Airborne Conflict

Recent increases in reported losses of required minimum in-flight separation of aircraft, known as airproxes in a number of European countries, and of altitude deviations from air traffic control (ATC) clearances by flight crews, called level busts, generated enough concern that in June, the stakeholders convened a two-day Airborne Conflict Safety Forum in Brussels, Belgium. The numbers for both airproxes and level busts are small relative to traffic volume, but they are viewed as critical safety indicators because of the severity of potential consequences, presenters said.

“In European airspace with prescribed separation minima, there are approximately 150 losses of separation per million flights,” says the final report by forum organizers. “Since each flight receives on average 15 executive instructions in the en route environment, this is equivalent to one loss of separation per 100,000 instructions. … IATA [International Air Transport Association] safety data show 0.25 pilot level bust reports per 1,000 flights with 41 percent of these occurring during descent. Other data suggest that approximately 15 percent of level busts may subsequently result in a loss of separation in busy airspace.”

The 272 participants heard 23 presentations offering insights at European and global levels, according to Tzvetomir Blajev, coordinator, operational safety improvement initiatives, Eurocontrol; organizer of the safety forum; and chairman of Flight Safety Foundation’s European Advisory Committee. The European Regions Airline Association and the Foundation joined Eurocontrol in arranging the event. Forum videos, the agenda, digital slides and the final report are available at no cost at Eurocontrol’s SKYbrary website at <www.skybrary.aero/index.php/Portal:Airborne_Conflict>.^1,2

The report also summarized an informal consensus about key safety-improvement strategies. Participants called for better operational data integrity and use of the most relevant data sources to address these events; measures to increase the probability that every pilot’s response to a corrective resolution advisory (RA) from an airborne collision advisory system (ACAS, known in some countries as a traffic-alert and collision avoidance system or TCAS) will conform to the procedures of the system’s design; overcoming variations in requirements for ACAS equipage and airspace access; and increasing pilot notifications to air traffic controllers during and after responding to an ACAS RA.

They also aimed to resolve aircraft airworthiness and operational problems that can degrade ACAS effectiveness; expand efforts to identify and mitigate the human errors that may lead to loss of aircraft separation; reemphasize all pilots’ adherence to basic “see and avoid” practices in all airspace classes; improve pilots’ awareness of the separation-risk implications/factors of flight operations within every airspace class; improve the functionality of short-term conflict alert (STCA) technology in ATC traffic displays; and reduce risks of misinterpreting ATC instructions by standardizing the responses to controllers from multi-crew flight decks regarding lateral or vertical clearances.

Forum participants urged government and industry to consider reducing the risk of level busts by changing/harmonizing states’ designated transition levels (one or more altitudes above which all aircraft barometric altimeters must be adjusted to standard sea level pressure for ATC separation, a procedure prone to errors by pilots not used to the locally applicable aviation regulation); integrate human factors, procedures and technology for a total systems approach to airspace design; apply proactive methods to reduce the risk of pilots or controllers becoming confused by similar aircraft call signs, and improve adherence to professional discipline and mitigating techniques when similar call signs are heard; provide European input to the international developers of ACAS X, the next generation of automated collision-avoidance warning logic; and publicize emerging airborne conflict issues and recommended solutions.

Insights From Data

In an average year, 160 airlines share air traffic management (ATM)–related flight operations data with Eurocontrol’s safety researchers, said Dragica Stankovic, EVAIR (European Voluntary ATM Incident Reporting) function manager at the agency. The region’s air navigation service providers (ANSPs) and states’ safety analysts supplement this with their data and analysis of issues such as call sign confusion and ACAS RAs.

EVAIR recently focused on 2008–2013 level busts and ACAS RAs. “In the data repository, we found 12,000 reports … 0.4 percent of the EVAIR occurrences were identified as level busts and … 12.6 percent … as ACAS resolution advisories,” Stankovic said, noting that 11 percent of level busts were followed by an ACAS RA. “It means that a further erosion of the separation minimum was, in fact, prevented by the ACAS resolution advisory,” she said. The data showed 57 airlines involved in level busts and 87 involved in ACAS RAs.

For 2012, the year in which the largest number of level busts was reported during the five-year period, the rate was 0.35 reports per 10,000 operations. “So if we have, let’s say, in the summer season, 30,000 operations daily, it means that in Europe … we had at least one level bust daily, if not more,” Stankovic said. “In 2013, we recorded quite a good decrease of the number of level busts. After drilling down to the base data, we saw that a good contributor to that was the reduction of the call sign similarities … partly a result of the call sign similarity deconfliction tool developed by Eurocontrol [and implemented by] about 20 airlines to date.”

In 49 percent of cases, ATC initiated avoidance action by other aircraft pilots when the level bust occurred. In 53 percent, the aircraft involved were converging from opposite directions; in 42 percent, their tracks crossed.

Most level busts took place at relatively low altitudes, from 2,200 ft to Flight Level 180 (approximately 18,000 ft), and the majority of level busts that generated ACAS RAs occurred in the upper airspace, Stankovic said, suggesting a possibility of improving local airspace design.

“We have 11 percent of the level busts where the traffic was, in fact, maintaining the [ATC-assigned] flight level,” she said. “In situations with unstable atmosphere or severe turbulence, we saw [losses] of altitude of more than 400 ft and also the impact of the super-heavy traffic.”

Eurocontrol strongly encourages flight crews to follow international standards and recommended practices by refraining from high vertical rates when climbing or descending to an assigned flight level, she said.

In 31 percent of level bust reports, there was a direct ATM involvement, and analysis of causal factors showed nearly one-third of those involving problems in air-ground communication, she said.

“Air-ground communication with the hearback [controller’s message verification] omitted — [resulting in] misunderstanding and causing confusion — is dominating as a contributing factor” in level busts, she said. Other issues are inadequate traffic information provided by ATC before the pilot selects vertical climb/descent rates, mistakes by planning controllers, and lack of timely information from ATC to pilots about meteorological conditions that increase susceptibility to a level bust.

Global Parallels

Gordon Margison, IATA’s assistant manager, Global Safety Information Center analysis, used the association’s Safety Trend Evaluation, Analysis and Data Exchange System to compare about 400 level busts. “Indeed we do see an increasing trend,” he said. “We have more altitude deviations being reported. … We have had a large increase in the contribution from U.S. [air] carriers.” This added information most likely indicates an actual number of level busts not just greater participation in the voluntary reporting of these events under airlines’ aviation safety action programs, he said.

“The descent [from cruise] and approach were major phases,” Margison said. “[Among] our top event types was ‘flight management.’ … Usually this was a crew error, … a human factors issue in the cockpit. Also related were … ATM factors as well as weather; TCAS response [as] a contributing factor to some of our altitude deviations … deficiencies in the [flight] documentation and data … provided to the flight crews and [in] their charts.”

IATA’s analysis found ATC factors such as confusing clearances and changes to clearances early in a flight. In other cases, turbulence was the major factor.

Giancarlo Buono, a captain and IATA’s regional director, Safety and Flight Operations, Europe, said air crew flight management, air traffic management and weather, especially turbulence and tailwinds, are now the three main areas of concern. “The majority of the events were successfully managed and did not have any further consequences on the flight,” he said. “In terms of immediate effects, we saw that the majority were flight path deviations in the lateral area, but also some avoidance maneuvers.”

About 68 percent of level busts happen during short-haul operations, compared with 28 percent during long-haul operations, he said. Pilots who spend most of their flight time in congested air traffic are more prone to altitude deviations. “Most happened during a STAR [standard instrument arrival procedure]. … Only 35 percent showed that the altitude deviations happened below 10,000 ft. … Maybe when the pilots are below 10,000 ft, we have quite robust procedures for maintaining situational awareness such as sterile flight deck. … Above 10,000 ft, pilots tend to get distracted a little bit more easily — especially on a shorter flight while a lot of things happen in a very short period of time,” he said.

In 89 percent of events studied by IATA, the autopilot was engaged at the time of the level bust. Anomalies in some automated systems also made a difference, Buono said. “I don’t want to get into an issue with manufacturers here, but we still have a lot of airplanes flying where, when you select an altitude on your autoflight panel … and you start playing with the vertical speed selector … the altitude function disarms and then the airplane will not automatically capture the altitude.”

In 70 percent of level busts studied, the pilot flying or the pilot monitoring recognized the altitude deviation and took corrective action. “However, in 29 percent, [the level bust only] was recognized by ATC and only in 1 percent [it was detected] by an aircraft automated system’s response,” Buono said. “These data are quite comforting. … ATC cleared [them] to continue, which means that probably there was no immediate safety issue related to conflict. … Only 0.5 percent of the reports indicated that a reduced separation happened as a result of the altitude deviation.”

U.K. Initiatives

Current initiatives to address level busts respond to a “Significant 7” list of safety risks derived from analysis of worldwide fatal accidents and high-risk occurrences that involved large U.K. air transport airplanes, said Jacky Mills, flight operations policy specialist at the U.K. Civil Aviation Authority (CAA). “Unfortunately, airborne conflict is the only Significant 7 risk for which high-severity incidents have not reduced,” she said. “There had been a gradual decline in events [from 2009 until late 2013] … when they started to increase, and the trend [has been] going upward for six to seven months since then. This time last year, we were getting an average of 24 level bust events in a month, but by February 2014, this increased to 36 incidents a month. It’s leveled off [as of June] but obviously that’s an area of real concern.”

Based on CAA questionnaires completed by each flight crew following a U.K. level bust, the most frequent scenario is a correct pilot readback (message verification) followed by an incorrect pilot action. Further work is needed to assess causal factors, but pilots’ expectations that ATC would assign a particular level to their aircraft, high workload, distraction and conducting weather-avoidance maneuvers were notable.

“Altimeter-setting errors is the next largest [scenario involved in a level bust] followed by failure to follow the cleared SID [standard instrument departure procedure] and then turbulence,” Mills said, pointing out the coincidence between days with significantly increased level busts and low atmospheric pressure causing a large difference relative to the standard sea level pressure setting of 1013 mb (29.92 in hg). “With the transition altitudes in the U.K. being lower than in a lot of countries, this can catch pilots out [unaware] if they are not very quick to change their altimeter setting.” Unique procedures — such as stepped climbs in SIDs — and unusually low transition altitudes of 3,000, 5,000 or 6,000 ft in U.K. airspace are being harmonized with other European states, but meanwhile they remain a risk factor.

“The U.K. airspace structure is also particularly intricate with heavy traffic loads sharing limited airspace [see “Breaking Down a Level Bust”],” she said. The CAA has been using Google Earth three-dimensional mapping to identify level bust hotspots based on plotting four years’ worth of cleared altitudes vs. actual altitudes for events extracted from 740 mandatory occurrence reports.

CAA safety outreach includes a reminder card for pilots and controllers. “An accurate location of the level bust event [in reports] with the precise name of the SID and/or the runway of departure would really help us,” Mills said. “Pilots could help us by pressing [their transponder’s] IDENT button to register the location of a particular event. I would also like to encourage reports on … altitude deviations which did not result in a level bust.”

Related Priorities

Flying with a malfunctioning transponder — or with the transponder turned off or with its standby mode selected in flight — and controller blind spots each led to a significant number of conflicts between adjacent airplanes, according to Eurocontrol’s Safety Improvement Subgroup. These are two of the subgroup’s current “Top 5” operational safety priorities, said Antonio Licu, head of the Safety Unit in Eurocontrol’s Network Operations Management Division of the Network Management Directorate, joined by Mike Edwards, director, Homefield ATM Safety.

“The controllers get it right 99.9999 percent of the time,” Edwards said, noting early insights from the beginning of a multi-year research project. “Minor slips of judgment [or] memory [occur in] probably about one out of every 500 [ATC instructions], but they are the kinds of things that nobody else would even notice. … Errors where there was a major requirement to provide separation are perhaps one in every 25,000. … So it is a small problem but, of course, potentially very significant.”

By the term controller blind spot Eurocontrol means a situation in which a controller issues a climb or descend instruction, for whatever reason, but fails to observe another aircraft positioned in front of the pilot who received the instruction. Researchers so far have attributed 65 percent of actual events studied to a controller almost exclusively focusing attention on the potential for future conflicts. A group of experts first imagined scenarios conducive to such controller behavior.

“The first one is attention grabber — literally just the controller focusing his attention on something else … without really following the standard pattern of all the things that he should do,” Edwards said. “The second is [heavily proceduralized] constraints. This is the requirement for an aircraft to leave a sector at a particular level so … [that the controller has] got to get the aircraft to that level. That becomes the primary focus, and he doesn’t see the aircraft that’s in the way. The third, quite common, is failure to conflict-detect when one of the aircraft is not following its flight planned route. … The fourth is solving a potential conflict, thinking ahead, but not seeing the one that’s right in front. And lastly, [there is a] general sort of … operational/nonoperational distraction — talking about staffing or whatever.”

The expert group then looked at actual ATC-error scenarios. Effective risk barriers (safety defenses) observed were standard scanning routines, flight data display systems, proactive colleagues, team resource management, short-term probes querying flight data, separation-alert tools, defensive controlling, efforts at “keeping it simple” and data-block clarity.

“Living in the future — not seeing the [aircraft] right in front of them … not being with the airplanes where they actually are but rather where they’re going to be” is related to another controller error called layered filtering, in which the controller assumes that the job is done after issuing instructions to the crew of an aircraft in his or her sector, Edwards said. “He’s not consciously thinking about that aircraft anymore. … He puts it to the back of his mind and doesn’t see it when he needs to,” he said.

On the technology side, 60 percent of the events involved ATC flight data displays that either were not updating correctly or were not capable of being updated by the controller. Most involved an aircraft flight crew cleared for direct routing. “There may be a need for ­ANSPs to focus on providing flight data that better supports controllers in potential conflict resolutions,” Edwards said.

The technique noted of imagining scenarios and comparing them with actual scenarios was applied to mishandled ATC coordination of aircraft moving between adjacent sectors, including those of other ANSPs. Issues included absent, incomplete or misunderstood coordination; incorrect data entries; premature transfer of an aircraft to the next sector, which precluded further ATC radio communication in case of a conflict (in one-third of events); late transfer of an aircraft after it entered the next sector, which precluded radio communication by the new sector’s controller in case of a conflict (in one-third of events); and problems in silent coordination because of flaws in an agreement specifying the procedure.

“Two thirds of such events involved … a failure to correctly apply a standard procedure [and/or a failure] to coordinate,” he said. “Separation-predictive tools, airspace incursion tools [and proactive colleagues] could prevent all those if they were deployed and if they were used.”

Most disconcerting, he said, was that in 36 percent of airborne conflicts, the executive controller was not talking to the pilot of either closing airplane. “It’s almost like the controller’s worst nightmare,” Edwards said. “The events themselves are so few, I’m pleased to say, [that we’re] getting into that difficult area of trying to break down that last little bit of information — and that’s a whole new ballgame for us.”

ATC Technological Solutions

Europe’s ANSPs have been active in sharing their best strategies — including for use of technology — for level-bust risk reduction, said Kris Vermeiren, Eurocontrol operational concepts and validation expert who spoke about the Maastricht Upper Area Control Centre, which is responsible for upper level airspace over Luxembourg, Belgium, Netherlands and northwest Germany.

STCA capability has proved valuable since 1980, he said, but he called the value added by processing transponders’ enhanced Mode S data “the best invention since radar.”

“For only two years, STCA also has been listening to the pilot-intent [data,] taking into consideration the selected altitude as provided by enhanced Mode S data,” Vermeiren said. “This can save valuable seconds to intervene.” The extra data — selected flight level, magnetic heading, the indicated speed in knots and Mach number — appear in an extendable label. New color-coded warnings also help controllers to quickly spot discrepancies between pilot actions and their ATC clearances. “Before … it was not guaranteed that you would see all the discrepancies,” he added.

The Maastricht center also has eliminated flight control strips, recognizing that controllers have a fast-detection advantage when they can keep their “eyes glued” to the enhanced labels on their displays. A 10-second “grace period” delay between receiving Mode S data and presenting an active alert to the controller allows the pilot time to select the assigned altitude/flight level. Many pilots remain unaware that some controllers now can see these in-flight data in real time, however, he said.

Technical Malfunctions

One review of European level bust reports since 2006, as noted, identified 57 reports involving unintended altitude deviation by the pilot, said Stephen Eggenschwiler, a captain and flight safety officer for Swiss International Air Lines, representing the FSF European Advisory Committee. Weather and technical malfunctions were factors in a number of them. “An aircraft that was flying fairly high over the Atlantic … encountered a downdraft at the same time an aircraft below encountered an updraft, and that resulted in an immediate TCAS resolution advisory,” he said. “[In another case, the aircraft] were in level flight when the autopilot disconnected due to an out-of-trim situation; [the crew] pitched up and increased power.” Altitude-selector faults in the flight control unit on the glare shield also have been confirmed in some cases, he said.

Among the ATC contributions, controllers have at times increased the risk of level busts by setting up aircraft in a manner that requires a high descent rate, such as 4,000 fpm, to capture the newly assigned altitude in a very brief period of time, Eggenschwiler said.

Adequate ACAS Training

In commercial air transport, reducing risks of airborne conflict revolves around three elements: visual acquisition, air traffic control and ACAS, said Stanislaw Drozdowski, ACAS expert at Eurocontrol. “These … will become a little more complicated in the coming years with the sense-and-avoid system introduced on UAS [unmanned aircraft systems]. … This is the right time to talk about what the systems are going to bring and to actually try to influence their design.”

It’s important to remember that operation by the see-and-avoid principle has not been a perfect solution in manned aviation, he said. “Avoidance maneuvers based on visual acquisition are not coordinated [and] can make the situation worse,” Drozdowski said. “There is no global standard [for STCA], unlike for TCAS. … TCAS will detect only aircraft which are cooperative, that is, which report altitude. Also, if the … radio altimeter or altimeter or transponder [fail], then TCAS will fail as well.”

ACAS basically works well when the objective is providing the aviation system’s last safety net for aircraft encounters when both are operating under instrument flight rules (IFR), said Wolfgang Starke, chairman of the Air Traffic Management and Airports Committee, European Cockpit Association. “The question is ‘[Do] the pilots have sufficient and proper training to work with TCAS?’ because, if pilots have proper indications of TCAS, [the training] makes them able to comply correctly with the traffic advisories and RAs,” he said.

A critical element of ACAS training is enabling pilots to respond to an RA with an appropriately precise climb rate. Yet avionics systems vary in the ease of interpreting the pitch reference for this response.

On aircraft types found to have relatively precise indications of the vertical speed, the appropriate rate was about 1,500 to 1,700 fpm in research on optimum vertical speed for quickly becoming clear of conflicting traffic, Starke said. In contrast, some systems may indicate up to 3,500 fpm for a “climb” or “increase climb” RA, for example. Unnecessarily abrupt and high vertical speeds carry the risk of injuring cabin occupants, he said.

The European Cockpit Association also is seeking better assistance to pilots from automation to address imprecise “fly to” indications (although the pilot needs to be able to correctly hand-fly ACAS maneuvers at any time); no prohibition on use of the autopilot to fly the TCAS RA maneuver; and more realistic and precise simulator training of pilots on compliance with RAs.

Notes

1. Forum materials include a 16-page report listing 15 safety improvement strategies; findings and recommendations; and basic background, objectives and outcomes of discussions.
2. Sponsoring forum partners were the International Civil Aviation Organization, the International Federation of Air Traffic Controllers’ Associations, U.K. CAA, U.K. NATS, IATA, European Cockpit Association and Direction Générale de l’Aviation Civile of France.