Also in this issue:4 Interview Prof. James Reason 4 New York Hudson River Collision

INTE

R-NA

TIONA

L FEDERATION OF AIR TRAFFIC CONTROLLERS’ ASSNS.

THE CONTROLLER

Journal of Air Traffic ControlDecember 2009

4 SPECIAL SAFETY

Bidding Roster Planning OJT Planning Check In BreakPlanner

Leave Planning Duty Swapping StatusChecker Check OutFlow from A-Z

Staff Planning Made Simple

Contact : Integra - Michael Silau - oms@integra.dk - +4522666120

The Traf�cPlanner provides �ow managers with a perfect overview of the future traf�c situation.

The Traf�cPlanner calculates the workload impact for each working position, based ontraf�c load and complexity calculations. Adjustable parameters such as weather conditions,�ight data, military activity and con�ict detection are calculated and analysed by the system.

The Traf�cPlanner features intuitive traf�c monitoring in an easy-to-use layout, featuring:

Developed by Air Traf�c Controllers

Traf�cPlanner

Traf�cPlanner

Contents

THE CONTROLLER

DISCLAIMER: The views expressed in this magazine are those of the International Federation of Air Traffic Controllers’ Associations (IFATCA) only when so indicated. Other views will be those of individual members or contributors concerned and will not necessarily be those of IFATCA, except where indicated. Whilst every effort is made to ensure that the information contained in this publication is correct, IFATCA makes no warranty, express or implied, as to the nature or accuracy of the information. No part of this publication may be reproduced, stored or used in any form or by any means, without the specific prior written permission of IFATCA.

VISIT THE IFATCA WEB SITES: www.ifatca.org and www.the-controller.net

In this issue:

Photo:Looking for safer skies.

Photo credits:dvmsimages/dreamstime

December 20094th quarter 2009 Volume 48 ISSN 0010-8073

Also in this issue:4 Interview Prof. James Reason 4 New York Hudson River Collision

THE CONTROLLER

Journal of Air Traffi c ControlDecember 2009

4 SPECIAL SAFETY

PUBLISHERIFATCA, International Federation of Air Traffic Controllers’ Associations.

EXECUTIVE BOARD OF IFATCA

Marc BaumgartnerPresident and Chief Executive Officer

Alexis BrathwaiteDeputy President

Alex FiguereoExecutive Vice-President Americas

(Henry Nkondokaya)Executive Vice-President Africa/Middle East

Raymond TseExecutive Vice-President Asia/Pacific

Patrik PetersExecutive Vice-President Europe

Dale WrightExecutive Vice-President Finance

Scott Shallies Executive Vice-President Professional

Andrew Beadle Executive Vice-President Technical

Jack van DelftSecretary/Conference Executive

EDITOR-IN-CHIEF

Philippe DomogalaEditorial address: Westerwaldstrasse 9D 56337 ARZBACH, GermanyTel: +492603 8682email: ed@ifatca.org

Residence: 24 Rue Hector BerliozF 17100 LES GONDS, France

DEPUTy EDITOR AND WEB SITEPhilip Marien (EGATS)

CORPORATE AFFAIRSKevin Salter (Germany/UK)

REGIONAL EDITORSAfrica-Middle East: Mick Atiemo (Ghana) Americas: Doug Church (USA) Phil Parker (Hong Kong)Patrik Peters (Europe)

COPy EDITORSPaul Robinson, Helena Sjöström, Stephen Broadbent, Brent Cashand Alexis Brathwaite

PRINTING-LAyOUTLITHO ART GmbH & Co. Druckvorlagen KGFriesenheimer Straße 6aD 68169 MANNHEIM, GermanyTel: +49 (0)621 3 22 59 10email: info@lithoart-ma.de

Foreword by Alex Figuereo .……..……………….….…………......… 4 Editorial by Philippe Domogala ……………………….…………......... 5

Obituary .……..……………….….…………...........…………………........ 6Safety Safe or Unsafe – the Multimillion Dollar Question?

by Marc Baumgartner …...................……………………………..... 7 The Blame Culture in Italy by Bruno Barra .…..............………...... 8

Safety in Russia by Eduard Kolodnyy .…....................................... 11 Safety Management Systems by Drazen Gardilči .....................… 12

NOSS – Normal Operation Safety Survey by Dr. Chris Henry ..… 14 JAL907 – 8 Years Later by Scott Shallies .............…..................... 16

Norwegian air traffic controllers praised for safety culture .......... 17 SKYbrary by Alexander Krastev ...…..........................................… 18 Are we too good? by Bert Ruitenberg ......................................... 20 Stop Bars and IFATC A by Raimund Weidemann ......................… 22 Interview with Prof. James Reason by Philippe Domogala .......… 26Americas News Argentinean Safety Seminar by Alex Figuereo .......................... 21 MERCOSUR Single Sky and OACTAM by Alex Figuereo ......… 21 The Hudson River (New York) Collision by by Doug Church ..... 30Books Review The Human Contribution (James Reason) …............................… 23

Aspects of Oral English Communication in Aviation (Franz Rubenbauer) ................….................................................. 23

Runway Safety Runway Safety Deficiencies by Capt Heriberto Salazar .......... 24European News Functional Airspace Blocks in Europe by Patrik Peters ....... 28Asia Pacific News Target Level of Safety, Keeping On Target

by John Wagstaff ……….……........................................ 29SES/SESAR Fairy Tales and Legends by Marc Baumgartner ...............… 32

Africa News Safety Management Systems by Mick Atiemo ................ 34 Charlie‘s Corner ……….……....……………..........….........…........… 35

THE CONTROLLER4

Foreword fromthe Executive BoardSAFETY: Air Traffic Controllers Involvement Absolutely Necessary

^ by Alex Figuereo, EVP Americas

ICAO Assembly 32 (Resolution A32-11) es-tablished the ICAO Universal Safety Over-sight Program (USOAP), which involves regular, compulsory, systemic and harmo-nized safety oversight in the Contracting States. The 1997 World Conference of Directors approved the implementation of this program when necessary as a part of a “Global Strategy for the Safety Over-sight”; this was accepted as an important part of the future program.

Assembly 35 approved the continuity and expansion of USOAP during 2005 to in-clude all ICAO Annexes (Resolution A35-6). This Assembly resolution further directed the Secretary General to ensure a compre-hensive systems approach that maintain as core elements the safety provisions con-

Foreword

tained in Annex 1 _Personnel Licensing, Annex 6 _ Operation of Aircraft, Annex 8 _ Airworthiness of Aircraft, Annex 11 _Air Traffic Services, Annex 13 _ Aircraft Acci-dent and Incident Investigation and Annex 14 _ Aerodromes to make all aspect of the auditing process visible to the Contracting States.

During the last 4 years the ATM commu-nity have adopted several projects to im-prove safety, such as the Global Aviation Safety Roadmap (GASR) which has been produced and developed by the Industry Safety Strategic Group (ISSG) that includes well known stakeholders such as CANSO, IATA, IFALPA and others, but does not in-clude air traffic controllers. Regionally, we have in Americas, the Regional Aviation

Safety Group-Pan-American (RASG-PA) with little involvement from air traffic con-trollers. Why is this?

In defining safety, ICAO Document 9859 says: “Safety is the state in which the risk of harm to persons or property damage is reduced to, and maintained at or below the acceptable levels through a continuing process of hazard identification and risk management”. Air traffic controllers and IFATCA have been identifying risks and hazards within the global ATM commu-nity, advising the aviation world on what is needed to improve safety in the Air Traffic Services. That is why we should be includ-ed more actively in projects such as GASR and RASG-PA. Air traffic controllers have always been at the forefront of promoting safety.

I had the opportunity to review the pre-liminary results of the USOAP of some Latin-American and Caribbean countries, specifically in the Air Navigation and Air Traffic Control Organization and most of the deficiencies, hazards and risks deter-mined as the result of the Safety Over-sight have been the same our Member Associations have claimed for years due to the lack of involvement of controllers in the decision making process locally and regionally in the development of a Safety Culture. However, there are countries such as United States, Dominican Republic and Cuba that are exceptions. These countries have included controllers and ATC ex-perts on the improvement of their whole national Safety System and the results of their oversight program (in Air Navigation, specifically) have been amazing. All states should follow the lead of these countries and make sure that their air traffic control-lers are included in all safety projects. We need to accept that as members of a com-munity, we are all in this together. ^

evpama@ifatca.org

Air traffic controllers have always been at the forefront of promoting safety.

4 Alex FiguereoPhoto: DP

Editorial

5 THE CONTROLLER

cle by David Learmount in the “Flight Global Magazine” said: “Unless there is a dramatic improvement between now and the end of 2010, then this decade will become the first since the second world war when global air-line safety rates did not improve.“

He asked if we have reached the point of diminishing return, where safety is now as good as it going to get? He concluded by saying that pilots were victims of a new disease called “automation addiction“, that pilots were becoming over-reliant on automated systems.

Could the same be true for air traffic control? Are we, in ATC, much safer than we were, say 20 years ago? Or are we, just like the pilots, pressed to move more and more aircraft, closer to one another (RNP, RVSM, etc) and relying on automation and automated tools like TCAS and STCA for the safety part?

In this issue you will read many comments from various sources on how to maintain and improve safety. All are worth spending the time reading.

There is also an exclusive interview of Prof James Reason on pages 26 and 27.

We can see we still have a lot to learn be-fore we can say we are one of the most safety – related professions.

Enjoy this issue and be safe out there…^

ed@ifatca.org

Philippe

If you ask anybody on the street they will tell you that air traffic control is a very safe-ty – related occupation, if not one of the most. This is the general public perception of our profession. But what is safety for us? Ask any controller around to define “Safe-ty”, and you will see that almost everyone answers differently. There is in fact no agreed definition of safety. As Prof. James Reasons said: “Safety is a term defined more by its absence than its presence.“

We have devoted this whole issue to safety – to ATC related safety to be more precise. Because while doing research for this theme I made a strange discovery: I wanted to in-clude articles and interviews on different perceptions of Safety from other industries, like oil exploration, maritime, nuclear power plants, etc. The reality I discovered is that no one really wants to discuss their own Safety with an “outsider”. I find this a real pity be-cause I am sure there certainly are things to learn from them. I was told for instance that the oil company SHELL has a zero accident policy. This is quite different from our 10 to the minus 7, 8 or 9 we apply in ATM.

Also while researching, I was surprised to read in a recent EASA document (*) that with TCAS, the probability of a mid-air collision is 2.7x10-8 per flight hour due to the identified deficiencies within the cur-rent version 7.0 software, which translates to one accident every 3 years. How can we claim to be safety conscious if we accept such parameters? (The European Safety Agency also concludes this is unacceptable and is proposing, like ICAO, to mandate a new version 7.1 to reduce those numbers.)

We also see that the accidents are back. Since 2007 the accident numbers are on the rise again, and we had a concentration in the first 6 months of 2009.

In a recent speech (**), Capt. Rory Kay, Safe-ty Chairman of US ALPA, referring to an arti-

EditorialIs Air Traffic Control Safe?

^ by Philippe Domogala, Editor

Are we, in ATC, much safer than we were, say 20 years ago?

Photo Credit: DD

^ A very “safe” controller.

(*) EASA NPA 2009-03 on TCAS available on www.easa.eu.int(**) August 6, 2009 – Capt. Rory Kay closing speech at the 55th ALPA Air Safety Forum. Video

of the speech avail on: www.alpa.tv/ALPAChannelPlayer.

Henry P. Nkondokaya IFATCA Executive Vice-President Africa Middle East

˚15 July 1955 ✝ 6 September 2009

Henry P. Nkondokaya, Executive Vice President Africa Middle East died sud-denly on 6 September 2009. It is dif-ficult to put into words the shock one feels at the sudden death of someone with whom you are working closely and with whom you are making plans for the immediate and long-term future. It is all the more crushing when you admire that person so much for who he is and what he represents.

Henry, a gentle man, a disciplined, thoughtful soul, had so much more to give, to his family, his association and country and to IFATCA. At his reelection at this year’s annual conference Henry expressed how proud he was that the Africa Middle East Region was now the largest in IFATCA. Henry understood what IFATCA meant for the future of air traffic controllers, especially those within the region he represented so admira-bly. He therefore committed himself to not only representing the needs of his region within IFATCA and the global aviation community, but to also build the capacity of his region to be able to continually speak for itself. He knew that numbers alone were not enough, so he worked hard at finding like-minded committed people to ensure the realiza-tion of the promise of IFATCA that he so clearly saw and fully embraced by mak-ing the tremendous sacrifice to serve at the level of the executive board.

Henry was clearly a humble man, but once you had a conversation with him you immediately recognized his good nature and his respect for his fellow man. He was a thinking man, who con-sidered all options and all views, ready to support and enact what he believed to be the best course of action. Above all, he strived to act with integrity; while he most definitely sought the best for his members and for air traffic control-lers generally, he was always fair and did not expect that controllers within his region or any controller for that matter

OBITUARY

was owed something simply because he was a controller.

This is a sad time for IFATCA; this is a difficult time for our family. We have lost one of our own when he was most ac-tive, when we least expected, when we are least prepared for it. As colleagues of Henry on the executive board, it will be very difficult to immediately carry on without him. The executive board extends to Henry’s family and relatives our heartfelt condolences. Through the many years of working with Henry, we have come to respect and care deeply for him. We therefore can experience only but a hint of your loss. We ask that you take some comfort in the knowl-edge that Henry is one of those rare persons whose influence extends be-yond the area in which he was born and

lived. His influence extends throughout Africa and the Middle East and into the global aviation community. His influence will extend beyond his life and for a long time to come. We thank you for sharing Henry’s goodness with us.

To the members of the Tanzania Air Traffic Controllers’ Association and the Tanzanian Civil Aviation Authority we also express our condolences and thank you for the support that you provided to Henry so that he could do this job that he evidently loved doing to the best of his ability. We share with you the loss of a colleague, a friend and an exemplar.

Henry P. Nkondokaya we will miss you; we will be poorer for your passing; we are better because you have lived. May your gentle soul rest in peace. ^

Photo: DP

ticle entitled “safety was 16 today”. Safety measurement is a science and it is reactive and serves (in the new business world) to determine the per-formance bonuses of our ANSP CEO’s. ICAO recommends a safety management approach. CANSO asks for a changed business model where liberal-ised and economical perform-ance will assist improvements to safety. Eurocontrol pro-poses a new methodology to bring us a step further in pre-dicting and shaping the safety outcome with an Aerospace Performance Factor. So let us, as IFATCA, remain on the fore-front to be among the poten-tial winners in safety, by con-tinuing to educate, influence and participate in shaping the safety discussion.

Oh, and by the way, did I for-get to mention: 100% of lottery winners did buy a ticket! ^

pcx@ifatca.org

So, if safety is a ‘non event’, why do we see it as the ‘holy grail’, our multimillion lottery ticket? Or does achieving safety give us the same thrill as when we buy a lottery ticket? Are we perhaps imagining what we would do with the gain?

Moving away from the art of air traffic con-trol to the science of air traffic management with its increased automation will we be buy-ing lottery tickets to keep the dynamic non-event’s sufficiently in line with mathematical models? Will this justify investments in future technology to keep us all ‘safe’? For quite some time, this has been the question for me. Can we actually develop models, ap-proaches, information and/or communica-tion campaigns preparing our profession and our industry for the next step of automation? Do we understand the approach to increase the intricacies of a set of systems which will reach levels of complexity which are currently unknown in our working environment?

Recent publications by researchers like Dekker, Hollnagel, Reason and others are as-sisting in understanding what is at stake and providing us with a scientific approach to what we are doing and what will be done. We are currently in the transition period towards a safety management process. It is very help-ful as it explains our activity and its related risk in a focused way. But the question still remains on how to manage your winning lot-tery ticket ahead of the potential gain?

In the quest to improve the dynamic non-events, we are not alone. Bert Ruitenberg, our Human Factors specialist, wrote an ar-

4 Safety

THE CONTROLLER 7

Safe or Unsafe – the Multimillion Dollar Question?

^ by Marc Baumgartner, President and CEO IFATCA

Photo: © Maria

Adelaide Silva/

dreamstime.com

Setting the ThemeAll aviation professionals try to be the winner in safety. However, in most cases, we only find out our safety score after the event!

Aviation has the highest safety record per km travelled. But, how is it that safety is still a ‘fuzzy’ concept? Why is it that nobody can tell what is safe and predict a safe outcome with the same certainty that we know the sun will rise or set?

Many readers will not agree with me, espe-cially all the aviation professionals, and in particular air traffic controllers. Safety is not really predictable and we struggle to define safety precisely. There are indeed commonly developed and accepted definitions, e.g. ICAO talks about ‘the condition in which the risk of harm or damage is limited to an ac-ceptable level’.

Safety is of course a very serious issue, es-pecially when we are talking about air traffic control. The longer we try to define it, create it and defend it as the basis for our profes-sion, the more it is like buying a lottery ticket. At least, for me, every time I buy a lottery ticket I see myself as a future multimillion-aire. It is only following the lottery draw that I know whether buying a ticket was worth-while. Establishing what is safe or the con-struction of safety follows a similar pattern. All the professionals will try to be a 100% winner, something only the future can tell!

The safety outcome is not predictable, and only is measurable once the event has passed. Weick has defined safety is a ‘dy-namic non-event’. However, from an intellec-tual point of view, how can a ‘non-event’ be ‘dynamic’? According to Weick, it is dynamic because processes remain under control due to the continuous adjustments, adaptations and compensations made by the human ele-ments of the system. It is a ‘non-event’ be-cause “normal” outcomes claim little or no attention. The paradox is rooted in the fact that events claim attention, while non-events, by definition, do not.

Does achieving safety give us the same thrill

as when we buy a lottery ticket?

because the procedures were not followed carefully and breached”.

Contrary to the earlier trials, where – based in ANACNA’s opinon on an inadequate and deceiving technical consultancy – the ground controller’s personality and alleged incompe-tence were focussed on, this verdict did not question his experience, skill and profession-alism. The appeal did however confirm the controllers’ sentence owing to one identified fault: the pilot reported a sign which did not appear on any map and was therefore un-known to them and the controller. The Su-preme Court of Cassation stated that “…no pilot, in normal conditions and knowing where he/she was, would have communicated such a report to the Tower…” In the given circum-stances (a position report that didn’t make sense, not being able to physically see the air-craft and without ground radar), the controller should have realised the dangerous situation: “he only had one possibility and one duty: to immediately stop the airplane … until the po-sition had not been identified”.

We have to ask ourselves whether it is possible that

someone, who the Court itself believes to have elevated professionalism, behaved in such a grave, negligent and imprudent man-ner. Furthermore, not considering the con-tinuous attempts to steer public opinion

towards blaming a single person, what proved to the Supreme Court that this call was so clear to the controller that

4 Safety

THE CONTROLLER8

The Blame Culture in ItalyTwo Accidents and Subsequent Convictions Illustrate Severe Shortcomings

^ by Bruno Barra, President ANACNA (Italy Controllers Association)

The Supreme Court ruled that while the con-troller operated with adequate professional-ism, he lacked the ability to “imagine” that the CESSNA was on the wrong taxiway, with-out radar and no visibility (fog). This unjust outcome appears to be largely the result of the outdated Italian justice system, not hav-ing implemented European and ICAO just culture regulations.

The Courts’ full motivation takes up around 200 pages. Focussing on the part of the con-troller, the judges stated: “it is possible that at the base of the accident, more concurring clauses can be identified to identify the hu-man errors combined by the controller and the Cessna pilots, the lack of ground radar and the misleading signals…on the R6 taxi-way”. Similar to what the judges underlined in the appeal with regards to “the existing procedures at Linate for aircraft movement in the airport area and in take off position were adequate and functional” and that “the accident did not occur because of the application of inadequate procedures, but

Linate Accident

On 8 October 2001 an SAS MD87 collided on take off on the runway in Milan Linate airport with a German Cessna Citation 500 taxiing. All oc-cupants of both aircraft and 4 on the ground were killed (118 persons). The Citation pilot took a wrong taxiway, crossed the active runway stop signs and penetrated the runway. Visibility in the fog was 50 to 100m and the airport was operating as CAT 3. The Citation pilot was only CAT 1 qualified. No ground radar was available. (source ansv,

report available on: www.ansv.it)

The Italian Supreme Court con-firmed an earlier ruling of the Milanese Appeals Court: the ground controller on duty that day was sentenced to three years imprisonment. Seven others from various organiza-tional levels in ENAV (Air Navi-gation Service Provider) and SEA (Airport Handling Agent), were also convicted. No one from ENAC (Italian Civil Avia-tion Organization) was found guilty, contrary to the outcome of earlier trials.

Photo: ENAV

against useless criminaliza-tion and automatically open-ing of judicial procedures against pilots, air traffic controllers and other staff responsible for flight opera-tions. Many others, such as the President of NTSB, the Flight Safety Foundation, IFATCA and IFALPA have made similar statements.

• The motivation for the fi-nal sentence appears to be equally inadequate, from the just culture principle sup-plied by Eurocontrol: “a just culture is defined as one in which front-line operators or others are not punished for actions, omissions or deci-sions taken by them that are commensurate with their experience or training, but where gross negligence, wil-ful violation and destructive acts are not tolerated”. The Court itself did not question the controller’s experience and professionalism. Cer-tainly, the fact that he did not perceive something that is outside of norms and op-erational procedures as an alarm signal cannot, surely, be considered gross negli-gence or wilful violation;

• Italy’sbreachofcontractandits insufficient “legal system”, along with its inadequate cul-ture, are also highlighted in the 2006 ICAO audit and in Eurocontrol’s 2006 and 2008 Performance Review Reports (PPR)

experts on flight se-curity defined as “the dangerous category of the ‘self-refer-enced experts’, who, without having ever followed a specializa-tion course like those of accident investiga-tors for each of the various fields of civil aviation (operations, maintenance, air traf-fic control, training, meteorology etc.).”… [These] ‘technical con-sultants’ of the many ‘ambitious’ public prosecutors present in Italian justice [system], invent thesis and theories of accusation for “front line op-erators” that, due to bad luck, committed (according to their point of view) “errors” where they do not exist, or at least, they are not grave faults, nor international vio-lations, but simply (and not always) simple human errors to evaluate according to the “Human Factor” techniques, and not in a tingling hand-cuff manner. (Captain Renzo Dentesano in ANACNA Convention on April 6th 2006)

Issues in the trial that followed this accident, have according to ANACNA, certainly not been comforting.• Inthefirstdegreejudgement,thedecision

was, as mentioned above, mainly based on the sometimes inconsistent and contradic-tory evaluations expressed on what hap-pened from the same technical consultant who assisted the Public Prosecutor, and who then assisted the Substitute General Prosecutor in the appeal. The court, then, did not take into account the observations of consultancy of other parts in the trial.

For ANACNA, we can see a verdict that did not take into account accepted just culture principles:• From the preliminary investigation, the

trial violated what was contained in the European 94/56/EC and 2003/42/EC reg-ulations. ANACNA reported the lack of segregation between the technical/admin-istrative investigation and judicial one (see also recommendations AIG ICAO), as well as deficiencies in the role and competence of the investigators;

• ConsideringthattheCourtofAppealbe-lieved the controller to be adequately pro-fessional, the motivation for sentencing him appears to be in complete contrast with ICAO recommendations, which advises

4 Safety

THE CONTROLLER 9

it had to at least presented a warning to him? Quite honestly: nothing! The controllers’ de-fence proved the unreliability of the evidence presented throughout, even using phonetic analysis. But to no effect. It is amazing that the Supreme Court did not even comment on this information in their final judgement.

Some superficial arguments would not have manifested themselves, according to us, if the Court of Milan, during the preliminary investigations and the first degree trials had relied on their objective, independent ex-perts (as is customary). Instead, they relied on the narrative of a single consultant, cho-sen by the public prosecutor.

Some important considerations:• Thissingletechnicalconsultantwasapro-

fessional pilot and a member of ANSV (Ital-ian Safety Agency). Both the ANSV initial report and the technical one for the public prosecutor were very similar, as they were written from the same point of view. Based on this, ANACNA forwarded a complaint to the European authorities.

• Complexcases like these require special-ist technical expertise. With such a central role, it is essential for this expertise to be completely objective.

• With this inmind, seriousdoubtsare jus-tified: specialized competencies are re-quired for each of the particular sectors involved. Therefore, there is a need for experts, preferably belonging to profes-sional orders or associations, who have documented technical experience in their field.

• Themagistrate’s auxiliary consultants are“trial subjects” and they certainly cannot be confused with professional experts such as pilots and controllers.

• The SAFREP (safety reporting) task forcehas reminded member states - in agree-ment with the 2003/42/EC Regulations - to employ only resources with a specific investigational and analytical competence for a surveillance and technical investiga-tion, in order to be able to properly evalu-ate the dynamics of an event. Recently, the European Commission made the respons-es given to public consultation promoted in the months of January - March 2007 public. These were proposals to modify the regulations 94/56/EC and 2003/42/EC and even in this context, the indication that investigators of air traffic incidents must be trained and have the correct ability to per-form this difficult profession sharing simi-larities in all European Countries.

• A list of specialists that have a sole Euro-pean certification would, perhaps, avoid what one of the nation’s most qualified

4 The tail of the OE-FAN.

4 Safety

THE CONTROLLER10

The Cagliari Accident

On 24.02.2004, an Austrian Cessna Citation 500 (OE-FAN) collided with the top of Monte Sette Fratelli at 3300 ft, 18 NM before Cagliari airport while performing a visual approach at night. All 6 occupants died. The pilot, initially cleared for an instru-ment approach, reported the field in sight and requested a visual approach. The control-ler replied “Confirm able to maintain your own separation from obstacles, Sir, perform-ing visual APP runway 32?” The pilot replied “Affirm”. (ANSV final report available on www.

ansv.it)

On March the 17th, 2008, Cagliari court sentenced the two controllers on duty to 3 years imprisonment (reduced to 2 years due to the choice of reduced procedure). They also had to pay 75,000 Euros in civil damages and trial expenses. This sentencing created awe and drew reactions from eve-ryone in aviation circles in Italy. Main argument for the verdict was the authorization, even if requested by the pilot, for a visual approach at night “with-out supplying the pilot with all the necessary information on the orography* of the land.”

Photo: ENAV

2) the sole objective of the technical inves-tigation is to draw lessons that allow to prevent future accidents and incidents. The analysis of the event, the conclusions and the safety recommendations should not be aimed at establishing errors or at evaluating responsibilities.

So for an Investigation Agency such as ANSV to collaborate with a public prosecutor could well point technical reports towards estab-lishing errors and identifying responsibilities.

This verdict did not take into any consider-ation ICAO and EU community regulations regarding just culture.

From the beginning, this trial appeared to be an exaggerated attempt to criminalize pro-fessionals who operated with diligence. The behaviour of the controllers that day was in accordance to the technical rules and regula-tions in force at the time in their unit.

• Theexaggeratedseverityofthesentencehas confirmed the lack of Italy’s institution-al will to conform to ICAO and European directives which aim at encouraging the development of a just culture and the crea-tion of a punishment risk free environment. It does not focus on the faults of compo-nents of the system (those responsible for front line operations), but it aims at guar-anteeing an exhausting and regular inter-exchange of matters regarding safety.

• Noneoftheabovementionedinstitutions(ENAC, ANSV, ENAV, AMI) responsible for guaranteeing fight safety, have performed the necessary clarifying technical role in this matter, supplying explanations regard-ing the procedure to follow when a pilot’s request of a night visual approach.

• MorethanoneyearafterpublicationofEUdirective 2003/42/CE, still no intention was apparent to introduce a reporting system (mandatory and voluntary).

*Orography (from the Greek όρος, hill, γραφία, to write) is the study of the forma-tion and relief of mountains and can more broadly include hills, and any part of a re-gion's elevated terrain. ^

brunobarra@ymail.com

The controllers had followed the technical rules and regulations they had. This was also testified by the courts’ experts. The “topo-graphical information on the land’s orogra-phy“, which the controllers omitted to com-municate to the pilot, are part of additional conditions relevant night visual approaches. They were issued by the former D.G.A.C. of the Ministry of Transport, to all Italian airports and by extension to Italian airlines companies. They specify the applicable con-ditions in which the pilots can safely perform a visual approach at night in Italy.

The evidence highlighted that those addi-tional conditions were not present in the ATC technical regulations in Cagliari, nor were they ever brought to the attention of the controllers. The convicted controllers scrupu-lously applied what was in their manual re-garding visual approaches at night, as one can see in the transcript. ANACNA thinks that the Italian Safety Agency (ANSV) did not fulfil its institutional duty of verifying the real causes at the origin of this accident, avoiding doubts regarding eventual technical causes.

Even considering that the investigation re-port and its safety recommendations should not, in any case, apportion blame, ANACNA believes that the lack of a conclusive report by ANSV on the true causes of this accident, along with clearly specifying the real re-sponsibilities of the controllers, would have helped the magistrates to better understand the ATC technical norms.

Confusing the technical, administrative with the judicial one has probably influenced the ANSV investigation, seeing the fact that the sentence given, and its motivations were es-sentially based on a different interpretation of technical norms that regulate the ATS services

On this, it is necessary to recall that ANSV du-ties and finalities are in complete contrast with the EU Regulation 94/56/CE, which specifies:

1) as it is the state’s organism who is in charge of the investigation, its investigators must have absolute independence and autono-my in order to avoid any conflict of interest, pressures or interventions from any other party whose interests may enter in conflict with the mission assigned to them;

at Rostov-on-Don. My center is situated in the south of Russia and occupies a very large terri-tory extending to 1100 kilom-eters East to West and 1000 kilometers South to North. There are 14 sectors in the center and we use a system installed by the Spanish com-pany “Indra”. Now we use pro-tocol OLDI with Ukraine and hope to do it with Turkey soon. Over the Black Sea RVSM is now in use. There are many air traffic controllers who have studied English language in Great Britain and USA. I hope that by the 2014 Winter Olym-pic Games in Sochi, we will use all the advanced procedures in our center and I am sure that the controllers in Russia are able to provide the necessary level of safety now and in the future.^

kolodnyi@mail.ru

The problem of getting English language proficiency still exists, but it’s not as critical as before. A bigger problem, one that we don’t immediately know how to solve, is the con-troller shortage: it’s probably time to improve pay and conditions in order to retain existing controllers and attract new colleagues.

Implementation of new procedures such as, RVSM, RNAV, ADS-B, OLDI, airspace struc-ture and classification, radar vectoring, etc is dragging on and people are getting tired of waiting for them. At the same time, new and updated documentation has to make it trough the many levels of bureaucracy, which quite often, doesn’t work.

But, no matter what, air traffic controllers in Russia continue to provide a level of safety not worse than in other countries all over the world. And I’d like to emphasize, that these problems are of a temporary nature and not the fault of our air traffic controllers!

We are going to get over all difficulties and we hope to do it as soon as possible.I can say, that Russia recently:• startedtomodernizeandconsolidateATC

centers;•builtnewATCcenterinMoscow;•isimprovingthestructureofroutesandin-

troducing new straight routes;•isestablishinganewnavigationandairtraf-

fic control equipment;•finally,hasfinishedcivil-militaryintegration

and cooperation. It looks as if we’re start-ing to speak the same language.

All of this has a positive effect on safety. It’s very difficult to write about safety in Russia when to get to Vladivostok from Moscow you need 9 hours flight, but I’d like to say a few words about my Area Control Center

4 Safety

THE CONTROLLER 11

Safety in RussiaSome Concerns, but Improvements on the Way

^ by Eduard Kolodnyy, ATC Instructor of Training Center Rostov-on-Don, Russia

Safety in aviation – it’s something the whole world strives for, but, unfortunately, we nev-er get 100% result: the only way to achieve it is to stop all flights.

Russian media are very quick to accuse air traffic controllers in an accident or incident. They conveniently forget that safety was not assured before flight: terrorists on board, air-craft maintenance issues and/or pilot compe-tencies and so on. In any case, I would like to be responsible only for providing separation and information to the pilots.

So, what kinds of difficulties do we face pro-viding safe air traffic services in Russia? To start with, we still operate in meters. Only in Kaliningrad and Rostov-on-Don FIR to cross over the Black Sea, we use feet and RVSM. Pilots seem ill-prepared for flying in regions where we use the metric system as it is still a source of many level busts.

A second problem is that most airports in Rus-sia basically have only one runway. This can make it quite challenging to find a suitable al-ternate airfield for a modern large airliner in a non-standard, or even emergency, situation.

Our separation minima haven’t been revised for decades. For example, the longitudinal separation minima between the two aircraft at the same flight level must be 30 kilom-eters (16 miles), instead of 5 or 10 miles like all over the world. If it’s less, a level change is the only solution.

4 Controllers in Russia. Photo: Ed. K.

4 Aircraft at Arkhangelsk airport.Photo: sukhoi

son back in the 1980’s. He proposed that in-cidents and accidents do not occur in a vac-uum. In other words, the ultimate “culprit,” say in a controller operational error is not just the controller, but usually the whole organi-zation that allowed that controller to get into a position where an incident occurred in the first place. Now don’t get me wrong. I am not saying that controllers are completely blameless in operational errors and that their organizations are responsible. All the “organizational accident” concept proposes is that controllers (or pilots for that matter) don’t make errors in a vacuum. They are part of a system, and as part of that system they cannot necessarily be the only guilty party when something goes wrong. Consequently, proper incident investigations need to look at organizational or systemic issues as a mat-ter of principle.

Environment & DefenceWhat is that system one may ask. Accord-ing to Reason, it begins with the highest management levels of the organization. The executives in the organization make man-agement decisions and put organizational processes in place to allow the operation to be carried out. These management decisions and processes create a set of working condi-tions. Within this environment, workers in the normal discharge of their duties make errors and engage in violations. (Yes, violations. You know those shortcuts you take even though you know they are not right?)

In order to minimize the impact of these er-rors and violations, defences are put in place by management. These defenses consist typ-ically of measures using technology, or train-ing or regulations. In spite of these measures, accidents or incidents pass through these filters (defences) and result in incidents like mine or worse, in accidents.

This means that the controller or pilot’s dis-charge of his/her duties is only the last link in an organizational process. In other words, the controller or pilot error at the end of the chain is most often the result of an organizational process that allowed the last line of defence to be broached. Any error or violation needs

4 Safety

THE CONTROLLER12

Safety Management SystemsICAO Sees Errors as Part of a Bigger Picture

^ by Drazen Gardilči, ICAO

It is often said that there are two types of controllers: those who’ve had an operational er-ror, and those who will. Unfor-tunately, I’m one of the former. When I was still an en-route radar controller I let an airplane go into the next FIR at the co-ordinated altitude but at the wrong fix. Fortunately, there were no other aircraft involved.

RoutineOur routine was pretty well established: one airway was inbound the other outbound. It all worked well for me until the day when a general avia-tion jet tracked to our normally inbound fix after take-off. The departure controller had given the pilot a clearance to the in-bound fix. No doubt about it, as the last controller talking to that aircraft, I should have

caught it. But I didn’t. I was busy, talking to many other airplanes, coordinating, whatever. I didn’t.

After the incident, I was pulled off the boards and given administra-tive duties. The incident was inves-tigated and dissected; the usual suspects were rounded up. In the end, it was determined that I was the only guilty one. Everyone else was clean. They gave me intensive remedial training, told me to pay closer attention to the route on the strip, to ensure proper coordina-tion, and not to do it again. I was then given a new check ride which I passed, and I was back to work in a week. End of story right?

Easy Way OutWell, in retrospect I think, “not quite.” Looking at the incident now with my Safety Management Systems (SMS) mind in place, I think the process of finding me guilty was the easy way out. Further, and more critical, the situation or environment that allowed my operational error to occur was left in place. This “latent” situation continued to exist to nab another unsuspecting controller in the future. Like me, other controllers had the system rigged against them. Rigged to fail and point the accusing finger to the last link in the event chain, in this case the controller. It is a tribute to controllers’ skills that more errors don’t occur in places like that.

As they say, “that’s the way it was.” Back in the (not so) old days, accident and incident investi-gations were geared to find the “who” before anything else. But those investigations were seldom interested in finding out the WHY and the HOW. Prime aim was to hand out the ap-propriate sanctions and move on. It’s only when the concept known as the “organizational acci-dent” evolved, that things began to change. This idea of the organizational accident forms a cornerstone of the SMS approach to safety.

ReasonThe “organizational accident,” is a postulate developed by a professor named James Rea-

The process of finding me guilty was the easy

way out.

Photo: DP

This concept will be very tough to implement. The notion of the organizational accident, the idea that management share the responsibility for operational errors when ap-plicable, the concept of a just culture, the idea of the protec-tion of sources of information, etc, are proposals that may re-quire a generational change to become realities. But we must start somewhere. A journey of a thousand miles begins but with one little step.

Mr. Drazen Gardilčić, is an air traffic controller with over 22 years of experience in the FAA and nearly 5 years with ICAO. He also hold an FAA license as a multi-engine, commercially rated IFR pilot and FAA Air-frame and Power-plant mainte-nance technician's licenses. ^

DGardilcic@icao.int

operational error: why did clearance delivery give the aircraft the route, why did the air-craft request a direct to the inbound fix and why was it given a clearance to the inbound fix? Why was this shouted across the con-trol room instead of coordinated properly? Why did the assistant controller coordinate the aircraft at a fix that was not the outgoing fix? And why did I not see that the aircraft was going out the wrong fix? All these were “working conditions” engendered by our training and tolerated by the supervisors in that control room.

I am not trying to provide easy excuses for controller errors, my own included; I am simply trying to illustrate how an SMS ap-proach may have worked on an incident that I experienced. Even though I made the error, it could be argued that the manage-ment system at my facility had a part to play by allowing to exist in that control room an environment (working conditions) that was not conducive to the optimal provision of air navigation services.

Next Generation?All this aside, I firmly believe that the ICAO requirement to apply the SMS concept to the provision of air navigation services is a huge step in the right direction. If properly implemented, controllers can only benefit. On the other hand, we need to be realistic.

4 Safety

THE CONTROLLER 13

Safety Management SystemsICAO Sees Errors as Part of a Bigger Picture

to be looked at in the context of the system in which the pilot or controller is operating. This is the concept of the “organizational ac-cident” and forms the anchoring concept of the SMS now being required by ICAO.

Systematic ApproachAs it can be deduced from the foregoing, maintaining a safety level and ensuring that the same incident or accident does not oc-cur again is not satisfied simply by the in-vestigation of accidents and incidents after they occur. The emerging approach to safety management proposes to look at the organi-zation behind the operation. Normal day-to-day operations need to be monitored in order to identify trends that could lead to incidents or accidents. This is the core of the Safety Management Systems concept. The SMS concept constitutes a systematic ap-proach to the management of safety by serv-ice organizations. At its core, SMS maintains an acceptable level of safety performance based on a continuous process of hazard identification and risk analysis. When neces-sary, mitigation measures are defined and implemented. A SMS is a continuous process that never ends.

Systemic IssuesGoing back to my operational error, there were a number of systemic issues behind the handling of this aircraft that resulted in my

… may require a generational change to

become realities.

Photo: Gaute Bruvik/Avinor

itly, aware of a wide range of issues regard-ing operations within their airspace. When it comes to generating action and change, how-ever, the opinions of a group of people do not always provide the same catalyst as objec-tive data. ANSPs have reported that having issues documented in an objective manner has greatly enhanced their abilities to make improvements towards those issues.

NOSS can identify threats within the operat-ing environment - Many safety data streams tend to be “error-centric,” while neglecting the threats that can potentially lead to er-rors and safety breakdowns. Any effective means of reducing errors requires attempts to modify the environmental conditions that can contribute to errors. While safety managers often respond to errors in a reac-tive manner, it may be possible to manage threats that controllers must deal with more proactively. Put another way, safety manag-ers must deal with errors and events after they have already transpired. Threats, on the other hand, reflect the working conditions controllers deal with daily, and may be sub-ject to interventions or mitigation strategies in a more proactive manner, thus making life a little easier for controllers.

Strengths or Best Practices Because NOSS gathers data during routine operations, it is possible to gather informa-tion on positive aspects of system and con-troller performance. This information is useful in two ways. First, it informs an organization of what they are doing well thus allowing them to direct their limited safety resources elsewhere. Second, the best practices which are identified can be spread – to other con-trollers, facilities, and ANSPs. A nice exam-ple of spreading best practices focuses on

4 Safety

THE CONTROLLER14

NOSS - Normal Operation Safety Survey An Implementation Update

^ by Dr. Chris Henry, Scientific Advisor of the University of Texas to the ICAO NOSS Study Group. Edited by Bert Ruitenberg, IFATCA HF Specialist

The Normal Operation Safety Survey (NOSS) is a tool for the collection of safety data dur-ing normal ATC operations. In the past, the ATC industry has largely relied on post-hoc in-vestigation reports to further its understanding of safety. While rich in information, these reports only capture rare events, and are reactive by nature. NOSS aims to inform an organization about safety matters by using trained ATC staff from within the or-ganisation to take a structured look at normal ATC operations. This process allows identifying safety deficiencies in a proactive manner. NOSS can also help the exporting of best practices to other parts of the organization.

NOSS is premised on the Threat and Error Management (TEM) Framework, which frames human performance from an operation-al perspective by simultaneously focusing on the environment, as well as how controllers respond to that environment. TEM pos-its that threats and errors are part of everyday operations and must be managed by control-lers in order to maintain safety margins.

NOSS is envisioned to be a pe-riodic safety program. Obser-vations are typically limited to a 2-3 month period, after which the data is verified during the data cleaning roundtables and a

report is produced. The data within this report can be used as a standalone or in conjunction with other sources of information to imple-ment safety change. The focus of NOSS is the larger system as opposed to the individual controller, which means that NOSS provides information that can feed multiple areas in-cluding training, procedures, airspace design, and equipment design. The effectiveness of these changes can be monitored through oth-er SMS sources and more fully assessed dur-ing a follow up NOSS, which is recommended approximately three years subsequent to the initial NOSS.

NOSS Deployments & FindingsTo date, NOSS has been deployed in Aus-tralia, Canada, Finland (limited trial), New Zealand and the United States, with future deployments being discussed in numerous countries. The following section highlights some noted areas of contribution as report-ed by the participating ANSPs:

NOSS provides an objective data source that serves as a check to other sources of informa-tion – In many cases, NOSS findings have sub-stantiated and complimented already existing sources of information. Specifically, NOSS has validated incident trends while at the same time providing another level of detail by highlighting some of the behaviors and is-sues leading up to the incidents. Additionally, numerous ANSPs cited the benefit of NOSS as an objective source of information. Many ATC staff are at least implicitly, if not explic-

4 A380 taking off.Photo: eads

the more pervasive threats experienced by controllers which resulted in the installation of noise dampening panels.

Degree of Transference of Training to the LineTraining and jeopardy check situations as-sess whether training concepts have been learned and ensures that controllers have the capability to perform their duties. These formal assessments, however, may not be re-flective of normal operating practices when controllers often adopt practices that differ “from the book.”

Understanding of ControllerShortcuts and WorkaroundsAs a result of experience, controllers devel-op shortcuts and workarounds to work more efficiently. These shortcuts frequently involve contraventions of procedures, and are sel-dom seen during checks/audits, where per-formance is typically “by the book.” Through a trusted process such as NOSS, it is possible to observe such shortcuts and workarounds. Some may be deemed as effective and can be communicated to others within the or-ganization as a “better way of doing things.” Poor shortcuts and workarounds that have shortcomings in their safety assumptions can also be identified and addressed.

Facilitate Information exchange with Airspace UsersCurrently, more than 50 airlines from all over the world have conducted the Line Opera-tion Safety Audit (LOSA), which is the flight operations equivalent of NOSS. The com-mon use of a similar methodology and the TEM framework has enhanced the informa-tion shared between several ANSPs and major airspace users on the challenges they present to one another’s operations.

IntangiblesMany Service Provisers who have conducted NOSS have reported benefits outside of the changes that occurred as a result of the report and data. These benefits have ranged from the experiential effects of individual observers who initiate discussions and grassroots change efforts within their working group based on

4 Safety

THE CONTROLLER 15

NOSS - Normal Operation Safety Survey An Implementation Update

vulnerabilities that have consistently been identified surrounding position relief brief-ings. During a NOSS, one workgroup was found to have particularly effective brief-ings due to the procedures and practices employed by controllers in that workgroup. These procedures and practices have been adopted throughout that facility, and have since been spread to other facilities where position relief briefings have been identified as a vulnerability.

Feedback on the Quality and Usability of ProceduresIf for example 5% of observed controllers do not follow a particular procedure, there may be a problem with those particular controllers. If, however, 50% of controllers do not follow a particular procedure, the problem most likely resides with the procedure. The procedure may be poorly understood or timed, or may be a poor fit for the operating environment. Poor adherence rates can identify problem-atic procedures or procedural drift.

The data and contextual information pro-vided by NOSS has also led to procedural change in matters including provisions for a data assistant or the splitting of sectors, let-ters of agreement to reduce coordination, and protocols for the release of equipment for maintenance.

Equipment and Workspace InteractionsNOSS has highlighted a number of issues per-taining to the equipment and workspace used by controllers. For example, at several ANSPs where frequent, spurious conflict alerts oc-curred, controllers responded to such alerts in a very casual manner thus reducing the effec-tiveness of the tool in the event of an actual conflict. NOSS has also identified problems more specific to the physical workspace in which controllers work. At one ANSP, control-lers were having difficulty reading information from parts of the radar display due to glare. As a result, special lighting was installed on the affected operating positions in an effort to reduce the glare problems. The NOSS re-sults at another ANSP indicated that noise within the operations room floor was one of

What makes NOSS unique:1. Over-the-shoulder obser-

vations with clearly defined stop rules during normal shifts

2. Joint management / con-troller association support

3. Voluntary participation4. De-identified, confidential,

and non-disciplinary data collection

5. Systematic observation instrument based on the Threat and Error Manage-ment (TEM) framework

6. Trained and standardised observers

7. Trusted data collection sites8. Data verification process9. Data-derived targets for

safety enhancement10. Feedback of results to the

controllers

Only a data collection method for monitoring safety in normal ATC operations that meets all ten characteristics mentioned above can use the name NOSS. (Source: ICAO Doc. 9910).

what they observed to larger organisational benefits related to creating mechanisms to uti-lize safety information to enact change. Perhaps the most en-couraging intangible benefit was highlighted by the presi-dent of a controllers association who stated that NOSS helped create the trust within the or-ganization that was necessary to undertake other efforts such as a Just Culture Program.

More information about the NOSS methodology is avail-able in ICAO Doc. 9910 – Nor-mal Operations Safety Survey (NOSS). This manual is a com-prehensive “How to..” guide that addresses all aspects of the preparation, execution and follow-up of a Normal Opera-tions Safety Survey. ^

henry@nosscollaborative.org

4 TWR Air traffic controller at work.

Photo: Gaute Bruvik/Avinor

Unjust Culture?Our concerns are of course summed up by the term “Just Culture”, or unfortunately in this case, the lack of it. IFATCA has defined Just Culture as: A culture in which front line operators or oth-ers are not punished for actions, omissions or decisions taken by them that are commensu-rate with their experience and training, but where gross negligence, wilful violations and destructive acts are not tolerated. Matters such as the JAL907 case, where aviation professionals are subject to criminal prosecution, are against the spirit and intent of ICAO Annex 13, Aircraft Accident and In-cident Investigation. The sole purpose of an accident/incident investigation according to Annex 13 is the prevention of similar occur-rences. Clearly, bringing criminal charges against controllers who were acting within the bounds of their experience and train-ing does nothing to aid prevention. In fact it quite evident that criminal prosecutions are a barrier to open and successful investigations. As ICAO itself notes in the introduction to At-tachment E to Annex 13: “The protection of safety information from inappropriate use is essential to ensure its continued availability,

4 Safety

THE CONTROLLER16

JAL907 – 8 Years Later

The Aftermath of this Highly Publicized

Safety Event

^ by Scott Shallies, IFATCA EVP Professional

Back in 2005, my predecessor as EVPP, Doug Churchill wrote an article for The Controller titled “The JAL Case… Four Years Later”. Well, a further four down the track, it is time to again review what is hap-pening in this important case.

The EventFirstly, to recap the event itself: on the 31st of January 2001 there was a near mid-air colli-sion between two Japan Air-lines aircraft over Yaisu, Japan (west of Tokyo). Eighty-eight passengers and twelve cabin crewmembers were injured. Charges were laid against the two Air Traffic Controllers on duty on the grounds of pro-fessional negligence. There have been a number of legal proceedings since that time, in 2001, 2005 and more recently

last year, whereby the High Court, which revised the origi-nal not guilty verdict of the Tokyo Dis-trict Court, found the controllers guilty of negligence. Our Japanese colleagues have appealed this decision to the Japanese Su-preme Court and we are still awaiting the outcome of this.

The Follow-upThroughout this saga, IFATCA and IFAPLA have cooperated in a number of actions to raise the professional concerns that both organisations have about the legal pro-ceedings. Earlier this year, I had the privi-lege to participate in a number of events in Tokyo in conjunction with the Japanese Association and an IFAPLA Board member. Presentations were made to a representa-tive from the Supreme Court, the Police Agency, the Transport Safety Bureau and the Civil Aeronautics Board to express our concerns about the legal proceedings and the adverse impact they will have on avia-tion safety.

The sole purpose of an accident/incident investigation according to Annex 13 is the

prevention of similar occurrences.

4 Artist's conception of the near miss.Photo: Wikipedia/GNU

preme Court be perceived as a enlightened body, cognisant of the ICAO requirements for incident and accident investi-gations being for the purpose of prevention, not prosecu-tion? We certainly hope so, for the good of our colleagues who live under the continued threat of prosecution and loss of liberty and for the good of aviation safety in Japan. Or will another dark chapter be writ-ten in this unfortunate saga?

I know that you all join with me in wishing our colleagues well, and letting them know that the thoughts of all controllers are with them. ^

evpp@ifatca.org

chain of events. The single lapse by a human within that chain is a consequence rather than a cause of the systemic failures”.

Missing the PointPunitive action against any individuals in this or similar cases will NOT help develop SAFETY in the local or global aviation community. There was no intent to cause harm, no wilful violation of rules or procedures and no gross negligence in this matter. There was a failure of system safety nets to prevent the event unfolding as it did. There is an opportunity to learn from this, to improve, to make things SAFER. Prosecut-ing individual air traffic controllers for a simple human error is NOT improving safety.

Such punitive action is detrimental to the full, open and honest reporting of safety matters, including human error. Such punitive action does NOT fit the global aviation communities understanding and expectations of JUST CUL-TURE. A culture in which front line operators or others are not punished for actions, omis-sions or decisions taken by them that are com-mensurate with their experience and training, but where gross negligence, wilful violations and destructive acts are not tolerated.

VerdictAnd so for now, we continue to wait. Wait to hear the verdict of the Supreme Court, wait to hear the fate of our fellow control-lers, and wait to see how the Supreme Court decision will be perceived in the international aviation community. Will the Japanese Su-

4 Safety

THE CONTROLLER 17

JAL907 – 8 Years Later

The Aftermath of this Highly Publicized

Safety Event

since the use of safety information for other than safety-related purposes may inhibit the future availability of such information, with an adverse effect on safety. This fact was rec-ognized by the 35th Assembly of ICAO, which noted that existing national laws and regula-tions in many States may not adequately ad-dress the manner in which safety information is protected from inappropriate use”.

Complex ChainWe know that mistakes and errors in the air traffic control environment are rarely caused by a single element. We also know that the Accident Report into the near miss gave a number of contributing factors to the cause of the incident; these including pilot’s actions, controllers’ actions, controllers’ operational procedures, lack of proper training for the controllers, and lack of definitive procedures for pilots to follow after a TCAS RA. No com-plex, dynamic system can ever be completely fail-safe. In order to improve system safety, with the emphasis on prevention, all contrib-uting elements need to be closely examined. Directing blame to any one system com-ponent at the outset, is not appropriate, or productive. As we noted in our press release issued in January this year “From the current research of highly respected safety experts, it is now accepted that in high reliability organi-sations that demand a high level of safety, hu-man lapses are a normal part of the system; system failures, however, are not solely due to a single action. System failures are due to sys-temic problems that emanate from a complex

In cooperation with Eurocontrol and the Uni-versity of Aberdeen, Avinor, (the ANSP of Norway) recently carried out a survey of its own safety culture - two years after the previ-ous one. Workshops were carried out to verify and expand on the responses given at the air traffic control centres in Oslo and Stavanger. A preliminary report shows clear progress follow-ing targeted efforts in the last two years, which included a nationwide campaign at towers, air traffic control centres and in technical regions.

The actual campaign has consisted of the safety staff at ANS visiting all the units around the country. Through meetings with the air traffic controllers, air traffic controller assistants, engineers and local unit manage-

4 Tokyo ACC. Photo: Hiro Tade

Norwegian Air Traffic Controllers Praised for Safety Culture

ment, everyone was given a presentation on safety culture and human factors as a basis for creating awareness, understanding and a commitment to continuous improvement of safety through development of a sound safety culture, says Knut Skaar, CEO ANS.

Dr. Barry Kirwan, head of Safety Research at EUROCONTROL, believes the results of the survey reveal a high degree of trust be-tween co-workers, and between employees and the management in the entire organisa-tion, which is a precondition for further im-provement. He adds that the ANS division in Avinor is in the process of achieving a best in class safety culture compared to other serv-ice providers in Europe. ^

4 AVINOR safe and happy controller.

Photo: Gaute Bruvik/Avinor

Alerts issued by EUROCONTROL, or access a growing bookshelf of reference documents, including accident & serious incident reports. SKYbrary provides coherent links from knowl-edge articles to direct behaviour influencing applications like e-learning modules, videos, posters and presentations.

Beyond ATCSoon, it was obvious that the knowledgebase needed to reach beyond the air traffic control community: the aviation system as a whole could benefit from such a repository, which is why all hazards and safety risks associated with commercial air transport operations, not just air traffic management, were put in the focus of the content development.

The SKYbrary initiative rapidly gained the support of both ICAO and Flight Safety Foundation, which was crucial for enhanc-ing credibility as well as for providing access to existing knowledge. The partnership was subsequently extended to include the UK Flight Safety Committee and the European Strategic Safety Initiative led by EASA.

While SKYbrary is useful for anyone interested in aviation safety, the content development efforts mainly target three major groups:

•Operations – air traffic controllers, pilots,ATC operations line mangers, chief pilots, operational experts

•Safety–safetymanagers, incident investi-gators, flight safety officers, safety experts, safety regulators

•Training–trainingexperts,instructors.

PortalsThe initial main focus of SKYbrary, i.e. opera-tional issues (i.e. risks) of concern to the SISG currently covers 14 principle categories: Airspace Infringement, Air-Ground Commu-nications, Bird Strike, Controlled Flight into Terrain, Fire, Ground Operations, Human Factors, Level Bust, Loss of Control, Loss of Separation, Runway Excursion, Runway Incur-sion, Wake Vortex Turbulence and Weather.

4 Safety

THE CONTROLLER18

SKYbraryA Single Entry Point to Aviation Safety Knowledge

^ by Alexander Krastev, SKybrary Content Manager

The Need for an Aviation Safety Knowledge BaseHow often do we hear people say in the aftermath of an ac-cident “This is a known issue”? Well, the fact that accidents continue to happen indicates that important information is not always readily available to those who need it at the time they need it. How easily can a pilot, a controller or a safety manageer find information on a specific problem? Where can he/she find examples of inci-dent and accident reports, ad-vice on best practices, answers to particular questions, train-ing material, or links to other information sources?

Most aviation organisations publish their own journals and documents on their websites but don’t link very well to other sources. How can we ensure that our collective knowledge and experience is shared and globally accessible to anyone in-terested in it? Furthermore, how

can we ensure that the knowledge helps shape behaviour and promote best practice?

A “One Stop Shop” for Aviation Safety KnowledgeEUROCONTROL’s Safety Improvement Sub-Group (SISG) identified the need for some kind of knowledge repository to ‘store’ safety related data as early as 2004. It would provide a central location for service providers to share solutions to common safety problems. The first step in that direction was the launch of the HindSight magazine in the beginning of 2005. Work on an on-line safety knowledgebase started late 2005 with the development of the concept and platform design. The website, in the meantime called SKYbrary (shortened from Sky Library), was officially launched in May 2008.

WikiThe safety knowledgebase adopted the con-cept of a wiki. It consists of a hyperlinked network of articles and documents. An arti-cle is the building nucleus of the knowledge base. It can contain links to other related ar-ticles, to documents stored on the SKYbrary bookshelf or to external safety data sources. Anyone can comment, propose modification to an existing article or submit a new one, including new topics. However, unlike other wiki’s, a robust content control process en-sures the needed quality, reliability and con-sistency of stored safety data.

Visitors can browse selected portals and cat-egories of information, look at recent Safety

Photo: © Sandra Cunningham | Dreamstime.com

Challenges for SKYbraryCollecting, organising, deliver-ing and maintaining aviation safety knowledge in such a way that it does not remain static is an enormous challenge. It took two years of considerable ef-fort to get SKYbrary ready for launch. A great deal has been achieved since then but for the project to go forward, we need greater engagement from the aviation community in order to build the depth and breadth of knowledge that we aspire to. ^

SKYbrary is freely accessible at: www.SKYbrary.aero

Human FactorsThe OGHFA is an extraordinary col-lection of valuable information relat-ed to human fac-tors made avail-able to the entire aviation commu-nity through SKY-brary. Recognis-ing the prevalence of human factors issues in aircraft accidents and in-cidents, the Flight Safety Foundation has released it to bridge the gap between theory and practice and to improve the safety and efficiency of commercial aviation. OGHFA gathers avail-able scientific information and makes it un-derstandable and accessible for aviation operators. It includes more than 100 articles and supporting visual aids which present hu-man factors issues. The articles are divided into four categories:•CrewActionandBehaviour• Personal Influences, involving the “inter-

nal state” of each crewmember, such as knowledge, stress, fatigue, awareness and many other factors

• Organizational and Environmental Influ-ences, including factors beyond the con-trol of the crew but under the control of the airline

• Information Influences, including thecon-tent and form of information available to a crew, such as checklists, manuals, naviga-tional charts, and other items.

Moreover, integration of new SKYbrary tools and information services is underway. The tests of the prototype of a “safety case” module have been accomplished recently. Once integrated the new feature will enable SKYbrary users to browse the database of hazards and safety cases made available as an output of risk assessments.

PrioritiesWhile the framework of the SKYbrary knowl-edgebase is becoming mature, the subject coverage is not yet uniform across portals and categories. The short-term content de-velopment priority is focussed on the major killers in the aviation industry:• LossofControl(LOC)• ControlledFlightIntoTerrain(CFIT)• RunwayExcursion(RE)• RunwayIncursion(RI)• LossOfSeparation(LOS)

4 Safety

THE CONTROLLER 19

Along with articles on each of the subjects, an extensive set of incident/accident reports provide illustrative examples and support lesson dissemination.

In addition to Operational Issues, two further portals were created, notably the Enhancing Safety and Safety Regulations portals. The Enhancing Safety portal provides access to a wealth of articles and other materials on proactive safety improvement grouped in several categories, such as Airworthiness, Flight Technical, Safety Management, Safety Nets, Theory of Flight, and Safety Culture. The Safety Regulations portal, as the title in-dicates, enables users to access safety regu-latory requirements issued by authorised or-ganisations, such as European Commission, EUROCONTROL, JAA. Although this is the least developed portal for now, it provides comprehensive information about the Single European Sky initiative and legislation.

ReferenceBesides the primary risk related articles, SKYbrary offers to all users numerous ancil-lary articles that provide further explanation of terms and definitions used in the primary articles, but also articles of a more encyclo-paedic nature, such as aircraft types and per-formance. The information architecture of SKYbrary is subject to constant review as the volume of knowledge grows and feedback is received from users.

It also provides access to various toolkits and expert support functionalities that can help aviation professionals enhance their knowl-edge and skills. Examples of these are the Level Bust toolkit, Air-Ground Communi-cations tookit, the ICAO search centre and OGHFA (Operator’s Guide to Human Fac-tors in Aviation).

ICAO Search CentreThe ICAO search centre enables quick refer-ence to ICAO Standards and Recommended Practices (SARPS) and Procedures for Air Navigation services (PANs). The database of SARPS and PANs to be searched through is limited to those considered essential for aviation safety - the Annexes to the Chicago Convention, PANS OPS (Doc. 8168), PANS ATM (Doc. 4444), etc. Users can search for keywords through the ICAO documents listed on the search page (http://www.SKY-brary.aero/sissy/home/). Each hit shows as an excerpt from a document - a paragraph that contains the keywords searched for. Un-fortunately, ICAO prohibits making the full document available in any form, but the site provides a handy reference of where to find the info.

Runway ChangesArchie goes on: of the 843 late runway changes, 17% were ‘mismanaged’ by the flight crews, meaning the flight crew commit-ted one or more errors that are linked to the late runway change. This makes “late runway change” the most often mismanaged threat in the LOSA Archive – other mismanaged threats average around 10-12%.

Remember these were “normal flights” with-out reportable safety incidents. In the 17% of mismanaged late runway changes, crews must therefore have been able to successfully manage their errors - otherwise their flights wouldn't be included in Archie. That implies the crews’ workload must have increased be-tween the moment the late runway change was given to them, and the moment at which the operation was returned to normal again. A higher than usual workload in what is uni-versally regarded a critical phase of flight. Is that what we want to achieve when we try to provide the best possible service to pilots?

Less is More!As with late runway changes, some flight path alterations are unavoidable. Pilots as well as controllers have to manage those situations to the best of their abilities. But for the “unforced” ones, which controllers think are a favour, Archie's statistics tell us that ATC may need to reconsider: it may ac-tually be a bigger favour NOT to offer pilots an alternative runway, direct or level change. From a safety perspective, it may be a case of “less is more”! ^

bertruitenberg@cs.com

4 Safety

THE CONTROLLER20

Are we too good?Why Doing Favours Might not be the Safe Thing to do

^ by Bert Ruitenberg, IFATCA Human Factors Specialist

The full-length version of this article appeared in issue 8 of Hindsight, produced by Safe-ty Improvement Sub Group (SISG) of EUROCONTROL and is issued twice a year. More info via HindSight.magazine@eurocontrol.int

Air traffic controllers take great pride in their job and try to pro-vide the best possible service at all times. This personal pride translates to what their ‘clients’ range from offering shortcuts (direct routings) in the air or (during taxiing) on the ground, offering alternative runways for departure or landing, to even offering the use of a single run-way in the opposite direction of the one active at that time.

GoodiesReasons for offering those “goodies” are usually not self-ish: there is a genuine feeling that we offer these as a favour to the crews, airlines and pas-sengers. It could save them a couple of minutes of taxi time, get them airborne a minute or so earlier, or save them a minute or two of flying time. The International Air Transport Association, IATA, sent out an appeal a few years ago to air traffic controllers to try and shave off 1 minute of flight time for every flight they han-dled. So this kind of “micro im-provement” must be important to ATC’s customers!

But are such micro improve-ments, especially when this is done at short notice, really that beneficial at all? Modification of existing (and understood) plans1 of pilots used to be fine in the days when aircraft were analogue machines that were operated by manual control in-

puts of the pilots. But those days are gone: aircraft nowadays are complex digital ma-chines, operated by computer systems that are managed by the pilots.

HarderSimply put: in the old days, it just was neces-sary for the pilots to understand the change and carry it out. Today however almost any “real time” change requires an update of the FMS – in addition to having to understand the change the pilots must also re-program the air-craft in order to be able to accommodate it.

An in-depth look at the LOSA Archive, Archie for short, reveals some interesting statistics. LOSA is the Line Operations Safety Audit, an airline safety programme to monitor safety in normal operations. It is endorsed by ICAO and maintained by Dr. James Klinect and his team at the LOSA Collaborative at the University of Texas, Austin, Texas. Archie only records flights where no reportable safety incident occurred – just successful operations from A to B...

In Archie's data, a late runway change is identified as an “ATC threat to the flight crew2” in 13% of the flights – which means that on average one in every eight flights faced a late runway change. One in every eight! Digging a bit deeper: of the late run-way changes, 39% occur after pushback and 61% occur late in the descent or approach (i.e. below FL200, including multiple runway changes after Top of Descent).

1 “mental model”2 A “threat” in this respect is something that

originates from outside the flight deck and that has to be managed by the flight crew in order to maintain the margins of safety for the flight.

4 In addition to having to understand the change the pilots must also re-program the aircraft. Photo: eads

much as we can. Paraguay and Bolivia are willing to host the next meetings and we expect to gather more and more coun-tries from the continent. ^

ommends it and Latin America shouldn’t stay behind. North America, Central America and the Caribbean (NACC Region) are archieving the first step, starting with radar data shar-ing. In a few years, the needs of the modern ATM/CNS systems and the demands of increasing traffic are going to force the winds of change in this particu-lar and turbulent region. The next meeting is in Ascuncion, Paraguay in November, with the second in La Paz, Bolivia (February or March 2010). ^

tion in Civil Aviation Collapse in MERCOSUR” and “Safety in ATC” was presented by Gabriela Logatto. The seminar has been a great opportunity to gather South American countries such as Uruguay, Paraguay, Brazil, Argentina and Bolivia in the same place. It’s been im-portant for them to see IFAT-CA’s presence there. We had the chance to talk about the importance of continuing to be within the federation. The goal is going to be expanding this Buenos Aires experience and to promote IFATCA and our profession as

(Union de Naciones Suramericanas which includes Argentina, Venezuela, Colombia, Ecuador, Brazil, Bolivia, Ecuador, Surinam, Paraguay, Guyana and Chile). UNASUR Sin-gle Sky enhances the number of countries involved geopolitically. Harmonization is the main objective of this project; Latin Ameri-can controllers are really concerned on what is going on in Europe with SESAR and in the United States with NEXT GEN, wishing to start developing the concept and to involve the whole sub continent in the next air navi-gation challenges.

Measured with SWOT (where we can deter-mine the Strengths, Weakness, Opportunities and Threats of a project) Analysis, Mercosur Single Sky could be possible. Most of the South American countries have cultural similarities and they mostly have the same technical needs but the project’s threats and weaknesses could be the military operation of ATC in countries such as Brazil, Argentina, Uruguay and others.

Nevertheless, the air navigation world is moving towards harmonization. ICAO rec-

4 Americas News

THE CONTROLLER 21

Are we too good?Why Doing Favours Might not be the Safe Thing to do

The Argentinean Air Traffic Controller As-sociation organized a seminar on safety on Sept 10, 2009 in Buenos Aires, attended by the Presidents of many South American Con-trollers Associations, IFATCA and also the MERCOSUR Controllers Associations. IFATCA was represented by Bert Ruiten-berg, who gave a nice presentation of NOSS (Normal Operations Safety Survey), EVP Americas (Setting the Standards for an Effi-cient ATC System in Latin America) and R. Bruce Magallon de la Teja from COCTAM (Importance of becoming a Professional ATC College in our Region and Mexico ATCO’S experience). Fernando Reyes from Uruguay MA presented “Why Military Administra-

New Initiatives for South America

Controller associations that are affected by MERCOSUR ( a regional trade agreement between Argentina, Brazil, Paraguay and Uruguay to promote free trade) created an organization called OACTAM. They organ-ized a meeting last September in Buenos Aires, Argentina.

The meeting was attended by Argentina, Bolivia, Brazil, Paraguay, Uruguay and many observers. Mr. Rodriguez, former repre-sentative of Argentina to IATA, expressed his concerns on the lack of harmonization in the region. He argued that for once for all South American controller associations must stand up for the development of new strate-gies to improve the ATM system. OACTAM supports the concept of MERCOSUR Single Sky which is likely to evolve into UNASUR

Argentinean Air Traffic Controllers Association Organizes Safety Seminar ^ by Alex Figuereo,

EVP Americas

MERCOSUR Single Sky and OACTAM

^ by Alex Figuereo, EVP Americas

4 Buenos Aires 2009.

Photo: Argentina ATCA

evpama@ifatca.org

presented working papers in the working group meetings of the respective panels to bring the problem to the attention of ICAO and to propose a review and extension of ICAO provisions on stop bars. Objective is to make ICAO provisions on stop bars consist-ent and unambiguous, and to cover aspects like extended stop bar operation in a 24/7 environment.The IFATCA Technical and Operations Com-mittee (TOC) is working on a study in regard to the operational use of stop bars, which will be presented at the 49th IFATCA Conference in Punta Cana next year.

What are the Next Steps?IFATCA will actively follow and influence the work on stop bar provisions at ICAO level.TOC will finalise the study on stop bar usage for presentation and decision during the 49th IFATCA Conference.IFATCA may consider extending the survey on stop bars to more Membership Associations in order to get an updated and more complete picture about the situation on stop bars.IFATCA will follow the developments in re-gard to operation of modified stop bars in a 24/7 environment. ^

raimund.weidemann@t-online.de

4 Safety

THE CONTROLLER22

Stop Bars and IFATCA

^ by Raimund Weidemann, IFATCA Representative at the ICAO Operations Panel

What are Stop Bars? Stop bars are defined as a row of red, unidirectional, steady-burning in-pavement or elevated lights installed across an entire taxiway, and elevated steady-burning red lights on each side. (see photo) They were originally developed as a safety net to pre-vent traffic (aircraft or vehicles) inadvertently entering an active runway. In other words, red stop bars are a measure to prevent runway incursions. Very often stop bars are used especially under low visibility conditions (LVP) or at night, but as runway incursions can occur under any weather conditions and at any time of the day there have been considerations and trials lately with modified stop bars oper-ated in a 24/7 mode.

How are Stop Bars operated?According to ICAO provisions in Annex2, Annex 14, PANS ATM and Manual for Prevention of Runway Incursions stop bars should be switched on to indi-cate that all traffic shall stop and switched off to indicate that traf-fic may proceed. Aircraft or vehi-cles should never be instructed to cross illuminated red stop bars when entering or crossing a runway. In the event of unserv-iceable stop bars that cannot be deselected, contingency meas-ures, such as follow-me vehicles, should be used.

Why did Stop Bars come to the Attention of IFATCA?Tower controllers from different parts of the world have reported the following problems:• Absenceofstopbarsatrunwayentrypoints

at some airports (partly or even total)• InsufficientstopbarandHMIdesign(stop

bars not switchable from the tower or only switchable together with other parts of the lighting system)

• Unacceptableproceduresforstopbarop-eration at some airports (pilots or vehicle drivers are routinely instructed to cross ac-tive stop bars)

• Inadequateornocontingencyproceduresfor the case of stop bar malfunctions

• InconsistenciesinICAOprovisionsonstopbars throughout different ICAO docu-ments (Annexes, Manuals, PANS ATM)

What has been done within IFATCA to tackle the Problem with Stop Bars?The IFATCA Global Airport Domain Team has distributed a survey on the usage of stop bars throughout selected Membership Associa-tions. The results of the survey were presented at the 48th IFATCA Conference in April 2009. It was confirmed that the reported problems with stop bars exist at various airports. Recommenda-tions how to improve the situation and proposed solutions are provided in the conclusion section of the survey. The IFATCA survey on stop bars can be downloaded directly from the IFATCA Web site.The IFATCA representa-tives to the ICAO Op-erations Panel (OPSP) and to the ICAO Aero-dromes Panel (AP) have

4 Stop barPhoto: NATS

4 Jet stopping at a stop bar.Photo: Sukhoi

Air traffic controllers should never instruct a pilot or vehicle driver to cross an active stop bar.

THE CONTROLLER 23

Books Review

The book explains the difference between the man as a hazard and as a hero. It ex-plains some accidents but then details some heroic recoveries, not only in avia-tion. Prof. Reason explains how it is pos-sible to learn from these heroic recover-ies and how these actions can be taught to achieve resilience. The last chapter of the book is particularly important for us in ATC. It is called “In search of safety“ and is really something everyone involved in safety management should read.

With Christmas approaching, if you want to make a present to your CEO, this book would be a good choice. After all, the controller work-force is not causing incidents, but preventing much more by their actions everyday.

ICAO proficiency tests and its implications. This book connects two systems, the lan-guage one and the aeronautical one. It ex-plains how English is applied in aviation and how miscommunications occur.

Overall, it’s a good research book that gives a scientific background, including facts of interests to those who are trying to implement a single language in ATC.

Aspects of oral English communication in Aviation by Franz RubenbauerISBN: 978-3-8322-8233-2108 pages Published by SHAKER, GermanyTo order contact www.shaker.de ^

The Human Contribution: Unsafe Acts, Accidents and Heroic RecoveriesBy James ReasonISBN 978-0-7546-7402-3296 pages

Published by ASHGATE, UK.To order contact www.ashgate.com ^

We all know professor Reason (see interview on pages 26-27). His latest book, The Human Contribution, is as fascinating as his reputa-tion. It is not an easy read, especially for non-English speakers, but realistic enough to keep you reading it until the end.

The purpose of the book is to explore the human contribution to both the reliability and resilience (the positive capacity of peo-ple to cope with stress) in complex systems such as ours. Until now, many (including Prof. Reason himself) considered the human as a hazard, whose unsafe acts could cause accidents. This book explores another, less explored perspective: the so-called heroic recoveries, i.e. when people saved the day instead of causing a catastrophe.

This small book is very interesting as it ex-plains why verbal communications are so vi-tal in our profession and reinforces the need to use standard phraseology in today’s avia-tion circles. The author is an IFR pilot with university degrees in various subjects, cur-rently working for the German CAA.

We all know how successful verbal com-munications, not only on the R/T, are es-sential in air traffic control, and how misun-derstandings can lead to loss of life. Many accidents have communications as causal factors and this book goes into some of those accidents and discusses the ambigui-ties in communications that led to those ac-cidents. It also covers the newly introduced

The Human Contribution: Unsafe Acts, Accidents and Heroic Recoveries By James Reason

Linguistics and Flight Safety: Aspects of Oral English Communication in Aviationby Franz Rubenbauer

^

^

Reviewed by Philippe Domogala, Editor

Reviewed by Philippe Domogala, Editor

Photo: ashgate

Photo: shaker

nex 14 compliant signs and markings are used at all airports.

STOP BARSUse of STOP BARS op-erated 24 hours per day in all weather conditions are considered a significant safety benefit by Pilots and Driv-ers working on the manoeuvring area and therefore Air Traffic Controllers. Controller workload is considered acceptable given an appropriate procedure and co-location of the stop bar switches with the Controller working position. IFALPA requests that Stop Bars are used 24 hours per day to protect the runway.

Taxiway NomenclatureComplex taxiway environments, with illogi-cal naming conventions applied, e.g. taxiways with similar, or the same designations, as an-other part of the same airport, lead to pilot and driver confusion and a loss of situational aware-ness by all. The misunderstanding of taxiway clearances leads to navigation errors on the ground, runway incursions daily and occasion-ally to accidents. To reduce such incidents and accidents all taxiways and especially taxiways that enter and exit the runway should be in-stinctive and logical to the pilots, air traffic con-trollers and vehicle drivers. That requires logical routings with logical nomenclature. To do this IFALPA has developed a policy to help airport administrators to do this. ICAO is requested to update Annex 14 accordingly.

Aircraft LightsThe use of aircraft lights serve two basic goals, SEE and BE SEEN. As a direct effect, the aircraft will be more conspicuous and that is essential for other aircraft, ground crew, vehicle drivers and ATC to aid visual detection. Navigation (position), anti colli-sion, strobe, logo, taxi, turnoff and landing lights are useful aids to make aircraft more

4 Runway Safety

THE CONTROLLER24

Runway Safety DeficienciesIFALPA Insists on Mitigations to Prevent Incursions.

^ by Capt Heriberto Salazar, B737 Aeromexico and Vice-chairman of the Aerodrome & Ground Environment Committee (AGE)

IFALPA believes that runway safety issues are among the most serious threats to aviation safety. A significant percent-age of accidents are as a result of runway safety deficiencies.

Runway IncursionICAO document 9870, the Run-way Incursion Prevention Man-ual, is based on the Eurocontrol action plan and FAA initiatives, focusing on short and medium term preventive actions. These might be the best achievable at present, but the real solu-tions lie in designing out the problem which requires a more systemic approach focusing on the future.IFALPA’s preferred solution is to design airports in such a way that Taxiways crossing runways should be avoided whenever possible, by the construction of “end-around” or “perimeter” taxiways. When a crossing is unavoid-able, it should be done at a low energy point on the runway, at either runway end or entrance. Taxiways for a runway shall be restricted to those required for lining up, for take off and shall be perpendicular to that runway. Many airports were constructed more than 30 years ago; dur-ing these years aviation traffic has grown expo-nentially. Many airports around the world still have the original signs and markings, and they are no longer ICAO compliant. Leaving a pilot to interpret

the meaning of these non-standard signs and markings is an unnecessary hazard that may lead to a significant safety event. IFALPA considers the use of non-standard signs and markings a threat for its pilots and is request-ing their standardization around the globe. Local Runway Safety Teams need to include pilots to ensure that ICAO standards are re-spected. Maybe for some airport administra-tors and Air Traffic Controllers, their airport is perfectly logical, but what would happen if we move the Controller to different airports, two or three times a day, so she or he would have to control traffic from a variety of dif-ferent platforms at different airports? How would their expert knowledge of their home base get applied in different circumstances? The expertise developed at the home airport could even be dangerous elsewhere. The design of an airport can make a signifi-cant difference to the number of Runway Incursions experienced. The statistics show that airport configurations where a runway has to be crossed as part of normal opera-tions are more vulnerable to runway incur-sions. Accident statistics also show that risk increases when there are sudden changes to traffic throughput (e.g. Tenerife 1977) or unusual local circumstances. While appropriate operational procedures are essential, airport design that eliminates runway crossings are what IFALPA is asking for from airport operators around the worldAt legacy airports that do have runway crossings today IFALPA supports some easy solutions that will help to reduce Runway Incursions:

ICAO Annex 14 Standard Signs and MarkingsSigns and Markings are the body language of an airport and are as

important as the use of standard ICAO phraseology. Local words

or signage are only meaning-ful to local pilots. IFALPA re-

quests that only ICAO An-

Photo: Phil P.

4 Capt Salazar

ing runway. This area should be laid out to optimize surviv-ability; in other words, flat, firm, ground capable of supporting the heaviest RFF equipment at the airport and free of non-frangible objects. An alterna-tive means of compliance is the installation of an arrestor bed which will provide the same level of protection as a 240m RESA. Other factors, for exam-ple safety minded construction zoning in the airport vicinity will further mitigate risk.

Emergency exercises must form a part of every airport’s Emer-gency Plan. Such an exercise must be carried out, in full, on a regular basis and involve all per-sonnel and agencies that would be expected to attend an actu-al airport emergency. Table top exercises are of some value, but they should never replace regu-lar full scale exercises.

For more information refer to:• Uses of aircraft external

lights see 09AGEBL01• IFALPA’s RESA policy see

08POS01• Airport nomenclature see

IFALPA Annex 14 para 5.4.3 Taxiway Designation ^

should be given above an altitude that can jeopardize the decision of Go-around.

PAPI or VASI lights system should be oper-ated during day and night, irrespective of the visibility condition, and should be used dur-ing the visual part of every approach.

Runway Surface ConditionIFALPA believes that the effect of all natural or unnatural contaminants on aircraft performance should be assessed, whenever it is not possible to fully clear the runway, taxiway or apron of these contaminants. The effects of displacement and impingement drag on aircraft performance should be assessed as well the effects of any contaminants on aircraft braking.Aircraft cross wind capability has been dem-onstrated during test flights. These flights were ONLY conducted by test pilots and on a “test” runway; this doesn’t mean that the same operation capability can be achieved on a contaminated runway and/or after a long duty day with a 10 time zone difference.

TrainingTo provide adequate safety awareness among crews, operators should set up a training program to develop theoretical knowledge of runway excursions and the im-portance of effective CRM leading to a solid understanding of the excursion risk.

Improving Post Accident SurvivabilityHuman life can be saved even after a seri-ous runway excursion accident by adopting risk reducing measures. These include, but are not limited to the runway environment, emergency plans, (cabin) crew performance and aircraft structure.The runway environment should be construct-ed for optimum survivability following a runway excursion or other accident. In addition to the runway strip as defined by ICAO, this should include a runway end safety area (RESA). IFALPA policy is that the minimum accept-able RESA is 240m beyond the 60m runway strip and twice the width of the correspond-

4 Runway Safety

THE CONTROLLER 25

conspicuous and show intention of move-ment. Adherence to IFALPA Policy is strong-ly recommended to aircraft operators and aircraft manufacturers to help standardize operating procedures.

Runway ExcursionDuring the last decade the number of fatal and non-fatal accidents has been reducing, According to FSF, more than 90 per cent of runway accidents are runway excursions. During the last few years catastrophic acci-dents have occurred where commercial air-craft run off at the end or depart the side of the runway. Runway excursion accidents are primarily caused by either an incorrect approach/land-ing technique or an uncontrollable aircraft on the runway To reduce the risk of a runway excursion, there are some measures that the aviation industry can emphasize.

Stabilized ApproachesThese are essential for safe landings: when these parameters cannot be maintained a Go-around should be executed. Standard operating procedures should include the op-erator’s policy with regard to the decision to go around encouraging the crews to do so in case the approach is not stabilized.ATC has a role to play as an aid to avoid rushed approaches. Runway changes after top of de-scent, especially last minute changes, can cause a lack of situational awareness and rushed ap-proaches. These are contributing factors to unsterilized approaches. Landing clearance

Photo: FAA data

^

What in your views should Air Traffic Man-agement Service Providers do to cope with the production pressure (less costs, less de-lay etc.) and at the same time invest into the future tools - keeping safety in mind.

JR: I agree that few if any ATM systems are generative, but many are responsibly proac-tive (NATS, for example, is surprisingly well led and has turned itself around almost 180 degrees in the decade I have been associ-ated with them). The rest of the questioning seems to depend on the relationship be-tween production and protection (discussed in my former book: Managing the Risks of Organizational Accidents pp. 3-6). Maybe in the long run protection and production can go hand in hand; but, in the short-term, there are always conflicts. When I first started working with ATM, I naively supposed that it was all about protection—maintaining sepa-rations, regulating flow and ensuring safe approaches and landings. But then I realised that it’s also very much about revenue-earn-ing production: pushing as many aircraft as possible through closely defined pieces of sky. Thus there is a clear tension between revenue-earning and separations. Automa-tion—collision predictions, and the like—are seen as added defences to the increasing volume of traffic, and indeed they are. The problems arise when the acquisition of new automation is traded off to achieve reduced separations. The ATM system, as a whole, is made safer by effective automation, but only if the original separations are maintained. Building in the human factor to such auto-

4 Safety

THE CONTROLLER26

Interview with Prof. James Reason SAFETY and Human Factors in 2009

by Philippe Domogala, Editor

James Reason was Professor of Psychology at the Univer-sity of Manchester (UK) from 1977 to 2001. He is now a lecturer and a consultant in various organizations such as UK NATS.

Philippe Domogala: Prof Rea-son, Everybody knows you after the now famous cheese model, and it is used in almost every safety course on the planet. In your latest book (The Human Contribution: Unsafe Acts, Ac-cidents and Heroic Recoveries (see the review on page 23 of this issue) you alter the general view of humans as a hazard, producing errors and viola-tions. Instead, you introduce the notion of the human as a hero, compensating and recov-ering system errors. Looking at Capt Sullenberger’s actions in that Hudson river ditching, one could agree with you entirely. But looking at the latest avia-tion accidents this year, is that really so?

James Reason: The hazardous human and the heroic human are two sides of the same hu-man factor coin. Everyone is ca-pable of errors, violations and unsafe acts in general. They have occupied centre stage so far because most of the data are event-dependent, i.e., they depend on accident reports. But as the Capt. Sullenberger event (and many others) has shown, people are also capa-ble of pulling back troubled

systems from the edge of disaster. After 40 years of studying unsafe acts and system fail-ures, I find the heroic recoveries much more interesting, and perhaps equally important in the human factors of safety. In my 11 case studies, I set out to find the common factors. But I actually found very few. One was the possession of realistic optimism; that is some-thing that is the opposite of despair. In most other respects, there were wide situational differences in contributing factors, type of decision-making involved and management style. The contrast, for example, in the lead-ership styles of Captain Rostron of the Car-pathia ship (see note 1) and Capt Al Haynes of the United Airlines DC10 (see note 2) is very marked. The former (as far as we know) didn’t consult, but simply issued a string of detailed instructions relating to the handling of the vessel, preparations for receiving sur-vivors, and the like. Al Haynes on the other hand consulted widely with his crew mem-bers. I doubt whether everyone is capable of making heroic recoveries, or whether some-one who was heroic on one occasion could repeat his/her success at another time. It was horses for courses. The right people in the right place at the right time were doing the right things. Your question implies a conflict, but the hazardous and the heroic human are not mutually exclusive (e.g. the crew of the Gimli Boeing 767 Glider ( see note 3 ) were implicated in the running out of fuel as well as the miraculous recovery).

Ph.: In your book you also talk about the ten-sion between internal and external factors. For the time being at least in Air traffic Man-agement (ATM) we do not believe that safe-ty is generative Maybe it is already in some places pro-active - however it is by far not where one would expect. How do you see that we will automate more working steps in ATM without necessarily the state of genera-tive safety required being used?

The problems arise when the acquisition of new automation is traded off to achieve reduced

separations.

4 Prof. James Reason Photo: JR

cue of the sinking Titanic. He saved 705 persons.

NOTE 2: Capt Haynes was in 1989 flying a United DC10 from Denver to Chicago when the number 2 (tail) engine ex-ploded in mid flight, severing all 3 hydraulic systems (the probability of losing all 3 hy-draulic systems was calculated as 10-9 or one in a billion!) Us-ing dissymmetrical power on the 2 remaining engines he managed to crash land in Sioux City. Of the 296 on board 185 persons survived.

NOTE 3: In 1983, an Air Cana-da B767 from Edmonton to Ot-tawa ran out of fuel mid way at 41.000 ft due to a combination of inoperative fuel gauges and miscalculations pounds/kilos. The crew successfully landed, without engines, on a disused runway in Gimli, Manitoba. ^

ed@ifatca.org

Ph.: What advice would you give top man-agement, CEOs of Air Traffic Service Provid-ers, etc, when introducing the new very ad-vanced automated systems in gestation?

JR: I’d get them to read about the ironies of automation (see Managing the Risks of Organizational Accidents’ book, Chapter 3 pp. 42-46). Automation in ATM can and does have enormous benefits; but there will also be human factors traps and surprises.

Ph.: Finally on a lighter note, I see that in your book, you added a cheddar layer to your famous Swiss Cheese model, and even a mouse nibbling that slice. Are we to expect from you more of these cheese stories in the future?

JR: Yeah, well, the cheeses could be past their sell-by dates (according to Sidney Dekker, though I said it first). Swiss cheese did not apply too well to the Ueberlingen tragedy, or at least not with regard to the proximal events. But maybe I should explore the French dimension: Brie and Camembert, soft cheese?

NOTE 1: Capt Rostron was in 1912 com-manding the Ship‘ Carpathia” that diverted through an iceberg field to come to the res-

4 Safety

THE CONTROLLER 27

mated systems should be kept in mind from the outset. Automation, as we have seen from the history of Airbus and other such sys-tems, is a double-edged sword. It can help and it can cause harm.

Ph.: Do you see any difference between “ap-portioning blame”, “determining responsibili-ty” and “holding someone accountable” after a safety event? If so, what is the difference?

JR: Clearly there is a difference between these phrases. Professionals like Controllers are clearly accountable but they need not be blameworthy. Blaming is bad news all around (the ghastly fate of the Ueberlingen controller marks one end of that spectrum). I have iden-tified what I’ve called the ‘vulnerable system syndrome’ (see the Human contribution book). Blame lies at the heart of the syndrome, denial and the blinkered pursuit of the wrong kind of excellence are the other two. Together they interact to fuel the blame cycle.

Ph.: In your view how far should resilience be build into the new automated ATC systems in order that these systems can recover?

JR: Resilience, robustness and the ability to continue in the face of operational stresses and strains are the proper goals of a safety management system (see both books). Tar-get zero (no accidents) is unattainable. Not only that, it misrepresents the nature of the safety war. There will be no decisive battles like Waterloo. It is a guerrilla war which we all ultimately lose (entropy gets us all in the end). The best we can hope for is to be on the last helicopter out of Saigon.

Automation in ATM can and does have enormous benefits; but there will also be

human factors traps and surprises.

Photo: JR

This year, the PORTUGAL-SPAIN FAB has launched a feasibility study including a CBA making use of simulation tools. Significant per-formance improvements need to be generated to exceed the already existing cooperation.

The BLUE-MED FAB combines the airspace of Italy, Malta, Greece and Cyprus with Albania, Egypt, Jordan and Tunisia as associated part-ners. This FAB initiative crosses the border to Africa. Performance benefits appear to be very modest.

High performance benefits though might be seen in the DANUBE FAB of Bulgaria and Romania.

IFATCA is concerned as missing guidance has created wrong expectations among politicians and public. FABs will not achieve more improve-ments than bi- or multilateral harmonisation plans. It is therefore essential to reduce fragmen-tation at operational level with operational solu-tions. Additionally several FAB initiatives lack real financial benefits. Imposed pressure of the Euro-pean Commission requires many institutional and cross-border legal issues to be solved to comply with the implementation by 2012.

IFATCA agrees to enable optimum use of airspace – taking into account traffic flows and military requirements – focusing on the harmonisation of sector complexity and workload. We believe that capacity gains are to be achieved through compatible ATM sys-tems and improved communication. ^

evpeur@ifatca.org

4 European News

THE CONTROLLER28

Functional Airspace Blocks in EuropeHuman Centered & Operationally Driven?

^ by Patrik Peters, European Editor

Europe suffers from its fragment-ed airspace with a high number of service providers. The estab-lishment of the European Union with the Treaty of Maastricht in 1993 was a fundamental step towards harmonization, having effects on the organization of European airspace. The idea of Functional Airspace Blocks (FAB) was born by the Single European Sky initiative when airline opera-tions suffered from increasing delays due to airspace satura-tion. A reconfiguration of the upper airspace into functional airspace blocks was seen as the enabler for more capacity. The framework regulation decided that a “functional airspace block means an airspace block based on operational requirements, reflecting the need to ensure more integrated management of the airspace regardless of existing boundaries.” As it left room for interpretation, the op-erational requirements were not always the driving factor behind alliances formed to satisfy this regulation. Through the pres-sure of the European Commis-sion politics gained importance and focus was more put on economical aspects, supported by the need to maintain profit-ability in a competitive market situation.

Today we count nine different FAB initiatives in Europe:

NEFAB – North European FAB – is a com-bined effort of the Nordic states Denmark, Sweden, Norway, Finland, Estonia and Ice-land. A cost benefit analysis has been un-dertaken last summer and work has now ad-vanced to a feasibility study, which is to be completed by May 2010.

NUAC – Nordic Upper Area Control Center – is an initiative launched by Sweden and Denmark and will become one of the service providers within NEFAB. The service provid-ers of both countries, LFV (S) and NAVIAIR (DK), have decided to proceed with the op-erational alliance option after having also considered a merger scenario. The initiative is one of the most advanced within Europe.

The BALTIC FAB combines the airspace of Poland, Lithuania and Latvia, where traffic growth, before the economic crisis, was very high. It could foster significant performance improvements in the area, despite its rela-tively small size.

In the north-western region of Europe we find the UK-IRELAND initiative, which is based on a cooperation long existing. Currently sig-nificant performance improvements are be-ing sought for, beyond the very modest ones identified in the cost benefit analysis (CBA).

FABEC – FAB Europe Central – is by far the largest initiative. Owing to its size (Germany, The Netherlands, Belgium, Luxembourg, France, Switzerland) and central position it accounts for 37% of flight-hours and costs in Europe and is seen as the biggest capacity enabler in the densest part of the continent.

FAB-CE, the FAB Central Europe, kind of re-places the initiative formerly known as CEATS (Central European Air Traffic Services). States involved (Austria, Czech Rep., Croatia, Hun-gary, Slovak Rep., Slovenia, Bosnia & Herze-govina) want to learn from their experience made with the previous undertaking, but need to seek further benefits, as those iden-tified in the CBA are relatively low.

FABs will not achieve more improvements

than bi- or multilateral harmonisation plans.

4 The European FABs

Photo: © Norebbo | dreamstime.com

Photo: EURO

CO

NTRO

L

4 Asia Pacific News

THE CONTROLLER 29

Target Level of Safety, Keeping On Target^ by John Wagstaff, Former IFATCA EVP Asia Pacific

levels. The timing of these tran-sitions and the associated ATC workload were the root cause of many of the LHDs with the potential for many conflictions if the transition and necessary co-ordination were not completed in time. The Group agreed that a revised FLOS should be introduced, but with the increase in flights and many new significant traffic flows, it was not viable to adopt a common single alternate FLOS, therefore after much discussion, deliberation and co-ordination, a consensus was finally reached. On 2 July 2008 the WPAC/SCS FIRs implemented a revised FLOS and the total risk for the airspace in December 2008 was 4.81 x 10-9, a value within the ICAO metric.

ConclusionWith the co-operation and co-ordination of the states and the active participation of IFATCA in the WPAC/SCS RVSM SG, the TLS has been met and the overall safety criteria has been significantly improved. How-ever there are other issues in the region that still need to be resolved and IFATCA will be participating in the newly es-tablished Southeast Asia Route Review Task Force as both the voice of the operational control-ler and as the liaison through EATMCG to ROCATCA and the Taiwan authorities. ^

john.wags@gmail.com

agement and Co-ordination Group (EATMCG), the MAs of Japan, Taiwan, Hong Kong and the Philippines together with the respective State authorities regularly meet to discuss important operational issues that cannot be fully ad-dressed in ICAO meetings. Through construc-tive dialogue held over many meetings, impor-tant decisions have been reached and complex problems have been resolved. The outcomes were reported to ICAO, where the IFATCA ini-tiative was gratefully acknowledged.

Target Level of SafetyThose with a degree in advanced mathemat-ics may be able to understand the following formula for calculating the collision risk for passing and crossing traffic as part of the Target Level of Safety (TLS) equation:

However for the average controller it will suffice to give the ICAO definition – Target Level of Safety A generic term represent-ing the level of risk which is considered to be acceptable in certain circumstances. The ICAO metric for the Target Level of Safety for RVSM operations is 5.0 x 10-9 fatal acci-dents per flight hour due to all causes.

West Pacific/South China Sea RVSM Scrutiny GroupAt the ICAO APANPIRG 17 Meeting in 2006 there was concern that the total risk reported by the West Pacific/South China Sea FIRs ex-ceeded the ICAO TLS metric (it peaked at

13.6 x 10-9 in 2006). The Meet-ing established the WPAC/SCS RVSM SG to address this seri-ous safety problem.

The Group quickly identified the number of Large Height Discrep-ancy (LHD) reports as one of the primary problems. Due to the modified single alternate FLOS that was adopted by the WPAC/SCS FIRs at the time of RVSM im-plementation in 2002, there was now a need for flights passing to or from adjacent FIRs that utilised different RVSM FLOS’s to change

BackgroundAt the ICAO APANPIRG 20 Meeting at the ICAO Asia Pacific Regional Office in Bang-kok, Thailand, at the beginning of Septem-ber 2009, the West Pacific/South China Sea RVSM Scrutiny Group (WPAC/SCS RVSM SG) was disestablished following its success over the past 2 years in reducing the collision risk value in RVSM airspace to a value below that of the Target Level of Safety (TLS). Although this was a significant achievement in a com-paratively short time span in ICAO terms, the real success of this group was in the unprec-edented co-operation and co-ordination that was undertaken by all parties involved under the leadership of ICAO.

The WPAC/SCS airspace includes portions of the Oakland and Anchorage FIRs, the FIRs of Japan, Taiwan, Hong Kong, the Philippines, Indonesia, Vietnam, Malaysia, Singapore and part of China – an area approximately equiva-lent to the landmass of Canada and the USA.

However at all of the six WPAC/SCS RVSM SG meetings, one of the states, Taiwan, could not attend as it is not an ICAO mem-ber. Hence one of the key players in both the north-south and east-west traffic flows could not participate in the discussions.

IFATCA is a professional body and an apolitical organisation. Many years ago IFATCA estab-lished the precedent that through the North East Asia Traffic Working Group (NEAT) and subsequently the East-Asia ATM Traffic Man-

Target Level of Safety A generic term repre-

senting the level of risk, which is considered to

be acceptable in certain circumstances.4 Hong Kong FLASPhoto: Phil P.

Clearance from ATC is required to enter and operate within the Class Bravo airspace that begins at 1,100 feet above the exclusion zone. Under the procedures in place on Aug. 8, Teterboro controllers did not have the au-thority to climb VFR aircraft into Class Bravo airspace. Therefore, the transition into Class Bravo requires a handoff of control from Te-terboro to Newark. On Aug. 8, the Teterboro controller initiated a timely handoff to the Piper, which the Newark controller accepted. The Newark controller was expecting radio contact from the Piper, which never came.

Although controllers at both Teterboro and Newark attempted to re-establish radio com-munications with the pilot, they were unable to contact him. At the time of the collision, the pilot was not in communication with air traffic control.

After the accident, the FAA convened a task force to examine the airspace with the goal of developing recommendations to make this historically safe airspace even safer. NATCA was represented on the panel by Newark controller Edward Kragh. On the very first day the task force met, it was unanimously decided that the current procedures were flawed and that under those flawed proce-dures, the Aug. 8 accident could not have been prevented.

4 Americas News

THE CONTROLLER30

The Hudson River (New York) CollisionWhat Happened?

^ by Doug Church, USA National Air Traffic Controllers Association (NATCA)

Just to be clear, right upfront: NATCA believes the main con-tributing factor in the Aug. 8 mid-air collision between a Piper airplane and a sightsee-ing helicopter in the Visual Flight Rules airspace above the Hudson River – separating New York City from New Jer-sey – was flawed procedures that prevented controllers at Teterboro Tower in New Jer-sey from giving instructions to climb before switching control of the aircraft to controllers at Newark Tower, who have juris-diction for flights before they enter this tightly compacted area of uncontrolled airspace over the Hudson.

We realize that for our brothers and sisters around the world, it may be tough to ignore the sensational New York tabloid newspaper headlines and the reporting in foreign media outlets of this high-profile acci-dent, particularly in Italy, where five of the victims in the heli-copter were visiting from. The headlines – initially fueled by a poorly worded report from the U.S. National Transportation

Safety Board (NTSB) – have clouded the important issues of airspace and procedures and, in our view, rushed to judgment and wrongly impli-cated a NATCA-represented controller from Teterboro Tower in the accident for an alleged “inappropriate” phone conversation with an airport employee during much of the Piper’s brief time in the air.

As of this writing, the con-troller was suspended with pay. But NATCA, which will represent the controller in the due process afforded him in the Federal Aviation Administration’s (FAA) internal hearing on this matter, believes this is a red herring.

Instead, what we’re dealing with here is an aviation tragedy that resulted from a chain of several extremely rare and unfortunate events that included the pilot of the Pip-er not making radio contact with Newark controllers, who would have climbed him above the exclusion zone and on his route of flight southward to coastal New Jersey, out of harm’s way. Also now becoming an issue, after the NTSB’s Sept. 16 testimony at a U.S. House of Representatives Aviation Subcommittee hearing, is the audio quality of the Piper’s readback to Teterboro control-lers of his assigned radio frequency to reach Newark Tower, which came piped into Teter-boro Tower’s loudspeaker at the same time as Newark Tower was calling Teterboro to inquire about the Piper.

Pilots in this particular airspace, called the Class Bravo Exclusion Zone (below 1,100 feet), are required to use “see and avoid” VFR procedures and are advised to tune into a common radio frequency to check in and report their positions. The burden of separa-tion is, of course, entirely on the pilots.

NATCA believes the main contributing

factor in the Aug. 8 mid-air collision

between a Piper airplane and a sightseeing

helicopter […] was flawed procedures.

As we filed this story on Oct. 1, the investigation continued and the NTSB likely will need several months to complete its work and issue findings of probable cause. NATCA will continue to work to publicly defend the Teterboro control-ler, who did his job on Aug. 8. What we hope happens soon is the implementation of new procedures at Teterboro that will enable controllers to have the ability to prevent this type of accident from ever happen-ing again. ^

dchurch@natcadc.org

in the 39-day-old investigation that the pilot of the Piper read back an incorrect frequen-cy during the radio switch to Newark. The readback was not heard or corrected by the controller, according to ATC recordings, the NTSB testified.

This was a disturbing development because the NTSB, which in its initial phase of inves-tigating heard the exact same audio record-ing of the event as our controller in the Te-terboro tower cab on Aug. 8, did not hear any readback error. The Teterboro control-ler told NTSB investigators in his interview that he believed the readback to have been correct.

Something must have changed between Aug. 8 and Sept. 16. Either a separately re-corded tape (with clearer quality audio) was uncovered, or the NTSB worked to enhance the quality of its existing tape. Either way, whatever the NTSB learned was not what the Teterboro controller heard in real time on Aug. 8. If it wasn’t on the ATC tape, then the controller didn’t have a chance to hear it. If the NTSB had to go to another source for this new information, then it is not pertinent.

4 Americas News

THE CONTROLLER 31

The FAA’s task force recommended sev-eral changes to training, procedures and airspace structure. NATCA supports these recommendations and we agree that their implementation will make the Hudson River Exclusion Zone safer. But further analysis is required before the recommendations can be implemented.

Much of the media coverage has centered around a central dispute that NATCA has had with initial findings of the NTSB as to whether the Teterboro controller could or should have warned the Piper about possible traffic conflicts ahead of it already in the Ex-clusion Zone. The NTSB’s first written public statement on the accident, released on Aug. 14, stated erroneously that the Teterboro controller could have warned the Piper about the accident helicopter before switching ra-dio control of the plane to Newark. In fact, the accident helicopter didn’t appear on ra-dar until seven seconds after radio control was switched.

NATCA made extensive attempts to pri-vately convince the NTSB to issue a correc-tion to its statement and believed on Aug. 15 that such a correction was forthcoming. But it didn’t happen, leaving NATCA in the very rare and excruciatingly difficult position of deciding whether or not to refrain from publicly correcting the NTSB’s statement, an action that we knew would surely cost us our coveted status as an official “party” to the NTSB investigation. However, remaining si-lent would have allowed the media storm to rage, wrongly and unfairly trying and convict-ing the Teterboro controller of direct respon-sibility for not acting to prevent the crash.

Ultimately, we decided to publicly correct the report and ask the NTSB to clarify its statement. We got our wish on the afternoon of Aug. 17 but not before the NTSB removed us from the investigation.

Adding to our perception of a rush to judg-ment by the NTSB in its public statements was the Congressional hearing on Sept. 16 at which the NTSB revealed for the first time

If it wasn’t on the ATC tape, then the

controller didn’t have a chance to hear it.

All photo credits: ntsb

and navigate from one stable to the other. The beautiful princes had to give the magnet-ic fountain gold pieces that kept the magnetic fountains working day and night. The beauti-ful princes had been once rich when the kings (states) had money to pay them the food for the flying horses. At a certain stage the king was fed up with flying horses, as they were polluting the air and made a lot of noise with their “neigh/guffaw” and he preferred the high speed rabbits (trains).

One day the King decided that the princes with their flying horses had to find their own way to finance the food for the horses. As the flying horses were expensive and a luxury the princes decided that they needed to find a solution to their new problem. They went to an old man called Schumann who was known to be a magi-cian. But he had gone away on a long journey.

• Local/Regional Implementations. The fol-lowing list of changes will not be imple-mented globally by 2030 but it will be ex-pected that there will be a number of such implementations around the globe.

- Airports will be controlled from a re-mote facility (virtual towers).

- Completely automated separation pro-vision. In other words the separator is not the controller or the pilot but is in fact automation.

• Less controllers needed: this has been the universal claim of all “advances” in ATM; however, because it has not been achieved in the past does not mean it cannot be achieved in the future. IFATCA needs to as-sess each claim on its merits and may well find that by 2030 there is a significant change in the number of controllers required.

For many of us this sounds like a fairy tale, my daughter did of course not understand any-thing – therefore I tried to tell her in the form of a fairy tale what is currently going on in Europe as she understood that I would be in Belgium how maybe in the future we will talk about an urban legend, a Babylonian project or a phenomena called SES II, SESAR?

Telling you a fairy tale of the current work around SES of our public service called ATM might inspire you to take a little distance to think out of the box, think the unthinkable and help the others dream their dreams. This has the advantage for me the story-teller, that I can be cruel, that not everything needs to be explained and that there is not necessar-ily any logic to be applied – but there might be a moral…

Once upon a time there was a kingdom of many kingdoms with two tribes. One tribe had two beautiful princes (AEA/IATA) who had a fleet of flying horses, one nicer than the other. The other tribe lived in small stone towers and in caves, which owned powerful magnetic foun-tains (ANSP). The flying horses needed these magnetic foun-tains to be able to get full speed

Why Fairy tales and Legends are important – a philosophical contribution to the future of Air traffic Management in Eu-rope in the light of the Single European Sky II (SES).

I was sitting on our terrace at home one day working on a speech, when suddenly my daughter came running and shouting “I don't want to kiss; I don't want to kiss this slug”. She had found a slug in the plants on our terrace and she was scared to kiss him. Some-body told her if she wanted to be a real princess she needed to kiss a slug at least once a week. I told her that this is non-sense and princesses, frogs and slugs who suddenly transform themselves into princes only exist in fairytales. She calmed down and was intrigued by what I was doing. Now if you think that explaining what is good or bad or the morale of a fairy tale to a 5 year old girl might be difficult or compli-cated then try to explain to the same child what the future of ATM would look like. The Vision • ThewholeATM system will

be performance based, and changes based on perform-ance cases (which includes safety cases).

• A high level of automation will be required in meeting the highest ATM perform-ance requirements.

• Air traffic control (reactive,tactical) will be replaced by Air Traffic Management (proactive, strategic).

• Management by Trajectory will form the basis of all con-trollers’ activities.

• Airspace will be dynamic (move around).

• UAV in non-segregated airspace.

Fairy Tales and Legends^ by Marc Baumgartner, President IFATCA

4 Marc Baumgartner Photo: Iran ATCA

4 Flying horses.

Photo: © Loveliestdreams | dreamstime.com

4 SES/SESAR

THE CONTROLLER32

THE CONTROLLER 33

Photo: Iran ATCA

flying horses to the magnetic fountains.

But sadly this was not enough. The plan had already brought disease to the dwarfs, the fly-ing horses and the magic foun-tains. They were so sad: they had no energy and couldn’t work as they did before.

The kings, princes and dwarfs became afraid. They decided that something had to be done. The only solution was to weaken the girls’ power and control her stone. The kings and princes decided not to pay her anymore gold for the magic plan.

In the end, the girl saw that she made a big mistake. She was so sad that she decided to leave Schuman’s house and move to a land far far away. The beautiful princes with their flying horses accepted that the princes with the magnetic fountains would not give away their secret. They accepted that they had to pay them for using the magnetic fountains. But the best thing was, they did not have to pay gold to the girl, and they did not have to pay gold for the SESAR Stone. So they all lived happily ever after.

My daughter thought that you could sleep well after such a bed time story … ^

pcx@ifatca.org

33

But there was a young girl in his house…The princes were not sure if they should tell the girl their story as she appeared very young, but she was very beautiful and seemed strangely wise, and could speak 27 languages. She convinced the princes to trust her. She told the princes of her plan ’the Single Sky’.

Once the beautiful princes had left, the girl took a big book, Schuman’s book, which was full of magic recipes. The girl started to look for the right recipe. After many moons, she found it and summoned the princes. She told them “I have found the solution. You know that your horses need the magnetic fountains to fly correctly – but the princes owning the magnetic fountains have never told us their secret from where they got the magnetic fountains. In the name of my master, I will ask them to change the way they use their magnetic fountains. We will ask them to re-duce the magnetic force – which will make your horses fly in a direct line. We will then pay them less gold. Your flying horses will be more efficient and you will become richer!”

After the princes had left however, the girl started having doubts… She wasn’t really

sure of her plan… After all, she was not really an expert at recipes. Despite her doubts, she published a decree in the name of the master. She sent an invitation to all the kings in all the kingdoms to come and hear her new plan. All the Kings came, bringing along with them the beautiful princes and the princes owing the magnetic fountains and the dwarfs riding the flying horses (Pilots), the dwarfs looking after the magnetic fountains (Engineers) and those who had the secret of guiding the fly-ing horses (Controllers).

They all came in their best attire, discussed for two moon cycles and went back home and started to work according to the plan. But some of the dwarfs – especially those who had the secret of guiding the flying horses were unhappy and told the kings and the princes that the girl was a danger and they were scared that plague and problems would hit the various kingdoms. They com-plained that the girl did not want to listen, unlike the elves in the marble palace (Euro-control) who had always listened to them.

Slowly the kings and princes saw that the plan was not working. The girl was afraid. She need-ed a second plan. She had found a recipe for a powerful stone called the SESAR Stone. It could tie the flying horses and magnetic foun-tains into a big spider web which didn't need the dwarfs anymore. She used all the gold the kings had given to Schumann to feed this stone and to develop knots and ropes to tie all the

Your flying horses will be more efficient and

you will become richer.

4 A European marble palace.Photo: EUROCONTROL

4 SES/SESAR

33

paying of lip service. Training is the base on which every discipline or work stands and for that matter S M S. Inadequate or piece meal type of training will not make the sys-tem give the required impact. The continu-ous up grade or up date to get abreast and keep pace with worldwide development is necessary.

We can also not rule out consultancy service when setting up such a system. Training they say is rewarding, not costly. The education of all staff of the organization to know that safety is a team business. Safety must be quality and assured of, we must therefore make serious effort to establish these systems to improve safety in our part of the world which is behind in all aspects of world development and for that matter safety in the aviation industry.

The sharing of expertise, knowledge, in-formation and experience, among regional neighbors must be encouraged.

A well-established SMS will go a long way to improve safety. It is hoped that we here in West Africa especially will take this concept seriously in order to take safety to a higher and reliable level. ^

kwapong05@yahoo.com

4 Africa News

THE CONTROLLER34

Safety Management SystemsThe Way Forward – also from an African Perspective

^ by Mick Atiemo, Africa Regional Editor

A Safety Management System (SMS) is a proven, systemic way of safety assurance. It has been adopted as an ICAO re-quirement for all service pro-viders to implement such a sys-tem, with the aim to provide a continuous improvement in all aspects of safety.

A Safety Management System is a series of processes that iden-tify safety hazards, implement remedial actions that restore or improve safety, and continu-ously monitors and assesses safety performance. Main aim is continuous improvement of the overall safety performance. The basic components of such a system are risk management, safety assurance and safety promotion. The management of the organization must accept responsibilities and also com-mit to the system. Risk identifi-cation and assessment must be done in a professional (i.e. fairly and competently) manner. Only by consistently applying these

processes will lead to quality in safety stand-ards. We all know that safety can't be or isn't absolute; we must keep improving it.

Promotion of safety is also important be-cause the understanding and or appreciation of safety by all staff of the organization is necessary for SMS, all must be educated and professionally trained.

In our part of the world where the basics are even lacking, one wonders how such a system will operate and what will be achieved. Where we are now, coupled with our slow pace of de-velopment in the industry, there is a long way to go and a lot of work to be done. The will, commitment and non-interference of manage-ment and a total organizational support, safety is everybody business. Findings and recom-mendations of assessments and investigations are important and must be accepted and taken seriously. The era where recommendations are kept in files as papers while hazards persist, must be considered as past and our attitude towards safety must change for a more proactive look.

The promotional aspect of the system is also very crucial as we need the expertise, this we do not have. We need well-trained pro-fessionals to set up such a system, not the

4 Artist rendering of an A400 landing in the desert.

Photo: eads

THE CONTROLLER 35

Charlie’s Corner

Loosing Pieces of AircraftIn the September 2008 edition of Charlie’s, I reported about a French ATR 42 that lost a landing gear wheel somewhere between Paris and Lyons, which was never found. Well, that same company (Airlinair) this time lost a cargo access door from one of their ATR72s last September. The large door fell on a house near Valence (France). Fortunately nobody was hurt, it only broke some roof tiles. I guess the maintenance guy in charge of safety in that airline must be looking for a new job.

Cheap RepairsThis photo was taken by a pas-senger. Someone repaired a cracked winglet with duct tape. The notion of safe repairs is very flexible in that airline apparently (which shall remain nameless)

Safe in all LanguagesSome passengers on an Aer Lingus Airbus A320 flight from Dublin to Paris last Sep-tember began shouting out and crying as they thought their plane was about to ditch. The drama followed an initial announce-ment made in English, telling passengers to return to their seats because of turbu-lence while flying over the Irish Sea. But then the cabin crew accidentally played out a recorded emergency landing warning in French. Around 70 French passengers were reported to be “freaked out” on hearing the warning. One English-speaking passen-ger said: “The French man sleeping next to me woke up and looked very startled.” He then translated what had been said, that the plane was about to make an emergency landing and to await instructions from the pilot. “I got quite alarmed. The woman be-hind me was crying. All the French totally freaked out.” The plane was just 20 minutes into its flight to Paris when the bungled an-nouncement was broadcast. The Irish air-line's cabin crew quickly realized their mis-take and swiftly apologized in French. Later an airline spokesman said: “There was a malfunction of the public address system“

Safe Charlie

Photo: Frank Notes

Photo: pilotsengineerstechinfosite

4 D-FUKK… It could have been worse.

Photo: DP

Bad LuckSometimes you must have luck in order to be safe they say. Well in Germany, un-like in many other countries, you cannot choose your aircraft registration. This guy spent 4 years and thousands of hours re-storing with love an old North American Harvard T6, and when he applied for reg-istration look what he got! It could have been worse, yes, and that is what everyone is telling him.

Overheard on the Frequency:

Flying through Syrian airspace requires pilots to advise ATC of aircraft type and registration, so the correct route charg-es can be calculated.An American carrier was over-flying at 0200 in the morning. Syrian Controller – Ah… confirm you are a B767, registration N12345A?Pilot – (Slow American drawl)... Man, you’ve got good eyes!

••••••••••••••••••••••• Dublin ACC (Ireland):Pilot: “ Control, we’re getting some

music on the frequency here.”ACC: “ Yeah, we’ve been getting re-

ports of that alright. The music any good?”

Pilot: (very serious tone) “ It seems like choir or church

music.”ACC: (mocking) “ Eh, yeah, you should be hitting

motown in a minute.”

Cabin SecureIn this airline, if you report a problem, they take it seriously: 6 maintenance guys are coming immediately to fix the problem and they even take a photo as proof! I will fly in this Airbus A330 anytime! ^

charlie@the-controller.net

paying of lip service. Training is the base on which every discipline or work stands and for that matter S M S. Inadequate or piece meal type of training will not make the sys-tem give the required impact. The continu-ous up grade or up date to get abreast and keep pace with worldwide development is necessary.

We can also not rule out consultancy service when setting up such a system. Training they say is rewarding, not costly. The education of all staff of the organization to know that safety is a team business. Safety must be quality and assured of, we must therefore make serious effort to establish these systems to improve safety in our part of the world which is behind in all aspects of world development and for that matter safety in the aviation industry.

The sharing of expertise, knowledge, in-formation and experience, among regional neighbors must be encouraged.

A well-established SMS will go a long way to improve safety. It is hoped that we here in West Africa especially will take this concept seriously in order to take safety to a higher and reliable level. ^

kwapong05@yahoo.com

4 Africa News

THE CONTROLLER34

Safety Management SystemsThe Way Forward – also from an African Perspective

^ by Mick Atiemo, Africa Regional Editor

A Safety Management System (SMS) is a proven, systemic way of safety assurance. It has been adopted as an ICAO re-quirement for all service pro-viders to implement such a sys-tem, with the aim to provide a continuous improvement in all aspects of safety.

A Safety Management System is a series of processes that iden-tify safety hazards, implement remedial actions that restore or improve safety, and continu-ously monitors and assesses safety performance. Main aim is continuous improvement of the overall safety performance. The basic components of such a system are risk management, safety assurance and safety promotion. The management of the organization must accept responsibilities and also com-mit to the system. Risk identifi-cation and assessment must be done in a professional (i.e. fairly and competently) manner. Only by consistently applying these

processes will lead to quality in safety stand-ards. We all know that safety can't be or isn't absolute; we must keep improving it.

Promotion of safety is also important be-cause the understanding and or appreciation of safety by all staff of the organization is necessary for SMS, all must be educated and professionally trained.

In our part of the world where the basics are even lacking, one wonders how such a system will operate and what will be achieved. Where we are now, coupled with our slow pace of de-velopment in the industry, there is a long way to go and a lot of work to be done. The will, commitment and non-interference of manage-ment and a total organizational support, safety is everybody business. Findings and recom-mendations of assessments and investigations are important and must be accepted and taken seriously. The era where recommendations are kept in files as papers while hazards persist, must be considered as past and our attitude towards safety must change for a more proactive look.

The promotional aspect of the system is also very crucial as we need the expertise, this we do not have. We need well-trained pro-fessionals to set up such a system, not the

4 Artist rendering of an A400 landing in the desert.

Photo: eads

4 A330 cabin secure? Here you go!