EUROCONTROL HindThe ability or opportunity to understand and judge an event or experience after it has occured ight21

Shall we cut off the lizard's tail? by Tzvetomir Blajev

What is your maximum workload? by Professor Sidney Dekker

Workload and the surprise factor by Captain Ed Pooley Workload SECOND EDITION

Summer 2015 Contents Summer 2015

HindThe ability or opportunity to understand and judge an event or experience after it has occured ight21

4 DG’s KEYNOTE

EDITORIAL 6 Shall we cut off the lizard's tail? by Tzvetomir Blajev 8 What is your maximum workload? by Professor Sidney Dekker DG’s THE VIEW FROM ABOVE keynote 10 Workload and the surprise factor by Captain Ed Pooley 4

CASE STUDY 13 Who stole my call sign? by Bengt Collin 16 Comment 1 by Richard (Sid) Lawrence Case Study 17 Comment 2 by Captain Ed Pooley 18 Comment 3 by Captain Pradeep Deshpande Who stole my call sign? 13 FROM THE BRIEFING ROOM 19 The quantified self in a complex system: a systems perspective on mental workload by Dr Steve Shorrock

22 Are you a competent workload manager? by Dragan Milanovski

24 Your team is likely to be the key by Adrian Bednarek

28 Self-induced workload caused by poor communication by Peter Hudec 32 See who is talking! by Tom Goossenaerts Workload Levels 36 Workload: getting it to work and their impact by Yoram Obbens and Rob Bezemer 62 42 Faster is not always better by Katarzyna Żmudzińska

46 Know your limits by Maciej Szczukowski

49 How much workload is workload by Michaela Schwarz and Fuat Rusitovic

54 The Chronology of Workload by Captain Shah Alam

58 Where is my workload? Identifying hot spots by Patricia Lopez and Nicolas Suarez 62 Workload Levels and their impact by Dr Beth Lyall

66 Can ATM learn from the experience of pilot workload measurement? by Jean-Jacques Speyer A,B,C... 70 Workload management in a 2-man flight deck: when automation increases the workload… it should be by Captain Dirk De Winter as easy 73 Using workload data to manage the deployment of change – as 1,2,3! defining the limits of safe workload by Nic Turley and Brian Janes 84

77 Sterile radio procedures by Captain Wolfgang Starke

81 Rhythm of the night by Anthony Seychell

84 A,B,C... it should be as easy as 1,2,3! – How to design a simple, safe and efficient taxiway designation system by Gaël le Bris and Magali Kintzler

89 A lack of workload resilience in a non-radar environment by HindSight Editorial Staff CONTACT US The success of this publication depends very much on you. SKYBRARY DOWNLOAD We need to know what you think of HindSight. 90 Information Processing Do you find the contents interesting or boring? Did they make you think about something you hadn’t thought of before? Are you looking forward to the next edition? Are there some improvements you would like to see in its content or layout? Please tell us what you think – and even more important, please share your difficult experiences with us! We hope that you will join us in making this publication a success. Please send your message – rude or polite – to: [email protected] How much Or to the postal address: Rue de la Fusée, 96 workload B-1130 Brussels Messages will not be published in HindSight or is workload communicated to others without your permission. 49 EDITORIAL TEAM Editor in Chief: Tzvetomir Blajev Editorial Adviser: Captain Ed Pooley Graphic Designer: Frédérique Fyon

HindSight 21 Summer 2015 3 DIRECTOR GENERAL's KEYNOTE

Dear Reader,

Workload affects us all and, as this edition highlights, many factors affect the workload of controllers and could potentially have an impact upon performance – most importantly, upon safety. So it is useful to step back a little, to see how European ATM is changing and to consider what impact this might have for controllers.

Some of the changes are very clear. For example, traffic is starting to grow again and this growth is expected to continue, with our latest medium term forecast predicting an average annual growth rate of 2.1% over the next seven years; this means that by 2021 we will see an extra 2.5 million flights a year, with particularly rapid growth in south east Europe.

We are also seeing more aircraft flying at higher flight levels, even for has worked in Air short/medium haul flights. This will change the distribution of aircraft Frank Brenner in Europe’s airspace and will also mean more climbing and descending. Traffic Management for his entire career. He Another big change is the adoption of Free Routes Airspace (FRA), which has been Director General of EUROCONTROL is being progressively introduced, both geographically and also time- since 1 January 2013. wise, with FRA being made available not just at night and/or at weekends but more generally throughout the week. Since taking up his functions at EUROCONTROL, he has initiated the development of a Vision The tools available to controllers are changing. For example, although and Strategy, including the development datalink has had a slow start, we can expect to see it being used much of Centralised Services as part of the SESAR more widely as we overcome some of the problems initially encountered. deployment concentrating on how to support We will need it in order to cope with higher traffic levels and also in controllers with new technology which order to achieve some of the performance enhancements envisaged. The SESAR operational concept is very clearly one which is based on the increases safety. extensive sharing of real time data and datalink is a significant first step. Before joining EUROCONTROL, Frank Brenner was General Manager Operations This concept will also bring much greater predictability. We are already seeing much better information from airports on exactly when aircraft for FABEC, Vice Chairman of EUROCONTROL’s will depart, both as part of the Airport Collaborative Decision Making Performance Review Commission and a programme and also as a result of the rollout of the Advanced Tower member of the Performance Review Body. concept for other airports. This will be very important to our efforts to Trained as an air traffic controller, he has enhance the capacity and efficiency of the network as a whole. held a number of posts at DFS including Head of ATM Operations, Director of Operations The structure of ATM is also changing, with a greater realisation that the traditional model of each individual ANSP doing everything itself is at the Business Unit for Aeronautical Data outdated and is not the most efficient or cost-effective approach. So we Management and Director of DFS’s Control will see more services being performed centrally, being jointly operated Centre Business Unit. or being jointly procured. Not everything needs to be housed in the same building and we are even seeing the concepts of remote towers or virtual centres being explored.

All this change means that it is particularly important to review constantly the human part of ATM and, in particular, the role of the controllers, who are at the heart of ensuring safety in Europe’s skies. How will the way they work be affected? Will the resulting workload be sustainable and safe? What can be done to help? I am sure that this edition of Hindsight will be valuable to all of us faced with these questions.

Frank Brenner

4 HindSight 17 Summer 2013 5 EDITORIAL Shall we cut off the lizard's tail?

“You cannot guess what long queue for But how much flexibility can be safely accommodated? border control I am in. There is no end to it! With performance schemes in place, Air Navigation Service Unless I find a way to jump the queue Providers are under pressure to do more with less, to I will probably miss my flight”. The accommodate more traffic demand whilst maintaining specific pattern of frequency current levels of safety, to be more efficient and at the same spectrum in the voice of my time not allow the workload to reach unsafe levels. Let us wife has always the potential examine two commonly-used strategies to manage more to wake me up but this time it traffic demand that are often used together. sounded even more alarming. A nationwide strike in Belgium One strategy is to know the traffic well in advance and, when had brought the public sector necessary, to pre-arrange it. This means giving up some to a standstill. Border control flexibility in order to gain some predictability. If all flights Tzvetomir Blajev officers were 'working to arrive in a sector randomly without any pre-ordering, then Editor in Chief of Hindsight rule' and following all their a safety buffer will be needed for sector capacity in order to procedures to the letter. The prevent sudden excessive bunching. Arranging the traffic result was a long queue of non-randomly (by flight planning, flow control and working passengers at the airport waiting for their passports with more precise indicators like sector loads) increases the to be checked. How is it possible that following all the predictability of the task demand. The more predictable laid-down procedures prevent you from getting the job the demand the less uncertainty we will need to provide done in the normally-expected time? for in our estimations and the safety buffer on the capacity is often reduced. Instead of 12 aircraft in the sector and a Comparing strictly-followed procedures and normal buffer of 4 we can now have 15 and a buffer of 1. Increasing ones can often illustrate the difference between a ‘job predictability not only allows us to work with more traffic, it as imagined’ and a ‘job as really done’. The procedures also results in us working closer to our limits. in place are often static and do not properly reflect the complexities of the real world. In reality, professionals The other strategy is to accommodate more traffic demand like pilots, controllers, doctors and border control by increasing the productivity of the controllers. Invariably officers strategically prioritise their tasks. They treat this means a redistribution of tasks between the controllers some of them like elastic springs and reduce them to in the team. For example re-allocating some non safety- the bare minimum and completely omit others that critical coordination tasks so as to increase efficiency in they do not consider mission-critical. The nature of the performance of primary controlling tasks and training decisions about cutting their task load when under controllers to be faster and leaner in their controlling. The pressure is not dissimilar to a lizard under threat gain in productivity “pays” for the acceptance of some which 'elects' to lose its tail for safety reasons. Tails additional traffic demand. for lizards and non-critical tasks for professionals are not unnecessary, but one can sacrifice them as a self- Both strategies allow us to work with higher traffic demand. defence mechanism to escape from critical situations. However, when you work with higher traffic demand, each This allows the professionals to get the job done when additional aircraft arriving in the sector typically leads to the task load suddenly shoots up and allows lizards to an increase in workload which is a little more than the save their lives when under attack by a predator. This increase which the previous aircraft brought. The reason that flexibility is one of the features that make professionals workload increases in this non-linear way is that every new what they are and they are proud of being able to aircraft will potentially have to be de-conflicted against a accomplish tasks when under pressure. higher number of aircraft already present in the sector.

6 Shall we cut off the lizard's tail?

In summary, the result of applying the two common strategies is to make it possible to work with more traffic closer to the limits where small perturbations can suddenly bring workload levels to a critical high. Nowadays, professionals like Air Traffic Controllers are more often finding themselves confronted with such situations. And as they are professionals they adapt dynamically in order to get the job done and cope by “cutting the tail of the lizard”.

Let me give you an example. Last week, I was visiting a major European Air Navigation Service Provider. During the regular workshop we had as part of the Network Manager 'Top 5' risk prioritisation process, the Safety Manger said “You know that we have increasing problems with ‘intruders’. These are flights that enter the sector not as originally planned by their flight plan. I know the word ‘intruder’ may be too strong for the aircraft operators but these flights intrude on our plan of work. And the plans these days are very tight. We are simply working at the edge of what is possible. These intruders create problems for us because we have squeezed all possible efficiency out of the way we work and one flight more in the sector becomes the straw to break the camel’s back”.

As the pressure of society to get cheaper air travel increases, we will see ANSPs in a continual search for strategies to accommodate more traffic with the same number of controllers or less. I believe that in ATC, the effects on the workload of controllers of any new strategy or a change should be more explicitly assessed, protection measures identified and the case officially approved. This will protect us but will also allow us confidently reap the benefits of our improvements. Otherwise we will think that the workload is properly managed but we will be only chasing our tail.

Enjoy reading HindSight!

HindSight 21 Summer 2015 7 EDITORIAL What is your maximum workload?

by Professor Sidney Dekker Workload makes intuitive sense to most people. They can typically tell when their workload is “high.” But what is too high?

In Hindsight 8 of 2009, I told of a trial at some European But today’s workload measurement has picked up where airport that wanted to go up to a throughput of 55 aircraft he left off. Take a workload rating scale (like the NASA TLX). an hour in some sectors. A group of controllers volunteered It deploys a bunch of psychological terms (mental to try this and I predicted that the trial would be successful. demand, physical demand, temporal demand, It probably was, depending on who you ask. I also predicted performance, effort, and frustration) and gives people that the airport would probably soon go up to sixty aircraft scales to mark how much they experienced of each. per hour or more. They have. People are asked to “introspect” or “look inside” and reflect on their own subjective experience. How was So how do we know what your maximum workload is? In your mental demand? Well, uh, just reflecting, I’d say this an even earlier 2007 Hindsight column, I quipped that to much: tick. How was your performance? Uhhh, I dunno, determine your maximum workload, you should talk to what about… here, tick. How frustrated were you? your union, not a human factors specialist. I apparently did Aaaargh, now that you ask, here, this much: tick. not have much confidence in the science of my own field. As soon as your tick is on the scale, then the psychologist It hasn’t grown a lot. At least not in respect of the question has her or his number. Because the scale has numbers, raised in the title of this column. My colleague Jim Nyce and your tick falls on or somewhere between them it and I recently wrote about the measurement of workload produces a non-zero number (typically up to seven or in a scientific journal as “psychological alchemy.” Alchemy, nine or some other arbitrary figure). The point for the of course, was the medieval forerunner of chemistry. It was psychologist is that numbers are good; they make the particularly concerned with turning base metals into gold. whole exercise look like science. Because numbers are no As far as we know, it never succeeded (notwithstanding, longer subjective. They are no longer just your opinion. even Isaac Newton was an alchemist – and his were hardly They are objective data. Objective psychological data. medieval times anymore). Huh? Yes, psychologists can even do statistics on these Psychological alchemy is concerned with turning its data! For the nerds among you, a team in Oklahoma own base data into numerical gold. Wilhelm Wundt, once proudly conducted an analysis of variance working in his 19th century Leipzig psychology (yes, ANOVA) on the data derived from such scales. laboratory, once declared that he wanted to develop a The data came from an air traffic control experiment “chronometry of the mind.” He later abandoned the idea aimed at demonstrating that paper flight strips were as too ambitious a research goal. unnecessary. But the workload scales are, in technical parlance, ordinal. That is, they just order things (this is less than that, or more than that). It is not a ratio scale. If you have measured “mental load” with an ordinal scale, you can never claim that the difference between 1 and 2 is as large as the difference between 4 and 5. Or that Professor Sidney Dekker the difference between 2 and 4 is twice as large as the is Professor and Director of the Key Centre for Ethics, Law, Justice and difference between 3 and 4. The problem is, you can only Governance at Griffith University, Brisbane, Australia. do fancy statistical analyses on ratio scales. Never mind, Author of best-selling books on human factors and safety, he has had the Oklahoma team set to work, pulling out a ruler to experience as an airline pilot on the Boeing 737. measure the distance between the left side of the scale and where controllers had put their tick.

8 The workload calculation used median correction based on Gaussian distribution of impulsive/compulsive response, normalised by behavioural data... It gives the average load as below 97.5% but now he wants subjective and insignifi- cant factors like "complexity" and "safety" to be included...

A question about some unproven psychological category or problems: too many task demands and things competing (…mental load? What in the world is mental load?) became for visual attention, severe time constraints, the difficulty of a tick, a tick became a distance from the left side of the ramping up psychologically and physiologically. In air traffic scale as measured in whatever units the ruler offered, the control, the opposite has also generated concern: coming off distance from the left side of the scale became a number, a traffic peak, or going from high to low(er) workload, has the number became a data point in a statistical analysis and been shown to have negative effects on controller vigilance finally, the statistical analysis became proof that your paper and directed attention in some cases. flight strips were a waste of everybody’s time. This kind of research is more interesting and perhaps even Right. That is called alchemy: psychological alchemy. What more genuine. What it shows is not numbers (55 per hour is worse, it performs what my colleague Jim Nyce called – or 60!), but patterns. It shows how things interrelate, a strategic retreat. A retreat from you, the operator, the interconnect and interact (this traffic low after this traffic controller. It produces numbers, and statistical “proof” so peak at this time of day in those sectors, given this roster and that your managers or engineers feel more confident to this manning). Those patterns hide possibilities for action take action based on it. Like removing paper flight strips. and intervention. Different ways to schedule you. To build Or re-sectorising so that you can now do it all alone, all by rosters in other ways. To re-sectorise at different times or in yourself! Or that you now get 55 airplanes to talk to. Or 60! different ways. Nobody needs to be shown right or wrong But where are you, the controller, in this? What happened to with such results either. Instead, this kind of research gives us your actual experience of workload? Well, you were asked things to think about, talk about and try out. So what do you about it. And your answers to those questions became a do now? Have a healthy distrust of numbers produced by the tick, and the tick became… psychologists and human factors people who swirl around your workplace. Ask them, and yourself, and your manager, OK, I think you get the drift. questions about patterns and interrelationships that together make up the workload as you experience it. Don’t Fortunately, researchers today are actually not just interested worry too much about maximum or minimum numbers. in figuring out maximum workload anymore. What matters more to them is workload transitions – and particularly If you don’t mind, I will stop writing now. Even though I don’t going from low workload (also known as “underload”) to have a union to help me determine it, I think I have exceeded high workload. This has been shown to be related to all kinds my maximum workload for the day.

HindSight 21 Summer 2015 9 THE VIEW FROM ABOVE Workload and the surprise factor By Captain Ed Pooley

by the same crew, it is also necessary is an experienced airline pilot who for to consider the hour or so before the Captain Ed Pooley aircraft pushes back from the gate for many years also held the post of Head of Safety for a large short haul airline which there is also some predictability. operation. He now works with a wide range of clients as a Consultant and For any crew there is rather a lot to also acts as Chief Validation Adviser for SKYbrary. do during a period of time which is invariably a fixed number of minutes before STD – typically 60, 75 or 90 I don't know how many HindSight that in each case, two of the choices minutes1. This interval often has less to Readers are familiar with the story of are always too much in the direction do with what is required than the need Goldilocks (a little girl) and the Three of an extreme – too hot/cold, too to keep the Flight Duty Period2 to a Bears – a baby bear and her mother hard/soft or too large/small and one minimum. Even before 'signing on' for and father. It includes a scene where, is "just right'. For the majority of both a flying duty, if the aircraft commander whilst wandering in a forest early one controllers and pilots, the everyday is new to command, new to the aircraft morning and rather hungry, Goldilocks exposure to workload is rather like comes across the Bear Family's cottage that. There is an optimum, at each end and looks through the window. With of which are the extremes of 'too low' 1- Long haul flights in larger aircraft are likely to be preceded by more generous reporting times. no bears in sight, she goes in and sees and 'too high'. 2- This begins at the time that a crew member is three bowls of porridge. She tries a required to report for duty and ends at engine little of each. Then she tries out each Workload on the flight deck is, on a shutdown after the final flight. It is often scheduled of the three chairs and finally, having normal day, predictably cyclical for quite close to the maximum permitted. This is different to a Duty Period which can and does found the bears' three beds and falls every flight. Unless the flight which continue after this time as required – including asleep. But not before she has decided follows is a short haul turnround flown positioning after flying duty.

10 type or variant, about to operate a variant within a common type rating which they have not recently flown or is unfamiliar with the route and/or destination and alternates, then they will almost certainly have undertaken some pre-flight preparation in their own time. Probably not too many controllers feel the need to do that unless OJT beckons!

So pre-flight is routinely high workload and can become very high workload if operational normality does not prevail with the overriding pressure being that these days, every late departure has to have a reason, the We have an unexpected traffic demand! Did the system come up with a solution? Yes... but I don't think you'll like it! determination of which is a subject on its own. Needless to say, most Captains want to minimise the number of times will interfere with this. Once descent controllers will have some 'baseline' they are the 'cause'. has started, the routine workload variations in workload which can be slowly builds up to a maximum until anticipated at the beginning of a Engine start to 10,000 feet is after completion of the landing when particular shift – although I'm sure that accompanied by a different but equally it reduces to a intermediate level until these baselines are rarely the same high workload. Then, almost always, engines off. unless it's the same shift in the same comes the low workload period position. beginning above 10,000 feet and Of course this broad predictability lasting until about the top of descent. is not guaranteed but this repetitive For both pilots and controllers, these Usually only the direct or indirect cycle is probably more constant than routine expectations of workload effects of adverse weather or the the variation in a shift as a controller. variation will (for pilots) or may well occurrence of an aircraft malfunction Nevertheless, normality for most (for controllers) encompass the full range of acceptable workload. But this at least represents a familiar 'normality', and whilst the challenges in the vicinity of these two extremes are rather different, they at least happen more or less when expected. Where to 'draw the line' when faced with overload can be dealt with procedurally by making reasonable assumptions about the point just before that where the performance of individuals may no longer be consistently safe and devising a reliable solution.

But there is an extra dimension to workload in respect of the high end of the spectrum and with it a heightened risk of overload. This is the fact that 'the 44

HindSight 21 Summer 2015 11 THE VIEW FROM ABOVE

Workload and the surprise factor (cont'd)

system' in both the flight deck and in The first of these stands out as the case but this should not prevent the the control room must be able to cope one where ATC is unlikely to be development of overall resilience with the particular case of a (very) involved – although in respect of risk- sufficient to stay out of more than sudden and (entirely) unexpected mitigation, it has a lot in common momentary overload altogether. transition to high workload which with the last two. For the next three, demolishes in seconds the previous there are procedures for both pilots To be effective, this training must be expectation that fluctuations in and controllers to follow and in these based on two guiding principles: workload would continue along the situations, the response is at least anticipated path. Recovery – or at similar in principle every time and the n A way must be found to 'hide' least containment – before overload is responses are procedurally prescribed, these 'representative scenarios' reached becomes the aim. are covered in training and for real within a whole training exercise fairly often. The last two, however, so as to introduce at least a little From the perspective of the party on typically demand rather more ad hoc of the unexpected onset which the receiving end of a surprise, the decision making and there is much would accompany the real thing. trigger for this sudden change could more chance that every situation will be either 'internal' or 'external'. In be different. Here, (and in the first n We all know how quickly news either case the origin of the change case) the normal training system may of each new training exercise could be 'technical/environmental' have provided the least benefit. gets passed round. To avoid this or 'human' – although inevitably, as loss of surprise, a huge library of in any endeavour with a human in Coping with any operational issue representative training scenarios charge, the latter tends to dominate. needs two approaches – prevention must be developed so that the A sudden unexpected increase in and recovery. Since prevention surprise they provide is as near to workload on the fight deck or in the procedures will often have failed, the real as possible. control room may fairly quickly result ability to recover is important and in the same condition for the other supportive training to increase the Of course the best place to practice too. But of course both pilots and chances of this is therefore crucial. this is in a simulator which replicates controllers can initiate an unexpected But in the case of a 'sudden' and a real aeroplane or work station and and sudden increase in their 'unexpected' rapid transition to high for most pilots at least, this is possible. workload by their own inappropriate workload, not every scenario can be But I suspect that many controllers will or unintended actions without any anticipated. Training must therefore not be exposed to quite such realistic help from anyone else! employ representative scenarios and training opportunities so that in itself assess the competence demonstrated will be an additional challenge. Some of the most common scenarios in coping with them. I admit that it will for sudden and 'out of the blue' high be difficult if not impossible to directly And one final thought. Is the workload are as follows: include the self-caused high workload predictable consistency of a 'goldilocks' workload really what we Trigger In Condition Cause Workload effect for want? Even if we define 'normality' as including the predictable and Flight deck Aeroplane control Pilot Pilot anticipated variation in workload, Flight deck Low fuel External/Pilot Both do we really want to stop there? Why did we become pilots or controllers? I Flight deck Aeroplane malfunction External Both suggest that most of us did so because Flight deck Medical emergency External Both there was also the prospect of an occasional unexpected challenge to Control room ATC system malfunction External Both rise to and meet successfully without needing a completely memorised or Either Traffic separation Either Both scripted solution.

12 CASE STUDY Who stole

my call sign? by Bengt Collin

The Manager was new in his job – he ment. “This organisation is like a fat cat had started only two months ago. His lying in the sun, waiting to be fed. We knowledge of process management have to change that”, he continued. and efficient monitoring had played an One of those at the meeting, a senior important role in his selection, ahead controller, looked out of the window. It of other applicants. “We need to look had started to rain and he had no um- at air traffic control from a different brella. angle; the European SESAR project will dramatically change the role of the One pair of fighters had already depart- controller” the CEO was explaining to ed from the local air force base bound Union representatives in a coordination for one of the exercise areas some ten meeting following the new appoint- minutes east of the base. Sylvester led a second pair as they taxied out to the runway for departure. It was a sunny day. During an earlier training flight before lunch, he had been flying under callsign A32 but for this second sortie, he had been assigned callsign A65. He had really enjoyed lunch – fried her- ring and mashed potato with lingon berry jam. Immediately after take-off A65 he contacted the controller responsible for clearing air force flights crossing the terminal area of the international airport nearby; “Control, Alpha six five airborne”. Bert, the controller, replied “Alpha six, five fly heading one zero zero, climb to flight level one one zero, call you back for further climb”. “Head- ing one zero zero, climbing to flight level one one zero, Alpha six five”. The landscape he was passing over was so beautiful, small lakes, attractive green forest. Perhaps there would be time for a trip on his Harley later. 44

Bengt Collin worked at EUROCONTROL HQ as a Senior Expert involved in operational ATC safety activities. Bengt has a long back- ground as Tower and Approach controller at Stockholm-Arlanda Airport, Sweden

HindSight 21 Summer 2015 13 CASE STUDY

Who stole my call sign? (cont'd)

Bert began to coordinate A65 with the supervisor’s duty to support his team you as soon as I've dealt with this im- two controllers responsible for traffic by following the operational environ- portant phone call”. Frederic and Kevin north and east of the international air- ment, not his. walked slowly over towards Yvonne. port just south of the intended flight path. He had to coordinate all cross- Frederic and Kevin, two representa- Bert instructed the first pair of fight- ing traffic as he did not control the tives from a consulting company, had ers to contact the air force controller airspace himself. The first controller, arrived to the centre at lunch time. in charge of the exercise area locat- Greg, replied immediately. You could “We will be measuring the work load ed east of the civil terminal area. The tell he was bored to death and had vir- of the controllers” Frederic explained second pair of fighters, A65, passed tually nothing to do by the way he re- to the supervisor, Tony. “It’s part of just north of the international airport plied. “Send them wherever you like, it the new efficiency program initiated maintaining flight level one one zero. doesn't matter to me” Greg responded by the new manager” he continued. The conflicting traffic for A65, ABC123, in a tired but not unfriendly way. “For example, what is that controller was descending through flight level over there busy with”, Frederic asked 170 westbound so they should be The second coordination was not as the supervisor, nodding towards Greg, clear of conflict in around two minutes. simple. He didn’t expect it to be given now lying across his desk half asleep? that there was a trainee in position. “Greg, wake up! We have visitors”. The Whilst he waited for a third and final By turning around to his left, he could supervisor felt rather embarrassed to pair of fighters, operating as A32, to see that the trainee, Yvonne, had been say the least. “Well this is what hap- depart, to follow the same eastbound left alone, her instructor was nowhere pens when we are required to keep all route as the previous ones, Bert tried in sight. As always, once he had made the sectors open whatever the work to coordinate a military transport air- contact he proposed a solution. It was load” Greg answered in his typical, ob- craft heading southwest but the line much quicker and efficient to do it that structive way. was busy. The airspace south of the way. ”Please stop ABC123 at level one civil terminal area was controlled from two zero, I stay below with Alpha six “Why not start your study at another a different and rather small approach five”. “OK”, Yvonne replied. He could sector, perhaps…”, the supervisor tried centre. There was not really any need overhear other aircraft calling on her to change focus away from Greg. But to keep it open, it had remained just frequency, she was obvious busy. He he stopped mid-sentence when his for political reasons. thought about asking the supervisor phone began to ring and he saw that it to call Yvonne’s instructor back, but was his wife, i.e. absolutely top priority. In this small centre, there were four con- decided not to. After all, it was the “Please just go ahead, I'll get back to trollers on duty but only one working – the other three were playing cards. This was their usual routine – work very hard for an hour then have three hours free. MAKE YOUR CHOICE... Even better, one or two of them could leave early which was very useful – you

Low workload High workload

14 could do all your shopping before you “What is your opinion? I will fill in this ing with Yvonne. Her body language officially stopped for the day. The con- and your other replies to our questions was unmistakable, she was obviously troller in position, Marie, was very ex- on my printed form, you just need to annoyed with them. She had turned perienced; she had full control of all the answer”. “For obvious reasons we can’t away from her radar screen and was aircraft, although she was responsible do this survey outside the operational pointing a finger at Kevin. “Don’t you for traffic to and from four different air- environment, I’m sure you understand”. dare tell me what I should do”, she ports. The only minor stress factor was Kevin had a serious tone in his voice. shouted. It could have been worse, I the necessary coordination with the could have been married to her, Tony towers, but she could handle that too Bert, still unable to coordinate his thought, returning to his working po- without any problem. southbound aircraft, noticed the A32 sition. She will make an excellent con- pair had got airborne. “Control Alpha troller! Bert again tried to coordinate his south- three two airborne”. Just as he was go- bound transport aircraft. The inter- ing to reply, the controller at the centre “Control, Alfa three two, I did not reply phone at the other centre was busy all south replied on her interphone, “yes, to your clearance”. What did he say; the time which was very irritating. They what do you want?” He recognised he did just that, he did read back the must be extremely busy. He focused Marie's voice, he knew her well. “Hi, clearance to climb? Bert was confused. on the transport aircraft; it would leave I have Echo one six zero for you, just “Someone else read back the clear- his area in a minute or so and he really wait a sec”, Bert answered the A32 be- ance”, the pilot from A32 clarified. “But needed to coordinate. fore it reached four thousand feet, the we are climbing now, Alfa three two”, standard climb limit after departure. he continued. Bert suddenly went cold Frederic introduced Kevin and himself “Alpha tree two fly heading one two as ice. He scanned his HMI. Which pilot to Yvonne. “Hi, we are going to measure zero, climb without height restrictions”, had picked up the clearance and was your working conditions in line with “Where was I” he said as he returned to climbing? How could this happen? In a request from your new manager”. the coordination, ”ah yes, Echo one six a few seconds he saw A65 climbing, “What do you estimate your current zero, south west of…”. “Radar contact, passing through the same level as work load to be?” Frederic asked with- send him to me”, Marie interrupted. ABC123 just half a mile behind it. out waiting for a reply to his introduc- “Thanks, climbing without restrictions, tion. “We have a scale from one to six, Alpha three two” the pilot replied. “OK, Yvonne turned back to her radar one is a very light workload and six is I’ll send him to you”. Marie had already screen; ABC123 had just met the fight- very high”. Yvonne turned round, “sorry hung up. ers. “ABC123 descend to flight level six what did you say?”. ”One is light, six is zero”. very high workload”, Kevin suddenly After taking down the shopping list came to life, repeating Frederic’s words for today’s evening meal from his wife, “That looked really scary Bert”, Greg but louder. Yvonne looked at them, ap- the supervisor Tony walked over to laughed while calling up Bert to verify pearing rather puzzled and opened her Kevin and Fredric. He tried unsuccess- that the last pair of fighters had left his mouth to say something but didn't. ful to talk to them but they were argu- area. “Did they have visual contact”?

Low workload High workload

HindSight 21 Summer 2015 15 CASE STUDY Case Study Comment 1 by Richard (Sid) Lawrence

Where to start with this one? There are clearly a ‘multitude of sins’ to consider – over eager/inappropriate management, poor supervision, an absent OJTI, high workload, endemic call sign allocation issues, inadequate hearback, distraction…the list goes on.

However, with my EUROCONTROL Call Short call signs such as A65 are easy to The question you might ask is why did the Sign Similarity Project Manager’s hat pronounce but they are easy to mix up squadron have to use the same call sign on, I’ll stick with the call sign related too. As an aside, in the civil world ICAO numbers again for a different flight a few issues as these are at the heart of the Doc 8585 recommends that call signs hours later? After all there are plenty of problem. Clearly nobody in the mili- ending in 5 or 0 should be avoided to other combinations available that could tary set up realised that by re-using the lessen the possibility that they may be have removed any potential confusion in same call sign, albeit with a different mistaken for headings and flight levels. the pilot’s mind at a stroke. Now I’m not a crew/pilot, this might induce human It would be fair to say that adherence human factors specialist and I won’t pre- factor-related misunderstandings. to this practice is, shall we say, at best tend to know the inner most workings of Comparison with civil ops is, in some re- ‘patchy’ and at worst ignored. So if civil the human brain (least of all my own so spects, inappropriate. Civil flight sched- operators don’t do it, we can hardly ex- I’m sometimes told!!) but, intuitively, it just ules and associated commercial flight pect the military to consider doing this doesn’t seem sensible to re-use a call sign numbers and ATC call signs are gener- either. when there are plenty of other number ally allocated before the start of each combinations to choose from! IATA summer and winter season. In the We also can’t expect the military opera- military, whilst some air transport type tors to conform to the EUROCONTROL As in the civil world where an aircraft op- operations may involve an element of Call Sign Similarity ‘’Rules” that we use erator has a specific R/T designators, e.g. scheduling, the planning of operational as the basis for detecting and de-con- British Airways' use of 'SPEEDBIRD', the ad- training sorties is a much more dynam- flicting similarities embedded within dition of a call sign designator prefix for ic affair. A typical flying programme is civil aircraft operators’ flight schedules military flights, e.g. “SAXON” might help to probably published the day before at using the EUROCONTROL Call Sign better differentiate call signs. So instead the earliest. In some air forces, ‘training’ Similarity Tool (CSST). These “Rules” – of A65 and A32, we could have SAXON 65 (instructor and student) pilots are allo- although it’s best to consider then as or SABRE 32. Of course the same principle cated an individual call sign which they conventions rather than “rules” per se of not re-using the same call sign within a use on every training flight – this lets – describe the main types of ‘similar- matter of hours can still apply but the addi- ATC and aircraft operating authorities ity’ that can lead to call sign confusion; tion of a call sign prefix might just help to know who exactly is flying which air- they also describe the various recom- break previous mental connections. craft. But whilst on ‘training’ squadrons mended call sign suffix formats – num- this makes life a bit easier, operational bers and letter – that can be adopted, training sorties tend to use different call e.g. nn, na, nnn, nna, naa, nnnn, nnna, A RECOMMENDATION signs every day. nnaa. Just as in civil operations, it is important that military authorities try to avoid/reduce the risk of call sign similarity/confusion not only in Richard “Sid” Lawrence served in the UK Royal Air their own operating environment but Force for 29 years across a wide range of ATM and related safety disci- also within the mixed civil/military plines. Richard joined EUROCONTROL in January 2006 and is currently environment that is commonplace. working in the Network Manager Directorate Safety Unit covering a Accordingly, I would recommend broad spectrum of ATM safety related topics including management of that the military aviation authority the EUROCONTROL Call Sign Similarity/Confusion project. reviews its call sign allocation policy, perhaps coming up with a version of its own call sign similarity “rules” that could be applied service-wide. 16 Case Study Comment 2 by Captain Ed Pooley

Well, my first impression is what a dysfunctional ATM setup exists in this region! No surprise that the need to start some sort of improvement is overdue. However, we only hear of some change planned for the main ACC in the story when a regional solution is obviously required.

Anyway, the new manager has or no respect amongst his controllers. failed to realise that his initial prior- Again, the wrong man got the job – or is an ity should have been not to begin perhaps in this case, his performance Captain Ed Pooley workload measurement or any other had just deteriorated once in post… experienced airline pilot who for many years also part of the change process but to held the post of Head of Safety for a large short first spend some time gaining an But the near miss which represented haul airline operation. He now works with a wide understanding of the status quo. the immediate threat to safety was range of clients as a Consultant and also acts as Such insight would have allowed nothing to do with workload or effi- Chief Validation Adviser for SKYbrary. his vision of modernisation can be ciency or the civil ATM service gener- turned into reality through a change ally. It was the consequence of a flight management programme based on crew error which was made more likely the starting point – the people, their by a frankly stupid system of allocat- approach to their job and everything ing R/T call signs to military training Finally, as a observation, I would sug- else about their working environ- flights. Whilst there can be no justifica- gest that it is poor practice to separate ment. And in particular he needed, tion for the call sign allocation made, a military fast jet (or a pair) by only at an early stage following his ap- the solution needs to be formulated 1000 feet from crossing or opposite pointment, to get to know his man- by the military authorities – for all bas- direction traffic. The performance of agement team down to the super- es. However, it is obvious that after its such aircraft means that by the time visor level so as to be able to judge first use of the day, a call sign must not the potential conflict has been picked their fitness for purpose in their ex- be used again that day be a different up by STCA or radar observation, there isting roles and their suitability for crew – and unless individual pilots are may be insufficient time to pass avoid- implementing significant change. allocated personal call signs, it should ing action instructions or insufficient An address about a vision should really not be re-used at all that day. time to act on them. have been merely a prelude not the starting gun on change. Clearly, the I did wonder about the availability of wrong person got the new manag- STCA which wasn't mentioned. Not in- A RECOMMENDATION er's job.... stalled, not operating or not set up in The military authority HQ needs such a way that would detect such a to undertake a risk assessment On a more specific failure, the del- potential conflict? on their operation of fast jets in egation of the premature workload controlled airspace where the measurement exercise to a contrac- Of course, Mode 'S' DAPs from the civil authorities provide ATS. In tor appears to have been inappropri- military aircraft could have triggered the near term, this might lead to ately tasked and/or inappropriately a quicker warning to the civil control- a sensible service-wide policy on briefed. Oversight of the two idiots ler which may well have provided him R/T call sign allocation and in the supplied for the survey work in the with sufficient time to intervene. But longer term, it might result in the control room was non existent thanks then, if the military had fitted a mode fitting of altitude encoding tran- to a completely inadequate supervi- S transponder to their fast jets (or sponders to all their aircraft ac- sor. It seems that the same supervi- even a mode C one), the civil aircraft companied by a requirement to sor also failed to ensure that an OJTI would have received a TCAS RA if the switch them on whenever in con- did their job properly and, on the time-to-proximity threshold had been trolled airspace. evidence available, commanded little breached….

HindSight 21 Summer 2015 17 CASE STUDY Case Study Comment 3 by Captain Pradeep Deshpande

The subject which I would like to focus on is the control of military fighter aircraft through civil airspace.

Routing of military aircraft through civilian airspace, particularly in the proximity of international airports, is fraught with potential difficulty from both the pilot and controller point of view. Military fighter planes often fly in formation with a single In hindsight, giving some information aircraft taking responsibility for ATC on the opposite direction traffic may A RECOMMENDATION communications on behalf of two or have been a prudent move, however, Procedural control could be used more aircraft. Situations may arise the controller’s decision not to do so to mitigate the risk of a conflict where, should the visual contact which cannot be faulted since he had made such as this. A simple solution is often a necessity when maintaining the required effort to establish the would be the creation of a transit a compact formation be lost due vertical separation. corridor to the south of the to weather or any other reason, the international airport which is attention of the formation leader may Not paying attention to ones call sign is relatively free of civilian traffic and get divided between maintaining a serious yet oft-repeated error. Military also has an adequate number of safety within the formation as well fighter missions are generally allotted a controllers. This would allow the as coordinating the transit through ‘block’ of mission numbers, and these military jets to transit to and from the civil airspace. The formation may are used in sequence during the course their exercise area with minimal even be using two separate radio of an exercise. On a day such as this exposure to the traffic coming frequencies at the same time, one where one pilot flies multiple missions in and out of the international within the formation and the other for using call signs that are distinguished airport. Also, restrictions on transit. The workload in the cockpit only by another number, the chances flight level/altitude could be even during a seemingly routine climb of committing such an error are pretty established to ensure that the out could be higher in the fighter high. Arguably, on a multi-crew flight military aircraft stay below a cockpit as compared to a multi-crew deck this error would have been caught certain level whist the civilian flight deck. This is fully appreciated by in time by the second crew member, but aircraft do not descend until they the air traffic controllers and therefore, on a single seat fighter the backup does are within a prescribed distance of as in this case, the fighter formation not exist. The safety net for this could the international airport. Clearly, was given a heading and a restriction have been provided by Yvonne or her radar control provides more on the altitude to climb to without supervisor – that however, is another efficiency for air traffic control but giving details of the conflicting traffic. aspect of this case. in a scenario that has an area being coordinated by one agency and controlled by another, procedural control must form the basis for air Capt. Pradeep Deshpande traffic management. This will not served as a combat pilot in the military for 22 years. only allow a built-in safety to cater He was a flying instructor and examiner in the military before joining for any delays in coordination but commercial aviation. Commercially he has flown the Airbus A 310 and is will also give the military fighters currently flying the B 737 800 NG at Air India. some room to manoeuvre should He has approximately 9000 hours from 32 years in aviation. the situation so demand.

18 FROM THE BRIEFING ROOM

The quantified self in a complex system: a systems perspective on mental workload

by Dr Steve Shorrock In the last few years, many of us have started to quantify ourselves. We have purchased activity trackers to monitor and track health and fitness metrics ✈ such as distance walked and run, calorie consumption, heart rate and sleep quality. By quantifying inputs, outputs and what goes on in between, it is possible✈ to set a desired goal, adjust, and track progress toward it... 44 ✈

✈

HindSight 21 Summer 2015 19 FROM THE BRIEFING ROOM

The quantified self in a complex system: a systems perspective on mental workload (cont'd)

This occurs within a complex system (a person), but one where it is usu- ally possible to control the inputs and outputs fairly well. Sometimes, we like to think of socio-technical systems in the same sort of way. We measure concrete things like traffic and RT load, less concrete things like traffic com- plexity, and sometimes rather abstract intermediary things like ‘mental work- load’. Yet many remain sceptical of the quantification of aspects of human ex- perience in complex systems.

From a systems perspective, human performance exists in the context of a dynamic (and often messy) system. For complex systems such as aviation, everything connects with something. When there are changes in one part, there are adjustments elsewhere. So ‘human performance’ is only relevant in the context of the system: other humans, a variety of equipment, pro- cedural constraints, working environ- ments, demands, and so on. All of these aspects of the system interact in variable ways, over time and in dif- “the most ferent situations. From a humanistic perspective, human beings supersede important the sum of their parts. We cannot be reduced to components or concepts, things nor can we be dislocated from our hu- man and environmental context. The cannot be trouble with many measures in socio- measured”. technical systems is that they can dis- locate, mask and distort the human, system and environmental context.

Quantitative data about humans and systems look scientific be- cause they take on a certain (of- ten spurious) accuracy in black and white, with all their decimal places. But such data are as political as they are scientific, or at least they become so because the search is sometimes not for an answer to a question but the desired answer to a question (e.g. that a change is safe or acceptable). Unrav-

20 elling the history of the numbers can values, traffic numbers, or whatever, observing controllers, my questions reveal some inconvenient truths. And are a reason for a conversation, the on workload rarely concern numbers, once something is measured, it can start of a conversation – not an end even though so much research on be tempting to prescribe a maximum, point. We can’t measure workload like workload is aimed at measurement. minimum, or target. All of these can we can measure our heart rates, calo- To you controllers, some of these are create problems in socio-technical sys- rific intake or physical activity, but we worth asking prior to the introduction tems, which do not have hard physical can do what we can to try to make of changes. For instance: parameters, and which can change sense of our experience, accepting their behaviour in response to being that any data collection is a compro- n Ask the proposer about the measured, and in response to arbitrary mise, and there are nearly always so- purpose(s) of the change – the an- quantified targets. Numbers can take cial and political implications. swers may change over time. on a life of their own. n Ask designers and engineers about In practice, how we human factors the requirements, engineering pro- But it is naïve to think that we can or specialists measure, assess or under- cess, user needs analysis, prototyp- should completely avoid numbers. stand your workload – or anything ing, interaction design, testing and Unfortunately, there remains an at- else – is secondary. This is because simulation. titude among some that “If you can’t only a small minority of European n Ask training specialists about the measure it you can’t manage it.” This ANSPs employ human factors special- training needs analysis, the length is despite everyday evidence to the ists in the first place, and those ANSPs and timing of training and familiari- contrary, and despite the thinking of who do any kind of ‘mental workload sation, its design, method and plat- management and quality guru and assessment’ could be counted on one form. statistical professor, W. Edwards Dem- hand (with fingers to spare). Decisions n Ask HR and planning about the ing who remarked that “the most im- about changes to technology and pro- staffing, stress management and portant things cannot be measured”. cedures are, in the majority of cases, fatigue implications, including shift And qualitative data – of the sort that I made with no input from human fac- work and breaks from operational tend to prefer – don’t always penetrate tors specialists in ANSPs. Decisions duty. the management-by-numbers or hard are made on the basis of a perceived n Ask operational management engineering mindsets. Qualitative business or operational need and an about how demand can be reduced data are messy and might not reduce available technological or procedural or varied when needed (e.g. high- uncertainty in the same way as num- solution (which sometimes creates a workload training flights in small bers, and uncertainty is a key source ‘need’), and the solution undergoes airports). of anxiety for decision makers. It’s also some form of design process and safe- worth remembering that quantitative ty assessment. Technological solutions And finally, ask yourself, your col- measures can also suggest that work- are increasingly commercial-off-the- leagues and all of the above about load is too high, and this might carry shelf, with little room for adaptation. your involvement in all aspects of the more weight for some than a story change. You are the experts in your or controller comments. Numbers After over one thousand hours talking work, and you will inherit the result of may also be the only thing that some with operational staff (and managers) any changes…and have to adapt to have any time or inclination to digest all over Europe, and hundreds of hours them. when it comes to decision making. The quantification of performance is re- ally a trade-off in data collection. Such data can often be gathered from more Dr Steven Shorrock is Project Leader, Safety people, more efficiently. Development at EUROCONTROL and the European Safety Culture Programme Leader. He is a Registered Ergonomist and a Chartered For these reasons, most numerical Psychologist with a background in practice and research in measures concerning human experi- safety-critical industries. Steve is also Adjunct Senior Lecturer ence and system parameters should at the University of New South Wales, School of Aviation. be treated as social objects. Any data on mental workload, sector capacity

HindSight 21 Summer 2015 21 FROM THE BRIEFING ROOM Are you a competent workload manager?

Dragan Milanovski A controller’s ability to manage workload is a subjective and individual response to a given task load situation. It enables him/her to continue to provide a safe and efficient ATC service. Personal factors (e.g. skill, experience, stress) or external factors (e.g. time pressure, noise, stressors, distraction, organisational change issues etc.) can all influence workload. There seems to be a general consensus that ability to manage workload is one of the key ATC competencies. How does a controller develop this competence?

There are currently two conceptu- such a remark might be true in a small load management are listed below: ally different approaches to addressing proportion of cases, more often than workload management in ATC training. not, we fail to understand the real rea- n manages personal efficiency and sons for the insufficient performance. work tempo by proactively adapt- Traditionally, workload management ing solutions is introduced towards the end of a Competency-based training offers n limits the number of simultaneous training course, allowing students to an alternative to the traditional way actions and ensures their timely initially focus more on carrying out in- of teaching workload management. completion dividual tasks and mastering some of Within this concept, the workload man- n prioritises and schedules tasks; the skills such as applying separation agement is addressed from the very n manages interruptions and distrac- standards correctly, vectoring, speed beginning of the training as a core ATC tions effectively; control etc. Then as the traffic load- competency. Regardless of the traffic n builds in appropriate safety buffers ing is made busier and more complex, level or the individual training objec- into control actions; the associated workload inevitably in- tive, the ability to manage personal n organises traffic flow according to creases and the skill of workload man- workload is treated as a part of the traffic complexity by using direct agement is introduced in training. This job. The emphasis throughout training routings, initiating actions early requires students to consolidate what under this system is on what the final and avoiding excessive vectoring; they have learnt up to this point and performance should be, integrating the n asks for and accepts assistance to continue to apply the “individual knowledge, skills and attitudes required when appropriate; task-based skills” along with some new to perform the task (the provision of an n delegates tasks as necessary in tips and techniques from the instruc- ATC service) to the prescribed standard. order to reduce workload; tors for use when the workload is high. n selects appropriate tools, equip- Many discover important new aspects Usually, a competency-based assess- ment and resources to ensure the of the skills which they thought they ment is made on the basis of the efficient accomplishment of tasks. had mastered by this point in training, different levels/standards of perfor- such as building in safety buffers, or at mance reached progressively during Although the above list is only provid- times opting for less efficient solutions. training, which allows students to ed for illustrative purposes, we can al- Many others, however, find it very dif- build up their competence until the fi- ready see a number of benefits which ficult to adjust to the new conditions nally-required level of performance is it offers over the traditional approach. and to understand why some of their achieved. But how do we know that a For example, the prioritisation of tasks skills are no longer working as they student has reached the desired per- and work tempo and the proactive ap- were before. A typical instructor as- formance level in terms of workload proach are questions of attitude which sessment would in this case blame the management? Typical performance need to be trained from the start. student’s lack of ability (simultaneous criteria (in terms of observable behav- Although at the beginning of train- capacity) required for the job. Whilst iour) which are associated with work- ing, low traffic volume and complex-

22 What you need right now is a hot bath, an hour of relaxation yoga, a good meal and a glass of wine, but you know that's impossible... So a 5 minute cigarette break should do...

ler to achieve a desired outcome using the least possible number of control actions while also minimising any ad- ditional track miles which the aircraft must fly as a consequence. If this ap- ity mean that the method might not How do we teach future controllers proach is applied consistently, it is not make a huge difference to the overall to ask for help when they need it a problem to avoid excessive vectoring outcome, it is important to insist on the and/or accept such help when it is and to limit the number of simultane- execution of tasks according to an ap- offered, and how do we teach them ous solutions during busy periods. propriate priority and with a pro-active to recognise a situation in which it is focus. As traffic levels and complexity appropriate to delegate tasks? If we I am sure you can think of many other increase, the desired observable behav- wait until students are overloaded examples in your own environment iour remains the same. and there is no solution other than in which it makes more sense to ap- delegation or seeking assistance and proach workload management train- For the same reason, selecting the most by then it is probably too late. If a stu- ing in an integrated manner even appropriate tools and equipment for dent has never delegated a task be- though this might seem difficult at the task is another aspect which might fore, it is highly unlikely that he/she first sight. be considered for early introduction will do it at times when the workload in training. It could be argued that stu- and the complexity become too high. Looking at these examples, it is easy dents must learn how to use all the tools However, if such judgements are in- to see that workload management is at their disposal, and that allowing them tegrated into training right from the quite complex and that a controller time to experiment has no impact on the beginning, students can opt for these probably needs more time to develop overall outcome of a simple exercise or actions a lot earlier and learn to ap- this core ATC competence. However, during periods of low traffic volume and preciate both the potential benefits despite its complexity, we can focus complexity. This is probably true, but it and likely consequences, there is a lot on these aspects of behaviour from is also a fact that in this case we will be better chance of success. the very beginning of training. Ad- missing out the attitude element of the dressing workload management in a competence, i.e. considering the use of Teaching all aspects of vectoring at all practical and integrated manner gives different tools then always picking the times is also a better option. Admitted- us a lot more time to teach and then one most appropriate for the task. ly, vectoring is not a simple technique consolidate the required skills and at- and it requires the development of a titudes. In addition, this method pro- Another good example is how students number of individual sub-tasks (usu- vides an early opportunity to identify deal with interruptions and distractions. ally on a part-task trainer) at an early weak performance in workload man- Apart from teaching students the knowl- stage of the training, but once these agement and gives us enough time to edge and skills needed to resolve situ- sub-tasks are well established, the address any difficulties with person- ations in the event of interruptions, we aim should always be for the control- alised remedial action. also need them to develop a conscien- tious attitude towards routine and effec- tive resolution of interruptions and dis- tractions. This is possible only if they can manage interruptions and distractions Dragan Milanovski consistently and using the same tech- is an ATC training expert at the EUROCONTROL Institute niques, even during periods in which of Air Navigation Services in Luxembourg. Most of his operational there is plenty of time available and no experience comes from Skopje ACC where he worked for a number of years real pressure to carry out other tasks. To in different operational posts. put it simply, if the time is available, it is not acceptable to waste it.

HindSight 21 Summer 2015 23 FROM THE BRIEFING ROOM Your team is likely to be the key

by Adrian Bednarek in cloud and not visible on a screen.. I’m sure every controller can easily It is a common belief that an air traffic controller’s recall moments like those and will re- profession is one of the most stressful jobs in the member them for a long time. world. But actually, I am more inclined to agree with Workload which has been identified as another opinion common in the controller community ‘too high’ or ‘too low’ is something not – that our job is 90 percent daily routine and 10 desirable in any human activity, es- pecially in high risk activities. Both of percent of rapid heartbeat. these situations have specific hazards associated with them, which are direct If we took a closer look at those figures, night shifts on Saturdays or days when consequences of the fact that people we would quickly discover times of un- some Icelandic volcano with an un- don’t like to be bored and neither do welcome boredom and monotony in- pronounceable name erupts – when they like to face situations which re- terspersed with short intervals of total I wonder if my presence in the ops quire extraordinary effort. That can panic and bewilderment. Clearly, the room was even noticed. These are the raise several questions, starting with balance between these would differ if times when minutes become hours the most obvious one: how do you we took some additional factors into and hours become infinity. At the measure workload? Are there any re- account – controller experience and other end of the scale are those short liable data available? Who would set age, type of service being provided, seconds and minutes which passed in the limits of an acceptable workload level of traffic, available equipment. the blink of an eye and turned some and how? But what we would see is that signifi- of my hair grey. Maybe an unexpected cant part of our job is just routine and 'swarm' of aircraft being diverted from ordinary tasks we don’t even remem- a suddenly-closed airport, a failure of ber when we get back home after the telephone or radio commu- shift. However, in some strange way, nications, military train- those usual tasks give us the satisfac- ing flights during peak tion and joy of a job well done. And hours or a VFR flight lost there are also those times – holidays,

24 Usually, he or she is a part of a bigger group of individuals – a team of controllers, One could perhaps use a simulator to fic flows in unpredictable ways, equip- help answer those questions but even ment fails and weather doesn’t want assistants, unit or shift that wouldn’t be a perfect tool yield- to follow forecasts. It is not possible to supervisors as well as ing a clear picture. There are too many respond to those changes merely with variables and interactions which can- regulations and procedures. In the various other people not be readily simulated – at least not end, there is always a human operator at a cost proportional to the benefit. – the air traffic controller sitting there who are physically in What would happen to workload if in the ops room – who has no other the same room... one particular phone line went dead? option but to find a way to cope with What if our airspace becomes a fa- those issues in real time. This is the environment vourite destination for the training flights of nearby flight schools? What Usually, he or she is a part of a bigger where complex if it turns out that Tower windows fog group of individuals – a team of con- up or there are so many reflections in trollers, assistants, unit or shift super- interpersonal relations them it’s not possible to see anything visors as well as various other people grow, where friendship outside at night? And what about low who are physically in the same room. workload? It’s almost impossible to These are the people we interact with and hostility emerge test such conditions in a simulator. for several hours a day, several times per week. This is the environment and, finally, where our As a result, even if you assume optimis- where complex interpersonal relations job gets done every tically that all resources are being used grow, where friendship and hostility efficiently and everyone else is doing emerge and, finally, where our job gets day. everything correctly, there is no guar- done every day. This is also the place antee that your working environment where mechanisms for coping with will perfectly match the needs of your workload problems are being created. fluctuating Those formal and informal methods workload. can differ from place to place but I But you can am sure that every person in your ATS be sure that unit makes use of them, maybe even those de- without being aware of it. We have mands will continuously change known each other in our teams for because of weather, season, time of several months, quite often for years. a day or one of many other factors. Unlike the pilots in big airlines, it is Our working environment is a dy- unusual for most controllers to work namic system where almost nothing is with somebody whom they don’t al- constant: people change, sectors are ready know. We’ve been seeing our being opened and closed, traf- colleagues doing their jobs for a very 44

Adrian Bednarek works in Krakow, Poland as an air traffic controller and a safety manager, focusing on safety culture and practical drift in organisations. He has university degrees in safety engineering and aviation.

HindSight 21 Summer 2015 25 FROM THE BRIEFING ROOM

Your team is likely to be the key (cont'd)

long time and we know what their usual way of working looks like. We’re also the first people to notice how the workload (both high and low) changes their behaviour...

When things become more complicat- ed than usual, we may see them mov- ing closer to the screen; they stop talk- ing to us and – quite often – they stop listening. We may see them overlook- ing an aircraft, momentarily missing some actions which are obvious to us. Perhaps their faces blush or they start to fidget or stamp their feet! Being an incidental observer gives us an oppor- tunity to focus on the situation while being released from the burden of de- ing for repetition, giving impossible- additional coordination (as long as cision making, listening and talking. At to-follow instructions etc. It took me someone had thought about having the same time, a controller doing his or a while to get the courage to ignore an extra phone line available) or pro- her own job can be tempted to ignore the controller’s refusal and call for help vide you with an extra pair of eyes all of the symptoms of 'overload' in or- myself. which will warn you about the risk be- der to get the job done and to protect fore the short term conflict alert does. their feelings of personal pride and If I had done it earlier, we would have But the challenge is to know when to professionalism. Plus, if the workload avoided the embarrassment and con- call for help and who should make that level increases gradually, controllers fusion but, as always, it was only easy call. Unfortunately, formal procedures directly involved may not even notice to say so with hindsight... At the time, quite often leave that to the control- the change at its early stage. the situation was not so clear and ler himself yet he or she might be the alongside me was a much more expe- last person to notice the symptoms of I remember one afternoon when I was rienced controller saying ‘no’, He was their high workload. We also have to just a rookie being trained for my ra- also well-known for having uncon- recognise that making that decision dar rating. Traffic was low so there was ventional working methods and I was very early is crucial, as some of the only one sector open with me working pretty sure that he knew what he was possible responses like opening new as an assistant and an experienced col- doing. He was also an OJTI and I was sectors and briefing an additional con- league as an executive controller. The afraid that not following his instruc- troller will themselves briefly add to rest of the team were on their break, tions would have a counter-produc- the workload. waiting for a phone call in case we tive effect on my future training prog- needed any assistance. Suddenly, our ress. But even taking situations such What does it look like in your unit? flight strip printer woke up and started as that into consideration, I am still Who makes the call to get some extra to spit out new arrivals, one after an- convinced that our closest co-workers staff? How can you reach those peo- other, until they formed an impressive are the place we should look for help. ple? Are there specific steps to follow pile at the controller’s strip bay. There In most cases this method will rely on when opening new sectors? Do you were a lot of aircraft heading our way interpersonal interactions and social need to switch your voice communica- and I began to worry we wouldn’t be connections within the team. tion system? Do you have a checklist able to deal with all this on our own. for it? How long will it take to action? But when I asked if we should call for Getting help from other people is the help, the controller answered with a easiest and the most effective way When working as a pair, one planning simple "no". Before long, I was able to of dealing with high workload. Addi- controller and one executive con- see all the symptoms of high workload tional staff can open a new sector (as troller, it may also be a good idea to appearing: lack of plan, chaotic ac- long as such a possibility was foreseen think how those controllers can sup- tions, overlapping transmissions, ask- by the management) or take care of port each other during high and low

26 workload periods. For example, when and sit in more relaxed ways than week. If your airspace and equipment the majority of the traffic is already in they would usually do. Sometimes an allow you can try to collapse sectors the sector, a planning controller can aircraft is forgotten, especially when and close supporting services to keep provide an extra pair of eyes. He or it has already flown off the screen. yourself busy enough. If you’re terribly she can simply point out a develop- Sometimes, we may also see some bored, you can try to invent a kind of ing conflict on the screen when the of those symptoms affecting our- mind game which will keep you look- executive controller is focused on selves. And we might feel bored and ing at the screen such as estimating problem-solving somewhere else. The count every minute for that aircraft distances between aircraft or navaids. problem is we usually don’t have clear to leave our sector. At times like this, That might be especially helpful for rules on how to provide such help or everything and everyone in the ops students during their OJT when the how to accept it. This also applies to room easily gets our attention. Quite traffic level is low. Another possibility situations when a planning control- often, we also use these moments to is trying to set up a kind of routine in ler needs extra support from another perform experiments, like applying your mind which involves a specific person in your team. It would help a minimum separation even when it’s timeframe for making a cyclic scan of lot if you had your support action plan not necessary. Or just leaving the your radar screen, even if it’s empty sorted out before it is actually needed. situation on its own just to see if it’s at that time. The same can be done in Setting clear, but very often informal, going to ‘resolve itself’ instead of ap- the TWR environment by periodically rules can greatly improve your team’s plying simple pre-tactical resolution. scanning the runways, taxiways, or the performance in such situations. If you Our vigilance is effectively relegated ground surveillance screen, verifying don’t have such rules you’re risking an to stand-by mode and we need extra that you know which vehicle is going avoidable additional increase in work- time to adapt to any new and more where. Think of this as though you are load caused by the need to assign and demanding situation. preparing for position handover all the clarify individual parts of your job to time and you need to be current on your colleagues. The problem of low workload can be every detail of current the situation in defined in a very simple way – people order to determine what would merit don’t like to be bored and when they inclusion in a handover brief. And on When working as a pair, are, they tend to do something silly. the subject of handover, it also might one planning controller Once, I heard a story about one Eu- be a good idea to shorten low work- ropean ANSP experiencing a mysteri- load shifts and rotate team members and one executive ous series of trackball malfunctions at more often thus leaving less time for one of their ACCs. Their technical staff boredom. controller, it may also couldn’t figure out why those fairly re- be a good idea to think liable devices kept failing on a regular Of course, it is up to you and your col- basis. It took them some time before leagues to decide what solutions will how those controllers they found an answer. Controllers work best for variable workload in your can support each other working night shifts at that centre had local environment. Our job, whether been so bored that they had invented we like it or not, is based on teamwork during high and low a game in which they were using their in complicated socio-technical sys- trackballs. The goal of the game was to tem. Workload measurement in such workload periods. move a cursor to a chosen position on systems is neither easily measureable the other side of the screen with one nor predictable and the perception of Low workload situations, on the other powerful punch. It’s hard not to agree it is highly subjective both in respect hand, can be more tricky to detect. that idle brain is the devil's workshop, of self-perception and in the obser- Yawning or closing of the eyes are ob- isn’t it? vation of others, since both depend vious symptoms for others to watch on individual character and approach out for. But before that, we should be So, how can we cope with the effects of to task. Crucially, it is this that means able to hear controllers starting to talk low workload? As always, it’s all "com- that controlling workload from a high about things not related to their work, mon sense". Consider scheduling all managerial level may be very difficult, or maybe not talking at all. We may non-routine activities (military train- or even impossible. The place where it also notice that people move their ing, calibration flights, navaids mainte- can be really dealt with is at the sharp chairs further away from the screen nance) for specific periods of a day or a end – in your ops room.

HindSight 21 Summer 2015 27 FROM THE BRIEFING ROOM Self-induced workload caused by poor communication

by Peter Hudec Workload is very wide term and there are a lot of factors that can affect it. Such as aural/ visual (static and dynamic) information processing, the balance between traffic load and its movements and airspace complexity, the man-made environment (e.g. route structure and working position design and the way a position facilitates actions, for example interacting with radar by means of a keyboard and mouse), relevant change in the natural environment in the form of adverse meteorological conditions such as thunderstorms, fog, icing), co-ordination methods, overall availability of support equipment and many more. But workload can also be influenced by personal variables, such as performance instability arising from age, experience, skill, etc. In this article I am going to address the potential for avoidable increase in communication workload which is sometimes caused by controllers and how this may interact with efficiency and safety.

Peter Hudec became an ATCO in 1983 and an executive supervisor in 2005. He finished his TWR/APP and supervisor operational post at Bratislava, Slovakia at the end of March 2015. Since 1995 he has been working in various positions related to safety investigation and supervision and currently works for the ANSP Safety Division as a Safety Specialist.

28 Generally, every time we have to Busy in this context means that those that we will hear requests for repeat repeat something – "say again" – our white gaps between transmissions or get a wrong readbacks from pilots communication workload is increased. on the frequency are very narrow that will have to be corrected. We may What we could say in a single (just a few seconds), so that the only even not detect such wrong readbacks transmission, now needs repeating way you can accommodate more – but that is another story. once, sometimes twice, sometimes communication without eliminating three times, until we achieve an these gaps altogether is to speak more Phraseology understanding of the transmitted quickly when you transmit. If you try message by the recipient. to accommodate more transmissions From time to time some controllers by narrowing the gaps between them, use non-standard phraseology "to This kind of communication workload you have to be careful not to 'step save words and time” so as to be more increase may occur for a variety of on' and thus block someone else's efficient, which can have the opposite 44 reasons: message which you are not necessarily expecting. In ATC, we often speak more quickly (between 140 and Speed of Speech 160 words per minute) than is recommended in ICAO ANNEX 10 As we speak faster, we may not be Volume ll1. The Recommendation that able to pronounce words, letters and "controllers should be encouraged numbers with sufficient clarity and to speak slowly and distinctly", is thus the recipient does not correctly still valid, but the volume of traffic, understand the message. This efficiency and capacity sometimes problem can be aggravated encourages us to speak faster, so that when it is combined with work as imagined (WAI) is different the effects of a local accent from work as done (WAD). This is an unfamiliar to the recipient. increasing problem. In a busy sector, The result will be a communication blocks recorded by a higher probability logging system might look like this:

1 - Paragraph 5.2.1.5: "Transmitting technique", Paragraph 5.2.1.5.2: "Transmissions shall be conducted concisely in a normal conversational tone, a) enunciate each word clearly and distinctly; b) maintain an even rate of speech not exceeding 100 words per minute. A slight pause preceding and following numerals makes them easier to understand; c) maintain the speaking volume at a constant level”; etc.

HindSight 21 Summer 2015 29 FROM THE BRIEFING ROOM

Self-induced workload caused by poor communication (cont'd)

effect when they subsequently have Some ATCOs use numbers because of the need to get the job to repeat a transmission that was not within a single message done very quickly doing two things understood due to an incorrect or for more than one purpose together saves transmission time unexpected format such as leaving – clearances to climb or descend by avoiding the need to address the out the word "decimal" in a frequency together with frequency changes2. same flight twice I quick succession. change. Some examples of time lost This increases clearance complexity The Recommendation: "Controllers merely by the latter are shown in and may lead to wrong readbacks should be encouraged to keep their EXAMPLES A,B, C. or requests to repeat. This is mostly instructions short“ also supports the separation of such instructions.

EXAMPLE A The more complex a message is, Controller: XYZ6KH resume own navigation, contact Bugen 13289, good bye especially if it contains a lot of numbers, Pilot: 132 decimal 9, good bye, XYZ6KH. the higher the probability that a wrong Controller: Decimal 89 and resume own navigation. readback will occur. Sometimes such a readback error may not be picked up Pilot: 128 decimal 9 and resume navigation XYZ6KH. and a loss of separation may follow. Controller: 132 decimal 890. Examples of this creating additional Pilot: 132 decimal 890 XYZ6KH. workload shown on D and E. Note that saving the one word 'decimal' led to the use of 37 additional ones.

EXAMPLE B Controller: XYZ7343 12037 good bye. Controller: XYZ7343? Pilot: XYZ7343, go ahead sir. Controller: 12037 good bye. Pilot: Say again the frequency, XYZ7343. Controller: 12037. After 40 seconds: Pilot: Sorry sir, you have confused us, XYZ7343. Can you say slowly the frequency? Controller: 120 decimal 375. Pilot: 120375 thank you, XYZ7343. Note that saving the one word 'decimal' led to the use of 58 additional ones.

EXAMPLE C Controller: XYZ361 contact Bugen Radar 132890 good bye. Pilot: Say the frequency again for XYZ361. Controller: Frequency 132890, ahoj. Pilot: 13890, XYZ361. Controller: Negative sir, 132 decimal 890. Pilot: 132 decimal 890 for XYZ361. Note that saving the one word 'decimal' led to the use of 35 additional ones.

2 - This is not consistent with the Recommendation in the "European Action Plan for Air Ground Communications Safety” Part 5.2 "Best practice for ATCOs”, Paragraph 5.2.1.1 which says "Do not pass RTF frequency changes as part of a multi-part clearance".

30 EXAMPLE D Some controller transmis- Pilot: XYZ829, request descent. sions are not easily readable because of their improper Controller: XYZ829 descent to FL290, change Radar 134 decimal 475, good bye. use of the microphone/headset – yet Pilot: Descending FL270, change frequency 134 decimal 475. another reason for having to repeat Controller: 290 flight level and 134 decimal 475. the message. Pilot: Descending FL29 and 134 decimal 475, XYZ829. So you can see that any communication Note that saving the one word 'decimal' led to the use of 28 additional ones. that is not understood by the recipient can needlessly increase workload both EXAMPLE E directly (more time used for a task) and Controller: XYZ2347, Bugen? indirectly (less time for other tasks). Pilot: XYZ2347, go ahead. It can even create work itself – more Controller: Contact Willy 120 decimal 550 and descend to FL120. time spent focusing on pilot readback – your hearback) means more active Pilot: 120550, descending level 100, XYZ2347. listening. And effective active listening Controller: Descend to FL120. always requires effort and energy. Pilot: Say again? Controller: Descend only to FL120. At the beginning, we saw that saving Pilot: Sorry, descending FL120, XYZ2347. words could be seen as saving time so as to be more efficient but I hope Note that saving the one word 'decimal' led to the use of 33 additional ones. that now we appreciate that the result of such action can have the opposite effect. Time is our friend – it can work for us – but it is also our enemy – it can work against us when things are not going as planned. And it is not only just a matter of increased workload because the delivery of operational safety can be affected too. It seems there is a relationship between workload (in this case communication workload), efficiency and safety. Therefore communication has to be used very wisely to keep these three factors in balance as time passes and circumstances change.

HindSight 21 Summer 2015 31 FROM THE BRIEFING ROOM See who is talking!

by Tom Goossenaerts Not rarely drastic measures are need- Several ATC occurrences find their origin in the gap ed to ensure adequate separation. The effects here are both safety risk and between the situation as perceived by the Controller impact on the workload of Controller. and the real air traffic situation picture. The causes Additionally one can argue that this creates an impact on the workload leading to this misinterpretation are various in nature. for Pilots as they are at the end of the The consequences however are usually the same: separation assurance chain. a lot of precious time is lost before the ATCO has a correct view on the situation... But what are the typical scenarios we are talking about? A typical case in which such incor- Tom Goossenaerts rect image is mistakenly taken for has a MSc in telecommunications technology and has worked on the correct one is ‘callsign confusion’. various – mainly military – avionics systems and on ground-based A Controller issues a clearance to an communications equipment for several years. He joined EUROCONTROL aircraft yet a different aircraft replies, in 2005 as team leader of the Voice Communications Team at MUAC. assuming the clearance was intended In 2010 he moved to the project management unit where he became for him. The pilot of the first A/C may responsible for leading the NVCS project, the joint DSNA-MUAC not react since both the ATCO and the EUROCONTROL procurement initiative. pilot of the second (replying) A/C are under the assumption that they were communicating to the correct party. Neither of them is correct however. Alternately, both aircraft pilots reply simultaneously and the incorrect reply is masked on the frequency and not noticed by the Controller. The situa- tion initially passes unnoticed, still of- ten results in a single or even a double conflict (the instruction is followed by the not intended aircraft and not fol- lowed by the intended one). In a num- ber of cases a second conflict kicks in as the second A/C is following an unin- tended trajectory.

Another case, irrespective of similar callsigns, is a mental confusion by the ATCO of the aircraft addressed. The ATCO looks at an aircraft, gives instruc- tions to it and manipulates the flight data of it seeing its callsign but always considering it as another one. It may seem like an impossible scenario since all information is correctly displayed; still it happens. Moreover it is one of the most dangerous ones as the read-

32 Presentation on CWP:

All possible RDF indications: overview of the possibilities we plan to foresee in the HMI

back is correct from the correctly ad- dressed aircraft but not the from the intended surveillance target the ATCO was focusing his attention at.

As demonstrated, a major drawback of ATC communications is the fact that voice communications are still the ATCO’s primary tool for providing clearance instructions. Whereas the ra- dar screen displays a very accurate air traffic picture, the ATCO has absolutely no visual feedback with respect to the originator of a pilot-to-ATCO voice call.

Single RDF: The normal indication= a white circle of about 5NM radius centred around the most probable location of the origin of the radio call

44

HindSight 21 Summer 2015 33 FROM THE BRIEFING ROOM

See who is talking! (cont'd)

Last RDF call up: Our new VCS has a function ‘say again’, which replays the last A/C transmission. We will re-indicate the location of origin of the call as well, marked in a different colour.

We all know the drawbacks of air-ground should also integrate the new informa- communications, but is there any reliable solution on tion. Here after are some screen shots the horizon, apart from telling the Controllers to be to demonstrate how the concept of more careful when they speak and listen? RDF would appear in the “real world”. We often tend to think that if you do One way to increase the awareness of Direction Finders is nearly as old as ra- something it is for a single reason, that the ATCO in the area of voice communi- dio itself: radio beam tracking devices there are single causes explaining the cations, and hence to prevent conflicting have been available on the market for events and actions. This way of think- situations rather than to resolve them, is many years. ing can be also sometimes deduced to provide the ATCO with fast, clear and from conversations and discussions accurate information on the area where Nevertheless, only few implementa- about investments in ATM system. We a radio call has been initiated from. In tions are known in which the informa- either invest in system functionality to other words – to help the controller to tion of multiple individual radio direc- improve efficiency and reduce flight see who is talking and to increase the tion finders is combined to provide a delays or in safety nets and safety- reliability of the detection by combining continuous flow of triangulated posi- supporting features. But sometimes we audio and visual perception information tions. can “hit” both objectives. Having RDF streams. functionality is one of these examples. MUAC launched a dedicated project to It clearly supports safety and it helps at ATC radio calls transport no other implement Radio Direction Finders of least one routine and frequent task of information than the RF carrier and the current generation, capable to pro- the Controller – to identify where the the 2 amplitude-modulated sidebands vide a fast and accurate calculated fix communication originates. Reducing containing the voice signals. As a result it of a transmitting aircraft and as such to the cognitive effort for this task and is impossible to extract any geographical deliver the operational benefits. decreasing the time required for sure information directly from the signal. This helps the controller to be more efficient information will therefore have to be MUAC has executed some tests with with all the other circumstances being produced in an indirect way. RDF devices installed on 2 sites and the same. this on limited as well as full capacity. One means to bring forward this in- Having a good system may be totally And, yes, I am talking to you Deci- formation consists of an array of Radio jeopardised by a dysfunctional HMI. sion Makers – help the Controller to Direction Finders (RDFs) working to- Ultimately, the already overloaded see who is talking. This is not a small gether. The technology behind Radio surveillance screen of the Controller talk.

34 Multiple RDF calculated positions: We noted the RDFs have a very short detection time and can easily differentiate between (pseudo-)simultaneous transmissions. One exception are calls entirely masked by a stronger signal. Still, since we will deploy ~6 RDFs, we expect each of the simultaneous calls will be perceived as the strongest one on at least one RDF. We will find out how to optimize this after initial deployment.

Off screen call: small arrow indication there was a detection but it is outside the visible area.

HindSight 21 Summer 2015 35 FROM THE BRIEFING ROOM Workload: getting it to work by Yoram Obbens and Rob Bezemer

On 16 March 2015, a system for predict- This is a significant step in modelling ing controller workload was introduced and predicting of controller workload for Amsterdam ACC operations. Now, for Amsterdam ACC operations. It is part ACC supervisors have the ability to use of a larger project that started within workload data to: Luchtverkeersleiding Nederland (LVNL) almost a decade ago. n manage ACC operations; n make decisions on sector How did LVNL develop a prediction mod- configurations; el and implement it on a daily operation- n consider staffing options; al basis? What is the impact on opera- n intervene timely to prevent tional safety and performance? And for controller overload; what other purposes is this model used? n consider traffic regulations Let us share our experience.

36 Workload: the model could add value as a sup- from past to present port tool for ACC supervisors and FMP controllers. Benefits identified include: Until 2005 LVNL relied mostly on the judgement of controllers to assess n Sector management: managing the impact on controller workload of sectors, their configurations and major airspace changes and projects. staffing. With workload information Understanding of this impact is impor- readily available, situational aware- tant for assessing the effect on sector ness of ACC supervisors is improved. capacities and assuring safe opera- This information can further assist tions with adequate performance for decision making regarding sector the airlines. Although the use of ex- staffing, the opening of additional pert judgement can be very valuable, sectors or ad-hoc coordination of it is subjective and can be inconsistent. unexpected overload with adjacent Subsequently, the need has arisen to centres. The result? Improved safety assess effects on controller workload for ACC operations. for major airspace changes using a quantitative method. n Flow management: managing traffic flows within sectors by regu- Strategic use first lating traffic. Again, with workload The development of a Workload Mod- information readily available, FMP el (WLM) for Amsterdam ACC opera- controllers can make more accurate tions began in 2006 as a research proj- decisions on regulating traffic. The ect. In the early years, the model was result? Achieving more efficient op- developed and validated with opera- erations with less delay. tional data – various data sources were used for this purpose. Results showed In 2014, efforts were made to develop that WLM performed better when pre- the model as an operational system, dicting executive controller workload developing standard procedures and compared to other traffic count met- training personnel and WLM for Am- rics like sector entries or occupancy. sterdam ACC was commissioned on March 16 2015. 44 Based on these results, WLM develop- ment accelerated in 2008 and 2009 and was used in major strategic air- space projects, for example the AM- Yoram Obbens RUFRA project. Since then WLM has has been a senior performance also been used in numerous airspace analyst for the Dutch ANSP LVNL changes to assess the effects of tem- since 2005. He holds a Master’s porary changes or special events like degree in aerospace engineering the 2012 London Olympic Games and from the Technical University of the 2014 Nuclear Security Summit in Delft and has been involved in the development of LVNL’s workload the Netherlands. model from the beginning. WLM for operations Traditionally, supervisors and FMP controllers use traffic counts to predict Rob Bezemer controller workload. However, during is a supervisor and executive WLM development, the opportunity controller at the LVNL Amsterdam for operational use of the model was Area Control Centre. He has over identified. To determine the useful- 25 years of operational experience ness of WLM in daily ACC operations, a and has been involved in the separate project began in 2012. From develop-ment of LVNL’s workload non-operational trials conducted in model from the beginning. that same year, it was concluded that

HindSight 21 Summer 2015 37 FROM THE BRIEFING ROOM

Workload: getting it to work (cont'd)

The principles of WLM For each specific route or traffic flow The level of intensity of traffic interac- it is established how demanding tions and routine tasks is established A fully detailed description of LVNL’s these routine tasks are. Routes with by using weighted scores. These scores workload model would be too com- no specific procedures are less de- are fed into the WLM algorithm for cal- prehensive for this article so here are manding whereas routes that require culating workload. A five-point scale is the key principles of WLM: specific controller action to ensure used ranging from zero (lowest weight) adherence to procedures, are consid- to four (maximum weight). Scores are 1. ATS route structure ered more complex. In addition, for determined by operational expertise. The ATS network and its relevant traf- each specific route and for each pair Guidelines describe the scoring criteria fic flows within a specific ACC sector is of routes, the intensity of the interac- and provide examples to ensure consis- one of the fundamentals of the WLM. tions is established by considering: tency. An extract from these guidelines Also, sector boundaries, available air- is shown below as an example. space and specific characteristics (e.g. n the airspace available for sector balconies and delegated areas) manoeuvring; 3. Time Blocks are incorporated. This means that n the geometry of routes and Traditionally, sector capacities are de- for each ACC sector, a list of relevant crossing points; fined as the maximum allowable num- routes or traffic flows is defined. Traf- n the time available for conflict ber of flights passing through a sector fic entering the sector is then allocated resolution. per hour. However, workload is not ex- appropriately. perienced per hour by controllers. Peri- For example, the interaction of traffic ods of high workload tend to occur in 2. Controller workload breakdown on two widely-spaced parallel routes much smaller time frames. As a compro- The workload of a controller is the is considered to be minimal and the mise between the two, 20 minute-time result of: potential for conflict is low. On the blocks are used in WLM. This means that n routine actions (e.g. standard other hand, two traffic flows that the model takes into account all traffic handovers, check-ins or standard have to merge at a certain defined that enters each sector during a period issued clearances), and point means increased interaction, of 20 minutes. Each flight within this pe- n actions required to manage given that the traffic is moving in the riod is allocated to one of the predefined potential conflicts (detection same direction and has similar flight routes and the expected controller and resolution). For WLM these profiles. workload for the period is then calculat- potential conflicts are called traffic ed using the traffic distributed on routes interactions. and the previously-discussed weighted scores. The result is an overall figure for the expected controller workload.

38 Traffic interaction Route limitations within a route (minimum score)

0 (minimum score) n No significant lateral, vertical or time limitations

1 n Lateral limitation along the route;

n Vertical limitation along route (temporary);

n Ample time (flight distance) along a route to adhere to procedures and to manage conflicts. Analysing changes: 2 n Lateral limitations along a part of the route; AMRUFRA n Vertical limitations along route The AMRUFRA project implemented (available flight levels limited, <9); in 2009 provides a good illustration n Available time sufficient (flight distance) of the use of WLM in assessing the along a route to adhere to procedures and changes which will result from strate- to manage conflicts. gic airspace projects.

3 n Lateral limitations along one side (distance < 10NM); The most important changes in the AMRUFRA project (the parties involved n Vertical limitations along route being AM=Amsterdam, RU=Ruhr, (available flight levels limited, <6); FRA=Frankfurt) from the point of view n Available time limited (flight distance) of Amsterdam ACC were: along a route to adhere to procedures and to manage conflicts. n the expansion of ACC Sector 2 4 (maximum score) n Lateral limitations on both sides of route; (southern boundary displacement with military TMA-D); n Vertical limitations along route n the introduction of a new out- (available flight levels very limited, <3); bound route via waypoints LUNIX- n Available time very limited (flight distance) NAPRO-AMOSU to the (U) Z738 along a route to adhere to procedures and airway. to manage conflicts. The implications for controller work- load and sector capacity were ana- 4. Workload threshold lysed using WLM. Versions of the Defining a threshold for maximum to aircraft and workload measure- planned changes were input to the controller workload is essential for ments with Instantaneous Self-Assess- model – new routes were added, ex- obvious reasons. During the develop- ment (ISA) scores were used for this isting routes were re-evaluated, old ment of WLM, it was calibrated to es- purpose. The result was the determi- routes were deleted and all weighted tablish threshold values for acceptable nation of an universal WLM threshold scores for routine tasks and traffic workload. R/T calls, instructions issued value for all sectors. interaction were assessed. The next 44

HindSight 21 Summer 2015 39 FROM THE BRIEFING ROOM

Workload: getting it to work (cont'd)

step was to benchmark the workload System Overview results of the finalised new sector de- sign with the old sector design as a The WLM platform gives users reference. The early divergence of Am- different views of the expected sterdam departure routes and the in- controller workload and provides crease in available airspace decreased insight into traffic characteristics. the traffic interaction. Analysis showed It calculates and displays expect- that controller workload for handling ed controller workload based on Amsterdam departures and en-route traffic information from Network traffic to EDDL/EDDK would decrease Management by using flight plan significantly. Based on these results it data available via ETFMS. was decided to increase the capacity of ACC sector 2: the declared capacity The platform interface provides of movements per hour for weekdays the following information: was increased from 36 to 38. n The expected workload for all Daily operations using WLM elementary sectors and com- As noted earlier, WLM is now being binations of Amsterdam ACC is used to actively assist ACC supervi- shown clearly on the workload sors and FMP controllers in making dashboard. Supervisors can daily operational decisions. Centrally- manage the activation of sec- placed at the ACC supervisor´s work- tors in WLM and are alerted as ing position, the WLM display provides soon as the calculated control- relevant and timely access to control- ler workload exceeds a pre-de- ler workload information. termined threshold.

40 sectors which normally takes place between 10 and 60 min- utes in advance. When managing sectors, the ACC supervisors first consider WLM information and they then combine this with oth- er relevant information to make their decisions on sector opening schemes, staffing or coordination with adjacent centres in specific conditions.

The next step for operational use of WLM will be the introduction of capacity management which is scheduled for the second half of 2015. During this stage of imple- mentation, FMP controllers will use WLM information for regulat- ing traffic. With the availability of this information, it is expected that less traffic regulation will be necessary and that regulation will be more precise. This should lead to less delays and increased net- work performance. n A specific sector can be selected the workload view or traffic view, the The future looks good and viewed in the workload view. corresponding flights are shown Plans for future development of This screen shows the projected with detailed flight information and WLM at Amsterdam ACC includes workload for each 20 minute pe- the individual contribution to the enhanced features for detailed riod. Colour indicators are used overall calculated controller work- analysis, the development and to represent the main traffic flows load. incorporation into WLM of Short within Amsterdam ACC. Antici- Term ATF Measures (or STAM) pated controller workload can be One small step for WLM… and the integration of the WLM- viewed up to 20 hours in advance, To familiarise operational users of system with other operational although the projection up to 4 WLM with the system and its use in systems so as to enable data- hours ahead is more practical and their decision-making, a gradual in- exchange (e.g. provision of WLM accurate. troduction into daily operations was information at controller working considered most appropriate. positions). n Traffic counts for a sector can be viewed in the traffic view. This As a first step, WLM information is Alongside this, the development screen shows the number of flights being used for sector management of a workload model for Schiphol entering the selected sector every at Amsterdam ACC. With this infor- Approach and Ground Control has 20 minutes. mation, ACC supervisors have a bet- begun. Only the future will tell if a ter overview of expected controller WLM will be useful for all Schiphol n Detailed flight information can be workload. This provides them with operations, but based on Amster- shown in the flightlist. When select- key information for their decision- dam ACC experience alone, the ing a specific 20-minute period in making on how to manage the ACC prospects appear good!

HindSight 21 Summer 2015 41 FROM THE BRIEFING ROOM Faster is not always better by Katarzyna Żmudzińska

It was a cold Sunday morning and, unusually for As the story told by a Boeing 737 pi- lot indicates, TCAS RAs (Resolution the route, we had only 26 passengers. We took off Advisories) can be generated due to on schedule and were quite surprised when the high vertical rates before an aircraft departures controllers cleared us direct to XXXX reaches its cleared level, against an- other aircraft at the adjacent level. [destination] and to FL230. Operationally, these RAs are unnec- The First Officer [pilot flying] observed that there were essary and cause additional work- not too many aircraft around as the frequency was load and paperwork for all involved. They can also introduce new risks as remarkably quiet. When we were passing through pilots do not always correctly follow FL215 we got a TA and noticed a target on the TCAS their RAs. Monitoring data indicates that approximately 40% of all RAs are traffic display, above us, moving from left to right. generated due high vertical rates, re- The FO started to reduce the vertical rate which at gardless of TCAS version fitted on the this point was 5300 [ft/min]. At the same time, the aircraft. In line with ICAO recommen- dation some airlines published their controller reminded us that our cleared level is 230. own Standard Operating Procedures While I was in the process of responding to her, (SOP) to prevent these types of RAs. In I heard a TCAS RA command to “Level off”. The FO this article we examine their effective- ness through simulations. Following disconnected the autopilot and performed a smooth these recommendations would help level off at FL225. Suddenly, we got very busy: the FO not only to prevent unwanted RAs but also to prevent the associated increase flying the aircraft and me looking outside to see the of the workload. That being said, these intruder, talking to ATC and monitoring FO’s actions. recommendations also involve addi- We never saw the other aircraft above due to haze. We tional workload. told the controller we had an RA and would be filing a company report. She said she has to do the same…

[A story from a Boeing B737 Captain]

Katarzyna Żmudzińska is a graduate of the Poznan University of Technology. In 2014 she was a trainee at EUROCONTROL’s Air Traffic Services Unit, working mainly on ACAS issues. She is a glider and light aeroplane pilot.

42 Unnecessary RAs due to high vertical rates before level-off The performance of modern aircraft allows pilots to climb and descend with high vertical rates. While this can provide operational benefits (i.e. fuel or time savings), it can become problematic when aircraft continue to climb/descend with a high vertical rate close to their cleared level. TCAS will issue an RA when it calculates a risk of collision based on the closing speed and vertical rates. A high verti- cal rate before level-off may cause the TCAS logic to predict a conflict with another aircraft even when appropri- Once an RA has been issued it must ing aircraft and only to the aircraft ate ATC instructions are being cor- be followed without delay and it takes in level flight if a response to the ini- rectly followed by each crew. This is precedence over any ATC instructions. tial RA is not satisfactory. However, in because TCAS does not know aircraft Any deviation from the intended flight cases of very high rates or when both intentions – autopilot or flight man- path, resulting from the RA, causes aircraft are climbing and descending, agement system inputs are not taken additional workload to all involved RAs will be issued to both aircraft. The into account because TCAS must re- and can be disruptive to ATC traffic precise sequence of RAs may be differ- main an independent safety net. If, flow and planning and in congested ent if one of the aircraft is not TCAS- simultaneously, another aircraft is ap- airspace there is a risk for follow up equipped. proaching an adjacent level, the com- conflicts. Moreover, several cases have bined vertical rates make RAs are even been observed where pilots did not In order to reduce more likely. correctly follow their RAs and instead the number of RAs ICAO Annex 6: increase their vertical rate following an caused by high Max. 1500 ft/min. in the last “Adjust vertical speed, adjust” RA. vertical rates be- 1000 ft (when the pilot is fore level-off, ICAO aware of another aircraft at When a TCAS-equipped aircraft is ap- recommends un- or approaching an adjacent proaching its cleared level with a high der certain condi- altitude or flight level). vertical rate, TCAS will generate tions a reduction an RA advising the reduction of of vertical rate Major European airline SOP: vertical rate (e.g. “Adjust verti- while approaching Always max. 1000 ft/min. cal speed, adjust” or “Level the cleared level. in the last 1000 ft. off, level off” RA, depending A major European on the TCAS software ver- airline has introduced a Standard Op- sion). It might even change erational Procedure (SOP) requiring the vertical direction (i.e. “Climb” their crews to approach the cleared when descending or “Descend” when level with a specified maximum verti- climbing). If both aircraft are TCAS- cal rate in all cases (see the adjacent equipped and one aircraft is climbing text box for details). The workload or descending while the other one is implications of the two approaches in level flight, an RA will typically be are different: the ICAO recommenda- issued first to the climbing/descend- tion requires routine monitoring for 44

HindSight 21 Summer 2015 43 FROM THE BRIEFING ROOM

Faster is not always better (cont'd)

potential conflicts and occasional ver- To determine their effectiveness, these tical rate reduction whilst the airline scenarios were compared to a baseline SOP only requires routine vertical rate scenario where the aircraft only reduc- reduction. This airline experienced a es its vertical rate in order to level-off reduction of nuisance level-off RAs by 1000 ft below the other aircraft. a factor of 10 (the effectiveness of the ICAO recommendation is unknown). If no vertical rate reductions are ap- Additionally, some States have intro- plied at all (i.e. the aircraft starts re- duced specific vertical rate reduction ducing its vertical rate only in order requirements or recommendations to level off), it is likely that an RA will applicable in their airspace. “While be triggered, especially at the higher these provisions prescribe the vertical levels, with relatively low vertical rate. speed during the last 1000 ft before In each scenario one aircraft was al- The maximum vertical rates (ft/min) the level off, the vertical speed of the ways in level flight, while the other was at which no RA will occur for different aircraft may dictate that these reduc- climbing towards it, either head-on or load factors are shown in Table 1 be- tions start to take place earlier.” In this on a crossing track. These scenarios as- low. For example, an aircraft climbing article, for simplicity, only the ICAO sumed a projected track with no hori- at 1,800 ft/min will not generate an recommendation and the above men- zontal or vertical miss-distance at the RA if it just reduces its rate for level-off tioned airline SOP are examined. Closest Point of Approach2, i.e. a col- (e.g. ignores the ICAO recommenda- lision; however, the climbing aircraft tion), with deceleration of 0.20 g in Effectiveness of vertical would start to reduce its vertical rate the altitude band between FL200 and rate reduction if correctly to achieve the required vertical rate FL420. 2000 ft before the other, to level off, applied subsequently, 1000 ft below. The verti- The number of possible conflict geom- cal rate in the last 1000 ft before level etries is infinite; therefore it is impos- off will be either 1500 (ICAO recom- sible to examine the effectiveness of mendation) or 1000 ft/min (major Eu- these recommendations in all cases. ropean airline SOP) and, subsequently, Therefore, a small number of encoun- the climbing aircraft will level-off 1000 ters were created to test simplified ft below the aircraft in level flight. The level-off geometries in computer- vertical rate reduction deceleration based simulations. These scenarios was set to varying values from 0.1 assumed perfect surveillance and vir- g to 0.3 g (in 0.05 g increments). tually the same speed for both aircraft in all cases. Heading, as well as altitude of either aircraft were not subject to normal variations (due to wind etc.). Analyses were conducted at various altitude bands, based on TCAS sensi- tivity levels1, varying the initial vertical rate of the climbing aircraft.

1 - The TCAS sensitivity level is a function of the altitude and defines the level of protection. The warning time is greater at higher altitude. 2 - The Closest Point of Approach is the instant at which the slant range between own TCAS II equipped aircraft and the intruder is at a minimum.

44 Table 1: RA triggering thresholds if no vertical rate reductions are applied (TCAP) functionality which has been introduced by Airbus to prevent the Altitude band 0.10 g 0.15 g 0.20 g 0.25 g 0.3 g generation of RAs in 1000-foot level- FL200 – FL420 2,000 1,850 1,800 1,850 1,750 off geometries (see Hindsight 12). The FL100 – FL200 2,550 2,300 2,200 2,150 2,100 functionality uses a new altitude cap- ture law for flight guidance comput- FL50 – FL100 3,000 2,800 2,700 2,600 ers, which decreases the aircraft’s ver- 2350 ft AGL – FL50 4,050 3,700 3,500 tical rate towards the selected altitude, 1000 ft – 2350 ft AGL 6,250 once a TA has been generated and the auto-pilot and/or flight director are engaged, and when another aircraft is However, if the ICAO recommendation TCAP known to be in the vicinity. or airline SOP is applied, unwanted RAs in level-off geometries will be pre- Aircraft manufacturers recognise that Summary vented with much higher vertical rates unwanted RAs are an operational until 2000 ft below the other aircraft. problem and try to supplement pro- TCAS II will generate RAs in 1000-ft lev- These maximum vertical rates (ft/min) cedures with technology which would el-off encounters if aircraft approach at which no RA will occur are shown prevent unwanted RAs. An example their cleared levels with high vertical respectively in Tables 2 and 3 below. of a technological solution to the rates as autopilot inputs or pilot in- For example, an aircraft climbing at problem is the TCAS Alert Prevention tentions are not known to TCAS. RAs 3,900 ft/min will not generate an RA if it just reduces its rate for level-off in line with the ICAO recommendation (Table 2), with deceleration of 0.20 g in the altitude band between FL200 and FL420.

Not surprisingly, more aggressive ver- tical rates deceleration (higher g-load) will make the ICAO recommendation and airline SOP less effective. Howev- er, higher decelerations are less likely to be used in normal operations due to passenger comfort.

Table 2: RA triggering thresholds when ICAO-recommended vertical rate caused by high vertical rates result in reductions are applied unnecessary workload to flight crews and can be disruptive for ATC. Any Altitude band 0.10 g 0.15 g 0.20 g 0.25 g 0.3 g unexpected departure from ATC clear- FL200 – FL420 5,500 4,150 3,900 3,750 3,700 ance carries a risk of a follow up con- flict. Monitoring data indicates that FL100 – FL200 5,800 4,950 4,650 4,500 as much as 40% RAs are generated FL50 – FL100 8,000 6,450 5,950 due high vertical rates and 75% of the 2350 ft AGL – FL50 aircraft getting an RA in the level-off 1000 ft – 2350 ft AGL geometry approach their cleared level with a rate above 1500 ft/min. These Table 3: RA triggering thresholds when airline SOP-recommended vertical RAs are not operationally needed and rate reductions are applied can be avoided in many cases if verti- cal rate reductions are applied. Altitude band 0.10 g 0.15 g 0.20 g 0.25 g 0.3 g FL200 – FL420 6,200 4,250 3,950 3,800 3,750 Although the simulations conducted FL100 – FL200 6,050 5,050 4,700 4,550 assume a perfect environment, they indicate that reductions in vertical FL50 – FL100 8,450 6,500 6,000 rates in the last 1000 feet before level- 2350 ft AGL – FL50 off are effective in preventing RAs due 1000 ft – 2350 ft AGL to high vertical rates before level off.

HindSight 21 Summer 2015 45 FROM THE BRIEFING ROOM Know your limits

by Maciej Szczukowski Air traffic controllers' work is surrounded by definitions, theories and values. Safety, efficiency, delay, capacity, workload – these are every day notions in ATC.

Maciej Szczukowski has been an Air Traffic Controller for almost 15 years at Warsaw Okecie Airport, Warsaw, Poland. He has also been an aviation consultant and ground school instructor, working with pilots and cabin crew. He has experience as a private pilot.

Some of them may be calculated and are ideally kept constant while others are variable and change throughout a shift. Most of the figures are a function of others and it is therefore more important to establish their limits rather than keep them at any particular level. Workload is one of them.

46 For decades specialists have tried to controllers occurred in Barcelona in De- according to which, instead of regulat- find a formula to measure workload. cember 2012. With low visibility proce- ing large volumes of traffic, the entry of Mathematical equations, quantitative dures in force because of thick fog, only complex, but local, airspace by too many and qualitative research or experiments one runway was available for approach- aircraft in short periods of time should as sophisticated as utilising functional es. This led to a mean delay of around 40 be prevented. The obvious problem, as spectroscopy to monitor the concentra- minutes and approach control frequen- in any approach, is that the prediction tion of hemoglobin at the cortex1 have cy was overburdened. “Break, break” was has to be made well in advance5. been used. The most general formula sci- the most often-heard phraseology and ence has come up with is “task” x “time” very soon the approach controller was x “frequency”. However, this ignores the not able to coordinate relay the effects of The expression ‘excessive complexity of ATC and workload remains delays or estimates. He was soon faced workload’ suggests that the a subjective concept, shifting among or with many increasingly urgent crews’ trying to fit the statistics of task demands requests for approach clearances. Be- acceptable upper limit of and the assumptions2 about available cause aircraft were continuously being technology. Consequently the most pre- handed off from surrounding ACC sec- demand has been exceeded. cise definition of ATCO workload we get tors and supervisors did not support the today is the capacity of team’s mind and controller in any way, the situation soon However, a low workload level body. became even more urgent with crews beginning to report "fuel emergencies". has its own problems. It is obvious that from a controller’s point This 'pushing tin' eventually reached its of view, each aircraft operation does not limit when the airport stated that there In 1999, Heil presented an inductive require the same amount of work. The were no more parking spaces available. model of enquiry based on knowledge concept of complexity is introduced to That is when one of the pilots was sup- of the relationship between air traffic assess the level of difficulty perceived posed to have said “let the aircraft land controllers’ ages and their performance. by controllers during traffic handling – and put them on taxiway, car park, roof By referring to previous research6 and by based on the volume and nature of the ... but on the ground!” 3. creating a series of tests for over 800 ac- required controller interventions. In par- tive controllers, he was able to confirm allel, ATC mental complexity describes To find the dynamic capacity of a sector, the theory that ATCO performance only the level of required mental response allowing to equate its effectiveness with increases until the mid 40s. The hypoth- as determined by a controller’s ability, actual demands and preferably to mi- esis was advanced that the relationship knowledge and experience. It “reflects nimise the odds of a situation similar the between age and performance is not the relationship between the demands one mentioned above, workload simula- necessarily linear and that although of a specific environment on the opera- tions are usually used. They calculate the there is a negative correlation between tor and the capability of the operator to sum of tasks required in different circum- age and performance on tasks requiring meet those demands”. The most well- stances, although the relative simplicity cognitive abilities, it is not so in case of known measure here is the “declared of such calculations limits their versatil- tasks requiring experience and knowl- capacity”. However, its limitation is that ity. One response to this is the idea of a edge. Unfortunately the quantitative such a “declaration” is based only on ide- peak traffic count based on practical ex- approach to the research missed par- al conditions and does not include any perience. Such a threshold can be help- ticipants’ subjective feelings about their of the unpredictability which character- ful in decision-making processes4. An- qualifications, environment and the in- ises most ATC environments. Adverse other idea has been proposed by SESAR fluence of these on their ability to main- 44 weather conditions which alter the traf- fic flow and restrict available airspace, equipment or communication problems 1 - Ayaz, H., Willems, B., Bunce, S., Shewokis, P. A., Izzetoglu, K., Hah, S., Deshmukh, A., Onaral, B. (2010). and sudden and unplanned closures of Cognitive Workload Assessment of Air Traffic Controllers Using Optical Brain Imaging Sensors. Advances in taxiways or runways can both decrease Understanding Human Performance: Neuroergonomics, Human Factors Design, and Special Populations, pp.21-32. capacity and significantly increase work- 2 - Lee, P.U., Prevot T. (nd.) Prediction of Traffic Complexity and Controller Workload in Mixed Equipage NextGen Environments. Retrieved from: http://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/20120016433.pdf load. 3 - http://avherald.com/h?article=45b4bc8c&opt=0 4 - Welch J.D., Andrews J.W., Martin B.D. (n.d.) Macroscopic Workload Model For Estimating En Route Sector Capacity.Retrieved from These are the times when managers and https://www.ll.mit.edu/mission/aviation/publications/publication-files/ms-papers/Welch_2007_ATM_MS-28122_WW-18698.pdf supervisors have to respond by reducing 5 - Suárez N., López P., Puntero E., Rodriguez S. Quantifying Air Traffic Controller Mental Workload. Fourth SESAR Innovation Days, 25th–27th November 2014. Retrieved from the demand. An example where the lack http://www.sesarinnovationdays.eu/sites/default/files/media/SIDs/SID%202014-03.pdf of such a reaction led to an overload for 6 - Salthouse (1991), Hardy & Parasuraman (1997), Tsang & Shaner (1998).

HindSight 21 Summer 2015 47 FROM THE BRIEFING ROOM

Know your limits (cont'd) WORKLOAD tain adequate competence with increasing age. And the researchers did not take into account the level of fatigue of controllers taking part either7. The reasonable con- clusion from such work is that workload is actually not a function of the number of tasks but rather a consequence of the division of duties. Another challenge for senior controllers and supervisors in effec- tive task allocations hence, for example, correct sector configuration8.

The expression ‘excessive workload’ sug- gests that the acceptable upper limit of demand has been exceeded. However, a low workload level has its own problems. and reaction time. Research conducted values from simulated control posi- In July 2010, a Boeing 737 was cleared to by Repetti showed that there is a rela- tions into qualitative categories of traf- cross a runway on which another aircraft tionship between daily workload (traf- fic load13. We now need to focus more had already been cleared for takeoff, fic volume and visibility at the airport) on mental workload models rather than though it was still taxiing to the depar- and a controller’s behaviour after work dispassionate mathematical formulae. ture runway. The safety net for the 737 (the degree of social withdrawal and Creating dynamic thresholds, based crew – asking about a stop bar still turned the extent of expression of anger)10. On on situational awareness, decision- on – did not work (the trainee controller days of high workload and distressing making processes, matched with local switched it off). The investigation con- interactions with co-workers or supervi- procedures and demands but taking cluded that there had been ATCO over- sors, ATCOs reported more health com- into account the psychological factors confidence and inattention because of plaints and more negative moods11. It inherent in ATC profession, is the way to the “undemanding environment as seen seems however that although social go. Otherwise, everything we will gain by the workload at the time”. In this case, withdrawal „may help an aroused indi- from controller effectiveness in a high division of duties as mentioned above vidual to return to a baseline emotional demand environment, will be lost later was involved – On-the-Job Training was in and physiological state”, supportive due to the negative effects of overwork. progress during the occurrence9. spouses are also able to diminish the ef- fects of workload related stressors. I believe that it is an obligation of each But workload is not only about tasks controller to establish their own work- and duties. It is also affected by personal There is no single standard which can load limits, keep to such limits and com- variables like skills and experience in an anticipate all elements increasing work- municate them to their team. It is essen- encountered type and structure of traf- load12. New models are being created, tial to be open to changing them and fic or one’s proneness to apprehension. including the EUROCONTROL Capac- to remain open for discussion about It expresses itself in ATCO behaviour ity Analyser tool (CAPAN), which uses them throughout one’s career. And af- and fatigue. The latter in turn includes RAMS (Reorganised ATC Mathematical ter changes in equipment, procedures, drowsiness, decreased concentration Simulator) to "translate" quantitative airspace or airport structure, it is im- portant to tell those who are respon- sible about any significant effects of 7 - Heil, M.C. (1999). Air Traffic Control Specialist Age and Cognitive Test Performance. Retrieved from changes, including how their decisions http://www.faa.gov/data_research/research/med_humanfacs/oamtechreports/1990s/media/am99-23.pdf affect controller workload. If controllers’ 8 - http://www.skybrary.aero/index.php/Sectorisation views are not heard, any feeling that 9 - http://www.skybrary.aero/bookshelf/books/1971.pdf 10 - Repetti R.L. (1989). Effects of daily workload on subsequent behavior during marital interaction: one’s own workload limit is approach- The roles of social withdrawal and spouse support. Journal of Personality and Social Psychology, ing is actually the last moment to stop, Vol 57(4), pp.651-659. let something go or accept the delay. 11 - Repetti, R.L. (1993). Short-term effects of occupational stressors on daily mood and health complaints. Health Psychology, Vol 12(2), pp.125-131. There is only one little step between 12 - Welch J.D., et al., op. cit. such a limit and no safety at all. Don’t 13 - http://www.eurocontrol.int/sites/default/files/library/026_Pessimistic_Sector_Capacity.pdf take that step.

48 WORKLOADWORKLOAD WORKLOADWORKLOAD WORKLOAD WORKLOAD WORKLOAD WORKLOAD WORKLOAD WORKLOAD WORKLOAD How much WORKLOAD WORKLOAD workload WORKLOAD WORKLOAD WORKLOAD is workload? WORKLOAD by Michaela Schwarz and Fuat Rusitovic WORKLOAD 44 WORKLOAD The Human The Human WORKLOAD Factors Factors Perspective Perspective WORKLOADWORKLOAD WORKLOAD WORKLOAD The ATCO The ATCO Perspective Perspective WORKLOAD WORKLOAD WORKLOAD

HindSight 21 Summer 2015 49 FROM THE BRIEFING ROOM

The Human How much workload is workload? (cont'd) Factors Perspective

Being an ATCO, workload is ed soon. There’s almost nothing for me or even more potentially dangerous an omnipresent factor in my to do and after about 20 minutes, the situations than overload? daily business. Questions challenge is to stay focused and alert. A like; ‘What is an optimal short chat now and then with my sec- There are plenty of factors that contrib- workload for an ATCO?’ tor partner helps, but I wonder for how ute to workload. But often only one is The ATCO ‘Can we define thresholds?’ long. I ask myself “is there something measured and taken into account by Perspective ‘How can we measure work- I can do?”, “have I missed something?” flow management and/or operational load?’ are with me every day. over and over again. Fortunately, an management. This factor is related to Before I continue, I want to give anticipated increase in traffic begins occupancy counts (the number of air- you some examples of how I personally but I get released from position before craft within a certain sector per min- perceive workload during parts of a typi- it gets really busy. Break. ute) or sector capacity (the number cal shift. of aircraft there are in a certain sector Let’s jump to the last run of the day. per hour). Both factors are based on a 10:00 UTC. I start my first run in position 17:00 UTC: It’s in the same position as generic definition of sector complex- as executive controller on a sector which my first run. I take over during a busy ity, number of vertical movements and is known for having a high volume of period. There are no ongoing conflicts, traffic flow, but do not consider overall vertical movements. The traffic load is but still plenty to do and I feel fine. Traf- traffic complexity. pretty low, only a couple of aircraft on fic load is high but absolutely do-able. the frequency and with a not very com- My planner is busy too and time flies. But, what about other factors like: plex traffic distribution. After about 15 After about 40 minutes traffic reduces, minutes, traffic increases and reaches but it's only a brief respite and traf- n How many hours have I already its peak after another 20 minutes. 90% fic increases again until we are at the been on duty? of the flights have to perform vertical same peak as earlier. It gets really busy n How many shifts did I work in a row movements as they are inbound and but we are doing fine. A lot of vertical without a day off? outbound from aerodromes in the area. movements, moderate traffic complex- n What time of day is it (circadian The frequency is very busy and there is ity but nothing special. I am feeling fine rhythm)? not much time between transmissions. but I catch myself missing initial aircraft n Who is my sector partner? (if we I am feeling good, very good. I am still calls from time to time. “Station calling, understand each other instinctive- ahead of the situation and everything is say again?” I am fine. Am I? Am I really? ly, it’s easier to handle more traffic) working out as planned. After this peak, There is nothing different than on my n What is the complexity of individu- the traffic level reduces to a moderate first run but my situational awareness al traffic situations? level for the rest of my run. Break. is not quite as good as it was. Then, my shift is over and I am released. For me, the last one is the most impor- 12:00 UTC: For the second run, I am work- tant one: traffic complexity. ing as a planning controller on a different Obviously the workload that was per- sector which is usually combined with fect for my first run wasn’t so perfect But how can we measure that? It’s easy another sector most of the day as there for my last run, although according to calculate frequency occupancy val- is not a lot of traffic in it. However, this flow management measures it should ues and to create figures about how time the sector is not combined because have been the same. And what about many aircraft a sector is able to deal there is a rush of inbounds to a major my second run? How do we define un- with. And with sectors that are not aerodrome and another wave is expect- der load? Couldn’t that lead to equally very complex, frequency occupation is the bottleneck. No doubt about it. With Controller Pilot Data Link Communica- tion (CPDLC) we have a technology Fuat Rusitovic which can expand that bottleneck to a works as an ATCO and on-job-training instructor at the ACC Vienna. certain degree but what about the re- He is involved in the planning and development of pre-on-job sultant complexity? How many vertical simulator training and the coordination of the Team Resource movements do I have to oversee? How Management program at Austro Control. many turns due to conflicting traffic do I have to give? Do we have a tool to measure that? I think we do.

50 The Human Factors Perspective

Workload for n Mean aircraft separation, sector tors include the ATCO being well Air Traffic area, mean airspeed, sector flow rested and fit for work, leading a Controllers is a coefficient (Arad, 1964) healthy lifestyle, taking regular re- well-known and n ATC position (oceanic versus ter- storative breaks and being aware of well-researched minal) (Wickens, Mavor & McGee, his own capabilities and limitations. concept. Human 1997)The ATCO Team factors include team qual- Factors experts gener- n ATCO interface (visual displays, ity and climate, adequate leadership ally refer to Hilburn & Jorna (2001) who data entryPerspective systems) (Jorna, 1991) and supervision, appropriate com- distinguish task load (i.e. the demand munication and assertiveness etc. imposed by the ATC task) from workload (i.e. the ATCO’s subjective experience of that demand). Hilburn & Jorna (2001) also provide an excellent summary on Michaela Schwarz research related to task load factors in- works as a Safety Management and Human Factors Expert at Austro cluding but not limited to: Control in Vienna. She is a registered Aviation Psychologist with more than ten years of practical experience in the aviation industry including n Traffic load / number-of-aircraft- assignments at EUROCONTROL and Qantas Airways. under-control (Hurst & Rose, 1978; Stein; 1985) n Number of traffic problems/ con- flicts (Kalsbeek, 1976) n Number of flight altitude transitions Workload for ATCOs can be assessed Finally organisational factors in- (Cardosi & Murphy, 1995) through subjective, behavioural and clude duty roster, break plans, sec- n Mean airspeed (Hurst & Rose, 1978) psycho-physiological measures (ad- tor opening/collapsing, flow control/ n Aircraft mix and variations in direc- opted from Hilburn & Jorna (2001). management and a pleasant work tions of flight (Wyndemere, 1996) See table. environment aiming for optimal task n Proximity of aircraft and potential and workload conditions. So know- conflicts to sector boundaries (Wyn- Whether or not and if so to what ex- ing all the task load and workload demere, 1996) tent a person can manage task load factors and how they can be man- n Weather (Scott, Dargue & Goka, depends on personal, team and or- aged, why are we restricting our- 1991; Mogford et al., 1994) ganisational factors. Personal fac- selves to occupancy counts? 44

Subjective Behavioural Psychophysiological

n NASA Task Load Index (TLX) n Communication n Heart Rate Measures (ECG) (Hart and Staveland, 1988), efficiency n Eye blink rates (EOG) n The Air Traffic Workload Input n Communication times, n Eye movements, pupil diameter, Technique (ATWIT) (Stein, 1985) message length, content fixations (Eyetracking) n Subjective Workload Asessment n Flight data management n Brain activity (EEG) Technique (SWAT) (Reid and n Inter-sector coordination Nygren, 1988) n Electrodermal activity (EDA) n Number of control actions n The Instantaneous Self-Assessment n Biochemical Activity of Workload (ISA) (Jordan & Summarised by (cortisol, adrenalin) Brennan, 1992) Hilburn & Jorna (2001) n Muscle activity (EMG) n Mobile ISA available at n Body temperature http://www.think.aero/isa/ n Respiration Summarised by Schandry (1998) 44

HindSight 21 Summer 2015 51 FROM THE BRIEFING ROOM

How much workload is workload? (cont'd) The Human Factors Perspective Monotony ‘is indicated by reduced physiological activation,

Modern air traffic manage- subjective sleepiness and ment (ATM) systems pro- vide pre-calculated con- behavioural impairments’ flict predictions up to 30 - Straussberger, 2006 The ATCO minutes before aircraft Perspective enter a sector based on their flight plans, actual radar-derived position, air- craft performance and local Air Traffic Services (ATS) procedures such as exit conditions. For ex- ample, in the case of an aircraft entering the sector at FL300 that has to exit the sector at FL220, such a system will pre- dict potential risks taking into account the best estimates of complete aircraft trajectories. Wouldn’t using such conflict predictions be more accurate as a means to measure workload than only referring to occupancy counts?

ANSPs and ATCOs would ben- efit from a tool that provides a complexity value for the ex- pected traffic in addition to oc- cupancy counts. The benefit for the ATCO would be the avoid- ance of potential overload situations attributable to traf- fic complexity. And the ANSP would profit from a more effi- cient use of human resources. So called ‘Dynamic Density and Complexity’ Models (Masalonis, Callaham & Wanke, 2003) already take various complexity metrics into account (e.g. sector aircraft count, sector volume, aircraft speeds and distribution of aircraft relative to sector structure). This could be a good start for developing a tool that considered actual traffic complexity and which could proactively increase safety performance.

52 The Human The HumanFactors FactorsPerspective Perspective

A tool to calculate actual traffic com- plexity should So what is the optimal also be able to take human capa- workload for an ATCO? bilities and perfor- The ATCO To be honest, we don’t know. We mance variability into account. ATCOs The ATCOPerspective doubt that it is possible to set a val- perceive workload differently depend- Perspective I agree. ue for optimal workload but we can ing on their individual condition, As well as de- get as close as possible to a value personal experience and workload fining a limit for for good workload. Putting occu- management strategies. Both over- the maximum safe pancy counts and traffic complex- load (excessive workload) and under traffic complexity there should be a ity together and calculating a num- load (monotony/bore- limit for the minimum as well. The ber which would keep an ATCO at a dom) should be part situation of an ATCO in under load is steady and fairly busy level would be of the assessment. hard to describe. It’s a feeling of un- a major step in the right direction. Monotony ‘is indicated certainty as to whether everything is Human Factors experts can help by reduced physiologi- OK, which is as bad as being in over- with measuring workload of ATCOs cal activation, subjective load. Additionally you have to cope during live operations in order to sleepiness and behavioural with staying focused and alert on evaluate such new tools and estab- impairments’ (Straussberger, the task when you have almost noth- lish the maximum and minimum de- 2006). Both traffic repetitive- ing to do. In these cases it would be sirable values on the new workload ness and dynamic traffic density good practice to ask the supervisor scale. have been found to contribute to collapse sectors to distribute the to monotony. Workload measures workload better. However, often this Until then we can only suggest that (subjective, behavioural and psy- is not possible because it may cre- you call for help if you need it, like chophysiological) can help to identi- ate an overload in another sector asking for another ATCO to super- fy optimum levels of task load to sup- so developing a tool that considers vise. Or ask the supervisor to open port ATCO performance and avoid traffic complexity in all sectors taken a new sector in case of overload or overload and monotony. together is important. collapse sectors if in underload.

References Jordan, C.S. & Brennan, S.D. (1992). An experimental report on rating scale descriptor sets for the instantaneous self-assessment (ISA) recorder. DRA Technical Memorandum (CAD5) 92011 and 92017, DRA Maritime Command and control Division, Portsmouth. Hart, S. G. & Staveland, L. E. (1988) Development of NASA-TLX (Task Load Index): Results of empirical and theoretical research. In P. A. Hancock and N. Meshkati (Eds.) Human Mental Workload. Amsterdam: North Holland Press. Hilburn & Jorna (2001). Workload in Air Traffic Control. In P.A. Hancock and P. Desmond (Eds.) Stress, Workload, and Fatigue: Theory, Research and Practice. Hillsdale, New Jersey, USA: Lawrence Erlbaum Associates, 384-394. Masalonis, A.J., Callaham, M.B. & Wanke, C.R. (2003). Dynamic Density and Complexity Metrics for realtime traffic flow management. 5th USA/Europe ATM Seminar, June 2003, Budapest, Hungary. Available from: https://www.mitre.org/sites/default/files/pdf/masalonis_tfm.pdf Reid, G.B. & Nygren, T.E. (1988). The subjective workload assessment technique: A scaling procedure for measuring mental workload. In P.A. Hancock and N. Meshkati (Eds.) Human mental workload. Amsterdam: North Holland. 185-218. Schandry, R. (1998). Textbook of Psychophysiology: Physical Indicators of Psychological Reactions. Weinheim: Beltz. Stein, E.S. (1985). Air traffic controller workload: An examination of workload probe. (Report No. DOT/FAA/CT-TN84/24). tlantic City, NJ: Federal Aviation Administration Technical Centre. Straussberger, S. (2006). Monotony in Air Traffic Control. Contributing Factors and Mitigation Strategies. EUROCONTROL Experimental Centre Note. 15/06. Available from: http://www.eurocontrol.int/eec/gallery/content/public/document/eec/report/2006/019_Monotony_in_ATC.pdf

HindSight 21 Summer 2015 53 FROM THE BRIEFING ROOM The chronology of workload

by Capt Shah Alam When I started learning to fly in the military back in early 1980's in a Chinese-built PT6 aerobatic trainer, powered by a small radial piston engine, I didn't have any idea about workload...

We just had a short ATC and Met workload that I faintly remember was if you had an emergency or a major briefing in the morning, followed by in navigation and instrument flying failure. a short briefing by the instructor and sorties. But I would not dare to call off we went for the sortie. We had to it workload compared to what I now My first real workload came when remember our checklist and the limi- have after flying for 34 years in mili- I started flying military transport in tations by heart. I do not remember tary and in commercial aviation. Russian built Antonov-26 aircraft. Be- ever being told about workload as fore departure, we had to check the a threat as such. It was all stick and In fact we had a subject in the Air Force NOTAMS, Met Forecasts and Jeppesen throttle action from start up onwards. academy known as Airmanship, which navigation and approach charts. But Of course, there was no automation, is basically equivalent of present day the flying itself was still simple. No au- no FMS, no EFB, no MCP to manage aviation law and aviation physiology topilots, manual selection of frequen- the flight. Flying was simply fun and which mainly covered the medical and cies and courses to fly and straight- 'success' was down to skill in handling physiological aspects of flying. But we forward ILS, VOR or NDB approaches. and aerobatics. We didn't have much were never made aware that some- Hardly any airports had a SID for the to do heads-down in the cockpit and thing called workload existed as such, departure and even if they did, it was I would not call it a flight deck! Flying our activity was just part of our human invariably a pretty simple turn after was just looking out, doing your ma- instinct like a normal day of any work. takeoff to follow a outbound radial or noeuvres looking out with just an oc- I presume it never came up as a factor course. We only needed to select the casional glance inside to check your because it was never normally over- VOR or NDB frequency and the desired engine oil temperature and pressure. whelming, and only became an issue I remember that it used to be hot and sweaty, pulling g, I would say it was much more physical workload then mental workload. The only mental

54 course and it was then a simple matter CRM courses for pilots. We started see- modern aircraft I flew, the more ATC of intercepting the course or radial by ing case studies on how some of the was also using increasingly advanced following the memory aids TDC (tail- major fatal accidents had happened technology to monitor the skies and desired-correction) or DHC (desired- where workload had been a contribu- the more my workload kept increas- head-correction). tory factor. I began to get the impres- ing. The skies all over the world be- sion that the more advanced and came busier, airspace became more When I started flying as a commercial complex, rules more stringent and airline pilot in the early 1990s, I was the rate at which new concepts and first introduced to automation in the I began to get the technologies were being introduced form of autopilot and an EFIS control impression that the increased resulting in more to learn panel, we loved to proudly call them and learn and again learn. The age-old our 'glass cockpit'. Now we had fancy more advanced and cockpit had now become today's flight flat-screen panels called the PFD and deck with all the modern gadgets like the ND which replaced the age-old modern aircraft I flew, TCAS, EGPWS, RAAS, FMS, ACARS, EFB. ADI and HSI. The flying itself became the more ATC was also New procedures are being introduced easier but the work to manage the to match with these state of the art flight started to increase. We now had using increasingly cutting edge technologies. Next we to learn how to interpret the EFIS dis- started learning about RNAV, RNP, and play and so on. advanced technology to now RNP-AR, all of this meant more monitor the skies and learning and more pre-flight workload Next came my first introduction to the in the form of preparation for a flight word 'workload' as applied to aviation the more my workload to a little-known airport in your net- rather than everyday household work- kept increasing. work. 44 load. My airline introduced mandatory

HindSight 21 Summer 2015 55 FROM THE BRIEFING ROOM

The chronology of workload (cont'd)

Now let me share what the present day fray the pilots' nerves. They will now are head-down actions during taxiing workload of a typical transcontinen- be at more risk of making mistakes in which add to workload. tal flight looks like. Nowadays, some performance planning with the wrong of the major airports have page after flap setting for the changed Runway or Even with all these complications, the page of charts and masses of airport the wrong V speeds. Situational aware- departure workload is much simpler briefing pages with technical informa- ness can degrade and this can increase these days than the arrival workload. tion, much of which is not related to the chances of taxiway or runway in- Let us look at what happens in a ma- the operational needs of pilots. Some- cursions. Now if you then add the cold jor airport in Europe, Asia or the USA. times there can be close to a hundred weather deicing procedure at major The ATIS will typically give you two or pages of SIDs and STARs each with a airports you would have the real threat sometimes three runways for arrival. If different name and chart number but of workload. On the other extreme, you do not have datalink and D-ATIS really many are the same ILS approach some of the Asian airports will still then you have to wait until within with a small bullet note of procedure not give you the departure clearance VHF range to plan your arrival and to to make it a different chart as ILS X,Y until you are taxing out and handed brief the crew. You may well not know or Z approach. There now seems to be over to the tower controller. They will which arrival and runway you are go- a competition by the chart makers, in often not appreciate that the depar- ing to get until after you have started the skies by ATC and in the company ture procedure needs to be inserted your descent. For some US airports, to increase pilot workload. At major EU in the FMS, the MCP needs to be setup you do not get confirmation of the airports, you would now need to un- and the EFB needs to be organised landing runway until you are handed derstand not only 'Slot time', but more for the departure procedure. All these over to the approach controller. The specific times like TSAT, EOBT, CTOT. controllers or those who determine All this is done to make airports more local procedures presumably do not efficient by increasing their capacity. realize that this creates tremendous The effect is more pre-departure time time pressure and imposes additional pressure and workload for the pilots, workload on the pilots of a mod- especially as you would typically not ern aircraft with all its complex know until 20 minutes prior to depar- automation. Late notification ture which runway or SID you are go- ing to get. And if this is not what you had expected, then you invariably end up with last minute distractions and the workload of performance plan- ning, FMS preparation and a revised briefing, basically the whole process all over again. And on top of this you still have to get the doors closed on time to make your slot. All this is work- load which adds up and can

56 or change to a landing runway needs last minute FMS, EFIS, MCP and EFB setup followed by a briefing in a busy Capt Shah Alam R/T situation when you are constantly is an experienced pilot who flew in the Bangladesh Air Force being called by ATC for speed change, and with Biman Bangladesh Airlines for over 30 years. His level change, frequency change and airline roles included being a TRE and a CRM trainer and or heading change. This means high holding management positions as Chief of Technical and as workload and the risk of degraded sit- General Manager Corporate Planning. He now works as a uational awareness due to head-down Captain on the Boeing 777 aircraft with Qatar Airways. time of at least one pilot and chances of getting 'out of the loop' because temporarily, it is no longer possible for both pilots to monitor ATC. Then add tween en route and terminal area pilot changes in the terminal area. And if ATC to this the ATC-imposed speed con- workload is marked. The former is gen- is providing radar vectors, give the track trol and maybe a high speed arrival erally low because management of miles to go automatically so that pilots until late followed by the stringent the airspace is pretty much the same can plan the energy management and Company requirement for a stabilised the world over whereas each individ- the descent profile. Such practices add final approach. Most controllers do ual major airports has it's own unique to safety by reducing workload and bet- not tell you the track miles while they pre-departure procedure, arrival pro- ter situational awareness. are vectoring you so you do not know cedure, taxi procedure or taxi routes your profile till late which might lead presented in an abbreviated form ATC must remember that pilots often do to interception of the glidepath from which itself creates extra workload for not operate to the same airport often. above. Acceptance of an ATC request a pilot who is not familiar with it. He Having served almost four years in a ma- to maintain high speed for too long needs to looks at the briefing pages jor airline, I have not yet operated to all can result directly in an un-stabilised to check the standard taxi routing the airports served by my B777 fleet. So approach. Worst of all is when the last and any last minute runway change if I'm rostered to operate to a completely minute change of runway is during a increases workload to the extent that new airport in the US or in China then visual or a non precision approach as positional awareness may be lost, and the preparation has to start days ahead occurs at some of the major US air- errors ranging from taking the wrong to read the airport pages, taxi routes, ports. Controllers there do not appear runway exit or subsequently taking a special ATC procedures, expected ar- to realise that if pilots are not used wrong taxiway or even a taxiway in- rival and departure procedure, Jeppesen to flying visual or non-precision ap- cursion at a hot spot may follow. Some charts, state procedures, the Operations proaches, thus the work load on the might argue that hotspots are de- Manual Part C and so on. Now add to flight deck for both pilots increases picted on the chart, but checking that this around 70-80 pages in the briefing significantly. The monitoring pilot's means reading the airport reference package on the day consisting of page ability to cross check for errors by the pages and their notes and explana- after page of NOTAMs which will mainly handling pilot degrades in situations tions when you are still flying the air- tell you where one taxi light is missing, like this. Controllers also do not always craft and responding to ATC re-clear- or some of the markings are missing or seem to understand the energy man- ances for every 1000 feet of descent some crane operating near the airport. agement difficulty for pilots of large and to frequent changes of heading This is real workload. passenger jets in situations like these. and speed, not to mention the work- load created by the diverse use of avia- My hope that the regulators and airport For some airport controllers, a dif- tion English around the world. Without authorities will some day harmonise the ferent approach to their task is an being prejudiced we see the full range procedures at major airports and thus re- appreciation of when and why pilot of possibilities from 'all American Eng- duce the number of superfluous charts work load increases. Controllers need lish' to 'Chinese or East Asian English'. and briefing pages. ATC would always to recognise that pilots are mostly So why can't we have an arrival proce- pass the expected departure and arrival pretty well prepared and procedur- dure and a landing runway given to routes and the runway early enough, ally responsive to things which go the pilot early enough to allow them maybe via datalink, for automation as planned or if a change of plan is to prepare well, when the flight deck insertion and planning to reduce the known early enough. The contrast be- workload is low instead of giving the workload and achieve safer skies.

HindSight 21 Summer 2015 57 FROM THE BRIEFING ROOM Where is my workload? Identifying hot spots

by Patricia Lopez de Due to an unexpected weather dis- This last paragraph has introduced turbance, a number of aircraft trajec- a key aspect of ATM complexity, its Frutos and Nicolas Suarez tories have been modified. This situ- direct relationship Today is a normal day in ation, combined with a small set of with workload, Europe, with normal traffic departure delays in airport ABCD will so we are able result in a hotspot in sector EFGH in now to refine our flows and no incidents. 45 minutes from now. Having identi- understanding of a Aircraft are flying through fied the hotspot, the Local Network hotspot. A hotspot Manager in cooperation with the is an area of high European skies efficiently, Regional Network Manager propos- controller workload following user-preferred es to level cap the flow of aircraft where one or more ATCOs will routes and keeping to their coming into the sector. This solution experience undue pressure if they is also coordinated with the opera- are to ensure the safe flow of aircraft. target times. In this normal tions control centres of the airlines Thus, if we are able to determine situation, nothing seems involved which results in minimum those areas where ATCO workload is to go wrong. Nevertheless, all- round disturbance to the system. above a certain threshold, we will be This action allows all the aircraft in- able to identify potential hotspots. the Local Network Position volved to maintain their target times. of ACC WXY has detected Generally speaking, the As seen from this hypothetical ex- workload experienced by a possible non-normal ample, the key to identifying and ad- an ATCO has a range of situation. dressing small system disturbances different components, is to correctly identify and deal with but from an operational hotspots. However this seemingly point of view, the most Patricia López de Frutos easy process has a number of chal- significant feature of holds a M.S. in aeronautical engineering lenges. The first one is to identify workload is the “mental and has a working experience of over what is a hotspot. workload”. 15 years in the ATM business sector. Her area of expertise is focused on validation Hotspots can be defined in a number Mental Workload of future concepts and their impact on of ways, but the most useful method is defined as a performance. Currently, she is a principal is to assess the prospective hotspot function of the research engineer at CRIDA (ATM R&D and innovation in terms of complexity. A hotspot is resources required Reference Centre). She coordinates CRIDA participation in defined as a location of high com- by the cognitive SESAR Development Phase. plexity where one or more control- processes that a task lers will need to pay extra attention demands (cognitive to ensure the safe flow of aircraft. So demand) and the Nicolas Suarez far so good but, what exactly is com- mental resources holds a B.S. in aerospace engineering plexity? In this context, ATM com- available. In this context, and has a working experience of over 25 plexity is understood to be a multi- mental overload occurs years in the Air Traffic Management (ATM) dimensional construct that includes when there is an excess of domain. His area of expertise is focused static sector characteristics and dy- task load (cognitive demand) on the development, assessment and vali- namic traffic factors. These factors compared to the psychologically dation of ATM operational concepts and can, for example, be physical aspects available resources that the controller logical architectures. Currently, he is a technical manager in of the sector, or factors relating to is able to supply. It is assumed that CRIDA (ATM R&D and innovation Reference Centre). the movement of air traffic through tasks are always performed without the airspace. reducing safety levels.

58 Thus the objective of Hotspot detection is met through the estimation of expect- ed workload. This “expected workload” is considered to be a function of the ATCO cognitive resources required to perform a task in a safe and efficient manner.

The Cognitive Demand model is based on the idea that a person engages in five basic cognitive tasks when performing an action – Perception (both visual & auditory), Comprehension, Strategic Thinking, Decision Making and Execution (manual and verbal).

Figure 1 The Cognitive Demand model

The use of these cognitive tasks allows a person to perform high-level mental processes such as the acquisition of situ- ational awareness or the performance of decision-making (Figure 1).

This approach allows us to describe ATCO activities as a set of tasks triggered by those flights under their responsibility. Flight Events, such as sector entry, level changes, conflict detection or vectoring, can be translated into ATC Control Events, thus emulating controller activity (e.g. clearances, conflict resolution by level changes, monitoring, or sequencing). It must be highlighted that ATC Control Events are composed of a temporal sequence of Tasks that the controller performs when an event is occurs – for instance collecting information from the system, coordinating an entry with collateral sectors, listening to the pilot and giving instructions. 44

HindSight 21 Summer 2015 59 FROM THE BRIEFING ROOM

Where is my workload? Identifying hot spots (cont'd)

Tasks are performed through elemen- still need to translate the model into There are three basic concepts that we tary actions called Primitive Operator “something” that can be used to ob- need to implement (figure 3): Actions. Each one of these involves dif- tain a number. To accomplish this, we ferent parts of the Cognitive Process must determine how the performance n Cognitive Demand (Task Load): such as reach flight strip, fixate object, of tasks affects cognitive demand. the physical and mental activity search with pattern, listen, recall, recog- required to deliver perceptual ac- nise, select, compare, compute, decide, Cognitive Demand is calculated us- tions, cognitive actions and motor say a message and type. Primitive Op- ing Wickens' algorithm. When Tasks skills. To model this concept it is as- erator Actions are triggered according overlap in time, the Total Cognitive Re- sumed that Flight Events result in to the cognitive processes implied in source Demand depends on two fac- ATC Control Events that are driven the controller task and result in the use tors, the resources demanded per task by an underlying Operating Con- of different cognitive resources with dif- and a “conflict” component when two cept and that their implementa- ferent loads. tasks compete for the same pool of re- tion requires a specific set of cog- sources. The Multiple Resource Model nitive resources. The relationship between ATC Control postulates separate resource pools in Events, Tasks, Primitive Operator Actions terms of three dimensions of informa- n Available Mental Resources: the and cognitive resources is determined tion processing so that when two tasks mental resources that an ATCO has by the way in which controllers perform use the same pool of resources there available to provide the control their control actions and constitutes the is a conflict and a higher cognitive de- service, considering only a fixed operating concept used by the Cogni- mand results. amount of base resources. The tive Model to estimate the required psychological factors experienced cognitive resource needed to manage a Wickens’ algorithm allows us to esti- during a controller’s shift such as specific traffic situation (Figure 2). mate cognitive demand using a set fatigue, stress and satisfaction with of flight events and control events. work done shape the available re- We can now model ATCO activities in Furthermore, this algorithm permits sources. terms of the tasks associated with the us to use different operating concepts operating concept used to provide the depending on traffic features and en- n Threshold: the value beyond control service over an area, but we vironmental context. which Cognitive Resource De- mand (Task Load) exceeds the Available Mental Resources. This is where a direct impact on safety Figure 2 The Cognitive Model Operating Concept begins and the ATCO will need to be trained to cope with these situ- ations or be supported by technol- ogy. Currently the Cognitive Model assumes a fixed amount of avail- able resources.

The implementation of these three components results in a system that is able to estimate the workload us- ing commonly available information such as flight events and operational inputs.

Up to this point, the reader will have noticed that there is a strong theoret- ical emphasis in this approach. So the question that we now need to pose is can we build an experimental sys-

60 Figure 3 The Mental Workload Model System Framework

plement this approach already exist and are being used by ENAIRE and CRIDA and are un- der evaluation as part of the SESAR programme.

Additionally, analysis of validation data from the mental workload model indicates that there is a need to upgrade the mental workload model to take into account the variability of human be- haviour under the dif- ferent traffic patterns and dynamic environ- ments that are the Op- erating Modes. This will tem that implements this approach? We believe that the use of Cognitive be achieved by introducing dynamic The answer to this question lies in our Demand to assess the workload is a vi- thresholds, enhancing the definition ability to develop an appropriate logi- able approach for the identification of of operating modes and developing cal architecture and an associated set hotspots. This approach has a distinct situational awareness and decision- of operational requirements. This ar- advantage presenting the hotspot in making process models. Psychological chitecture defines the principles that terms of high workload areas that re- factors sush as fatigue, stress and emo- support the estimation of the work- quire special effort from ATCOs. The tion will be integrated to complete the load (Figure 4). models and systems required to im- model as part of future projects.

Figure 4 The High-Level Logical Architecture of the ATCO Mental Workload Experimental System

HindSight 21 Summer 2015 61 FROM THE BRIEFING ROOM Workload levels and their impact

by Dr. Beth Lyall Workload has been described as an indicator of the level of total mental and/or physical effort required to carry out one or more tasks at a specific performance level.1 The reason we pay attention to workload is because of the effects it can have on performance as it changes. When workload is too high or too low, it can significantly increase the probability of all types of errors.

1- Stramler, J. H., Jr. (1993). The Dictionary for Human Factors/Ergonomics. Boca Raton, FL: CRC Press, Inc.

62 The challenge in addressing workload is that it needs to be Current Workload Level broken down into its components in order to understand what actions can effect an improvement in performance. In The current workload point is determined by a combination this article I will give one way of breaking down the concept of many factors including: of workload and how it can be addressed in design, training, and operations. n Tasks being accomplished n Design of systems and equipment Workload is one element in a situation that impacts per- n Processes and procedures formance and the potential for making errors. In a safety- n Situation and environment related situation we are interested in minimising errors and ensuring that errors that do occur can be recognized and Tasks: Some tasks are more difficult to accomplish than oth- managed. ers. They require more mental or physical resources, making workload higher at the times they are being accomplished. Figure 1 presents a notional workload description that will However, tasks do not stand-alone. allow a discussion of all the different components and their impact. The line depicts how workload moves from low Design of Systems and Equipment: The design of the sys- to high. Many factors define the point along this line that tems and equipment used to accomplish the tasks will also workload will reside at for one point in time. That point will impact the workload at that time. If the design is poor and change as the tasks and situations change. The two thresh- requires a lot of effort to understand and use the system, old lines on the graphic indicate the level of workload at then workload will be higher. Workload is impacted by the which the probability of errors increases. There is an error design of all systems, displays, controls, and equipment be- threshold when workload goes too low and one where ing used. If workload is significantly impacted, it can lead to workload goes too high. When the current workload level critical performance errors. Human factors considerations goes beyond either threshold, the occurrence of errors is in design have been developed2 to reduce the potential for much more likely. The challenge is that all of these are mov- these design-induced errors. ing parts. Workload goes up and down, and the thresholds move based on certain factors. In the remainder of this ar- Processes and Procedures: The availability and design of ticle, I will address each of these components and how they any required processes or procedures also impact workload. are influenced. For example, performance in an emergency situation is eas- ier if an appropriate checklist is available for that situation. And when that checklist is needed, the effort required to find the right checklist, understand it, and use it will impact the workload at the time of doing the tasks to deal with the emergency.

Situation and Environment: Finally, the situation in which the tasks need to be performed will impact the workload current workload experienced. Attributes of the situation that affect the level of workload include urgency, competing tasks, time of day, ambient lighting, noise, and the availability of other team members to help.

Each of these four factors vary throughout a work session, causing the current level of workload to go up and down as the four factors come together at any one point in time. 44

error error threshold threshold 2 - Lyall, B. and Harron, G. (2005). A Systematic Approach To Addressing Human Figure 1. Workload levels with indications of Factors Considerations In The Design Of Flight Deck Components. Proceedings current workload and error thresholds of the Thirteenth International Symposium on Aviation Psychology, April 18-21, 2005, Oklahoma City, Oklahoma.

HindSight 21 Summer 2015 63 FROM THE BRIEFING ROOM

Workload levels and their impact (cont'd) Error Thresholds Level of Expertise: We usually think of a person’s expertise as encompassing their knowledge, experience, and training for accomplishing tasks. That is important here too with the knowledge, experience, and training someone brings having a big impact on their performance and the likelihood that they will make an error in general. I want to expand expertise for this discussion to also include the knowledge, experience, and training for using the systems, equipment, processes, and procedures – and in facing the situations and environments. So all of the factors that contribute to the existing level of workload are important when considering how prepared a person is for dealing with those tasks and situations. This combination sets the threshold for error. If expertise is high, the threshold is higher, and, considering the threshold at the high end of the workload range, a person can handle increasing levels of workload before significantly impacting the probability for error. But the threshold for error for novices will be lower, more likely leading to errors when facing lower The big reason we care about the level of workload is levels of workload. Figure 2 illustrates this difference in that it can lead to performance errors. Workload levels error thresholds for people with lower and higher levels can contribute to many types of errors including physical of expertise for the current tasks and situation at the high errors of data entry or manual handling; perceptual end of the workload range. The impact would be similar at errors of not recognizing a change in display label, not the low end with more expertise resulting in less likelihood identifying a system failure, or not hearing an aural alert; of errors. and cognitive errors related to planning, decision-making, problem-solving, troubleshooting, communicating, task management, and many more. It is the relation between the current level of workload and the error threshold that determines the likelihood of these errors. If the current level of workload is at or beyond the error threshold – either at the high or low end of the workload range – errors become current more likely. workload

Along with the four factors (tasks, design of systems and equipment, processes and procedures, and situation and environment) that impact where the current level of workload will be along the range of workload, there are factors that are associated with the error thresholds. The workload threshold for error is determined by a combination of several attributes error error related to the person performing the tasks at a particular threshold threshold point in time. Four of these attributes are: low expertise high expertise

n Level of expertise Figure 2. Impact of expertise level on the upper error threshold. n Fatigue The impact on the lower threshold will be similar in that in increase in expertise will move the threshold to reduce the n Distraction likelihood of errors. n Stress

64 Fatigue: The impact of fatigue, whether physical or mental, is to re- duce the threshold for error and make it more likely that errors will occur for particular workload task and situation combinations. One of the challenges with fatigue is that it usually increases as a work session progresses. It also Error Thresholds changes with levels of alertness and changes in the circa- dian rhythms. We all know that we feel more tired or fa- tigued in the middle of the night than we do during the What Can You Do? day. The error thresholds change with these changes in fatigue throughout a work session, resulting in errors be- 1. Understand the impact of the different factors ing more likely with less workload at the high end and less related to workload tolerance for lulls in workload at the low end. This means Everyone is different. Review and continue to try that the same challenging tasks that are accomplished eas- to understand how the current workload levels ily with no errors early in a work session will be more prone change for you in your work situations, which factors to error occurrences later in the session if fatigue increases. have more impact for you, and what you can do to Figure 3 shows this effect along with the similar impact of recognise the current levels of workload and when distraction and stress. you are getting close to the error thresholds.

2. Be prepared n Stay current on your training and engage in getting new knowledge about incidents and situations you may not have yet encountered. n Reduce your stress by having a regular exercise and current relaxation routine. workload n Manage your level of alertness by getting enough sleep, eating a well-balanced diet, staying hydrated and limiting your use of caffeine as an alertness strategy.

3. Develop strategies to use while at work n Review and brief about the expectations for changes high fatigue, low fatigue, in workload situations – at the beginning of a shift distraction, distraction, and as expectations change. or stress or stress n Recognise changes in workload and take steps to address their impact. Figure 3. The impact of fatigue, distractions, and stress on the n Develop routines to keep yourself alert and reduce upper-end error threshold. The impact would be similar on the the risk of fatigue. lower-end threshold with increases in fatigue, distractions, or stress increasing the likelihood of errors. n Try to avoid the impact of distractions by coming to work prepared and ready to focus by employing the fatigue avoidance strategies mentioned earlier and Distraction: taking a professional attitude to each work session. Distractions can come from many sources including competing tasks, voices of others nearby, noise, and lights and reflections. When we are distracted, many areas of

performance are affected. For workload, distraction moves Dr Beth Lyall the error threshold (either high or low), making it more is founder and president of Research Integrations, likely that errors will occur. Inc. For over 25 years she has been improving safety through the enhancement of human performance Stress: in design, certification, training, and operations Our level of stress impacts the error threshold by moving in aviation and other safety critical domains by the high-end threshold to the left – or moving the low-end conducting and applying human factors research. threshold to the right – and making it more likely to com- She has served on a number of international mit errors for a given current level of workload. Stress can aviation industry committees including the Flight also increase the levels of fatigue and distraction enhancing Deck Automation Working Group. their associated impacts as well.

HindSight 21 Summer 2015 65 FROM THE BRIEFING ROOM Can ATM learn from the experience of pilot workload measurement?

by Jean-Jacques Speyer Hard-won experience from 35 years of experience with airline pilot workload measurement methods can perhaps shape the future of Air Traffic Controller workload measurement in the context of SESAR & ATM just by sparking some ideas…We don’t want to bore you with any technicalities, just give back some basic ideas.

This all started with Professor Bob Simpson, my thesis supervisor at MIT. He used to meet his guys over a sand- wich lunch and was pretty communi- 50 cative about his own work. One day he told us about his review of workload assessment methods for the impend- 65 60 55 ing MD80 certification. Years later at Airbus, as I was being interviewed 45 for a job in the Flight Operations de- 7075 partment, I was asked “have you ever 40 heard of pilot workload?” “No… oh, yes, now wait a minute, yes, 35 now I remember…” Within days I was working on the design of the flight deck of the world’s first two-crew wide-body air- craft, the Airbus A300FF, with a “carte blanche” to go and meet up with NASA’s HF gurus who were more 20 than happy to show headquarters that they were popular in Toulouse. My starting point was a landmark piece “A Simulator Study on the Inter- action of Pilot Workload with Errors, Vigilance and Decisions”, by the late Dr Patrick Ruffell Smith. His work coupled quite well with my personal practical experience of workload from time as a 10 Boeing 707 Flight Engineer.

Still to this day minimum crew certifi- cation under FAR 25 and its Appendix 100 0 5 66 D stipulates both workload functions evaluations in mockups with early sets Certification reports – already as early and factors that need to be assessed of procedures not yet subject to flight as then – emphasized the need for pi- and documented but do not sug- experience. The avionics smoke pro- lot training to include full use of ECAM gest any means of compliance. After cedure analysis even triggered a rede- messages and FMS modes, specifically proposing a simple framework to my sign of the A300 electrical system. predicting the need to focus on con- management, which the airworthi- ventional aircraft handling without ness authorities readily accepted, we Dynamic Workload Analyses com- resorting to automation so as to main- could start work in earnest to develop pared the timelines of workload varia- tain pilot flying skills and avoid loss of our own evaluation methods. tions under demanding scenarios with situational awareness, years ahead of subjective ratings from each pilot issues that would become top indus- The overall idea was to compare a new using an 8-point scale derived from try concerns, aircraft to be certified for two-crew op- Cooper-Harper’s scheme to evaluate eration with existing ones – at the time Aircraft Handling Qualities1 with con- Performance Criteria Analyses com- already well – proven in actual airline current subject pilot and observer pared electronic flight instruments service – to assess whether the new ratings from Airworthiness Authority and flight management systems re- aircraft footprint would be within the pilots. These demonstrated that work- spectively to electromechanical in- envelope of the older design. Methods load ratings measured for both the struments and conventional naviga- were developed just by “doing it” – by A300 and for the smaller A310 were tion systems (HSI, ADI), measuring intuition. within those recorded for B737/DC- pilot performance when executing a specified and demanding circuit on the flight test A300. Another experi- ment compared side-stick/Fly-By-Wire (FBW) versus conventional controls by removing the conventional con- trols at the left side of the test aircraft and replacing those with a side-stick. Experience was gained in assessing basic measures derived from dozens of aircraft performance parameters such as for example pitch, speed, el- evator position and engine power le- ver angle. For the FBW experiments, smoothness, stability measures and rates of reversals showed a marked improvement over conventional con- trol. When using the side-stick, pilot control inputs were reduced by 50% or more, releasing time for other flight management duties.

Static Taskload Analyses considered 9’s. Overall, workload profiles were in Following the positive outcome of the Normal, Abnormal & Emergency the moderate range and crews never these methods, a mathematical mod- system procedural tasks that had in experienced workload levels becom- el, the Airbus Workload Model, was the past been carried out by a Flight ing extreme and unacceptable to the developed in the wake of the A310 Engineer. These indicated that task- point that errors became inevitable. certification and fitted the subjective load of the aircraft under evaluation Good convergence emerged between rating data well. This model was a sta- for certification would be within the subject pilot and observer ratings, tistical combination of aircraft flight envelope defined by the reference air- with about 75% of ratings being iden- parameter data such as airspeed and craft (B737/DC-9), an early indication tical. Calibrated and validated, the roll rate with heart rate variability data of acceptable two-person crew op- proposed rating scale was deemed us- on both pilots and flight status mea- erations on the new aircraft. This work able. sures such as phase of flight. The mod- also enabled first hand task-sharing el predicted the rating a pilot would have given on the workload rating scale. The overall experimental meth- 1 - G. Cooper and R. Harper. The use of pilot rating in the evaluation of aircraft handling qualities. odology was sufficiently original for a Technical Report TN D-5153, NASA, April 1969. joint patent to be obtained in France, 44

HindSight 21 Summer 2015 67 FROM THE BRIEFING ROOM

Can ATM learn from the experience of pilot workload measurement? (cont'd)

the USA and Europe on behalf of three measures often sounded unusual and A340 certification. It was also able to parties concerned2,3. weird, eventually strengthening ac- help investigate the impact of auto- ceptance of the two crew certification mation on crew underload in long- The model gave the “subjective” nature process. The availability of continuous range operations in parallel with of ratings a solid foothold as subjective modeled graphs provided a unique dedicated crew alertness measure- measures often sounded unusual and opportunity to examine some issues ments to help formulate recommen- weird, eventually strengthening ac- such as possible associations between dations to cope with crew fatigue. ceptance of the two crew certification workload, automation and errors; process. The availability of continuous there was an indication that severe er- Although there had been much re- modeled graphs provided a unique op- rors may occur during periods of high search on pilot workload, virtually portunity to examine some issues such and increasing workload; as well as all of this had been focused on over- as possible associations between work- the suggestion that these take place load. Hence we progressed to mea- load, automation and errors; there was near surges and peaks of workload. suring crew alertness in actual airline an indication that severe errors may oc- Workload decreases noted thereafter operations to complement workload cur during periods of high and increas- appeared as pilots procrastinating, plots calculated from the model us- ing workload; as well as the suggestion taking tactical postures, at times even ing DFDR data and pilot ECGs. that these take place near surges and shedding tasks. We also found that peaks of workload. Workload decreases just as for errors, plotting workload It was found that for short peri- noted thereafter appeared as pilots graphs and automation levels pointed ods, both pilots would cooperate in procrastinating, taking tactical pos- towards a classical inverse relationship shared tasks and that these would be tures, at times even shedding tasks. We between the two. separated by longer periods where also found that just as for errors, plot- pilots were effectively disconnected ting workload graphs and automation Step-by-step, the version of this from one another. To preserve crew levels pointed towards a classical in- model that had been developed for vigilance, the concept of pilot al- verse relationship between the two. the A310 was used for the A320 and ternation emerged, crewmembers was expanded for airline applica- taking turns to enable napping “in The model gave the “subjective” nature tions on A310, A320, B767 and B747- the seat” to reduce sleep pressure. of ratings a solid foothold as subjective 400 aircraft and validated for the Pilot ECGs showed that low activity with relatively flat workload curves were typical of night flights whereas a saw-tooth pattern characterised daytime flights. This suggests that lower workload variability could act as a predictor of low vigilance or under-alertness. Unsurprisingly, high pilot workload was calculated when arriving at busy and unfamiliar airports after long overnight flights. One night we even recorded a pre- cautionary engine shutdown after erratic oil pressure fluctuations just after a near miss coupled with ATC coordination problems – the activ- ity ratings surged. This was seen as “proof of the pudding” as far as the model’s reliability was concerned given that it had been formulated during certification testing where pi- 2 - Dunlap & Associates, the Cochin Laboratory of Adaptation Philosophy and Airbus. 3 - Speyer JJ, Fort A, Blomberg R.D , Fouillot JP,“Assessing Workload for Minimum Crew Certification”, in AGARD lots knew in advance there would be AG-282, “The practical Assessment of Pilot Workload, Ed. By Dr A.Roscoe,, June 1987 problems to be faced.

68 crews, taskload tended to rate higher since longer time on task would deplete more of their physical and mental re- serves. It was also found that in the case of the A380, as with all the other types, CRM breaks down under extreme work- load. When cognitive bias overpowers the PF, the other pilot has to take over. But what if both pilots are under pres- Work on active/passive pilot alterna- n EEG recordings confirmed that de- sure that narrows their workload capac- tion also informed a means to moni- creased alertness would get back to ity? How then can we avoid situational tor the awake pilot during the other higher levels if a pilot took on a cog- awareness sliding further away? pilot’s in-seat napping on long haul nitive workload coupled with physi- flights and warn him/her, if necessary, cal interface activity, within a limited So, what does all this say for the world of of his/her own impending sleepiness. time and sufficiently vigorously that the ATC Controller? Perhaps some ideas This concept of electronic pilot activity situational awareness could be re- are that: and alertness monitoring depended gained. A finding we could verify for on two inputs: the cruise parts. n Their work could be monitored; just as we had observer-pilots rat- n pilot activity monitoring by detec- Finally, we undertook Minimum Crew ing workload and describing flight tion of their interaction with dif- Certification for the A380. This was qui- scenarios, can we imagine a similar ferent aircraft systems such as the etly and smartly performed by means procedure for future ATM operational FMS, ECAM, EFIS FCU and RMP , of NASA’s TLX index. Its 6 dimensions – evaluation and certification using an mental, physical and temporal demand, equivalent of the Aircrew Data Log- n pilot eye-tracking because of the frustration, effort and performance, ging software. possibility that pilots would still were measured using hand held devices manipulate systems when in a low to capture pilot ratings. After calibra- n Eye tracking could be used to see alertness state, tion these could assess multi-attribute what the controller looks at and re- tasks involving tracking work, systems cord eye movement sequences eye- The concept also goes along with monitoring and scheduling work, com- lid or eye-pupil devices to assess present philosophy on pilot flying/pi- munications, systems status work and alertness & workload lot monitoring. resource management, so as to assess all elements of workload acceptability n ATC strategies & tactics could be Evaluation on selected flights showed using just a handful of scenarios. mapped, workload models would that: soon emerge and discriminations like This process led to the finding that on taskload, workload & performance n Cameras could be used to obtain all long-haul flights without augmented could be made! some measure of the cognitive part of pilot workload since filmed eye- lid closures correlated with alert- Jean-Jacques Speyer ness measures as it would clearly be impracticable to 'wire-up' line Jean-Jacques, MS El & Mech Eng, VUB, Brussels, Belgium, MS Aero & pilots to EEG recorders in routine Astro, MIT, USA, DU HF’s & Ergonomics, Univ René Descartes, Paris, airline operations, France. After an airline start as B707 Flight Engineer, JJ Speyer moved on to Flight Operations Engineering & Certification at Airbus from n Cameras could be used to record where he retired as Senior Director Airline Consulting, Fuel & Flight what instruments pilots were actu- Efficiency at the end of 2009. He is currently Professor in Aircraft ally looking at – although this was Specification & Certification at the Vrije Universiteit Brussel. and remains taboo for normal line flying purposes,

HindSight 21 Summer 2015 69 FROM THE BRIEFING ROOM

Workload management in a 2-man flight deck: when automation increases the workload...

by Captain Dirk De Winter While the flight deck of first generation passenger jet aircraft hosted a 3 to 5 man crew, modern versions need only a 2 man crew and transport many more passengers. The knowledge and skills of the navigator are replaced by a few keystrokes on the keypad of a Flight Management System (FMS)...

The now digital VHF radios are eas- During the pre-flight cockpit prepara- by the despatcher who also sent vari- ily operated by the pilots and aircraft tion, new technologies such as datalink ous flight data such as the fuel uplift, systems have become extremely reli- allow the uploading of the flight plan passenger numbers and delay codes able, digitally controlled and much straight into the FMS, thus avoiding to the Company. In the flight prepa- more automated. Navigating, commu- the time consuming and error-prone ration phase, the type of tasks un- nicating and system operation have process of manual entry. The use of dertaken may have changed, but the become so “easy” that these tasks can computer programs on the electronic time required to complete them all now be combined with the primary flight bag (EFB) to calculate the take- has remained very similar and this is aircraft control tasks of the two pilots off performance data instead of the reflected in the flight and duty time without any other flight deck occu- old manual process relying on a paper limitations. pant. However these two pilots are not “weight book” has certainly made this working in the same way as the larger process more efficient. However the Once in the air, in addition to their crews used to. time saved by these new technologies aircraft control tasks, the Pilot Flying has freed-up time for new tasks. In the (PF) takes responsibility for navigation airline I fly for, this includes the exter- nal aircraft inspection which was pre- viously done by the flight engineer, and the calculation of weight and balance data previously done

70 and the Pilot Monitoring (PM) takes workload. After the PM has verified in workload and offer mitigation mea- responsibility for communication and the new taxi routing and confirmed sures such as bringing the aircraft to a systems operation. During normal this with the PF, he needs to stop his full stop and remaining stationary so operations, the procedures and tasks primary task – guiding and monitor- the PF can more effectively monitor for the PF and PM in the various flight ing the PF – to make the changes to the PM as they complete every step of phases are well described and evenly the departure routing in the FMS, se- the change process. distributed. With good use of the avail- lect the corresponding chart from the able automation, the level of workload EFB and then cross-check the routing Controllers have a “big picture” view is such that spare capacity to maintain in the FMS against the routing on the of the airport and are trying to op- situational awareness is available. chart. Next, the PM needs to go to the timise the aircraft movements both take-off performance module in the on the ground and in the air which However if an unexpected situation EFB to recalculate the performance is one reason why they sometimes occurs which requires extra attention, data for the new runway and enter change departure runways or de- the workload can increase consider- these into the FMS. Afterwards the PF parture routings. Changing weather ably. A good example is a runway must cross-check these entries and conditions are another. Whilst this change during the taxi-out phase. re-brief the changes to the departure is likely to also be beneficial for the Many airlines perform single engine routing. An initially normal taxi phase flight involved, controllers should taxi on their twin-jets and these are suddenly turns into a high workload consider the time needed by the slightly more complex and change phase where errors such as an incor- flight crew to make the necessary the order of set-ups and checklists rect taxi routing could lead to a run- changes in the FMS and re-brief because these aircraft were originally way incursion or errors in the perfor- the new runway or departure rout- designed to taxi on two engines. Add- mance calculation or FMS data entry ing. Additionally they might offer an ing a taxi out runway change to this could lead to a tail strike or even a run- opportunity to stop the aircraft en significantly increases the flight crew way excursion. route to the new runway so that all consequences on the flight deck can Some operators employ the Threat be accomplished whilst the aircraft is and Error Management (TEM) process stationary. The European Action Plan which seeks to identify the 'threats' for the Prevention of Runway Excur- involved with such a sudden increase sions (EAPPPRI 2.0) acknowledges 44

HindSight 21 Summer 2015 71 FROM THE BRIEFING ROOM

Workload management in a 2-man flight deck: when automation increases the workload... (cont'd)

this issue and proposes recommen- go-around procedure. Some aircraft sooner the flight crew is advised of dations for flight crew (REC 1.4.10) have a FMS functionality called “sec- this runway change, the more chance and air traffic controllers (REC 1.5.17). ondary flight plan” to store the rout- there is that the flight crew will be able to complete a successful stabilised ap- proach and landing. In my view, practi- During taxi departure or during approach, Pilots should not accept a runway cal guidance for a straight-in approach 1.4.10 change proposal if time to re-programme the FMS / re-brief is not sufficient. is that the landing runway should not This includes a change of departures intersection. be changed once the aircraft is within 20 track miles of the threshold or be- Figure 1: EAPPRI 2.0 – Recommendations for Aircraft Operators yond a late downwind position abeam the landing threshold. This case shows 1.5.17 When planning a runway change for departing or arriving traffic, consider that automation assists in reducing the time a pilot will require to prepare / re-brief. pilot workload but that when there is a change to the original plan; automa- Figure 2: EAPPRI 2.0 – Recommendations for Air Traffic Controllers tion creates extra workload that re- quires careful mitigation. The same principle applies to ap- ing for the approach and go-around proaches. Paris Charles-de-Gaulle air- procedure for an alternate runway. In recurrent training, workload man- port; one of the busiest airports in Eu- This “secondary flight plan” can be set agement is analysed and trained as rope, has two pairs of parallel runways up and briefed during the cruise and part of the crew resource manage- with the terminal buildings in between if required activated with just a few ment (CRM). Traditionally, the focus the Northern and Southern runway keystrokes making it easier for the is on how the two pilots cooperate. pairs. The two inner runways are usu- crew to accept a runway change. However the way they cooperate with ally used for takeoff and the two outer Unfortunately crews often choose the cabin crew and ATC should also runways are usually used for landing. to enter the inner (normally the be part of the training process. Here a This means that once landed, aircraft take off) runway into the “second- Training Captain would simulate nor- often have to hold short of the inner ary flight plan” because in low traffic mal cabin manager or air traffic con- (departure) runway to await crossing situations they could request a 'side troller behaviour and not facilitate the clearance from the tower controller. To step' to land on the inner runway and flight crew to complete the exercise. optimise the arrival sequence, control- thereby reduce taxi-in time. Also, in A few weeks ago, I had a flight crew lers sometimes change the approach anticipation of a short turnaround, under training who requested a hold from the Northern to the Southern the next sector might have already on a 10 mile final to a major airport in runway or vice versa. Like a change been loaded into the “secondary order to investigate a minor technical in departure runway, this generates a flight plan”. So even if the aircraft is problem. Whilst this makes the naviga- high workload for the flight crew with equipped with this secondary flight tion task of the flight crew easier and the major difference that the aircraft plan functionality, it’s far from sure places the aircraft in an ideal position position can’t be frozen to allow for a that it will contain the amended ap- to start the approach if the situation change of the landing runway in the proach and landing runway which deteriorates, it is not necessarily an op- FMS and a review the approach and the controller has in mind. So the timal position for the controller who has to manage his arrival sequence. Consequently, there’s little chance a controller would authorise such a re- Captain Dirk de Winter quest without the prior declaration of a PAN or MAYDAY. In lesser situations, has over 11,000 hours flying time gained over the last 22 years. He started controllers are trained to assist flight as a cadet pilot with SABENA in 1987 flying Boeing and Airbus aircraft. crew and facilitate the navigation by Before starting his flying career Dirk obtained a Masters degree in offering suitable holding fixes or radar Electronic Engineering from the University of Brussels. Since January 2009 vectoring so that the flight crew can Dirk has been working part-time at EUROCONTROL. swiftly begin the failure management process.

72 Using workload data to manage the deployment of change: defining the limits of safe workload by Nic Turley and Brian Janes The world is full of good advice: derive user requirements; involve operational controllers in the design process; conduct formal human error analyses; provide high fidelity simulations under varying workload conditions and so on – but what happens when this is not enough?

In 2012, NATS successfully introduced Electronic Flight from controllers and front line supervisory staff, EFD was Data (EFD) into the Prestwick Area Control room. EFD successfully introduced into full operational service. represented a significant change from previous paper operations and was another step on NATS’ journey towards Safety Margins of Workload fully electronic operations. There are many different aspects of a system that need to be considered when implementing new technology into live The deployment of EFD at Prestwick posed significant chal- operations safely and efficiently such as the different roles lenges due to the nature of the system (paper to glass), involved (e.g. Planner/Executive/Assistant/Supervisor), sec- changes to working practices and the limitations of simu- tor types, traffic volumes/complexity, fallbacks, handovers, lations in the validation of complex socio-technical sys- coordination, aircraft emergencies, steady state, com- tems for live operations. bined roles, and combining and splitting sectors.

The first attempt at deployment was temporarily Also, when evaluating or validating a new design withdrawn from service due, in part, to workload. in a simulated environment, there are limitations However, with the innovative application of due to the fidelity of the simulation (even high some straightforward Human Performance fidelity simulators are limited), the number measurements to define the safe limits of of runs within the allocated timeframe, the workload and some practical support Decrease in Safety Margin number and skillset of controllers avail-

Manageable Workload Overload Safety Margin

Increase in Safety Margin

Erosion of Safety Margin as Workload Increases 44

HindSight 21 Summer 2015 73 FROM THE BRIEFING ROOM

Using workload data to manage the deployment of change: defining the limits of safe workload (cont'd)

able, critical roles that cannot be replicated (e.g. supervisor Development roles not replicated due to limitations of some simulators), interconnection between systems (e.g. operating as stand- The EFD work began with the development of an in-house alone), replication of real life traffic/pilot interaction, weather, workload scale; more than 18,000 data points were collect- the experience of the controllers and their experience/train- ed from air traffic controllers in live operations across NATS ing with the new system. The list goes on. centres (Terminal Control and En-Route) at Prestwick and Swanwick over an 18 month period. Because of these limitations, when new systems are being in- troduced into service it is important to understand that the A second measurement relating to controller situation safety margins for workload observed in the simulated envi- awareness was introduced alongside the workload measure ronment may be different to those observed in the real world. and further data points were collected from live operations. It is therefore critical to identify the size of the buffer between Together, the workload and situation awareness scores for manageable workload and overload in the real world system the same period provided an insight into the workload as quickly and as reliably as possible. levels under which situation awareness remained above what was considered to be a safe level. This then provided a The change in workload safety margins when implementing means for comparing the relative tolerance of different sys- new systems has been likened to ‘Q’ corner of a fixed wing air- tems to varying levels of workload. craft (the margin between stall speed and over speed reduces with increasing altitude). If the system is new and the changes are significant, it is much more difficult to identify the triggers for overload. Therefore the margin between manageable work- load and overload may be reduced and become a ‘cliff edge’ which is much more difficult to anticipate and respond to. Operations baseline (Live) Identifying and defining the changes in the safety margins of workload during implementation is extremely difficult to achieve. However, NATS has been working on innovative methods to do just that, making it possible for any erosion of safety margins due to an increase in workload to be restored quickly. Situation awareness Situation

Workload Nic Turley is a Human Factors Specialist with over 20 years’ experience in applying HF to the procurement, development and use of The observed link between high workload scores and situ- complex safety critical systems. Prior to joining ation awareness scores appeared to be related to the point NATS Nic worked for large IT consultancies at which the controllers found it difficult to maintain the working on the development of Royal Navy ‘picture’ (a term used within NATS to describe the capacity warships, attack submarines and reconnaissance of the individual to maintain sufficient situation awareness systems as well as other major defence and rail to manage current and future anticipated traffic scenarios). procurement. Nic is currently the Deputy Head If this was the case then this would provide a means for of HF in NATS and is responsible for NATS Safety protecting safety margins during the introduction of a new Culture Strategy as well as Assessor of Technical system: keeping workload levels below a known critical Standards for the HF team. level would (theoretically) ensure that situation aware- ness would remain above a desired critical level and thus enable continued safe operation of the system.

74 Application to EFD

The temporary withdrawal of EFD from service provided an opportunity. We had data from a number of sources: simu- lations; live operations; pre implementation simulations; live operations during implementation and live operations post-reversion to paper. These data sets provided a clear in- sight into the events which took place following the initial introduction of EFD and the subsequent reversion to paper operations.

This now meant we had a clear ‘picture’ of the current operational profile (baseline) to compare against and were no longer implementing ‘blind’. Data showed that the percentage of time that controllers were experiencing non-satisfactory situation awareness scores was higher for EFD than the current operating system at similar levels of workload. Brian Janes is currently Head of One very clear finding related to the limitations of using Independent Human Factors Assurance at NATS workload data alone from simulations in the absence of reporting to the Operations Director, Safety. Brian situation awareness indicators. A clear limitation of the joined NATS 10 years ago and has held a number of simulations related to key workload factors not being technical and people leadership positions including replicated (e.g. phone calls interrupting planner actions). Acting Deputy Head of the Human Factors Group. His Live traffic scenarios, which would be classed as high technical skills include User Interface and Interaction workload in live operations, did not invoke the same Design, Safety Analysis and Validation. workload experience for controllers in the simulator.

Introducing EFD back into live service In order to facilitate the introduction of EFD back into live service, efficiencies and improvements were identified in Baseline order to reduce task demand. These included:

System 1 n Electronic (Forward) coordination n Auto population of initial levels n Carry forward of previous sector heading and speed data

Situation awareness Situation n Data entry – Heading, level and speed – Co-ordinations – Oceanic clearance times n Strip interactions

The changes were identified and implemented through Workload working closely with a core team of controllers to ensure they would be effective. 44

HindSight 21 Summer 2015 75 FROM THE BRIEFING ROOM

System 1

Live Ops Validation

EFD was reintroduced during a period of Limited Operation- awareness Situation al Service. The supervisors were tasked with maintaining the workload of the controllers at or below LOW-MODERATE levels as defined by the in-house workload measurement tool (data showed that this was the level at which the con- trollers could maintain good situation awareness). Time (months)

Supervisors have expertise in controlling workload (as part of their day job) and use a large amount of information to Being able to ‘see’ the progress taking place allowed for in- support this task (e.g. traffic information; number of con- creases in the defined workload level at a gradual rate, with trollers present; sector configurations; specific sector issues constant feedback that situation awareness wasn’t being etc.). At the end of each controlling session, controllers re- eroded. The improvements could be seen when looking ported the actual level of workload and situation awareness at the workload/situation awareness profiles at different they experienced and this was fed back to operational man- points in time. agers and supervisors to ensure that workload and situation awareness had remained within acceptable limits.

Baseline To provide complete safety assurance, a paper back-up System 1 (time period 2) team was utilised during each period of operating with EFD. This allowed reversion at any point (either prompted by the supervisor or the controllers). System 1 (time period 1)

From the data it became clear that the supervisors were able to maintain the workload of the controllers within the

desired range. A buffer had been built in and during this pe- awareness Situation riod there were no overload reports.

Workload Baseline System 1

After a few months, the paper back-up was removed and the utilisation of EFD in live operations continued to in- crease until all controllers were using EFD on a full time ba- sis and traffic was able to be managed at the same levels as when the previous systems were in use.

Due to this success, this process was repeated on further projects (e.g. iFACTS, the London 2012 Olympic Games, air-

% of scores of each workload level of each workload % of scores space changes). Previous issues encountered during proj- ect implementation (e.g. overloads) were not experienced. Workload We now have baseline data from live operations (how the current system performs), more accurate data from simula- 90% of the situation awareness scores during this period tions, and limited operational service applied sooner (as we were ‘Good’ or above (very similar to baseline scores of 91% know the levels of controller workload to maintain safety ‘Good’ or above). Over time, as workload was maintained at and clear indicators when these levels need to be adjusted). a low to moderate level, an increase in situation awareness The approach also allows significant amounts of data to be scores was observed. This was taken to indicate a gradual in- collected (e.g. in the 1000s, with 100+ participants). Investi- crease in the buffer relating to workload, possibly resulting gation to broaden the use of this technique for live opera- from increased familiarity with the new system. tions monitoring is currently being explored.

76 Sterile radio procedures

by Captain Wolfgang Starke Basically there are four phases of flight where workload is high and errors of flight crews are likely to occur. These four phases are the taxi-phase, the take-off and initial departure phase, approach and landing as well as emergency situations.

While high workload during emergency situations seems pretty clear to under- stand, stress during approach, landing and take-off is self-explanatory, the is- sue of high workload during taxi-phase of flight might be unexpected to certain stakeholders. However, sticking to some basic principles most of these phases can be rather relaxed as huge amount of tasks is generated somewhere between ATC and pilots.

Workload has been a recurrent topic in the aviation community over the last few years, especially as flight crew workload varies a lot, even during routine flights, from low to high and vice versa. These two situations represent specific risks. But it is very personal how to quantify workload. The effects of workload are very individ- ual as well. Problems resulting from high or low workload are normally a product of different factors like personal experience, emotional state, cooperation within the flight deck etc. Beginning from this point of view, I asked myself what have been the events from my personal experience when work- load definitely became an issue. 44

HindSight 21 Summer 2015 77 FROM THE BRIEFING ROOM

Sterile radio procedures (cont'd)

Taxi tions to this dilemma might be pro- During taxi-phase the workload can gressive taxi-clearances or a chance to increase pretty fast, especially during stop for a couple of minutes. It might taxi-out. Of course, the possibility of be disturbing for a controller to have stopping always exists while taxiing a taxiway blocked due to an aircraft an aircraft, however this opportunity is holding there. But the possible effects hardly ever used. Normally pilots try to on safety if an aircraft is blind flying in expedite taxi whenever they can as a vicinity of runways might rapidly be- favour to ATC as well as to stay within come dramatic. their schedules. Departure As long as everything happens as pre- If you look at the departure-phase of a dicted and the airport is known to the flight, there is much and more on the crews the taxi-phase should not be “to do” list and it has to be done within a problem. But if things change, an a short period of time. Also the engine problems between controllers and unusual re-routing is received, tech- power is high while airspeed is low, pilots lies in communicating every re- nical problems arise or there is an is- a combination which does not leave quest to pilots as soon as possible. This sue within the cabin workload does too much room for mistakes and little should be done at the latest combined increase rapidly. This effect is greater time to correct. During the take-off roll with the take-off clearance, allowing during taxi-phase as there is no auto- the lack of time leaves only two op- pilots to properly prepare themselves pilot allowing the pilot flying to divide tions, STOP or CONTINUE. A possible for this high workload phase. his attention. The ideal solution would exchange of information is therefore be to stop the aircraft but no one limited to really essential information. As soon as gear and flaps are retracted, wants to disturb a major airport opera- The same should be true for ATC, de- the after take-off checklist has been tion because of a 'possibly small prob- liver important information / instruc- read and no immediate level-offs are lem'. Proper communication can ease tions or keep quiet. to be expected, pilot workload reduc- this issue. On the flight deck side, pi- es rapidly and once past 10,000 feet lots should clearly state their problem About a year ago the Tower-Controller altitude (FL100) any non-essential re- to ATC while Controllers should try not on a major hub in Europe asked a de- quest by ATC can be dealt with. asking pilots to move, depart or expe- parting Airbus A-321 if he was still able dite when they obviously have a prob- to abort the take-off. The crew just To illustrating the problem of very lem. Even soft pressure from control- filtered out the words “abort take-off” short notice of important restrictions, lers’ side on pilots to move, depart or and did so. At a speed close to V1, the the following is an incident that hap- expedite could work counterproduc- maximum speed at which a take-off pened to me shortly after my upgrade tive. It would be better to proactively abort can be done, this was a risky ma- to become a Captain. The whole story offer the chance to stop somewhere noeuvre in reaction to a question. ended up in a massive exceedance of in the vicinity as soon as the controller the maximum flap speed and a rapid becomes aware of any 'possibly prob- Once airborne there are a lot of limita- high-G manoeuvre. When on take off lem' on board the aircraft. Hints for this tions to obey and time to react is very and only about 10 knots below V1, we can be various, typically I would say short. While levelling off for example were informed by ATC about a light very slow taxi speed, incorrect or very the time from level off to an exceed- aircraft flying through our departure short communication or uncertainty ance of the maximum flap speed can route at an altitude of 1,500 feet. The about the route to follow. be as little as a few seconds and climb suggestion was to level off at 1,000 rates can be very high. feet. Given the fact that our load was The same goes for re-routings. As the only about 30% of the maximum this Captain normally steers the aircraft (s) A common practice amongst pilots is request meant rotating for lift-off and he is not able to make notes or study to brief themselves before departure literally starting the level-off manoeu- charts while handling the aircraft. The about what to expect and how to han- vre at the same time. When levelling First Officer might be busy with cabin- dle the different steps during initial off, power had to be reduced by about calls, checklists or other actions. Solu- part of a flight. A solution to possible 70%, flaps had to be retracted and the

78 Of course, getting closer to the land- ing runway, it becomes more and more important to maintain the intended flight path accurately and monitor the aircraft position and energy state. It is obvious that these tasks do increase workload.

During the normal operations of taxi, departure and landing, there is one important thing to reduce flight crews’ workload. As flight crews are instruct- ed to maintain sterile flight deck pro- cedures that demand the omission of any non-essential task while taxiing gear needed to be raised. At the same to be done in order to prepare for an and in flight below Flight level 100, time TCAS was starting to provide Traf- approach. First, the new approach “sterile radio procedures” should be fic Advisories (TAs) and the controller needs to be selected and properly clearly understood by controllers as gave us new clearances and instruc- programmed into the Flight Manage- well. This means refraining from any tions. This was a really dangerous situ- ment System (FMS). The route from non-essential communication to an ation and if I had had the knowledge present position to landing must be aircraft whilst it is in a high-workload earlier, I would have preferred to delay checked and closed if needed. Then phase. Any instruction, plan or infor- take-off until the VFR traffic had gone. the approach aids need to be tuned, mation such as track-miles to go etc. inbound courses and minima set and, should be given to flight crews on Approach and Landing in most aircraft, the approach aids earliest convenience allowing them need to be identified. to pre-plan their actions in good time. As flight efficiency becomes more and Once an aircraft is below 10,000 feet more important, a high priority is as- After this is done, the approach must altitude, ATC communication with that signed to an optimum, continuous de- be briefed between the pilots includ- aircraft should be limited to important scent. For most jet aircraft this means a ing go-around procedures and missed instructions or information only. continuous descent with the engines approach route. The landing perfor- at idle thrust. While prolonging the de- mance must be calculated and refer- However, some situations are simply scent and approach as well as requests ence speeds must be set to complete not foreseeable. Unexpected missed for high speed are taking aircraft to the the approach briefing. At complex air- approaches or abnormal emergen- non-optimum but safe side of the de- ports the runway turn-offs as well as cy conditions can normally not be scent planning, reducing track miles initially expected taxi-in routes should planned. to go or advising a required speed re- be reviewed. duction takes aircraft above their idle- Abnormal and descent profile, effectively facing pilots The whole process of re-planning an Emergency Situations with additional problems. Due to the approach can take up to ten minutes. limited effectiveness of speed brakes, As the descent phase of a flight is not On the day before Christmas in 2011 especially in low speed regime, work- free of any additional tasks, this can my aircraft was approaching a Ger- load increases quite massively when end up in high levels of stress for the man Airport round about midday. The pilots try to fix this problem in the ab- flight crew. Not to mention that ad- weather was a little windy with mod- sence of proper tools for this task. ditional communication with cabin erate icing conditions above 2,500 feet crew might become necessary if the altitude but good visibilities below. If such a shortened flight path is ac- remaining flight time is shortened sig- Due to the reported winds, the First companied by a change of runway nificantly. This issue can also be found Officer as pilot flying decided to con- or approach, workload of flight crew within the European Action Plan on the figure the aircraft a bit earlier than usu- might exceed a safe value. To under- Prevention of Runway Excursions (EAP- al for landing. Passing approximately stand this, we need to see what needs PRE 3.3.2, Appendix C). 2,000 feet on approach we recognised 44

HindSight 21 Summer 2015 79 FROM THE BRIEFING ROOM

Sterile radio procedures (cont'd)

that the No. 1 engine was malfunction- A second important piece of advice is ing. Our first intent was to notify ATC, In any abnormal or not to press or guide a flight crew in perform the required emergency drills unexpected situation, any direction. Under possibly extreme and go on landing the aircraft. workload, the easiest solutions some- the best ATC response is times do not turn up. If flight crews are However, the approach became un- instructed to do something they do not stable requiring us to go around and to let the flight crew fly want, an easy response is simply to say as an immediate consequence we “NO”. However, it is a mistake to rely on received quite a few radio calls, a their aircraft until a safe the ability of a flight crew to say “NO” frequency-change to departure and at any time. It is better is to ask open another bunch of questions from the flight path is assured. questions and at same time separate all controller. Remember! we were flying other traffic to the maximum possible a single-engine go-around into mod- from this aircraft in distress. erate icing conditions on a turbo-prop problems. Only after we had cleaned aircraft. It took a couple of “stand-by”s up the aircraft, engaged the autopilot Conclusion and “we'll call you back”s until we and called the controller back did he were able to sort ourselves out, work instructed us to contact departure for It is self explanatory that a controller through the checklists, get the cabin a second approach. cannot appreciate all the pressing fac- prepared and all the required tasks. tors that are building up a high flight Comparing these two situations, crew workload. The same goes with pi- As a comparison, only about two I have to say, that the handling of the lots, sometimes there is no workaround months ago my aircraft was approach- latter was excellent! He must have a certain request although knowing the ing Vienna runway 34 with the First guessed correctly that workload in this controller is being stressed. But when- Officer again acting as pilot flying moment was simply too high to allow ever one side is recognising the other but this time also on initial line train- any radio communication. This empa- side suffering from high workload, it is ing. From what I judged a completely thy from the controller let us continue generally true that less is better than uneventful approach, he produced a undisturbed, delaying non-essential more. Empathy with and knowledge rather hard landing and bounced the things like information sharing to a about the other side of the ether helps aircraft. After I took control and initiat- later moment when a safe flight-path to understand situations without ask- ed a go around, the controller did ex- was assured. More than just this, his ing and by that supports overall safety. actly nothing at all, He just let us fly the first call was questioning our needs; at aircraft. After we were through about no time he pressed us or disturbed us, As a rule of thumb the following time- 1,500/2,000 feet, he queried whether although it was rush-hour in Vienna. frames should be kept free of any non- we needed any assistance to which I essential radio calls i.e. remain sterile. replied “negative, bounced landing, In any abnormal or unexpected situa- call you back”. His response was “rog- tion, the best ATC response is to let the n During take-off from the moment er, follow standard missed approach” flight crew fly their aircraft until a safe the take-off clearance is issued until which left us free to sorting out all the flight path is assured. passing transition altitude or even better until passing FL100. n While aircraft are approaching an airport, information about the ap- Captain Wolfgang Starke is a Bombardier Dash proach to be expected, remaining 8-Q400 line training Captain with the Air Berlin Group. He chairs distance, possible delay, weather, the Air Traffic Management and Aerodromes Working Group of etc. should be given at earliest con- European Cockpit Association (ECA) and serves on committees for venience but no later than passing FL100. the Vereinigung Cockpit (German Air Line Pilots’ Association) and for n After landing, every radio call should IFALPA. He is an IFALPA representative member of ICAO’s Airborne be delayed until the crew is no lon- Surveillance Task Force (ASTAF). ger using reverse thrust/reverse pitch.

80 Rhythm of the night by Anthony Seychell

Oh, What a night! It hadn’t been par- close to seeing them and hearing the strips showed that someone had not ticularly busy for a Friday. The usual aural STCA alarm. I thought that be- done a proper study of our changed flights on their well-established fore leaving, I should have a word working methods. Work-as-imagined routes, the adjacent ACC constantly with the supervisor about this over- was totally different to Work-as-done. ringing to request direct routings, load situation and I considered writ- the strip-printer nosily clattering ing a report about it. Too many of us People at the sharp end, like ATCOs away printing strips for the re-routing were ending up feeling overloaded and ATSEPs, often have to handle situ- which nobody uses because we are and close to losing the picture after ations where better planning and risk working in a radar environment. All the implementation of the new ros- appreciation by management could routine and soon time to go home ter and, soon afterwards, an airspace have led to improvements in service but before that there was still the reorganisation. I wasn’t quite sure delivery without significantly increas- dreaded band-boxing. Already my that I could have handled the rhythm ing workload. Management should colleague was preparing to close her of the night at the end if I had had adopt a ‘human-centred’ approach sector as her shift ended at 0600. I encountered a contingency situa- when designing, implementing or wasn’t looking forward to her sector tion. operating a system, or managing a being combined with mine. It con- tained the XYZ TMA, which included the major XYZ airport and the smaller ABC aerodrome. The shift roster was Anthony Seychell is an experienced ATM not in tune with the band-boxing safety expert who has both an ATC operational and an ATC because as soon as the sectors were engineering background. He worked previously at Malta Air Traffic combined, the XYZ night-time curfew Services in a variety of posts, the last being that of Safety Manager. ended. By the time my relief came at He joined EUROCONTROL in 2007 and currently works for the ESP around 06.25, there would already where he is coordinator of the Programme to support ANSPs in SMS be several departures climbing out Implementation (SASI) and provides support to other ESP activities. of the TMA while I would also be do- ing the pre-sequencing of the arrivals descending into the TMA. Manage- ment had decided that there was no The Ops Room of our XYZ ACC seems change, i.e. those responsible should need to man the second sector 0600 to have been designed to ensure the consider the people in the system. – 0630; it had something to do with maximum possible discomfort to the Such a ‘human-centred’ approach productivity. staff and to increase the task/work should follow established human fac- load as much as possible. Besides the tors and ergonomic principles. Shaver Ten minutes into the combined sec- poorly-planned collapsing of sectors and Braun1 have defined human fac- tor, I was already feeling that I was at and decreased staffing, it was also a tors and ergonomics as "a scientific my limit and close to losing the pic- noisy place. The single-person opera- discipline whose goal is to optimize ture. The sector was extremely busy tion meant that the ATCO was often the interaction between people and so I told the Coordinator Assistant to distracted from his watch over the the systems they use to enhance safe- answer all calls from the adjacent ACC traffic. The constant requests from ty, performance, and satisfaction. In and refuse all direct routings. Also I the adjacent ACC for direct routings simpler terms, it focuses on designing told him to find a way to silence the meant that the telephone was ring- the world to better accommodate the noisy strip-printer; it was becoming ing (or buzzing) all the time. The strip needs of people". The Human Factors really annoying and a disturbance. printer was a noisy machine and the and Ergonomics Society2 tells us that Finally my relieving colleague arrived fact that it was printing unnecessary human factors and ergonomics are and took over and I could go home.

1 - Human Factors and Ergonomics initiatives make good business sense, Eric F. Shaver and Curt C. Braun, I never had rings on the screen but I Idaho Business Review, January 5, 2009 was sure that at the end I came quite 2 - https://www.hfes.org//Web/Default.aspx

HindSight 21 Summer 2015 81 FROM THE BRIEFING ROOM

Rhythm of the night (cont'd)

the study to help ensure that people’s erations match human capabilities created, organised and run. The staff interactions with technology will be and this maximises the likelihood of members are often the only people productive, comfortable and effec- a successful outcome. It also leads that truly know the intricacies (de- tive. Is the interaction of humans with to a better understanding of people’s tails, complexities) of their task, so systems always productive, comfort- activities, e.g. the tasks that they per- involving them in the generation and able and effective? form, the demands, pressures and operation of a system will help to in- limitations that people face and what crease support for, trust in and adher- These descriptions of human factors motivates them. ence to it. and ergonomics indicate that the ‘human-centred’ approach is not just Another important aspect of the hu- Many of us ar e nowadays familiar with about pleasing the people in the sys- man-centred approach is that it gives ‘safety assessments’, often perceived tem. It also provides an opportunity people ownership, by involving them as some sort of a mysterious rite per- to optimise the system, the perfor- in changes and initiatives. A system formed by the safety juju man which mance of the human and the tasks will be more effective if the people in leads to the pronouncement that our that they have to undertake. The ‘hu- the system have some say in how it is new system as safe and acceptable man-centred’ approach ensures that for our use. But how often is a safety the procedural and technical consid- assessment done for a soft change

82 such as a roster change, a change in work and task load. A good human Back in my days as an ATCO I the remuneration/reward structure impact analysis can materially con- felt that there was a song that or even changes in the staff selection tribute to the effective reduction described our work very well: processes? As we saw in our initial of the work and task load. The hu- The Rhythm Of The Night by the scenario, the band-boxing occurred man-centred approach to change Italian group Corona3. The first when traffic was actually increasing. management brings a number of part of its lyrics went: Was a proper safety assessment of benefits: the task load performed? It is obvi- Rhythm is a dancer, ous that reducing staff and collapsing n Proactive identification of the It's a soul's companion, sectors while the traffic is increasing people affected by the change, People feel it everywhere, may not be a very good idea. Often particularly those in roles that Lift your hands and voices, changes are considered individually have the potential to impact Free your mind and join us, and no assessment is performed at safety; You can feel it in the air, a system level. But this is critical be- n Proactive identification and cause the risks affecting task perfor- prevention of human error as- Although I didn’t dance the air- mance can only be understood if the sociated with a change; craft, I felt that that there was a change in the task(s) is considered in n Reduced resistance to change. certain rhythm in the work and context and thereby fully understood. people felt it, especially the ones Despite all the advances in technol- in the air. Going back to our original scenario ogy and the introduction of more in the ACC, we have already seen that and more automation, the humans The ATC/ATM world has changed the Ops Room was a noisy place. Of- are still the main means of mitiga- considerably since my ATCO days ten we contribute a lot to noise our- tion when our system somehow because ATC is a dynamic busi- selves without even noticing. There fails because they act as key de- ness and traffic is almost always have been cases where the incom- fences to help in controlling the risk. increasing. We are making use ing/outgoing controllers do their Our centre was a busy ACC but the of more and more automation briefing handover at the supervi- amount of traffic was not the cause to handle traffic but traffic is only sors’ desk, the vicinity of which then for the ATCOs’ feeling of overload. one factor affecting workload. becomes a sort of a chat-club with A study would have indicated ‘clas- We need to look more at the hu- each participant contributing that sic’ system failures – the contribu- mans in the system and adopt a little bit more to the noise level. This tion of staffing as the biggest con- human-centred approach so that might naturally induce the ATCOs, tributor to the overload situation we can better understand human especially those choosing to work with the working environment and abilities and limitations. That without headsets and relying solely practices also playing an important will enable us to design systems on the console speakers, to increase part. These human factors problems which optimise the interaction the speaker volume. This then sets severely impacted the human per- between people and other sys- off a viscous circle where the others formance, significantly reducing the tem elements to enhance safety, also raise the volume, people speak ACC’s resilience to failure. Of course, performance, and job satisfac- louder and… a strong reporting culture is an es- tion. sential element of safety culture What about the physical design of and greatly assists in identifying I’m convinced that ATCOs all over the room itself? How user-friendly is problems, reducing their effects the world still feel the Rhythm but the equipment? How difficult is it to and seeking long-lasting solutions. the task of managers and 'safety interact with the console’s computer- In a positive safety culture environ- practitioners' is to ensure that driven system? Lighting, ventilation, ment, staff will be encouraged to the ever-increasing number of heating, humidity? Traffic and its come forward with not only their flights and complexity of traffic complexity are actually only a com- concerns but also suggestions/rec- do not negatively impact ATCO ponent of an ATCO’s workload. It is ommendations for their resolution. workload. well known that a badly designed system significantly increases the 3 - http://www.metrolyrics.com/the-rhythm-of-the-night-lyrics-corona.html

HindSight 21 Summer 2015 83 FROM THE BRIEFING ROOM A-B-C... it should be easy as 1-2-3! How to design a simple, safe and efficient taxiway designation system by Gaël le Bris and Magali Kintzler

Introduction The designation of the taxiways plays 19 for RWY09/27 (the Northern runway a major role in the airside safety. Taxi- now called RWY09R/27L) and from An airside where all users can find way naming should be simple, logi- 20 to 28 for RWY08/26 (the Southern their way easily is a key issue to help cal and intuitive as far as practicable. runway now called RWY08L/26R). The improve the safety of the maneuver- However, many existing airports have connecting and parallel taxiways were ing area and to reduce mental work- only grown through incremental de- designated by adding a suffix to these load for pilots and controllers. The velopment in recent decades and they numbers. For instance, "10" was rapid European Action Plan for the Preven- do not always have a fully harmonised exit taxiway (RET) Y3. "10.1" and "10.2" tion of Runway Incursions (EAPPRI) designation system. were the name of the two segments states that the inherent difficulties of of taxiway DA1 used just after "10" for communicating on the manoeuvring Paris-CDG celebrated its 40th anniver- joining Terminal 1. All the major taxi- area mean that aerodrome design, sary last year. From the opening of the ways not directly related to the run- visual aids and infrastructure naming airport in 1974 to the entry into service ways were divided into portions – for conventions play an important part in of RWY08R/26L in 1999, all the runway example N1 to N13 were defined for reinforcing the intended instructions entrance and exit taxiways were desig- each portions of the taxiways now passed by the air traffic controller.1 nated by a single number: from 10 to called UNIFORM and CHARLIE.

These designations changed to letters 1 - European Action Plan for the Prevention of Runway Incursions (EAPPRI), and numbers on the South side when Appendix B – Guidelines for Local Runway Safety Teams, edition 2.0, ERSI, April 2011, page B5, a second parallel runway was built http://www.skybrary.aero/bookshelf/books/1862.pdf along RWY08/26 in 1999. The taxiways on the North side changed in a similar Gaël le Bris holds two MSc degrees and is Airside Development Manager way when a fourth parallel runway was for Aéroports de Paris at Paris-Charles de Gaulle airport. His work includes built close to the former RWY09/27. managing and coordinating airside development projects. He is also responsible for their Safety Risk Management. He leads aircraft/airport compatibility studies With subsequent developments of and economic and technical benchmarking for his department. theairside and the expansion of Termi- nal 2, other particularities and excep- tions appeared. We lost the simplicity of the initial plan. Many of the mne- monics to help controllers, pilots and Magali Kintzler is an air traffic controller and ATC manager the drivers of the movement area to at Paris-Charles de Gaulle airport. Her work includes coordinating airside precisely and easily locate themselves projects with Aéroports de Paris and informing controllers of changes. ceased to be valid. Consequently, it She is also responsible for runway safety and wake turbulence projects. was time to change the entire desig- nation system to a more coherent and simple format.

84 Working together

A dedicated workgroup of repre- sentatives from the airport operator (Aeroports de Paris) and the ANSP (DSNA) was created to oversee the project. In parallel, meetings were held by each of these entities with their respective acting staff in or- der to involve all airside operations' stakeholders. In particular the air- port operator included movement area drivers in these meetings. They are – a workforce which has a differ- ent perception and perspective of ground movements to that of pilots and controllers, and they must be This collaborative approach is a good taken into account in taxiway nam- practice which met both European ing projects, especially at airports and national2 recommendations. subject to winter conditions. Keep it simple and logical Pilots were involved in the project through their representatives on the The first and main principle followed Local Runway Safety Team (LRST). was to designate infrastructure The general principles and then the elements in a logical manner that modification of the runway exit taxi- was instinctive to both pilots and way naming were presented and manoeuvring area vehicle drivers, discussed at LRST meetings. Details as recommended by the European of the planned re-designation were Action Plan for the Prevention of then sent to the pilots and airline Runway Incursions (EAPPRI)3. This representatives participating in the approach can be summarised into the LRST and the airport Safety Risk "keep it simple and logical" of the U.S. Management (SRM) processes for Federal Aviation Administration (FAA) their comments and validation. in the Advisory Circular 150/5340-18F.4

2 - Dispositions relatives à la dénomination des voies de circulation sur les aérodromes, Notice d'Information Technique, DGAC/DSAC, edition 1, October 2012, p3 http://www.developpement-durable.gouv.fr/IMG/pdf/2-6-NIT_2012-10-23-Denominationvoies_de_circulation-Ed01_signee.pdf 3 - European Action Plan for the Prevention of Runway Incursions (EAPPRI), Appendix K – Aerodrome Design Guidance for the Prevention of Runway Incursions, edition 2.0, ERSI, April 2011, page K3, http://www.skybrary.aero/bookshelf/books/1862.pdf 4 - Standards for Airport Sign Systems, AC 150/5340-18F, Section 4 – Developing taxiway designations, August 2010, pp. 2-3 http://www.faa.gov/documentLibrary/media/Advisory_Circular/150_5340_18f.pdf

HindSight 21 Summer 2015 85 FROM THE BRIEFING ROOM

A-B-C... it should be easy as 1-2-3! How to design a simple, safe and efficient taxiway designation system (cont'd)

The other basics were the following: Specific provisions were made for taxi- Finally, this project provided an oppor- ways at the runway complexes due to tunity to remove unusual designations n The numbering grows from the West the criticality of the vicinity of the take- and deviations from extant standards to the East, and then from the North offs and landings. These taxiways must and the best practices: to the South. be clearly identified for preventing n The letters I, O and X are not used for runway incursions, but also runway ex- n The prefixes "Outer" and "Inner" taxiway designation in order to avoid cursions by differentiating the straight were removed from taxiway ALPHA confusions with 1, 0 and crossing and rapid exit taxiways: ("Inner ALPHA" became A3 in 2011). or closure symbols. This is an ICAO Coincidently, this good practice be- recommendation5, confirmed by the n The runway entry taxiways of the came a European standard in Feb- European Certification Specifications outer runway use a specific letter ruary 2014 when the EASA issued for Aerodrome Design (CS ADR- followed by a unique number for the CS ADR-DSN6. DSN)6. each one e.g. all the entry taxiways n Two non-continuous adjacent but n Two different taxiways cannot have of RWY08R/26L are designated V + different taxiways cannot have the the same name7. a number like – V1, V2, V3, etc. same name7. n A same infrastructure element can- n The same rule applies for the inner n All taxiways and taxilanes must not have two names, except when it runways, but straight (entry) and have a designated name. is a de-icing pad. rapid exit taxiways are designated n An active runway entry taxiway can- with a different letter so as to dis- East-West oriented taxilanes are des- not have the same number as that tinguish them. e.g. the straight ignated GOLF + a number when they of the runway it connects with8. taxiways of RWY08L/26R are desig- lead northward to Terminals 2A to 2G, nated T1 to T12, and the rapid exit but designated PAPA + a number when These rules were applied on the move- taxiways (RET) are named W1 to they lead southward. ment area for naming the taxiways and W6. apron taxiways: n In the case of straight (entry) taxi- North-South taxilanes are designated ways, their designation begins with using FOXTROT + a number. n All major taxiways are designated by a letter which is the same as that of a single letter e.g.: A, B, Q, S. the first parallel taxiway they con- Intermediate holding points (IHP) are n Subsidiary taxiways are designated nect with e.g. the taxiways between designated as TANGO (like "Terminal" or by two letters and a number e.g. GE1. SIERRA and RWY08L/26R are taxi- "Traffic area") + the letter of the apron n Links between two major taxiways ways S1 to S9). in their vicinity + a number e.g. TA1 and are designated using the combined n The letters and the numbers used TA2 when entering and exiting apron letters of the two taxiways plus a for the designation of the two con- ALPHA. number. For instance, links between tinuous taxiways on each side of a taxiways BRAVO and QUEBEC are runway are different. When an intermediate holding point is designated BQ1, BQ2, etc. located on a short taxiway, this taxiway n The taxilanes (taxiways serving an takes the name of the IHP. apron and only used for this pur- pose) are designated by letters and a A de-icing area has the name of the number e.g. GE1. The main taxilanes cardinal point of the airport where it is are called by a single letter and a located (NW, NE, SW, SE) or the apron number e.g. E1. where it is collocated (ROMEO or JULI-

5 - Annex 14 Volume I – Aerodromes, chapter 5 Visual aids for navigation, section 5.4.3 Information Signs, article 5.4.3.36, 6th edition, ICAO, July 2013 6 - CS.ADR-DSN, Chapter N – Visual Aids for Navigation (Signs), CS ADR-DSN.N.785, Issue 2, EASA, January 2015, p137-138 http://easa.europa.eu/certification-specifications/cs-adr-dsn-aerodromes-design 7 - These rules follow or are inspired by the propositions of the IFALPA to the ICAO for taxiways naming convention. 8 - French law "arrêté du 28 août 2003 (modifié le 15 mai 2007) relatif aux conditions d’homologation et aux procédures d’exploitation des aérodromes" so-called CHEA, Appendix A, article I.5.2.3.1, https://www.sia.aviation-civile.gouv.fr/dossier/texteregle/CHEA_A_01_V2.pdf

86 Figure 1: Evolution of the taxiway designations (Northern part of the airport)

HindSight 21 Summer 2015 87 FROM THE BRIEFING ROOM

A-B-C... it should be easy as 1-2-3! How to design a simple, safe and efficient taxiway designation system (cont'd)

ETT). A de-icing pad within a de-icing area Maintenance of this could generate a serious hazard if has the name of the de-icing area + a num- the designation system an unexpected aircraft passed through ber e.g. NW1 to NW4. Because of their par- without clearance. These issues were ticular function and the re-categorisation In addition of complying with the stan- addresses in September 2014 when as part of the non-movement (or traffic) dards and the best practices, the proj- all the links between taxiways BRAVO area when activated, the de-icing pads ect followed a risk-based approach. and QUEBEC were re-designated QB have a specific name even when they are In order to correct any unexpected + a number instead of BQ + a number. co-located with a taxiway. But the two "side effects" of the changes, we put names are not used at the same time. For in place a safety assurance program to This is an example of how the user instance, taxiway BD2 is only called NW1 monitor their efficiency. This proved to feedback and the safety assurance when it is operated as a de-icing pad. be particularly helpful in identifying a can help to improve a naming system need for improvement just after the even after the completion of the pro- Phasing the change changes to Northern taxiways naming. gramme. When designing the project, Here, it appeared that the phraseol- the airside operations community To limit the initial mental workload just ogy at the end of the ground routings wanted something simple and logical after changes to names and to have a to Threshold 27L could be a source of for pilots, controllers and drivers. But practicable plan for the modification, we confusion with the name of taxiways we also envisaged the creation of a ro- phased-in the changes over 4 years. Each used for alignment. For instance, for bust and stable system in which minor phase are performed in a single night to taxiing to Q4 from BRAVO, the con- changes could be easily performed to coincide with an AIRAC cycle date. trollers typically gave the following correct short-term local safety issues. clearance: "taxi N, B taxiway to holding Also, this system should be capable of In September 2011, the Southern runway point Q4". But safety reports showed taking into account the long term in- complex was modified. September 2013 verbal and mental shortcuts which frastructure development with limited was the turn of the Northern runway com- were conducive to understand that further modification. The first years plex and the taxiways around BRAVO, DEL- taxiing was through "BQ4". Because of operational feedback are positive TA and QUEBEC. On the same night in Sep- taxiways BQ3 to BQ6 can be activated about the completion of these objec- tember 2014, the taxiways serving aprons as de-icing pads, it was decided that tives. ECHO, NOVEMBER and INDIA were re-des- ignated. Also, the taxilanes serving apron PAPA, previously without a name, became C1 and C2. Finally, September 2015 will see the completion of this multi-year proj- ect with the modification designations in the vicinity of Terminals 2A to 2G. Preventing the incidents and learning from the recent events The best practices applied to the taxiway naming were selected following a risk- based approach with strong safety assur- ance roots. For example, this is why the let- ters and the numbers of a taxiway crossing a runway are different on each side of this runway. Indeed, clearance misunderstand- ing due to the continuity of a taxiway name on both sides was identified by the Figure 2: Taxiway naming around Terminals 2 from Sept. 2015 (extract) ATC as a possible cause of some runway Blue: aprons / Black: unchanged / Red: old names / Green: new names / Yellow on black: new incursions. designations of the IHP

88 A lack of workload resilience in a non-radar environment by HindSight Editorial Staff

The SKYbrary Accident and Incident Library contains over 750 articles summarising selected accidents and serious incidents which have been independently investigated, each one of which is linked to a copy of the full Official Investigation Report. Some involve controller workload issues, especially high workload relative to the capacity of an individual controller. Here is a short summary of one of these based on the findings of the Investigation. The finding relating to workload and the ability of the controller involved to cope with it based on their experience level and training was accepted as a formal 'Safety Issue' and dealt with by the ANSP involved.

In January 2012, ATC error resulted in was that "processes for monitoring and two aircraft on procedural clearances managing controller workloads did not in oceanic airspace, an A320 and an ensure that newly-endorsed controllers A340, crossing the same waypoint in had sufficient skills and techniques to the Eastern Indian Ocean within an es- manage the high workload situations timated 2 minutes of each other with- to which they were exposed". out the prescribed 1000 feet vertical separation required when there was less than 15 minutes between them. By the time ATC identified the loss of separation and sent a CPDLC message to the A340 to descend in order to re- store separation, the crew advised that such action was already being taken.

The Investigation identified various organisational deficiencies relating to the provision of procedural service by the ANSP concerned. one of which

Flight Plan Tracking of the two aircraft involved (reproduced from the Official Report)

The full article is at: http://www.skybrary.aero/index.php/A320_/_A346,_en-route,_Eastern_Indian_Ocean,_2012_(LOS_HF)

HindSight 21 Summer 2015 89 SKYBRARY SKYbrary download

If you need to find out something about aviation safety, we suggest you go first to www.skybrary.aero. It doesn’t matter whether you are a controller, a pilot or a maintenance engineer, SKYbrary aims to have either the answer you are looking for or a direct route to it.

Definition tion processing requirements fall with- in the capabilities of employees and Working in aviation requires opera- colleagues (i.e. within their memory, If by any chance you can’t find what you tives (pilots, controllers, airside safety, attention and decision-making capa- want, please remember that SKYbrary is etc.) to take in information from a mul- bilities) such that the following are a dynamic work-in- progress which needs titude of sources, assess this informa- minimised: continuous user feedback and benefits from tion, prioritise it, and use it to make user support. Be sure to tell the SKYbrary decisions and take actions. This com- n Failure to see information Editor about any difficulty you may have plete process from sensing informa- n Misunderstanding information had making it work for you. If you can tion (whether it is aural, visual, mental, n Handling the information directly help us by identifying material we kinaesthetic, gustative or olfactory) incorrectly could use or even fill a gap by writing some through to taking action is referred n Forgetting the information. content yourself then please tell us too! to as “human information processing”, n reacting inappropriately We aim to provide wide coverage through or information processing for short. both original articles and, especially, by So, information processing refers to Perhaps more importantly, we should hosting the best of what’s already been the ability of the operator to process understand our own limitations, espe- written so that a wider audience can access the type and amount of information cially during periods of high workload it more easily in one place. within the required timeframe, and to and/or when particular illusions may do so in an effective manner that leads go unnoticed. SKYbrary is also the place where you can to suitable responses. access: Situational Awareness n all the documents of the Flight Safety Need to Know and Information Foundation Operator’s Guide to Processing Human Factors in Aviation Information processing capabilities n the largest collection of selected official vary from person to person, day to day, Our situational awareness is built accident & serious incident reports place to place and task to task. It is par- upon our perception of the world that from around the world anywhere in one ticularly affected by age, health, stress, relies on information attained through place online different environments, workplace our senses. The information available cultures, experience levels, interper- to us includes: flight, navigation and An article taken from SKYbrary is reprinted sonal relationships, distractions, and in engine instruments, primary flight in each HINDSIGHT. For this issue, we have particular, by its own limitations. These displays, radar, TCAS, radio voice com- chosen "Information Processing" limitations can be substantial and will munications, data-link, direct vision, be explained later in this Article. crewmember communication, vibra- tions, noises and smells, and more. It Knowing how our information pro- also includes our mental model of our cessing capabilities can be limited is “plan” of how things are expected to important in designing and delegat- occur, and our prediction of what oth- ing tasks to ensure that the informa- ers’ plans are, and how they may prog-

90 SKY

braryInformation Processing ress. Our perception of the world will Building Blocks of Human be a four-dimensional model. Four di- Information Processing mensions because we retain memory of what has occurred already and we are also able to project forward in time to predict what the situation will be. At any given moment, in three-dimen- sions, the accuracy of our situational awareness depends on how accurate our perception is compared to real- ity. It is possible to be highly accurate, especially in simple and familiar situa- tions. However, our predictions for the future will be, on the whole, less accu- rate, as will our perception in complex and busy environments. We may have a good idea of what will happen when we ourselves make changes, correc- tions and decisions, and this will be based on our experience; however, it is less easy to judge what others will It is accepted that there are at least One major feedback loop exists, where do. Therefore, maintaining situational four stages in information processing: we sense changes that occur due to awareness is a continuous process n sensing our own actions – in this way we are requiring mental effort and it will be- n perceiving able to measure and correct our prog- come vulnerable during periods of n decision-making ress in achieving a task i.e. digitally high workload where our information n motor action, or performing and analogue, e.g. by shooting more processing capacity is exceeded. And, and more accurately towards a bull’s- usually, it is these high workload situa- Supporting these key steps in infor- eye, or by correcting continuously to tions when we need to ensure that our mation processing are various ele- maintain straight-and-level flight, re- situational awareness is as accurate as ments of memory, referred to as sen- spectively. possible. sory memory, working and short-term memory, long-term memory and mo- Another key feedback loop is when tor memory. These are not distinct sec- our mental model of the world, influ- tions of the brain, but it is useful to re- enced by past experiences, drives our fer to the functions that each provide attention: we are looking for evidence as distinct from the others. Another that supports our model – even if it is important building block is the “atten- wrong. tion directing” mechanism.

HindSight 21 Summer 2015 91 SKYBRARY

SKYbrary download (cont'd)

Vigilance and Attention fail to hear the phone ring, or notice for up to 8 seconds. It is these "sensory someone entering the room. In the memories" that allow us to immedi- Vigilance refers to our state of aware- workplace this may also occur when ately read-back a frequency, or recall ness to external stimuli; this state we are fully occupied in dealing with a telephone number long enough to can range from low to high levels of many different inputs e.g. flying an dial it once, but 30 seconds later be un- vigilance. Vigilance might best be de- unfamiliar non-precision approach able to recall accurately. Paying atten- scribed as a positively motivated in- in poor weather at night, we can fail tion to any of these inputs will involve tention to be ready to react to a range to re-tune the navigation aids at the forming a perception and the transfer of inputs. It is an energetic state that appropriate point. This is why some of data into more robust memory. This we can turn-up and turn down at will, systems utilise visual and aural alarms takes effort and involves the decision- but also one which can drop off dur- to break our focus and “grab our atten- making mechanism; in these exam- ing periods of low stimulus, boredom, tion”; it helps that we are particularly ples this may be either continuously fatigue and stress. Our situational sensitive to hearing our own name repeating the numbers (during which awareness will determine how vigi- and call-sign. It is also why pilots and we can process no other information – lant we become and to what external air traffic controllers need to be per- at all) or writing down the information data we include in our scan of aware- sistent in maintaining scans, in which as a record. ness. For example, on a typical flight attention is temporarily broadened deck, pilots need to remain vigilant of such that other critical information Of course at this sensing stage we a whole range of possible data, from can be sensed. Having other team, and can be at a disadvantage if our sight engine, navigation, communication crew, members also allows attention and hearing are attenuated (naturally and other aircraft systems, as well as to be divided between people which or not), and also if our inner ear is af- events occurring outside of the flight can greatly enhance the information fected in any way. This means that our deck. It is just too much for our sen- processing capacity available; this re- perception of the outside world will be sory and perception mechanisms to quires effective planning and briefing. incomplete, or distorted. recognise and make sense of all this As well as external events of relevance information. Which is why we need to vying for our attention, our attention “pay attention” to the most important will always be tempted by loud, bright, Perception stimulus in the moment, and divide moving and proximate events and ob- Perception is the process of converting our attention between various stimuli jects; i.e. we are easily distracted by ir- sensory information into something when there are several important fac- relevance, especially from tasks requir- that makes sense – i.e. creating an in- tors that require our observation and ing applied thought – as anyone who ternal mental model of the outside response. has ever procrastinated will recognise. world. Because we are unable to “col- Also, distraction can be internally gen- lect” 100% of external data (as already Attention is a necessary function if we erated. Internal thoughts about cur- mentioned above) our internal model are to focus on the things that matter rent, past and future events will arise, will be incomplete. However, based on at the right time. Various theories ex- and often these thoughts are totally our previous experiences, we are often ist which explain the mechanism that unconnected with the task at hand. able to make sense of the little data permits multi-tasking, and also the de- Internal distractions are more likely to we receive and create a realistic model gree to which we can or cannot multi- occur when fatigued, stressed or ill. based on our expectations. Much like task. One determinant of whether we the fact that we can easily recognise can multi-task or not is the capacity we Sensing someone’s face from a badly pixilated have for dividing attention between picture; if it’s someone we know, then stimuli. For the most intricate, or unfa- Whether the input is sound, light, our brain literally fills in the gaps and miliar, tasks we usually require full at- pressure, taste or smell, unless we can joins the dots. It is this mechanism that tention and this will result in us being place our attention onto these inputs helps us to divide attention and some- unable to perceive anything else that there is only a short period of time times multi-task. is occurring. E.g. whilst being occupied before the sensation disappears; e.g. in a hobby such as delicate sculpture, visual memory lasts for less than 1 However, the same mechanism can we can become so engrossed that we second, audible (echoic) memory lasts lead us to “misperceive” the world –

92 Information Processing (cont'd) the more we rely on past experiences perceive anything but different tables. Long-term Memory the more our expectations will distort Similarly in figure 2, although we can our perception. For example, a heli- measure each horizontal line and rec- Similarly, the more times data is ac- copter pilot who regularly flies along ognise that they are the same length, cessed in our long-term memory, snow-covered valleys in Norway will it is impossible to shake off the percep- then the more likely we are to be have a mental model of fir trees being tion that they are different. Both these able to recall it when needed. This 150ft tall. If he enters a valley which is illusions have relevance for pilots fact gives support to the method of full of newly planted fir trees he may judging the height, distance and slope training called “over learning”, where fly much closer to the ground than of runways on approach. we repeat a procedure or task many intended as he has misperceived the more times than is necessary just to scale of the outside world. Hence the perform to a satisfactory level. This is importance of cross-checking our per- Working Memory a positive counter-measure to guard ceptions with other data; in this exam- Working Memory is the aspect of our against long periods between training ple – the radalt. memory that we use all the time when and actual performance during live conducting any task. It holds small operations; and gives support to the Another source of misperception con- amounts of data for a very short time, concept of practicing elements of op- cerns how juxtaposed objects within which is to be used immediately. There- erating that have not been performed an environmental setting can influ- fore, we can read-back an Air Traffic Con- for a long time, or at least mentally re- ence each other to create a visual illu- trol instruction to descend and change hearsing or discussing them. sion. Transponder Code and maintain these numbers long enough to enter them Long-term memory can be said to con- into the appropriate systems. Mental sist of three sections, each defined by repetition may be required to achieve the manner in which data is stored – the task, but once completed the in- Semantic, Episodic and Unconsciously. formation is lost within 30 seconds and replaced with the next set of data we Semantic Memory need e.g. setting-up the displays to fa- Semantic Memory is our database cilitate an instrument approach. of facts about things, which is built through repetition and familiarity. We Typically the capacity of our working use the semantic memory to under- Fig 1. Shepard's illusion of equal table top memory is 7 digits +/-2. We can extend stand words, to “do” mathematics and dimensions this by “chunking” digits together into to follow checklists and instructions. meaningful blocks such as a long tele- This does not mean that everything phone number with 12 digits (e.g. 49 stored in the semantic memory is cor- 123 747 8989) can be chunked as shown rect. If we learn an incorrect fact e.g. into just 4 memorable blocks. Chunking Chiang Mai is the capital of Thailand, can also be usefully employed to access then this is what we will answer, in- long-term memory through the use of stead of Bangkok, if someone asks us mnemonics and other tricks, e.g. I al- what is the capital of Thailand? Similar- ways remember the downwind checks ly if we incorrectly learnt and therefore for the De Havilland Chipmunk, even “remember” that we turn the APU on though I haven’t flown one for over 30 before retracting Flaps after landing, years – My Friend Fred Has Hairy Balls then unless we follow the Checklist we Fig 2. Muller-Lyer Illusion – Mixture, Fuel, Flaps, Harness, Hood, are liable to make an error. Figure 1 above displays the exact same Brakes! table but from different perspectives Just because we have meaning and – even after measuring each table The more times that data is used in our facts stored in our semantic memory top and realising they are the same, working memory, then the more likely it does not necessarily mean we can al- it seems impossible for our brain to is to enter our long-term memory. ways recall them, when required. Rare-

HindSight 21 Summer 2015 93 SKYBRARY

SKYbrary download (cont'd)

ly used data can become inaccessible The stages of skill learning can be bro- management. Decision-making in it- unless we happen to be reminded by ken down into four steps [2]: self is an acquired skill, which will not some context i.e. a mnemonic (as al- be covered in depth here. However, in ready mentioned) or something else n unconscious incompetence the context of information processing, familiar, like a sequence of events, or a n conscious incompetence the deciding stage is concerned with familiar experience. This is why when n conscious competence selecting the type of action that best remembering facts it is useful to en- n unconscious competence fits the current task. gage the imagination, other senses and even the emotions[1]. It is in this last stage when the skill The actions we choose can be: becomes “second nature” and we are Episodic Memory able to conduct another task at the n skill-based Episodic Memory contains experienc- same time such as instruct another pi- n rule-based, and es, including knowledge of specific lot to fly. This is because the demand n knowledge-based events; the more vivid, or emotional, on our information processing ability then the more likely it is we will re- for automatic tasks is much reduced. The information processing model member. And, as for all memory, the Whereas if we slip back into the third shows that selected actions are con- more we access and recall certain stage we become aware, once more, cerned with correcting the “outside” memories, then the easier they will of what we are doing, and this uses up world so that we can perceive prog- be to access and recall again in the processing capacity. ress being made in the desired direc- future. A bit like joke-telling! Unlike tion – it is an error-correcting closed factual semantic memory, informa- In effect we all run different dedicated feedback loop. However, if we are tion (stories, if you like) held in epi- motor programmes and motor sub- sensing incomplete or false data, then sodic memory can change with each programmes for a variety of different our selected actions can be error- telling, especially with time. This is skills that “kick-in” when the situation generating[3] (open-feedback loop). because we interpret events differ- demands. Whilst we may rarely make ently depending on many factors, an error in performing these skills, Apart from automatic motor-skills one of which is our expectations of we sometimes initiate an inappropri- responses, our responses will be se- how things were, or should have ate skill, at the wrong time e.g. when quences of conscious actions and been. Inconsistencies between wit- intending to fly an approach to over- communications. It is common in ness reports, for the same event, are shoot (go around) we may find our- aviation for decisions and actions to mainly due to witnesses experiencing selves landing and taxiing back to the be made quickly under-pressure and the same event differently and then terminal. These are referred to as “ac- therefore it is likely that accuracy will layering different interpretations on tion slips”. suffer in place of speed. Therefore, it is top of what they experienced. extremely important in such pressure Deciding and Acting situations to be as vigilant as possible Motor-skills Memory and to purposefully put effort into When we are highly-skilled at a task In the early stages of flying training, raising our situational awareness. This then we can perform seemingly with- focus is on learning and developing will allow speedy anticipation of likely out too much conscious effort. Pe- motor skills to the point that they be- events but also keep our awareness culiarly though, the more we think come automatic. However, as training broad to react appropriately to unan- about “how we are doing it” the less progresses focus broadens to include ticipated events. As Maslow calls it [4] skilful we suddenly become! E.g. a a wider range of skills that require flow, or as we know it from the sports- golfer suddenly losing the ability to judgement, such as, communica- field being in the zone. putt, a maestro playing a difficult pi- tion, problem-solving, procedures, ano solo getting stuck, or a pilot land- decision-making, planning; and also ing in a strong crosswind suddenly skills that require knowledge, such as over controlling. performance, software and systems

94 Information Processing (cont'd)

Multi-task or Manage Related Articles Resources? n Attention Can we or can’t we multi-task? n Decision Making n Human Error Types There is no doubt that humans can n Lessening the Effects of Visual Illusions drive a car and hold a conversation n Managing Somatogravic Illusions Presentation at the same time (we all do it routine- n Memory ly). However, in most circumstances n Memory in ATC we are driving a familiar car along a n Somatogravic and Somatogyral Illusions familiar route, and the conversation n Vigilance in ATM is unimportant (we can stop it any- n Spatial Disorientation time we need to). In these situations n Visual Illusions our mental model can rely a lot on schemata of previous experiences stored in our memory, allowing us References to divide our attention, and perhaps [1] O’Brien, D. 1993. How to Develop a Perfect Memory. London. Pavilion Books re-tune the radio, drink coffee, chat Limited. to our passenger and drive all at the [2] Noel Burch. "Learning a New Skill is Easier Said than Done." Gordon Training same time (not recommended!). International [3] Rasmussen, J. 1986. Information Processing and Human-machine However, we all have a point where Interaction: an approach to cognitive engineering. New York. Elsevier we quickly reach capacity and have Science Ltd. to “dump” certain tasks. When taking [4] Maslow, A, H. 1968. Toward a Psychology of Being. 2nd Edition. USA. D. Van. a detour that requires a bit of map Nostrand Company Inc. reading, the conversation stops, the radio is turned off (to help us con- Further Reading centrate) and we ask our passenger to hold the coffee. We don’t even n Green, R, G., Muir, H., et al. 1996. Human Factors For Pilots. 2nd Edition. have the capacity to think about Aldershot, England. Ashgate Publishing Limited. delegating the map reading to our n Campbell, R, D., & Bagshaw, M. 1999. Human Performance and Limitations in passenger; or, is this our ego talking Aviation. 2nd Edition. Oxford, England. Blackwell Science Limited. – I’ve got it!

Therefore utilising the other avail- able human resources (crew/team) when the workload increases is a skill that needs to be practised and implemented. Sometimes this deci- sion is already made and a standard procedure exists i.e. flying moni- tored approaches. Similarly, when a member of your team/crew is fully engrossed in a critical task they can be helped by picking up other tasks, and should probably not be distracted.

HindSight 21 Summer 2015 95 If you are interested in downloading back numbers of the HindSight collection http://www.skybrary.aero/index.php/HindSight_-_EUROCONTROL

N°1 N°2 N°3 N°4 N°5 N°6 N°7 January 2005 January 2006 June 2006 January 2007 June 2007 January 2008 July 2008

Putting Safety First in Air Traffic Management COMMUNICATION COLLISION WEATHER HINDSIGHT IS A “Hindsight” “Hindsight” The ability or opportunity to understand and judge AIRSPACE The ability or opportunity to understand and judge an event or experience after it has occured. AIRSPACE an event or experience after it has occured. WONDERFUL THING CONFLICT AVOIDANCE “Hindsight” The ability or opportunity to understand and judge INFRINGEMENT an event or experience after it has occured. By Tzvetomir Blajev “Hindsight” DETECTION “Hindsight” DETECTION THE RUNWAY AND YOU Coordinator - Safety Improvement Initiatives, The ability or oportunity to understand and judge The ability or opportunity to understand and judge “Hindsight” and Editor in Chief of HindSight. an event or experience after it has occured. A WEATHER an event or experience after it has occured. The ability or opportunity to understand and judge WORKLOAD By Ian Wigmore an event or experience after it has occured. WORKLOAD “Hindsight” See page 22 GHOST STORY “With the benefit of hindsight I would Win a free trip for two to Paris: See page 22 GHOST STORY The ability or opportunity to understand and judge THE APPLICATION OF have done it differently”. See page 26 IS AIRSPACE PENETRATION an event or experience after it has occured. By Prof. Sidney Dekker OFFSET TRACKS By Prof. Sidney Dekker How often do we hear responsible people If we learn the right lessons we will stand with your colleagues - think what you AN ATC PROBLEM OR NOT? ANOTHER SUNNY DAY IN SWEDEN See page 8 saying these words? Often,it is an attempt a much better chance of reacting correct- would do if you had a similar experience. IN EUROPEAN AIRSPACE to disguise the fact that they had not ly when we are faced with new situations We hope that you too will join in this See page 3 BY BENGT COLLIN prepared themselves for some unusual where a quick, correct decision is essen- information sharing experience. Let us WORKLOAD A STRANGE CONCEPT BY ROLAND RAWLINGS situation. Yet hindsight is a wonderful tial.This magazine is intended for you, the know about any unusual experiences See page 5 NEW! CASE STUDY: thing and can be of great benefit if used controller on the front line, to make you you have had – we promise to preserve BY PROFESSOR SIDNEY DEKKER See page 8 intelligently to prepare ourselves for the know of these lessons. It contains many your confidentiality if that is what you SeeSee pagepage 66 “THE FIRST OFFICER IS MY unexpected. There is much to be learnt examples of actual incidents which raise wish. Working together with the benefit from a study of other peoples’ actions - some interesting questions for discussion. of HindSight we can make a real contribu- MOTHER-IN-LAW” good and bad. Read them carefully - talk about them tion to improved aviation safety. Front Line Report By Bengt Collin by Bert Ruitenberg By Bengt Collin The Briefing Room Editorial 121.5 - Safety Alerts SeeSee pagepage 1616 Learning from Experience Hindsight is a Wonderful Thing 1 Avoiding Action Phraseology 4 Runway Incursion 8 50 YEARS AFTER MUNICH EUROCONTROL Safety New Clearance Related Loss of Separation 11 WORKLOAD VERSUS BOREDOM Enhancement Business Division 2 to Levels 4 THE HUMAN FACTOR COLUMN See page 39 Controlled Flight Into Terrain 13 BY BERT RUITENBERG About HindSight 3 Aircraft Turn Performance LOSS OF SEPARATION BY PROFESSOR SIDNEY DEKKER BY BERT RUITENBERG Early Turns 5 Unauthorised Penetration See page 7 Acronyms used in This Issue 24 of Airspace 15 See page 7 See page 7 Undetected Simultaneous THE BLIND SPOT The Editorial Team 26 Transmission 5 Wake Vortex Turbulence 17 See page 15 AIRBUS AP/FD TCAS MODE: Contact Us 27 Hand-over/Take-over of Runway Excursion 19 Operational Position 6 INVESTIGATINGINVESTIGATING CONTROLLERCONTROLLER Disclaimer 28 Level Bust 21 NEAR COLLISION A NEW STEP TOWARDS GET YOUR Feedback 22 BLIND SPOTS The Phonological WHAT? RUNWAY INCURSIONS - AT LOS ANGELES SAFETY IMPROVEMENT SKYbrary POSTER SeeSee pagepage 2020 See centre page See page 25 IT WILL NEVER HAPPEN TO ME ... BY DR. BARRY KIRWAN By Paule Botargues SeeSee pagepage 1212 See page 18 See page 25

European Air Traffic Management - EATM

EUROCONTROL DAP/SAF January 2005 EUROCONTROL DAP/SAF January 2006 EUROCONTROL DAP/SAF June 2006 EUROCONTROL DAP/SSH January 2007 EUROCONTROL DAP/SSH June 2007 EUROCONTROL DAP/SSH January 2008 EUROCONTROL DAP/SSH July 2008

8: winteredition’09 “Hindsight” the ability or opportunity to understand and judge an event or experience after it has occurred.

EUROCONTROL HindThe ability or opportunity to understand and judge an event or experience after it has occuredight09 EUROCONTROL EUROCONTROL HindThe ability or opportunity to understand and judge an event or experience after it has occuredight10 HindThe ability or opportunity to understand and judge an event or experience after it has occuredight11 HindThe ability or opportunity to understand and judge an event or experience after it has occuredight12 Hind ight Are you responsible Level Bust... Airspace Infringement - Runway excursion Production for safety? or Altitude Deviation? again?! Putting Safety First Pressure Controllers and pilots teaming up in Air Traffi c Management to prevent runway excursions Clashing moral values p08 by Captain Bill de Groh, IFALPA © European Organisation for Safety of Air Navigation (EUROCONTROL) January 2009. By Professor Sidney Dekker

This publication has been prepared by the Safety Improve- ment Sub-Group (SISG) of EUROCONTROL. The authors acknowledge the assistance given by many sources in the Next please p15 Some hidden dangers preparation of this publication. By Anthony F. Seychell of tailwind The information contained herein may be copied in whole or in part, providing that the copyright notice and disclaimer by Gerard van Es are included. Safety & the cost killers p16 The information contained in this document may not be To see or not to see modifi ed without prior permission from EUROCONTROL. By Jean Paries A letter to aviation prosecutors Level Busts: cause or consequence? by Bert Ruitenberg The role of ATM in reducing The views expressed in this document are not necessarily those of EUROCONTROL. by Tzvetomir Blajev by Professor Sidney Decker the risk of runway excursion The consequences of p23 EUROCONTROL makes no warranty, either implied or ex- Let’s get rid of the bad pilots by Jim Burin pressed, for the information contained in this document; nei- commercial pressure can be fatal ther does it assume any legal liability or responsibility for the I separate therefore I am safe The ‘Other’ Level Busts by Professor Sidney Dekker accuracy completeness and usefulness of this information. By John Barrass by Bert Ruitenberg by Philip Marien Airbus altitude capture enhancement Air Traffic Controllers do it too! to prevent TCAS RAs Lesson from (the) Hudson by Loukia Loukopoulos by Paule Botargues by Jean Paries CND January ’09 Winter 2010 Summer 2010 * Piste - French, 1. (ski) track, 2. runway Winter 2011 Summer 2009

EUROCONTROL EUROCONTROL HindThe ability or opportunity to understand and judge an event or experience after it has occuredight17 HindThe ability or opportunity to understand and judge an event or experience after it has occuredight18

Safety versus Cost

Production and safety are not opposites by Professor Sidney Dekker

Defining a Compliant Approach (CA) A joint response to enhance the safety level of approach Justice & Safety and landing by André Vernay

A new just culture algorithm by Professor Sidney Dekker Is justice really important for safety? by Professor Erik Hollnagel Cash is hot and safety is not 'Human error' - the handicap of by Captain Rob van Eekeren human factors, safety and justice by Dr Steven Shorrock

Summer 2013 Winter 2013

In the next issue of HindSight: Safety nets

EUROCONTROL

Putting Safety First in Air Traffic Management

© European Organisation for Safety of Air Navigation (EUROCONTROL) June 2015

This publication has been prepared under the auspices of the Safety Improvement Sub-Group (SISG) of EUROCONTROL. The Editor in Chief acknowledges the assistance given by many sources in its preparation.

The information contained herein may be copied in whole or in part, providing that the Copyright is acknowledged and the disclaimer below is included. It may not be modified without prior permission from EUROCONTROL.

DISCLAIMER The views expressed in this document are not necessarily those of EUROCONTROL which makes no warranty, either implied or expressed, for the information contained in it and neither does it assume any legal liability or responsibility for its accuracy, completeness or usefulness. This edition is printed in 5500 copies