R20000285
As a result of the investigation the Australian Transport Safety
Bureau recommends that Airservices Australia develop risk
management protocols that improve its ability to recognise and
track controllers' fitness for operational duty.
- The crews were not using the same air traffic control frequency
at the same time. - An assessment of the controller's fitness for duty did not
include due consideration of the cumulative effects of stress. - The controller was probably unaware of the harmful effect of
stress on individual performance. - The management of staff by a number of different managers did
not aid Airservices Australia to readily identify the controller's
fitness for duty. - The operation of traffic alert and collision avoidance systems
and aircraft secondary surveillance radar transponders by the crews
were valuable defences for the aviation system.
There were opportunities for both crews to be alerted that they
were assigned the same level. However, these were missed
because:
- the B767 crew had been instructed to monitor the
Woomera sector frequency and did not hear the controller approve
the A320 crew to climb to FL280,
- the controller's transmission about the A320 interrupted the B767
crew's on-frequency report that would have included their
level,
- the controller did not include the assigned level for the
opposite direction aircraft in the sighting and passing report
transmission to both crews, and
- the presentation of system data reinforced the controller's view
that vertical separation had been applied between the
aircraft.
High levels of stress can increase the likelihood of individuals
failing to complete actions or recognise a situation. For example,
stress promotes slips and lapses by narrowing the focus of
attention. Slips most often occur when an individual is performing
an automated task in familiar surroundings, but is distracted by
external events or internal thoughts. A preoccupation with personal
problems can divert attentional resources, particularly at times of
low workload. Such conditions are ideal for inducing a slip.
The controller's inability to appreciate the use of the wrong
level and its relationship with his traffic management plan, and
the indicators available to him from the air traffic system was
consistent with him being preoccupied. An increased state of stress
was probably the prime reason for the lack of concentration or
preoccupation by the controller. This then led him to instructing
the A320 crew to climb to the wrong level and causing the
separation standard to be infringed. This was consistent with the
controller's stressful state while under a low workload.
Research literature on occupational stress strongly supports
giving priority to person-job fit issues as a strategy to prevent
work stress. Also, a change to the work environment has the
potential to cause health problems if not managed well. Airservices
Australia had not been able to address the controller's concerns
about occupational opportunities. Nor were they able to either
understand or reduce the controller's increasing reaction to these
stressors. The result was an organisational climate that
contributed to the controller's stress levels. Concurrently, the
controller had significant difficulty adjusting to the changes in
vocational circumstances. These organisational and personal factors
combined to produce increased stress in the controller.
The impact of stress on the controller's performance was one
that needed consideration and action as advised in the CATSOAM.
Airservices knew the controller had personal and vocational
problems but seemed unable to reduce the individual's occupational
discontent. It is probable the change in management staff during
the TAAATS transition limited the organisation's ability to
recognise the extent of the controller's stress and consequent
potential effect on safety. This lack of organisational
understanding and the use of various managers, in addressing the
issues, may have limited the centre manager's ability to decide on
the controller's fitness for duty. Without a full understanding of
the controller's situation and current susceptibility to stress
related conditions the manager had to assess whether the controller
was able to work. The ability to readily access a controller's
complete history or the use of a protocol, that ensured vocational
and personal details were considered with any commensurate safety
risk, would have enabled the manager to make a more informed
decision. As it was, the centre manager tried to mitigate the
situation by briefing the flight information region manager and the
team leader. However, the flight information region manager and the
team leader lacked a full understanding of the situation and were
less able than the centre manager to assess the controller's
fitness for duty.
Had either a more encompassing risk protocol or a better system
of monitoring a controller's career been in place it is likely the
cumulative stress from the controller's job discontent, the two
recent unfavourable briefings and his family problem would have
been recognised. If there had been a better understanding of either
the controller's situation or the potential risk to safety, the
centre manager would have probably removed the controller from duty
until a formal evaluation of fitness for duty was done.
Accurate work and rest times were not available to assess the
level of fatigue for the controller but it is likely the controller
was tired before the occurrence. The controller's overall
heightened stress, preoccupation and fatigue made him unlikely to
be capable of making a coherent and rational decision about his
fitness for operational tasks.
Radio facilities to enable crews under the jurisdiction of the
Alice Springs sector to maintain continuous radio communications
with that controller would reduce the possibility for similar
events.
A Boeing 767 (B767) was en route from Sydney to Jakarta,
Indonesia, on the two-way air route A576 and was estimating
overhead Alice Springs at 1255 Central Standard Time at flight
level (FL) 280. The crew of an Airbus Industrie A320 (A320) taxiing
at Alice Springs had also flight planned via A576, in the opposite
direction to the B767, for Sydney. The A320 crew had planned the
flight at FL370 but the Alice Springs sector controller, operating
from the Melbourne air traffic control centre, intended to issue a
clearance of FL270 to the crew. This would have provided the
required 1,000 ft vertical separation standard between the A320 and
the B767. The A320 departed at 1218 on climb initially to FL200 and
the crew contacted the controller at 1225. The controller entered
FL270 in the air traffic system but told the crew to climb to
FL280. The crew correctly read back FL280.
The estimated time of passing of the two aircraft was 1237. The
controller told both crews the opposite direction aircraft was
1,000 ft above or below them respectively and to report sighting
the other aircraft. At 1236 the A320 crew reported to the
controller that they were descending because of a traffic alert and
collision avoidance system resolution advisory. The controller
acknowledged the report and then queried the B767 crew about the
traffic alert and collision avoidance system event. The B767 crew
confirmed that their aircraft's systems had received a traffic
alert and collision avoidance system resolution advisory to
climb.
Later analysis of aircraft data showed that both aircraft had
been maintaining FL280 on reciprocal tracks. The combined closing
groundspeed of the aircraft was 920 kts and they were about 9 NM
apart when the traffic alert and collision avoidance system
activated. As the crews complied with the resolution advisory the
A320 crew saw the B767 pass above them when the vertical spacing
and lateral distance between the aircraft was 900 ft and 0.5 NM
respectively. There was an infringement of separation
standards.
Controller background
The controller had over 10 years experience in en route and five
years in tower control. Following a staff rationalisation exercise
the controller reluctantly moved from Moorabbin to the Melbourne
centre in mid-1998. Since that time he had experienced increasing
levels of stress because of:
- dissatisfaction with career opportunities,
- problems with undertaking night duty,
- personal problems with supervisory staff,
- unsuccesful applications for positions in the tower, and
- a recent diagnosis of the critical illness of a family
member.
For example, on the day before the occurrence the controller was
told that he had again been unsuccessful in a recent selection
exercise for positions in the tower or terminal area streams. This
was a source of stress to the controller.
Day of the occurrence
The controller reported that he did not have breakfast because
of the early start and woke at 0400 after about 5 hours sleep. He
began work at 0530. He later said he felt "somewhat tired" on the
day of the incident and that he did not feel his limited period of
sleep influenced his performance. Individuals suffering mild to
moderate fatigue are generally unaware of decreasing levels of
performance.
This was to be the controller's last working shift before
starting leave. The controller had been approved to take 2 weeks
leave to be able to be with his family because of the illness of
the family member.
About 3 hours before the occurrence the controller was relieved
at the position to enable him to meet with the centre manager. The
centre manager advised that a claim of harassment by the controller
had been investigated and was dismissed. This information
distressed the controller. The centre manager told him to take time
to compose himself before going back to the console or operations
room. During this exchange the controller advised the centre
manager of the strain he was under because of the recent diagnosis
of a family member with a terminal illness. Before this meeting the
centre manager was unaware of the illness in the controller's
family. The centre manager told him that he didn't have to return
to the console - it was his choice.
Airservices' Australia (Airservices) Civil ATS Operations
Administration Manual (CATSOAM) provides guidance material on
stress awareness for Airservices' staff. It states in part that
"routine tasks with monotonous or minimum workload can cause some
people to run over previous events or issues and, if they have been
unpleasant or difficult, then concentration on the task being
performed may deteriorate". It also warns that "stress is
cumulative and can affect performance at work" and includes a
caution that "professional guidance should be sought in case of
doubts concerning mental state and fitness for work". With illness,
injury or medication the manual places the onus on individuals to
ensure that they are able to undertake rostered duties. It states,
"a person having any doubt about their fitness to perform at the
correct level for a full tour of duty must tell the appropriate
supervisor. They should be stood down from operational duties until
they feel fit to resume duty, or until the matter has been resolved
by a medical practitioner".
The controller later reported that he had felt similarly
distraught on other occasions and had performed satisfactorily and
believed he would be able to do so again. Also, he felt that he had
little choice but to return to the operator position. The
controller spent 30 to 40 minutes recovering from the meeting and
returned to the position after an absence of about 90 minutes.
The centre manager advised the flight information region manager
in the operations room and the controller's team leader of the
outcome of the meeting. The centre manager briefed the flight
information region manager to stand the controller down from
operational tasks should there be any doubt about that individual's
ability to control. The flight information region manager saw the
controller on two occasions during the 40 - 50 minute period
following the return to the operating position. The flight
information region manager's impression was the controller was
managing the position and did not need relief.
Organisational issues
During the last decade, there has been an increased rate of
organisational change within Airservices. This has led to increased
changes in work practices and a tendency toward expanding many job
roles through multiskilling.
Research shows that perceived major causes of stress in
Australian workplaces include the rate of change and poor
organisational communication. Similar factors were also reported
during the investigation.
Despite the strong influence of organisational climate factors
on employee stress levels, operational demands also contribute to
psychological stress. Also, stress is more likely to be reported
where morale is lower than normal.
During 1998 and 1999 the Melbourne Centre was undergoing
significant change in preparation for and during the transition to
The Australian Advanced Air Traffic Control System (TAAATS).
Because of this change, during late 1999 and early 2000 the
controller had five different managers. The management of the
controller within the centre was such that operational, health and
career management and other issues were handled by a number of
different managers. This arrangement relied on a high level of
coordination and communication between managers for each to
maintain an understanding of the progress of staff specific issues.
The investigation did not establish the degree to which the
controller's issues had been passed on to the relevant individuals
during the changeover in management staff.
Air traffic system
Alice Springs sector is a non-radar sector that uses procedural
control methods to separate aircraft. Controllers use a combination
of a presentation of aircraft positions on an air situation display
and lists of electronic flight progress strips to manage and
separate aircraft. The air traffic system updates aircraft
positions based on limits, including aircraft performance data,
meteorological data and the flight data record created for each
flight from a flight plan. Controllers update aircraft flight data
records after receiving position reports from flight crew.
The label for each aircraft depicted on the air situation
display includes a field for operational data. After the controller
had been told the A320 had left Alice Springs he annotated the
operational data field to show the crew had planned at FL370 and
that an amended level of FL270 was needed. When the A320 crew
reported on frequency, the controller selected FL270 in the cleared
flight level field of the label but told the crew to climb to
FL280. When the crew read back FL280 the controller did not detect
the error and accepted FL270 in the aircraft's flight data record.
Shortly after, the controller deleted the amended FL270 note from
the operational data field. Later analysis of the recorded data
confirmed the controller had correctly entered FL270 into the
system but had issued a wrong level, FL280, to the A320 crew.
The controller had a similar event with a Boeing 737 that left
Alice Springs five minutes after the A320 on the same route. The
crew of this aircraft also needed to be assigned FL270 to ensure
separation from the B767. The controller initially assigned FL280
but corrected it to FL270 during the same radio transmission to the
B737 crew. The B737 crew sought clarification of the assigned level
from the controller and the controller confirmed the required level
was FL270
Pilot - controller communication
Because of very high frequency (VHF) radio coverage limits, air
traffic controllers needed to tell crews to change frequency at a
position about 250 NM south-east of Alice Springs when operating
below FL310. As the B767 was at FL280 the controller told the crew
to transfer to 132.9 Mhz, which was a frequency, used by the
adjacent Woomera sector. This was to ensure that the crew
maintained VHF communications with Melbourne centre. Responsibility
for the separation of the flight remained with the Alice Springs
sector controller while the crew was monitoring the Woomera sector
frequency. The Alice Springs sector controller could not monitor
132.9 Mhz. During the period the crew were monitoring the Woomera
sector they did not hear the Alice Springs sector controller tell
the A320 crew to climb to FL280. Shortly after, the B767 crew
returned to the Alice Springs sector frequency.
The Manual of Air Traffic Services (MATS) states that a reply to
a voice call shall consist of the identification of the calling
unit, the identification of the called unit and the words "Go
ahead" or "Standby" as appropriate. However, while "communications
should normally start with a call and reply, when reasonably sure
that the call will be received, the calling unit may go ahead
without waiting for a reply". In a situation similar to this
occurrence, the resulting report from a crew would include the
altitude or level being maintained. However, following the B767
crew's on-frequency report the controller immediately told them to
report sighting and passing the A320. The controller did not ask
nor did the crew report the flight level being maintained.