Introduction

1.1 The ATM system has been enhanced in recent years to resolve capacity and delay problems and to provide a better more cost-effective service to the airlines.

1.2 As each of these new developments are introduced the mixed mode environment is increased through either exemptions or non mandatory equipage.

1.3 Each of these new technologies or change in operating methodology has been introduced with associated exemptions, for State Aircraft, Humanitarian Flights, Military operations, etc., because the aircraft concerned being unable to comply with the requirements for a given piece of airspace. Additionally, States will provide exemptions for political reasons.

1.4 Where equipage requirements are introduced such as Mode S and Datalink which will not be mandatory there exists and will exist a mixed mode environment.

1.5 This paper looks at the impact of these and offers a solution to what is becoming an increasing problem.

Discussion

2.1 THE PROBLEM

2.1.1 With the increasing complexity in airspace it is inevitably necessary for Military and State Aircraft to operate as General Air Traffic. The numbers of these aircraft are increasing.

2.1.2 B-RNAV – With the gradual withdrawal of terrestrial based navigation aids and the need to fly accurately to accommodate closely spaced parallel route structures, the introduction into the system of a non-equipped aircraft increases the controller’s workload.

2.1.3 P-RNAV – This introduction has already been identified as being problematic, particularly in TMA’s where SIDs and STARs will be designed around this requirement.

2.1.4 TCAS – In an environment where TCAS V7 will be mandated as a safety net, the safety of the system is degraded through the introduction of non-equipped aircraft.

2.1.5 8.33 – Exemptions may be granted by States within the Area of Mandatory Carriage, but which are not actually implementing 8.33 kHz channel spacing. Such exemptions may be either unconditional or conditional. Unconditional: all flights of non-equipped aircraft are permitted. Conditional: only clearly specified categories of flight are permitted. Exemptions must be clearly specified so that there is no doubt whether a flight may or may not proceed through the airspace concerned. Examples of conditional exemptions: Domestic flights; Flights not entering specified portion(s) of the airspace. or as per LOA such as Austria’s exemption of 8.33 carriage for all arrivals landing at Vienna airport and coming from the East (non-8.33 zone). That LOA states that inbound Vienna flights are transferred at the first available level below the 8.33 airspace.

2.1.6 Those State aircraft which are infrequent users of the FIR/UIR (or sectors, as applicable) where 8.33 kHz channel spacing is in actual use, are permanently exempted from the above carriage requirement, provided that they are able to communicate on UHF where available. Where UHF is not available, State aircraft not equipped with 8.33 channel spacing equipment shall be excluded from airspace where 8.33 channel spacing is in operation. Note: Infrequent user is one defined as not exceeding 30 hours flying time per airframe per year, within the airspace concerned. However there is no mechanism to ensure adherence to this requirement.

2.1.7 RVSM – The only exemption granted to operate in EUR RVSM airspace -State NonRVSM are approved for Specific exemption as in Regional Supplementary Procedures Doc 7030. This has the effect of controllers requiring to facilitate by providing a two thousand foot separation from other traffic and also co-ordinating with adjacent sectors and/or centres. Increase workload. Although the EUR RVSM procedures do not allow for civil Non-RVSM exemptions, some States have specified airspace in which special rules apply e.g. for aircraft manufacturers to flight-test new aircraft. Although no non-equipped aircraft are expected to fly in RVSM airspace, military flights do – such as AWACs and special military flights. In addition, a State can approve the acceptance of non-RVSM flights which remain wholly within the airspace of the State. Formation Flights of State Aircraft; classified as non-RVSM even if the aircraft are individually MASPS compliant. In addition, there is the requirement of 2000ft separation for TSAS, Prohibited, Restricted and Danger Areas.

2.1.8 Where new technology such as Mode S, Datalink, ADS reporting etc are introduced as non mandatory a controller is often faced with mixed mode operations.

2.1.9 Although a hazard analysis and safety case methodology has been used in the introduction of all these items, this has been on an individual basis. There is no evidence that a hazard analysis or safety case has been carried out for mixed-mode operations. It is IFATCA’s opinion that the impact on workload of mixed-mode operations is such that management should recognise that there is an increased risk and that capacity should be reduced.

2.2 JAMES REASON’S ANALYSIS OF THE AVIATION INDUSTRY

2.2.1 James Reason views the aviation industry as a complex productive system. One of the basic elements of the system consists of the decision-makers (upper management, the company’s corporate body or the regulatory body), who are responsible for setting goals and for managing available resources to achieve and balance two distinct goals: the goal of safety, and the goal of on-time and costeffective transportation of passengers and cargo. A second key element is line management – those who implement the decisions made by upper management. For upper-management decisions and line management actions to result in effective and productive activities by the workforce involved, certain preconditions have to exist. For example, equipment must be available and reliable, the workforce has to be skilled, knowledgeable and motivated, and environmental conditions have to be safe. The final element – defences or safeguards – is usually in place to prevent foreseeable injury, damage or costly interruptions of service. ATCO has to distinguish many differing aircraft capabilities and/or attributes (wake turbulence category, RVSM approval, 8.33 equipage, RNAV capability, etc.) that are usually indicated only by a single character on the strip or in (a specific line in) the label, or by a dedicated radar symbol. The more differing indicators there are, the higher the chance of confusion or overlooking its significance.

2.2.2 Illustrated in [the attached figure] is Reason’s model of how humans contribute to the breakdown of these complex, interactive and well-guarded systems to produce an accident. In the aviation context, “well-guarded” refers to the strict rules, high standards and sophisticated monitoring equipment in place. Because of technological progress and excellent defences, accidents seldom originate exclusively from the errors of operational personnel (front-line operators) or as a result of major equipment failures. Instead, they result from interactions of a series of failures or flaws already present in the system. Many of these failures are not immediately visible, and they have delayed consequences.

2.2.3 Failures can be of two types, depending on the immediacy of their consequences. An active failure is an error or a violation which has an immediate adverse effect. Such errors are usually made by the front-line operator. A pilot raising the landing gear lever instead of the flap lever exemplifies this failure type. A latent failure is a result of a decision or an action made well before an accident, the consequences of which may lie dormant for a long time. Such failures usually originate at the decision-maker, regulator or line management level, that is, with people far removed in time and space from the event. A decision to merge two companies without providing training to standardise operating procedures illustrates the latent failure. These failures can also be introduced at any level of the system by the human condition – for example, through poor motivation or fatigue.

2.2.4 Latent failures, which originate from questionable decisions or incorrect actions, although not harmful if they occur in isolation, can interact to create “a window of opportunity” for a pilot, air traffic controller, or mechanic to commit an active failure which breaches all the defences of the system and results in an accident. The frontline operators are the inheritors of a system’s defects. They are the ones dealing with a situation in which technical problems, adverse conditions or their own actions will reveal the latent failures present in a system. In a well-guarded system, latent and active failures will interact, but they will not often breach the defences. When the defences work, the result is an incident; when they do not, it is an accident.

2.2.5 An application of the Reason Theory could be that exemptions are established at “Decision Makers” level (possible “latent failure”), strategically planned at “Line Management” level (possible “latent failure”), but tactically managed by the operational staff (the “productive activity”). Every mixed operation with exempted traffic affects workload, consequently affects ATCOs’ situational awareness and safety. In presence of “Preconditions” (such as bad weather conditions), workload can exceed ATCOs managing capability, resulting in an “active failure” of the system.

2.3 POSSIBLE SOLUTIONS : NO EXEMPTIONS, OR STRICT EXEMPTION MANAGEMENT

2.3.1 The position could be taken that no exemptions should exist and that “Decision Makers” at political level should decide to implement a new procedure only when able to update State aircraft equipment. One of the most important principles of a modern State is, indeed, that the laws are to be respected also by those who make the laws.

2.3.2 The possible “strategic defence” is to give a “workload balanced weight” to every exempted aircraft, depending on the type of exemption. This could work in the following way:

• Sector capacity: 30 aircraft per hour,
• Exempted aircraft #1 weight: 2.3,
• Exempted aircraft #2 weight: 2.7,
• Exempted aircraft #3 weight: 2,
• Number of “non-exempted” aircraft to accept in the hour under consideration: 30-(2.3+2.7+2)=23

2.3.3 The sector capacity will be reduced by 7/30 x 100% if three similar exempt aircraft fly through the sector in any given hour. This should be done pre-tactically at ATFM level, restricting the time to submit an FPL at some 4 hours (instead of 3) prior of the EOBT, for the exempted aircraft.

2.3.4 However, this would become even more complicated as the weighting would be different in the case of number (7) non-RVSM aircraft at the one time, as opposed to 1 non-RVSM, 1 non-8,33, 1 non-BRNAV etc.

2.3.5 Reducing the numbers of exemption does not necessarily imply that the operation becomes safer. For example, if I ask you to blindfoldedly walk across a busy motorway, you probably would consider this an unsafe thing to do. Now, if I halve the number of cars using that motorway, or even reduce it by 95%, would that make it any safer? I think not – I think all it does is reduce the probability of something happening. The only way to make it safe is to build a bridge or to dig a tunnel, or not to cross at all.

2.3.6 The controller is used as mitigator through the use of indicators either on the flight data display or on radar. When information validity is in doubt, the controller must verbally check with the flight. Additionally, when a flight is identified as non-equipped and cannot be received by the next unit as an exemption, the aircraft must be rerouted. At this time, some of the flight plan data is not transmitted and further exemption notice may be missed.

2.3.7 For example, if a flight approaching an OAC boundary states that it does not carry HF radio, it is not permitted to proceed and must be re-routed through another agency Iceland OAC. Iceland would not have been on the transmission of the original flight plan and will receive only brief details on the transfer. The route now being flown will be through unplanned ACCs who will have to ascertain the equipage of the aircraft for RVSM, 8.33kHz or BRNAV compliance.

2.4 ICAO Human Factors Training Manual (Doc 9683)

2.4.1 The applicability to ATC of technological innovations […] has to be appraised, to assess their helpfulness and their optimum forms in relation to ATC. It is necessary to identify all the Human Factors consequences of such changes, and to resolve the associated problems not only of display, control, integration, interfaces, communications, understanding and memory, but also of team roles, attitudes, norms and ethos.” (Page 1-5-22, para 5.5.33). I think it would be totally in keeping with the spirit of this paragraph to add “workload” to the listing at the end of the sentence.

Conclusions

3.1 The ATM system will continue to evolve through the use of technology and the number of exemptions, if not checked now, will increase – Mode S, FM Immunity, MLS, ADS, CPDLC, TDMA radios etc, to name but a few. The controller is often used as the mitigation to permit these to operate, however there is a limit to the number of pieces of information which can be displayed either on the data display or the radar to indicate these exemptions, and also the cognitive function of the controller to react to numerous triggers.

3.2 The introduction of non-mandatory technology and its use of, introduces to the environment a mixed mode operation. Whilst currently at low levels there are
proposals to introduce more technology Mode S, Datalink, MLS etc which will have an impact on the operation.

3.3 Airspaces such as the North Atlantic specify a Minimum Navigation Performance Specification thereby denying access to the core area of the airspace to those not meeting that requirement. This practice should be the norm rather than the exception.

3.4 There is an identified need to conduct a safety analysis on mixed mode operations, in all its variances.

3.5 It should be recognised that there is a limitation to the number of different exemptions in a given airspace and that these will have an impact on capacity and safety. The introduction of more of these exemptions will only make the airspace more complicated.

Recommendations

It is recommended that:

4.1 In addition to the individual safety case, a system safety analysis should be conducted at the introduction of each and every technology which results in mixed mode operations.

4.2 The role of the controller as the mitigation must be considered in the context of the level of integration and that, for safety assurance, capacity levels must be revised to maintain the required safety level.

Annex