ANSP operational error

Executive summary

What happened

At about 0515 local time on 9 December 2022, an approach controller for Cairns Terminal Control Unit (TCU) was found asleep at the end of their night shift by the oncoming morning shift approach controller. They were woken by the oncoming day shift manager and, after ensuring there was no traffic in the area, control was handed over to the oncoming controller. 

What the ATSB found

The ATSB determined that there were several factors that likely contributed to the controller falling asleep. These included working multiple consecutive night shifts resulting in sleep debt, in combination with time of day and very low workload. The controller also took actions that increased the likelihood of sleep. 

The ATSB also found that while there was a fatigue risk management system in place, it did not effectively identify the risk associated with working multiple night shifts based upon tactical changes to the work schedule. The ATSB also identified that the fatigue risk assessment process was not effective in identifying or managing low workload as a hazard. 

What has been done as a result

Since the occurrence, Airservices Australia has increased the overall number of air traffic controllers available, including those based in the North Queensland group. While noting this positive action, the ATSB will continue to monitor the anticipated increase in staffing numbers and provide website updates.

The Airservices ATS Fatigue Safety Assurance Group has developed additional guidance and training on the fatigue risk assessment process, including information on how low traffic situations should be treated as a high fatigue risk.

Civil Aviation Safety Authority (CASA) has introduced legislative changes to Fatigue Risk Management System (FRMS) requirements for Air Traffic Services (ATS) providers in Part 172 Manual of Standards. Airservices Australia is working with CASA to trial their existing FRMS against the new requirements and using feedback to make improvements. 

Safety message

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. One of the safety concerns is improving the management of fatigue.

Despite increased awareness across the transport sector, fatigue remains one of the most relevant ongoing concerns for safe transport. Fatigue impairment has been identified as a contributory factor in numerous aviation, maritime and rail accidents.

While this occurrence was not associated with a negative consequence, it highlighted areas for improvement in work scheduling and fatigue risk management. Operators should investigate similar events to identify and remedy deficiencies in work scheduling, fatigue risk management processes and risk controls.

The occurrence

On 8 December 2022, an approach controller for the Cairns terminal control unit (TCU) signed on to work a scheduled night shift, between 2200–0600 local time, at the Air Traffic Services Centre in Brisbane (Brisbane Centre), Queensland. During the night shift period, the TCU was normally staffed with one controller, who was normally relieved by another (oncoming) controller at about 0515–0530.

At about 0500 on 9 December, the oncoming approach controller for the Cairns TCU position arrived at the centre to commence their morning shift. At 0515, they alerted the oncoming shift manager for aisle 3 that the night shift controller was asleep at the console. They observed that the air situation display (ASD) screensaver was on and the controller’s headset, which they were wearing, was plugged in. The controller was lying across 2 chairs with a blanket covering them. 

The shift manager woke the controller and checked the ASD. There was no indication of traffic in the airspace or alerts on the display. The approach controllers conducted a handover brief, and the oncoming controller took control of the console.

Context

Brisbane Centre

Overview

Brisbane Centre is a major air traffic control centre, operated 24 hours a day by Airservices Australia (Airservices) at Brisbane Airport. The operations room was divided into aisles, each with 2 rows of consoles. Each aisle was supervised by a manager working from a desk in the middle of the aisle (Figure 1), but during the night shift, there was no aisle manager on duty. 

A system supervisor was available for indirect supervision,[1] and they were usually located at the front desk of the centre. The system supervisor was responsible for coordinating system changes and maintenance activities for the operations room. This role included general supervisory responsibilities and, when shift managers were not rostered, indirect supervision across the aisles. In addition, an overnight operations manager was on-call, but not on site.

Controllers further reported that the Brisbane Centre building was much cooler at night than during the day, and it was considered normal practice for blankets to be needed during night shifts. Airservices advised that the temperature of the room could not be manually adjusted, and the air conditioning system was not effective at maintaining the desired temperature at night. It was also reported that the room lighting was not adjusted for the night shift.

Aisle 3 operations area

Aisle 3 included separate en route sectors Gwydir, Hastings, Capricornia, Reef and Cairns TCU, with the Cairns TCU workstations in the back right corner (Figure 1). During the night shift, each sector was staffed by one air traffic controller.  

Figure 1: Brisbane Centre aisle 3 layout

Source: Airservices Australia, annotated by ATSB.

Cairns terminal control unit

The Cairns TCU position had been operating in Brisbane Centre since 2017 and the Civil Aviation Safety Authority (CASA) required the airspace to be operated 24 hours a day. Depending on the level of traffic, the Cairns TCU position could be split into multiple workstations including approach, departures, flow, Rockhampton and Mackay approach during tower hours,[2] and a Cairns shift manager during day shifts. During the night shift, the approach, departures, and flow positions were combined, and Rockhampton and Mackay reverted to a common traffic advisory frequency (CTAF).[3]

Between the hours of 0100–0530, there was generally so little scheduled traffic in the airspace that a night shift on Cairns TCU could not be counted as recency experience for the position. After 0200, on the night of the occurrence, there was one scheduled aircraft arriving and then departing Cairns Airport. This aircraft’s last contact with the approach controller was at about 0305 (Table 1).

Voice communication system 

A voice communication system was used by air traffic controllers to communicate with aircraft and other controllers. It included a headset at the console and a loudspeaker that could project sound to the aisle. When the headset was plugged into an active console, the audio could be selected for either the headset only, loudspeaker only, or the headset and loudspeaker combined. 

The approach controller reported that, at the time of the occurrence, it was selected to both headset and loudspeaker combined. They also reported wearing their headset at high volume and the audio was set to full volume on the loudspeaker.

Air situation display data 

The air situation display (ASD) key logger data and recorded radio calls were obtained for the console between 0200–0600 and are presented in Table 1. Before the controller was woken, there was 15 minutes and 23 seconds of no logged activity. Additionally, there were longer periods of time after 0200 where there was no logged activity. 

Table 1: Time of interactions from the air situation display 

Approach controller information

Medical and recent history 

The controller had been working at Airservices for about 10 years and had worked on the Cairns TCU position for the previous 3 years. They held a valid Class 3 and Class 2[4] medical certificate, which had no documented history of sleep disorders. 

They reported sleeping for about 12 hours during the night starting 5 December prior to commencing the first night shift of the block of 6 night shifts (see the section titled Roster information). They estimated they obtained sleep on both of the 2 days preceding the event (6 and 7 December), between 2200–0600 and 1900–2100. They rated their sleep quality ‘7 out of 10’[5] and advised that they normally slept 7–8 hours a night. 

The controller rated their alertness at the time of the occurrence as ‘moderately tired’,[6] which they advised was relatively normal for a night shift. They recalled that they consumed their last caffeinated drink at about 1400 the previous day. They did not report feeling fatigued prior to the shift, nor to the system supervisor while on duty. 

They stated that during night shifts for the Cairns TCU position, there was no additional relief available to hand over the console for extended breaks, but it was possible and normal to take a quick break (to go to a rest room or obtain a drink) between traffic. The loudspeaker (see the section titled Voice communication system) could be used to alert other controllers in the aisle to communications while the controller was taking a quick break. 

Roster information

The ATSB obtained copies of the controller’s master roster, including records of the changes to the roster, between November and December 2022. This information is summarised in Table 2.

Table 2: Planned (strategic) and actual (tactical) work schedule^[5] of approach controller in the lead up to, and shortly after occurrence

On the evening of 6 December, the controller commenced a block of 6 night shifts (2200⁠⁠–⁠0600). The occurrence happened on the third shift of this block (that is, the morning of 9 December). This night shift had been included in the controller’s master roster. However, as indicated in Table 2, the remaining 5 shifts in this block were the result of changes to the planned roster. The last 2 nights of this block were allocated during the day of the occurrence (but prior to the beginning of that shift).

Prior to commencing this block of night shifts, the controller had 64 hours free of duty. This followed a block of 5 shifts which commenced with one afternoon shift, followed by 4 night shifts. 

The controller was working their seventh night shift in 9 days and by the end of the block of shifts, had completed 10 night shifts in 12 days.

Fatigue analysis

A biomathematical model of fatigue (BMMF) predicts the effect of different patterns of work on measures such as subjective fatigue, sleep, or the effectiveness of performing work, using mathematical algorithms. Each model uses different types of inputs/assumptions and produces different types of outputs, each having limitations.

Airservices used the BMMF known as FAID[7] as one of its assessments of the master roster. FAID uses a 7-day rolling average to calculate sleep opportunity afforded by the work schedule. Airservices had set a nominal threshold of 80.4 as their maximum score for master rosters. 

An ATSB analysis of the controller’s roster of actual hours, using FAID, showed scores were:

• above this threshold on 6 of the night shifts over the analysed period (Table 2)
• on the day of the occurrence, the analysis indicated a peak FAID score of 78 and a peak Karolina sleepiness scale (KSS)[8] score of 7.7
• the highest peak FAID score across the analysed period was 100 on the last night of the block of 6 consecutive night shifts (11 December). 

The ATSB also analysed the same roster using the fatigue avoidance scheduling tool (FAST). The auto-sleep function and a commute time of 20 minutes were applied. This resulted in: 

• Effectiveness scores[9] that decreased over the period of 4 consecutive night shifts (30 November–3 December) reducing below 77% effectiveness for more than half of each shift.
• During the following block of 6 night shifts (6–11 December) effectiveness scores remained below 77% for more than half of each shift.
  • During the occurrence shift, the performance effectiveness score was 70%. 

Overall, the analyses using both FAID and FAST predicted that the controller’s actual hours of work during the 6 consecutive night shifts was associated with an increasing fatigue risk.

Fatigue risk management

Fatigue risk management procedure

Airservices had a fatigue risk management procedure which outlined how the organisation identified and managed fatigue-related risks. There were several components to the system including FAID BMMF and strategic roster planning rules (SRPRs) to plan the master roster at least 45 days prior to implementation.[10] If there were changes to the master roster, tactical roster management principles (TRMP), were used to assess these changes. Airservices used work scheduling software to create the master roster and risk assess any changes.

Strategic roster planning rules

The SRPR included 12 rulesets, with 7 that constrained the number of consecutive shifts or the required rest period following consecutive shifts. These rules included:

• The number of planned consecutive shifts was limited to 7.
• Seven consecutive shifts had to be immediately followed by an extended rest period of no less than 58 hours.
• Planned work hours could not exceed 54 hours in any period of 7 consecutive days (168 hours) prior to the end of each shift.
• Blocks of shifts had to be separated by a minimum of 35 hours, including one 24-hour period, commencing at midnight.
• A minimum of 2 extended rest periods were required in any period of 28 consecutive days (672 hours) prior to the start of each shift.
• When 2 or 3 night shifts were present in a block of shifts they had to be consecutive and immediately followed by an extended rest period of no less than 58 hours.
• The maximum number of planned night shifts permitted in a block of shifts was 4. When 4 night shifts were present, they had to be consecutive and immediately followed by an extended rest period of no less than 83 hours.

The master roster was published on 1 September 2022, about 3 months prior to the work being performed. The ATSB analysed the master roster using FAID, and this showed the peak FAID scores were below Airservices’ nominal threshold (80.4). Additionally, it contained blocks with a maximum of 2 night shifts and these were followed by 2 consecutive full days off (Table 2).

It was reported during interviews with controllers that the Cairns TCU master roster was regularly published with vacancies. Additionally, there were 19 controllers available but 23 were required to cover the 24 hour operational requirement. This required shift managers to regularly make tactical changes to the roster using tactical roster management principles (TRMP – detailed in the following section). 

Tactical roster management principles

Airservices advised that the purpose of the TRMP was to provide flexibility while ensuring any associated increased fatigue risk was identified and managed.

The TRMP included the following principles relevant to consecutive shifts and the rest periods following consecutive shifts:

• The number of actual consecutive shifts should be limited to 7.
• Seven or more consecutive shifts should be immediately followed by an extended rest period of no less than 58 hours.
• Actual working hours should not exceed 60 hours in any period of 7 consecutive days (168 hours) prior to the end of each shift.
• Within the 28 days (672 hours) prior to the start of each shift, there should be a minimum of 2 extended rest periods (of no less than 58 hours).
• When 2 or 3 night shifts were present in a block of shifts they should be consecutive and immediately followed by an extended rest period of no less than 58 hours.
• When 4 or more night shifts were present in a block of shifts they should be consecutive and immediately followed by an extended rest period of no less than 83 hours.

The changes to the roster and the future effect were automatically assessed in the work scheduling software against the TRMP. Where there was no deviation from the TRMP, the change could be accepted with no further action required. 

Where a shift deviated from the TRMP it was assigned a predicted fatigue level of low, medium or high based on scoring documented in the fatigue risk management procedure, which assigned points depending on the type and extent of deviations from the TRMP. Where the predicted fatigue level was low, the shift could again be assigned with no further action. Where the predicted fatigue level was flagged as medium or high, the shift would be flagged as requiring a fatigue assessment and control tool (FACT) process (see the section titled Fatigue assessment and control tool). The FACT process would then be used to select appropriate risk controls and assess residual fatigue potential, which then must be accepted at the appropriate level.

If more than one controller indicated they were able to take additional duties, supervisors were required to prioritise assigning additional shifts to individuals with the lowest predicted fatigue level.

The ATSB made the following observations about the tactical changes made to the controller’s roster and conducted FAID analysis of actual hours (there was no requirement for Airservices to check the changes against FAID during the tactical rostering process). These included:

• There was a block of 8 consecutive shifts (14–21 November) which:
  • exceeded the recommended limit of 7 shifts
  • included 2 consecutive night shifts and the following extended rest period of 64 hours was greater than the recommended 58 hours
  • included 3 consecutive shifts (19–21 November) flagged with a predicted fatigue level of medium
  • the shift on 21 November had a peak FAID score of 83 which was above the Airservices limit of 80.4 used for assessing master rosters.[11]
• The block of 5 consecutive shifts from 29 November–3 December:
  • none of the 4 night shifts were flagged with a predicted fatigue level
  • the following rest period was reduced to 64 hours (not the recommended 83 hours)
  • the last 2 nights (2 and 3 December) had peak FAID scores of 82 and 90 respectively.
• The block of 6 night shifts from 6–11 December
  • the first shift was flagged with a predicted fatigue level of high (6 December) – the peak FAID score for this shift was 62
  • the following 3 nights were not flagged with a predicted fatigue level – the last night of this block (the night after the occurrence) had a peak fatigue score of 85
  • the last 2 shifts of the block were flagged as high predicted fatigue level – these shifts had a peak FAID score of 93 and 100 respectively which was above the Airservices limit of 80.4 used for assessing master rosters.¹¹
• The controller continued to work 3 night shifts after the occurrence was reported. The last 2 night shifts had been allocated during the day of the occurrence (8 December – the controller was found asleep on the morning of 9 December).
• The occurrence did not result in changes to upcoming shifts, nor a reassessment of the FACTs already approved with a predicted fatigue level of high.

Fatigue assessment and control tool

The fatigue assessment and control tool (FACT) was embedded in the rostering system and provided:

… a means of assessing fatigue-related risk, applying appropriate controls and recording information about changes to the published work schedule/cycle. 

It was used by supervisors to assess shifts with a predicted fatigue level of medium or high. Supervisors were required to complete a FACT for a shift within 48 hours of commencement of the shift.

Fatigue risk assessment process

Shifts that were classified with a medium or high predicted fatigue level were required to be assessed in terms of the impact of situational factors that could affect fatigue, such as time of day and workload. This process was done using a combination of automatic ratings and supervisor inputs.

The work scheduling software automatically rated the time of day impact as either low, medium or high (relative to circadian rhythm). Supervisors were required to rate the expected traffic volume as either low, medium or high. Guidance associated with the procedure stated:

Traffic volume is either very low, which can result in boredom and low task engagement; or high, thereby demanding a significant increase in task engagement. These two scenarios can respectively lead to ‘under-load’ and ‘over-load’. As a consequence the fatigue potential needs to be considered as High.

A supervisor also rated traffic complexity, weather, system state and staffing levels by selecting routine, non-routine or significant. The supervisor was then required to make an overall assessment of the situational factors as negligible, moderate or significant. This rating was then combined with the predicted fatigue level rating associated with the work schedule, to give an overall initial fatigue potential rating of lower‑medium, higher‑medium or higher. 

Fatigue risk controls 

After the fatigue assessment process, supervisors were required to select from the risk controls available for individual controllers on the shift. The rostering software recorded the risk controls selected by a supervisor from a drop‑down list,[12] which were defined in the fatigue risk management procedure. Supervisors were required to ensure that the risk controls selected were available. The procedure did not require supervisors to consult with air traffic controllers on the selected risk controls.

The list of risk controls that could be selected included:

• supplementary personnel measures (better use of existing resources, call-out of additional/replacement staff, double up staffing)
• shift-related measures (delay start of shift, end shift early)
• break-related measures (instruct employee to take breaks, increase frequency/length of breaks, controlled use of stand-down rooms for napping)
• general measures (rotate/combine positions, initiate procedural process for regular two-way communications)
• ATC-specific measures to reduce workload/complexity (metering traffic flow, airspace closure/reduced service delivery, minimise/limit any abnormal working routine)
• post-shift measures (provision of transport home).

Following the selection of risk controls, a residual fatigue potential was derived. The residual fatigue potential determined the level of management required to accept the risk. 

Recent FACT applications

The ATSB reviewed the controller’s roster for the period from 10 November to 12 December and the associated FACT assessments for shifts with a medium or high predicted fatigue level. Records for each assessment are presented in Table 4.

Table 4: FACT records for the approach controller between 10 November and 12 December 2022

The assessments showed that in all instances the predicted fatigue levels were assessed as having negligible situational factors, resulting in an initial fatigue potential of lower-medium. In all 5 night shifts records for this roster, the time of day impact was rated (by the work scheduling software) as high and the traffic volume was rated (by supervisors) as low, with almost all the other aspects rated as routine.

Table 4 above also showed that the fatigue risk controls listed were to initiate procedural process for regular two-way communications and instructing controllers to take longer and more frequent breaks. Records were not able to show if these risk controls had been applied after they were documented in the work scheduling system. Timestamps from records showed that these risk controls were documented within the required 48 hours prior to shift start. There was no way to verify in the system if the risk controls selected were applied. During interviews with supervisors, they described the FACT administration process as a ‘tick box’ exercise because they had lots of shifts to fill and found it difficult to understand how the work scheduling system scored fatigue risk for some shifts, and not others. They further noted they had a low trust in the system because it seemed inconsistent with how employees felt compared to the predicted fatigue levels.

Previous fatigue risk management audits

Airservices provided copies of assurance and audit activities conducted on its fatigue risk management system (FRMS) between 2019 and 2023. Of these activities, an assurance report from 2023 focused on the effectiveness of the FACT process, and the design and application of additional risk controls for air traffic controllers. This report contained several findings, including evidence that:

• Feedback from some end users suggested that resourcing levels in some areas had prevented the creation of a master roster where all SRPRs could be met. This situation meant that there was reliance on tactical roster changes to fill the gaps.
• The number of FACTs requiring completion had significantly increased in 2022 compared to 2017, 2018 and 2019.[13] In addition, the number of staff had decreased over this period. On average, this situation resulted in the increased frequency of staff members working shifts with an elevated fatigue risk level.[14]
• When assessing the actual fatigue experienced by staff compared to the FACT risk level predictions, inconsistencies were noted where the FACT process predicted high fatigue levels when none was experienced, or it failed to predict fatigue when someone was actually feeling fatigued. Although, it was noted that the system’s high fatigue risk prediction was the most accurate.
• The same or similar risk controls were applied to manage risks with different fatigue risk profiles, most likely due to the availability and suitability of risk controls. Increasing the frequency/length of breaks and instructing employees to take breaks were the most commonly used risk controls.
• Once a FACT had been approved it was difficult to amend if the risk profile or controls were required to be changed.
• There were no constraints imposed by the Fatigue Risk Management System on the number of shifts with medium or high predicted fatigue levels that an air traffic controller could perform across a period of time.
• End user feedback suggested that there were instances where risk controls were selected but not applied in practice. In addition, sometimes risk controls such as ‘Instruct staff to take breaks’ were listed as an additional control, when they were normal practice. Feedback on controls listed for night shifts such as ‘initiate procedure for two-way communication’ were noted to not be effective in preventing fatigue. 

Fatigue management personnel from Airservices noted that while the tactical processes for assessing risk could detect factors that affected acute fatigue, it was probably less sensitive to cumulative fatigue that could build up over a period of weeks.  

Administration manual

Airservices had a National Air Traffic Services (ATS) Administration Manual that outlined procedures used across all ATS operational and support units. It noted that, to improve mental alertness and help reduce fatigue during low workload, staff were permitted to perform some non‑operational activities, such as reading (including using non-transmitting electronic devices) or paper-based puzzles. The controller was aware of these strategies listed in the procedure.

Similar events

A search of the Airservices incident database in the last 5 years using the key words ‘sleep’ and ‘asleep’ showed there were no similar reported events for Brisbane Centre. Rostering data also revealed there were 6 occasions between 6 October 2022 and 5 April 2023 where en route or approach controllers worked 5 or more consecutive night shifts at Brisbane Centre. In addition, there were 10 occasions between 1 June 2022 and 31 May 2023 where 4 consecutive night shifts were not followed by the recommended 83 hours rest.

A search of ATSB REPCON final reports from 2016 concerning air traffic controller fatigue risk management identified 5 reports, however these were not specific to rosters for Cairns TCU, or Brisbane Centre Aisle 3 (which did not have single-person night shifts):

• RA2023-00003 – Staffing levels at Sydney TCU
• RA2022-00045 – Sydney TCU staffing and operational concerns
• RA2022-00053 – Use of TRA, short break and ECE procedures mitigate shift shortages and breaks
• AR201700058 – Controller fatigue in Melbourne Centre during single-person night shifts
• AR201600052 – Fatigue at the Southern Control centre during one-person night shift

Safety analysis

Introduction

This analysis will initially discuss the factors that led to the controller falling asleep at the workstation. It will also outline how, likely due to a lack of resources, the fatigue risk management system (FRMS) used by Airservices Australia (Airservices) did not effectively identify or manage cumulative fatigue arising from changes to the work schedule. The effectiveness of Airservices’ fatigue assessment and control tool in identifying and managing the risk of low workload will also be considered. 

Sleeping at the workstation

Just prior to the shift handover, the approach controller was found to be asleep at the workstation while responsible for the Cairns TCU airspace. Data from the air situation display (ASD) indicated there had been no interactions with the system for approximately 15 minutes prior to the controller being found. However, the ATSB could not determine specifically when the controller had fallen asleep, nor how long they had been asleep during that time. There were 5 other periods after 0200 of no logged activity, where sleep could also have been obtained, noting there may also have been other reasons for no logged activity. 

When the controller was found asleep, there was no traffic in the Cairns TCU airspace, which was usual for that time of day. Additionally, there were no scheduled flights until after the night shift ended nor any regular situations where Cairns TCU would be directly contacted by a flight crew without first speaking with Cairns Tower or other en route sectors. In the unlikely event that a transmission did come through, the approach controller had selected the volume of the headset to full, and the loudspeaker to on, to ensure they would be alerted or other controllers in the aisle would hear.

Nevertheless, there was still risk associated with the controller being asleep. For example, upon being woken by a radio broadcast, a controller who had been asleep could experience sleep inertia[15] and provide delayed communications, or incorrect instructions/actions. They would also likely not have been in a position to ensure safety in the event that conflicts arose from traffic infringing the airspace without a clearance.

The ATSB determined that there were several factors that contributed to, or predisposed, the controller to fall asleep in this situation. The controller:

• was working within the window of circadian low,[16] when there was an increased biological drive to sleep
• was experiencing very low workload[17] and not expecting this to change
• was conducting their third consecutive night shift after a reduced rest period
• was working their seventh night shift in 9 days
• had obtained less than their normal sleep over the previous 48 hours.

The controller reported having 12 hours of sleep between the 2 blocks of night shifts, however the extent to which they had recovered the sleep deficit from the previous block of night shifts is unclear. Previous research has indicated that during a 16 hour rest period, where the time of rest onset is 0600, shift workers on average obtained 6.5 hours sleep (Roach & Dawson 2003). In addition, a series of 6 hours of sleep over several days is known to result in significant performance decrements (Banks and Dinges 2007). Therefore, it is likely the approach controller had accrued a sleep debt from inadequate sleep, before beginning the block of 6 consecutive night shifts. 

Even if the controller was not fatigued from multiple night shifts prior to occurrence shift, then they very likely would have been fatigued during the following shifts.

However, in addition to the sleep debt and situational factors, the controller had also undertaken practices that increased the likelihood of falling asleep. These practices included lying across 2 chairs and under a blanket, and not varying their posture regularly or undertaking activities to maintain mental alertness. 

Fatigue risk management system

Strategic rulesets and tactical principles

Airservices had a fatigue risk management system in place to identify and assess increased fatigue risk associated with managing a 24-hour roster. 

Master rosters were developed using prescribed limits of work from the industrial agreement, in combination with biomathematical modelling of fatigue (BMMF) and strategic rulesets (SRPR). The master roster could not be released outside of these parameters and was published well in advance of the shifts being worked. 

However, there was evidence that master rosters were published with gaps, and that this had been identified during Airservices’ assurance activities as an issue possibly related to staff under‑resourcing.[18] In addition, previous REPCONs highlighted that there were other rosters across Airservices that had concerns about ongoing controller shortages resulting in extended working hours, such as Sydney TCU. 

To fill the roster gaps for day of operations, changes were assessed against tactical roster management principles (TRMP) to predict if shift changes would result in controllers experiencing an increased fatigue risk. This process was mostly intended for occasional ad hoc changes to individual shifts, due to sick leave or unexpected shift changes. However, regular vacant shifts in the master roster meant that there was a reliance on the TRMP (and not the master roster) to control fatigue risks. 

The TRMP had recommendations rather than prescribed limits and shifts with a predicted fatigue level of medium or high could be worked if a fatigue assessment and control tool (FACT) was completed. 

However, there were no tactical limits in the fatigue risk management system on the number of shifts which could be allocated including night shifts.[19] As occurred in this case, a block of 5 shifts, including 4 night shifts, was followed by a block of 6 night shifts without the recommended rest period to allow the controller to recover their sleep deficit. As these changes complied with the TRMP, not all of the night shifts in the second block were flagged with a medium or high predicted fatigue score, which meant the supervisors were not alerted to the increased fatigue risk. Additionally, the controller’s work scheduling history showed that changes were being made within 2-3 days of the shift being worked, which reduced the controller’s opportunity to plan rest during their rostered time off.

There were also no limits on the number of consecutive shifts with medium or high predicted fatigue scores that could be worked. Successive indications of predicted medium or high fatigue signalled that a controller likely had insufficient opportunity to recover from a cumulative sleep deficit. However, these indications will not always accurately predict fatigue levels of an individual. Evidence from controllers revealed that predicted fatigue flags in the system did not correspond well to their own experiences, and there were times in which they felt fatigued but there was no predicted fatigue score.  

Cumulative fatigue risks were intended to be primarily managed through the master roster and occasional changes managed using the tactical roster management principles (TRMP). However, as the master roster was planned in advance, information about actual hours being worked was not being fed back into the roster development process to compare changes in fatigue risk. Consequently, the resultant risks of cumulative fatigue were not considered in the upcoming or future roster development. 

While the evidence for this investigation was centred around Cairns TCU, the fatigue risk management procedure applied to all air traffic controllers working in Air Traffic Services (ATS). 

The goal of the overall fatigue risk management system should be to favour reliance on the master roster as far as reasonably practicable. The reliance by Airserviceson the tactical system to build the work schedule meant that the protections for preventing cumulative fatigue were not being applied.

Surveillance

When an individual shift in the work scheduling software was flagged with a medium or high predicted fatigue level, the relevant supervisor was prompted to complete a FACT process to determine if additional risk controls were required. 

The ATSB determined that there were several factors that contributed to, or predisposed, the controller to falling asleep, which included working multiple consecutive night shifts. In this occurrence, the FACT process was not triggered because the controller’s shift was not flagged as having a medium or high predicted fatigue level. As no FACT was required (nor had been completed) and the controller did not report feeling fatigued, the system supervisor on duty was not made aware of the controller’s potential fatigue and so would not have had any reason to increase their surveillance of them during the shift.

Additionally, after the occurrence was reported, there was no trigger for the supervisors to review upcoming shifts, or the approved FACTs. The controller continued working 3 additional night shifts before a day off work, despite being found asleep. Analysis of the last 3 shifts showed FAID scores of 85, 93 and 100, which were all above the Airservices maximum peak FAID score used for developing master rosters. Recognising that these scores were not available at the time of the occurrence, they illustrate the fatiguing effect of the additional 3 shifts.

Fatigue assessment and control tool

Supervisors relied on the triggering of the FACT process to identify increased risk from changes to the work schedules. For night shifts, where there were no direct supervisors, the previous shift supervisor would complete the FACT before the oncoming night shift controller had started their shift. Airservices reported that there was no requirement for supervisors to consult with a controller on the selected risk controls.

During the FACT process, the supervisors were required to rate the fatigue risk associated with high or low workload through the assessment of traffic volume. Evidence from the controller’s previous FACT assessments for Cairns TCU indicated that the supervisors were assessing the low traffic volume as a low risk.

However, the guidance indicated that very low traffic volume should be rated as high. Cairns TCU was known to normally have low workload during the night. 

It was likely that the supervisors were not considering low traffic volume as an increased fatigue potential as stated in the guidance material. Rather they were considering it as a condition that facilitated more frequent or longer breaks. It is possible that this normalised the fatigue risk assessments conducted for the night shifts, such that it was not considered as a hazard. This most likely resulted in the supervisors assessing the situational factors as negligible instead of significant.

The procedure and work scheduling software list of fatigue risk controls did not include examples for managing low workload, however they were listed in the separate administration manual. Past audit and assurance activities had not identified the management of low workload as an area requiring improvement.

Changes to fatigue risk management regulations by CASA

On 1 August 2023, the Civil Aviation Safety Authority (CASA) introduced specific fatigue management requirements for ATS providers in Part 172 Manual of Standards. The standards required that by 1 September 2024, ATS providers have a Fatigue Risk Management System (FRMS) that is approved by CASA either as a trial FRMS implementation or as a final FRMS implementation. CASA informed the ATSB, on 17 May 2024, that they were in the process of reviewing the Airservices application for a trial FRMS implementation.

On 29 July 2024, Airservices Australia advised the ASTB:

We are currently working through the CASA FRMS application process. This is in progress and while we are utilising our existing FRMS, throughout the process we will look for opportunities to improve the system.

Findings

From the evidence available, the following findings are made with respect to the air traffic controller incapacitation at Brisbane, Queensland on 9 December 2022. 

Contributing factors

• Due to a number of factors, the Cairns terminal control unit approach controller fell asleep while at their workstation. These factors included the time of day (about 0500), very low workload, a roster pattern with multiple consecutive night shifts and the controller engaging in practices that increased the risk of falling asleep.
• The controller had been working multiple night shifts with reduced extended rest periods, which likely reduced their ability to obtain restorative sleep. This increased the likelihood of experiencing sleepiness and sleep onset while on duty.

Other factors that increased risk

• Likely due to an underlying lack of resources within Airservices Australia, there was an over-reliance on tactical changes to manage the roster. As a result, cumulative fatigue was not being effectively managed strategically and an over‑reliance on tactical principles did not identify or manage fatigue risks arising from the work schedule. (Safety Issue)
• Although Airservices Australia’s fatigue assessment and control tool (FACT) had the means of identifying situational factors that influenced fatigue, it had limited effectiveness as supervisors were not identifying low workload as a fatigue hazard. (Safety Issue)

Safety issues and actions

Fatigue risk management system

Safety issue number: AO-2022-065-SI-03

Safety issue description: Likely due to an underlying lack of resources within Airservices Australia, there was an over‑reliance on tactical changes to manage the roster. As a result, cumulative fatigue was not being effectively managed strategically and an over‑reliance on tactical principles did not identify or manage fatigue risks arising from the work schedule.

Fatigue assessment of low workload

Safety issue number: AO-2022-065-SI-04

Safety issue description: Although Airservices Australia’s fatigue assessment and control tool (FACT) had the means of identifying situational factors that influenced fatigue, it had limited effectiveness as supervisors were not identifying low workload as a fatigue hazard. 

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the involved air traffic controller
• Brisbane Centre air traffic controllers
• Airservices Australia
• published ATSB REPCONs

References

National ATS Administration Manual ATS-MAN-0013 Version 48 Effective 01 December 2022

Fatigue Assessment and Control Tool (FACT) Guide AA-GUIDE-SAF-0020 Version 6 Effective 21 May 2021

Air Traffic Services (ATS) Fatigue Risk Management Procedure AA-PROC-SAF-0028 Version 9 Effective 12 September 2022

En Route Supplement Australia (ERSA) Effective 15 June 2023

CASA OAR 166/22 Determination of Airspace and Controlled Aerodromes Etc. (Designated Airspace Handbook) Instrument 2022 Effective 28 November 2022

Airservices Australia (Air Traffic Control and Supporting Air Traffic Services) Enterprise Agreement 2020-2023

ICAO Fatigue Management Guide for Air Traffic Services Providers. 1^st edition 2016

AIRSERVICES AUSTRALIA (AIR TRAFFIC CONTROL AND SUPPORTING AIR TRAFFIC SERVICES) ENTERPRISE AGREEMENT 2020-2023

Roach, GD, Reid, KJ & Dawson, D 2003, 'The amount of sleep obtained by locomotive engineers: effects of break duration and time of break onset', Occupational and Environmental Medicine, vol. 60, no. 12, pp. e17-e.

Banks, S & Dinges, DF 2007, 'Behavioral and physiological consequences of sleep restriction', Journal of clinical sleep medicine, vol. 3, no. 5, pp. 519-28.

Institutes for Behavior Resources Inc., 2023, 'SAFTE-FAST as a Supporting Tool for Fatigue Investigation'. https://www.saftefast.com/_files/ugd/c8faa9_7f7b509fb18940f5ab04f2cc2c46a6e3.pdf

Dean, DA, Fletcher, A, Hursh, SR & Klerman, EB 2007, 'Developing mathematical models of neurobehavioral performance for the “Real World”', Journal of biological rhythms, vol. 22, no. 3, pp. 246-58.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the involved air traffic controller
• Brisbane Centre air traffic controllers
• Airservices Australia
• Civil Aviation Safety Authority

Submissions were received from:

• a Brisbane Centre air traffic controller
• Airservices Australia.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

What happened

On the morning of 30 April 2018, the surface movement controller (SMC) at Melbourne Airport, Victoria was conducting on-the-job training of a trainee air traffic controller. Runways 27 and 34 were in use, with aircraft landing on runway 27 and departing from either runway 27 or runway 34 (Figure 1).

Figure 1: Melbourne Airport apron, taxiways and runways

Source: Airservices modified by ATSB

At about 0923 Eastern Standard Time,^[1] after the trainee had been in the surface movement control position for nearly 2 hours, the SMC took over in preparation for handing over the position to another controller. At that time, an Airbus A321-231 aircraft, registered VH-VWQ (VWQ) and operating Jetstar flight 730 from Launceston, Tasmania, landed on runway 27 and exited onto taxiway N and then E (Figure 1). After landing, the flight crew of VWQ contacted the SMC, who instructed them to hold short of runway 34.

At about the same time, a Boeing 737-838 aircraft, registered VH-VZB (VZB) and operating Qantas flight 610 from Melbourne to Brisbane, Queensland, had been pushed back from bay C8.

About 3 minutes after VWQ landed, it was still holding awaiting clearance to cross runway 34. Meanwhile, the flight crew of VZB requested clearance to taxi to holding point J of runway 34 for take-off. The SMC cleared VZB to ‘taxi via TANGO [T] and hold short of [taxiway] ALPHA [A]’ (Figure 2).

Figure 2: Airport diagram showing aircraft tracks

Source: Airservices Australia modified by ATSB

At 0927:43, the SMC cleared VWQ to ‘cross runway 34, taxi via ALPHA [A], hold short of JULIET [J],’ which was four intersections beyond taxiway T. As VZB was required to hold short of taxiway A, at that time, VWQ had right of way through the intersection of taxiways A and T.

Twenty seconds later (at 0928:03), the SMC commenced handover of the surface movement control position. He pressed the handover record button and selected the speaker on so the relieving controller (and the trainee) could hear all transmissions on the Ground frequency. The SMC then proceeded through the handover checklist. When ‘Traffic’ was the next item on the checklist, the controller said they would ‘work through this traffic as we go’. The relieving controller did not take over the position at that time.

At 0928:39, the SMC cleared VZB to continue via A to holding point K of runway 34.

As VWQ taxied along taxiway A and approached the intersection with taxiway T, the captain, seated in the left seat, sighted VZB approaching the intersection from the left (on taxiway T). The captain of VWQ assessed that the flight crew of VZB had not seen VWQ and that if both aircraft continued at their current speed, they might collide at the intersection. In response, he took control of the aircraft from the first officer (the operating pilot) and braked heavily.

At the same time, the flight crew of another aircraft requested clearance. The SMC responded to that request, and by the time he finished that transmission, the captain of VWQ had braked. The SMC, on looking out the window, had also seen the potential conflict and instructed the flight crew of VWQ to ‘give way to Qantas [VZB]’. When the captain of VWQ responded that the instruction was late, the SMC acknowledged the oversight.

Meanwhile, VZB continued through the intersection, taxied to holding point K for runway 34 and subsequently departed. The flight crew of VZB had not been aware of any potential conflict.

VWQ continued to taxi first to J then onwards to the bay (at 0931:06).

At 0935:25, 7 minutes after commencing the handover, the SMC returned to the checklist item of Traffic, completed the handover, and the oncoming SMC accepted handover of the position.

Electronic flight strips (Flight Data Elements)

It is possible to note a clearance limit on the flight strip (such as VZB being instructed to hold short of taxiway A). However, the SMC advised that controllers generally do not do this because the time it takes to do so makes it counterproductive to issuing fast, dynamic clearances.

A technique that controllers do use to remind themselves that a clearance limit has been issued and further instructions are required is to ‘cock’ the flight strip (Figure 3). This involves leaving the strip offset to the right side of the bay. The controller moves it to the left (‘uncocked’) when a clearance has been issued where no further instructions are required. The SMC advised that he used that technique.

This technique provides a visual trigger to remind controllers that there is an outstanding action. However, an uncocked strip when no clearance limit has been issued would not provide that cue, or alert to the potential for a proximity event.

Figure 3: Examples of flight strips cocked and uncocked

Source: Airservices Australia

Handover

It was standard procedure for a controller to hand over their position either at the end of a shift or to take a break, in this case after being in the position for 2 hours. The handover requires a division of attention between controlling traffic and communicating with the relieving controller. Along with a division of their attention, the controller’s workload increases as they pass required information to the relieving controller.

In preparation for handing over to the oncoming controller, the SMC had taken over from the trainee in actively controlling the traffic about 5 minutes prior to commencing the handover. He commented that the traffic was not necessarily sequenced the way he would have done it if he had been actively controlling and that he had taken over in order to get the traffic in a state that he considered ready to hand over.

Strategies used to mitigate the risks of the increase in workload and of divided attention at handover include the use of a checklist to ensure all vital information is passed on, and delaying the handover until there is a suitable lull in the traffic.

The controller used a checklist and started the handover, which was then delayed due to the volume of traffic. The controller commented that there is an element of distraction in having another person watching them while controlling, and having the transmissions audible on the speaker.

Previous handover occurrences

The ATSB has been notified of 13 occurrences since 2008 where the handover was identified as an influencing factor. A review of these occurrences indicated that the handover increases workload and requires a division of attention from actively controlling. The handover therefore increases the potential for errors.

Taxiway works

Melbourne Airport was conducting planned works as part of the airport’s taxiway maintenance program. The works were not directly related to the clearances issued to the two aircraft involved in this occurrence. However, the controller was planning and managing other aircraft around the taxiway closures. This reduced the efficiency of controlling taxiing aircraft, thereby increasing the controller’s workload.

Flight crew actions

Airservices Australia Aeronautical Information Publication En Route section 1.1-9 2.3.3.5 stated that the ‘separation of aircraft taxiing on the manoeuvring area is a joint pilot and controller responsibility.’

Safety analysis

Controller workload

Workload reflects ‘the interaction between a specific individual and the demands imposed by a particular task.’^[2]

In this occurrence, several factors increased the controller’s task demands and therefore his workload:

• a high volume of traffic associated with the morning peak period
• having recently taken over from the trainee in actively controlling the traffic
• ongoing taxiway works.

Additionally, and according to the European Organisation for the Safety of Air Navigation (2006),^[3] handover increases workload demands and distraction, which increases the risk of errors.^[4]

After commencing the handover, the controller forgot that he had issued VWQ clearance to taxi through intersection A/T, thinking that he had instructed the crew to hold short of T. Situations of high workload are likely to reduce memory performance.^[5]

When the controller then cleared VZB through the same intersection, a potential conflict resulted. His workload and distraction associated with the handover probably contributed to the delay in detecting the conflict. When the conflict was detected, other radio transmissions delayed the controller instructing the flight crew of VWQ to give way to VZB until after avoiding action had already been taken.

Managing workload during handover

Workload experienced by a controller at a given time is subjective and it is difficult to assess the increase in workload that can be managed before the error rate increases. Therefore, it is important to implement strategies to reduce the risk and potential consequences of errors due to high workload. A widely accepted strategy to reduce that risk is delaying the handover until a suitable lull in the traffic.

In this occurrence, there had been 5 minutes of almost continuous radio communications then a 30-second lull before the controller started the handover. After completing some of the checklist items, the controller then delayed detailing the traffic to the relieving controller. Had the handover been delayed until a longer lull could be expected, it may have reduced the risk of error. However, without any prompt to record taxiing instructions, the controller was still reliant on remembering the issued clearance limits.

Findings

This finding should not be read as apportioning blame or liability to any particular organisation or individual.

• The surface movement controller’s workload during handover probably contributed to him forgetting the taxiing instruction he had issued to VH-VWQ. Consequently, he issued a conflicting taxiing instruction to VH-VZB that resulted in a proximity event between the aircraft at an intersection.

Safety message

This occurrence highlights that increased workload and distraction can reduce performance and increase errors. In the air traffic control context, using tools/practices that reduce reliance on memory and delaying handover until lulls in activity can mitigate these effects.

The timely action taken by the captain of VH-VWQ to avoid a collision also demonstrates the importance of flight crew alertness while taxiing.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Orlady H.W. & Orlady L.M. 1999, Human Factors in Multi-Crew Flight Operations, Ashgate Publishing Ltd, Hants, England.
3. European Organisation for the Safety of Air Navigation 2006, Study Report on Selected Safety Issues for Staffing ATC Operations.
4. Loukopoulos, L.D., Dismukes, R.K. & Barshi, I 2009, ‘The Perils of Multitasking’, Aerosafety World, August 2009, pp. 18-23.
5. Van Benthem, K.D., Herdman, C.M., Tolton, R.G., & LeFevre, J.A. (2015), ‘Prospective memory failures in aviation: Effects of cue salience, workload, and individual differences.’ Aerospace Medicine and Human Performance, 86(4), pp. 366-373.

What happened

At 1253 Central Standard Time on 27 February 2014, a Boeing Company 737-8FE, registered VH-VOM (VOM), was radar vectored when outside controlled airspace, near Darwin, Northern Territory. Radar vectoring outside controlled airspace was not permitted, and may have brought VOM into conflict with aircraft that were unknown to air traffic control.

What the ATSB found

The ATSB found that weather in the Darwin area resulted in the majority of inbound aircraft diverting around storm cells. These diversions increased workload for the Approach East controller. The increased workload resulted in the controller using non-standard phraseology and not cancelling radar vectors prior to VOM leaving controlled airspace. Additionally, the flight crew of VOM had not reported ‘clear of weather’ as expected by the controller. This resulted in a lack of shared understanding between the flight crew and the controller.

What's been done as a result

Following this occurrence the Department of Defence introduced theoretical and simulator-based training to assist air traffic controllers to resolve unusual situations using clear communication and direction. The training reinforces positive and assertive control measures, skills that are especially necessary in high workload situations.

Safety message

This occurrence highlights that effective communication is essential for a shared understanding between flight crew and air traffic controllers. On this occasion, the use of non-standard phraseology by both parties resulted in different expectations and delay. Additionally, coordination between controllers is an essential component of their duties; however, this is not transmitted via radio. As a result, silence on an air traffic control frequency should not be interpreted by flight crew as an indicator of low workload for the controller.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Department of Defence
• aircraft operator
• air traffic controllers involved in the incident
• flight crew of VH-VOM.

References

Harris, D 2011, Human Performance on the Flight Deck, Ashgate, Surrey, England.

Kantowitz, BH and Casper, PA 1988, Human Workload in Aviation. In EL Wiener and DC Nagal (Eds) Human Factors in Aviation (pp. 157–187), Academic Press Limited, London, England.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the involved air traffic controllers, the flight crew and operator of VH-VOM, the Department of Defence, Airservices Australia and the Civil Aviation Safety Authority.

Submissions were received from the flight crew and operator of VH-VOM, the Department of Defence and Airservices Australia. The submissions were reviewed and, where considered appropriate, the text of the draft report was amended accordingly.

Context

Personnel information

The flight crew on VH-VOM (VOM) were appropriately licenced and held current medical certificates. A review of their recent sleep and work patterns identified no fatiguerelated issues associated with the occurrence flight.

Darwin Approach was staffed by three Department of Defence (Defence) air traffic controllers, the:

• Supervisor
• Approach West controller
• Approach East controller.

Each controller was correctly endorsed and a review of their recent sleep and work patterns did not identify any fatiguerelated issues. The Approach supervisor was also endorsed in both Approach East and West.

The Approach East controller was working part-time, predominately in an administrative role. The controller worked on-console sufficiently frequently to maintain the Defence controller recency requirements.

Airspace information

Defence was the controlling authority for the Class C airspace^[6] within 40 NM (74 km) of Darwin Airport and below Flight Level (FL)^[7] 180. Airservices Australia (Airservices) had jurisdiction for the adjacent airspace and both agencies liaised extensively to provide an air traffic service in the area. Defence controllers use the same control techniques as Airservices when controlling civil, or a combination of civil and military, aircraft.

Procedures in place at Darwin required the airspace to be split between Approach East and Approach West during periods of higher traffic levels. Splitting the airspace resulted in fewer aircraft on a controller’s frequency, but could increase the need for coordination between those controllers. The procedures also required a supervisor be present when the airspace was split, to assist the controllers with coordination and sequencing.

The lowest levels of the controlled airspace to the east of Darwin that were controlled by the Darwin Approach East controller were:

• ground level from the airport to about 5 NM (9 km), then
• 1,000 ft from 5 NM to 15 NM (28 km)
• 2,500 ft from 15 NM to 30 NM (56 km)
• 6,500 ft from 30 NM to 40 NM (74 km).

The next controlled airspace step, with a lowest level of 8,500 ft out to 50 NM (93 km), was under the jurisdiction of Airservices.

The airspace below the steps was classified as Class G. Aircraft are, in certain circumstances, permitted to operate in Class G airspace without radio communication equipment or a transponder. Accordingly, there are limitations in the effectiveness of flight information services and surveillance information services in that airspace.

Meteorological information

The wet season in the far north of the Northern Territory extends from about October to April. This is also when most of the region’s hazardous aviation weather occurs. The wet season is characterised by cloudy conditions, lengthy periods of heavy rain, occasional thunderstorms and fresh to strong squally winds. During that period, aircraft regularly request track changes to avoid storm cells.

Controller responsibilities

Air traffic controllers are responsible for providing an air traffic service within the airspace under their jurisdiction. Such a service includes issuing clearances and information to prevent collision between aircraft and expediting and maintaining an orderly flow of traffic to and from the airport. The specific responsibilities of the Approach East and the Approach West controllers were dependent on the runway configuration in use at Darwin. When runway 29 was in use, the:

• Approach East controller was responsible for:
• arriving aircraft within the eastern portion of Darwin’s airspace
• sequencing aircraft arriving from the western portion of Darwin’s airspace
• separating arriving aircraft within the eastern portion of Darwin’s airspace with departing aircraft entering that airspace.
• Approach West controller was responsible for:
• aircraft in the western portion of Darwin’s airspace
• separating departing aircraft within the western portion of Darwin’s airspace with arriving aircraft entering that airspace
• issuing departing aircraft that will enter the eastern portion of Darwin’s airspace a separation-assured heading without prior coordination.

Further, procedures in place at Darwin stipulated that aircraft departing Darwin were to remain on the Approach West frequency as much as practicable.

The Approach East controller liaised with the Approach West and the Tower controllers to ensure the landing sequence was understood. Coordination was also required with the Airservices controllers responsible for the adjoining airspace.

The Approach Supervisor was responsible for, among other duties:

• supervising and coordinating the work of the Approach controllers
• planning traffic flow
• maintaining a constant liaison with the Tower supervisor regarding relevant weather information.

The Approach Supervisor who was responsible for monitoring controller workload on the day of the occurrence advised that they were aware that workload was high for the Approach East controller. They further stated that the traffic levels had built up quickly and, in response, they had taken on some of the controller’s tasks, predominately coordination with other agencies and sequencing.

Radar vectoring

The provision of navigational guidance to an aircraft in the form of specific headings, based on the use of an air traffic surveillance system, is known as radar vectoring. However, unless an emergency situation existed, aircraft were not to be radar vectored in Class G airspace.

One reason a controller can vector an arriving aircraft is to establish an orderly landing sequence at the airport. When an aircraft is vectored by a controller, the responsibility for navigation and terrain clearance is transferred to the controller.

When issuing an initial vector, the controller should advise the flight crew of:

• the reason for the vector, unless that reason was obvious
• the extent of the vector in general terms
• a tracking expectation at the completion of the vector.

On completion of vectoring, specific phraseology is to be used by the controller to transfer responsibility for navigation and terrain clearance back to flight crew. This phraseology includes advice to the aircrew of the aircraft’s position.

When aircraft leave controlled airspace, the controller is responsible for providing advice on other aircraft in the area. The other aircraft may either be observed, or known to be, in potential conflict with the aircraft leaving controlled airspace. The controller would be aware of aircraft in Class G airspace that had contacted them, or that were visible on their surveillance radar display. An additional source of information would be to liaise with the controller responsible for the provision of a flight information service (FIS) or a surveillance information service (SIS) in that area.

Flight crew responsibilities

Flight crew hold responsibility for the safe operation of their aircraft. On occasion, air traffic control assume responsibility for some aspects of flight, for example terrain clearance and navigation (see the section titled Controller responsibilities).

When a clearance is been requested by flight crew to deviate around weather, flight crew should advise air traffic control when the weather diversion is no longer required. This is done using the phrase ‘clear of weather’. Where circumstances warrant, and no documented phraseology is deemed appropriate, flight crew should use clear and concise plain language to indicate their intentions.

Similar occurrences

A review of the ATSB database did not identify any similar occurrences.

__________

6. Class C airspace: Controlled airspace surrounding major airports. All aircraft require an air traffic control clearance for operations in this airspace.
7. At altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 180 equates to 18,000 ft.

The occurrence

On 27 February 2014, a Boeing Company 737-8FE (737), registered VH-VOM (VOM), was being operated on a regular public transport flight from Sydney, New South Wales, to Darwin, Northern Territory. The arrival of the aircraft at Darwin coincided with the presence of a number of thunderstorms in the area (Figure 1).

In order to reduce the workload of the Approach controller associated with diverting arriving and departing aircraft around the storm cells, the air traffic control (ATC) approach unit responsible for the airspace within 40 NM (74 km) of the airport had split the airspace in to two control sectors. The division of airspace occurred along a line north-south through Darwin Airport, and each area (designated East and West) was under the control of separate Approach controllers operating on different radio frequencies.

Figure 1: Darwin weather radar picture at 1236 Central Standard Time^[1] showing rainfall associated with thunderstorm cells. The approximate location of VOM at that time is indicated by an arrow showing direction of travel. The range rings are at 50 km (27 NM) and 100 km (54 NM)

When the Approach East controller commenced their shift at 1230, the handover included details of four arriving aircraft in their airspace, and three arriving aircraft in the airspace under the jurisdiction of the Approach West controller. The majority of aircraft were not on their flightplanned track as they were diverting around storm cells. In addition to the arrivals, a number of aircraft departed Darwin during the development of this occurrence, including:

• Two aircraft heading to the south-east, through the airspace under the jurisdiction of the Approach East controller. These aircraft were tracking to air routes that were laterally separated from the tracks of aircraft inbound from that general direction.
• One aircraft that tracked to the north then returned to Darwin. This aircraft was instructed by the Approach East controller to hold overhead a visual point to the north of the airport for sequencing.
• Two aircraft heading to the north-east. One tracked low level and well clear of arriving traffic. The other tracked through the arrival track of an aircraft under the jurisdiction of the Approach East controller, requiring the controller to maintain a vertical standard between the two.

As a result of the traffic level, the workload for both controllers was relatively high.

At 1246, the Approach East controller advised the Tower controller of the landing sequence for runway 29. The sequence included six aircraft, with VOM fifth in the sequence. One other aircraft was also sequenced for runway 36, which crosses runway 29.

The weather on the day of the incident was typical for the Northern Australian wet season (see the section titled Meteorological information). The flight crews of the majority of aircraft in the Darwin area had been given approval by ATC to track around the storm cells. The crew of VOM intended to track for Howard Springs and then conduct an instrument landing system (ILS)^[2] approach for runway 29 (Figure 2). Additionally, the flight crew of VOM had been approved to operate up to 5 NM (9 km) either side of their intended track to avoid the storms.

Figure 2: Darwin weather radar picture at 1246 showing the approximate location of VOM while avoiding storm cells

The aircraft sequenced to land ahead of VOM on the ILS was considerably slower than VOM. To ensure separation between the aircraft on final for runway 29, at 1247 and with the aircraft 16 NM (30 km) south-east of Howard Springs, the Approach East controller cancelled the approach procedure issued to the flight crew of VOM and radar vectored (see the section titled Controller responsibilities) the aircraft right on to a heading of 360°. When the crew of VOM were issued with the radar vector, the preceding slower aircraft was 3 NM (6 km) east of Howard Springs and 14 NM (26 km) north-west of VOM, with a ground speed of 120 kt. At that time, VOM was indicating a ground speed of 260 kt.

The controller later reported that their intention had been for VOM to remain on the vector for only a short period of time. However, prior to cancelling the vector and clearing the aircraft direct to Howard Springs, at 1248 the flight crew of VOM requested a right turn heading 050° to avoid storm cells. The controller approved the diversion, instructing the flight crew to turn right on to a heading of 050° and asked them to report when they were ‘clear of weather’. In response, they advised the controller that ‘…we’re sitting in a big hole at the moment but there is weather out to the north of us and down to the south...’. The flight crew did not specifically advise the controller that the aircraft was clear of the storm cell.

Two minutes later, the flight crew of VOM requested to turn further right onto a heading of 100° to avoid weather. In response, the controller vectored the aircraft onto that heading. As VOM was heading away from Darwin, the controller changed the landing order of the aircraft arriving at Darwin. The aircraft that was to land after VOM was then resequenced ahead. Additionally, as VOM was tracking towards the edge of controlled airspace, 30 NM (56 km) east of Darwin, the Approach East controller advised the flight crew that their current track would shortly take the aircraft outside controlled airspace. When the controller asked the crew to advise their intentions, they stated that ‘… we’d like to come further right to join the ILS…’, but again did not report clear of weather.

Airservices Australia (Airservices) is responsible for providing the flight information service (FIS)^[3] and, workload permitting, the surveillance information service (SIS)^[4] in the Class G airspace^[5] adjacent to Darwin’s controlled airspace. At about this time, the Darwin Approach Supervisor advised the Airservices controller who was responsible for those services that VOM was about to leave controlled airspace to the east. The Airservices controller responded that there was no known traffic outside controlled airspace.

At 1252, VOM left 5,500 ft on descent to 4,000 ft as the aircraft left controlled airspace east of Darwin, heading 100°. At that time, the Approach East controller did not advise the flight crew of the aircraft’s position and any known traffic in the area. Additionally, the crew were not advised that they were required to resume their own navigation (see the section titled Controller responsibilities).

Twenty seconds later, when VOM was about 31 NM (57 km) east of Darwin, the flight crew requested a right turn to head 180°. The controller initially issued the radar vector, but, realising that the aircraft was outside controlled airspace, immediately cancelled the radar heading. Shortly after, the flight crew resumed their own navigation and tracked south.

The flight crew later reported that, due to the extent of the storms, the aircraft would not have been clear of weather and able to manoeuvre unrestricted until about 30 to 35 NM (56 to 65 km) east of Darwin.

The flight crew then requested to climb the aircraft into controlled airspace; however, this was not available due to an aircraft in that area at 7,000 ft tracking towards Darwin. At 1254, and with the aircraft 36 NM (67 km) east of Darwin, the flight crew of VOM were issued a clearance to track direct to Howard Springs. VOM re-entered controlled airspace at 1255 and subsequently landed at Darwin Airport via runway 29 at 1309.

__________

1. Central Standard Time (CST) was Coordinated Universal Time (UTC) + 9.5 hours.
2. A standard ground aid to landing, comprising two directional radio transmitters: the localizer, which provides direction in the horizontal plane; and the glideslope, for vertical plane direction, usually at an inclination of 3°. Distance measuring equipment or marker beacons along the approach provide distance information.
3. Flight information service (FIS): A service provided for the purpose of giving advice and information useful for the safe and efficient conduct of flights.
4. Surveillance information service (SIS): An on-request service provided to assist pilots of visual flight rules flights, within air traffic service surveillance system coverage in Class E and Class  G airspace, to avoid other aircraft or to assist in navigation.
5. Class G airspace: Uncontrolled airspace where aircraft operate without a clearance.

Safety analysis

Introduction

Thunderstorms in the Darwin area resulted in the majority of inbound aircraft tracking around storm cells, increasing the workload for the flight crews and the air traffic controllers. The flight crew of VH-VOM (VOM) had requested heading changes to avoid the weather that resulted in the aircraft tracking away from Darwin Airport. Ultimately, the aircraft exited controlled airspace without the required cancellation of radar vectoring. The controller subsequently issued a radar vector to the flight crew of VOM while the aircraft was outside controlled airspace. The following analysis will examine the various factors that led to this occurrence.

Controller workload

While the number of aircraft on the Approach East frequency was not high, the majority were diverting around storm cells. These diversions increased the controller’s workload as the arrival sequence became more complex and required increased levels of coordination. The situation was also exacerbated by a number of aircraft holding in the area.

The Approach East controller reported that their workload was higher than normal and that they were approaching their limit. As workload increased, the controller reported that they were spending additional time checking what they were doing, thus introducing a delay in communicating with flight crew. The supervising controller had recognised the controller’s workload and was assisting primarily with coordination and sequencing.

High workload is associated with an increase in error rate, and can also adversely affect an individual’s response to error (Harris, 2011 and Kantowitz & Casper, 1988). Time spent by a controller monitoring, but not communicating with, traffic was higher when dealing with ‘peak levels of air traffic’. This suggests that monitoring the traffic created a higher cognitive load than would be expected (Kantowitz & Casper, 1988).

In this occurrence, it is likely that the high level of workload resulted in increased monitoring. This added to the level of workload for the Approach East controller and reducing their ability to plan. As VOM approached the airspace boundary, standard phraseology was not used to advise the aircrew of their position and to transfer responsibility for navigation and terrain clearance back to the flight crew. This was likely due to the higher cognitive load being experienced by the controller.

The flight crew subsequently requested a heading change ‘due weather’, despite the aircraft being outside of controlled airspace. This was the third such request from that crew and, combined with the already high workload, the controller inadvertently responded by issuing a radar vector.

Additionally, on two separate occasions, the Approach East controller started, but did not complete, transmissions to the flight crew of VOM. These clipped transmissions were, more than likely, unfinished due to workload associated with completing coordination with other controllers. That workload prevented the controller from seeking clarification on possible headings that would have been acceptable to the flight crew.

Flight crew expectation

Due to aircraft in the airspace controlled by the Approach East and Approach West controllers being on different frequencies, the flight crew of VOM were not aware of all of the traffic in the Darwin airspace. Additionally, the flight crew were unaware of the higher than normal level of coordination being undertaken at the time, as this was not transmitted over the radio. As a result, the flight crew had no way on knowing the full extent of the controller’s workload.

When the flight crew of VOM acknowledged the Approach East controller’s advice that the aircraft would be going outside controlled airspace on the crew-requested heading, the crew should have been advised by the controller:

• of the aircraft’s position
• to resume their own navigation
• of any known traffic in the area.

In the absence of this information, the flight crew may not have understood the full implications of continuing on the crew-requested heading into uncontrolled airspace. That the flight crew requested another radar heading while outside controlled airspace supports this possibility.

The flight crew later reported that, following their request for vectors due weather, they expected that the aircraft would be vectored to commence the instrument landing system approach.

Controller expectation

When issuing the radar vectors to the flight crew of VOM to avoid the storms, and in accordance with documented requirements, the controller advised them to report clear of the weather. While the crew did respond to the controller advising of the surrounding weather, the controller was waiting for specific phraseology prior to facilitating the aircraft’s approach to Darwin Airport. Without that report, the controller believed that the flight crew were actively involved in avoiding storm cells.

Further reinforcing the controller’s belief was the flight crew’s acceptance to leave controlled airspace on the heading that the crew had requested in order to avoid weather. If the flight crew had advised an acceptable heading or how much longer the current heading was required, that may have assisted the Approach East controller to vector the aircraft for the instrument landing system approach. That represented a missed opportunity for common understanding.

Controller proficiency

Conditions that exacerbate error rate under high workload include inexperience with a task (Harris, 2011). Though the Approach East controller was correctly endorsed, their primary duty was administrative. To maintain endorsement recency, a controller was required to perform air traffic duties for a minimum number of hours over a stipulated time period.

While the controller met the recency requirements, given they were conducting part-time duties as a controller, their exposure to the Approach environment was ad hoc. This exposure, compounded by the onset of the wet season, may have resulted in a higher error rate compared to colleagues that were more routinely exposed to busy traffic sequences.

At the time of this occurrence, the Department of Defence was developing a number of simulator packages to enable Darwin air traffic controllers to gain experience in unusual operations. These packages, which were introduced in 2015, also help controllers maintain their skills during the dry season in readiness for the increased workload and complexity often seen during the wet season.

Findings

From the evidence available, the following findings are made with respect to the airspace event involving Boeing 737, registered VH-VOM, near Darwin, Northern Territory on 27 February 2014. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The non-standard phraseology used by the Approach East controller, just prior to VH-VOM going outside controlled airspace, did not emphasise that responsibility for navigation, terrain clearance and separation from other aircraft was being transferred to the flight crew.
• Despite the flight crew of VH-VOM providing an indication of the weather in the area, they did not comply with the requirement to specifically report ‘clear of weather’.
• A lack of a shared understanding between the flight crew of VH-VOM and the Approach East controller as to what was required from the other before the aircraft would be re-cleared to Darwin, delayed resolution and resulted in the aircraft exiting controlled airspace under radar vectors.
• While the Approach East controller met the Department of Defence recency requirements, working part-time in an administrative position limited their exposure to the tasks associated with controlling busy traffic sequences in adverse weather.
• A combination of the controller's recent and overall experience, traffic levels and the significant weather in the Darwin area, significantly increased their workload.
• The combination of the high workload and the previously issued vectors while VH-VOM was inside controlled airspace led to the controller inappropriately issuing a radar vector to an aircraft outside controlled airspace. This increased the risk of bringing VH-VOM into conflict with aircraft that were unknown to air traffic control.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.