Sometimes after an incident, a system-wide change is implemented that makes work more difficult and creates new problems. This story is one such example, which contains useful lessons for responding to rare events. Steven Shorrock recounts the tale.
KEY POINTS
- When reacting to individual incidents, interventions can present additional unintended consequences that were never foreseen or predicted during traditional safety assessments.
- Multiple changes at the same time impact performance in ways that may not be imagined.
- When planning a change in practice, speak to a variety of stakeholders, especially front-line practitioners, to understand the work, the context of work, the tools, and the history of the situation that the change seeks to address, and to get their views on possibilities for change.
This story takes place in a busy dual runway airport, where movements are restricted to daytime hours. Outside of those hours, one runway is kept one open and the other is closed for essential maintenance.
The drivers at the airport had a well- established process that they followed every night when they turned up to work for a night shift. The usual practice was that, on arrival for duty, drivers entered the office and checked a board on the wall for the live status of the runway – open or closed. The driver would then get into the vehicle, perhaps perform some tasks around the airport, and drive over to the runway. At this airport, drivers were required to call tower when approaching a runway for crossing, but not when leaving the apron and entering a taxiway. As drivers approached the runway, they had to contact tower if the runway was open, or contact the airside office if the runway was closed. If a driver were to call the airside office to cross or enter the runway when it was open, the driver would be were told to contact tower.
One night, a driver (Driver 1) approached one of the runways in his vehicle, believing that the runway was closed. During the period that the driver had been out, the runway had reopened for a planned late arrival. While the procedure was to contact the airside office to check before entry, the driver did not do this on this occasion. A runway incursion resulted.
At the time of the runway incursion, another airside vehicle (Driver 2) approached the runway from the opposite direction and saw Driver 1’s vehicle cross the runway. Driver 2 called tower to cross the runway, because this driver knew that the runway was open. But Driver 2 had not heard Driver 1 contact ATC on the same frequency, and queried whether Driver 1 had clearance to cross the runway. Driver 2 was informed that Driver 1 did not have clearance.
Driver 1 was suspended pending an investigation. While this could not be confirmed, it was believed that local practice had changed, and that drivers had stopped calling the office due to the number of calls generated and the associated workload. During the period of the runway incursion, there were significantly more runway crossings than usual, and calls were more frequent. But ultimately, the reasons for the runway incursion were never fully understood. Crossing the runway without calling the airside office may have been deliberate, reflecting local practice, or may have been inadvertent – an unintended crossing.
At the time of the runway incursion there were no aircraft movements on the runway, but this was sheer luck. This was, however, the first time that a runway incursion in these circumstances had occurred.
The first intervention
At the time of the incident, there was pressure to reduce runway incursions and ground movement events, which had become tracked metrics and key performance indicators (KPIs). There was an expectation that a certain number of runway incursions per 100,000 movements would not be exceeded. This was also tracked by the airport as a company performance target.
The next day, airside management made a decision. No vehicle was to enter any runway – open or closed – without contacting ATC. The airside office was now out of the loop.
The ANSP put out an instruction to controllers detailing the new protocol. Thereafter, vehicles began to call tower regardless of whether the runway was open or closed. The procedure for drivers was clear.
Aerodrome lighting changes
At the time, another change concerning aerodrome lighting had been imposed upon the airport by the regulator. Two significant changes were therefore made at the same time. This caused confusion for ATCOs, but the airport was committed to the lighting change and the ANSP was instructed by the airport to implement the runway access change.
Stop bar usage
The tower was also required to change the operation of stop bars. The system was based on a timer, so the controller would press one button to extinguish the stop bar to provide a route across the runway and a timer would then illuminate the bar a few seconds later. At the time of the runway incursion, this timer system was inoperative. Controllers therefore had to extinguish the bar, then illuminate it for every vehicle accessing the runway. On a normal evening that would be 30 to 40 crossings a night. But there was still heavy traffic departing and arriving on the active runway. So now controllers had to give a crossing clearance, extinguish the bar, watch the vehicle cross the runway, then illuminate the bar again. This took away focus from the aircraft taking off and landing on the live runway. The tower had never done this apart from in low visibility procedures.
Unintended consequences
Workload was now higher due to increased calls and increased monitoring load. Controller attention was now divided between the active and closed runways, with 30 to 40 driver requests to cross the closed runway. Controllers were also confused about the idea of giving vehicles a clearance to cross a closed runway, and did not know what do with the stop bars on the closed runway.
Everyone did their job according to work-as-prescribed. But as a result, the whole system was in disarray. Several safety reports were submitted.
Adaptation and adjustment
In the intervening period, controllers conducted their own informal hazard analyses within their own teams and made decisions about how to work safely. But there were now three or four systems in place, all acceptable, but each different. This meant that anyone who transferred between those teams faced a different working method.
The second intervention
The Head of ATC observed nighttime operations to understand the impact and issued a condition not to give the runway to the airside office until after the last aircraft movement. The ANSP put out an instruction to controllers detailing the new protocol.
The runway now remained under ATC control until after the last aircraft movement. Controllers could now focus on aircraft landing and taking off. This protected the operation and gave controllers time to think.
The downside to this was that the airside office would not get that runway to work on until about one hour later than it would normally be worked on.
The third intervention
The ANSP and airport now searched for a long-term, collaborative and viable solution. The ANSP started a review process lasting around six months. The final intervention involved individuals from all watches and face-to-face briefings with every controller to get their input. Drivers and controllers met up regularly in workshops, then bringing in airside and ATC managers, feeding upwards a range of options. These were reviewed at all levels to come up with a workable and safe process.
The agreed solution was that when the runway is given away, there is a single agreed entry/exit point, with airside staff briefed accordingly. The red stop bar is extinguished. If a vehicle approaches and the status of the runway has changed since they left the office, the driver will stop at the red bar and call ATC.
The final system satisfied all stakeholders. The airport office received the runway at the same time that they normally would have, and controllers were not distracted from their primary task. There was therefore a balanced consideration of different stakeholder needs. There were no more safety reports.
This post is a reproduction of an article published in HindSight magazine issue 28 in February 2019 on the theme of ‘Change’ (all issues available at SKYbrary)
Humanistic Systems 