#44 October/November/December 2013 - www.skyguide.ch/en/company/vision-mission/safety/editor: gregory.lucato@skyguide.ch - intranet: skyline/issue/safety/safety bulletin

Inside this issue

Editorialby René Aebersold, SD 2

Share the experienceHandover – Take it easy! 3

Other “hot” stuffMAO will put everything together 4-5Level bust: from reporting to prevention 6-8What is CISM? 9

InformationFeedbacks: new features 10Safety Prize 10OIRs & SIRs statistic 11-12

safety bulletin  –  editorial

On 11.12.2013, the EB confirmed the closing of the BMS Safety Stream requested by the BMS Core Team. The main achievements of the Safety Stream can be summarised as fol-lows:• A new safety process has been

developed, implemented and inte-grated in skyguide process land-scape. The safety documentation and organisation of the S depart-ment has been adapted. The new safety portal has been published, and safety training has been pro-vided.

• All identified safety and efficiency improvement measures are cap-tured in the new Safety Strategy 2013-17. A 5 year roadmap (under development) and a yearly action plan for 2014 will follow in the first quarter of 2014.

• Unit safety surveys have been established for 8 units so far, with risk management elements.

• A new process MOSI (Manage-ment of Serious Incidents) has been implemented successfully (as described more in details in Stéphane’s article about MAO).

• The function of Domain Manager Safety (DMS) was created within T, a safety platform is now provided, and safety sessions are organised.

• A HF policy and a HF strategy have been developed, and an action plan for 2013 was established and approved. The Human Factor Plat-form has been re-activated.

As a conclusion it can be agreed that the overall safety situation of sky-guide has been improved, especially the safety culture. However, it is very difficult to prove this in a short time frame.

But what comes now? Safety shall continue to receive, of course, proper consideration in the remaining BMS related undertakings. But a lot of safety improvement activities have been identified and started within the BMS Safety Stream, which are still ongoing. Examples are:• The MAO program (Management

of ATM Occurrences) will be launched in order to revise the complete occurrence reporting and investigation procedures (see specific article in this bulletin).

• Work has started within SA to fur-ther adapt the safety assessment framework in order to become more efficient and more systemic. Within the next one to two years, assessments of major releases shall be possible, the use of the func-tional model shall be extended and the safety assessment framework will be updated.

• In 2014, a unit safety survey is planned for the units Alpnach, Buochs, Emmen, as well as a unit safety survey for the ADDC.

• In addition to the already existing competence scheme for ATCOs, live evaluation and a review board

2

BMS Safety Stream closed – what now?

will be implemented, starting in 2014. The objective of this compe-tence management procedure is to continuously observe and improve the competency of ATCOs by agreeing on collective and indi-vidual actions.

All these safety improvement activi-ties will continue, but under the lead of the EBCO instead of the BMS Core team, and coordinated by the S Department. This has the advantage that the implementation of the com-plete Safety Strategy 2013-17 (which is much broader then the BMS safety activities) can be steered and coordi-nated more effectively and as a whole, and that resources can be managed directly by the project owners.

To make the story short: We will con-tinue to improve safety, of course!

René AebersoldSD

safety bulletin  –  share the experience

HANDOVER – Take it easy!

3

As far as known in ATC-Business it’s common practice to get relieved after a certain time at a sector. In Zurich ACC the DOM creates the relief plan according daily roster only and sometimes the relief matches moments, which are rather inappropriate.

So gone in ZRH UAC late summer of this year.

At the collapsed sector M56 the crew handled a period of high and complex traffic. Special meteoro-logical conditions (strong west-erly wind, varying with height) had an impact to the separation problem, which the ATCO in charge was about to solve. The traffic situation was about to relax and so it seemed not a bad idea to the RE M56 to issue a climb clear-ance to the crew of an A319 (GS 356kt), which needed to climb over the very fast cruising “oppo-site” A320 (GS 535kt).

Seconds later a fresh young col-league came around to take over the RE-position. While the hand-ing over ATCO got the feeling, the situation calmed down – the peak was gone – the new ATCO was not really comfortable. But he didn’t dare to refuse the takeover.

The existing problem between the two aircraft on almost opposite tracks came to full attention, when the A319 slowed its ROC

significantly, which was caused by decreasing headwind. Not being completely aware of the prevailing wind conditions the controller issued a minimum ROC (1500ft/’ plus), which didn’t work as ex- pected. The following heading instruction didn’t work either. At the end a separation minimum infringement (SMI) occurred and MOSI was launched.

The ATCO was less than 150 sec-onds in position.

What is interesting here? It is not the SMI itself. It is our behavior!

There are some issues, which left the impression, that we – control-lers - are not able to say NO.

NO to the acceptance of addi-tional traffic, NO to the accept-ance of special flights, NO to the acceptance of paras, NO to hand over a position or NO to takeover one. Nobody can show us how and when to apply. It is an indi-vidual feeling and decision.

The handover procedure is a cer-tain kind of “contract” between the handing over and the taking over ATCO. The handing over one has to decide if it is appropriate to give the control to the new ATCO and this one has to decide if he is comfortable with the situation at the position. Sometimes there is a difference in both minds. There-fore the handover is definitely done when both ATCO’s agree –

the “contract” signed. The sector handover checklist recommends the phrase “I agree” or “My con-trols”.

The phenomena of the mention- ed behavior (dare to say NO) is worth to be analyzed closer. We hope to be able to present such a socio-cultural study in the near future.

Lutz Heinecke, SRIATCO investigator, Zurich ACC

(POSREC, 13:13:24)

safety bulletin  –  other “hot” stuff

Safety processes are important as they set the framework within which the company performs on a daily basis. This article exam-ines what processes have been developed for the purpose of managing occurrences and em- phasizes the need to put every-thing together.

The whole story starts with the intent to develop a policy regulat-ing the protection and usage of ATM recorded data (mainly voice and radar). Three years of nego-tiations between management and Trade Unions led to the signa-ture of a so-called “directive on the handl ing of recorded data”. Amongst other things, this paper allows the Safety department to make usage of information related to non-reported occurrences (SMIs with STCA alerts as recorded by the CASTA system). As a conse-quence, a new process was needed in order to describe how this information could be managed.

In parallel to this, the BMS pro-gram (Business Management Sky-guide) required a deep examina-tion and review of occurrence

management processes. As a result, many procedures could be opti-mized and our services are now delivered in a more efficient man-ner. This was combined with important cultural changes that took place with the arrival of our new COO. The pendulum started to move in a direction where a more open discussion on error could take place – thus, reposition-ing the “Just culture” debate in such a manner that protection from the “outside” became predominant.

This revealed that an important piece of the puzzle was missing: skyguide was not able to manage “serious incidents” in a fair and systematic manner. This matter of fact has also been emphasized by the Swiss Aviation Investigation Board (SAIB) who recommended to address this issue in one of its investigation report. As a conse-quence, another long and difficult development took place which led to the implementation of MOSI (Management of Serious Inci-dents). Interestingly, this opened the door to discussions on indi-vidual behavior and competence. This emphasized the need for two

MAO will put everything together ….

4

safety bulletin  –  other “hot” stuff

MAO will put everything together ….

additional elements: a robust com-petence management scheme and a process determining how to deal with doubts about individual be- havior (Safety Evaluation Board).

The MOSI debate also highlighted the need to carefully reposition the Critical Incident Stress Man-agement program (CISM) and to give it more managerial attention. This led to the appointment of a dedicated program manager who is currently reviewing the coordi-nation structure and reshaping the whole program in a more con-sistent manner.

The BMS program and the devel-opment of MOSI also questioned our ability to conduct good Safety investigations. In this respect, we realized that we had some home-work to do as well. Important weaknesses were addressed with the creation of a dedicated unit. This permitted the recruitment of additional ATCO investigators and the development of a formal investigation management pro-cess. The novelty here is that man-agers are now deeply involved in the process of improving Safety: each investigation report is sup-plemented by an independent

“management response” describ-ing what will be effectively done (or not) about the problem.

And the story continues. While the company gently began to use MOSI in the field of operations, an interesting side-effect started to emerge: since this process allows a more open debate bet-ween all involved parties, there is a dangerous tendency to trigger it for the sole purpose of having this conversation. This is of course not acceptable – especially in the light of the fact that launching MOSI has non-negligible consequences for the involved License Holder(s). Thus, the need for another devel-opment suddenly arose: what about managing “normal” incidents?

The idea here is to find a way to increase learning from incidents for which no particular measure has to be taken (like for instance withdrawal from duty) – put dif-ferently, learning better from the “normal” ones. Inspired by what has been put in place by DSNA (France), skyguide currently stud-ies the possibility to implement so-called “Local Safety Commis-sions” – meetings at the occasion of which occurrences are openly and

construc tively discussed between ATCOs, managers and Safety ex- perts. Another piece of the puzzle…

Last but not least, if interesting occurrences are discussed in a more open manner within Local Safety commissions, the aim of the Monthly Review Board (MRB) meetings needs to be reconsidered as well. In addition to discussing OIRs individually, this board could focus on Sys-temic Hazards, trends and hot-spots. As a consequence, Safety Performance management shall be developed in such a manner that more value could be created with Safety Data – and the MRB repositioned as a “think tank”.

Finally, with the venue of new EASA regulatory requirements, there is a need to verify if our current way of doing things is still aligned with Just Culture principles and with the obligation to clearly separate occurrence management responsi-bilities from line management duties. Another issue to tackle very seriously before getting into trouble with our regulator!

Now, if you are still reading this article and start to feel a bit lost

with all these processes and acro-nyms, I have successfully achiev- ed my goal! You have understood the need to put all these pieces together and to create a consistent framework within which ATM occurrences are being managed within the company. Put differ-ently, there is a need to untangle the “spaghetti” plate resulting from successive and uncoordi-nated developments.

This is where the MAO program comes into play (Management of ATM Occurrences). This initiative will be officially launched in 2014 by the Safety Reporting and In - vestigation Management division (SR). Together with the Domain Managers Safety, the Head ATM managers and the Unions, we will revisit the whole picture, develop the missing pieces and put every-thing together in a consistent and hopefully more understandable manner. More on this will follow soon in another issue of the Safety Bulletin.

Stéphane BarrazHead Safety Reporting and Investigation Management

5

safety bulletin  –  other “hot” stuff

From reporting to prevention: The Level Bust example

6

As level bust (or altitude devia-tion) represents one of the most common kind of incident report - ed across Europe, Eurocontrol has started to tackle the problem some years ago. This short article is to sum up the various actions undertaken since then.Valuable material has been pro-duced by Eurocontrol to raise awareness of the causes of level busts and to address this issue to the concerned stakeholders.

At skyguide, level busts repre-sented 42 occurrences in 2012 and 53 in 2013. A level bust can result in a loss of separation between aircraft or a near collision with the terrain. Since January 2012, 26 reports have shown level busts resulting in separation minima infringements. To mitigate such events, multiple tools, such as enhanced STCA and Mode S data, improve the ability of controllers to safely manage any consequent

loss of separation. On the pilot side, the use of ACAS has also “significantly reduced the likeli-hood of a mid-air collision” (Euro - control). So does the Terrain Avoidance and Warning System (TAWS) in reducing the Con-trolled flight Into Terrain (CFIT) accident.

ScenariosThere are many different situa-tions where level busts are likely to happen. Here is a non-exhaustive list, grouped in three different categories.Air-ground communications: mis-hearing of level clearance, absence of readback or crossed transmission during read back, incorrect readback not challenged by ATC, call-sign confusion.Pilot-induced situation: incorrect FMS setting with correct readback, clearance accepted and set/recorded correctly but then not followed, incorrect altimeter setting.ATCO-induced situation:distraction, use of non-standard phraseology, fast speaking, late re-clearance, complex transmission.There are several factors which contribute to raise the risk of a

level bust to occur. Among which, one can list: only one pilot/crew member on the ATC frequency; the ATCO/pilot work-load; a dis-traction; the holding patterns; the airspace procedure and design; high R/T workload. And the risk of collision is then increased when the volume and rates of climb and descent are high.

Seeking for solutionsImprovements in safety manage-ment and reporting systems have given Eurocontrol an insight into the extent of the level bust prob-lem in Europe. A great deal of work has been carried out by

authorities, institutions and oper-ators to understand the causes of level busts. However the interest that aviation community shows in this regard might explain that the reporting rate has improved, therefore it is always extremely difficult, based on human reporting, to statisti-cally assess a trend in reports.As mentioned already earlier, the use and enhancement of both ground based equipment and on-board equipment help to improve the situation. But the issue re- mains one of concern to the air transport community.

To further raise awareness and understanding of the level bust issue, Eurocontrol has run a series of workshops. These workshops bring together operators, service providers, manufacturers and institutions to develop practical and effective solutions for reduc-ing the number of level busts and mitigating the associated risks.The “Level Bust Safety Initiative”, aimed at reducing the number and potential consequences of level busts, began in 2001. Follow-ing the successful adoption of the “European Action Plan for the

Eurocontrol defines level busts as any unauthorized vertical deviation of more than 300 feet from an ATC flight clearance. This limit is reduced to 200 feet within RVSM airspace.

safety bulletin  –  other “hot” stuff

From reporting to prevention

7

Prevention of Level Bust”, the ini-tiative moved to the implementa-tion and monitoring phase with a so-called “Level Bust Tool Kit”, which is produced as a multime-dia interactive application, giving access to the “European Action Plan for the Prevention of Level Bust” and the implementation checklists. It is a useful reference for pilots, controllers, safety offic-ers from the aircraft operators and safety managers and experts from ANSPs. See here the ATCOs checklist posters issued by Euro-control.The Action Plan contains recom-mendations for air traffic man-agement, air traffic controllers and aircraft operators. Among all the themes, one can find: pilot-controller communications, call-sign confusion, standard operat-ing procedures, altimeter setting procedures, standard calls, air - craft technical equipment, ACAS, human factors, safety reporting – operators & ATM, understanding the causes of level busts, reducing level busts, airspace & procedure design. The implementation of the Action Plan is monitored by the Task Force monitoring group reporting to the Eurocontrol Safety Improvement Sub Group (SISG).

As mentioned earlier in this arti-cle, skyguide is also implement- ing some tools in order to mini-mize such events. The Mode S Enhanced Surveillance (EHS) pro- ject started in 2011 and aims at increasing the ATCO’s situation awareness on airborne events and providing additional means to cross-check the pilot’s readback. Downlinked Aircraft Parameters (DAPs) are received via the Mode S and displayed in the EHS win-dow. This has been already imple-mented at the ACC and APP sec-tors in GVA and ZRH (including ARFA). A Cleared Level Adher-ence Monitoring (CLAM) alert is then displayed when the selected altitude does not match the CFL or when the selected altitude changes without previous CFL input by the ATCO. GVA ACC and APP sectors are using this tool since November 2013 and ZRH ACC and ARFA since December 2013. It is planned for implemen-tation at the ZRH APP sector by March 2015.

But as every tool, it has its limita-tions. For the selected altitude, for example, there is no mean to know whether it has been armed or engaged; there are no standard

operational procedures for select- ed altitude use by pilots; along SID/STARs pilots may select the final cleared level and use the FMS to achieve the vertical constraints; pilots may pre-select missed ap- proach point altitude in final approach; and the selected alti-tude does not necessarily corre-spond to the CFL when the air-craft is flown manually. For the QNH, on certain aircraft types

(e.g. Airbus), the standard pres-sure above TL is not downlinked – only the local QNH from depar-ture airport is still transmitted.

To conclude, and based on our analysis of the OIRs received until now, a good recommendation for the ATCOs to avoid level busts would be to pay special attention to effective air-ground commu-nication, particularly on cross-

check and readback/hear-back processes. And in case of discrep-ancy between CFL and selected altitude, the advices we can give is based on proposal of amendment to ICAO Doc 7030 are: – contact the pilot to confirm CFL– avoid transmitting Selected

Altitude value on the frequency

Maximizing the effective use of both flight crew and ATM safety

nets can either mitigate the conse-quences of level busts or even sometimes avoid them.

If you want to know more about this topic, you will find plenty of articles in the winter 2010 edition of the HindSight magazine.

Gregory LucatoSRO

Sources & further information: eurocontrol.int & skybrary.aero

safety bulletin  –  other “hot” stuff

From reporting to prevention

8

safety bulletin  –  other “hot” stuff

After talking to different people, I noticed that some of you do not know exactly what those 4 letters mean and to whom this program is addressed to.

CISM means Critical Incident Stress Management and is a pro-gram offered to all skyguide employees who face a critical inci-dent.

To understand what all those terms exactly mean, here are their definitions:

A Critical Incident (CI) is any sit-uation that causes a person to experience unusually strong emo-tional reactions.

Critical Incident Stress (CIS) are the behavioral changes, and the psychological and physical reac-tions which a person experiences after a critical incident. These reactions are normal reactions, of normal people to an abnormal event.

Critical Incident Stress Manage-ment (CISM) offers help in han-dling your personal emotions and reactions after events with a high potential for stress reactions.

CISM is neither psychotherapy, nor a substitute for psychother-apy. CISM is a form of psycho-logical “first aid” offered by col-leagues, who undertook a specific training and are called peers. Those colleagues do their job on a voluntary basis and are here to help you to mitigate the impact of stress related trauma and expedite the recovery process.

In skyhub, under the title “Emer-gency Essentials” and CISM, you can find the link to the peers lists and different documents con-cerning CISM.

In November, 7 French and Italian speaking colleagues got their train - ing to become peers. Sheung Ng Yuk and Markus Boesch from the ACC Geneva, Stéphane Reymond from the TWR/APP Geneva, Samir Mahdaoui from Locarno, Youssef Bahhaouy from the COM Center in Geneva, Alban Wirz from Payerne and Claudio Chit-taro from the SMC in Geneva.

Next year, in February, Jasmin Vogt and Daniel Stalder from the AIM in Dübendorf, will get their training in Germany. Welcome to all of you and thank you to all peers for the wonderful job you fulfill all year long.

If you have any questions related to CISM, do not hesitate to con-tact me.

Claudine Meyer-SagerSRC

What is CISM

9

safety bulletin  –  information

Safety Prize

10

applicable to be employed in the ANSE domain. The study put a case study through the processes and although there are some areas which are not directly applicable within the ANSE environment, there is value in adapting the pro-cess to become a better fit and a number of ideas for improvement have been identified. Actual status: The full thesis is avail-able on the STC intranet portal.

October 2013’s safety prize has been awarded following an OIR for an event that started when the FIC phoned Geneva Tower to let them know that an aircraft was above the cloud layer and was unable to descend through it. Geneva Tower took control of the aircraft (chang-

reduce the indicated airspeed and the climbing aircraft had a high indicated airspeed and a low rate of climb to the waypoint. The con-trollers became aware of a poten-tial issue shortly before the STCA triggered and the climbing aircraft was instructed to expedite the climb in order to vacate FL270. Both air-craft were aware of the other’s position. A report has been filed and the situation was assessed to have been caused by an incorrect appreciation of the speed reduc-tion of the descending aircraft and the speed increase of the climbing aircraft. From reports such as this, we can learn – and that is the whole point of the exercise! Actual status: No further action decided, case closed.

As usual, you will find here the last safety prize winner ideas.

In September 2013 two ANSE trainees wrote a thesis on the Adaptation and Implementation of MOSI for ANSE ATM Switzer-land. The purpose of the study was to investigate whether full imple-mentation of the current Manage-ment of Serious Incidents (MOSI) process would be suitable and/or

ing it to the transit frequency) and headed it SE towards waypoint PETAL at FL80. Some miles before reaching the waypoint the pilot decided to go VFR. Departures out of Geneva were stopped to allow the aircraft to land safely.Actual status: No further action required, occurrence closed.

In November 2013 an OIR was submitted reporting a separation minima infringement incident (SMI), which included the trig-gering of the STCA (Short Term Conflict Alert). The controller was controlling two aircraft both heading to the same waypoint, one descending to FL250 and the other climbing to FL290. The descending aircraft started to

New rules for feedbacks In the aim of providing a better service and reaching a better efficiency, a new feature has been added to the last release of the Safety Occurrence Database (SODA), which concerns all OIR and SIR’s submitters.

From now on, you will receive an individual feedback for each OIR or SIR, via the so- called “local action” or “progress report” per email, keeping you informed about the different treatment steps of your OIR or SIR, until its final closure. With this new feature, confidentiality will still be assured.

safety bulletin  –  information

In this section of the bulletin, you will find, as usual, the statistic of the occurrences for the last 3 months, as well as for the whole year 2013 and the evolution of OIRs and SIRs during the past 5 years.

Incidents are dealt with internally and ATIRs are handed over to FOCA and SAIB. Each individual occurrence receives an action which can be viewed for internal use only in the OIR/SIR monthly publication. To display those lists, please follow this link: http://sky-doc.skyguide.corp/cs.exe/open/ 8171557.

OIRs & SIRs statistic

11

OIRs statistic

In this section of the bulletin, you will find, as usual, the statistic of the occurrences for the last 3 months, as well as for the whole year 2013 and the evolution of OIRs and SIRs during the past 5 years.

October-December 2013

Incidents are dealt with internally and ATIRs are handed over to FOCA and SAIB. Each individual occurrence receives an action which can be viewed for internal use only in the OIR/SIR monthly publication. To display those lists, please follow this link:http://skydoc.skyguide.corp/cs.exe/open/8171557.

January-December 2013 January-December 2013

October-December 2013

2009-2013

SIRs statistic

2009-2013

SIRs statistic

2009-2013

2009-2013

January-December 2013 2009-2013

safety bulletin  –  information

OIRs and SIRs statistic

12