This paper will review the existing Single Person Operations policy and the Four Eyes Principle.

1.1  Due to economic conditions and changes in new technologies, Air Navigation Service Providers (ANSPs) have considered introducing Single Person Operations (SPO) and/ or the removal of the Four Eyes Principle (4EP).

1.2  As it appears not industrially possible to ensure having the 4EP systematically applied or to avoid SPO at all times, there must be appropriate and periodically reviewed mitigation measures in place. In fact, there are ANSPs already using SPO or not applying the 4EP in some form and some are considering expanding its use. Subsequently, many MAs indicated a high degree of interest in this matter, justifying a review of current IFATCA policies.

1.3  SPO last received attention at the 2004 IFATCA Conference in Hong Kong.

1.4  The 4EP was introduced at the 2005 IFATCA Conference in Melbourne.

1.5  Ambiguity and different interpretations of the term SPO were shown during PLC discussions and the committee is of the opinion that this term must be clarified.

2.1 Definitions and Existing policies

2.1.1

WC 1.1.6 Single Person Operation

IFATCA Technical & Professional Manual 2012 page 4217:

IFATCA Technical & Professional Manual 2012 page 4218:

2.2 Description of possible staffing situations

2.2.1 Air traffic is handled in many different ways around the globe. There are procedural or radar control units using voice or CPDLC clearances and instructions, paper or electronic strips and there are also stripless units.

2.2.1.1 As for the human aspect, there can be one, two, or sometimes more ATCOs on duty at one sector or in one unit.

2.2.2 SPO, per the current IFATCA definition, should be understood as a lone qualified controller on duty in a given unit.

2.2.2.1 This situation is contrary to IFATCA policy, and should be avoided.

2.2.3  The 4EP principle, per the current definition, should be understood as 2 or more qualified controllers working simultaneously as a team at one control position and monitoring each other as much as possible. This situation is often seen in terminal or en-route control centres. Geneva Area Control Centre (ACC) in Switzerland, Tel Aviv ACC in Israel, Amsterdam ACC in The Netherlands and Roma ACC in Italy for example, apply the 4EP principle with one executive controller and one coordinator for one sector at all times. Both ATCOs have an individual radar screen and are monitoring the traffic, the frequency or frequencies and each other at the exact same sector. In Geneva, this configuration is notably applied and followed during night shifts even when there is little or no traffic.

2.2.4  However, between the extremes of SPO and permanent 4EP, in many ATC units, an intermediate state of staffing is observed. For example in a tower, there can be one or more executive controllers working the airborne traffic while another or others will handle traffic on the ground possibly complemented by an ATCO giving initial clearance delivery. This is not considered as SPO as other controllers are on duty at the same time in the same facility.

2.2.5  For the purposes of this paper and possible future policy, PLC will introduce a new name for this situation: the Two Eyes Principle (2EP) i.e. only one person is monitoring the frequency at that time, but the ATCO is not the sole person on duty in the unit.

2.3.1  There are many and various reasons why SPO may be introduced, or the change from 4EP to 2EP be considered by an ANSP. As already discussed in previous working papers, today’s context of shrinking budgets and commercial pressures from different sources like States, airlines, ANSPs or other, are producing a global drive for increased efficiencies in the Air Navigation Systems (ANS) of the world. Consequently, ANSPs are continuously looking to find increased productivity from ATCOs, and thereby reduce their costs.

2.3.2  Other reasons why the introduction of SPO/ change from 4EP may be considered by ANSPs include:

• Persistent or temporary staff shortages in many ANSPs may also be a significant factor; therefore applying SPO or changing from 4EP might be preferred as a way of mitigating a lack of controllers, instead of closing units or working positions.
• In some established ANSPs, SPO or 2 EP has been the historical method of operation, which continues now because of those historical labour practices. There may not have been any safety analysis carried out on these procedures at any point.
• In many instances during periods where there is little or no traffic (e.g. night shifts) a unit can be found to reduce manning and operate as temporary SPO, or 2EP.
• Another important consideration is the introduction of automation and technical tools to better predict conflicting traffic and help ATCOs to better manage traffic flows. The introduction of conflict detection tools for example, may be considered by an ANSP as mitigation to reduce staffing levels, and introduce SPO or 2EP.

2.3.2.1 Some ANSPs can see in these new tools a way to alleviate a second ATCO at a unit or at a given working station, but history has shown that these new systems may not mitigate the presence of a second controller and may also introduce new hazards.

2.4 Potential human factors hazards of working SPO or 2EP

2.4.1 ATCOs can develop a false sense of safety when no safety events occur over a period of time. For example if a SPO unit or a position operated as 2EP (rather than 4EP) operates without any safety events during periods of low traffic. ATCOs or other people might then assume that it’s still safe even if the average traffic count has grown over time or that additional procedures and tasks increase the ATCO workload.

2.4.1.1  Provided no safety events occur in those busier conditions, people might think that this is acceptable both professionally and operationally and then accept this new method of operating the unit.

2.4.1.2  This attitude could be considered as a form of “Drift to Failure”, resulting in setting a new higher than normal traffic load or complexity norm. However, the latent safety hazards introduced by the reduction in manning levels still exist and could be the cause of an incident at any time. This concept was discussed in the Just Culture WP164 presented in Amman at the 2011 IFATCA Conference.

2.4.2  If a single controller is carrying out the roles of two people, for example working as an executive and planner controller, there is an increased risk that the attention needed by carrying out one task, may lead to the failure of detecting an error in the other task.

2.4.3  Boredom can become a potential safety hazard if the unit is particularly quiet as attention can wander and the mind can then be distracted away from the job resulting in poor monitoring. In this situation, a second controller can help in maintaining alertness, the mind staying busy and in a more ready state and to provide additional monitoring capacity.

2.4.4  Experience has shown that a lone ATCO can be quickly overwhelmed even with the most advanced equipment. In the span of an ATC career, a high proportion of ATCOs can expect to experience a rapid or unexpected rise in traffic, unforeseen weather, technical breakdowns, neighbouring ACC shutdowns or serious aircraft emergencies. These, or other circumstances, might significantly increase the workload and the complexity that an ATCO working under SPO or 2EP conditions will have to deal with.

2.4.5  SPO or 2EP is seldom found in other high stress, highly demanding of safety- critical occupations. For example, commercial IFR air transport of passengers is regulated in most countries with a minimum flying crew of 2 pilots.

2.4.6  As a general statement, it is an accepted fact that in a safety-critical working environment, redundancy in system components is an expected and welcome requirement. The redundancy of the human aspect in the system should also be considered as an essential requirement.

2.4.6.1 When SPO is applied, there is no human “safety net”.

2.5 Potential health and other hazards in SPO

2.5.1  If an ATCO is the victim of sickness or a serious health issue while operating SPO, he or she may be in need of urgent medical help and suffer from a lack of assistance.

2.5.2  In case of incapacitation, there may also be a temporary reduced ability to provide an ATC service.

2.5.3  Consideration should be taken in that; an increase in the risk of fatigue issues is possible when operating under SPO or 2EP, more so during night shifts. As described in the accident summary below, it was found that SPO during a night shift was a contributing factor in the outcome of the accident. Evidence showed that in this case, there was specifically a reduced ability to monitor effectively the aircraft concerned because of fatigue.

2.6 Accident example

2.6.1 A number of incidents and accidents have occurred where SPO was a contributing factor. One example is the Comair Airlines crash in Lexington, KY, USA.

2.6.1.1  On the morning of August 27, 2006, a single Air Traffic Controller was on duty at KLEX Air Traffic Control Tower. His duties that morning included operating the Clearance Delivery, Ground Control, Local Control and radar Departure functions.

2.6.1.2  At approximately 0605 EDT, after having been cleared to taxi to runway 22 three minutes earlier, the crew of Comair 5191 advised the tower that they were ready for takeoff. At the time of this transmission, the aircraft was located on taxiway “A”, short of runway 26. Shortly thereafter, the controller scanned runway 22 for traffic and issued Comair 5191 its takeoff clearance with the additional instruction to “fly runway heading.” At the time the takeoff clearance was issued, the aircraft was holding short of runway 26. After a brief exchange with Eagle Flight 882, the controller then turned his attention to administrative tasks inside the tower cab.

2.6.1.3  Comair 5191 taxied onto runway 26, began its takeoff roll, and crashed less than 2000 feet beyond the departure end of runway 26.

2.6.1.4  The takeoff clearance from the tower controller to the crew made no mention of a specific runway. The takeoff clearance was issued while the aircraft was on taxiway “A” and prior to reaching the intersection with runway 8/26.

2.6.1.5  While one-controller operations are allowable under FAA Orders, breakdowns in communication, ATC oversight and controller workload (fatigue and abundance of duties) clearly played a major role in this accident.

2.6.1.6  The Lexington Blue Grass Airport Air Traffic Manager stated that there were an authorized number of 21 controllers for his facility. On the day after the accident, he had only 15.

2.6.1.7  He creatively looked to other ways to staff the facility. During the first quarter of calendar year 2006, the manager had only been able to staff the midnight shift with two controllers on 40 of the 70 days.

2.6.1.8  At the time of the accident, the controller was working in the pre-dawn hours of the one night shift at the end of a five-shift 2-2-1 cycle. A medical analysis revealed evidence of fatigue in the controller and linked this to adverse circadian phase and sleep restriction. As documented in the factual reports, errors of omission, failure to proactively manage workload, slowed response times and inappropriate responses are typical of fatigue related behaviours.

2.6.1.9  A mathematical model that combines circadian phase with sleep history in an attempt to predict performance estimated that the controller was operating at 72% of his effective capacity at the time of the accident. For comparison purposes, this level of effectiveness equates to someone who had been awake for almost 21 hours straight or who had a blood alcohol level of slightly less than 0.08 g/100ml.

2.6.1.10  The investigation suggests FAA management accepted a degraded level of performance from controllers working under this schedule.

2.6.1.11  The controller’s ability to function at full capacity was impaired by fatigue as evidenced by the referenced fatigue study. The study clearly shows that the controller’s ability to function effectively was degraded to the point where he made a decision to turn his attention away from the aircraft at a critical time to work on a non-critical task.

2.6.1.12  During the investigation of the accident it was found that due to budget and personnel constraints, the air traffic control tower was operating at less than required staffing levels. This caused workload issues directing the controller’s attention away from their primary task of controlling traffic.

2.6.1.13  Had there been a second controller on duty at the time of the accident, the overall workload in the tower would have been substantially reduced. Eight seconds after the controller issued the final takeoff clearance to Comair 5191 he had a 14 second communication exchange with the previously departed Eagle Flight 882 aircraft. Immediately after the conclusion of this exchange, the controller immediately turned away from the local control position to handle his administrative duties.

2.6.1.14  The ATC Factual Report clearly makes the point that once the controller’s departure duties were completed, his attention was turned away from the scope and onto administrative duties (traffic count). While the flight crew selected the wrong runway, had the controller remained focused on local control, he was in a position to trap the crew’s error and cancel the takeoff clearance.

2.7 Mitigating measures for SPO or 2EP operations

2.7.1  Acknowledging that 4EP is the desirable configuration, it becomes obvious that neither SPO, nor a reduction in staffing resulting in a change from 4EP to 2EP should be introduced or used without a comprehensive and recurrent hazard analysis as complexity and occupancy will vary over time and warrant a review justifying its use or not.

2.7.2  Emergency situations, unexpected events and traffic or sudden health problems may occur at any time. The sole ATM safety net will then disappear. IFATCA policies state that mitigation measures to immediately provide assistance to an ATCO and to enable the continued safe operation of the air traffic service must be in place. Mitigation measures should also exist to restrict the traffic volume and complexity to a suitable level when SPO or a reduction to 2EP is in effect.

2.7.3  One other aspect that can enhance safety at a unit or working position is education and creating awareness to the ATCOs and management about avoiding situations that encourage individuals proving to themselves or to others that “I can do the job at all times” despite high complexity or workload.

2.7.4  IFATCA policy makes clear that SPO shall be avoided in the case of a stand- alone unit.

2.7.5  As a situational awareness enhancement for airspace users or adjacent units, when SPO can’t be avoided it should be mentioned in the respective Aeronautical Information Publication (AIP).

2.7.6  As SPO or a change to 2EP are considered as undesirable conditions, extra caution should be taken under certain conditions. These may include;

• The number of aircraft on frequency exceeds the determined maximum for the Controller working position (CWP).
• A system failure at the CWP or at an adjacent CWP.
• A downgraded CWP or systems maintenance in progress.
• The number or the complexity of traffic, actual or anticipated, at the CWP or adjacent CWPs.
• Unusual events.
• Holding within the sector or adjacent sectors.
• Aircraft emergencies.
• Flights having a higher priority category than normal flights, i.e. state flights.
• Bad weather conditions as low visibility, snow, CBs, etc.

2.7.7  ICAO has specific ruling concerning the use of surveillance radar within a tower environment and can be found under ICAO DOC 4444, 8.10.1: Surveillance radar.

2.7.8  As a human redundancy measure because of possible personal or operational emergencies or incidents, there should be a competent ATCO available for immediate relief in case of need.

2.8 Considerations of 2EP operations versus SPO

2.8.1 For the discussion in this paper, 2EP could be defined as: the situation where an active controller is accompanied by another appropriately qualified controller working simultaneously in the same unit but not necessarily at the same sector or working position or when there is another ATCO available immediately for assistance or replacement in the unit.

2.8.1.1  These 2 or more, equally qualified, controllers on duty together in the same physical environment don’t monitor each other directly but by being close by, it may be possible to request or propose help in a more timely matter.

2.8.1.2  It is observed that 2EP operations are found in many ANSPs. As such, it can be considered a step above SPO as safety and redundancy is somewhat enhanced.

2.8.1.3  However, the pick-up of a potential safety breach like identifying a wrong read- back or clearance by a colleague is significantly less likely to occur, and therefore IFATCA encourages the use of 4EP wherever possible.

2.9 Benefits of the 4EP

2.9.1  One of the major benefits of the 4EP is the added safety net provided when another qualified controller is monitoring the traffic, the frequency and the other ATCO of one sector or unit. Error detection can be greatly increased, for example on identifying wrong read-backs, erroneous clearances or instructions or missed alerts.

2.9.2  Fatigue or a reduction in alertness following a busy session can be alleviated when the executive and planner controllers exchange roles at the sector or unit without involving extra personnel. This occurs on a regular basis in Geneva ACC and other units for example.

3.1 Budgetary pressures, staff shortages, historical practices and automation can be some of the contributing factors for ANSPs to introduce SPO or to remove the practice of the 4EP.

3.1.1  IFATCA recommends that SPO must be avoided.

3.1.2  There can be many undesirable human aspect effects as a consequence of SPO like a false sense of safety, inadequate error detection, over-confidence, and possible drift to failure.

3.2  Appropriate mitigation measures and a mechanism for periodic and sound reviews of hazards and risk analysis must be in place where SPO is unavoidable or when the 2EP is introduced replacing 4EP.

3.3  Conditions should be detailed where SPO or a change to 2EP should provoke an enhanced state of attention.

3.4  Performing separate surveillance or other tasks are potential risks in ATC. In a sound safety culture we should learn lessons from that and avoid both.

3.5  ATCOs should be encouraged where appropriate, to request help, insist on not working alone and to report potentially critical situations at a unit where SPO or a change from 4EP to 2EP takes place.

3.6  ATCOs should also follow ICAO Doc 4444 8.10.1.1 regarding surveillance radar in a tower environment where it is specified that a radar screen may be used to monitor traffic that concerns the specified unit.

3.7  ANSPs should take full responsibilities for safety and the interest of ATCOs by eliminating SPO and not allowing the performance of simultaneous surveillance tasks.

3.8  Preventing SPO can only bring immediate benefits for ATCOs, for ANSPs and for the users of ATC by:

• Determining a correct minimum level of staffing in an established safety culture.
• The immediate relief of a person involved in an operational or personal incident/accident.
• Human Factors as described above are positively enhanced.
• Application and benefits of the 4EP.

3.9  SPO and 2EP eliminate the redundancy in the human element of the Air Navigation Service (ANS) system.

4.1 It is recommended that the IFATCA Technical & Professional Manual page 4217 WC 1.1.6 be amended as follows:

From:

Rostering Single Person Operations (SPO) shall be avoided. In the unlikely event of unavoidable SPO appropriate measurements shall be taken to ensure that the SPO situation will be alleviated as soon as possible. Until such time measures shall be taken to mitigate all impacts of SPO such as: traffic regulation, provide breaks, informing neighbouring ATC units. Procedures shall be in place to implement such measures in an efficient way, not increasing the workload of the ATCO.

The use of single controller shifts should be strongly discouraged by MA’s, both through their providers and their regulators.

When providers choose to use SPO, they must bear the responsibility for the resulting risk(s) to the system. The ATCO must not be held liable for incidents or accidents resulting from the use of SPO.

To:

Rostering Single Person Operations (SPO) shall be avoided. In the unlikely event of un avoidable SPO, appropriate measures shall be taken to ensure that the SPO situation will be alleviated as soon as possible. Until such time, measures shall be taken to mitigate all impacts of SPO such as but not limited to: traffic regulation, work break provisions, informing neighbouring ATC units. Procedures shall be in place to implement such measures in an efficient way, not increasing the workload of the ATCO.

The use of single controller shifts should be strongly discouraged by MAs, both through their ANSP and their regulator.

When providers choose to use SPO, they must bear the responsibility for the resulting risk(s) to the system. An ATCO shall not be held liable for incidents or accidents resulting from an ANSP imposing the use of SPO.

4.2  It is recommended that the IFATCA Technical & Professional Manual page 4218 WC 1.1.7 be amended as follows:

From:

Implementation of 4EP shall be strongly encouraged by MAs, both through ANSPs and regulators.

Individual ATCOs shall not be held liable for incidents or accidents resulting solely or in part from the non-implementation of the 4EP safety net.

To:

Implementation of 4EP shall be strongly encouraged by MAs, both through their ANSP and their regulator.

An ATCO shall not be held liable for incidents or accidents resulting solely or in part from the non-implementation of the 4EP safety net.

4.3 It is recommended that the subjects concerning SPO, 2EP and 4EP should be further developed by PLC.

Neering, P. Single Person Operations, SPO, the Slice with Proportional Opening.

4.2.1.1 Review of Policy: Single Person Operations in ATC (SPO). WP No. C.5.11. IFATCA Conference, Hong Kong 2004.

Single Person Operations – Four Eyes Principle (4EP). WP No. C.X.X. IFATCA Conference, Melbourne 2005.

Submission of the International Air Line Pilots Association to the National Transportation Safety Board regarding the accident involving COMAIR 5191 CRJ-100, DCA064MA064, Lexington, KY August 27, 2006.

ICAO DOC 4444, 8.10.1: Surveillance radar:

8.10.1 Surveillance radar

8.10.1.1 When authorized by and subject to conditions prescribed by the appropriate ATS authority, surveillance radar may be used in the provision of aerodrome control service to perform the following functions:

a) radar monitoring of aircraft on final approach;

b) radar monitoring of other aircraft in the vicinity of the aerodrome;

c) establishing radar separation between succeeding departing aircraft; and d) providing navigation assistance to VFR flights.