Europe has suffered two appalling air traffic accidents since 2001. Between them, their reports contain pointers to a safer future
Europe's air traffic management (ATM) systems may have served aviation adequately for a long time, but an accident like the mid-air collision over southern Germany shows just how fragile the existing systems are. Adequate is a damning word, and one which encompasses many levels of competency depending on what the observers' standards are.
Although the basic details of what happened were clear from the time that Germany's air accident investigator BFU released its preliminary factual report of the collision in 2002, the just-released final report analyses in detail why it happened. The 1 July collision over Ueberlingen, southern Germany between a DHL Boeing 757 freighter and a Bashkirian Airlines Tupolev Tu-154M was one of two seminal events in recent European ATM history. The other was the 8 October 2001 runway collision involving an SAS Boeing MD-87 and a Cessna Citation CJ2 at Milan Linate airport, Italy. If anybody in European ATM felt they could take comfort in a long period of relative safety, and say of changes proposed for their system: "If it ain't broke, don't fix it," these two events prove them wrong.
Human nature - and the nature of government-linked systems like ATM service provision - being what they are, perhaps these accidents had to happen to convince the industry it has to improve.
Just as the Linate accident investigation opened a complete can of worms, displaying an organisation that had no safety management system at all, the Ueberlingen collision report forced Swiss ATM service provider Skyguide to recognise it may have had a safety system in place, but it was operating it piecemeal and not as a closed-loop system.
Despite lessons from Linate, runway incursion accidents probably still constitute one of the risks against which the air traffic control system remains least well-defended, because a collision can be a matter of an aircraft travelling just 20m (65ft) from where it should be to where it becomes a fatal obstacle, leaving little time for controllers or systems to detect the developing risk. No wonder this risk remains a high priority in the safety action plans for Eurocontrol, the US Federal Aviation Administration, and many other ATM oversight organisations worldwide.
Meanwhile, Ueberlingen demonstrated that "the accident that couldn't happen" - because of all the safety-net systems that were theoretically in place - actually did happen because they either were not being used at all (short- term conflict alert - STCA - was down for maintenance) or were being operated differently in the two collision aircraft (airborne collision avoidance system) because of ambiguity in the laid-down standards for use and disparity in the operating instructions for pilots.
At the Zurich area control centre (ACC) on 1 July 2002, the sole Skyguide controller at his workstation had no operating technological monitor - the STCA - and he had no human back-up either because his colleague had taken a break. In addition, he had two tasks using two separate displays: controlling the upper-airspace sector in which the accident took place, and the lower sector in which he was guiding an Airbus A320 toward its destination at Friedrichshafen. The BFU report remarks that his focus on the low-level traffic definitely contributed to his late appreciation of the developing upper-airspace conflict. Skyguide admits that its standards at the time should have ensured that the controller was not alone however uncongested the sky was that night, but its system was being disregarded. As soon as this became apparent early in the investigation, the ATM provider clarified its requirement for human back-up at all times, and since then has also ensured that a separate controller handles low-level traffic for approaches and departures in the area.
Hindsight can provide wisdom for use in the future. The future is now. The Ueberlingen and Linate reports have illustrated that apparently "adequate" systems - adequate in the sense that nothing had gone seriously wrong for a while - were far short of the safety standards air travellers have a right to expect. It has been evident to pilots since the invention of radio communication that standards and styles of air traffic control all over Europe have always varied dramatically. It is obvious that the least competent have the most to do, but if Skyguide had internal imperfections, so have all the others. The fundamental keys to Europe-wide improvement are full participation in Eurocontrol's centralised ATM incident reporting system and the operation - not just the possession of - an approved safety management system.
Source: Flight International
