On 18 December 2010, a Boeing 737-300 being operated by Norwegian on a scheduled passenger flight from Amsterdam to Copenhagen took off from runway 24 in normal daylight visibility in accordance with its clearance and after becoming airborne overflew, by a significant margin and without sighting it, a bird patrol vehicle which was also on the runway in accordance with a clearance issued by the same controller. The conflict was not recognised until the vehicle subsequently advised vacating the runway.
An Investigation was carried out by the Dutch Safety Board. On 21 January 2012, whilst the Investigation was still in progress, a virtually identical incident occurred, in which an aircraft had been issued take-off clearance while a bird control vehicle was still present on the runway. This prompted an examination in even greater depth of the systemic effectiveness of safety management at the airport. The Investigation considered the context for the controller error which led to the conflict in terms of the tasks performed by both controllers and bird control personnel and their associated infrastructure and working practices. The Investigation also examined the effectiveness of runway incursion risk management and of strategic supervision of operational safety at the airport by the Dutch Government.
The circumstances which led to the conflict were, in summary, as follows:
“On Saturday afternoon, 18 December 2010, a bird controller contacted Air Traffic Control at Schiphol for permission to drive his vehicle down Runway 24, which was in use, to inspect the runway for the presence of bird remains and any remaining snow and ice. The runway controller granted permission through an assistant controller. At that moment the runway controller also granted the ground controller permission to allow a Boeing 747 to cross the runway from the cargo apron. The assistant controller warned the bird controller that the Boeing 747 was crossing the runway. Meanwhile a Boeing 737 was preparing to take off from the same runway. After the Boeing 747 had crossed and vacated the runway, the runway controller issued the Boeing 737 take-off clearance, but in doing so overlooked the fact that the bird controller was still on the runway. The Boeing 737 took off from Runway 24 and flew over the Bird Control vehicle that was still driving on the take-off runway.”
Approximately 15 seconds after the 737 had become airborne and overflown their vehicle at about 1000 feet, the crew of the bird patrol vehicle on the runway notified GND that they had just vacated the runway, at which point the occurrence of a runway incursion was recognised by ATC. It was established from recorded data that when the Boeing 737 got airborne, the bird control vehicle was 1740 metres ahead of the aircraft.
The Investigation noted that “a runway controller can use a variety of technical and procedural instruments to warn himself that a runway is occupied and (so) cannot be used at that time for aircraft taking off or landing” but also that “what all of these instruments in the TWR at Amsterdam have in common is that they do not indicate how many vehicles or aircraft occupy, or are still occupying a runway”. In the investigated incident, after the Boeing 747 had crossed and vacated the runway, the runway controller switched off the warning system, overlooking the fact that the bird patrol vehicle which he had (indirectly via an assistant controller) cleared onto the runway was still driving on it and issued a take off clearance to the Norwegian Boeing 737.
It was noted that Amsterdam ATC regulations require that aircraft that are crossing a “runway-in-use” must be transferred to the runway controller’s frequency unless the runway is not “active” but these do not provide a definition of the term ‘active’. In this incident the Boeing 747 that was crossing runway 24 had not been transferred from the ground controller to the runway controller which facilitated a situation in which at the time of the incident “two aircraft and one vehicle were located on the same runway and were being monitored on three different radio communication frequencies by three different air traffic controllers, including an assistant controller.”
It was noted that at the time of the investigated event, a “Runway Incursion Alerting System Schipol” (RIASS), which had been developed under the direction of the Dutch ANSP by “experts at Amsterdam Airport Schiphol, KLM, the Inspectorate for Transport, Public Works and Water Management, the National Aerospace Laboratory and Air Traffic Control the Netherlands (who had) jointly developed a plan to design a system on the basis of multilateration which issues a warning if a runway incursion has occurred”. It was noted that “this system only recognises aircraft and vehicles with an activated transponder” and that in test mode on the day of the conflict, it had not issued any alert which was audible or visible to the controllers on duty. The ANSP advised that “the complete system was switched on permanently according to schedule two days after the incident (and) officially completed and delivered on 28 October 2011.”
The majority of the Investigation effort was taken up with a detailed review of all aspects of safety management, including the body established in 2003 as a consultation platform “to share (operational safety) knowledge and promote joint analysis”, the “Schiphol Safety Platform”. The Investigation was told that “the aim of the Platform is to align the safety management systems of all parties involved as much as possible within the entire process, where beneficial and feasible” given that the organisations involved are responsible for performing and implementing safety improvement activities without government involvement in the Platform. Strategic supervision of the ANSP and the Airport Operator was noted to be the responsibility of the “Human Environment and Transport Inspectorate” which “issues air traffic control organisations and airports certification on the basis of inspections and audits” and requires that “organisations holding certification must constantly demonstrate that their business processes proceed in a controlled manner”.
The Investigation considered the history of runway incursions at Amsterdam and looked at action taken in response to them. It was noted that following a serious incursion incident in 1998, there had been several initiatives to reduce the risk of repetition which had involved both airport infrastructure and ATC procedures and systems. An example had been building a detour for aircraft tugs without a tow to avoid them having to cross a runway. Various measures were taken in respect of signage, lighting and surface markings and a ground radar system was introduced. However, whilst the fact that communication was evidently one of the main causes of runway incursions was recognised, historical initiatives in that area were less obvious.
The following summary is taken from the Official Report of the Investigation:
Immediate and Underlying Causes
The immediate cause of the occurrence of the incident is that the runway controller overlooked the fact that the bird controller was still on the runway. The Dutch Safety Board investigation concentrated mainly on investigating what underlying causes led the runway controller to overlook the bird controller.
The investigation found that the various technical and procedural instruments available to the runway controller to warn him that a vehicle is present on the runway are not laid down in the operating rules, and provide insufficient safeguards. Furthermore no instruments are available that show how many vehicles or aircraft are occupying the runway.
In addition, the work procedure was such that at the time of the incident the undesired situation could occur whereby two aircraft and one vehicle were present on the same runway while they were being monitored on three different radio communication frequencies by three different air traffic controllers, including an assistant controller.
International and European recommendations indicate that it is advisable to handle all traffic (both vehicles and aircraft) on a take-off and landing runway on a common aviation frequency and in the English language, when practicable. The intended purpose is to increase the situational awareness of all parties involved. Pilots, air traffic controllers and vehicle drivers will hear each other if all parties involved use a common aviation frequency. If an error is made by one of the parties involved, the other parties will be able to respond. At Amsterdam, the work procedure in this area is not in line with the international and European recommendations and furthermore deviates from the work procedure employed, among others, by Europe’s three major airports.
Risk management and supervision
Not only do the parties have individual responsibility, they also have collective responsibility for the system as a whole. This is a principle that the parties endorse. If a risk posed by one party could have consequences for another party at the Airport, or if the other party concerned can contribute to controlling the risk posed by the accountable party, the parties must enable each other to do so collectively. This also means that the parties involved must, and should not be afraid to hold each other accountable for the risks.
Not only is good coordination required between the Airport, Air Traffic Control and the airlines(s) to control aviation safety risks, but it is equally important that the Ministry of Infrastructure and the Environment and the Human Environment and Transport Inspectorate, which falls under the Ministry, obligate the aviation sector to adopt an integrated approach to safety and risk management. It has emerged from this investigation that they have to date not always succeeded in doing so.
Both the ANSP and the Airport Operator have a safety management system in place. The operations carried out by Air Traffic Control and the Airport in the runway area are integrated, yet their safety management systems are not aligned. While the parties in the Schiphol Safety Platform do collaborate constructively in various areas, they still continue to investigate incidents individually. The results of the individual investigations are shared and discussed in the Schiphol Safety Platform or in another consultation within the Platform, but no joint conclusions and measures are determined on the basis thereof. The Safety Board is of the opinion that the investigation of incidents that occur at the interface of the two organisations’ spheres of activity, such as this particular incident, can yield joint conclusions and measures that help improve risk management. The conclusions in an internal investigation report of the Airport Operator reaffirm the Safety Board’s opinion. In her comments on the draft report of this investigation, the Minister of Infrastructure and Environment also strongly recommended urging the sector to jointly investigate this incident and any future incidents of a similar nature to effectively identify lessons learned and improvement areas.
The failures on the part of the Airport Operator and the ANSP that contributed to this particular runway incursion did not prompt the Human Environment and Transport Inspectorate to take effective action. Because the two organisations are certified separately in a process that lacks a sufficient focus on the interaction between the sector parties involved, the correlation between these failures failed to come to light. This is partly due to the changed role of the Inspectorate. Now more than in the past the Inspectorate pursues a risk-oriented supervision policy, based on the principle of ‘trust, unless’. Irrespective of the above, the supervisory authority nonetheless forms an integral part of the system no matter what role it performs or how limited its role may be. The bottom line is to identify those parts of the system that are not functioning properly (if at all) and to urge the organisation to make improvements, responsibility for which lies with the organisation concerned.
Eight Safety Recommendations were made as a result of the Investigation as follows:
- that ATC the Netherlands and Amsterdam Airport should assess the procedure for vehicles on take-off and landing runways against the EAPPRI and ICAO recommendations.
- that ATC the Netherlands and Amsterdam Airport should align the safety management systems of both organisations in areas where the parties each have inextricably linked tasks, such as the use of runways.
- that ATC the Netherlands and Amsterdam Airport should conduct investigations into incidents in such a manner that information is shared, and use this as a basis for determining joint conclusions and measures.
- that ATC the Netherlands should design the runway occupancy warning system such that the signals also indicate the number of vehicles or aircraft that occupy or continue to occupy the runway, and incorporate the procedure to be followed into the regulations.
- that ATC the Netherlands should lay down unequivocally in the regulations when a runway-in-use should be considered ‘active’.
- that Amsterdam Airport should structurally reduce the frequency of aircraft crossing Runway 24 midway by completing the postponed alternative aircraft route to and from the cargo apron without delay.
- that Amsterdam Airport should, in consultation with the ATC the Netherlands, define clear parameters within which Bird Control may carry out the requisite runway inspections effectively.
- that the Schiphol Safety Platform should ensure that investigations into incidents are conducted in such a manner that parties share vital information, and use this as a basis for jointly determining conclusions and measures.
The Final Report was published in Dutch on 23 January 2013 and subsequently made available in English translation in mid 2013.