SESAM Försvarssektors användargrupp för Sofware Engineering

Transkript

1 1 Följande utdrag är hämtat från nätet. Dokumentet är enbart avsett att användas för prov av analystekniken STAMP. Innehållet är varken fullständigt eller felfritt och kan (i o m att olika källor använts) innehålla motsägande fakta. Utöver dessa utdrag finns en del kommentarer tillagda. Synopsis ([1]) On July 2002 at 21:35:32 hrs a collision between a Tupolev TU154M, which was on flight from Moscow/Russia to Barcelona/Spain, and a Boeing B , on a flight from Bregamo/Italy to Brussels/Belgium, occurred north of the city of Ueberlingen (Lake of Constance). Both aircraft flew according to IFG (Instrument Flight Rules) and were under control of ACC Zurich. After the collision both aircraft crashed into an area north of Ueberlingen. There were a total of 71 people on board of the two airplanes, none of which survived the crash. Abbreviations AAIB Swiss National Bureau of Accident Investigation FOCA Swiss Federal Office of Civil Aviation ACAS TCAS Airborn Collision Avoidance System FPL Flight Plan ACC Aera Control Center ICAO International Civil Aviation Organisation ACSS Manufactor of TCAS equipment ICWS Integrated Controller Workstation AIP Germany Aeronautiacal Information Publication Germany IAC Interstate Aviation Committee AOM Aircraft Operating Manual JAA Joint Aviation Authority ATC Air Traffic Control LBA Luftfahrt-Bundesamt ATCO Air Traffic Controller MCC Multi Crew Concept ATM Air Traffic Management NLR Swiss National Aerospace Laboratory ATMM Air Traffic Management Manual OM Operations Manual ATPL Air Transport Pilots Licence PF Pilot Flying ATS Air Traffic Services PIC Pilot in Command Bashkirian Bashkirian Airlines, Russian TU154MOperator PNF Pilot non Flying BAZL Bundesamt für Zivilluftfahrt RA Resolution Advisory (TCAS) BFU Bundesstelle für Flugunfalluntersuchung (Tyska RE Radar Executive (Controller) haverikommissionen) BFU Swiss Schweziska haverikommissionen eller AAIB RP Radar Planning (Controller) CA Controller Assistant RVSM Reduces tical Separation Minima CIR Control Room (ATC, ACC Zurich) Skyguide Swiss ATC operator, former state controlled ATC Swiss-control (2001) CoC Center of Competence (at ACC Operator SMOP Single Man Operation Procedures (ATC) organisation) CRM Crew (Cockpit) Resource Manual SOP Standard Operational Procedure DETEC Swiss Department for Environment, Traffic, Energy and Communication STCA Short Term Conflict Alert (Function in ATC system) DHL British B757 operator SYCO Flight Plan system DL Supervisor (Controller) SYMA System Manager (technical officer at ATC) Eurocontrol Europeiskt samarbetsorgan för luftfartsmyndigheter och operatörer TA Traffic Advisory (TCAS) FAA Federal Aviation Administration (USA) TCAS Traffic Alert and Collision Avoidance System FbRDPS Fallback Radar Data Processing System TRM Team Resource Management FMS Flight Management System UAC Upper Area Control FO First Officer (Copilot) VSI/TRA tical Speed Indicator/Traffic Resolution Advisory Display (TCAS Display) Tidsförloppet ([1]) Vid läsning av följande avsnitt kan det vara en hjälp att studera bilden Timeline (last 15 minutes) i den powerpoint-fil som iordningställts inför studien.

2 2

3 3

4 4

5 5

6 6

7 7

8 Diverse andra sammanfattningar Telephone systems 1. ATS Telephon System Swith 02 (SWI-02) (Down due to planned modification work) 2. Bypass System (Technical error) 3. Mobile phone at DL suite (Not known, due to lack of training, to ATCO fulfilling DL tasks during night) Radar systems 1. MV, Radarprocessors, (hot-operation, hot-standby, cold standby) (Down due to planned modification work) 2. fbrdps, fallback system without STCA and flight plan correlation ATC Workstations 1. WS-CA (manned) 2. WS-RP (manned by ATCO) 3. WS-RE (manned by same ATCO) 4. WS-DL (not manned ) Roles ([1]:sid 39 ff) 1. CA Controller Assistant 2. RE Radar Executive Controller 3. RP Radar Planning Controller 4. DL Supervisioning Controller 5. SYMA System Manager (Technical support to controller) Manning during this night 1. One CA 2. One controller (ATCO) handling RE, RP and DL tasks for two combined sectors from two WS with different radio configuration and display scales 3. One resting controller out of hearing distance 4. A technician team working with reconfiguration of sectors 5. One manager to support the ATCO (Not known by the ATCO) 6. One extra SYMA (Not known by the ATCO) 7. One controller to support the technicians (Not known by the ATCO) Organisations International aviation organisations 1. ICAO 2. Eurocontrol National (Air) Traffic Centres/Offices Schwitzerland 3. ATC Zurich Skyguide 4. FOCA 5. DETECT Germany 6. ATC Karlsruhe UK 7. DHL Operator Russia 8. Bashkirian Operator USA 9. FAA Accident investigation bureaus 10. BFU Germany (The accident in German airspace, controlled by SkyGuide (Swiss ACC operator) 11. AAIB (BFU Swiss) TCAS-maufacturer 12. ACSS 8

9 9 Circumstances 1. Planned work with reconfiguration of sectors was not risk assessed 2. The effect of work on technical systems and functions was not analysed 3. The CoC did not know about the work 4. The ATCO didn t know about the work, since none of the controllers had read the written briefing 5. The ATCO didn t fully understand the radar fallback mode, the lack of STCA function and loss of normal telephone function 6. The ATCO didn t fully understand the TCAS systems 7. The faulty telephone bypass system 8. The ATC Karlsruhe couldn t reach the ATCO on ordinary phone 9. The DL had just mentioned the work in general manner 10. There was only one ATCO in service, against the written SMOP procedure. This manning was standard during nights since years and known by management 11. The ATCO didn t hear the B575 radio message descending due to TCAS RA 12. The TU154M crew didn t recognize the B575 radio message descending due to TCAS RA 13. The TU154M crew was confused by the ATCOs erroneous information about the bearing to the conflicting traffic 14. The TU154M PIC wasn t familiar with TCAS system 15. The TU154M PIC thought the ATCOs instruction was for a collision avoiding maneuver, not just for ordinary (very late) traffic separation Contributing factors ([4]) 1. Single Man Operations (Anm PN. Mot gällande instruktioner men med ledningens goda minne sen många år. Bidragande faktorer är kostnadspress efter privatisering och svårigheter att rekrytera personal) 2. Downgraded Radar (Anm PN. Planerat arbete, dåligt kommunicerat, ingen riskbedömning) 3. Dual Frequency Responsibility (Se pkt.1 ) 4. Phone System (Anm PN. A. Se pkt 2. B. Tekniskt fel I By pass system. C. ATCO kännde inte till den tredje reservtelefonen då han inte hade rätt utbildning för rollen som DL) 5. TCAS (Anm PN. Fungerade som den skulle! En ny release fanns klar men var inte distribuerad. I den nya versionen finns funktion för att ändra RA om en part utför motsatt manöver) 6. Corporate Culture (Russian vs. West) Anm PN. Troligen inte en bidragande faktor! Den ryska besättningen var inte van vid TCAS och saknade detaljutbildning. De fick TA varning från TCAS och fick visuell kontakt med B757. Strax innan de fick TCAS-instruktion RA stig fick de ATC instruktion att sjunka pga trafik klockan 2 vilket var fel då B757 kom från klockan 10. Detta förvirrade besättningen ngr sekunder: PIC uppfattade denna instruktion som en uppmaning till undanmanöver (ATCO gav instruktionen som ett sent färdtillstånd utan att inse att piloterna fick TCAS instruktioner). Den ryska utbildningen och pilotinstruktionen gav inte TCAS högre prioritet än ATC, PIC följde ATC instruktionen, inte på grund av företagskultur utan pga. utbildning. (En pilot i den ryska besättningen hade bättre kunskap om TCAS function och visste att en RA skall följas. Den piloten var medföljande och hade ingen roll i cockpit, PIC var dessutom instruktör).s

10 10 Description of the event ([4]) In light of this information, one now gains a clearer picture of what exactly happened that night. When the second controller left the workstation to take a break, the first controller was working his shift without any assistance. Notwithstanding issues related to lack of supervision and vigilance effects that are associated with monitoring under low traffic load (the effects which may be magnified at night), the primary conflict alert system, whose use was mandated in that situation was turned off. The dynamic event began at when the controller made radar contact with the B757 as it entered the sector at FL 260. Shortly thereafter the B757 was cleared to FL320 and at 26.36, the aircraft was cleared to climb to FL 360 as per the pilot s request. At this point, the controller had not made radar contact with the T-154 until After both aircraft had entered the sector, the controller became preoccupied handling the approach of an aircraft (Airbus A320) to a separate airport that required him to use a different radio frequency and more importantly a different monitor: this act in itself pushed the limits of divided auditory and visual attention. In handling the approach, the controller had to call a tower using a phone system that had been reliable since it was installed. As a result the controller had high trust in the system. Therefore, when the controller experienced problems using it, he did not question its effectiveness but rather his own abilities in using the system. First the controller experienced an automation surprise (Dekker, 2002) and this resulted in cognitive tunneling (Wickens & Hollands, 2000) on the part of the controller as he struggled to get the system to work in one workspace, while neglecting the radar screen in another, a radar screen that depicted two aircraft converging at the same altitude. In Karlsruhe, which has overlapping radar coverage with the Zurich ACC, the STCA went off at At this point the controller working the sector notified his supervisor and tried in vain for over a minute (from to ) to contact Zurich ACC to notify the controller of the pending conflict, but was unable to do so given the phone system malfunction. Note that as per standard procedure, whereas it would have been possible to use the worldwide emergency transmission code of to warn the aircraft in question directly of the possible collision, this required prior approval from the Zurich ACC (which currently had responsibility for the aircraft), and this was not possible for the aforementioned reasons. When the controller finally noticed the conflict, he immediately instructed the T-154 at to descend not knowing that the aircraft s TCAS had instructed the pilot to climb. This lack of knowledge represents a possible design flaw in the TCAS system, which does not provide the controller with sufficient information about aircraft maneuver recommendations, leaving the controller out-of-the-loop in terms of knowing the pilot s perceived maneuver choices. Similar design flaws also led to the TCAS s system s inability to account for non-compliance on the part of one user, evident when it continued to instruct the B757 aircraft to increase its descent rate even after the T-154 had begun to execute the same maneuver, putting both aircraft on a collision course. Finally, cultural differences led the crew of one aircraft to following TCAS recommendations and another to ignore it, under high temporal pressure. This series of events culminated in the mid-air collision.

11 11 Utdrag ur Haverirapporten ([1])

12 12

13 13

14 14 Skyguide Internet ([5]) On February 2004, the skyguide air traffic controller in service during the night of the accident was stabbed to death at his home. Skyguide had drawn lessons from the investigations into the accident before the publication of the final accident report, and has already enhanced its safety system. The errors which led to the accident were rectified in its immediate aftermath, and many of the actions recommended by the BFU have also already been taken. The safety management practised by skyguide complies with all national ant international requirements, and will continue to be constantly refined. Skyguide s 1400 personnel are also committed to ensuring that all the BFU recommendations are adopted and acted upon in full, to ensure that a tragedy of this kind cannot reoccur. NLR post audit 2007 The main finding of the report was that in Switzerland a number of essential safety management processes and associated responsibilities had been institutionalized in such a way that effective safety management was not being achieved. The study also established that the, once exemplary, safety level of Swiss civil aviation had undergone an adverse trend, requiring focused measures to reverse this trend. These measures concerned the removal of institutional barriers, and the implementation of a number of organizational changes at the level of DETEC, FOCA and the AAIB. Moreover it was found to be necessary to take a number of national and sector-wide safety initiatives to introduce and/or improve safety management processes. Referenser [1] Investigation Report, BFU, AX /02, May [2] Flightpath and Last Minute Events, AX /02 A1&3, May [3] Cockpit events, SMOP procedures etc, AX /02 A2-10, May [4] Identifying the Factors that Contributed to the Ueberlingen Midair Collision, A Nunes, T Laursen, Sept [5] Information regarding the air accident at Überlingen on July 1, 2002, ( ). [6] Post implementation audit of aviation safety management in Switzerland, NLR-CR , ( ).

15 Ytterligare referenser kan erhållas m h a nätsökningar efter Überlingen accident, Überlingen flygolycka etc: 15 Dokumenthistorik sion Beskrivning Sammanställt av Första urval med kommentarer av PENU Peter Nummert, Combitech AB Smärre putsningar (huvud, ref, dokhistorik, rättelser) + tillägg. Inga-Lill Bratteby-Ribbing, FMV Ytterligare extrakt Inga-Lill Bratteby-Ribbing, FMV