- skills. It appears that it has been several years the safety of his plane. Still, the two son, “fuel at minima”, precious time has since they received a full day of periodic re- pilots do not even discuss whether or already been lost. Had the fuel status fresher training. In addition, the controllers not they should press ops for a diver- been known to the controllers earlier, did not think the two hours they had was rel- sion to the nearest suitable airport, they could have already begun co- evant content-wise or eff ective. as probably recommended in their ordination to shorten the track and checklist. They just accept the decision save time – for both themselves and The ANSP from the story has to ensure that that is made for them and try to im- the aircraft. When the pilots informed periodic refresher training, as appropriate and prove it by asking for a direct with ATC. the previous ATC unit of their diver- as eff ective as possible, is delivered to control- But, just like Ops, they underestimate sion they must have sounded relaxed. lers unless… the managers prefer to deal with the gravity of the situation. A con- Maybe they mitigated their situation a military bearing and an “Old Spice” odour. tributing factor may be that such an a little bit (“small technical problem” abnormal situation was never trained maybe?). Enough to make that ATC for in the simulator. Simulator time is unit feel that there was no need to valuable and expensive but it should treat them as a priority. Did they ask A RECOMMENDATION be possible as well to have input from for the reason for the diversion? They Despite the story being fi ctitious, the the pilots as to what emergencies should have! Did they get an honest situation with the refresher training is and situations they want to train for reply or just the usual “company in- defi nitely not. We can learn a valuable rather than always just sticking to the struction” answer? Did they pass the lesson and understand that providing required minimum simulator time per revision with the reason or without periodic refresher training is about a lot person. Wishful thinking in it? Or did the planner just not inform more than just ticking boxes to meet diffi cult economic times his radar controller? There are so many regulatory requirements (if any). The like these, especially places where valuable information can training has to ensure that the controllers for aircraft operators, get lost! possess enough knowledge and skills to I know, but again a deal with unusual/emergency situations lost chance to learn Apparently, the reason for the di- whenever they happen. I understand and another missed version was not passed on from the that this is a big challenge, not just from opportunity for com- South Sector to Approach. So, for the a resources point of view, but also munication. second time, the pilots are talking to a from a training design aspect. controller who has no clue to the real However, economic crises, tight situation they are in. Then again, there performance targets and lack of is room for improvement in their com- staff cannot be used as an excuse Eileen Senger munication to the approach controller not to deliver refresher training is an Air Traffi c Controller at EUROCONTROL’s as well. The pilot is described as calling at a frequency and in an amount in an extremely modest and humble Upper Area Control Centre in Maastricht. which are considered appropri- voice for the direct routing rather than She works in the Hannover Sectors which cover ate to the job and with relevant giving the facts and communicating content. north-western Germany and is an OJTI. urgency. Later on, when the controller instructs them to turn to avoid the

34 restricted area, at fi rst the pilots do not reply and then fi rst try to talk their way out of complying with the instruction without giving any information before eventually revealing the real reason. Once they have done so, the controller immediately helps and does all he can to get them on the ground as swiftly as possible. All he can do is react. Only then is the supervisor alerted. Managers and supervisors should be there fi rst and foremost to protect coolly about the situation and getting certain situations in aviation where their staﬀ , provided they the necessary release fi rst. But had he noise abatement is no longer impor- acted with good inten- not done so, the landing of the aircraft tant. Maybe they could have been in- would have been delayed even more formed that the ATC provider would tions and followed their and aggravated the circumstances stick to the noise abatement proce- best judgment. which were already underestimated dures in normal operations. But an air- by everybody involved. Only when the craft low on fuel is no longer “normal Fuel Low Level warning light came on operations” and in any case, I’m sure It is a pity to see that the “top fl oor” was the gravity of the situation clear. that, at the end of the day, the neigh- of the ATC provider does not seem to So in the end his training led him to do bours would prefer a safely landed be interested in the story the people the right thing to help the aircraft. The aircraft to one which crashed in the who were working that particular air- approach controller could only react as vicinity but on the noise abatement craft have to tell. On the basis of only the real situation revealed itself bit by track. They should be able to complain a few facts, the staff are threatened bit. He is the last one in the chain and and be told what was going on, per- and intimidated. There is one-way he is the one who has to suff er from haps via a hotline, but if a reasonable communication – top down: “You the accusations made by the Investi- explanation is then given, they should acted wrongly! Prepare for the conse- gation Commission. The aircraft crew accept it. If such events were to hap- quences!” With such behaviour there might have backed him, but I doubt pen every week of course, it would be will never be open and honest com- that there will ever be any exchange a diff erent story. munication about what was going about the incident between the pilots on and what could be learnt from it. and the controller. As long as the air- Managers and supervisors should be craft landed safely there is nothing to A RECOMMENDATION there fi rst and foremost to protect talk about – that is how many people their staff , provided they acted with think. Exchanging experiences usually Communicate! Talk and ask. Ask good intentions and followed their implies admitting one’s mistakes or again until you have understood best judgment. There are always going revealing operational procedures you fully. Involve other people, col- to be situations where you have to act would rather keep inside the company leagues, supervisors, hear their fi rst and ask questions later. The South or both, so it hardly ever happens. opinion and get their help. Then in Sector controller later remembers his the end no one is confronted with instant reaction to the trigger words And fi nally: The neighbours of the air- an unpleasant surprise. “fuel at minima” instead of thinking port have to understand that there are

HindSight 15 Summer 2012 35 CASE STUDY Case Study Comment 4 by Sami Laine

This story is a great example of how the aviation system is formed and aff ected by various expectations from various domains.

The aviation playground is open, e.g. Seen more closely, it seems that the After a MAYDAY call there should as regards the political, economic and events described were often inde- not be any doubts that the fl ight operational perspectives, which are pendent and that the causal connec- concerned may not be able to com- spiced up with unexpected events. tion was rather loose for the actors ply with all clearances, restrictions or The framework is a combination of involved. Also the possibility of dif- limitations. Without a declaration of multi-level and multi-dimensional ferent people controlling the factors emergency, the controller needed decision-making processes. The high- governing the actual situation was not to help the aircraft based on his gut- end players are added to the play- obvious. The captain failed to respond feeling and professional assessment. ground to comply with the social, rationally to the reducing fuel endur- At the end of the day it may be that technical and economic constraints. ance, the controller was not aware of his “mistake” averted a catastrophe. It would be possible to consider many how bad the situation was in the air- perspectives in this story. In my com- craft and his attempt to avoid the re- It may be that pilots are not very ment I will focus on a single safety is- stricted area was rejected by the pilots. keen to declare an emergency if sue, which could have had a positive it seems that the situation can be impact on the event. It can be said that the situation could managed without it. Use of a MAY- have been clearer for everyone. The DAY call may be avoided even it We know that aviation is a complex outcome was fortunate – a catastro- would clarify many things in the system. When the unusual happens, phe like the New York accident in 1990 handling of abnormal situations. it is typical that things start to pile up. where an aircraft burned all its fuel In many incidents and accidents it is without declaring an emergency was Avoiding the use of MAYDAY may possible to see – especially in avoided. have deep roots in aviation history. hindsight – a continuous It is a known fact that culture is not chain of events. In the sto- Communication plays an essential changed overnight – sometimes ry here, the situation was role in every abnormal situation. In an not in decades. The clear declara- similar. Dominos were fall- American study the most prominent tion of an emergency is not just a ing down and the situation communication problem in accident pilot-ATC communication issue. It is was moving fast towards cases was recognised as communica- also an important CRM issue inside the conclusion. Or was it? tion never starting. Another big issue the cockpit. Effi cient communica- was unclear or incomplete communi- tion is essential for the modern avia- cation. tion system and appropriate use of emergency communications should According to EU OPS, the pilot in com- be a top priority in the industry- mand is allowed to deviate from the wide safety debate. Sami Laine rules and regulations if necessary for safety reasons in an emergency. That completed an MSc in accident and safety gives a lot of freedom to the Captain, A RECOMMENDATION investigation at Cranfi eld University. He is but what exactly is an emergency? Was The aviation community should First Offi cer in the Finnair A340/320 fl eet, the plane in the story in an emergency initiate cultural discussion of fl ight safety analyst and editor-in-chief of the situation, or was the situation merely abnormal and emergency com- Finnair safety magazine. His earlier working escalating towards an emergency? munications and the use of experience was with the Maritime Rescue MAYDAY and other distress or Coordination Centre, Helsinki. By declaring an emergency, all the emergency communications. players are on the same wavelength.

36 TALES OF OPERATIONAL SAFETY e.R. By Alberto Iovino For family reasons, I happen to be acquainted with the fi rst aid emergency protocol for the management of pulmonary oedema. ...

The relevant list of actions is some- correspond to what you could read times deployed on posters, hung on a behind what was happening. Or pos- wall in the emergency room, so that, sibly not, and this might, incidentally, Alberto Iovino if you were allowed inside, you might be among the reasons why you would is currently head of ATS Operational Procedures watch patient and doctor fi ghting not actually be allowed inside. Unit of ENAV Italy. Formerly an airline employee their way through life and death right for 8 years, he became an ATCO in 1997, under the list of actions which are sup- Emergency rooms are, by defi nition, posed to be taken in such a circum- places where people deal with emer- working as tower, approach and area controller. stance. Amazingly, you would be able gencies. From an ATC perspective, it is to follow the meaning of most of what as if, in a corner of control towers and you would see, as it would perfectly control centres, a couple of working positions were consistently reserved I have no knowledge of any provider for individuals with a remarkable organised in this way, for reasons that sense of self-importance and spas- can be quite easily presumed. On modic muscular movements of the the other hand, if the idea somehow face, often smoking cigarettes (yes, it sounded appealing to you, then it is forbidden, but what the hell, those might be worthwhile asking ourselves folks deserve some privileges): the why. emergency team, tough people in charge of getting going when the go- In an emergency, you feel more coming really gets tough. fortable when handled by someone you consider a specialist. One may be able to become so through training and experience; an emergency team member would be somebody specifi - cally trained to deal with emergency situations beyond the average of his/ her colleagues, having had the opportunity to become more and more familiar with the matter through re- peated exposure to such situations. In the emergency team scenario, negative features peculiar to those circumstances, such as uncertainty, unfamiliarity and excitement, should 44

37 TALES OF OPERATIONAL SAFETY

E.R. (cont’d)

be almost eliminated. So the question would be whether this can be achieved, and to what extent, with “normal” controllers, those who remain on frequency when, during an otherwise ordinary shift, an emergency situation arises. Or, in other words, whether operational people are placed in the position of offering a high standard of service in critical moments.

Controller training does include emergencies. Some controllers may not have much real-time experience in the field, luckily some would say, though a pilot actually in need might be of a different opinion. They are in any case constantly called on to be professionals and practice the art of overcoming their emotions. All these aspects are the Coast Guard. It took a while before to the reputation and financial situa- given due consideration; where this is the latter succeeded in identifying the tion of the operator of the vessel. not enough, or not adequate in some relevant ship and its location – not even way, every individual and organisation its name having been initially com- As these lines are being written, it is far should re-evaluate their policy and ef- municated. When they finally did and too early to draw conclusions about ex- fort. Still, in everyday operational life, called to check what was happening, actly how this came about and how it one specific item might be given some the first reply was a confirmation of the was at first perceived by the crew, nor extra care. electrical problem, and no need for as- would I be in possession of all the ele- sistance. ments (and qualifications) to express much more than an educated personal In an emergency, you feel more Shortly afterwards, af- opinion. Nevertheless, what you have comfortable when handled by someone ter admitting the vessel just read is there in the official Coast was holed below the Guard log book and linked to recorded you consider a specialist. waterline and asking communications, so that it can be con- for a tugboat, the crew sidered factual. From the time the lady eventually declared a looked for some domestic comfort, On a clear Friday night early this year, distress situation. In the meantime, which by the way took place after the an almost one-thousand-feet long and in the following minutes, the ship collision occurred, to the time the crew cruise ship with more than 4,000 peo- partially capsized and began to sink acknowledged their emergency status, ple on board struck a reef, a few hours a few hundred metres off an island more than half an hour had passed. after setting sail from its port of origin about ten miles from the mainland. On on the Tyrrhenian Sea. Around 2200, lo- the morning after, you could watch on Just one example, not even aeronautical time, a lady on board used her mo- the news this huge luxury ship lying cal; still, more than one reader might bile to call her daughter at home and on its side, partly under water, with a have recalled from personal experi- report that there was a blackout on the two-hundred-feet long hole on its star- ence a feeling of being made aware a ship, and passengers had been told to board side, the rock which the ship had little too late. In this issue of HindSight, put on their life jackets. Her daughter, struck still embedded in the hull. So far, Captain Pooley, in his usual clean and understandably not being familiar with twenty-five fatalities with seven more straightforward style, warns controller the alerting procedures for search and unaccounted for, plus some still largely readers about the probability that pi- rescue, called the Carabinieri (Italian unpredictable environmental conse- lots will be so prone to delay a MAYDAY Police), who relayed the information to quences, to say nothing of the damage call that, when they eventually make it,

38 ATC will have already developed a feel- whenever practicable, to have some veillance controller would highlight that ing of something going wrong. extra time to look for. position indication and start consider- ing who is below, what aerodromes There is no arguing that declaring an In the case of the shipwreck, some “at are in the vicinity, and so on. In a future emergency is something that should be fi rst glance” elements may sound un- which is already here, we will talk much done as soon as that is the case, neither pleasantly familiar: there is a problem, less on frequency, as information will before, nor afterwards. What people the crew tries to handle it and only fl ow on CPDLCs, Mode S downlink pa- from the ops room might sometimes when it overwhelms them is informa- rameters and stuff like that; there, you ask for is a reasonably earlier involve- tion spread outside. Once again, it are available for what may become very ment whenever rush moments don’t makes sense, you do not declare an useful residual voice communications. spring abruptly, but instead gradually emergency for a mere trifl e; in fact, If those who are asked for assistance develop from some initial “early warn- the precise moment when MAYDAY are involved at the potential outset of ing” signs, or through subsequent steps needs to be called is sometimes obvi- the problem, they will be more aware which evolve from a relatively insig- ous, sometimes hard to decide. Simply and ready to assist; today’s emergency nifi cant anomaly into genuine distress. sharing pilots’ concerns with those team member on duty is the same guy This already widely applies whenever they may later on call for help could who earlier gave an update on QNH, such anomalies (the classic red light sometimes save the day. and there is really nothing to complain on the cockpit panel) imply unusual about. behaviour, such as the request to de- This is not an invitation to ‘cry wolf’, nor lay take-off after a twenty-minute taxi to offl oad responsibilities. Relevant MAYDAY MAYDAY!! to “perform some checks”. Otherwise, calls should be very explicit about when there are no immediate outward the fact that no special assistance is consequences, the fl ight crew might needed thus far (unless it is), but not simply not deem informing ATC to be a unnecessarily specifi c, merely point- fi tting action. ing out that something non-routine is under scrutiny, and that the situation Seen from below, perspective changes might potentially evolve into a higher a bit. Let us focus on the fact that we degree of complexity. I guess any sur- are not talking here about circumstances that could take place on the ground, such as a power failure in a control centre, or a full loss of surveillance data, which are commonly referred to as contingencies, and for which backups and recovery procedures are also in place; instead, this is about an on-aircraft crisis which the people on board have to cope with on the basis of their procedures, judgment and skill. What we are asked to do is to act on the remaining traffi c, in order to avoid additional trouble, and to provide it with all possible assistance, which eventually means getting everything and everyone ready for a possible unfavourable outcome and, before that, passing on useful information to contribute to a happy ending. This information, such as the infamous nearest suitable airport, is something which it is nice,

HindSight 15 Summer 2012 39 FROM THE BRIEFING ROOM The small technical problem… By Eileen Senger Everyone knows it, everyone fears it: the “small technical problem”. The reason why we controllers fear it is because most of the time it is not what it is claimed to be: small. It grows. With every transmission we get more details that require action.

A very important factor during these orities as well as possibly deal with the a non-pilot to understand.. And of situations is pilot-controller communi- violation of active military airspace. In course to be able to communicate it to cation. In a technical emergency the pi- the case of an emergency descent it is the next unit so that they understand lots are usually so busy troubleshooting more reaction than action, but it has to as well. and working checklists that communi- be coordinated, sooner or later. cation with ATC is some way Over the years I have also got the feel- down their priority list. I Usually, “small technical problems” ing that pilots try to avoid having to was once allowed to wit- aren’t small technical problems. Pilots declare an emergency for as long as ness a fl ight simulator seem to have a tendency to play down possible. The trouble is that without emergency training the signifi cance of the problematic emergency status, it becomes rather session for the annual situation they fi nd themselves in, God diffi cult to coordinate good direct pilot check, and it was knows why. Whenever I hear those key tracks or arrange priority landing, and very impressive to see words, I go to red alert. I make sure no no transit through active military areas the workload they were aircraft is passing right underneath is possible. confronted with. that other aircraft. I pick up my pen and blank sheet of paper. I pick up the Probably all of us have witnessed a telephone without dialling. Because situation where we look in disbelief at Eileen Senger 95% of the time the next transmission our colleague with the “did he really of that aircraft will be “…request im- say that?”- question mark on our face. is an Air Traffi c Controller at EUROCONTROL’s mediate descent”, “…request diversion “Radar, we have a woman giving birth Upper Area Control Centre in Maastricht. to XXXX” or sometimes a very technical She works in the Hannover Sectors which description of the once small problem cover north-western Germany and is an OGTI. that now requires a lot of questions and explanations back and forth for

They have a plane to fl y plus have to go through all the paper work. Plus communicate with their crew and ATC. But we can only help if we know what is going on, if we get proper information and know their intentions. Then we can coordinate, in serious emergencies even two controllers in parallel on the phone to diff erent units, to fi nd shortcuts and set pri-

40 just following another procedure (unless the other plane gets so close that they can see it and judge it). Then again, the death of a person onboard seems abstract to us, to The small technical problem… them it may be shattering.

They cannot just unplug the headset and on board, do you have any tips or may- help should be provided promptly. A get relieved, they first have to complete be a doctor you could call?” – “Eh…” change of culture has taken place and it their flight and land their plane. A long-haul I guess there is no training for such is not considered a weakness anymore to flight may have to continue as planned to situations. All one can do is use com- admit problems and to ask to be relieved destination, sometimes for many more mon sense. No, we don’t have a doctor and supported by CISM peers. hours. There may be operational pressure hanging around the operations room not to disrupt the schedule with a diversion for situations like this. ATC cannot even if the pilots consider themselves unfit solve every problem. But how about a After these few very to continue their duty after touchdown. diversion to get mother and child on intensive minutes have the ground as quickly as possible? But their minds must sometimes be spin- passed and the aircraft ning as well! They must suffer from critical And after the situation is over? After is handed over to the incident stress every now and then just like these few very intensive minutes have controllers do. They can chat a bit with the passed and the aircraft is handed over next unit, the mind starts colleague next to them about it but when to the next unit, the mind starts spin- spinning. We take a deep one of them is hit by a reaction to heavy ning. We take a deep breath and try to stress, there is not much one can do. All of understand what has just happened breath and try to under- us who have witnessed a colleague having to us. Some of us are able to continue to go through this know how much this af- working on the position, some need stand what has just fects even the observer. a break and some need professional happened to us. help. Luckily, nowadays CISM is wide- Still, when I tried to find out from the web spread in ATC and it is if airlines have CISM programmes at their generally accepted But what about the men and women on companies, I found nothing. In Germany that people need the other side, on the flight deck? First of there is the “Stiftung Mayday”, an indepen- help and that all, they experience a greater range dent foundation which provides support of abnormal situations than we to pilots and their relatives in difficult situ- do as controllers. A TCAS RA ations. Interestingly though, they state that may look very serious to the majority of their interventions were the us, to them it may be consequence not of airborne situations or emergencies but of people passing away during their time on board. Some German airlines like Lufthansa or TUIfly cooperate with them. This organisation provides CISM to anyone calling their hotline, but they have a response time for first contact (usually via telephone) of up to six hours. Logis- tically it makes quite a difference to have a CISM peer present in an air traffic operations room or at major centres, not to mention in smaller units or even abroad. But this cannot be done when working with a team of volunteers in their free time. I must say that I had expected that at least the big airlines would have such a programme in place at their main hubs. Maybe the shift in awareness and attitude towards critical incident stress that struck ATC in Europe after the Überlingen midair collision still has to take place in the flying industry.

HindSight 15 Summer 2012 41 FROM THE BRIEFING ROOM It all went quiet

By Harry Nelson Many years ago, during a routine military training fl ight during my RAF service, it all went quiet for me and my crew.

We had been chosen to take part in developed a classic division a bombing competition against the of duties which involved might of the USAF. Our aircraft was the myself looking after the Avro Vulcan Mk 2 powered, at least at tracking aspects whilst the start and end of the story, by four working closely with the Rolls Royce Olympus 301 engines. The radar bombing navigator exercise in which we were engaged and my co-pilot looking was called a “timing and tracking run”. after the speed control It involved the pseudo-bombing from whilst taking the timing high altitude of two targets each 20 from the plotter navigator. nm apart. The run was measured by a All was proceeding well until I military radar ground unit which looked heard a loud call from the plot- after the “bomb scores”. The scoring sys- ter announcing that we were “20 tem awarded 5 points for each nautical seconds too early”. My co-pilot who mile between the two targets when was already quite tense and gripping within 100 metres of the bombing track the throttles, immediately throttled We did indeed have a problem. line, 4 points if within 200 metres and so back and as he did so he unintention- on until outside 500 metres one scored ally closed the HP (high pressure) fuel I took control of the aircraft and remem- a zero. Clearly, the maximum score pos- cocks on all four engines. Yes, it went ber well my fi rst thoughts. I must keep sible was 100 points per run, (20 x 5) but, very quiet! the speed up by descending to keep and it was a big but, the aircraft also had the Ram Air Turbine (RAT) working. It to be on time to a very strict timing limit. I should say at this juncture that the had dropped automatically as per de- HP cocks were operated as the outer sign. The RAT would provide us with This exercise created a pretty high sleeve of the throttles and, with time, the necessary power to control the air- workload situation for the crew and as the spring loading which was de- craft whilst we attempted relights. My we worked up for the competition, we signed to protect against their unin- second thought was, “which way do I tended operation had became weak turn for the nearest airfi eld? Without and therefore overcame the design being aware then of the now famous Harry Nelson has had a fl ying career safety criteria. mantra, I was indeed fl ying, navigating spanning some 46 years which has focussed on and later would also be communicat- fl ying training and test fl ying as the two main The fi fth crew member that day was ing. In fact, by chance our nearest air- activities. A graduate of the Central Flying the Air Electronics Offi cer (AEO). He fi eld was ahead of us and well within School and the Empire Test Pilots School he has was a laconic individual and certainly gliding range of our aircraft. Luckily, it operated in all parts of the world and worked was not one to get upset easily, but was not needed as I also managed to on this occasion his voice was the fi rst get some fi ngers stuck into the ends of at 5 fl ight test centres throughout Europe end- to speak. He normally called me ‘Skip” the throttles whilst opening them up ing up in Airbus where he now holds the post or some other less polite name but on and hit three of the four quick relight of Executive Operational Advisor to Product this occasion I heard loud and clear, buttons. My co-pilot hit the fi nal one Safety. He has over 10000 fl ight hours on over “Harry we have a problem”. He was and together, we were successful in 76 types of aircraft. looking at a bank of warning lights on regaining thee out of the four engines his generator panel and he was right. – suffi cient to continue.

42 Our air traffi c controller, being a sharp In the Hudson story I was incredibly the time it did not seem that way! guy, came on the ether and demand- impressed by the controller’s reac- Certainly, Captain Sullenburger ed to know why we were descending, tion and the determination to assist as had much less with his 3mins and at which point I had a diffi cult decision much as possible even faced with an 31 seconds of flight ahead of him, to make. Dear reader, please remem- apparent change in plan. In the end it which only goes to show what a re- ber that this was the “V Force” and they reached a point where Captain Sullen- markable performance it was, not did not take lightly such mistakes and burger was rightly so focused on fl ying just from the crew perspective but errors. Therefore, I am quite proud of the last part of the approach to the wa- also from the controlling team who my instinctive response which was ter that he was unable to respond to assisted him. that we had “suff ered a pressurisation the fi nal off ers of assistance. problem” which indeed we had. There were two post scripts to my You do not have much pressuri- own story. The fi rst happened sation when the engines are not If ever you are faced with an aircraft which many years later when I was working, so whilst telling a hope- has lost all useful engine power, it is nec- having a beer in some hotel fully forgivable white lie, I tried to essary for the controller to imagine the bar and was joined by an- save us all the formal embarrass- workload in the fl ight deck under such cir- other pilot. It turned out he ment of what would surely follow cumstances and to mentally put himself or too had fl own Vulcans and plus all the beers we would have herself there alongside the crew. Initially, after a couple more beers he to buy in the bar later when the following such a failure, there is quite a lot decided he wished to make other crews discovered our story. to do to stabilise the emergency. In priority a “confession to me”. Yes, you order: have guessed it, during a So what is this story all about and routine landing his co-pilot n Establish a glide descent at the right why do I tell you it now? This had inadvertently shut down speed. Normally, crews will know the whole tale came to mind not all engines, in this case as he speed to fl y but will probably not have long ago when I had the chance fl ared to land, just as my own an instinctive idea of the glide rate to talk to Captain Sullenburger co-pilot had done. With some which can vary quite a lot depending on following his amazing landing considerable shame and much the nature of the engine failure(s) and on the Hudson, which I was able more wisdom than I had then I the confi guration of the aircraft. to discuss with him. One of the confess that neither of us had most interesting questions is declared our respective experi- n Head in the right direction. This is where what, if any, real assistance ATC a good controller can surely assist and ences with the result that this can provide under such circum- it helps if that controller also knows the design weakness continued stances and he shared with me weather situation at any potential suit- and probably there are other his immediate need for direc- able airfi eld. guys out there somewhere who tional assistance to the nearest can tell similar stories. The need airfi eld. The fi rst turn is critical n Get on with the drills and procedures for a non-punitive culture could if you are at low altitude. It can that may improve the situation. Here not be better demonstrated. make the diff erence of making again the controller can assist by being it or not. In his case he was in- aware and rather than trying to “over The second post script was that deed too low and chose a well control”, leave the crew to get on with as we dropped from 40000ft known alternative. In my case, their work of systems recovery. to about 25000 in our “de-pres- I was higher and was able to surised” emergency we “fell” regain the power I needed to straight ahead through the tim- land normally. Had my engines not ing and tracking box, but there re-lit immediately, I know that the key Of course the biggest variable is al- was no limit on the height accuracy, information I would have needed was ways the likely time available and so we ended up achieving one of – what is my nearest suitable airfi eld, this is dictated normally by the the best bomb scores we had all what are the weather conditions there height at which all this starts. In season for that exercise. Some days and what is their contact frequency. my case we had lots, although at you get very lucky!!

HindSight 15 Summer 2012 43 FROM THE BRIEFING ROOM Emergency and unusual situations – whose world view?

We have always known that wise people learn from their mistakes and that all groups of specialists, from medical surgeons to elite athletes, can relate how, when things go wrong, they learn from reviewing the circumstances of their actions...

The grand slalom skier who misreads ond too soon and compensating for a quence of pattern matching and de- a turn through a gate and tumbles wet surface too late. What few people cision making. It is at this point that down the side of the run, the Olympic realise is that the brain will now have the brain defaults to the situation ex- diver who mis-times their exit from a learnt another slightly diff erent se- plained above, and the outcome often multiple twisting somersault, and the quence from the original motor pro- relies on the quality of unusual circum- rally driver who trusts in the friction of gramme, which it will match to the stance and emergency training, expe- their high performance car on a slip- new context if the same circumstanc- rience and the ability to accept what pery road, all refl ect on the moment es are encountered. I will return to this the facts of the situation are they lost control. At the point that the later in this paper. rather than what we pre-programmed motor sequence of would like them these highly skilled actions is being These are all examples of split-second to be. executed, the human has little to do adjustments made when things go but wait for the outcome. In the ex- wrong, but what of the situations in amples above, the sequence of mo- aviation, with which we are typically tor programmes has been disrupted more familiar, and in which we often by inputs which were adaptive: have a slightly longer time frame to weighting too much on one ski, recover? Interestingly, humans usually initiating the twist a nanosec- have a similar response to unusual or emergency situations and these follow a set pattern – indeed they can be found in any traumatic response. Firstly we may have a shock or startle Anne Isaac reaction. The strength of this will de- leads the Human Performance pend on both the individual involved development work in the and on how many times they have pilot/controller interface in NATS, UK. She gained encountered this situation before. At her PhD in Cognitive Neuropsychology at Otago this point we will suspend belief, for a University in New Zealand. Her previous work moment (classically we look to any other person in the direct vicin- has been in the development of incident ity for confi rmation that what investigation tools and techniques in European has just been experienced is ATM, the introduction of TRM into the ATC shared). environment and the introduction of Day to Day Safety Surveys techniques into NATS. Once it has been estab- She has written several book chapters, lished that something academic papers and the book Air Traffi c has indeed gone wrong, we attempt to compare Control: the human performance factors. the situation with past experiences and start a se-

44 This fi nal response is a very strongly to tackling these situations and, typi- But fi rst we need to appreciate the dif- developed behaviour which promotes cally, supports a safe and expeditious ferent ‘world views’. A controller’s re- survival in extreme situations, but this outcome. However there will still be sponsibility is focussed on separation behaviour often leads us to ignore the examples in which highly trained of individual aircraft (although often unusual facts in favour of disbelief crews simply don’t believe the indica- they will consider aircraft in pairs or in since we want and need a safe out- tions from instruments and tragically some cases multiple pairs); however, come. their training, as individuals or crews, they have many of these to consider leads them to disbelieve what is pre- and as such, arguably, their world view Knowing how humans respond to sented to them. In extreme cases they is a ‘many to one’ dynamic. By contrast, unusual or emergency situations may even ignore the warnings. In the pilots are responsible for the safety of has led airline manufacturers to sup- air traffi c environment checklists are their aircraft and as such their fl ight port crews with emergency protocols less evident; however, training in un- is associated with a ‘one in many’ dy- which support their decision-making usual circumstances and emergencies namic. Both the controller and the and can eliminate failures in a system- is practiced with regular periodicity. pilot seek the same safe outcome but atic manner. This leads to a more their perspectives or ‘world views’ will comprehensive History would suggest that it is not diff er and as such their priorities may approach until an incident attributed to both be misunderstood, especially in an controllers and pilots or vehicle driv- emergency. ers occurs and is investigated jointly that it is acknowledged how little each professional group knows of the oth- Both the controller and er, particularly in an emergency or unusual event. There are fewer the pilot seek the same and fewer opportunities in the safe outcome but their training of all parties to share common training scenarios. perspectives or ‘world As a result knowledge regarding the ‘world view’ views’ will diﬀ er and as of each team is often such their priorities may unknown or misunderstood. be misunderstood, especially in an emergency.

One way to support a better understanding of these two professional groups is to put them together in a facilitated workshop to explore the issues faced by each team in unusual and emergency situations. At NATS, our considerable experience of Multi-Crew Resource Management workshops1 has included the following discoveries: 44

HindSightHindSight 15 15 Summer Summer 2012 2012 45 FROM THE BRIEFING ROOM

What PILOTS should know about CONTROLLERS: What CONTROLLERS should know about PILOTS:

n The priority for controllers is to n The priority for pilots is to - communicate - aviate - calculate - navigate - coordinate - communicate

n Although controllers will probably have more emer- n Many airlines use an emergency acronym to brief gencies in their shift cycle than pilots, they remain un- fl ight-deck and cabin crews which helps simplify the certain if they are not given what they perceive as es- communication exchange. One example is the use of sential information. Their priority in an emergency is to a NITS brief which includes – move any confl ict traffi c, which means their workload - Nature of the problem increases in the area of communication and coordina- - Intention tion. A good example of these diff erent priorities can - Time needed – to sort out the problem be heard in the last R/T exchange from the US Airways - Special instructions if required A 320 aircraft which ditched in the Hudson River. n The priority for the pilots, depending on the emergency, is to fl y their aircraft and inform their crews about intended decisions. Often ATC is low on their priority in the fi rst minutes of the emergency.

n Selecting 7700 helps controllers to identify aircraft n At all times, but particularly in an emergency, pilots which need ‘special attention’ or have an emergency. prefer to be given distance information – in miles, not Controllers will treat all 7700 squawks as needing pri- periods of time – in minutes ority and arrange their traffi c accordingly. The other n Pilots have advised that they fi nd it very helpful to advantage is that the 7700 squawk is also ‘seen’ on ra- receive ATC guidance that is prefi xed or suffi xed with dar by all controllers throughout their airspace, which the statement “ when able” increases their situation awareness and readiness to assist.

n Controllers will assume pilots will announce ”PAN n ‘PAN’ and ‘MAYDAY’ does not necessarily mean a pilot PAN” for special attention regardless of the outcome. needs immediate landing or the nearest airfi eld. Controllers will assume pilots will announce “MAYDAY n Pilots also advise that in most unusual or emergency MAYDAY” when requiring immediate support. Both situations they prefer to be given airspace to sort ‘PAN’ and ‘MAYDAY’ announcements carry almost equal themselves out. The only exception is an explosive attention and the controllers will allocate a dedicated decompression or smoke/fi re in the fl ight-deck or controller and frequency if required. cabin.

COMMON INFORMATION FOR BOTH CREWS/TEAMS:

n At all times, but particularly in an emergency, the ‘world view’ of the two crews/teams diff ers. This clearly dictates the priorities of the two parties and therefore the reason these situations can be diffi cult to manage. In these situations each team can lose overall situation awareness of the other team and this may introduce unwanted communication, and this uncertainty may increase stress for each team. n In emergency situations, which require an immediate climb/descent, each airline (and often diff erent fl eets within the same airline) may fl y a profi le not anticipated by the controller. Some pilots prefer a straight ahead climb/descent and some prefer a turning descent. What an airline/aircraft type requires and what controllers expect they want, or will do, are often completely diff erent.

1- multi-crew Resource management is a workshop which is facilitated by tRm facilitators together with cRm instructors and focuses on a discussion regarding the interface risks found between pilots and controllers. the participants are made up of a mixture of pilots from diff erent fl ying disciplines and controllers who also have diff erent controlling experience.

46 Although expert decision makers “may make small Finally, let us return to the phenomena of motor programmes and the errors, they generally recognition of unusual or emergency situations. The response of the brain, avoid major mistakes. and the consequent behaviour, is always a result of experience and ex- They seem to have pertise. Once any professional has learned the basic skills, rules and discovered that for procedures of their work they will many decisions, have suffi cient knowledge to work in a normal situation. However, once coming close an unusual or emergency situation is As on nearly every manned ight since 1965, lift-o presented, the person will be limited is often good enough: of Apollo 12 went smoothly – but only until sev- in their response and also subject to enty-eight seconds after ignition when, unknown several decision-making, behavioural the key is not to worry to anyone, including the astronauts on board, biases. These include any of the fol- about being exactly the booster was struck by lightning. Pete Conrad lowing: radioed down the alarming news that the bottom right, but to avoid“ had fallen out of nearly every reading on every n Frequency bias: The risk of an electrical system aboard his ship. In the seconds event occurring is almost always making really bad following in which the abort decision would have over or under evaluated because to be made, John Aaron in Houston took another evaluation is based solely on refer- decisions. look at his screen and noticed that the readings ence to personal experience; on the console were showing about 6 amps, well n Selectivity bias: This occurs when, below what they should have been, but well above as we select information, our pref- We can recognise all of these de- erences lead to a strong tendency cision-making biases in aviation the zero that would be expected if the system had to select a restricted core of facts; accident reports both in Europe truly failed. It had been a few years earlier, when he n Familiarity bias: This is a tendency and beyond. It is therefore essen- was monitoring a simulated countdown of another to choose the most familiar solu- tial that all fl ight crews and teams mission, when he had seen a similar pattern as the tion, even if it is not the optimum are exposed not only to ‘normal’ rocket accidentally tripped the circuit breaker on solution for the situation; unusual or emergency situa- its telemetry sensors. In a split second, and with n Conformity bias: This happens tions, but also to the recovery conformation from ight command, John Aaron when we look for results which from unexpected and unforeseen pushed the reset switch and instantly the numbers support our decision rather than situations. This has become even were restored. information which would contra- more important since both pro- Minutes later Apollo 12 was in Earth’s orbit and dict it; fessional groups are increasingly went on to complete a successful mission to the n Group conformity: This is a bias exposed to highly automated moon. due to group pressure ‘Group systems demanding more moni- Think’ and/or a tendency to agree toring and perhaps less ‘hands- Lovell & Kluger, 1994. with a majority decision. on’ collaborative activity.

HindSight 15 Summer 2012 47 FROM THE BRIEFING ROOM THE NEW BEAUJOLAIS HAS ARRIVED TCAS II version 7.1

has arrived by Stanislaw Drozdowski New “Level oﬀ , level oﬀ ” RA

My article in the July 2007 The development of version 7.1 was ini- Additionally, there have been numer- issue of HindSight about TCAS tiated by EUROCONTROL following the ous cases of level bust when pilots discovery of two safety issues with the following the “Adjust vertical speed, mentioned a forthcoming current TCAS II version 7.0. Since its intro- adjust” RA went through their cleared change to TCAS II the introduction in Europe in 2000, TCAS II has been level, often causing a follow-up RA for the subject of monitoring. In the course of the other aircraft above or below, and duction of the new version “ analysing recorded and reported events, disrupting ATC operations. 7.1. After an admittedly rather many cases were found in which pilots did lengthy process, a regulatory not respond correctly to the “Adjust verti- In version 7.1 the “Adjust vertical cal speed, adjust” Resolution Advisories speed, adjust” RA is replaced with a decision was published on 20 (RAs). In a few of these cases a midair colli- new “Level off , level off ” RA. The new December 2011: all existing sion was avoided by chance. RA always requires a reduction of TCAS II version 7.0 installa- vertical rate to 0 ft/min, i.e. a level off The “Adjust vertical speed, adjust” RA re- which needs to be achieved prompt- tions must be upgraded to quires the reduction of vertical speed to ly, not at the next standard fl ight level version 7.1 before 1 December 2000, 1000, 500, or 0 ft/min., as indicated (e.g. FL 200, FL 210, etc.). The “Level on the fl ight instruments. In those cases off , level off ” RA may be issued as an 2015 and new aircraft must involving an incorrect response, the pilots initial RA or as a weakening RA fol- be equipped with version 7.1 increased their vertical speed instead of lowing, for instance, a “Climb, climb”

from 1 March 2012 if operat- reducing it, consequently causing a dete- or “Descend, descend” RA as the ver- rioration of the situation. This is currently tical distance between the aircraft 1 ing in European airspace . the most common RA, representing up to increases due to the initial response

The fi rst aircraft equipped two-thirds of the total RAs. taking eff ect. with version 7.1 are probably already operating in the“ skies above us, so it is important to “Clear of Conflict” understand the eff ect on ATC FL350 350 ft operations which the new ver- “Climb, climb” RA sion will have. FL340

“Clear of Conflict” 4500 ft/min. FL330

1- the european version 7.1 mandate sets earlier “Adjust vertical speed, equipage requirements than those published by adjust” RA (1000 ft/min.) icao (1 January 2014 – new installations, 1 January 2017 – existing units). 2500 ft/min.

Version 7.0 “Climb, Version 7.1 climb” RA

FL220

FL210 500 ft/min

Level bust 0 ft/min

“Adjust vertical “Level off, speed, adjust” RA level off” RA

2500 ft/min 2500 ft/min

“Descend, descend” RA “Climb, climb NOW” RA

Version 7.1: “Climb, Threat’s non-compliance climb” RA detected, reversal RA issued

Pilot does not comply with RA or TCAS unequipped aircraft following Version 7.0: No reversal an ATC instruction or visual avoidance THE NEW BEAUJOLAIS HAS ARRIVED

by Stanislaw Drozdowski

The new RA will have an eﬀ ect on ATC operations:

aircraft may level off hundreds of feet before the cleared level when responding to the “Level off , level off ” RA.

At this point, I can see many air traffi c controllers getting concerned that an aircraft level- “Clear of Conflict” ling off hundreds of feet before its cleared level may get into a confl ict with third aircraft. FL350 350 ft This issue was considered during the design“Clim b, climb” RA stages of version 7.1. The decision to replace the “Adjust vertical speed, adjust”FL340 RA with the new “Level off , level off ” RA was preceded by detailed analysis of events and radar data “Clear of Conflict” from several places in Europe and from two 4500 ft/min. busy TMAs in the USA. The radarFL330 data analy- ses indicated that the new RA will not cause secondary confl icts with third aircraft more frequently than occur with the current ver- “Adjust vertical speed, sion of TCAS. The new RA is also expected adjust” RA (1000 ft/min.) to contribute to an overall reduction2500 inft/mi then . number of RAs because follow-up RAs should not occur any more. 44

Version 7.0 “Climb, Version 7.1 climb” RA

FL220

FL210 500 ft/min

Level bust 0 ft/min

“Adjust vertical “Level off, speed, adjust” RA level off” RA

2500 ft/min 2500 ft/min

HindSight 15 Summer 2012 49

“Descend, descend” RA “Climb, climb NOW” RA

Version 7.1: “Climb, Threat’s non-compliance climb” RA detected, reversal RA issued

Pilot does not comply with RA or TCAS unequipped aircraft following Version 7.0: No reversal an ATC instruction or visual avoidance “Clear of Conflict”

FL350 350 ft “Climb, climb” RA

FL340

“Clear of Conflict” 4500 ft/min. FL330

“Adjust vertical speed, adjust” RA (1000 ft/min.) 2500 ft/min.

Version 7.0 “Climb, Version 7.1 climb” RA

FL220

FL210 500 ft/min

Level bust 0 ft/min

“Adjust vertical “Level off, speed, adjust” RA level off” RA

FROM THE BRIEFING ROOM 2500 ft/min 2500 ft/min

TCAS II version 7.1 has arrived (cont’d) “Descend, descend” RA “Climb, climb NOW” RA

Version 7.1: “Climb, Threat’s non-compliance Improved reversal climb” RA logic detected, reversal RA issued

A second change is also Pilot does not comply with RA introduced in version 7.1 or TCAS unequipped aircraft following Version 7.0: No reversal an ATC instruction or visual avoidance – improved reversal logic, which is also expected to enhance safety. This change is transparent to controllers and pilots. issue a reversal RA to the aircraft which The new version 7.1 is manoeuvring in accordance with the Version 7.0 allows reversal RAs (i.e. is compatible with all RA on the basis that it is this aircraft “Climb, climb NOW” and “Descend, de- which is more likely to respond cor- scend NOW”) to be issued when the existing versions being rectly to a reversal RA. current RA is no longer predicted to provide suffi cient vertical spacing. operated today, both In single equipage encounters (i.e. version 7.0 and version when only one of the confl icting air- However, there have been cases in craft is TCAS II equipped), version 7.1 which a reversal RA failed to occur 6.04a (which is still in use will recognise the situation and will is- when two converging aircraft re- by some aircraft, mainly sue a reversal if the unequipped threat mained within 100 feet of each other. aircraft moves in the same vertical di- This scenario can occur when one air- outside Europe). rection as the TCAS II equipped aircraft. craft is not following the RA properly or There is therefore no is not TCAS II equipped and follows an Compatible versions ATC instruction or performs an avoid- need for ATC to know ance manoeuvre based on visual ac- Until the whole fl eet of aircraft oper- quisition. Signifi cant examples of such which version of TCAS II ating in European airspace has been events include the Yaizu (Japan) near upgraded, confl icts will occur between midair collision (2001) and the Über- the aircraft operates aircraft using diff erent versions of lingen (Germany) midair collision because proper TCAS- TCAS II. The new version 7.1 is compat- (2002). ible with all existing versions being op- TCAS coordination is erated today, both version 7.0 and ver- aking place in all sion 6.04a (which is still in use by some aircraft, mainly outside Europe). There coordinated encounters. is therefore no need for ATC to know which version of TCAS II the aircraft operates because proper TCAS-TCAS Stanislaw Version 7.1 improves the reversal logic coordination is taking place in all coor- Drozdowski by detecting situations in which, de- dinated encounters. In fact, ATC does spite the RA, the aircraft continue to not need to know whether the aircraft is an ATM Expert at EUROCONTROL HQ in converge vertically. A feature has been is TCAS equipped or not or is operating Brussels, working in the area of ground and added to the TCAS logic which moni- with TCAS temporarily inoperative (as airborne safety nets. Previously, he worked as tors RA compliance in coordinated allowed under Minimum Equipment a system engineer with Northrop Grumman encounters (i.e. when both aircraft are List exemptions), because the provi- and as an Air Traffi c Controller in Poland and TCAS II equipped). When version 7.1 sion of air traffi c services to aircraft New Zealand. detects that one of the aircraft is not equipped with TCAS shall be identical responding correctly to an RA, it will to those that are not equipped.

50 by John Barrass, SKYbrary Editor minutes UPS flight 006, en route from Dubai to Cologne, recently levelled off moke from an onboard fire breathing and you have an in- at FL320 when the crew advised ATC that the fire warning systems is likely to contain toxic sub- creased sense of self-awareness for the cargo compartments indicated an onboard main deck fire stances that irritate the skin, and alertness, possibly because and advised ATC that they needed to land as soon as possible. * eyes and respiratory system. of that enclosed feeling and ATC advised the crew that Doha International Airport was at the 10 Furthermore,S the two main smoke possibly also7 because of the 1 o’clock position at 100 nm. Although Doha was closer, the Captain gases, carbon monoxide and hydro- increased levels of oxygen and gen cyanide, are very rapidly disabling adrenalin in the blood stream. elected to return to Dubai and the crew declared an emergency. if breathed in. Smoke can therefore 3 minutes after the first alarm bell, the flight crew put on their quickly incapacitate the crew unless Because of the oxygen masks, oxygen masks and goggles. The crew experienced difficulties com- they wear goggles and breathe 100% the voices of other crew mem- municating via the intercom with the masks on. oxygen. Smoke also reduces visibility, bers are slightly muffled and making it difficult, if not impossible, for your own voice sounds as if it 5 minutes after the first alarm bell, the Captain told the Co-Pilot to the crew to see instruments or see out is coming from somewhere pull the smoke evacuation handle and advised ATC that the flight of the window. In such circumstances, else, just like it does when you deck was “full of smoke”. a crew can become disorientated, lose have a heavy head cold. Add to 7 minutes after that first alarm bell, the Captain declared a lack of situational awareness and then lose that the reduced visibility, and oxygen and left his seat, possibly to get a portable oxygen bottle, control of the aircraft. there is a sense of detachment but he did not return. and isolation. In a benign envi- Many airlines conduct smoke training ronment, such as an exercise, 9 minutes after the first alarm bell, the Co-Pilot advised ATC that he sessions where, for example, crews when there is no actual threat, would remain on the Bahrain frequency, as it was not possible to see are given experience in locating and it is actually quite relaxing and the radios. fighting simulated fires, while wearing in similar training I have no- breathing apparatus, in a smoke filled ticed how many people have 14 minutes after the first alarm bell, the Co-Pilot asked for radar cabin. their eyes closed. guidance due to difficulty viewing the instruments...

Many years ago now, I participated in In the reduced visibility, it becomes such a smoke evacuation exercise. Sat increasingly difficult to read instru- Smoke from an on board fire on the flight deck in a very controlled ments. The mask and goggles also environment, entirely pre-briefed, restrict the field of vision. Warning reduces visibility and can be thick white smoke was pumped into lights and popped circuit break- the aircraft, quickly reducing visibil- ers go un-noticed. Radio calls are very rapidly disabling ity. We carried out immediate actions, missed. Calls from other crew mem- donned smoke goggles and oxygen bers are misunderstood. Calls you masks, set oxygen to 100% with over- make to other crew members get no tally breathe in any smoke – not so pressure, and then checked communi- response. easy if you’ve disconnected from the cations with the rest of the crew. There aircraft oxygen system. was no immediate evacuation; we Situational awareness gradually de- were encouraged to consider how the teriorates. I have had the misfortune to experi- reduced visibility and the wearing of ence 3 smoke events whilst on an air- masks and goggles might affect per- If the aircraft is on the ground, then craft, 2 of them while airborne. formance. evacuation is the best option. Evacu- ating a smoke filled aircraft requires In the worst case, while flying as a com- With mask and goggles on, it’s like be- concentration. You have to feel your petition judge on a Canadian Forces ing in a separate world. You look out way out based on a model of the air- CC130 at 250 ft AGL, thick white smoke at the scene around you as if through craft in your mind – much as a blind began pouring out of the overhead a window. That separate world is person does every day of their lives. panel. Being so close to the ground, dominated by the sound of your own You have to take care not to acciden- the loss of visibility clearly represent- 44

HindSight 15 Summer 2012 *GCAA Accident Report No. 13/2010. (Preliminary Report) - http://www.skybrary.aero/bookshelf/books/1485.pdf 51 FROM THE BRIEFING ROOM articles on SKybrary relating to the events and issues discussed above: http://www.skybrary.aero/index.php/Smoke_gases http://www.skybrary.aero/index.php/in-flight_fire:_guidance_for_flight_crews http://www.skybrary.aero/index.php/in-flight_fire:_guidance_for_controllers 17 minutes (cont’d) http://www.skybrary.aero/index.php/B744,_en_route,_persian_gulf,_2010_(aW_fiRe)

ed an immediate threat to the safety of message. ATC reacted quickly to our On 11 May 1996, a fi re broke out on the aircraft. The Captain opened his side emergency call. Although the active board a Valujet DC9. The fi re damaged window and someone, possibly me but runway was 24, we were given imme- the aircraft fl ying controls before the I can’t remember, opened the roof es- diate clearance to land straight in on crew were able to land the aircraft and cape hatch. The impact on visibility on Runway 36. We were on the ground it crashed in the Florida Everglades. All the fl ight deck was instantaneous – the within 6 minutes of the fi rst signs of of the occupants were killed. The fi rst smoke disappeared completely – there smoke and probably in the bar within indications that the crew had were was a lot of noise but the pilots could another 6 minutes. an unusual sound followed swiftly by now see. Of course, opening the win- major electrical problems and physical dows is not an option at FL320. It’s all about time. Crews need to de- signs of fi re. Little more than 3 minutes velop a mindset that, following any in- after those fi rst indications of a fi re, the I recall the fl ight engineer being busy dication of fi re, an immediate landing aircraft crashed. attempting to isolate the source of the is essential. smoke but to no avail – it later transpired On 2 September 1998, while cruising that the source of the smoke was an au- Masks, goggles, hoods and oxygen at fl ight level 330, the crew of Swis- topilot unit under the fl ight deck and the provide protection from the effects sair Flight 111 smelled an abnormal smoke was working its way up behind of smoke. Depressurisation, and odour in the cockpit. Their attention the panelling before entering the fl ight opening flight deck windows, vents was then drawn to an unspecifi ed deck from above. It is worth noting that and hatches, help to clear the smoke, area behind and above them and many fl ight crews experiencing a smoke and there are devices available to they began to investigate the source. event may never succeed in identifying improve visibility on a smoke filled Whatever they saw initially was shortly the source of smoke and any associated flight deck. However, an aircraft oxy- thereafter no longer perceived to be fi re in the time available to them. While gen system has finite capacity. It was visible. They agreed that the origin of it is of course important to make every not uncommon in my experience the anomaly was the air conditioning eff ort to isolate the source of the smoke for the portable oxygen bottles to system. When they assessed that what and fi ght the fi re, the top priority is to become exhausted well before the they had seen or were now seeing was get the aircraft on the ground as soon as time advertised – masks leak, people defi nitely smoke, they decided to di- possible. breathe more heavily when engaged vert. They initially began a turn toward in physical activity, and oxygen bot- Boston; however, when air traffi c ser- Luckily, we were just 10 nm to tles may leak between periodic services mentioned Halifax, Nova Scotia, the south of the nearest air- vicing, etc. as an alternative airport, they changed fi eld. I recall that the radio the destination to Halifax International call I made did not adhere Airport. While the fl ight crew was pre- to standard phraseology An on board fi re can paring for the landing in Halifax, they but ATC certainly got the were unaware that a fi re was spread- aﬀ ect aircraft systems ing above the ceiling in the front area and the structural of the aircraft. About 13 minutes after the abnormal odour was detected, the integrity of the aircraft aircraft’s fl ight data recorder began to John Barrass record a rapid succession of aircraft leading eventually, and systems-related failures. The fl ight served for 20 years in the UK Royal Air Force inevitably, to loss of crew declared an emergency and in- and Canadian Forces in a variety of fl ying, dicated a need to land immediately. instructional, and command appointments control About one minute later, radio com- before becoming an aviation consultant. munications and secondary radar contact with the aircraft were lost, and the John has worked on most of EUROCONTROL’s A fi re in the air can aff ect aircraft sys- fl ight recorders stopped functioning. safety enhancement initiatives and is the tems and the structural integrity of the About fi ve and a half minutes later, the current editor of SKYbrary. aircraft – out of control, a fi re will even- aircraft crashed into the ocean about tually result in loss of control. fi ve nautical miles southwest of Peg-

52 articles on SKybrary relating to the events and issues discussed above: http://www.skybrary.aero/index.php/Smoke_gases http://www.skybrary.aero/index.php/in-flight_fire:_guidance_for_flight_crews http://www.skybrary.aero/index.php/dc93,_en-route,_everglades_fL_uSa,_1996_(gnd_fiRe_Loc) http://www.skybrary.aero/index.php/in-flight_fire:_guidance_for_controllers http://www.skybrary.aero/index.php/md11,_en-route,_atlantic_ocean_near_Halifax_canada,_1998_(aW_fiRe_Loc) http://www.skybrary.aero/index.php/B744,_en_route,_persian_gulf,_2010_(aW_fiRe) http://www.skybrary.aero/index.php/Reﬂ ections_on_the_decision_to_ditch_a_Large_transport_aircraft

gy’s Cove, Nova Scotia, Canada. The The crew will wish to minimise fre- On 16 May 1995, an RAF Nimrod suf- aircraft was destroyed and there were quency changes in order to reduce fered an uncontrollable fi re in one of no survivors. workload and avoid the chance of an its four engines, which subsequently incorrect frequency selection and loss spread to the adjacent engine and A smoke or fi re event on an aircraft of communications. threatened the structural integrity and presents a challenging situation for a therefore likely controllability of the controller. Initially, the controller might Communications with the aircraft aircraft. Hearing a report from the rear be advised of a technical problem and may be particularly diffi cult. The situ- crew that the wing was “melting”, and a possible need for a precautionary di- ation on the aircraft may mean that fearing that he may have only seconds version. This is understandable – the the aircraft does not respond to calls, before the wing failed, the captain crew may be unsure of the nature of information passed to or by the air- decided to ditch the aircraft into the the problems they are experiencing. craft may be misunderstood, informa- sea. All of the occupants survived. It is Several minutes may therefore have tion may need to be relayed through most likely that, had he tried to reach elapsed before an emergency is for- other aircraft or ground stations, fre- the nearest runway, he would not have mally declared. Nevertheless, the con- quency changes may not be possible, made it. troller should use this time to consider and communications may be lost al- options and warn those he may need together. If communications are lost To handle an emergency such as this, to call upon if the situation develops completely, then the controller will where time is critical, controller over- into an emergency. need to anticipate the actions of the load is likely if support and supervisory crew based on previously declared in- back-up is not immediately forthcom- tentions. ing. To do this successfully requires An immediate landing well thought through and regularly is essential following A team eff ort will be required to carry practiced contingency plans – there out all the necessary coordination isn’t time for an ad-hoc response. any indication of an between sectors, airports, and other airspace users to ensure system safety Similar examples of in-fl ight fi re show in-ﬂ ight fi re and facilitate getting the Mayday air- that the average time between fi rst craft on the ground as soon as pos- indications of fi re and loss of control, sible – direct routings, expedited de- either through structural/system fail- As with all emergency situations, the scent, straight in approach. Numerous ure or crew incapacitation, is just 17 controller will need to pass timely and other airspace users will need to be re- minutes. appropriate information and guidance routed, passed to alternative frequen- to the crew. In the case of an in-fl ight cies, told to enter holding patterns or fi re, the support provided to the crew divert. As the situation develops, may include: the plan will likely need to change and change again. 26 minutes after the fi rst alarm, UPS 006 was approximately n Information on the nearest airfi eld 10nm from Dubai. ATC advised, through a relay aircraft, a 360 with suffi cient runway length, ceil- Ordinarily, the defi nition of a degree turn as the aircraft was too high and fast. The Co-Pilot ing and visibility, “suitable alternate” might rightly responded “negative”. Shortly afterward, the Co-Pilot indicated n Airfi eld information including ILS include considerations such as that the landing gear was not functioning. frequency, threshold elevation, aircraft and passenger handling and runway/ILS centreline, and facilities, customs and immigra- 28 minutes after the fi rst alarm, UPS 006 was overhead Dubai. n Vectors for a minimum track mile tion availability, or a contracted The aircraft was advised to turn left for Sharjah. The pilot ac- approach, regularly advising the service provider. With a fi re on knowledged. The autopilot subsequently disconnected and crew of the track distance to touch- board, “suitable” very quickly sim- the aircraft entered a descending turn to the right. down. plifi es to a long enough runway. Sometimes, getting an aircraft All of this information will support the “on the ground” might necessi- 29 minutes after the fi rst alarm, radar contact with UPS 006 situational awareness and decision- tate an off -airfi eld landing or a was lost. making of the crew. ditching.

HindSight 15 Summer 2012 53 FROM THE BRIEFING ROOM Beyond the outcome

by Bert Ruitenberg A friendly warning, dear reader: don’t expect any dramatic descriptions in this article about emergency situations that happened while I was working as a controller. If that sort of thing is what you’re after, I’m sure there are other articles in this HindSight issue that will satisfy your curiosity. This article will look at what happens after an emergency situation has been dealt with. Boring? Maybe – but if you want to know, you have no option but to read this article anyway.

solved and the fl ight was able to make all staff involved in handling the US/E; a safe landing somewhere, or the US/E arranging access for accident inves- Bert Ruitenberg couldn’t be resolved and there was an tigators to the controller(s) involved; accident. (Admittedly this is a some- and last but not least, providing factual is a retired TWR/APP controller, supervisor what simplistic view, but please in- information on the event and what’s and ATC Safety Offi cer who worked at Amsterdam dulge me for the sake of the point I’m being done about it to all ATC staff (or Schiphol. trying to make.) Now it’s important to indeed all employees of the ANSP) and realise that US/Es normally don’t hap- the media. pen in isolation – there is other traffi c in the sector or at the airport that also ex- To start with the fi rst item from the list As is evidenced by this very issue of Hind- pects to be handled in a safe, effi cient above, there’s nothing worse than leav- Sight, a lot of attention in the ATC world and orderly manner. And this applies ing a controller who just lost an aircraft is currently being focused on the han- both during the “lifespan” of the US/E to handle subsequent traffi c at a work- dling of emergencies and unusual situa- and after its outcome. So how is your ing position. Even if the US/E aircraft tions. And rightly so, I say, for ATC can be ATC working environment organised was the only one that the controller a powerful resource for pilots who fi nd to help controllers cope with handling was working with, the controller should themselves in an unusual situation or regular traffi c after the outcome of a be relieved and taken to a quiet place an emergency (which will be US/E from US/E turns out to be an accident? to await initial counselling (e.g. critical now on). I’m a supporter of controller re- incident stress debriefi ng). And please current training programmes that focus Issues that should be considered don’t let this poor controller wait unac- on US/E, especially where these include include, but are not limited to, ur- companied for the counsellor to arrive sessions in which pilots interact with gent relief from their position for the – make sure that a trusted colleague is controllers to analyse and discuss such controller(s) who last communicated with him/her during that time, if pos- events. But I’m not sure that everywhere with the aircraft that had the US/E; sible. in the ATC world the same amount of reduction of the traffi c complexity, if consideration is given to what happens necessary by establishing temporary Meanwhile, the other controllers in the in an operations room or tower in the traffi c restrictions, for the airport or operations room or tower have the dif- moments immediately after a US/E has sector(s) concerned; counselling of fi cult task of handling the other traffi c been dealt with, i.e. after the outcome of the controller(s) involved, e.g. through as if nothing happened. They prob- the US/E. a critical incident stress management programme; conducting an operation- There can be two diff erent outcomes: al debriefi ng with the participation of either the US/E has been successfully re-

54 Beyond the outcome

ably will be very much by conducting an operational debrief- the investigating author- aware of what their ing with all staff involved when the ity in which controller ac- colleague(s) experienced a few mo- outcome of the US/E is a happy one. cess is described and agreed, and have it ments earlier, yet they have to face Was internal and external communica- in place before an actual accident hap- the well-intended “good day” check-in tion adequate during the event? What pens. And if I may volunteer any guidance calls from unsuspecting pilots on their was it that saved the day? Was the for such a protocol, arrange for priority to frequencies. Depending on how close contribution from ATC in resolving the be given to counselling over investiga- they were to the handling of the US/E event a structural one, or was it some- tion, and for meetings with controllers before it resulted in an accident, they thing that strongly depended on the or other staff at a suitable location in an too may require relief from their work- individual skills and knowledge of the ANSP building rather than at the private ing position in order to go and receive controller(s) involved? In the case of the homes of those concerned. counselling. But there simply may not former, was everyone happy with the be suffi cient relief staff available on way things went internally or is there The fi nal point from my list above is on short notice for that to be realised, still room for improvement? And in the communications about the event to the hence the second item in the list above: case of the latter (above), how can that workforce in the organisation. In fact, the reduction of the traffi c complexity. If same level of skills and knowledge be communications requirement is broader you can’t get all controllers off position instilled in the other controllers? than just the workforce itself, for after an after an accident has happened, then accident the organisation will be in the at least make their work as easy as pos- Earlier I equated an accident investiga- media spotlight almost instantly. EURO- sible at such a time. tion to an operational debriefi ng, but CONTROL have produced a superb docu- that equation is of course incorrect. To ment called “Just Culture Guidance Mate- A further item from the list above is an the participants an investigation is of- rial for Interfacing with the Media “, which operational debriefi ng. This is some- ten perceived as more threatening than I believe provides excellent guidance for thing I strongly suggest be done after an operational debriefi ng, and one ANSPs on how to prepare for having to either of the two possible outcomes of of the reasons for that is that in an in- communicate about an accident, both a US/E, by the way. Where the outcome vestigation there are usually outsiders internally and externally. was an accident, it almost goes with- involved, i.e. State safety investigators, out saying that all staff involved are at people from outside the ANSP. And In conclusion, in this article I hope to some point interviewed by an inves- whilst they are working in the interests demonstrate that there’s more to han- tigation commission or are at least in- of aviation safety, they often want to dling unusual situations and emergen- vited to provide a written statement on interview the controller(s) involved in cies than “just” the technical ability of the their actions at the time of the event. the accident as soon as possible after air traffi c controllers. Providing recurrent The aim of this investigation of course the event, which can cause a confl ict training with tailored simulator scenarios is to determine what happened, how with the counselling process and thus is one thing, but it also pays to give seri- it happened, and what can be done to be inconvenient for the controller. Or ous thought to managing what happens prevent a similar event from happen- it can even interfere with the control- after the event is over. If you only start ing again. But why wait for an accident ler’s private life if the investigators insist thinking about that while an event is un- when your aim is to improve safety? on interviewing the him or her at their folding, chances are that you’re too late to home (be it in person or by telephone). manage it eff ectively. I submit that there is potentially as To avoid emotional complications at a much to learn for future improvements time when they are least needed, it is advisable to develop a protocol with

HindSight 15 Summer 2012 55 HINDSIGHT SITUATIONAL EXAMPLE

Fixed wing or helicopter?

Editorial note: Situational examples are based on the experience of the authors and do not represent either a particular historical event or a full description of such an event. The scenarios are rather exemplifi ed facts aligned to illustrate operational safety and human performance considerations. 4p58

56 HindSight 15 Summer 2012 57 HINDSIGHT SITUATIONAL EXAMPLE

Fixed wing or helicopter? (cont’d)

THE FACTS

Read the story as it develops, You use the intercom system to coor- position yourself in the context dinate with the controller in the tower without knowing the actual about this fl ight. Since it’s a helicop- outcome. How conﬁ dent are you ter, diff erent limits for special VFR op- that you would never get into a erations are applicable than for fi xed situation like this? wing aircraft and the tower controller and you both agree that the fl ight can be given permission to cross the control zone under special VFR procedures. You call the pilot and you give the clearance to cross the control zone special VFR at an altitude of 1200 feet. After the pilot acknowledges the clearance, again in a poor quality radio transmission, you instruct him to contact the tower for further guidance. The pilot switches to the other frequency, and you turn your attention to the inbound IFR passenger fl ight that has just checked in on your frequency. While providing the inbound passenger aircraft with radar vectors to the instrument landing system (ILS) for It’s a quiet day at the regional airport You are aware that normally requests the runway in use at your airport, you where you’re working as a radar ap- for VFR crossing of the control zone are monitor the conversation between proach controller. The weather condi- handled by the tower at your airport. the helicopter and the controller on tions are marginal, or at least below the tower frequency. The quality of the the limits for VFR operations. You’ve What would you do? transmissions by the helicopter is still just fi nished a coordination phone poor, but you hear the pilot acknowl- call with details about an inbound IFR You decide you’ll transfer the aircraft edge the request from the tower confl ight, a twin turbo propeller aircraft, to the tower frequency in a proper troller to “report one minute before which is a scheduled passenger fl ight manner. Since you have no fl ight plan crossing overhead the airport”. to your airport. data for this particular fl ight, you carry out an electronic search for the fl ight What would you think? An aircraft checks in on your frequen- in the automated fl ight data system cy, but you’re unable to understand to which the radar equipment at your Shortly thereafter the pilot of the IFR the full call sign because the quality airport is linked. The search does not passenger fl ight reports established of the radio transmission is poor. After produce any results, but that is not un- on the ILS, so you transfer that fl ight to asking the pilot several times to repeat usual for VFR fl ights in your area. Con- the frequency of the tower controller. the call, you fi nally are able to get the sequently you make a manual fl ight You continue to monitor the conversa- fi ve characters that make up the call plan input for the fl ight to appear in tions on the tower frequency, and on sign (and aircraft registration). You also your automated system as a VFR cross- your radar screen you also monitor the understand that the aircraft is a heli- ing helicopter, using the minimum progress of the helicopter. You hear copter on a VFR fl ight plan, and that amount of required data to get the in- the pilot of the helicopter reporting the pilot is requesting clearance to put accepted by the system. This input “one minute before overhead” to the cross the control zone of your airport also produces a related fl ight strip in tower controller, and at the same time from the southeast to the northwest. the tower. you see that the fl ight track of the he-

58 DATA, DISCUSSION AND HUMAN FACTORS

licopter will bring it rather close to This section is based on factors the fi nal approach track of the pas- that were identifi ed in the inves- senger fl ight on the ILS. tigation of this occurrence. Read the story knowing the actual What would you think? outcome. Refl ect on your own and others’ thoughts about the case, You hear the tower controller in- and see how easily judgmental forming the helicopter about the these might get with hindsight. presence of the inbound fl ight on Can you off er an alternative the ILS and instructing the pilot to analysis? stay on the east side of the airport and well clear of the fi nal approach area. It seems like the pilot acknowledges the instruction, but because of the poor radio quality you’re not sure that this is what he said. You ob- serve the helicopter making a rather wide right turn that initially will take it even closer to the fi nal approach area.

What would you do?

Via the intercom you warn the Factors that were identifi ed in the tower controller about the devel- investigation of this occurrence oping confl ict situation. The tower included: controller instructs the helicopter Of the fi ve characters that make up from the World War 2 era. The pilot to turn further to the east, which is the call sign and aircraft registration, mentioned the aircraft type in his fi rst acknowledged by the pilot, and on the approach controller got the fi rst contact with the approach controller, your radar screen you see to your one wrong. When he searched for a but because of the poor quality of the relief that the distance between corresponding fl ight plan in the au- radio transmissions from this aircraft the helicopter and the passenger tomated fl ight data system, his input the controller missed that piece of infl ight is indeed increasing. The pas- included the incorrect fi rst character formation. senger fl ight lands without further and consequently did not produce problems, and after completing a any result. Since there was no doubt The controller later stated that he full turn the helicopter continues its in the controller’s mind about the call was not familiar with that particu- fl ight to the northwest. sign and aircraft type (“helicopter”), he lar aircraft type, which may have made a manual fl ight plan input in the contributed to him not noticing automated system based on this infor- that it was mentioned by the pilot. mation. Expectation bias. The poor quality The crossing VFR aircraft was in fact of the radio transmissions from the a vintage fi xed wing, a single engine historic aircraft was, in the experience advanced military training aircraft of the approach controller, similar to transmissions from certain types of helicopters that he was used to working with. 44

HindSight 15 Summer 2012 59 HINDSIGHT SITUATIONAL EXAMPLE

Fixed wing or helicopter? (cont’d)

HUMAN PERFORMANCE - TEM ANALYSIS

NOTE: This section is o ered as an Furthermore the weather conditions these anomalies become apparent alternative way of analysing the may have subconsciously infl uenced in hindsight, i.e. after more details occurrence. For more information the approach controller’s impression about the event are known than about the Threat and Error that the crossing aircraft was a he- the controller had available at the Management (TEM) framework, licopter: it was below limits for VFR time. The controller never doubted see [TEM item in Skybrary] fl ying with fi xed wing aircraft in the that the aircraft was a helicopter, CTR, so logically there could only be and he also was convinced that he From the perspective of the radar con- helicopters asking to operate under was using the correct call sign in troller the following Threats can be special VFR rules because of the lower his communications with the air- identifi ed in the scenario: call for VFR applicable criteria for that category. craft. He therefore wasn’t looking crossing of the control zone on the ap- for any clues that might suggest proach control frequency; poor quality Ignoring contradictory signs. With otherwise; he was just providing of the radio in the VFR aircraft; pop-up the benefi t of hindsight it seems per- ATC service to an aircraft fl ying VFR traffi c (i.e. a call from an aircraft that haps strange that the controller didn’t in marginal weather that wanted was not previously announced or co- notice that the speed of the “helicop- to cross the control zone. ordinated); no fl ight plan available for ter” was higher than usual, or that its the VFR fl ight; marginal weather con- turn radius was greater than expected. ditions. The controller made an Error Similarly, it may seem odd that the when he started using an incorrect call controller accepted that the aircraft sign for the VFR fl ight. He also made an call sign consisted of an unusual com- Error when he assumed an incorrect air- bination of characters (compared to craft category for the fl ight (helicopter other call signs that normally operate instead of fi xed wing). Arguably there in the area). Don’t forget however that was one more Error made when the controller didn’t notice that the pilot mentioned the type of aircraft in one of the fi rst transmissions, but since the controller wasn’t familiar with the name of this type of aircraft there is room for discussion about how this should be classifi ed in the TEM framework. The Er- rors were not adequately managed by the controller, which contributed to an Undesired State: the controllers in the APP and TWR believed they were dealing with a helicopter operating under special VFR where in fact they were dealing with a fi xed wing aircraft that was operating below VFR limits.

60 FLIGHT DECK PERSPECTIVE

NOTE: the following item addresses aspects that strictly speaking Prevention Strategies It therefore comes down to the poor are outside the ATC domain, and and Lines of Defence quality of the radio transmissions from therefore the item may seem out- the VFR aircraft; however, there is very of-place in this article. It is only If the controller had correctly under- little (if anything) that an individual air included to enable a more com- stood the aircraft call sign (registra- traffi c controller can do about that. Yet prehensive understanding of this tion), his subsequent action to look if the fl ight plan data for this fl ight had occurrence. for the fl ight plan in the automated been actively provided (e.g. in printed fl ight data system would have pro- form) to the controller, rather than be- On the fl ight deck of the passenger duced the fl ight plan, including the ing passively available in the automated fl ight the pilots had monitored the type of aircraft. system, the controller would have been conversation between the tower able to anticipate a call from this aircraft, controller and the crossing traffi c. The controller was not familiar with and he probably would have been in a When passing 1350 feet on fi nal ap- that particular aircraft type, but he better position to deal with it. proach they received a TCAS traffi c would have been able to look up alert; however, because of the mar- the relevant characteristics for it, The radar controller eventually helped ginal weather conditions they were such as “fi xed wing, single engine”. manage the situation by monitoring unable to see the other aircraft. It seems logical that in that case the the progress of the “helicopter” after he Since there was no TCAS resolution aircraft would not have been given had transferred the fl ight to the tower. advisory or any instructions from permission to operate in the control He provided relevant information to his ATC for avoiding action, they con- zone, for the weather was below colleague in the tower, who used that tinued the ILS approach and made (special) VFR limits for fi xed wing information to give an additional turn an uneventful landing. aircraft, thus preventing the event instruction to the VFR aircraft which re- from happening. solved the confl ict. While executing the descent manoeuvre, the pilots of Airline907 heard a TCAS Resolution Advisory KEY POINTS that said “climb, climb, climb”1, but since they already were committed As a result of poor radio quality to descend the captain decided to the radar controller misheard the continue doing so. call sign of a VFR aircraft asking to cross the control zone in marginal It was established afterwards weather conditions. The controller that the closest distance be- had no fl ight plan data available, tween the two aircraft had and believed the aircraft was a heli- been less than 300 metres (i.e. copter whereas in fact it was a fi xed less than 0.2 Nautical Miles). wing aircraft. When the aircraft The encounter was within the later was instructed by the tower parameters for the generation controller to stay clear of the fi nal of a TCAS resolution advisory, approach area for a runway where but this advisory was sup- a passenger aircraft was making an pressed on the flight deck of ILS approach, its turn took it closer the passenger flight in accor- than expected to the passenger dance with the TCAS design cri- aircraft. Because of the marginal teria because at that time the weather conditions, none of the altitude was below 1000 feet pilots involved were able to estab- AGL. lish visual contact with the other aircraft.

HindSight 15 Summer 2012 61 SKYBRARY Skybrary download

If you need to fi nd out something about aviation safety, we suggest you go fi rst to www.skybrary.aero. It doesn’t matter whether you are a controller, a pilot or a maintenance engineer, SKYbrary aims to have either the answer you are looking for or a direct route to it.

Description

This article provides generic advice only on the eff ective management of air traffi c during periods of convective weather avoidance. The guidance provided in this article must not take If by any chance you can’t fi nd what you want, precedence over local operating instructions and air traffi c man- please remember that SKYbrary is a dynamic agement strategies that controllers are required to follow when work-in-progress which needs continuous user adverse weather avoidance is in progress. feedback and benefi ts from user support. Be sure to tell the SKYbrary Editor about any diffi culty Cumulonimbus Clouds you may have had making it work for you. If you can directly help us by identifying material we Convective clouds present a serious hazard to aviation. Aircraft could use or even fi ll a gap by writing some con- entering a Cumulonimbus (Cb) cloud may experience severe tent yourself then please tell us too! turbulence, icing, lightning, precipitation (especially Hail), and strong winds (both vertical and horizontal). These hazards, indi- We aim to provide wide coverage through both vidually and collectively, can lead to structural damage, injuries original articles and, especially, by hosting the best to crew and passengers, loss of separation/level bust as a result of what’s already been written so that a wider audi- of an inability to maintain assigned height, and loss of control. ence can access it more easily in one place. Where possible, fl ight crews will wish to avoid passing within 20 nm of a cumulonimbus cloud. SKYbrary is also the place where you can access:

n all the documents of the Flight Safety Founda- tion Operator’s Guide to Human Factors in Aviation

n the largest collection of selected offi cial accident & serious incident reports from around the world anywhere in one place online

n an expanding facility to search ICAO document text.

An article taken from SKYbrary is reprinted in HINDSIGHT. This time we have chosen something which can aff ect us all – ATC Operations in Weather Avoidance Scenarios.

62 SKY

ATC Operations in Weather brary Avoidance Scenarios

Particularly intense Cbs, often associated with squall Weather Avoidance Characteristics lines, may also present related phenomena such as Tor- nados, Gust Fronts, and Microbursts, all of which can When air traffic is avoiding Cumulonimbus cells, particularly have an impact on air traffic management and airport in congested airspace, the workload of the controller in- infrastructure. creases significantly. In such scenarios the increase in workload is caused by: Aircraft equipped with Weather Radar are able to identify the areas of cloud with the greatest vertical wind n Non standard traffic flow – the traffic flow is irregular shear and navigate through (or if not possible around) and not easy to anticipate because of: areas of convective activity. - the changing intensity of cells, both vertically and hor- izontally (for further information see the article “Life- Controllers should note that flight crew workload in- cycle of the Thunderstorm)” creases significantly in a weather avoidance scenario - the situational awareness of the flight crew and rout- not just because of the decision-making associated with ing decisions they take based on the display on their weather avoidance but also because of Turbulence, weather radar (for further information see the article management of In-Flight Icing, and increased commu- “Weather Radar: Storm Avoidance)” nications. Particularly dense cells, or groups of cells, can n the altitude of aircraft, attenuate radar and radio signals, thereby causing loss n the onward routing of the aircraft, of radar contact and poor quality or lost communica- n the training and experience of the flight crews, and tions. n operator’s procedures. n Reduction in available airspace – controllers will have less airspace volume available for conflict resolution tasks with a consequent impact on sector capacity; n New conflict points – new random crossing points are likely to occur as a result of the disrupted and non-standard traffic patterns; n Increased frequency occupancy time – radio communication is likely to be prolonged due to the necessity to clarify the details associated with the avoidance actions as well as revised onward routing clearances. Usage of non standard RTF is likely to increase; n Increased manual (telephone) coordination – telephone coordination with adjacent sectors or ATS units is likely to increase due to the necessity to coordinate the details associated with the avoidance actions (change of routes and flight levels); n Rapidly changing situation – isolated Cb cells can quickly evolve into a squall line and make navigation through the line of Cbs increasingly challenging for the pilots; 44

HindSight 15 Summer 2012 63 SKYBRARY

SKYbrary downloads (cont’d)

ATC Operations in Weather Avoidance Scenarios

n Degradation of RVSM capability – convective ICAO Procedures weather conditions are associated with moderate to severe turbulence, hence it might be advisable to Weather Avoidance Information for Flight Crews downgrade the RVSM airspace and introduce 2000 Controllers are expected to provide the most appropriate ft vertical separation in areas with reported severe advice/information to pilots of an aircraft requesting navi- turbulence; gational assistance when avoiding areas of adverse weath- n Lack of information about traffic in own sector er. ICAO Doc 4444 (PANS-ATM) contains the following provi- (not on frequency) – situations may arise when traf- sions on information to be given to flight crews in weather fic deviating from its planned/cleared flight route, avoidance scenarios: due to bad weather, penetrates (or flies close to the boundary of) another sector’s airspace without prior n Doc 4444 - 8.6.9 Information regarding adverse notification of the controller in charge of that sector weather - 8.6.9.1 who is not aware of the crew’s intentions; n Limited applicability of radar vectoring – use of Information that an aircraft appears likely to penetrate radar vectoring to resolve potential traffic conflicts an area of adverse weather should be issued in sufficient might be limited due to crew inability to maintain time to permit the pilot to decide on an appropriate the required headings. This is a very significant fac- course of action, including that of requesting advice on tor in busy environments where controllers rely how best to circumnavigate the adverse weather area, if heavily on radar vectoring to provide separation; so desired. n Airspace constraints – ATC sector overloads can be aggravated by the combination of weather factors Note: Depending on the capabilities of the ATS surveillance (majority of these are Cb-related) and airspace con- system, areas of adverse weather may not be presented on straints in particular in busy TMAs. the situation display. An aircraft’s weather radar will normally provide better detection and definition of adverse weather than radar sensors in use by ATS.

n Doc 4444 - 8.6.9 Information regarding adverse weather - 8.6.9.2

In vectoring an aircraft for circumnavigating any area of adverse weather, the controller should ascertain that the aircraft can be returned to its intended or assigned flight path within the coverage of the ATS surveillance system and, if this does not appear possible, inform the pilot of the circumstances.

Note: Attention must be given to the fact that under certain circumstances the most active area of adverse weather may not be displayed.

Weather Avoidance Communications in Oceanic Airspace In controlled airspace, a pilot using an aircraft radar and in- tending to detour around observed weather must obtain clearance from the controller before doing so. Even so, controllers should not be surprised if, perhaps because of com-

64 SKY brary munications difficulty and the flight safety risks, an aircraft Effects alters course without clearance. If it is necessary to leave controlled airspace the pilot must request permission to Possible effects of adverse weather avoidance include: re-join. ICAO Doc 4444 (PANS-ATM) provides the following procedures intended for deviations around adverse meteo- n Pilots may be unwilling to execute a turn, as instruct- rological conditions: ed by the controller to avoid conflict, due to the proximity of adverse weather; n Doc 4444 - 15.2.3.1 Procedures related to emergen- n Pilots may be unwilling to descend due to the prox- cies, communication failure and contingencies - imity of an adverse weather area; 15.2.3.1.1 n Pilots setting a heading or altitude not expected by the controller; When the pilot initiates communications with ATC, a n Pilots changing the assigned heading after clearing rapid response may be obtained by stating “WEATHER weather (CB) without informing ATC. In general pi- DEVIATION REQUIRED” to indicate that priority is desired lots request deviation from the planned route due to on the frequency and for ATC response. When necessary, CBs but sometimes, when clear of weather, they turn the pilot should initiate the communications using the back to their planned route without prior notification urgency call “PAN PAN” (preferably spoken three times). to ATC; n Increased communications with pilots; n Doc 4444 - 15.2.3.1 Procedures related to emergen- n Increased communications with adjacent ATC units cies, communication failure and contingencies - to coordinate avoiding actions; 15.2.3.1.2 n Some flights may not be able to follow missed approach procedure due to thunderstorm areas near The pilot shall inform ATC when weather deviation is no the airport (APP/TWR environment); longer required, or when a weather deviation has been n Some flights may initiate a go around on final due to completed and the aircraft has returned to its cleared severe turbulence, wind shear, or a flooded runway route. (APP/TWR environment); n More requests to use a different runway for depar- Weather Avoidance Procedures in Oceanic Airspace ture or arrival due to sudden changes of wind com- The crews should notify ATC and request clearance to devi- ponents in combination with wet runway and ra- ate from track, advising, when possible, the extent of the de- dar-derived information on adverse weather on the viation expected, expressed in a new heading, and for how climb out route, (APP/TWR environment); long the crew intends to proceed on the deviation heading. n Increased controller and pilot workload; n Reduced sector capacity - The complexity of the traf- n Doc 4444 - 15.2.3.2 Actions to be taken when fic situation (traffic demand, non-standard routings, controller-pilot communications are established - potential conflicts) may necessitate the implemen- 15.2.3.2.2 tation of flow measures in order to ensure safe ATC service provision during periods of massive adverse n Doc 4444 - 15.2.3.2 Actions to be taken when weather avoidance. controller-pilot communications are established - 15.2.3.2.3

The pilot should take the following actions: a) comply with the ATC clearance issued; or b) advise ATC of intentions and execute the procedures detailed in 15.2.3.3.

HindSight 15 Summer 2012 65 SKYBRARY

SKYbrary downloads (cont’d)

ATC Operations in Weather Avoidance Scenarios Defences Operational Supervisor’s (SUP) actions. The ATC shift supervisor should be able to mitigate the impact of severe weather avoidance by air traffic on the controller’s workload by facili- tating and engaging in the following actions:

n Establish a coordination pattern with the MET office for the provision of periodic weather updates and forecasts for the affected area. Following an established protocol, which outlines the roles and responsibilities of those involved, will be of advantage; n Use all available information: MET updates/forecasts, traffic load forecasts and availability of ATC personnel to assess the situation and establish with the help of the local flow management position (FMP) possible tactical mea- n Consider the rejection/adjournment of planned sures; maintenance work on any technical equipment used n Inform affected adjacent units of the (flow) measures taken; for ATS provision; n Assess whether it is safe and possible to follow the proce- n Consider application of the so-called “one-airway” dures described in local letters of agreement (LoAs) with procedure, i.e. closely situated airways are considered adjacent ATC units. As necessary, agree with the SUPs of as one airway for traffic separation purposes. the neighbouring unit(s) special coordination procedures to substitute the normal operating procedures (i.e. flight Flow Management Position’s (FMP) actions. The FMP level allocations, points of transfer etc.). It is important to should provide the necessary assistance to the OPS Su- point out to the controllers the need for dedicated coordi- pervisor and facilitate the management of the severe nation in these exceptional cases; weather by timely activation of coordinated flow control n Provide additional (third) controller as necessary at the measures in order to prevent sector overloads. During sector to help the sector team with coordination / moni- the normalisation period, special consideration must be toring / planning tasks, as applicable; given to possible bunching of traffic at the end of the reg- n Apply dynamic sectorisation management – the OPS Su- ulated period. It is felt that the return to normal capacity pervisor should monitor the situation and activate the following flow control measures is usually more efficient most appropriate sector configuration depending on the if implemented on a gradual (step-by-step) basis. traffic volume and complexity, and the scale of the weather avoidance. For example, in the case of major deviations The FMP should consider passing timely information to from planned routes, vertically split sectors may be more the regional flow management unit (CFMU for the Euro- appropriate than laterally split ones; pean region) about the forecast and actual convective n Open additional sectors in order to deal with possible ca- weather and its impact on ATC operations. pacity problems and avoid sector overloads; n Consider the application of a reduced departure rate or of Controllers’ actions. Controllers should exercise their a specific departure separation (e.g. individual approval re- best judgment and expertise when dealing with adverse quest; departure interval of 5 minutes, etc.) for aerodromes weather avoidance scenarios; in particular they should be within the affected airspace and coordinate this course of prepared to: action with the relevant units; n If relevant, coordinate with the respective parties the re- n Maintain awareness of the adverse weather location, lease of temporary restricted airspace for use by general air its evolution (laterally and vertically) and of the pos- traffic or its use under special crossing coordination proce- sible deviation routes. A controller may be alerted to dures (e.g. use of dedicated SSR code); the presence of adverse weather by a variety of sourc-

66 SKY brary

Organisational measures n Provision of sufficient number of controllers during periods with forecast severe convective weather; n Use of weather radars/ weather displays to enhance information provided to controllers; n Use SIGMETS and associated weather forecasts to improve prediction of sector loading; n Train controllers to deal with weather during live training; use simulator training to build in more resilience in controllers’ skills; n Provide a periodic refresher course to OPS supervisors n Consider adoption of a generic checklist for OPS supervisors.

es including: radar observations, adjacent ATS units, Weather Avoidance Decision Support MET office reports, unit briefings and reports from pi- Systems lots. Being constantly aware of any ongoing deviations and flight crews’ intentions should provide precious It is generally agreed that decision support tools may be time for the separation of affected nearby traffic; instrumental in the management of convective weather n Develop strategies – the executive (radar) and planner avoidance scenarios in congested airspace. Such tools will controller should develop strategies and practice mu- use the weather forecasts to estimate the impact on ATC tual crosschecks of the current, planned and intended provision and consequently suggest air traffic management weather avoidance actions; strategies. n Provide timely information to and coordinate with the adjacent sectors regarding any deviations which will af- In research funded by the NASA Ames Research Centre, the fect them; MIT Lincoln Laboratory has developed an en-route Convec- n Pro-actively seek information regarding traffic which is tive Weather Avoidance Model which outputs three-dimen- likely to enter their own sector; sional weather avoidance fields. “The probabilistic Weather n Request any necessary details from the flight crews on Avoidance Fields identify regions of airspace that pilots are the planned avoiding actions i.e. heading(s) on which likely to avoid due to the presence of convective weather” the aircraft will be flying, as well as the estimated dura- (for details see Further Reading). tion and/or the distance the aircraft will proceed on the heading(s); The concept for the future trajectory-based operations is n Provide extra room for manoeuvring, if in doubt that the that it will be necessary to automatically generate flight traffic will request further deviation provide extra space trajectories through or around convective weather which for separation, issue instructions for flight level change pilots will find acceptable. as necessary, provide traffic information, as necessary; n Inform pilot if weather avoidance will take pilot outside controlled airspace, and offer an appropriate service.

Further Reading n Aircraft Emergency and Unusual Situations - http://www.skybrary.aero/index.php/Category:Aircraft_Emergency_and_Unusual_Situations

HindSight 15 Summer 2012 67 If you are interested in downloading the entire HindSight collection: www.skybrary.aero

N°1 N°2 N°3 N°4 N°5 N°6 January 2005 January 2006 June 2006 January 2007 June 2007 January 2008

Putting Safety First in Air Traffic Management COMMUNICATION COLLISION HINDSIGHT IS A “Hindsight” The ability or opportunity to understand and judge AIRSPACE an event or experience after it has occured. AIRSPACE WONDERFUL THING CONFLICT AVOIDANCE “Hindsight” The ability or opportunity to understand and judge INFRINGEMENT an event or experience after it has occured. By Tzvetomir Blajev “Hindsight” DETECTION “Hindsight” DETECTION THE RUNWAY AND YOU Coordinator - Safety Improvement Initiatives, The ability or oportunity to understand and judge The ability or opportunity to understand and judge “Hindsight” and Editor in Chief of HindSight. an event or experience after it has occured. an event or experience after it has occured. The ability or opportunity to understand and judge WORKLOAD By Ian Wigmore an event or experience after it has occured. WORKLOAD “Hindsight” See page 22 “With the benefit of hindsight I would Win a free trip for two to Paris: See page 22 The ability or opportunity to understand and judge THE APPLICATION OF have done it differently”. See page 26 IS AIRSPACE PENETRATION an event or experience after it has occured. OFFSET TRACKS How often do we hear responsible people If we learn the right lessons we will stand with your colleagues - think what you AN ATC PROBLEM OR NOT? ANOTHER SUNNY DAY IN SWEDEN saying these words? Often,it is an attempt a much better chance of reacting correct- would do if you had a similar experience. IN EUROPEAN AIRSPACE to disguise the fact that they had not ly when we are faced with new situations We hope that you too will join in this See page 3 BY BENGT COLLIN prepared themselves for some unusual where a quick, correct decision is essen- information sharing experience. Let us WORKLOAD A STRANGE CONCEPT BY ROLAND RAWLINGS situation. Yet hindsight is a wonderful tial.This magazine is intended for you, the know about any unusual experiences See page 5 thing and can be of great benefit if used controller on the front line, to make you you have had – we promise to preserve BY PROFESSOR SIDNEY DEKKER See page 8 intelligently to prepare ourselves for the know of these lessons. It contains many your confidentiality if that is what you SeeSee pagepage 66 unexpected. There is much to be learnt examples of actual incidents which raise wish. Working together with the benefit from a study of other peoples’ actions - some interesting questions for discussion. of HindSight we can make a real contribu- good and bad. Read them carefully - talk about them tion to improved aviation safety. Front Line Report by Bert Ruitenberg The Briefing Room Editorial 121.5 - Safety Alerts Learning from Experience

Hindsight is a Wonderful Thing 1 Avoiding Action Phraseology 4 Runway Incursion 8 EUROCONTROL Safety New Clearance Related Loss of Separation 11 WORKLOAD VERSUS BOREDOM Enhancement Business Division 2 to Levels 4 THE HUMAN FACTOR COLUMN Controlled Flight Into Terrain 13 BY BERT RUITENBERG About HindSight 3 Aircraft Turn Performance LOSS OF SEPARATION BY PROFESSOR SIDNEY DEKKER BY BERT RUITENBERG Early Turns 5 Unauthorised Penetration See page 7 Acronyms used in This Issue 24 of Airspace 15 See page 7 See page 7 Undetected Simultaneous THE BLIND SPOT The Editorial Team 26 Transmission 5 Wake Vortex Turbulence 17 See page 15 AIRBUS AP/FD TCAS MODE: Contact Us 27 Hand-over/Take-over of Runway Excursion 19 Operational Position 6 INVESTIGATINGINVESTIGATING CONTROLLERCONTROLLER Disclaimer 28 Level Bust 21 NEAR COLLISION A NEW STEP TOWARDS Feedback 22 The Phonological WHAT? RUNWAY INCURSIONS - AT LOS ANGELES BLIND SPOTS SAFETY IMPROVEMENT SeeSee pagepage 2020 See page 25 IT WILL NEVER HAPPEN TO ME ... BY DR. BARRY KIRWAN By Paule Botargues SeeSee pagepage 1212 See page 18 See page 25

European Air Traffic Management - EATM

EUROCONTROL DAP/SAF January 2005 EUROCONTROL DAP/SAF January 2006 EUROCONTROL DAP/SAF June 2006 EUROCONTROL DAP/SSH January 2007 EUROCONTROL DAP/SSH June 2007 EUROCONTROL DAP/SSH January 2008

8: winteredition’09 “Hindsight” the ability or opportunity to understand and judge an event or experience after it has occurred.

EUROCONTROL HindThe ability or opportunity to understand and judge an event or experience after it has occuredight09 EUROCONTROL EUROCONTROL N°7 HindThe ability or opportunity to understand and judge an event or experience after it has occuredight10 HindThe ability or opportunity to understand and judge an event or experience after it has occuredight11 HindThe ability or opportunity to understand and judge an event or experience after it has occuredight12 July 2008 Hind ight WEATHER Are you responsible Level Bust... Airspace Infringement - Runway excursion “Hindsight” The ability or opportunity to understand and judge an event or experience after it has occured. Production for safety? or Altitude Deviation? again?! Putting Safety First A WEATHER Pressure Controllers and pilots teaming up in Air Trafﬁ c Management GHOST STORY to prevent runway excursions By Prof. Sidney Dekker Clashing moral values p08 by Captain Bill de Groh, IFALPA © European Organisation for Safety of Air Navigation See page 8 (EUROCONTROL) January 2009. By Professor Sidney Dekker

This publication has been prepared by the Safety Improve- NEW! CASEment Sub-GroupSTUDY: (SISG) of EUROCONTROL. The authors acknowledge the assistance given by many sources in the Next please p15 Some hidden dangers “THE FIRSTpreparation OFFICER of this publication. IS MY By Anthony F. Seychell of tailwind MOTHER-IN-LAW”The information contained herein may be copied in whole or in part, providing that the copyright notice and disclaimer by Gerard van Es are included. By Bengt Collin Safety & the cost killers p16 SeeSee pagepage 1616 The information contained in this document may not be To see or not to see modiﬁ ed without prior permission from EUROCONTROL. By Jean Paries 50 YEARS AFTER MUNICH A letter to aviation prosecutors Level Busts: cause or consequence? by Bert Ruitenberg The role of ATM in reducing The views expressed in this document are not50 necessarily YEARS AFTER MUNICH those of EUROCONTROL. See page 39 by Tzvetomir Blajev by Professor Sidney Decker the risk of runway excursion The consequences of p23 EUROCONTROL makes no warranty, either implied or ex- Let’s get rid of the bad pilots by Jim Burin pressed, for the information contained in this document; nei- commercial pressure can be fatal ther does it assume any legal liability or responsibility for the I separate therefore I am safe The ‘Other’ Level Busts by Professor Sidney Dekker accuracy completeness and usefulness of this information. By John Barrass by Bert Ruitenberg by Philip Marien GET YOUR Airbus altitude capture enhancement SKYbrary POSTER See centre page Air Traffic Controllers do it too! to prevent TCAS RAs Lesson from (the) Hudson by Loukia Loukopoulos by Paule Botargues by Jean Paries CND January ’09 Winter 2010 Summer 2010 * Piste - French, 1. (ski) track, 2. runway Winter 2011 Summer 2009 EUROCONTROL DAP/SSH July 2008

In the next issue of HindSight: Understanding (modern) aircraft performance

EUROCONTROL

Putting Safety First in Air Traffi c Management

This publication has been prepared by the Safety Improvement Sub-Group (SISG) of EUROCONTROL. The Editor in Chief acknowledges the assistance given by many sources in its preparation.

The information contained herein may be copied in whole or in part, providing that the Copyright is acknowledged and the disclaimer below are included. It may not be modifi ed without prior permission from EUROCONTROL.

DISCLAIMER The views expressed in this document are not necessarily those of EUROCONTROL which makes no warranty, either implied or expressed, for the information contained in it and neither does it assume any legal liability or responsibility for the its accuracy, completeness or usefulness.