When President Ronald Reagan said, “Trust but verify,” it was uttered in the context of strategic nuclear arms control. But it also can be applied to aviation. Herewith, two examples:
Example 1: Safety Defenses Breached in Landing Attempt
“The inadvertent slip by the approach controller was the final action of a number of lapses or omissions that led the pilots to believe that the ILS [instrument landing system] was available, despite previous advice,” said the report of the Australian Transport Safety Bureau (ATSB).
The holes (breaches) in the layers of swiss cheese (the safety defenses) lined up nicely in this incident, although fortunately the airplane, a B737-800 on a passenger flight from Melbourne to Adelaide on March 9, 2004, didn’t crash. However, the incident might have had a different outcome in night instrument meteorological conditions (IMC), and it does point out that habit patterns of air traffic controllers can be dangerous.
The crew was alerted to their plight by the airplane’s enhanced ground proximity warning system (EGPWS).
The copilot was flying, and both pilots were aware of a current notice to airmen (NOTAM) that the ILS was radiating intermittently on test and was not to be used for navigation.
During the turn onto final, the aircraft’s instruments indicated that the ILS was operating (glideslope OFF flags disappeared, needles “alive,” localizer broadcasting the ILS identifier), and the approach controller instructed them to make an ILS approach.
They did so, but about 20 seconds later the EGPWS announced a SINK RATE caution. The pilot in command assumed control of the aircraft and arrested the rate of descent. During that maneuver the EGPWS announced a PULL UP warning.
Information from the aircraft’s flight data recorder indicated that the airplane had descended to 1,180 feet above ground level at a maximum rate of descent of 6,100 feet per minute.
It turns out that the pilots had seen only two of three NOTAMS on the runway 23 ILS. The third one had been issued at the time they were enroute. Moreover, Adelaide control had shortened the information on the computerized automatic terminal information system (CATIS) that is used to broadcast operational information to pilots. The CATIS message indicated “localizer available,” but information that the glide path (GP) was not available was not included. As the ATSB report noted, “Consequently, when the pilots reported on first contact with the approach controller that they had received the CATIS, they were unaware that only the localizer was available.” There is a subtle difference between GP not available (i.e., not radiating) and “not available for use.” That vital distinction is rarely made by air traffic controllers in an oral exchange.
The approach controller was aware of the non-availability of the glideslope due to its being on test calibration, but forgot to make a note to this effect for his display. He later told investigators he forgot that the glide path was not available for use, and reverted to his normal radio phraseology for aircraft on final.
Result: the EGPWS warning to the flight crew.
There were 19 recommendations coming out of this incident, the last nine of which were expected to be put in place June 30.
As indicated, most of the holes in the swiss cheese analogy were lined up, but the final defense, the EGPWS, saved the day. (See the ATSB report at http://www.atsb.gov.au/aviation/occurs_detail.cfm?ID=612)
Example 2: Plane Lands on Closed Runway
In a similar vein, we present the April 29 Japanese air traffic control error by not one, but all 18 Haneda Airport duty controllers:
On April 29, a passenger plane landed at night on a runway closed for repairs at Tokyo’s domestic airport because of an error by air traffic controllers. Japan Airlines (JAL) Flight 1158, an A300 from Obihiro, northern Japan, landed on the closed runway at Haneda Airport 10 minutes after it was opened to construction workers, according to Kenichi Kohashiguchi, an official at the Transport Ministry‘s accident investigation commission. The captain twice asked for confirmation before finally landing after the runway had been closed for repairs.
Flight 1036 from New Chitose Airport in Hokkaido was also directed by controllers to land on the closed runway. The captain was about to touch down, but decided to abort the landing after receiving inconsistent instructions. He eventually landed on another runway.
Controllers Forgot Runway Was Closed
The errors occurred because air traffic controllers forgot the runway was closed for construction, a Transport Ministry official told a news conference later as he apologized for the near mishap. Eighteen air controllers were on duty in approach control and the tower at the time, and none of them noticed, he said. Despite the repeated requests for confirmation, the controllers only became aware of their mistake when another controller, on standby for a late-night shift, reminded them of the closure.
“We later found out that all of the duty controllers had forgotten about the runway closure,” ministry official Yoshinori Furukawa told the televised news conference. Even unusual questioning by the pilots of their landing instructions didn’t prompt the controllers to remember the runway closure. Investigators found that the ATC notice-board used for disseminating upcoming safety crucial matters at Haneda was so clogged with trivia that highly relevant material was overpinned by inconsequential material. The 18 controllers have now been taken off regular duty for retraining to prevent a recurrence, according to ministry officials.
Asked by one pilot if it really was the right runway, a controller had responded, “There is no mistake,” public broadcaster NHK and Kyodo News agency quoted Transport Ministry officials as saying.
According to the officials, the controllers were informed in March of the scheduled maintenance work. The deputy chief controller was scheduled to remind the shift of the closure at a meeting on April 29, earlier on the day of this incident, but did not do so. No one raised the issue at the meeting. Because maintenance usually takes place late at night, the deputy chief admitted being unaware that the closure would take place during the shift, the officials said.
“Trust but verify” only works when specifics are challenged assertively.