Summary

This paper recognises that accidents/incidents don’t just happen because a few individuals didn’t pay attention but rather because of a whole systems failure. It therefore proposes a systemic approach to the incident/accident reporting in order to identify and eliminate the weak link in ATM which may lead to a serious incident or accident.

Introduction

1.1. Air Traffic Control (ATC) relies mainly on the support of other Air Traffic Management (ATM) units in order to achieve the objectives of safety, orderliness and expedition. Timely and accurate information, serviceable equipment and good management are crucial to achieving these objectives.

1.2. A theme of the International Federation of Air Traffic Controllers’ Association (IFATCA) that comes to mind is ‘Together Safe Skies’, where IFATCA seeks to partner with both internal and external stakeholders to achieve high standards of safety. Internal stakeholders (e.g AIM, CNS, and Management) are very crucial in achieving safety. ATC cannot achieve safety without this support.

1.3. The role of internal stakeholders in eliminating some of the latent issues that could impact on safety must be looked at keenly in order to develop an effective incident/accident reporting system.

1.4. Comprehensively implemented Incident Reporting Responsibilities will:

• Improve incident reporting;
• Improve incident investigation through comprehensive reporting systems;
• Create awareness across the ATM domain that ATCOs are not the sole bearers of safety responsibility;
• Protect the ATCO in case of legal issues arising after an incident by having comprehensive incident reporting systems in place, which help in proper investigation systems.

Discussion

The importance of complete information for incident investigation

2.1 It is not uncommon to find incidents happening under/to ATC which have been contributed to by events that occurred elsewhere in the ATM system. According to James Reason’s ‘Swiss Cheese Model’, an incident is often a result of cumulative acts entailing both active and latent failures. Since all individual parts of the system all have their defences, a single error is unlikely to result in an accident. The better all systems are aligned and work together, the smaller the chance that defences will be broken.

2.2 When investigating incidents, complete information from all involved parties is essential to get a complete view of the situation at the time of the incident, and identify all factors that were involved. An investigator needs to know how the whole ATM system worked and what defenses were broken and/or not in place.

2.3 The following examples are hypothetical cases that illustrate why complete information is important to proper incident investigation:

Example 1

During flight planning, incorrect types of aircraft, incorrect RVSM status, incorrect aircraft capabilities e.g. RNP capabilities may lead to overestimation or underestimation of aircraft performances. If an ATCO receives a flight plan indicating that one aircraft is an A320 and another departing behind is also an A320 instead of e.g. a B777, this may lead to serious problems. The ATCO could be misled and as a result, apply insufficient separation between consecutive departing aircraft. Errors in calculating crossing times may result in a similar scenario. Allowing aircraft to operate in RVSM airspace while they are not RVSM approved is a common occurrence due to errors in flight planning. When AIP charts and departure information are not accurate, the controller may clear an aircraft on a SID that happens to be wrongly published, e.g. wrong frequencies are listed.

Example 2

Procurement of inadequate equipment (as a cost cutting measure), untimely or inadequate maintenance of equipment (resulting into e.g. erroneous radar information) would impact negatively on safety. Investigators may fail to capture information about equipment failure in the event an incident happens while crucial equipment is unserviceable. In this case an equipment unserviceability report should form part of the incident reporting as per the safety management manual.

Example 3

Work overload may be a result of Single Person Operations (SPO) caused by inadequate staffing, or other reasons such as training and sickness absence. When an incident happens during Single Person Operations, investigations may conclude that the ATCO was not attentive or was distracted, but may fail to capture that the ATCO may have been fatigued due to working on his own. In this case a report by the appropriate authorities would help with proper investigations to avoid future repeat of putting one person on duty at any time.

Implementing a Safety Management System (SMS)

2.4 The ICAO Safety Management Manual (Doc 9859) defines a Safety Management System (SMS) as a systematic approach to managing safety, including the necessary organisational structures, accountabilities, policies and procedures.

2.5 Accurate and timely reporting of relevant information related to hazards, incidents or accidents is a fundamental activity of safety management.

2.6 Mandatory incident investigation and voluntary reporting are some of the safety databases that may be used to support safety data analysis, and these reports form part of the safety data required for investigation.

2.7 The SMS manual states that Aviation safety has transformed through 3 eras.

2.7.1 Technical era:

The focus of safety endeavours was placed on the investigation and improvement of technical factors.

2.7.2 The Human Factors era:

The focus of safety endeavours was extended to include human factors issues including the man/machine interface.

2.7.3 The Organisational era:

During the organisational era safety began to be viewed from a systemic perspective, which was to encompass organisational factors in addition to human and technical factors. The notion of the ‘organisational accident’ was introduced.

2.8 From the above, it is clear that incident reporting needs to evolve with the eras by adopting a systemic approach to incident reporting which leads to a more objective investigation system and hence improvement in aviation safety.

Systematic and complete Incident Reporting

2.9 Accurate and timely reporting of relevant information related to hazards, incidents or an accident is a fundamental activity of safety management. The data used to support safety analyses are reported by multiple sources.

2.10 A systemic approach helps us understand two key aspects of our work. First, it gives us frameworks to look into the wider system (and specific functions/parts in that system) which poor and disadvantaged women and men are part of. Second, it guides us to understand the main causes for underperformance/failure and not just their symptoms. Research and analysis is thus an essential part of our daily work; it shapes our focus for intervention. A systemic approach provides us the strategic framework to do this by continually asking ‘how?’ and ‘why?’ It helps us to ‘peel the onion’ until we find the main causes that gives us leverage for relevant and meaningful impacts (https://blog.helvetas.org/on-systemicapproach/#is).

2.11 Effective safety management is data driven. Hence proper management of the organisation’s databases is fundamental to ensure effective and reliable safety analysis of consolidated sources of data.

2.12 A study report on ‘Guidance Material for Robust ANSPs Incident Analysis Systems of the European Organisation for the Safety of Air Navigation’ (2006) identified the following as some of the preconditions of immense importance in order to run a successful reporting system;

• The right resources at the right place: e.g. adequate personnel, adequate funding and time.
• Commitment from the senior management (make sure management knows what it wants before the work starts).
• The analysis of reports and findings requires at least as much expertise as the persons who are involved in the generation of the incident.
• Trust and independence of the investigation unit should be cared and nurtured by the company and the people involved.
• The development of systemic methods in the analysis process and how to implement systemic methods in analysis of data and investigations.

2.13 The guidelines developed and presented by European Organisation for the Safety of Air Navigation, are based on well-established research as well as on findings from studies showing that “we might have to reconsider some cherished ideas about how to handle the reporting of occurrences within complex systems”. The study proposes the systemic approach or ‘New View’, which advocates that human error is a symptom of deeper trouble inside a system.

2.14 According to the European Organisation for the Safety of Air Navigation, the ‘New View’ expresses that accidents don’t just happen because of single errors. Accidents happen because entire systems fail, not only a few unreliable parts. The ‘New View’ believes that accidents are produced by the daily trade-offs that organisations and the people inside the organisations have to do.

2.15 ICAO has provision for reporting incidents by ATCOs using the ATC Incident Reporting Form, however there is no known provision for capturing incident reports by others within the ATM domain. The International Civil Aviation Organization (ICAO), in Annex 13 to the Chicago Convention, states that

“the sole objective of the investigation of an accident or incident shall be the prevention of accidents or incidents. It is not the purpose of this activity to apportion blame or liability.”

2.16 In support of this philosophy IFATCA has produced policy on Accident/Incident Investigation in order that ATCOs can contribute fully to an investigation. It is necessary to gather all relevant facts that led up to the incident/accident in order that we can continue to use this knowledge to improve the safety of the ATC system. (See IFATCA TPM LM 11.2 and LM 11.2.8)

Conclusions

3.1 A good reporting system must involve a thorough investigation within the whole ATM system. Incident reports by ATC are to be accompanied by a report of the whole ATM system which will assist in comprehensive investigation.

3.2. Incident reporting and investigation needs to change to reflect the systemic perspective by expanding the ICAO incident report to include reports by other ATM personnel.

3.3 Safety Management Systems (SMS) need to be fully implemented by all to address effective safety management. It is recommended that an air traffic incident report shall not be used in isolation but shall be used together with other safety data bases as specified in the SMS Manual in order to investigate aircraft incidents.

3.4 All parties within the ATM domain need to be involved in incident reporting in order to have a robust incident reporting system.

3.5 MAs are encouraged to adopt IFATCA policy on incident/accident investigation as contained in the Technical and Professional Manual (TPM 2016 LM 11.2 and LM 11.2.8).

Recommendations

4.1 It is recommended that this paper is accepted as information.

References

ICAO PANS ATM (Doc 4444).

IFATCA Technical and Professional Manual (TPM) 2016.

Safety Management Manual (Doc 9859).

European Organisation For The Safety Of Air Navigation; A Study Report on Guidance Material for robust ANSPs Incident Analysis System Reason, James (1995). “A System Approach to Organizational Error”. Ergonomics. 38: 1708 – 1721. doi:10.1080/00140139508925221.