ATM Safety Data Reporting, Analysis and Sharing Where we are and where are we heading by facilitating Just Culture Tony LICU Programme Manager – EUROCONTROL DAP/SAF European Safety Programme for ATM (ESP) April 2006 – Baku/Azerbaijan antonio.licu@eurocontrol.int European Organisation for the Safety of Air Navigation

Objective Current Status of Safety Reporting and Analysis Regulations Technical Issues (taxonomy, harmonisation, severity assessment, trend output) A Just Culture definition Actions that ANSPs can do…

ICAO Annex 13 First edition September 1951 1st-3rd edition (04/1973) called “Aircraft Accident Inquiry” 4th-7th edition (05/1988) called “Aircraft Accident Investigation” 8th-9th edition (07/2001) called “Aircraft Accident and Incident Investigation” History of the editions and of the title of Annex 13 are presented in this picture. The current edition in force is the edition 9th dated July 2001. ICAO Annex 13 has suffered “major” amendments following the ICAO AIG (Accident Investigation Group) 99 Divisional meeting. Several amendments have been included following this meeting to expand and clarify the non-punitive intent of the reporting and investigation.. First edition of ICAO Annex 13 is dated back in September 1951: 1st-3rd edition (04/1973) were titled “Aircraft Accident Inquiry” 4th-7th edition (05/1988) were titled “Aircraft Accident Investigation” 8th-9th edition (07/2001) were titled “Aircraft Accident and Incident Investigation” Since the initial edition the Annex 13 has expanded to encompass also incidents as well as accidents. In the current edition of Annex 13 Section 3-1 states the Objective of the Investigation “3.1 The sole objective of the investigation of an accident or incident shall be the prevention of accidents and incidents. It is not the purpose of this activity to apportion blame or liability.” This is consistent with ESARR 2 Rationale “…….Such reporting and assessment, which must be in a non-punitive environment, has the potential to act as an effective contribution to accident and serious incident prevention.” Annex 13 current edition has obviously expanded over time to cover technical and legal issues in incidents and accidents investigation, however it’s objective has not change from it’s very first edition in 1951.

Reported Safety Occurrences ESARR 2 Trends, KRA, ATM improvements GLOBAL SOLUTIONS Need to know about undesired events that have had or might have had an impact on safety Reporting systems Requires a common TAXONOMY Reported Safety Occurrences Need to determine to what extent ATM has contributed to the occurrences and severity of a safety risk Data collection Analysis Severity assessment ATM contribution Requires HARMONISED PROCESSES Findings, Recommendations Severity Assessment Need to share experiences ESARR 2 ought to lead to GLOBAL SOLUTIONS : ATM Improvements, Key Risk Areas and Trends, etc. To ensure that, we need to know about undesired events that have had or might have had an impact on safety – We need therefore robust “Reporting Systems” based on a harmonised Taxonomy. Having Reported Occurrences is not enough. We need to understand and to determine to what extent ATM has contributed to the safety occurrence and severity of a safety risk. To ensure this next step we need harmonised processes for data collection, analysis, severity assessment etc.. Output of all these processes will lead to findings and Recommendations. To improve aviation safety these information ought to be shared. Sharing of safety data is a sensitive exercise which in turn requires procedures and confidentiality assurance. Only at this final stage we can say that GLOBAL SOLUTIONS are identifiable and available for all stakeholders within aviation community. Annual Summary Template Agreements (bilateral or regional) Requires PROCEDURES CONFIDENTIAL ASSURANCE

What can go wrong ?

Accident Definition This really looks like an accident but are we absolutely sure that this statement is correct and to which definition does this correspond?

Accident Definition Criteria What criteria or elements would you consider for the purpose of classifying an occurrence as an accident ? 1 2 3 4 5 6 7 What would you consider before you can say that something that happened was actually an accident? There are 7 criteria in the Accident definition: 1. Persons on board an aircraft (between moment when boarded and disembarked) 2. Fatalities 3. Serious injuries 4. Fatalities OR serious injuries 5. Aircraft sustains structural failure or damages 6. Aircraft is missing or is inaccessible 7. Overview

Persons on board at time of occurrence? Accident Criteria YES Intention to fly? NO No Accident YES Fatalities? Note 1 NO Accident YES NO Serious injuries? Def. YES NO A/c damages, structural Failure req. major repair ? YES NO Aircraft missing? or inacessible? Note 2 For an occurrence to categorised as an accident: 1. There MUST persons on board who have intention to fly AND Either 2. there are Fatalities or Serious Injuries OR 3. The aircraft is missing, inaccessible or has suffered structural damages ICAO/ESARR 2 definition of an accident: “An occurrence associated with the operation of an aircraft which takes place between the time any person boards the aircraft with the intention of flight until such time as all such persons have disembarked, in which: a) a person is fatally or seriously injured as a result of: - being in the aircraft, or - direct contact with any part of the aircraft, including parts which have become detached from the aircraft, or - direct exposure to jet blast, except when the injuries are from natural causes, self-inflicted or inflicted by other persons, or when the injuries are to stowaways hiding outside the areas normally available to the passengers and crew; or b) the aircraft sustains damage or structural failure which: - adversely affect the structural strength, performance or flight characteristics of the aircraft, and - would normally require major repair or replacement of the affected component except for engine failure or damage, when the damage is limited to the engine, its cowlings or accessories; or for damages limited to propellers, wing tips, antennas, tires, brakes, fairings, small dents or puncture holes in the aircraft skin; or c) the aircraft is missing or is completely inaccessible. Note 1.-For statistical uniformity only, an injury resulting in death within thirty days of the date of the accident is classified as a fatal injury by ICAO. Note 2.- An aircraft is considered to be missing when the official search has been terminated an the wreckage has not been located. “ YES NO

Accident Definition cont’d This definitely looks like an accident although the seven criteria haven’t been checked yet.

Accident Definition cont’d This in fact was not an accident….as per ICAO definition i.e. there was no intention of flight. On board were technical staff testing the aircraft brakes.

There is a need for detailed Conclusion There is a need for detailed agreed definitions We need to make sure that we use the same words to express/describe identical situations when reporting and investigation aviation safety occurrences. This is what HEIDI (Harmonisation of European Incident Definitions Initiative for ATM ) is attempting to do (hopefully it does or it will after it will be used for some time). HEIDI is therefore a set of Terms, to cover a specialist domain i.e. the accident/incident notification-investigation-reporting But these terms are NOT organised/presented in a dictionary like manner they are structured in a way that makes the use of HEIDI more efficient. In other domains such arrangements of terms for the purpose of enhancing their usage are called TAXONOMY. Therefore, although to a somewhat smaller extent, HEIDI is a TAXONOMY.

CFIT Some Clue… “Say…what’s a mountain goat doing Here is some clue...for a CFIT definition The “funny” picture intends to show the lack of prior awareness of the crew before collision with the ground. This is key for the completion of the CFIT definition. The crew is still in control of the aircraft and the collision of the ground is not a resulted cause of a Loss of Control. “Say…what’s a mountain goat doing way up here in a cloud bank?”

HEIDI/ADREP Taxonomy Layout Factual Data BACKGROUND DATA Collision with Ground EVENT TYPE Accident SEVERITY CLASSIFICATION SCHEME No awareness from crew DESCRIPTIVE FACTOR(S) Human Factors EXPLANATORY FACTOR(S) Let’s describe the CFIT definition in terms of HEIDI CFIT is: - an accident (to be placed in the CLASSIFICATION SCHEME chapter) - a collision with the ground (to be placed in the EVENT TYPES chapter) - No awareness from the part of the crew there other reasons for other types of occurrences (to be placed in the DESCRIPTIVE FACTORS chapter) - Factual data, which aircraft?, where?, what time?, which ATC unit? Etc, (all these factual data found their place in BACKGROUND DATA chapter) - Finally the investigation will try to understand why this happened from Human Factors perspective (EXPLANATORY FACTORS chapter) We must NOT forget that the aim of this activity is to prevent accidents therefore there particular attention should be paid to safety recommendations (HEIDI has dedicated chapter to help investigators to issue Safety Recommendations) GLOSSARY - is a chapter that contains definitions of key words that are used in several definitions contained in the rest of the taxonomy. Recommendations RECOMMENDATIONS GLOSSARY

Current Output Trend analysis and statistics on a large number of Safety Performance Indicators: Accidents and the ATM Contribution to accidents Mid-Air Collision, CFIT, Collisions on the ground e.g. Incidents: Separation infringements, Runway Incursions, Near CFIT, Unauthorised penetration of airspace e.g. ATM Specific Occurrences: Provision of ATM services: ATS, ASM, ATFM Failure of ATM Elements: COM, SUR, NAV, FDP

In reality Almost all Data is Lost Forever Currently Only a Minute Portion of Data is Reported, Analyzed, Used and Disseminated

Why ? - SAFERP TF Report Seek Solutions

Just Culture SMS to address these for the single purpose of improving safety Inadequate attitude Repetitive errors Deliberate acts Honest mistakes criminal acts gross negligence omissions optimising violations mistakes Issue for the competence of justice Management to monitor these and take disciplinary actions as required JB, FL & GLG

From where in fact safety data comes In the absence of bad outcomes, the best way to sustain a state of intelligent and respectful wariness is to gather the right kinds of data. This means creating a safety information system that collects, analyses and disseminates information from incidents and near misses, as well as from regular proactive checks on the system’s vital signs. prof. J. Reason

From where in fact safety data comes Ref – IFATCA survey early 2000 The above chart is a sample collected from ANSPs that shows the additional information you could collect from a such system on potential threats to safety

Encourage people to report even minor concerns Assess the reporting culture and identify major reporting impediments in your organisation Conduct a survey amongst the totality or part of your staff to assess the reporting culture and main impediments for reporting Involve staff representatives in the survey

Improve the trust in the system Trust is the most important foundation of a successful reporting programme, and it must be actively protected, even after many years of successful operation. O’Leary - British Airways & S. L. Chappell -NASA Any safety information system depends crucially on the willing participation of all staff and requires trust between management and staff regarding a shared commitment to safety.

Written reporting policy and procedure People need to know what will happen when they are involved in or witnessed a safety occurrence and submit a report. “Just Culture”, agreed by staff representatives – define the limits Separation of the data-collecting function Involvement of active controller in the process Confidentiality for the reporter Refer to the examples in the WP and add one more at the end of the presentation

Deal with sanctions and Loss of face Ref – IFATCA survey early 2000 ~70% LOSS OF FACE 31%

What can we do?

The « non-punishment » chart Intentional? (Deliberately endangered others) This actually refers to the author of the action(s) or absence of action(s) concerned being conscious of not doing well and potentially endangering others . This includes (gross) negligence yes Mental illness? no « normal » Environment? This must be understood as external and internal conditions being covered by procedures, training, and all activities that must be carried out to ensure normality of operations (supervision) Important: non written rules but working habits that are considered « normal » practice at a given unit must be considered as « normal » environment yes Medical case no Criminal case yes Substitution test no Procedures missing or supervision error Training missing yes Management Issue The environment is not « normal » when the conditions in which operators are required to work were either: Not covered by procedures Or not addressed by training Or the supervision was inadequate (e.g. manning of sectors, traffic flow control etc..) The « substitution » test aims at determining whether any other staff with the same experience would have performed in a same way or not. In ATM this can only be achieved by a group discussion of « experts » (experienced staff) which honestly evaluates the performance and decides whether the performance was substandard or not. Care must be taken as experienced staff may have developed their skills in different manners. Individual issue Management Issue Revision of procedures Or training Global issue « Disciplinary » Type of sanctions may be Envisaged Rule based Violations Negligence Corrective actions should be Envisaged (training) Knowledge skills Management issue Lack of Competence verification And/or

Finally what is JUST CULTURE? Failure Incident Accident

Seriously what ANSPs can do? (NAME of organisation) will adopt the following « proportionate blame » policy with regards to incidents with the purpose of making disciplinary measures strictly limited to those acts that do not qualify as « honest mistakes ». Disciplinary measures range from: temporary suspension of payment of shift allowances Down grading …… 2. Disciplinary measures are to be decided upon by the Management who has to consider the advice of the disciplinary committee. (see TORs of disciplinary committee) 3. The disciplinary committee shall also be informed by the Management about acts that need to be reported to the Department of Justice. 4. Safety occurrences that emerge from data derived from automatic reporting activities (STCA and/or AMST) will not mention any names as long as they do not pertain to a reported occurrence (by ATM or pilot)

In summary SMS to address these for the single purpose of improving safety Inadequate attitude Repetitive errors Deliberate acts Honest mistakes criminal acts gross negligence omissions optimising violations mistakes Issue for the competence of justice Management to monitor these and take disciplinary actions as required JB, FL & GLG

Thank you! Questions? ?