Chris Johnson: Linate Resources

Re-Analysis of the Linate Accident

This project reviews the Linate Accident. The analysis will concentrate on the ANSV report and investigation. The aims of this work are to:

to show how the existing recommendations relate to the root causes identified in the existing report.
to use recognised accident analysis techniques to identify additional recommendations that might be derived from this accident.

Executive Summary of this Report: This project analysed the ANSV report into the Linate runway incursion. The investigation began by first constructing a detailed timeline of the events leading to the collision. The ANSV perform a valuable service in promoting the cause of Safety Management Systems but arguably could go further in looking at the specific lessons that Linate offers for the operation of those systems in the future. Any risk-based decision to continue operations must consider not only the likelihood of an accident occurring, for instance under reduced visibility conditions. It must also consider the likelihood of successfully coordinating any emergency activities should an adverse event occur. Many of the ANSV's recommendations focussed on establishing conformance with national and international regulations. They also provided high-level guidance on the development of safety management systems. In contrast, we focus on the reasons why the runway and taxiway markings did not conform to ICAO and other requirements. Similarly, we examine the reasons why the Cessna was 'allowed' to fly under low visibility conditions. We also look at the technical and organisational reasons why ATM personnel failed to curtail operations as they faced worsening meteorological conditions and rising workload with minimal ground based technical support. The closing sections analyse the reasons why an inadequate emergency response placed additional lives at risk, including those of other aircrews, passengers and the rescue services.

We identified a number of additional recommendations based on the lessons learned from this accident:

Additional Recommendation 1: The official report does not explicitly consider the various conditions under which ATM personnel should call for a suspension or reduction in operations. The report largely focuses on Safety Management Systems. It is argued that these might have provided improved runway signage and automated support, for instance through ground radar systems. Ultimately, however, it remains the responsibility of ATM staff to determine when operating conditions exceed the capacity of the systems that they have available. Lenate provides valuable lessons in when to decide that safe operational bounds have been exceeded.
Additional Recommendation 2: One of the lessons from Linate is that ATM personnel need to understand that the same environmental conditions, which make ground-based collision more likely, will also frustrate rescue efforts. It is unlikely that ground- based radar would have provided a panacea for the coordination problems that frustrated immediate attempts to rescue any survivors. It is fortunate in this case that additional lives do not seem to have been lost through the delay in locating the aircraft. The difficulty of mitigating the consequences of adverse events should inform the risk-based management of operations.
Additional Recommendation 3: In addition to the provision of ground movement radar, future investigations might consider the suitability of image intensification and thermal imaging systems for use by emergency personnel. Ground radar systems may help to reduce the likelihood of collision but they cannot eliminate it. If such a collision does occur then the radar should enable the Tower and Ground personnel to locate the site of a potential collision. However, the problem remains that emergency personnel have to navigate in reduced visibility to the site of an accident. As shown in Linate, this site can be extremely difficult to find if one of the aircraft involved is a small commercial or General Aviation aircraft. Night vision devices are now widely available and are relatively low cost. With appropriate training, they might help rescue crews to locate the site of an accident. They might also play a role in helping rescue vehicles avoid other aircraft whose crews are unaware of their presence; this issue is discussed in more detail in the following paragraphs.
Additional Recommendation 4: The events of Linate ought to be publicized more widely to ATM staff. Not simply to illustrate the importance of Safety Management Systems but also to illustrate the critical need to take additional precautions in the aftermath of adverse events.
Additional Recommendation 5: It is important that future accident reports explicitly consider the management and organizational structures that were in place prior to an accident so that readers can clearly identify the impact that they might have had upon the course of an adverse event. As later sections will show, this is particularly important for the credibility of any recommendations that focus on the role of safety management systems. It is difficult to clearly understand the ways in which these systems might have been improved if readers cannot identify the reporting structures that held when an accident occurred.
Additional Recommendation 6: There is good reason to believe that the infrastructure at Linate, in terms of technical equipment, operating procedures and signage, might have been improved to a point where the accident would have been prevented if they had followed the recommendations from the European Action Plan for the prevention of runway incursions. However, these were made after the accident. It is, therefore, critical to monitor the manner in which these recommendations have been interpreted and implemented at a local level if we are to be sure that they are to have their intended effect on system safety.
Additional Recommendation 7: Safety management systems often imply the use of risk-based techniques not simply to analyze the barriers that may prevent accidents from happening in the first place, for instance by ensuring adequate signage that complies with ICAO requirements. They can also be used to identify key technical and organizational requirements for mitigating the consequences of any adverse event that does occur. The Linate collision provides numerous examples where inadequate preparation could have exacerbated the outcome of the accident. The staffing of the UCT-DCA group is one example.
Additional Recommendation 8: ATM personnel at Linate had to control a runway environment that was poorly documented and included markings that were both inconsistent and confusing. The piecemeal decisions to introduce and then 'abandon' the additional parking stands were symptomatic of wider problems that stemmed from the management of change. Linate first had to cope with an expansion of traffic and then adjust as traffic was moved to Malpensa. The ANSV report does not analyze these changes in any detail. However, it seems possible that these changes were seen in purely operational terms without a full analysis of the impact that they might have had both on operating procedures and on the runway environment. In the future, organizations such as EUROCONTROL might invest limited resources to study how other industries take a more systemic approach to change management so that we might avoid the ad hoc and piecemeal changes that were apparent at Linate.
Additional Recommendation 9: The more detailed analysis of the runway environment prior to the Linate collision shows that a number of decisions seem not to have been properly documented. For example, the ANSV report describes the lack of documentation about the decision to permanently introduce the additional parking stand markings. Similarly, such changes seem not to have been communicated to ATM personnel in documentation that was provided to the Tower. In the future, ATM organizations might reconsider the importance of documentation and traceability within their operational procedures. For example, an increasing number of organizations working in non-safety critical industries are using document management systems and the ISO9000 suite of standards to provide quality and performance metrics.
Additional Recommendation 10: Consideration should be given to the additional workload imposed on ATM personnel operating mixed-mode runways that service both commercial and general aviation. This workload will differ depending on the proportion and total volume of traffic in each category. It will also vary in relation to environmental conditions. It is surprising that existing regulations governing high, medium and low traffic flows in low visibility conditions seem to ignore the characteristics of that traffic. They are purely defined in terms of numbers of 'operations' rather than the mix of traffic and Linate shows that this mix plays a critical role in determining workload when commercial and other forms of traffic must share a runway.
Additional Recommendation 11: In addition to the high-level guidance provided by the ANSV report and by the various international working groups on the prevention of runway incursions, there is a need for very specific and detailed guidelines on how to assess the environment for ATM staff who are responsible for the safe operation of runways and taxiway. These guidelines should not simply be devolved to line management or to the runway safety groups that have been proposed. There must also be some line for appeals to be made to a higher authority should a review reveal the need for more sustained 'root and branch' reform of current working practices, signage and technical equipment.
Additional Recommendation 12: Advice should be provided by organizations such as EUROCONTROL about what to do when national organizations postpone safety improvements in anticipation of European or other international initiatives. A risk- based approach could be advocated where national operators must explicitly document and justify the decision to postpone the introduction of a safety critical system, such as the NOVA SMGCS radar. It seems clear that the desire to conform or harmonize with wider European initiatives should not place passengers lives at undue risk.
Additional Recommendation 13: The Überlingen accident illustrates the importance of conducting explicit risk assessments when planning major upgrades to ATM infrastructure. The European and international working groups have also argued that risk assessments should be made at regular intervals to assess the likelihood of runway incursion. Our analysis of Linate also suggests that risk assessments should be required whenever a planned upgrade is postponed. Such an analysis would ensure that the temporary erosion of technical support does not create an undue risk during the transition between old and new systems.
Additional Recommendation 14: The level of traffic should be determined by a combination of the mode balance, commercial or civil, the total number of movements and the prevailing meteorological conditions. Current distinctions between low, medium and high traffic movements are relatively meaningless without this additional contextual information. Further research might be conducted to provide ATM staff and supervisors with simple mnemonics and other aide-memoires that could help them to make decisions about workload when they are faced with changes in their operational environment.
Additional Recommendation 15: Aircrews are a 'last resort' for objective information about prevailing meteorological conditions. Automated instruments and standardised metrics should be used wherever possible. If this is impracticable then aircrews must be explicitly told about the criteria to be applied when making such judgements. ATM personnel must also ensure that aircrews are prompted to provide this information.
Additional Recommendation 16: Our analysis of the ANSV report has shown how difficult it was to determine the visibility levels. This, in turn, made it difficult to identify what levels of traffic and equipment provision could safely be tolerated . ICAO and ENAV recommended different approaches. This previous analysis focused on the ATM perspective. Further analysis should also be conducted to determine whether aircrews could use existing ATIS and other information resources to unambiguously determine the operational status of runways, including Cat level.
Additional Recommendation 17: The onus should be on the crews to ensure eligibility at the point at which they make a request as they are in the best position to understand their classification and license status. Aircrews could usefully be reminded of this obligation and greater effort should be made to ensure that they can unambiguously determine their rights and responsibilities from information sources such as ATIS (see recommendation 16). The intervention of operational ATM personnel to check such permissions should only be relied upon as a last resort.
Additional Recommendation 18: The onus is currently on ATM and ground personnel to check the eligibility of aircrews to perform the operations that they request. It is unrealistic to expect reduced number of ATM personnel to conduct such checks while controlling large numbers of other aircraft. Spot checks made by other ground personnel prior to flight are of only limited value; crews argue that they would not fly if the meteorological conditions changed. This is analogous to asking a motorist if they intend to break the speed limit. Hence, spot checks should also be made on the basis of previous flights. Enforcement actions can be taken if crews can be shown to have violated their licence conditions.
Additional Recommendation 19: Current CRM techniques often focus on airborne operations. Arguably too little attention is paid to the problems that uncertainty and confusion can create for runway operations. This is confirmed by the lack of integrated training for aircrew, ATM personnel and fire crews on the problems of runway incursion at Linate. It seems unlikely that in the short term we will be able to ensure that all maps and information resources provide unambiguous and suffienet cues for aircrews to determine their location on most runways in low visibility operations. Hence aircrews should be trained to recognise and communicate any uncertainty over their location on a taxiway so that appropriate help can be provided.
Additional Recommendation 20: When confusion exists there should be a clear verbal protocol for ensuring that both the crew and the ATM personnel know their location before any permission is given to proceed. Greater consideration should also be given to the mechanisms that might be used to determine the location of an aircraft under low visibility conditions. In such circumstances, the trial and error use of lighting systems may increase the risks of runway incursions or of other operational incidents given the associated increases in workload. If lighting systems are to be used in this fashion then studies need to be conducted to ensure that this is regarded as a distinct and potentially dangerous mode of operation where ATM staff may need additional support from supervisory or other ATM personnel.
Additional Recommendation 21: The post accident events at Linate and the impact of the MD-87 with an approved structure raise questions about the adequacy of existing regulations governing the location of buildings around runways. Studies should be conducted to review the requirements for new constructions even if it is impracticable to revise the position of existing major structures close to major runways. It is important to stress that at least in the short term there is little prospect of eliminating the problem of runway incursion. We must, therefore, carefully consider ways of mitigating the impact of those adverse events that may occur.
Additional Recommendation 22: The immediate response to the collision was characterised by confusion. The lack of coordination, in part, prevented the establishment of an Emergency Coordination Team and the lack of an Emergency Coordination Team contributed to the lack of coordination. Simulations and drills can be used to increase coordination in the aftermath of an adverse event. This is noted in the ANSV report. However, those drills need to be focussed if they are to justify the resources that are spent on them. The military use 'Lose your leader' simulations to test whether organisations can respond when incidents unfold in unexpected ways. In this instance, drills should not automatically assume that an Emergency Coordination Team will lead the immediate response to all adverse events.
Additional Recommendation 23: There are significant costs associated with the installation of detailed ground based movement tracking systems across the many different aircraft types that use facilities such as Linate. However, at least part of the confusion after the collision stemmed from problems in communicating the location of fire fighting resources to ATM personnel. This information could be automatically communicated by any one of a number of commercial vehicle tracking systems that will provide position data down to several metres in detail. These commercial systems could initially provide displays in the TWRs from sensors in each of the fire fighting appliances. Eventually, these vehicles might also be equipped with these displays to help ensure that they can locate their colleagues under low visibility conditions.
Additional Recommendation 24: Emergency plans should be revised to ensure that fire fighting personnel and other staff do not prematurely commit all available resources to a particular location without first coordinating a full survey of the surrounding area to ensure that casualties are not overlooked. This recommendation is strongly related to the ANSV requirement that any decision to commit emergency personnel should not overlook the hazards faced by other aircraft and staff.
Additional Recommendation 25: EUROCONTROL or other national service providers should commission a detailed study on the feasibility of image intensification and thermal imaging technology to support emergency operations in low visibility conditions. Military technology is sufficiently robust and is available at a low enough cost for it to be widely used by, for example, army truck drivers. It is reasonable to suppose that it might be used to help locate burning wreckage, jet exhausts etc as fire crews navigate runways and taxiways. A formal risk assessment should also be conducted as there are operational risks associated with the improper use of these devices, for example as aid to 'high speed' driving in reduced visibility.