Linate and Überlingen: Understanding the Role That Public Policy Plays in the Failure of Air Traffic Management Systems

The terrorist attacks of September 2001 had significant economic effects on the aviation industries. Passenger numbers fells across many countries and several large carriers were threatened with bankruptcy. More recently, there has been a gradual recovery. This has renewed concern that the rising volume of traffic will lead to an increase in the total number of safety-related incidents as accident rates have remained stable. This creates a “wicked problem”. How can we further reduce the rate of very rare events before there is any rise in the total number of the accidents and incident? There are no panaceas but it seems clear that we must identify any common factors that occur between the relatively small numbers of adverse events that occur each year. This paper, therefore, shows how violations and vulnerability (V2) analysis can be applied to identify similar causes in the Linate runway incursion and the Überlingen mid-air collision. Both stemmed from underlying problems in theSafety Management Systems that are designed to protect the European Air Traffic Management (ATM) infrastructure. Introduction From 1995 to 2000, the worldwide accident rate was 1 in every 1.25 million flights. This improved between 2001 and 2005 to 1 accident in every 2 million flights. In 2004, the European Air Traffic Control agency, EUROCONTROL, recorded a single mid-air collision that was directly caused by Air Traffic Management (ATM) involvement. This was not fatal. Such statistics illustrate the significant progress that pilots, Air Traffic Control Officers (ATCOs), managers and regulators have made in raising safety standards. However, passenger numbers are gradually increasing across many routes in the aftermath of the 2001 terrorist attacks. These increases in departures must be offset against further falls in the accident rate if we are to maintain or reduce the total annual number of annual incidents. It is unclear how to achieve further safety improvements when the accident rate is already so low. These problems are compounded by the pathological combinations of events that seem to trigger adverse events in European air space. Many authors use Reason’s ‘Swiss Cheese’ model to characterize the bizarre way in which underlying vulnerabilities line-up in the events leading to major failures [7]. In contrast, the following pages argue that many accidents in European air space have a core set of common causes. In particular, violations and vulnerability (V2) analysis is used to identify the latent and catalytic events leading to the Linate runway incursion and the Überlingen mid-air collision. 1 Glasgow Accident Analysis Group, Department of Computing Science, University of Glasgow, Glasgow, G12 8QQ, Scotland, U.K. [email protected], http://www.dcs.gla.ac.uk/~johnson Overview of the Überlingen Accident The Überlingen accident occurred on the 1 July 2002 when a Boeing 767-200 was involved in a mid-air collision with a Tupolov TU164M [2]. A total of 71 crew and passengers were killed on both aircraft. The immediate causes of the accident centered on the Air Traffic Control Officer’s (ATCO) instruction to the Tupolov crew, which contradicted the Traffic Alert/Collision Avoidance System (TCAS) on-board warning system, and ordered them to descend into the Boeing 767 which was also responding to a TCAS warning to avoid the other aircraft. The official BFU report into the accident was issued in 2004. It provides a relatively thorough analysis of the causes that led to the confusion over the warning from the TCAs software. In contrast, this paper focuses on the infrastructure changes at the Zurich Air Traffic Control Center. Scheduled maintenance procedures created some of the preconditions where the ATCO was likely to make a mistake. Overview of the Linate Accident The Linate accident happened on the 8 October 2001 when a Boeing MD-87 was taking off from runway 36R at Milan’s Linate Airport [1]. The MD-87 collided with a Cessna 525-A, which taxied onto the runway. The MD-87 carried two pilots, four attendants and one hundred and four passengers. The Cessna carried two pilots and two passengers. All occupants of the aircraft were killed along with four ground staff who were working in a baggage handling building struck by the MD-87 after the runway collision. The official ANSV report identified the human factors causes that led the Cessna’s crew to mistakenly cross the active runway under, low visibility conditions. It also balanced these factors against a number of organizational and technical limitations in the systems in the airport’s operational environment that created the preconditions for the accident. Motivation These accidents had a profound impact on both the Italian and Swiss Air Traffic Service Providers. They also motivated the European Strategic Safety Action Plan as national bodies moved to learn the lessons of the Überlingen and Linate accidents [6]. Most of these initiatives treated the incidents as separate events. For instance, reports into the Überlingen accident focused on the role of TCAS and on the management of the Zurich Center. Conversely, work on the Linate accident tended to focus on the problems of runway incursion. This is illustrated by the establishment of the European Action Plan for the Prevention of Runway Incursions [3]. None of these reports looked at the common element in both accidents. To date, there has not been any sustained consideration of similarities in the project management problems that affected the software infrastructure in the Linate and Überlingen accidents. The following pages, therefore, identify common causes between these adverse events. Public Policy Tensions between Safety Regulation and Market Economics Public policy is defined to be guidelines or rules that results from the actions of governmental and quasi-governmental organizations. Public concern over infrastructure reliability often persuades government agencies to intervene directly in the engineering of many large scale computer systems. There is considerable controversy over whether such interventions directly contribute to incidents and accidents. It can be argued that governmental intervention is necessary to ensure ‘social goods’, including reliability, that cannot be guaranteed under free market competition. In contrast, it is also argued that government intervention creates the preconditions for failures when deregulation fails to consider the implications for infrastructure investment [4]. Both the Überlingen and Linate accidents have causes that stretch back into the public policy of Air Traffic Management in Italy and Switzerland. In both cases, national governments were struggling to resolve the tensions between market economics and the need to maintain extremely high levels of safety. For example, the Swiss government began to reduce direct State intervention in ATM service provision during the 1980s and early 1990s. Swisscontrol became an independent joint stock company under Swiss law in 1996. A key objective in this process was for airlines and airports to meet the financial costs associated with air navigation service provision rather than Swiss tax payers. Skyguide was formed in 2001, by the merger of military and civil air traffic management. Figure 1 sketches the management and regulatory structures surrounding this company in the months prior to the Überlingen accident [8]. The Swiss Confederation retained formal owner of Skyguide with a majority shareholding. As can be seen, the Federal government was represented by the Department of Defense, Protection and Sport (DDPS) and the Department of Environment, Transport, Energy and Communication (DETEC). DDPS focused on the need to integrate civil and military service provision. In contrast, DETEC was primarily concerned to ensure that Skyguide operated at no cost to the Swiss Confederation. This created important tensions given the rising volume of air traffic and the international agreements that place caps on the levies raised against air traffic. These constraints were exacerbated by the obligations to maintain services in areas that would normally not have been financially viable, including smaller airfields. Skyguide were placed under further financial pressures in the years leading to the accident by accounting structures that made it difficult for them to carry forward financial reserves as a contingency against future difficulties. Department of Environment, Traffic, Energy and Communication (DETEC) Federal Office for Civil Aviation (FOCA) Skyguide. Eidgenössische Flugunfallkommission (EFUK) Department of Defence, Civil Protection and Sports (DDPS)