presented to: by: date: federal aviation administration the ato and safety: improving our safety...

Presented to:

By:

Date:

Federal AviationAdministration

The ATO and Safety: Improving Our Safety Culture

ATO Safety Service

Aerospace Guidance and Control Systems Committee (AGCSC) – Lake Tahoe, NV

3/2/2006

Joe Schanne, Director IOT&E

The ATO and Safety2Federal Aviation

AdministrationMarch 2, 2006

DISCUSSION TOPICS:

• Overview (Who am I??? …. Who am I representing??)

• Maintaining/Enhancing Safety in U.S Air Traffic Control

• Safety Management System (SMS) and Safety Culture



International Models• FAA’s new Air Traffic Control (ATC) provider/regulator model is

consistent with international models– SMS functions within and is the responsibility of the service provider (ATO)

– Oversight (at varying levels) is outside of provider (in AVS)

Oversight: Transport Canada

Service: NAV CanadaOversight: CAA

Service: NATS

Oversight: Federal

Ministry of Transport

Service: DFS

Oversight: CASA

Service: Airservices Australia



FAA Safety Organizations

Administrator& Deputy Administrator

Air TrafficServices

Subcommittee

Chief Operating OfficerATO Transition

CommunicationsOperationsPlanning

FinanceAcquisition &Bus. Services

En Route &Oceanic Terminal Flight Services

SystemOperations

TechnicalOperations

Associate Administratorfor Aviation Safety (AVS)

Air Traffic Organization (ATO)Air Traffic Organization (ATO)

ATO Safety Service

Manage SMS process Support safety risk

management (SRM) Monitor/assure NAS

safety through: Audits/evaluations Data/metric

analyses Promote safety Collaborate

internationally Primary interface with

AOV

Provide independent safety oversight of air traffic service provision

Audit of process, not daily operations

Can require a change to enhance safety

AOV

Safety

Communication



Safety …. Our Highest Priority

The ATO

Safety. Service. Value.



FAA Safety Management System

Assurance

Policy

Safety Promotion

Architecture

SMS Requirements

SMS Responsibilities & Accountabilities

Safety Oversight

Safety Risk Management (SRM) - e.g., changes are safe

SRM Filter (what changes require SRM?)

SRM Guidance

SRM Documentation (and who approves?)

Safety Assurance and Evaluations

Safety Data Tracking and Analysis Recommending Actions

based on Safety Metrics

SMS Training

Safety Organization

Safety Culture

Safety Lessons Learned



FAA Safety Management System (SMS)

Assurance

Policy

Safety Promotion

Architecture

Safety Risk Safety Risk Management (SRM)Management (SRM)

An Example ….

Unmanned Airborne Systems (UAS’s)



SRM Example ..UAS Challenges

Ensuring safety of the U.S. NAS– Users and public on the ground

Minimizing safety impacts:

– Inherent low visibility of many UAS aircraft - more difficult to visually detect and track

– Increased time between detection and avoidance

– UAS aircraft performance limits in collision avoidance

Differentiating between Recreational model aircraft and UAS aircraft

Supporting the national defense expanding access requests



See and Avoid is not an ATC Function Radar does not depict everything in the NAS



Within “segregated” airspace– Includes Special Use Airspace (SUA) Restricted and Prohibited

areas & Air Traffic Control Assigned Airspace (ATCAA)– Excludes MOA, MTR’s and Warning areas

In non-segregated airspace– “Public” UAS – through Certificate of Authorization (COA) process– “Civil” UAS – using experimental / type certification process– “Model” aircraft – with guidance from AC 91-57, dated June 1981– Variety of other operations believed to be occurring by both the public and

private sector• Some based on interpretations of “model” aircraft guidance • Others with a lack of knowledge of aviation environment requirements

While ensuring “no harm” to other NAS customers and public

Current UAS Operations in the NAS



DOD UAS Border Flight – Arizona (Hunter UA)

Altitude: 11,000 to 13,000 MSLDimensions: 105 NM x 10 NM



Safety Risk Management

Assurance

Policy

Safety Promotion

Architecture

Improving Safety Improving Safety CultureCulture

An Example ….



The primary purpose of the ATC system is to prevent a collision….

Tenerife Accident: March 27, 1977



What is a Safety Culture?A Safety Culture includes:

– Personal dedication and accountability

• Individual attitudes and behaviors

– Shared vision with structures to attain it

• Organizational processes, methods and metrics

– Commitment to improve (resist complacency)

• Beyond simple adherence to procedures

• Learning and continuous improvement

– Pervasive safety thinking

• Commitment to excellence

• Integration of safety into all activities

Leaders must:– Create a climate in which news is quickly and easily communicated,

– Be committed to investing the time and resources to address risk



Potential Challenges to Evolving the Safety Culture

• Complacency based on past success• Belief that the organization is as advanced as possible• Data questioned rather than acknowledging need for

change• History of mistrust and hiding information• Facilities penalized for reporting errors• Difficulty in breaking through the bureaucracy• Resistance to change; Cynicism



We Have Data, But We Are Reactive, Not Proactive

Eva

luat

ion

s

Inve

stig

atio

ns1

AircraftAccident

~30Incidents

~300HazardousConditions

~1,000Unreported

“Unsafe Acts”R

un

way

Incu

rsio

ns/

Op

erat

ion

al E

rro

rs

NTSBNTSB

DOT IGDOT IG

AVS/AOVAVS/AOV

(OE/RI, etc.)(OE/RI, etc.)

(TCAS Alerts, UCRs, Non-Compliance,(TCAS Alerts, UCRs, Non-Compliance, Go-arounds, Bad Documentation, etc.)Go-arounds, Bad Documentation, etc.)

(Non-Reported OEs/ODs, Missed Checks, etc.)(Non-Reported OEs/ODs, Missed Checks, etc.)



Examples

• We have previously discussed the NASA Challenger Disaster and how complacency crept back in before Columbia.

• Recent Discovery flight showed willingness to do the right thing, even when not the popular thing to do.

• An ATC Example: Überlingen Collision Video–Credit: DFS Deutsche Flugsicherung GmbH



Überlingen Collision Video



Example …. Überlingen Accident Überlingen Accident July 1, 2002July 1, 2002

• Unreported, Unknown to management

• Aircraft Accident

• Previous OE by this controller in similar circumstances

• TCAS procedures not integrated internationally

• Management allowed mid-shift operations with one controller working both HIGH altitude and LOW altitude workstations. There was no complete situation display.

• Ongoing resectorization activity:• Controllers did not read Notice • Radar in a back-up mode, no Conflict Alert• Communication system impaired

Accident

Incidents

HazardousConditions

Unreported“Unsafe Acts”



Lack of Management Oversight

• Reduced staffing on midnight shift • Tolerated a policy of “extended breaks” on mids• Became complacent, failed to compensate for loss

of automation with human redundancy• Failed to ensure own regulations were followed:

– Single person operations required full automation capabilities– The reduced communication service was not coordinated with

adjacent facilities as required– Failed to ensure controllers reviewed “Facility NOTICE” posted

about reduced capabilities on the night of the accident



… An Update …

Monument on the grave of Vitaly Kaloyev's wife and two children, Diana, 4, right, Konstantin, 10, and Svetlana, 44, in the city of Vladikavkaz, southern Russia, in this Feb. 27, 2004 file photo. Swiss prosecutors are urging a Zurich court, Switzerland to convict Russian man Vitaly Kaloyev of stabbing the air traffic controller he believed was responsible for the death of his wife and two children in a mid-air collision.



Where do you think you are?• Questions to indicate health of the Safety Climate

– Are employees committed to safety and ready to apply the resources necessary?

– Do employees feel encouraged to point out possible problems?

– Do employees fear retaliation for exposing problems?

– Does management show that they want to know the problems?

– Are Safety positions seen as a career boost, not a dead-end?

• If improvement is necessary, what can be done to improve?



Safety Culture Evolution

*Adapted from Safeskies 2001, “Aviation Safety Culture,” Patrick Hudson, Centre for Safety Science, Leiden University

PATHOLOGICALWho cares as long as we’re not caught

Chronically Complacent

REACTIVESafety is important. We do a lot every

time we have an accident

CALCULATIVEWe have systems in place to manage all

hazards

PROACTIVEAnticipating and preventing problems

before they occur

GENERATIVESafety is how we do business around

hereConstantly Vigilant

Increasing Tru

stIncreasing A

wareness



A Final Thought …

All truth passes through three stages:

– First, it is ridiculed.

– Second, it is violently opposed.

– Third, it is accepted as being self-evident.(Arthur Schopenhauer, 19th Century Philosopher)

As a Leader/Manager, how do you respond when As a Leader/Manager, how do you respond when a safety “truth” is brought to you?a safety “truth” is brought to you?

presented to: by: date: federal aviation administration the ato and safety: improving our safety...

Documents