The ATO and Safety: Improving Our Safety Culture

1. The ATO and Safety: Improving Our Safety Culture ATO Safety Service Aerospace Guidance and Control Systems Committee (AGCSC) – Lake Tahoe, NV Joe Schanne, Director IOT&E 3/2/2006

2. DISCUSSION TOPICS: • Overview (Who am I??? …. Who am I representing??) • Maintaining/Enhancing Safety in U.S Air Traffic Control • Safety Management System (SMS) and Safety Culture

3. Oversight: Federal Ministry of Transport Service: DFS Oversight: CAA Service: NATS Oversight: CASA Service: Airservices Australia International Models • FAA’s new Air Traffic Control (ATC) provider/regulator model is consistent with international models • SMS functions within and is the responsibility of the service provider (ATO) • Oversight (at varying levels) is outside of provider (in AVS) Oversight: Transport Canada Service: NAV Canada

4. FAA Safety Organizations • Provide independent safety oversight of air traffic service provision • Audit of process, not daily operations • Can require a change to enhance safety Administrator & Deputy Administrator Air Traffic Services Subcommittee Air Traffic Organization (ATO) Associate Administrator for Aviation Safety (AVS) Chief Operating Officer ATO Transition AOV Communication ATO Safety Service • Manage SMS process • Support safety risk management (SRM) • Monitor/assure NAS safety through: • Audits/evaluations • Data/metric analyses • Promote safety • Collaborate internationally • Primary interface with AOV Safety Communications Operations Planning Finance Acquisition & Bus. Services En Route & Oceanic Technical Operations Terminal System Operations Flight Services

5. Safety …. Our Highest Priority The ATO Safety. Service. Value.

6. FAA Safety Management System • Safety Risk Management (SRM) - e.g., changes are safe • SRM Filter (what changes require SRM?) • SRM Guidance • SRM Documentation (and who approves?) • SMS Requirements • SMS Responsibilities & Accountabilities • Safety Oversight Architecture Policy Safety Promotion Assurance • Safety Assurance and Evaluations • Safety Data Tracking and Analysis • Recommending Actions based on Safety Metrics • SMS Training • Safety Organization • Safety Culture • Safety Lessons Learned

7. FAA Safety Management System (SMS) Safety Risk Management (SRM) An Example …. Unmanned Airborne Systems (UAS’s) Architecture Policy Safety Promotion Assurance

8. SRM Example .. UAS Challenges • Ensuring safety of the U.S. NAS • Users and public on the ground • Minimizing safety impacts: • Inherent low visibility of many UAS aircraft - more difficult to visually detect and track • Increased time between detection and avoidance • UAS aircraft performance limits in collision avoidance • Differentiating between Recreational model aircraft and UAS aircraft • Supporting the national defense expanding access requests

9. See and Avoid is not an ATC Function • Radar does not depict everything in the NAS

10. Current UAS Operations in the NAS • Within “segregated” airspace • Includes Special Use Airspace (SUA) Restricted and Prohibited areas & Air Traffic Control Assigned Airspace (ATCAA) • Excludes MOA, MTR’s and Warning areas • In non-segregated airspace • “Public” UAS – through Certificate of Authorization (COA) process • “Civil” UAS – using experimental / type certification process • “Model” aircraft – with guidance from AC 91-57, dated June 1981 • Variety of other operations believed to be occurring by both the public and private sector • Some based on interpretations of “model” aircraft guidance • Others with a lack of knowledge of aviation environment requirements • While ensuring “no harm” to other NAS customers and public

11. DOD UAS Border Flight – Arizona (Hunter UA) Altitude: 11,000 to 13,000 MSL Dimensions: 105 NM x 10 NM

12. Safety Risk Management Architecture Policy Improving Safety Culture An Example …. Safety Promotion Assurance

13. The primary purpose of the ATC system is to prevent a collision…. Tenerife Accident: March 27, 1977

14. What is a Safety Culture? A Safety Culture includes: • Personal dedication and accountability • Individual attitudes and behaviors • Shared vision with structures to attain it • Organizational processes, methods and metrics • Commitment to improve (resist complacency) • Beyond simple adherence to procedures • Learning and continuous improvement • Pervasive safety thinking • Commitment to excellence • Integration of safety into all activities Leaders must: • Create a climate in which news is quickly and easily communicated, • Be committed to investing the time and resources to address risk

15. Potential Challenges to Evolving the Safety Culture • Complacency based on past success • Belief that the organization is as advanced as possible • Data questioned rather than acknowledging need for change • History of mistrust and hiding information • Facilities penalized for reporting errors • Difficulty in breaking through the bureaucracy • Resistance to change; Cynicism

16. 1 Aircraft Accident Investigations Runway Incursions/ Operational Errors ~30 Incidents NTSB DOT IG AVS/AOV (OE/RI, etc.) ~300 Hazardous Conditions (TCAS Alerts, UCRs, Non-Compliance, Go-arounds, Bad Documentation, etc.) Evaluations ~1,000 Unreported “Unsafe Acts” (Non-Reported OEs/ODs, Missed Checks, etc.) We Have Data, But We Are Reactive, Not Proactive

17. Examples • We have previously discussed the NASA Challenger Disaster and how complacency crept back in before Columbia. • Recent Discovery flight showed willingness to do the right thing, even when not the popular thing to do. • An ATC Example: Überlingen Collision Video • Credit: DFS Deutsche Flugsicherung GmbH

18. Überlingen Collision Video

19. Example …. Überlingen Accident July 1, 2002 • Aircraft Accident Accident • Previous OE by this controller in similar circumstances Incidents • TCAS procedures not integrated internationally • Management allowed mid-shift operations with one controller working both HIGH altitude and LOW altitude workstations. There was no complete situation display. • Ongoing resectorization activity: • Controllers did not read Notice • Radar in a back-up mode, no Conflict Alert • Communication system impaired Hazardous Conditions Unreported “Unsafe Acts” • Unreported, Unknown to management

20. Lack of Management Oversight • Reduced staffing on midnight shift • Tolerated a policy of “extended breaks” on mids • Became complacent, failed to compensate for loss of automation with human redundancy • Failed to ensure own regulations were followed: • Single person operations required full automation capabilities • The reduced communication service was not coordinated with adjacent facilities as required • Failed to ensure controllers reviewed “Facility NOTICE” posted about reduced capabilities on the night of the accident

21. … An Update … Monument on the grave of Vitaly Kaloyev's wife and two children, Diana, 4, right, Konstantin, 10, and Svetlana, 44, in the city of Vladikavkaz, southern Russia, in this Feb. 27, 2004 file photo. Swiss prosecutors are urging a Zurich court, Switzerland to convict Russian man Vitaly Kaloyev of stabbing the air traffic controller he believed was responsible for the death of his wife and two children in a mid-air collision.

22. Where do you think you are? • Questions to indicate health of the Safety Climate • Are employees committed to safety and ready to apply the resources necessary? • Do employees feel encouraged to point out possible problems? • Do employees fear retaliation for exposing problems? • Does management show that they want to know the problems? • Are Safety positions seen as a career boost, not a dead-end? • If improvement is necessary, what can be done to improve?

23. GENERATIVE Safety is how we do business around here Constantly Vigilant PROACTIVE Anticipating and preventing problems before they occur Increasing Awareness CALCULATIVE We have systems in place to manage all hazards Increasing Trust REACTIVE Safety is important. We do a lot every time we have an accident PATHOLOGICAL Who cares as long as we’re not caught Chronically Complacent Safety Culture Evolution *Adapted from Safeskies 2001, “Aviation Safety Culture,” Patrick Hudson, Centre for Safety Science, Leiden University

24. A Final Thought … • All truth passes through three stages: • First, it is ridiculed. • Second, it is violently opposed. • Third, it is accepted as being self-evident. • (Arthur Schopenhauer, 19th Century Philosopher) • As a Leader/Manager, how do you respond when a safety “truth” is brought to you?