Description

On 27 April 2021, the crew of a Boeing 737-400 (OE-IAJ) being operated by ASL Airlines Belgium on a scheduled international cargo flight from Porto to Liege as TAY4959 saw a vehicle on the runway ahead during their night takeoff in good visibility but assessed that they would be able to get airborne before reaching the vehicle. By the time they overflew the position where the vehicle had been, it had cleared to the side of the runway after being instructed to do so. A subsequent discussion between the aircraft Captain and the relieving controller noted that safety reports would be filed by both parties.  

Investigation

The event was notified to the Portuguese Accident Investigation Agency (GPIAAF) by Porto Airport operations the following day and an in-depth Serious Incident Investigation was commenced. Relevant recordings of ground radar, TWR voice communications and CCTV around the time of the event were available to the Investigation. Whist it was in progress, another similar vehicle-on-runway/aircraft conflict occurred at Ponta Delgada on 13 May 2022 and this was taken into account from that point on because of some apparent commonality of contributing factors.

It was noted that the TWR Controller involved was the Shift Supervisor. He had been a controller for 18 years and at Porto for 14 years and had been promoted to Supervisor in 2014. On the day of the investigated event, he was responsible for a team of 3 controllers on the afternoon shift, one of whom was working with a trainee. In the light of a lower than normal number of movements, he had scheduled controllers as considered appropriate for the shift. Initially, the controller and trainee were in position and relieved during their break by a third controller who then left (he lived nearby and had agreed with the Supervisor to return if required). Almost two hours later, the Supervisor arrived and took over from the instructor and trainee who then left. The Supervisor took over alone and continued until the first night shift controller arrived as the investigated event was in progress. By this time, he had been “on duty for approximately four hours without taking the mandatory breaks”.

The vehicle driver had 2½ years experience as airport operations officer at Porto and on the day of the event he was one of four operations officers and had been assigned airside ramp and runway inspection duties. The runway inspection which led to the conflict was his first of the shift but the fourth and final one of the day. He had not received any formal training on the use of the frequency scanner radio installed in the Follow-Me vehicles at Porto airport and used for airside communication with ATC. The aircraft flight crew had operated the early morning flight from Liege to Porto and they had then been off duty until the report time for the return leg to Liege.  

What Happened

Two minutes after the Boeing 737-400 had called on Porto TWR frequency for its departure clearance, the TWR controller had received a call from a Follow-Me vehicle on a discrete separate radio channel, ‘TETRA’, routinely used for such communications for permission to carry-out a routine runway inspection. This was approved and about a minute later, the vehicle entered the runway at taxiway ‘B’ and began its inspection by heading north in the centreline of runway 35 (see the illustration below).  

Whilst this runway inspection was in progress, the 737-400 and another departure requested and received their departure clearances and ten minutes after the vehicle had entered the runway, the 737-400 called for and received taxi clearance to hold short of runway 35 at taxiway ‘B’, a clearance which was immediately modified on crew request to hold at taxiway ‘D’ instead. This re-clearance only involved a very short taxi distance and a minute later, the flight reported ready for takeoff on taxiway ‘D’, and was so cleared.

An annotated overview of Porto Airport. [Reproduced from the Official Report]  

At the time the clearance was given, the inspection vehicle had reached the end of runway 35 and was making a 180° turn in order to head south and inspect the western side of the runway. The 737 entered the runway and began its takeoff roll almost immediately unaware of the vehicle. After about 15 seconds of the 737’s takeoff run, the vehicle driver, having seen bright lights ahead on the runway contacted the TWR controller via the discrete communication system and asked whether an aircraft was “lining up on the runway” and after a further 10 seconds received the response which was the aircraft was taking off and the driver should “try and quickly vacate to the left”. After a brief pause, the driver responded that he was already off the edge of the runway. Soon after this, the aircraft became airborne shortly before reaching the vehicle. The crew subsequently reported having observed the vehicle at a late stage and decided that a continued takeoff would get them airborne before reaching it and was preferable to conducting a high speed rejected takeoff. During the conflict another TWR controller entered the control room in preparation for beginning his shift ten minutes later. Once the aircraft was safely airborne, the aircraft Captain and the controller discussed what had happened and agreed that both would file formal reports on the occurrence. The situation as the aircraft overflew the vehicle is shown in the illustration below.

The Captain’s subsequent written report stated that only at lift off had they noticed white headlights from a moving vehicle next to the left edge of the runway, which were similar to and confusing with the white edge runway lights. The crew stated that they could not recall seeing any flashing-yellow obstacle beacon on the vehicle.  

The closest relative positions of the vehicle and the departing aircraft. [Reproduced from the Official Report]

Why It Happened

After gathering and analysing all relevant information, the Investigation summarised its principal relevant findings as follows:

• The on-duty controller had been working alone in the tower position, acting both as aerodrome control and providing approach control service uninterruptedly, without any break, for about four hours when the event occurred.
• There was no independent alerting system in place and the existing controller memory aid procedures were, under the circumstances, ineffective in reminding the controller of the presence of the Follow-Me vehicle, which had earlier been authorised to be on the runway.
• Communication of the aircraft and the Follow-Me vehicle with ATC occurred on different radio systems (the aeronautical frequency and the ‘TETRA’ communication system, respectively), thereby disabling awareness of one-another’s presence in the manoeuvring area.
• The exercise of a Supervisor’s prerogative to tactically manage his team is based on procedures which are ambiguous such that in practice the make-up of teams is done irrespective of the plan for the period they have been rostered for, without guidance material and risk analysis for the decision making.
• The failure to detect systemic non-compliance with the maximum duty period without a break by controllers and their supervisors.
• The absence of Safety Review Board meetings associated with a consistent lack of formal provision of safety information to the Accountable Manager significantly undermines the ability of ANSP leadership team to effectively exercise its prerogative of operational safety supervision.
• “Silo culture” from the leadership of the individual towers (and units) prevented the implementation of operational, managerial and safety best practices implemented elsewhere, unrelated to local specifics.
• The absence of an unambiguous, independent and effective compliance monitoring processes at NAV Portugal, meant a lack of oversight and convergence in terms of operational, control and safety best practices amongst units.
• Deficiencies in the organisation and management system of the ANSP and its implementation of the Part-ATS requirements went undetected by ANAC.

The Probable Cause was formally documented as “air traffic control’s issuance of a take-off clearance to the Boeing 737 despite having earlier authorised a ‘Follow-Me’ vehicle onto the runway to perform a runway inspection”.

A total of 15 Contributing Factors were also identified as follows:

• The provision of air traffic services with unified tower and approach positions, provided by a single controller without any supervision, working in continuous duty without interruptions for an extended period of time, in a tedious and low-activity environment.
• An archaic memory aid system, ineffective and totally dependent on human action to prevent simultaneous use of the runway by vehicles and aircraft.
• An inactive runway incursion monitoring and conflict alert system (RIMCAS).
• The decision process on the application/inhibition of technological tools, in particular the inhibition of RIMCAS, without a risk analysis supported by facts or mitigation measures to allow such inhibition.
• The absence of advanced ATC surveillance systems, including multilateration and electronic flight strips which can offer additional protection when compared with traditional, entirely human-dependent systems.
• The absence of H24 stop bars procedure or other equivalent lighting systems at all runway holding positions, as recommended by EAPPRI for ANSPs.
• The absence of objective criteria set by the organisation for the tactical management of teams by supervisors, based on risk assessment in order to ensure that the required level of safety is not compromised.
• A deficient organisational culture at the ANSP resulting in misrepresentation of the position logs not in line with reality. 
• NAV Portugal’s failure to oversee and detect operational, managerial and safety shortcomings over the different Units, namely at Porto and Ponta Delgada towers.
• Deficiencies in NAV Portugal’s safety management system, just culture and its compliance with the requirements of Part ATS were not identified by the regulator.
• The Regulator’s shortfall in properly supervising the Runway Safety Committees at Porto and Ponta Delgada airports, ensuring effectiveness of their activities and compliance with Regulation 8/2018.
• The lack of a single frequency for all aircraft and vehicle movements in the manoeuvring area (as recommended by EAPPRI, and others) which would allow both flight crew and ground vehicle drivers to be aware of any possible threats to safety.
• Unreliability of the radio scanners which were installed by the infrastructure management in the Follow-Me vehicles at Porto airport, which were not user friendly and for which no formal training had been given to the drivers on how to operate them.
• The ‘Follow-Me’ driver’s decision not to actively monitor the aeronautical frequency even though it was not a mandatory requirement.
• The non-standardised manner of conducting the runway inspections which, in this case, resulted in a prolonged period of ‘TETRA’ radio silence.

Safety Action known to have been taken during the course of the Investigation was noted to have included the following:

• NAV Portugal introduced a new complementary method to indicate the presence of vehicles on the runway at Porto TWR consisting of a large “runway occupied” sign, covering the wind velocity display similar to the method already in use at Faro and subsequently formalised this procedure at all airports.
• NAV Portugal introduced a requirement for all ATS units in the Lisbon FIR to adopt the digital positions log system and follow strict associated procedures including shift supervisors validating them and submitting them to the central database by the end of the shift.
• NAV Portugal provided explicit procedures for Shift Supervisors open and shut controller positions and added a requirement that whenever human resources allow, a minimum of two TWR positions should always be open.
• NAV Portugal installed MLAT at Porto and made it available for operational use (although no information on related changes in procedures was supplied to the GPIAAF).
• Aeroportos de Portugal (ANA) introduced a requirement for any vehicle operating in or around the manoeuvring area to permanently listen-in on the TWR frequency irrespective of the prevailing visibility (but noted that this will only be fully possible when all of the Follow-Me vehicles have been fitted with radios capable of receiving transmissions on this frequency).
• Aeroportos de Portugal (ANA) updated the Aerodrome Manual to require that all committees at Porto airport, including the Runway Safety Committee meet at least three times each year and that the meetings of the following year are all scheduled at the last meeting of the current year.

Ten Safety Recommendations were made as a result of the Investigation as follows:

• that NAV Portugal, within six months, establish a plan and timeline for implementation across all units, in the shortest time possible, reliable systems which are independent from the on-duty controller intervention for alerting and detection of conflict when a runway is occupied, fully implementing the recommendations of EAPPRI v3.0 pertaining to Air Traffic Control. While the necessary technological resources of proven efficiency are not available, NAV Portugal must immediately ensure the implementation of the mitigation measures that result from a risk assessment that takes into account, among other aspects, the human factors involved and the lessons learned from the events described in this report. [PT.SIA 2022/002]
• that NAV Portugal, within twelve months, review its policy for the supervision of aerodrome control activities, reviewing and amending, as applicable, its manuals and procedures so that the services provided by the different units will not be provided without effective supervision of the on-duty controller(s). In cases where it is accepted that the service is provided by a single controller in the tower, such decision process must be duly justified, documented and approved by the unit’s manning procedure in force at NAV Portugal and duly approved by the Regulator. [PT.SIA 2022/003]
• that NAV Portugal, within three months, review and amend procedures regarding a Supervisor’s responsibility for operational tactical management to ensure that manning levels never fall below that which has been allocated and approved through a certified process by the Authority and ANAC for the shift and that any adjustment, if required, is made in excess (only) to respond to exceptional unforeseen circumstances, while observing maximum duty periods without a break. [PT.SIA 2022/004]
• that NAV Portugal, within six months, carry out a transversal and exhaustive survey of the competence of its Safety and Security Department, evaluating and discerning each of its functions and take the measures considered necessary to review its safety management system (SMS) in order to ensure that the implemented processes in all its units fully comply with the PART-ATS requirements. Namely, NAV Portugal should reassess its compliance monitoring function, making it robust, independent and effective so as to ensure full compliance with the applicable civil aviation regulations and harmonisation of internal procedures in all activities for which it is responsible. [PT.SIA 2022/005]
• that NAV Portugal, within three months adopt, in all units, a sterile control room concept by implementing and enforcing measures which include a no-tolerance policy towards the presence of mobile devices or any other device likely to create distraction at controller workstations and control rooms and by imposing strict rules restricting the presence of non-active staff and conversations unrelated to the activity taking place in the control room. [PT.SIA 2022/006]
• that ANA Aeroportos de Portugal as operator of Porto Airport, within six months install and certify reliable and user-friendly air-band equipment in Follow-Me vehicles, to allow the effective implementation of the requirements of Operations Letter No. 3 at Porto and which also allow the future implementation of a common frequency for all movements of vehicles and aircraft in the manoeuvring area. [PT.SIA 2022/007]
• that ANA Aeroportos de Portugal as operator of Porto Airport, within three months harmonise procedures for runway inspections and provide guidance material to Follow-Me operators on the routes to follow thereby establishing for each runway a reference duration which will aid the situational awareness of air traffic controllers. [PT.SIA 2022/008]
• that ANAC (the Portuguese CAA) follow through on Regulation no. 8/2018 in the shortest possible time by enforcing the provisions of paragraph(s) of Article 8 which require ANSPs to ensure that there are clear and effective procedures in place to indicate that a runway is occupied, obstructed or unavailable, using, where possible, appropriate technological tools. [PT.SIA 2022/009]
• that ANAC (the Portuguese CAA) follow through on the applicable EU Regulations and Regulation no. 8/2018, within the scope of the National airports, by supervising the effectiveness of LRSTs and their outcome in terms of proper identification of safety issues and implementation of the approved mitigating actions/plan. [PT.SIA 2022/010]
• that ANAC (the Portuguese CAA) reinforces its oversight and enforcement of the ANSP NAV Portugal to ensure the full and effective implementation of the requirements for Part-ATS in Commission Implementing Regulation (EU) 2017/373, particularly those pertaining to Management Systems. [PT.SIA 2022/011]

The 153 page Final Report of the Investigation was completed on 29 December 2022.

Related Articles

• Runway Incursion
• ATC Radio Use by Airside Vehicles
• Stopbars (SKYclip)
• Local Runway Safety Teams (LRST)
• Safety Oversight
• Organisational Culture
• European Action Plan for the Prevention of Runway Incursions (EAPPRI)