This paper provides an overview of current practices and assesses if they meet desired outcomes when dealing with recovery from a critical incident/accident. As the boundary between the individual and organisation can be indistinguishable in ATM, both entities will be assessed. By comparison of recovery actions from actual events, some short falls have been identified. IFATCA provides guidelines considered to be ‘best practice’ covering a broad spectrum of the impact of a critical incident/accident on ATM for both the individual and service provider.

1.1 Whilst aviation has an enviable safety record, the continued expansion of air travel and the rapid deployment of new technologies both on the ground and in the air, it is clear the industry needs to guard against complacency. Over the last 15 years there have been major accidents and incidents that sadly have not all been as a result of human error. Yet these occurrences have had profound impact for those involved and those that operated on the periphery of the aircrew and ATCOs involved.

1.2 The subject of the paper was submitted by Italy, as it was seeking guidance material to create generic checklists of recommended practices and actions to be taken by their ATCOs following an incident or accident.

Firstly to clearly identify the scope of this paper of ‘critical incident/accident’ and ‘critical incident stress’ (CIS) the IFATCA definition will be used.

2.1 Definition

Critical Incident/Accident is any situation faced by Air Traffic Controllers that causes them to experience unusually strong emotional reactions, which have the potential to interfere with their ability to function either at their positions or later. Critical incident stress is the reaction a person or a group has to a critical incident.

The definition clearly permits any incident affecting an individual or group to be considered. Incidents are therefore not necessarily restricted to technical issues arising from the workplace.

2.2 Case Studies

To review past performance, the following is a brief summary of some notable accidents and incidents since the year 2000 together with the actions taken and the handling of the personnel involved.

2.3.0 – 31 JAN 01: Near mid-air accident between JAL 907 and JAL958

2.3.1 Subsequent actions

The aircraft were on a collision course towards each other. The pilots of both aircraft revived conflicting instructions from their Traffic Collision Avoidance System (TCAS) and those issued by the Tokyo Area Control Centre (ACC). The pilot of JAL 907 was credited with having avoided a collision when he abruptly forced his aircraft into a dive after making a rapid visual assessment of the situation.

2.3.3 In 2006 prosecutors asked for Hachitani, then 31, to be sentenced to one year in prison and for Momii, then 37, to be sentenced to one and one half years. On March 20, 2006 the court ruled that Hachitani and Momii were not guilty of the charge. The court stated that Hachitani could not have foreseen the accident and that the mix-up of the flight numbers did not have a causal relationship with the accident.The presiding judge said that prosecuting controllers and pilots would be “unsuitable” in this case. the Tokyo District Public Prosecutor’s Office filed an appeal with the Tokyo High Court on March 31.

2.3.4 On April 11, 2008, on appeal, a higher court overturned the decision and found Hachitani and Momii guilty. The presiding judge, Masaharu Suda, sentenced Hachitani, then 33, to confinement for one year, and Momii, then 39, for one year and six months. Both were placed on probation. Each of the two sentences was suspended for three years.

2.3.5 – 8 OCT 01: SAS Flight 686

Whilst taking off from Linate-Milpenasa airport, collided with a Cessna Citation. All those aboard both aircraft were killed together with four people on the ground.

2.3.7 In the appeal trial (7 July 2006), Fusco and Federico were discharged. Another four people were sentenced. The pardon law issued by the Italian Parliament on 29 July 2006 reduced all convictions by three years. On 20 February 2007 the Corte di Cassazione upheld the decision of the Appeal Court.

2.3.8 – 11 SEP 01: A series of four suicide attacks involving aircraft were committed in the United States

2.3.10 Subsequent actions

Initially traffic in-bound to New York and Washington was refused a clearance once a pattern of the attacks became clear. After approximately 30 minutes of United Airlines Flight 175 colliding with the WTC, the FAA Operations Centre imposed a grounding of all airborne traffic regardless of destination.

2.3.11 The FAA does not have a dedicated disaster recovery plan. The FAA coordinated closely with the NATCA CISM team conduct widespread Critical Incident Stress Debriefings (CISD) for all those facilities with involvement or for those that witnessed ‘ground zero’. NATCA recognised in the aftermath how fortunate they were to have such a mature infrastructure in place with Union representatives at every facility. In some cases a phone conversation was sufficient, followed by a CISD at the affected facility. After 9/11, controllers were frequently followed by the media upon leaving the security gate at the completion of their duty. In some cases CISM team members were sent to controller’s homes. All ongoing long-term support was then generally provided by the onsite Union rep.

2.3.12 The Union leadership also provided support during an investigative process that was required. Another element, the Employee Assistance Programme (EAP) was used. This is the clinical component of the NATCA CISM to provide Mental Health Professionals on site. CISM played no role in dealing with the media, police or investigative process.

2.3.16 A criminal investigation of Skyguide began in May 2004. On 7 August 2006, a Swiss prosecutor filed manslaughter charges against eight employees of Skyguide. The prosecutor called for prison terms of 6 to 15 months, alleging “homicide by negligence.” The verdict was announced in September 2007. Three of the four managers convicted were given suspended prison terms and the fourth was ordered to pay a fine. Another four employees of the Skyguide firm were cleared of any wrongdoing.

3.1 From the Japanese near mid-air collision, Uberlingen and the Brazilian mid-air accident major improvements have been implemented throughout aviation to enhance procedures between aircrew and ATC governing the standardised use of TCAS Resolution Advisories (RA).

3.2 The Linate and Uberlingen accidents highlighted that aviation administrators were not immune to prosecution in relation to accidents, where poor oversight or lack of Safety Management Systems were deemed as causal factors.

3.3 An additional focus was placed on the contentious issue of Single Manned Positions an issue IFATCA has long been opposed to. Management were aware that prior to the accident, ATCOs were working alone during overnight duties. It would seem the Safety Management model of Skyguide was not effective in assessing the impact of single person operations and with hindsight this became a causal factor in the findings. Had an SMS programme been proactive, the Single Person Operation (SPO) would have been highlighted as an unsafe practice in advance.

4.1 Within the ATC environment operational staff are trained to operate in accordance within strict protocols in abnormal situations, primarily relying on checklists to ensure all avenues of assistance are employed during catastrophic events. It is in the aftermath of such events that is the focus of this paper. Many ANSPs have established a Critical Incident Stress Management (CISM) programme. This is the primary tool to assist workers involved in or impacted by any significant occurrence to be able to return to work by minimising any residual effects. These occurrences do not have to be work related. Examples may of a personal nature not job related involving traumatic marital issues or dealing with the death of a close friend.

4.2 With the terrorist attacks on the WTC, the FAA and its workforce were exposed to possibly the greatest single catastrophic series of events yet experienced in aviation. Obviously many changes were made to operational procedures to enhance security considering the extraordinary chain of events that could not have been anticipated. However, at the personnel level, CISM was employed to assist people in returning to work as effectively as possible. Considering the large scale, impact the NATCA CISM team made effective use of Critical Incident Stress Debriefings (CISD) to contend with the significant number of staff that was affected.

4.3 According to NATCA, following this wide-scale use of CISM following 9/11 assisted with unilateral support for the programme by both management and their membership. The Netherlands also has a very effective CISM programme and they responded that they do not have anything external to that programme to handle accidents or incidents.

5.1 The performance appraisal of the NATCA CISM teams in the aftermath of 9/11 is testament that a well administered CISM programme works. The same programme was tested during Hurricane Katrina. Some MAs though have developed disaster recovery plans. These are developed around division of responsibilities and actions for known and forecast events.

5.2 The UK is one of the few MAs known to have a composite disaster recovery plan. It was first used following the British Airways B777 crash short of the runway at Heathrow. For such a plan to work, it must come into operation as soon as the occurrence is known and cover all levels within an organisation. Not to distract from the large scale events already listed above, such an occurrence could simply be the suicide of a workmate and the resulting impact on co-workers. Hopefully this example will keep the intended coverage of such a programme to a very broad spectrum to ensure it covers all known or anticipated events.

5.3 Three major civilian disasters, Hurricane Katrina, the Christchurch earthquakes and Japanese Tsunami, although external to ATC, had direct consequences on the mental state of staff considering the events impact on basic human needs. In the earthquake situation in New Zealand, CISM was not used in such a unique occurrence where the entire workforce, plus family and friends were impacted simultaneously. Also, their CISM team was not trained to deal with major national disasters.

1. ANSP management
2. Unit managers
3. Supervisors
4. Identify those involved directly and indirectly
5. Activation of CISM
6. Involvement by the staff association and or peer support
7. Briefing and dissemination of information to other staff members
8. Relaying of information to families and close others
9. Dealing with the police or relevant authority
10. Dealing the with the media
11. Means to protect the identity of those involved
12. Safe house checklists

6.7 CISM/Peer Support

The Federation endorses the use of professionally trained peers in the provision of critical incident stress management (CISM) to colleagues experiencing critical incident stress. Any conversations or discussions of events at this level are deemed totally private and not to be seen as part of the investigative process. A part of the success of CISM is predicated on those involved being able to express their recall of events in a secure environment.

6.8 In events where technical infringements have occurred or suspected to have occurred, IFATCA has established policy for actions taken in the event of an incident/accident. It would be best administered at the peer to peer level to initiate this process and ensure that it is adhered to, to moderate any unnecessary stress on the individual or individuals concerned. If the case warrants the use of dedicated

6.9 The areas covered by policy vare as follows:

• Just culture and its application
• Exemption from duty
• Right of representation
• Protection of identity
• Use of recorded data

6.10 Peer support should also monitor as far as possible the personal conduct of those involved with regard to stress management.

6.11 Dealing with the media

The media in general may purport ethical behaviour, but in general their aim is to sensationalise events for commercial gain. If ATM is seen by the public to be secretive in nature by not providing details to the media, it can be counter- productive. The Eurocontrol study of the media made the following determination:

“The low profile of air traffic control in forming opinion among the general public could be storing up problems for the future in a world where transparency and reporting are increasingly becoming the standard practice required of social actors. What legitimacy will the technological and organisational choices made in the future by ATC have in the eyes of the general public if their knowledge of the field is sketchy or non-existent?”

6.12 The report also formed a link between the political orientations of the newspaper. The political leanings of the paper also seem to be a major factor in apportioning blame. Left- wing publications tend to highlight the failure of the system and tend not to concentrate on the individual. Right-wing establishments, while not denying the system is to blame, systematically highlight the human failings of those involved.

6.13 It was established that five parameters trigger and sustain media interest in ATC:

• The scale of the accident and how dramatic it is
• The cumulative effect. Is it serial in nature indicating a flawed system?
• The local dimension. How close was the event to the organisation reporting it?
• The presence of specialised journalists in the editorial team
• The involvement of the judiciary. The press tends to feed off a trend where a judiciary demonstrates an impetus to proceed quickly from finding causes to apportioning blame and responsibility

6.14 The report also determined that the handling of the Milan and Uberlingen cases demonstrated a shift in ideology when accepting levels of risk in a system. Risk is inherent in every facet of life and until recently it was an accepted norm that new technologies brought with them added risks in their evolution to maturity. The reporting of recent cases though has indicated a reluctance to accept such a stance.

6.15 Obviously dealing with the media is an art form and is usually strictly controlled by the senior management of ANSPs. Staff associations are commonly solicited for comment, however the advent of social media has further complicated the issue of rapid dissemination of information, be it factual or otherwise. It appears the best result comes from striking a relationship with the media and permitting a better understanding of the ATM environment prior to events occurring. Attempting to add technology and human factors after the event can always be seen as a ‘cover up’, sparking a lack of trust.

6.16 Social Media

Regarding the use of Social Media, management and staff associations should conduct an education programme highlighting the adverse side effects of transmitting potentially damaging information without any form of control. The tragic murder of Peter Nielsen should provide ample demonstration of the consequences of such actions.

7.1 The evidence from US experiences would indicate that a plan for recovery actions is not a necessity. However, to ensure a complete coverage of all aspects and entities is covered within the events included within the scope of this paper, it is plausible to argue that a plan linking staff and management at all levels with a flexible action plan is more prudent. The plan should be readily adaptable to the circumstances as aviation history attests forecast predictions are rarely accurate. A very instructive example: who would believe that a jet aircraft could suffer a double engine flame-out shortly after departure and land in the Hudson River, clearing numerous bridges and river traffic, without loss of life. Yet who would have conceived a disaster plan with such an outcome?

7.2 So several cases here indicate that a plan is better than no plan. While the basis of the NZ Crisis Management Plan may have been totally inadequate where forecast contingencies were not accurate, it still provided a solid basis for a rolling action plan. As is evident in Threat and Error Models (TEM), human performance is always demonstrated to be far more reliable under pressure, if some sort of rehearsal of imagined events is undertaken prior to an occurrence. The strategy of any plan should include the division of responsibilities for actions taken to avoid duplication of effort or omission.

7.3 There is sufficient evidence from the experience gained from the incidents/accidents detailed above that contingency planning at the minimum should cover actions by the following entities and action items.

7.4 Entities

• CISM team activation
• The individual or individuals concerned
• EAP

• Ensure those directly and indirectly involved are identified and recorded for comprehensive coverage by CISM/EAP
• Involvement by the staff association and or peer support
• Activation of CISM
• Briefing and dissemination of information to other staff members
• Relaying of information to families and close others
• Dealing with the police or relevant authority
• Dealing with the media
• Means to protect the identity of those involved
• Use of events to update existing plans and re-educate EAP and CISM staff.
• Safe-house check-lists

General advice:

1. Have yourself relieved from your position immediately.
2. Immediately contact your association representative.
3. Decline to make any statements to anybody, written or oral.
4. Make personal notes of the incident, but do not make them public.
5. With the assistance of your Association nominee, complete and submit safety incident report. Only fill in the facts pertaining to your actions in time sequence.
6. Seek legal opinion to protect your Rights.
7. If you are given a direct order by your supervisor to make a statement, then only outline the facts: name, address, control position, time, etc.
8. Avoid a detailed statement at this time as a written statement should be perused by your legal representative before submission to your supervisor.
9. Before issuing a statement insist on a review of all audio, radar, CCTV or recorded information.
10. Under no circumstances should you agree to a joint ATS/Safety Board or Regulator interview. You should insist that separate Safety Board/Regulator and ATS interviews take place.
11. Contact the CISM team if provided.
12. Make no official statements without witnesses (Association representative, Supervisor, CISM or legal representative).

1. ANSP management
2. Unit managers
3. Supervisors
4. Identify those involved directly and indirectly
5. Activation of CISM
6. Involvement by the staff association and or peer support
7. Briefing and dissemination of information to other staff members
8. Relaying of information to families and close others
9. Dealing with the police or relevant authority
10. Dealing the with the media
11. Means to protect the identity of those involved
12. Safe house checklists