Helping reduce incidents at Maastricht: Safety learning in practice

A little over a year ago the Maastricht Upper Area Control’s (MUAC) Safety Manager (Keith Cartmale) and principal Maastricht incident investigator (Philip Marien) came to Bretigny to discuss a number of items with the Safety Research Team. One was a recurrent incident that had occurred some seven times in a few MUAC sectors. The characteristics of the incident were that a controller dealt with an aircraft (a/c) in his or her sector, such that it was still in the sector but effectively ‘finished with’ and prepared for the next sector. Then the controller proceeded to deal with the other aircraft in the sector. This first aircraft was ‘dimmed’ in brightness at this point, although it was still in the controller’s sector, and still his or her responsibility. Shortly afterwards, there would be a loss of separation incident between the ‘dimmed’ a/c and one or two ‘active’ a/c in the sector. It seemed that potentially the dimming of the aircraft, an aspect of the interface meant to reduce workload and clutter (by helping the controller focus on other a/c) was unwittingly contributing to losses of separation.

There were other factors in the incidents, but the brightness factor was prominent. At the time, MUAC was in the process of transitioning to its new interface. This new interface would have different characteristics – a/c ‘finished with’ would not be dimmed, but would change in colour. Given that this change was imminent, it seemed wise to simply monitor the situation to see if the incidents went away. They did, for a while. But then they started again.

New ODS (Operator Input and Display System) suite at Maastricht Upper Area Control Centre

We then visited Maastricht in late Spring, and interviewed seven of the controllers who had experienced these incidents, which were now in double figures. What was interesting from a psychological point of view, was that the controllers were indeed surprised by the incidents – it was not simply a case of ‘Oh no, I’d forgotten about that one!’ as one might expect. Rather, it seemed as if the a/c had indeed been ‘deleted’ from what we call the working memory (also known as situation awareness; or ‘the picture’) in the controller’s mind, and never entered the more long term storage system we call long term memory. This suggested that it was more than simply a matter of the interface leading the controllers astray. Additionally, this pattern of incidents was only occurring in a few specific sectors of MUAC airspace.

The problem appeared to be due to several factors. The first was workload, which was a function of the airspace design and the traffic flows in those sectors, and the working practices of the controllers. Maastricht controllers are considered as some of the best in Europe, and they have this reputation because they generally give a very good service to aircraft flying through their airspace. This means that if pilots request certain flight levels that are more economical, they usually get those flight levels. But this means that in certain sectors there is a good deal of vertical movement, in relatively (laterally) constrained corridors. This increases the workload and requires more effort to maintain situation awareness. Additionally, as a function of airspace design and the traffic flows, and the complexity of some of the sectors, the aircraft are sometimes dealt with and effectively finished with some time before they exit the sector. This means that these a/c will change colour (to a less salient colour) while some minutes remain before another controller takes charge of them in his or her sector. In fact at least one controller who had experienced one of these incidents had changed their working practice so that aircraft would be finished with much later.

During a presentation in July to some of the senior management at MUAC, it was agreed that colour coding did nevertheless reinforce, or support, the’losing’ of a/c from situation awareness in certain sectors and traffic loads. MUAC is therefore currently exploring alternative colour and other coding approaches, so that the aircraft that are finished with nonetheless remain salient. Additionally, MUAC have improved the working of their Short Term Conflict Alert (STCA) system to give controllers more warning before separation is lost, especially in the vertical dimension. There is probably going to be some TRM (Team Resource Management) type training on this incident pattern, and MUAC will themselves release an internal bulletin on the nature of the incident pattern. There will also likely be some focus groups to explore how best working practices can avoid its recurrence.

This investigation is an example of what is intended for the Safety Learning (Saflearn) project (run by Tony Joyce) now running at the EEC. It shows that it is possible to analyse real incidents and detect patterns, and derive ways of preventing accidents from occurring. More specifically for EEC however, it generates design insights for our projects. In this particular case, it has raised some concerns about simple colour changes for a/c, when working in high density and highly dynamic airspace. During the study, other Human Machine Interface design issues were also noted by MUAC, and these will be fed forward by Saflearn into the project known as Safbuild (Alistair Jackson, in the SSP Business Area). Safbuild will develop a database of safety-related design information so we can build safety into EEC concept designs and interfaces.

In 2004, following the AGAS post mid-air collision review of safety, airspace complexity was identified as an important safety research topic. Therefore, the Safety Research Team, probably together with the COCA (Complexity and Capacity) project (Geraldine Flynn) in the NCD Research Area, will work with MUAC to help understand the complexity of their airspace, and develop means to reduce it and/or to help controllers cope with it.

Lastly, but by no means least, in parallel with this investigation (and unrelated to it), there was a simulation in 2002 concerning changes to military zones affecting MUAC airspace. During that simulation, some concerns were expressed by controllers. In the intervening time, MUAC has in fact decided to limit the traffic throughput in certain sectors affected by the military changes, to allow the controllers more time to adapt to the new sector design and traffic patterns. This decision is a good example of safety culture in practice, since safety is being placed before capacity.

Barry Kirwan, Tony Joyce (EEC)

Keith Cartmale, Philip Marien (MUAC)