Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
This book is for all those air traffic controllers, past, present and future to
whom excellence is the minimum.
ANNE R. ISAAC
with
BERT RUITENBERG
First published 1999 by Ashgate Publishing
Notice:
Product or corporate names may be trademarks or registered trademarks, and
are used only for identification and explanation without intent to infringe.
2 Human Error 11
2.1 The Nature of Human Error 11
2.2 The SHELL Model 13
2.3 Modelling Error 17
2.4 Levels ofBehaviour 20
2.5 Sources of Error 25
2.6 Managing Human Error 30
2.7 Individual Blame or Systemic Causal
Factors 32
v
vi Air Traffic Control: Human Performance Factors
Appendices
A Test of the Blind Spot 326
B Task/Relationship Questionnaire 327
c Key to the Countries in the Hofstede
Model 335
Bibliography 337
Index 357
List of Figures
vii
viii Air Traffic Control: Human Performance Factors
ix
Preface
The motivation for writing this book comes from a long standing belief
that Air Traffic Service personnel are rarely represented in the aviation
literature. There are few references to Air Traffic Control in any of the
increasing numbers of books written for pilots and about pilots. This is
also observed at all the main conferences held both in Australasia and
Internationally, although since 1994 things have gradually improved. I also
hope that the past sixteen years working with and for many of the New
Zealand and Australian air traffic control centres has given me sufficient
insight to redress the balance in the aviation industry.
This book has been written for all in air traffic services, from the ab initio
through to the boardroom. It is probably more important in some ways that
the men and women in these senior management positions have some
knowledge and awareness of the fundamental problems that limit and
enhance human performance. I have tried to present the information in this
book as logically as possible and having followed ICAOs lead in their
model of human performance, I hope I have succeeded in presenting the
material as clearly as possible.
I firstly examine the reason for the study of human factors, including the
past developments and how this discipline impacts on the present ATC
environment. Secondly, and probably most importantly, the issue of
human error is considered. It is perhaps this area alone which has
accounted for the continued and growing presence of human factors in the
aviation industry and is therefore the basis on which the rest of the book is
referenced. The introduction of the SHELL and Reason models allows a
logical progression of the various issues which affect the controller in their
working environment. A study of the strengths and weaknesses of the
controller themselves is followed by discussions regarding the interaction
of the controller with other people within the system, their use of
equipment (particularly in advanced technologies), the use of procedures
within ATC, and the more physiological issues within the working
environment itself.
Finally the topic of safety and risk management is tackled in the hope that
the system can learn from previous errors.
X
Preface xi
A book such as this is never a solo effort. There are many people who
need to be acknowledged for their professional help, guidance and support.
Air Traffic Control is both a science and an art and I believe that rarely are
these two aspects addressed. It is for this reason that I needed professional
Air Traffic Control personnel (and the odd pilot!) to help.
Firstly I would like to thank my co-contributor and collaborator, Bert
Ruitenberg, without whose help and witty repartee, as well as his writing,
this book would never have been completed. I have known Bert for many
years and his professional attitude and tolerance for, and applied work
with, the human factors specialists is somewhat unique. It is often difficult
and frustrating to get the message across to those who work in air traffic
services, but Bert has made my contribution much easier.
Thanks must also go to Dan Maurino for his faith in Bert and I and this
book.
There are several senior managers in both Australia and New Zealand
who I have to thank for their tolerance of my work over the years; from
the N. Z. Airways Corporation, Jack Frost, Ken McLean, Brian Hay and
Dave Rollo and John Guselli in AirServices Australia. Also from N. Z. the
many controllers, in training and in the field, in particular, Don Hamilton,
Fred Hansen and Mal Sole, who was brave enough to allow me dual
control with real traffic.
Lastly, but not least, the many pilots who have influenced my thinking,
Ron Raymond, Gordon Vette, Mark Woodhouse and Jim Rankin from
N.Z. and Mike O'Leary and Neil Johnston from British Airways and Aer
Lingus respectively.
I would also like to thank the many ab initio pilots and instructors,
particularly Leigh Signal, from Massey University School of Aviation who
have tolerated my experiments, simulations and demand to do things my
way, in the belief of training safer pilots. In a similar way I would like to
acknowledge the influence of Ken Lewis, Head of Safety and Environment
for QANTAS airways. His passion for safety in aviation is renown; I wish
all managers in this industry felt the same way.
xii
Foreword
Introduction
xiii
xiv Air Traffic Control: Human Performance Factors
Safety is no accident (also If it ain't broke, why fix it?). The proposal here
is that there is no need to be concerned about safety as long as there are no
accidents, that the system is safe as long as people are not hurt, metal is
not bent, and the organization is not exposed to criticism and
embarrassment. In other words, that accidents - or the lack thereof - are
reliable indicators of system safety. This school of thought has recently
been under fire. An alternative view proposes that, if structures and
processes afforded by state-of-the-art knowledge are in place to keep the
system under continuous surveillance for signals of hazards, accidents are
merely like "noise in the system". Beyond other falsehoods underlying this
slogan, waiting until the system breaks down before attempting to address
its flaws might tum out to be onerous beyond reason. Furthermore, when
the system breaks down, human life is at stake, which raises ethical
questions in relation to this approach. Since the financial and human costs
associated with waiting for accidents before undertaking remedial action
are inevitably high, there are compelling economic and ethical reasons to
fix the system before it breaks. However, too often is the case in aviation
Foreword xv
Seventy percent of accidents are caused by human error. This one has
been saved for the end because it epitomises how misleading the armchair
wisdom underlying conventional wisdom and slogans can be, and because
it becomes the natural bridge for the balance of my argument. Consider the
aviation system: humans conceive what the system should look like, and
once they are satisfied with what they conceived they set upon to design it.
Humans then build the system and when the system is functional, humans
make it work. In order to exhibit the behaviours necessary to achieve the
system's objectives, humans train other humans who are going to make the
system work day after day. Humans make strategic and tactical decisions
about system performance, and when dangers are anticipated, humans
devise and deploy the necessary countermeasures to protect the system
from such dangers. Simply put, humans design, manufacture, train,
operate, manage and defend the system. Therefore, when the system
breaks down, it is of necessity that human error is a foregone conclusion,
that some human flaw of one kind or another must be underlying the
occurrence. From this perspective and depending upon the level of
observation, it is arguable that virtually one hundred percent of accidents
Foreword xvii
Air traffic control (ATC) - like all of aviation - is and will remain a
technology-intensive system. People (controllers) must harmoniously
interact with technology to contribute to achieve the aviation system's
goals of safe and efficient transportation of passengers and cargo.
Maintaining and advancing safety in technology-intensive systems
demands a continuous evaluation of the strategies we adopt and the
resources we deploy to achieve the system's goals. Should this constant re-
evaluation be absent, or should our endeavours be guided by slogans, then
we might at best attack the symptoms rather than the causes of safety
deficiencies. At worst, we would be squandering limited and precious
resources in misdirected endeavours.
In specific, ATC- related terms, there are three fundamental aspects over
which we need to maintain a watchful eye to make sure that the integration
of Human Factors knowledge contributes its full potential to "safety 2000"
in air traffic control. Conceptually speaking, it aH starts by making sure
that human-technology interaction in ATC remains human-centred. The
widespread adoption of a philosophy of human-centred automation for
workstation design and supporting procedures is the only safeguard
against unco-operative human-technology interfaces which hold potential
for human error and therefore safety breakdowns. In order to design
human-centred technology, the tendency to include formally educated
Human Factors practitioners into design teams, slowly but surely being
adopted by the two major aircraft manufacturers, must be echoed by others
as well as by equipment manufacturers. This is a much needed
development if we are to design technology which is a tool rather than an
end in itself.
Practically speaking, we must tackle the challenge of integration from a
broad system's perspective. A critical observation of the deployment of
technology over the years suggests that aviation has pursued human-
technology interaction in a piecemeal fashion. We have paid considerable
attention to the design of individual technological components but not
equal or enough attention to the design and integration of the whole. We
have designed technology which, by and of itself, would more often than
not prove adequate. But we have not sufficiently scrutinized the interaction
between technology, humans, and the constraints of the operational
contexts into which technology is deployed. This largely explains the
mismatches in human-technology interaction recorded in accident
xx Air Traffic Control: Human Performance Factors
within a year of this accident, that airline had launched the first 'Human
Factors Awareness Course' for its staff.
If the focus of human factors in World War II was primarily on
correcting systems that were obviously faulty, the current phase of
thinking is moving to consider the limitation of the human operator prior
to building a system so that a more effective allocation of functions can be
made between human and system and thus reducing the limitations in both.
An early example of this approach was a study undertaken by Fitts and
Jones (1947) which described the types of errors being made by pilots
through the misinterpretation of instrument information. Today Boeing
lead the way with their developments on the 777 series aircraft, but what
of the developments in Air Traffic Control?
This definition suggests not only that human factors and ergonomics
should be regarded synonymously, but that all human sciences should be
considered in this relationship. It also implies that those working in these
environments are now represented by both genders and that the interaction
of these people is just as important as their relationship with the
The Need for Human Factors 5
Although the ATCO was very experienced, he had only worked a limited
number of solo shifts in Anyfield Tower. Having validated his Tower
rating in early summer, he had been involved in giving OJT instruction on
most of his shifts since that time. As a consequence of the staff shortage he
was required, like all other controllers, to work his share of nightshifts.
The shift in which the accident occurred was only his second in which he
had worked at Anyfield Tower under foggy/low visibility conditions; the
first had been the previous night, when there was hardly any traffic as it
was the mid weekend shift.
A number of years ago there had been an incident at Anyfield involving
runway intrusion by a vehicle, under similar meteorological conditions as
in this case. One of the recommendations at that time was the installation
of an SMR, together with stop bars at all runway intersections. The
authorities decided that in view of the limited number of days (with fog)
that would warrant the use of an SMR, the benefit of having an SMR did
The Need for Human Factors 7
not match the costs of having one installed. The same argument applied
with regard to the installation of stop bars, but in lieu of those, painted
signs had been put in the grass next to the runway intersections, informing
those who noticed them there was a "runway ahead".
As the early morning traffic began to increase, the ATCO and his G/C
were each working an independent R/T frequency. When the G/C
announced he had to visit the men's room for a second, the ATCO told
him to go ahead, intending to work both frequencies by himself. In order
to do so, the ATCO had to physically move between 2 control positions in
the tower that were about 3 metres apart. Anyfield Tower was not
equipped with a frequency coupling installation and transmissions on one
frequency could not be heard by stations on the other frequency.
The pilot of the piston engined aircraft had arrived in Anyfield late the
night before. After a short sleep he went to the airport in order to waste as
little time as possible as his company wanted the aircraft back at its
homebase as soon as possible. After the minimum of preparation, he went
to his aircraft and called Air Traffic Control for approval to taxi to the
runway. He obtained the clearance and began taxiing, but soon found
himself lost at the foggy, unfamiliar airport. The fact that there were no
signs indicating the various taxiway intersections did not help.
The R/T tapes showed that the pilot of the piston aircraft then called G/C
(by RJT) and asked for "progressive taxi instructions". G/C replied by
asking his position. The pilot said: "I believe I'm approaching Foxtrot
intersection", to which G/C answered: "At Foxtrot taxi straight ahead". In
fact the pilot had already passed Foxtrot, and should have turned onto the
parallel taxiway. The instruction from G/C, though technically correct,
caused the pilot to taxi onto the runway where the jet was in its take-off
roll. Since the communications to both aircraft took place on different
frequencies, neither pilot was aware of what was happening.
After the collision, it took the ATCO several minutes to realise something
was wrong. Of course he had not observed the departing jet passing on the
section of the runway that was visible to him, but he initially blamed that
on the fogpatches and/or being distracted by traffic on the G/C frequency.
Apart from the fog, the ATCO was also unable to see the part of the
runway where the collision had taken place because of the newly built
extension of the terminal building blocking his view. So it was not until he
wanted to transfer the departing jet to the next controller (Departure
Control) that he became aware things were not as they should be; his
transmissions to the jet remained unanswered. His G/C, who returned
8 Air Traffic Control: Human Performance Factors
shortly after the accident, also reported having no contact with the taxiing
twin prop. The ATCO then decided to alert the fire brigade, but as he had
no idea where to send them, more precious time was lost as the rescue
vehicles tried to make their way across the foggy airport. When they
finally arrived at the accident site, they found there was little they could do
as the wreckage of the aircraft had already completely burnt out.
This also relates to the stop bars. Had they been installed, the twin prop
may have been less likely to have entered the runway.
At the very least, special procedures for Low Visibility Operations at
Anyfield should have been developed and in place, limiting the number of
movements at the field. The ATCOs should have been trained in working
with these special procedures, ideally on a simulator, to help them cope
with the unusual situation once they occurred.
In their talks with the airport authorities, ATC management should have
firmly opposed the plans for extensions to the terminal building. As a
result of not having any input from the operational ATCOs (who were not
available to attend the meetings due to staff shortage), management was
not even aware it would constitute a line of vision problem from the
Tower.
The ATCO should not have found himself in a position where he was
forced to work two positions by himself. At all times ATC positions
should be sufficiently staffed to allow the traffic to be handled in a safe
manner.
The installation of a frequency coupler might have helped prevent the
collision from occurring. As it was, these systems are considered
'optional' by the aviation authorities, so only few ATC facilities had them.
Management should have ensured that OJT instructors were given the
opportunity to stay current at the positions where they were expected to
The Need for Human Factors 9
teach. This could have been done by scheduling the instructor for duties
without trainees at regular intervals. Such duties should be sufficiently
challenging to allow an instructor to practise their skills (in other words:
shifts without traffic may look good in a roster, but are of no value for
currency maintaining purposes!).
Had there been a well devised training curriculum, that was correlated
with the duty roster, management would have recognised that the ATCO,
although qualified, had not been able to acquaint himself with working at
Anyfield Tower under low visibility conditions. Ideally, they should not
have scheduled him for unsupervised duty when low visibility was
forecast. Dedicated low-visibility operations training would have made the
ATCO aware of the dangers involved, alerting him to be more positive in
guiding the lost taxiing pilot. At the very least he probably would not have
given the pilot irrelevant information.
It is a scientific fact that when consecutive nightshifts are worked, the
performance of persons engaged in cognitive tasks (such as ATC)
decreases dramatically in the second and later nights, especially between
03:00 hours and 07:00 hours. The ATCO at Anyfield was on his third
nightshift in a row. This could explain why he failed to recognize a
potentially dangerous situation that he may not have missed under other
circumstances. When designing shift rosters for ATCOs, it is advisable to
keep the number of consecutive nightshifts to an absolute minimum.
Based on the Met. forecast, and taking into account that the propellor
aircraft's pilot was unfamiliar with Anyfield, it may be argued that the
operator would have been better to send two pilots to collect the aircraft.
Even with limited knowledge of crew resourse management, a second pilot
could have prevented the lone pilot from acting the way he did.
Epilogue
Contents
337
338 Air Traffic Control: Human Performance Factors
Cobb, B.B., Mathews, J.J., and Nelson, P.L. (1972) 'Attrition- retention
rates ofair traffic controller trainees recruited during 1960 - 1963
and 1968 -1970'. Washington DC: federal Aviation
Administration Report No. FAA- AM- 72-33.
Colquhoun, W. P., Blake, M. J. F., and Edwards, R. S. (1968a)
'Experimental studies of shift-work I: A comparison of of
"rotating" and "stabilised" 4-hour shift systems'. Ergonomics,
11, 437-453.
Colquhoun, W. P., Blake, M. J. F., and Edwards, R. S. (1968b)
'Experimental studies of shift-work II: "Stabilised" 8-hour shift
systems'. Ergonomics, 11, 527-546.
Colquhoun, W. P., Blake, M. J. F., and Edwards, R. S. (1969)
'Experimental studies of shift-work III: "Stabilised" 12-hour
shift systems'. Ergonomics, 12, 865-882.
Committee on the Regulation of Air Traffic Controllers' Hours (1990)
'Report ofa Committee on Regulation ofAir Traffic Controllers'
Hours (CRATCOH) to the UK Civil Aviation Authority'.
Cheltenham: Civil Aviation Authority.
Cooper, C. L. and Payne, R. (1989)(eds) Personality and Stress:
Individual Differences in the Stress Process. Wiley: Chichester.
Costa, G., Lievore, F., Ferrari, P., and Gaffuri, E. (1987) 'Usual meal
times in relation to age, sex, work activity and morning-
eveningness'. Chronobiologia, 14,383-391.
Crump, J. H., Cooper, C.L. and Maxwell, V.B. (1981) 'Stress among air
traffic controllers: occupational sources of coronary heart disease
risk'. Journal of Occupational Behaviour. 2: 293-303.
Cruz, C. and Della-Rocco, P. (1995). 'Investigation of sleep patterns
among air traffic specialists as a jUnction of time off between
shifts in rapidly rotating work schedules' in R. S. Jensen and L. A.
Rakovan (eds.), Proceedings of the Eighth International
Symposium on Aviation Psychology Vol. 2, pp. 974-979. Ohio:
Ohio State University.
Cushing, S. (1995) 'Pilot-Air Traffic Control Communications. It's not
(only) what you say, it's how you say it'. Flight Safety
Foundation, Flight Safety Digest.
340 Air Traffic Control: Human Performance Factors
Sells, S.B., Dailey, J.T. and Pickrel, E.W.(1984) (eds) 'Selection ofAir
Traffic Controllers', Washington, DC: Federal Aviation
Administration Report No. FAA - AM - 84-2
Senders, J. W. and Morey, N.P. (1991) Human Error. London: Lawrence
Erlbaum.
Shanteau, J. (1987) 'Psychological Characteristics of Expert Decision
Makers' in J.L. Mumpower (ed) Expert Judgement and Expert
Systems. pp 289-304. Springer-Verlag
Shaw, L.S. and Sichel, H.S. (1971) Accident Proneness. Pergamon:
Oxford
Sheen, S. (1987) 'Herald ofFree Enterprise'. Report of Court No. 8074.
Department of Transport. London: HMSO.
Sheen, Mr. Justice (1987) 'MV Herald of Free Enterprise'. Report of
Court No. 8074. Formal Investigation. London: Department of
Transport.
Shouksmith, G. and Burrough, S. (1988) 'Job stress factors for New
Zealand and Canadian air traffic controllers'. Applied Psychology:
An International Review. 37: 263-270.
Shouksmith, G. and Taylor, J.E. (1997) 'The Interaction of Culture with
General Job Stressors in Air Traffic Controllers', International
Journal ofAviation Psychology. 7 (4): 343-352.
Signal, T.L.(1997) 'Stress and Coping in ATC Shift Work'. Unpublished
M.A. Dissertation. Massey University, New Zealand.
Singleton, W.T. and Hovden, J. (1987) (eds) Risk and Decisions.
Wiley: Chichester.
Sligo, F. ( 1988) 'Effective Communication in Business'. Palmerston
North:Software Technology.
Sloan, S.J. and Cooper, C.L. (1985) 'The impact oflife events on pilots: an
extension of Alkov's approach' Aviation, Space and
Environmental Medicine, 56: 1000-1003.
Smith, P., Billings, C., Woods, D., McCoy, E., Sarter, N., Denning, R. and
Dekker, S. (1997) 'Can Automation Enable a Cooperative Future
ATM System?' in R.S. Jensen and L.A. Rakovan. (eds)
Proceedings of the Ninth International Symposium on Aviation
Psychology. The Ohio State University.
Smith, R.C., Melton, C.E.and McKenzie, J.M. (1971) 'Affect Adjective
Checklist Assessment of Mood Variations in Air Traffic
Controllers' Technical Report No. FAA-AM-71-21. Washington,
DC: Federal Aviation Administration, Office of Aviation
Medicine.
Bibliography 353