Level Busts, unauthorised deviations from ATC
cleared level, are facts of aviation life. As the numbers of flights
have grown so have the number of level busts although the occurrence
rate has remained reasonably steady. Concern over the increasing
number of incidents is growing and the CAA’s Safety Regulation Group
is conducting an awareness campaign to highlight this issue.
Preliminary analysis indicates that some aircrew
may harbour misconceptions about ATC capabilities which could
contribute to a lessening of vigilance on the flight deck. Issues
discussed here relate to the use of radar and are especially relevant
to the holding situation.
On November 12th 1996, at around 1638, an MD81
en-route from Aarhus in Denmark entered the Lambourne (LAM) holding
pattern prior to making an approach to land at London’s Heathrow
Airport. Two minutes later a Boeing 737-400 from Amsterdam, also bound
for Heathrow, called on the same frequency and was also instructed to
hold at LAM. The MD81 was instructed to descend to FL140 and
subsequently reported at that level. The Boeing 737 was then
instructed to descend to FL150, and this instruction was correctly
read back by the crew. 1,000ft vertical separation is the minimum
permitted in this airspace.
Nevertheless, by 1644 vertical separation had
reduced to 100ft and the two aircraft had closed to around 750 metres
horizontally. The Boeing 737 had descended at a rate of about 1,000ft
per minute, and at its lowest, had descended to 14,052 ft (1013mb).
The controllers concerned, having taken appropriate action to ensure
that the aircraft were vertically separated, were no longer
specifically required to constantly monitor the two aircraft and were
devoting their attention to other flights. Their attention was drawn
to the incident when an automatic system, the ‘Short Term Conflict
Alert’ (STCA), activated to indicate that there was a possible
imminent loss of separation requiring immediate attention.
No one is entirely sure why the correctly read
back cleared level was not set on the Boeing’s flight deck. However,
when the Boeing 737 pilot read back the correct descent clearance to
the Air Traffic Controller, the other pilot was not in the
communication loop. Instead, he had been briefing the passengers over
the aircraft’s passenger address system. Thus an essential safeguard,
a second pilot to check that the vertical clearance was correctly
understood and implemented, was missing from the system. One
conclusion that can be drawn is that the timing of passenger
announcements and other non-essential tasks which remove a crew member
from the R/T communications loop can be critical to flight safety.
Following their investigation, the AAIB
recommended that the airline concerned review its Standard Operating
Procedures in the light of this incident. ‘Human factors’ such as this
have been implicated in many aviation incidents. It is likely that, as
technology becomes more reliable in itself, such factors will become
more visible in the future, not so much because they are on the
increase, but because incidents due to other factors will be fewer.
This incident, though, raises questions about
the relationship between Air Traffic Control and the Flight Deck Crew,
and what Flight Deck Crews might reasonably expect from the Air
Traffic Controllers responsible for their aircraft’s separation from
others; after all, these flights were in controlled airspace and ATC
should have been watching all the time, shouldn’t they?
Actually, Air Traffic Controllers cannot monitor
all flights at all times, and they do not attempt to do so. Rather,
they mentally sort flights into groups - groups of aircraft which
require frequent attention and groups which do not. In the case of the
MD81 and Boeing 737 at LAM, these aircraft were in the ‘do not require
frequent attention’ group. That is because, as far as the controllers
were concerned, the immediate problem of separating these two aircraft
had been sorted out ‘procedurally’ - by the aircraft being assigned
vertically separated levels, and the pilots correctly reading back the
appropriate instructions. For the controllers this communication and
confirmation process is a matter of ingrained normal operation and has
greater significance in the holding situation since controllers are
trained not to rely on SSR information when aircraft are in close
proximity laterally, as is the case when aircraft are stacked in a
holding pattern.
This is not to say that controllers will never
use SSR to check on holding aircraft, they will and do. Instead it is
a recognition that the radar systems in use are unable to reliably
present controllers with consistently accurate data when aircraft are
close together horizontally. In fact, on occasions, the data blocks
containing aircraft identity and altitude information can transfer
from aircraft symbol to aircraft symbol on the radar screen, even when
the aircraft concerned are correctly vertically separated (or indeed
are many thousands of feet apart vertically). So, what looks to the
controller to be one aircraft’s data are actually those of another, or
are completely corrupted. This corruption of information may even lead
to spurious activation of the STCA facility. (STCA is not a TCAS for
controllers in that it does not give ‘advisories’ to resolve a
situation: the controller must take a few seconds to assimilate the
situation, perhaps by querying the pilots’ actions via R/T, before
being in a position to act - by which time it may be too late to
prevent an erosion of separation. It is worth noting that neither
aircraft in this incident was equipped with TCAS.)
So where does this lead us? In holding patterns,
perhaps more than anywhere else, the ATC separation system relies on
the accurate communication of vertical clearances between all those
involved in safely managing a flight. The process of safely changing
the level flown by an aircraft is a complex one where the pilots
flying the aircraft and the controllers managing the flight can be
considered to be part of the same team exchanging information with
opportunities for error every time information is passed on.
Sometimes, as in the incident discussed earlier, that error is a human
one which exposes a weakness in procedures designed to provide
“fail-safes” on the flight deck, or between the flight deck and the
ATC unit, or within an ATC unit alone. These mistakes can happen at
any stage in a flight, but in a holding situation the safety net of
ATC radar is much less effective, resulting in a less secure
environment should a vertical clearance be misunderstood.
Nevertheless, by 1644 vertical separation had
reduced to 100ft and the two aircraft had closed to around 750 metres
horizontally. The Boeing 737 had descended at a rate of about 1,000ft
per minute, and at its lowest, had descended to 14,052 ft (1013mb).
The controllers concerned, having taken appropriate action to ensure
that the aircraft were vertically separated, were no longer
specifically required to constantly monitor the two aircraft and were
devoting their attention to other flights. Their attention was drawn
to the incident when an automatic system, the ‘Short Term Conflict
Alert’ (STCA), activated to indicate that there was a possible
imminent loss of separation requiring immediate attention.
PDF file