58TH ANNUAL CONFERENCE, Conchal, Costa Rica, 20-24 May 2019Agenda Item: C.6.10 – WP No. 161Report Writing and ANSP Procedures for Serious Incidents or AccidentsPresented by PLC |
Summary
Learning lessons from incidents is a key part of every safety management system. Therefore, it is imperative that an open and just reporting culture is not inhibited by fear of punitive action against a controller. The post incident or accident process is not something that appears to be well understood. Different legal systems, interpretations and variations from ICAO’s guidance and recommended practice, further complicate that understanding. The current guidance and assistance to a controller should they be in such a scenario, needs consideration.
Introduction
1.1. The rate of fatal accidents in civil aviation has remained fairly constant over the last decade. Nevertheless, the number of accidents could rise over the decades to come, due to, “an increase in air traffic and an increase in technical complexity of aircraft.” (“EU Report 2016 – Air Transport Industry – European Commission.”)(EU Regulation No 376/2014)
1.2. Due to serious incidents and accidents being rare events, the topics of report writing, legal systems and the post incident processes are not often discussed or tested. Because of this rarity, the reaction to such an event could be extremely stressful and confusing for all parties concerned.
1.3. Recent events in Europe have shown that the ATCOs knowledge of post incident procedures, and their own ANSPs policies following a serious incident or accident, is lacking.
1.4. This paper will examine the current ICAO and EU regulations and guidance. It will also look at the practices within ANSPs to deal with ATM incidents and the training and assistance ATCOs receive before incidents occur. This paper aims to highlight the importance of continuing to adhere to the principles of Just Culture, whilst also being mindful of how a serious incident might be treated.
1.5. This paper will also look at how different ANSPs treat the post incident process, including both the handling of the controller involved and the report writing and gathering process. This has been conducted using a small sample of Member Associations from different regions, and by interviewing a controller who has been in a post incident situation.
Discussion
2.1. Guidance and Regulations for the Investigation of Accidents and Incidents
2.1.1. ICAO Annex 13 to the Chicago convention sets out international standards and recommended practices on aircraft accident and incident investigations and measures necessary to ensure the safe operation of aircraft.
2.1.2. As an example of how Annex 13 is interpreted and applied, the following paragraphs look at the relevant EU regulations. These regulations consider Annex 13 of the Chicago convention and they broadly mirror each other in most respects.
2.1.2.1. Regulation (EU) No 996/2010 deals with the investigation and prevention of accidents and incidents in civil aviation.
2.1.2.2. Reporting analysis and follow-up of occurrences in civil aviation is currently regulated in Europe by two main regulations: Regulation (EU) No 376/2014 and Commission Implementing Regulation (EU) 2015/1018.
2.1.2.3. Regulation (EU) No 376/2014 deals with the reporting, analysis and follow-up of occurrences in civil aviation and the Commission Implementing Regulation (EU) 2015/1018 lays down a list of classifying occurrences in civil aviation to be mandatorily reported according to Regulation (EU) No 376/2014.
2.1.2.4. The purpose of these regulations is to ensure that ‘The sole objective of safety investigations should be the prevention of future accidents and incidents without apportioning blame or liability. (Regulation (EU) No 996/2010)
2.1.2.5. The objectives of these regulations are to improve aviation safety by ensuring that relevant safety information relating to civil aviation is reported, collected, stored, protected, exchanged, disseminated and analysed. (Regulation (EU) No 376/2014 (6))
2.1.3. In the case of a serious incident or accident in the UK any person who is either involved, or has knowledge of it must inform the Air Accident Investigation Branch (AAIB), and in the case of an accident, the police, without delay. (The Civil Aviation (Investigation of air accidents and Incidents) Regulations 2018) Failure to report at this stage would be a contravention of the law.
2.1.4. The AAIB will commence an investigation which is undertaken pursuant to Regulation 996/2010, without the apportionment of blame or liability. (The Civil Aviation (Investigation of air accidents and Incidents) Regulations 2018)
2.2. Human Factors considerations for the ATCO after a serious incident or accident
2.2.1. The first step to take following a serious incident or accident is, where possible, to inform a supervisor who in turn should relieve the ATCO from position.
2.2.2. It is important that the controller receives some support at this stage. Even if the controllers actions had no bearing, there is the potential for the event to have been traumatic for the controller. Critical Incident Stress Management (CISM) is designed to alleviate some of the stress at this stage and is the usual system that ANSPs have in place. Defusing (one-to- one peer post incident support7) is the most used service in the ATC-CISM programme; and any programme which does not offer this service is losing the opportunity to provide significant assistance to the target group. (IFATCA TPM MED 9.3.3)
2.2.3. It would also be prudent to allow the ATCO some time to recover and to this extent the ATCO should be removed from duty for a period of time. The current IFATCA policy on exemption from duty is as follows: –
| “When an accident or incident is alleged to have occurred, where the actions of an air traffic controller may have had a bearing, the controller shall have the right to be exempted from control duties until he is physically and psychologically fit again. The removal is without prejudice, and is non-disciplinary.”
“In case of an accident or traumatic incident/event, it is recommended that immediate psychological or medical advice be sought for all parties involved. The time required to obtain this advice and the subsequent return to duty of the controller should be considered part of the investigation for the purpose of protecting the pay and employment benefits of the parties involved. It is not always possible for a controller to assess his own state of mind after a traumatic situation such as an accident/incident. Therefore, it is recommended that the controller take at least the remainder of the shift to “collect” himself. A psychologist or medical professional can be of use in helping one determine a suitable time to return to duty.” |
(IFATCA TPM LM 11.2.8 (2))
2.2.4. In the event of an incident which might be of interest to the media, the ANSP should have a scheme in place to protect the identity of the individual or individuals involved and their families. The current IFATCA policy states:-
|
“Protection of the identity(ies) of ATM staff involved in incidents or accidents shall be guaranteed.” “The disclosure of personal information details, i.e.: names and addresses of individuals associated/involved with a serious ATC incident or accident have had tragic results for air traffic controllers. Employers and Service Providers must take firm steps to establish and enforce appropriate legislation that would ensure that identities of air traffic controllers and other ATM staff involved in serious accidents/incidents remains privileged and protected.” |
(IFATCA TPM LM 11.2.28 (4) Protection of Identity)
2.3. Note Taking and the writing of the Report
2.3.1. Taking notes after an incident can be done but some degree of caution must be taken. The potential for personal notes to be used as evidence against a controller is a risk that is probably not well known to an individual controller. IFATCA has produced some policy on the matter:-
|
“The controller should make no written statements without the advice of a legal representative of his choice, even at pre-investigation board stages.” “It is not mandatory that a controller obtain advice from a legal representative prior to making written statements. In the case of an incident a controller should obtain advice from a representative (employee, Association, legal). In the case of an accident it is strongly recommended that the controller obtain legal advice. To keep track of the facts during a confusing time immediately after the incident / accident, it is often prudent to make some personal notes of the facts as he remembers them. These personal notes should not be made after he has had a lot of time to reflect on what happened. Notes should be made while the facts have not been coloured by rationalization or interpretation. Caution is suggested when making these notes. In some Member Association countries these personal notes may be admissible as evidence. Therefore, a preface should be included in the notes which state that they are for use of legal counsel only and that they are not an admission of guilt and that the controller reserves the right to change them as more facts become available to the controller.” |
(IFATCA TPM LM 11.2.8 (3) The right of representation)
2.3.2. When writing the report, the ATCO must consider many factors. The Swiss ATCA ‘Just Culture Manual for ATCO, ANSE & ATSEP’ provides sensible considerations for report writing:
2.3.2.1. “It should be factual, with a neutral tone and worded in such a way as to not incriminate yourself. Phrases like the following should be avoided;
- “Forgot…”
- “Didn’t check…”
- “Should have…”
- “I assumed that…”
2.3.2.2. It should not contain any names, any emotion or apportion any blame. It should also not attempt to interpret any of the events.”
2.4. The Investigation and treatment of the written reports
2.4.1. The EU interpretation of Annex 13 states,
“All the data sent from an organisation in a member state to the European commission will be disidentified and will be protected, in as such, will not be disseminated to any other person or entity, unless it will be used to enhance aviation safety.”
2.4.2.
“If disciplinary or administrative proceedings are instituted under national law, information contained in these occurrence reports shall not be used against the reporters or any persons mentioned in the occurrence reports.” (Regulation (EU) 376/2014 Protection of the information source pt. 7)
2.4.3.
“Also, employees or contracted personnel who report or who are mentioned in a report shall not be subject to any prejudice by their employer or by the organisation for which the services are provided on the basis of the information supplied by the reporter.” (Regulation (EU) 376/2014 Protection of the information source pt. 9)
2.4.4.
“This protection will not apply to any of the following situations (Regulation (EU) 376/2014 Protection of the information source pt. 10)
- In cases of wilful misconduct.
- Where there has been manifest, severe and serious disregard of an obvious risk and profound failure of professional responsibility to take such care as is evidently required in the circumstances, causing foreseeable damage to a person or property or which seriously compromises the level of aviation safety.” (emphasis added)
2.4.5. In the case of wilful misconduct, it is clear that there can be no protection, and in occurrences where people are hurt or property is damaged, there is almost certainly going to be a legal process.
2.4.6. However, in scenarios where aviation safety was seriously compromised there could also be no protection for the ATCO under the EU regulation 376/2014.
2.4.7. This can leave the ATCO after a serious incident, wondering if they have made an honest mistake which could be seen as a profound failure of their professional responsibility. If this is the case their protection is no longer guaranteed and there is a possibility that they could face legal action, even if no harm was caused.
2.4.8. If reporting is inhibited for any reason, then the consequences could be dire for air traffic and aviation safety on international, regional and national levels.
2.4.8.1. In 1998, at Amsterdam’s Schiphol Airport during Low Visibility Procedures, a Boeing 767 aborted take-off when the crew spotted a 747 crossing the runway ahead of them. The Trainee Controller and their Instructor were charged and found guilty of, “the provision of air traffic control in a dangerous manner, or in a manner that could be dangerous, to persons or properties.” (Corporate Manslaughter in the Maritime and Aviation Industries by Simon Daniels) The subsequent investigation noted 23 recommendations to rectify the system deficiencies that were contributory factors to the incident.
2.4.8.2. Significantly, due to the prosecution of controllers working in this deficient system, the number of incident reports of any nature were reported to have fallen by over 50% during the years that the charges were brought against the controllers. (Skybrary) It took until the middle of the following decade for the pre-incident reporting culture to be fully re-established. (
2.5. Acceptable or Unacceptable?
2.5.1. The decision that behaviour is acceptable or not, is likely to be a very difficult one. This is in part due to the large number of factors involved in any air traffic control incident. Therefore rationally, the decision should be made by those qualified and with sufficient knowledge and experience to judge whether their actions were acceptable. This important decision being made by suitable qualified persons, underpins the security that a Just culture system provides. IFATCA has taken the initiative to create a joint Eurocontrol/IFATCA course for prosecutor training to ensure a positive contribution is made to the future of Just Culture.
2.5.1.1. A crash in the vicinity of Cagliari in 2004, was an occasion where it was the judgement of the court and not that of the investigation, which decided that the actions that the controllers took were not the correct ones.
2.5.1.2. The investigation found the cause of the crash to be aircraft flying below the areas Minimum Safe Altitude. There were 7 contributory factors, unrelated to the controllers. However, 2 Italian Air Force ATCOs were still convicted of negligence and failing to exercise a sufficient duty of care. (Pooley Cpt E, (2013) The (Cagliari) accident investigation. Hindsight 18, Winter 2013)
2.5.1.3. In this example, it was the court that decided that the controller’s actions, were an “infringement of standard expectations in terms of diligence, skilfulness and prudence.” They also found that they were specifically negligent, “in respect of breaches of operational rules, in this case involving those concerning visual approaches, the lack of separation from obstacles and misleading instructions relating to descent.”
2.5.1.4. In a separate Skybrary article regarding the investigation of the incident, Starrantino and Finocchiaro, from Eurocontrol, state in reference to Italy, (but applicable around the world) that “there is a need for the judiciary and aviation professionals to be more aware of each other’s perspectives on criminal prosecutions and operational issues connected with ATM.” “This case exemplifies that International aviation provisions are subject to the interpretation of judges” (Starrantino C and Finocchiaro M, (2013) The Judicial Aftermath. Hindsight 18, Winter 2013)
2.5.2. There is a certain level of dualism in Just Culture. When faced with an incident that will go to court, the focus will be on apportioning blame. This is a backward-looking focus, which provides little help to improve safety.
2.5.3. In cases where an incident will remain out of court, the goal should be on the improvement of safety with the avoidance of apportioning blame to individuals. This is a forward-looking focus, which provided huge advantages to safety.
2.6. National Judicial Systems
2.6.1. National Judicial Systems play the most significant role in any possible prosecution of an ATCO, and it is imperative that the ANSP is aware of the specific laws that may be applicable to them and their employees. The judiciary may also be satisfying the national public interest in attempting to secure prosecution.
2.6.2. For Example: In the Schiphol accident mentioned in 2.4.8.1. The controllers involved were charged under a specific Dutch Aviation Law, “the provision of Air Traffic Control in a dangerous manner, or a manner that could be dangerous, to persons or properties.” (Ruitenberg, 2002 – Court Case against Dutch Air Traffic Controllers. The Controller Vol41 4th Q.) Ruitenberg, in an article published in ‘The Controller’, also states that the “court treated the case as an infringement of the law (as opposed to an offence).” In Dutch law, this means that the only admissible defence, is for the controllers to be completely blameless. The article goes on to state that, the court had recognised the design, facilities and equipment were “less than optimal.” However, since the defence to the charge, required the controllers to have no ‘blame’, despite all the system deficiencies they were still found guilty.
2.6.2.1. In the Cagliari accident mentioned in 2.5.1.1., Starrantino and Finocchiaro state, “the divergence of opinion between the subject matter experts and the Judge was based on the application of specific Italian rules introduced in 1991 by the DGAC (Civil Aviation General Direction)” (Starrantino C and Finocchiaro M, (2013) The Judicial Aftermath. Hindsight 18, Winter 2013)
2.6.3. Not only does the judiciary interpret aviation law in the manner that it sees compatible with its country’s own laws, but individual countries are also able to file differences or variations against the ICAO provisions.
2.6.3.1. Switzerland is one such example, and has filed a difference to ICAO Annex 13 article 5.12 allowing accident and incident reports to be explicitly used in possible court cases.
2.6.3.2. In the trial following the Schiphol incident, and contrary to Annex 13, the internal investigation report was deemed permissible as evidence. Ruitenberg notes that, the court did not refute the prosecutor’s assertion that the internal report was not covered by the Annex 13. Ruitenberg states that, “In Dutch law Annex 13 only applies to reports originating from the “official” aviation investigating authority…. the DTSB”, therefore the internal investigation was permissible as evidence as it was not from the official aviation investigating authority. (Ruitenberg, 2002 – Court Case against Dutch Air Traffic Controllers. The Controller Vol.41 4th Q)
2.6.4. Due to the rare nature of such a serious event, a controller could find themselves trying to understand the legal position they are in, with very little time to prepare.
2.7. Duty of Care
2.7.1. There are previous papers on the topics of Duty of Care and Overservicing that have been produced by PLC, which concluded that the term ‘duty of care’ is familiar with ATCOs but that few probably fully appreciate. Although some ANSPs and member associations provide training to ATCOs on this topic, most do not. At best, this may result in ATCOs not being fully aware of their responsibilities to operators, pilots and others. At worst, it could result in an ATCO not acting when they should or acting incorrectly in the mistaken belief they are acquitting their duty of care.
2.7.2. Whilst this conclusion is sound, what could also be concluded is that most ATCOs would not consider that not providing a duty of care could effectively remove any protection that could have been afforded to them under the EU regulation 376/2014 if a serious incident was to occur.
2.8. Current reporting culture
2.8.1. A sample of five MAs from Europe, Asia Pacific, Africa and South America were surveyed to understand what the procedures are, following an incident and a serious incident.
2.8.2. All of the MAs surveyed described their ANSPs report writing tool. Although there are different systems in use, the information captured is usually an electronic tool that is standardised and based on the information required in ICAO Annex 13.
2.8.3. Following an incident, all MAs reported that the controller was relieved from position as soon as possible and a report was written. Some organisations will require a report to be completed by no later than the end of the day while others will require the report to be written almost immediately.
2.8.4. Guidance on reporting for controllers varies from mandated training on a yearly basis to no guidance at all. The guidance provided by employers itself can be simply how to use the tool that records the report. For other MASs, full guidance is given, including consideration to the words and statements used in a report. Where guidance or training from the ANSP is lacking, there are MAs which have produced their own guidance material.
2.8.5. IFATCA endorses the use of professionally trained peers to provide CISM to other colleagues following an incident. CISM in the workplace has proved particularly effective to reduce stress after an occurrence or serious incident. Of the MAs surveyed, CISM was available in a number of organisations, however some are yet to introduce CISM or still do not have any plans to do so.
2.8.6. The severity of an incident will somewhat dictate what occurs directly after that incident, but the option to suspend controllers differs significantly between organisations. For example, one ANSP will let the controller decide how much time they require to return to a working position and offer up to 3 days paid leave. Elsewhere, this decision is not in the controllers hands, and there may not be any set procedure, so that the process can be influenced by other interested parties to suspend an individual.
2.8.7. Competency schemes are present in all but one of the MA’s organisations we surveyed. Competency assessment is usually carried out following an incident however, in one organisation, the competency scheme is completely independent from the investigation process. The competency assessment or the individual involved might decide that some dual time would be beneficial to that individual. This can be a useful tool to rebuild confidence.
2.8.8. MAs were asked if there is any guidance documentation given to ATCOs for dealing with incidents. Whilst some organisations have documentation on the process to be followed, usually for the safety team or supervisors, there is no guidance given to ATCOs in particular. One MA provided their own guidance only for their organisation to provide their own guidance which countered the instructions of their MA. It should be noted that the MA was giving advice for the controller to not incriminate themselves in the report writing whilst the ANSP was trying to ensure that all the relevant information was recorded for accurate reporting to continue.
2.9. Example of an accident from a controller’s perspective
2.9.1. A controller was interviewed about their experience following an accident that occurred in their country. These were some of the findings:-
- The controller only discovered the seriousness of the incident from a TV news broadcast shortly after the event.
- The controller was asked to write a report almost immediately following the incident, with no guidance on their wording or reference to any replay.
- They were left for a significant period of time whilst the internal investigation began.
- The investigation concluded that the controller was not a fault.
- The controller was offered, and accepted defusing following the incident.
- The controller was given a reasonable amount of time away from operation duty and was placed into the care of a legal team and a psychologist.
- Whilst the legal team had expertise in aviation, their knowledge of ATC was woeful. The controller had real difficulty in explaining ATC terms to them, which made the process very stressful.
2.9.2. This example highlights that, from the ATCO to the supervisor and to the legal teams, there is a sense of reaction to an unforeseen event. This is the time where guidance becomes essential to all stakeholders. In particular, the ATCO.
Conclusions
3.1. Post incident procedures following a serious incident are likely to remain an exceptionally rare event. However, following from recent legal action taken against ATCOs in Europe, it is important to understand the complexities of the legal position following incidents. This paper has studied the EU regulations that are the basis for legal action in Europe, it has also surveyed a number of associations to understand what procedures are in place today. IFATCA policy regarding post incident procedures has also been examined to see if any changes need to be made.
3.2. If reporting is inhibited for any reason, be it because of the fear of disciplinary or legislative action, then the consequences may be dire for air traffic and aviation safety on international, regional and national level. Timely and accurate reporting of safety information is critical to verify the achievements of global safety objectives. Recognising that aviation is a complex industry, an analysis of multiple safety indicators is essential to assess safety performance globally.
3.3. The post incident process differs around the world and real progress is being made to try to encourage report writing and lesson learning. Work in this area must continue. An anonymous system to record and learn is vital. Controllers must be supported post incident, with CISM, and appropriate time away from a control position given. The ‘real world’ example in the paper, highlights some areas of concern, notably the lack of guidance about how to write the incident report. In other circumstances, that controller’s report could potentially have been used against them in a court of law.
3.4. It is clear that there is a lot to consider after an incident has occurred. Even more so if the incident is serious one. It is becoming increasingly prudent for a controller to be aware of the procedures put in place following an incident or accident so that if such an event happens to them, they fully understand the procedures to follow and the processes in place.
3.5. It is already IFATCA policy for member associations to provide a reference card containing their basic rights and the (IFATCA TPM LM 11.2.5). Whilst this is useful, in the current climate, this should become more comprehensive in the form of a manual containing subjects on ‘The importance of accurate reporting’, ‘Just culture’, and the current judicial system and criminal code of the country the ATCO operates in. This has already been implemented by Swissatca in their ‘Just Culture Manual for ATCO, ANSE & ATSEP’.
3.6. Finally, and unfortunately, some of the progress is being eroded where judicial systems are in conflict with Just Culture. It is therefore, important that ANSPs provide information about the national law that applies in the states that they operate within. If this does not occur, then the MA should consider taking that role and explaining this and its implications to ATCOs.
Recommendations
IFATCA policy is:
Member Associations should provide their members with a card containing the basic rights they have and the rules that will be applied in case of incident/accident investigations (Acapulco 90.C.7)
It is recommended that this is replaced by:
Member Associations should provide their members with information containing the basic rights and the rules that will be applied in case of an incident or accident investigation. This should include guidance on the reporting process, Just Culture, the investigation process, and the specific parts of the legal system that applies in their State(s). Special consideration should be given to any areas where the State has filed difference(s) from provisions contained in Annex 13.
References
“EU Report 2016 – Air Transport Industry – European Commission.” https://ec.europa.eu/transport/sites/transport/files/2016_eu_air_transport_industry _analyses_report.pdf
Reason J (2000). Human error: models and management. British Medical Journal. Vol 320 P768–770.
Dekker S (2010) Pilots, Controllers and Mechanics on Trial: Cases, Concerns and Countermeasures. International Journal of Applied Aviation Studies, Vol 10, No. 1.
Erotokritou C (2012) The Legal Liability of Air Traffic Controllers. Inquiries Journal Vol. 4 No. 2.
Early S, Garner Jr. W, Ruegsegger M, Schiff S (1973) The Expanding Liability of Air Traffic Controllers. Journal of Air Law and Commerce Vol. 3.
Kouvelakis D (2015) The extent of liability imposed by the Warsaw Convention on international air carriers. Hogan Lovells Publications May 2015. Retrieved July 2018.
Pooley Cpt E, (2013) The (Cagliari) accident investigation. Hindsight 18, Winter 2013. Retrieved January 2019 from https://www.skybrary.aero/bookshelf/books/2579.pdf
Starrantino C and Finocchiaro M, (2013) The Judicial Aftermath. Hindsight 18, Winter 2013. Retrieved January 2019 from https://www.skybrary.aero/bookshelf/books/2579.pdf
Ruitenberg B (2002) – Court Case against Dutch Air Traffic Controllers. The Controller Vol 41 4th Q. Retrieved January 2019 from https://issuu.com/ifatca/docs/2002_04/2
Thanks to the MAs for answering our surveys and to the controllers for allowing us to interview them.
Last Update: October 2, 2020