Besides some other aircraft, the ATCO of the HIGH-Sector had two aircraft on frequency that had almost the same callsigns (A/C1 and A/C2). A/C1 was a flight at FL360 to a nearby aerodrome and therefore had to be descended soon. A/C2 was an overflight at FL370 whose destination was still over 1000 miles away.

The ICAO-3-letter abbreviations of the two callsigns differed only by one letter and both tripnumbers ended with the letter “B” – spoken “Bravo”. The opportunity of a callsign mixup on either side – cockpit and/or ATC – was high, and this turned out to be the case.

First, the ATCO instructed A/C1 to call the LOW-Sector because the LOWer controller had to perform the descent. During that instruction the HIGH-controller wanted to send away A/C1 but inadvertently used the callsign of A/C2 with the tripnumber of A/C1.

The wrong callsign (and most probably the tripnumber ending “Bravo”) was enough for A/C2 to answer that call (with its correct callsign). A/C2 left the frequency of the HIGH-Sector and called in on the LOWer’s frequency.

When A/C2 called in (again with its correct callsign) the LOWer controller was focused on A/C1, which he expected to descend. In addition, he had a potential conflict concerning A/C1 and another flight in his sector, for which the planned descent of A/C1 was the solution. The actual flight that called in (A/C2) was about 70NM away from the point where the ATCO’s focus was at that time. The controller thought, “I have to solve that potential conflict and I have to descend A/C1 anyway. So why wait?”

After identifying A/C1 visually, the ATCO instructed what he thought was A/C1 to descend to FL340 – but this instruction was made to A/C2. This clearance prompted some discussions between the A/C2 pilot and ATCO; the pilot wanted to continue at his cruising level. During this discussion neither the ATCO nor the pilot used the correct callsign anymore. The A/C2 pilot expressed his astonishment and asked the ATCO if he could stay at FL370. The answer of the ATCO was surprising. The ATCO was still fixated on A/C1 and answered: “You are at FL360 and negative! You have to descent now due to traffic”. The pilot didn’t argue, and left his cruising level.

The result was that A/C2, which wanted to fly at FL370 to its destination, performed an uncoordinated descent to FL340 whilst A/C1 still was at FL360. The conflict had to be solved by turning the other aircraft. Luckily no other traffic was below A/C2. When all participants recognised the evolving situation, A/C2 was offered to climb back to FL370.

This illustrates the local rationality principle. For the LOWer controller it made sense to act as he did. Part of his mental picture was the expectation of the initial call of A/C1. He had no knowledge about A/C2 because it was never planned to enter his airspace. In addition, he had a potential conflict between A/C1 and another flight in his sector. The ATCO planned to descend the inbound A/C1 according to the procedures after initial call. The next call on his frequency from a flight with a similar callsign fit his plan perfectly. After ‘identification’, he issued the descent clearance. Even the short discussion about the actual level did not help to identify the mix up.

This case also illustrates an interesting fact about the equivalence of success and failure in ordinary work; the same sorts of processes that enable efficient performance can also contribute to unwanted events. It is not feasible or desirable to avoid adaptive processes (e.g. expectation) and ways of working. What matters most is to work with field experts to improve the system.

Thomas Jaekel

Safety Manager, UAC Karlsruhe

DFS, Germany

Source: EUROCONTROL (2014). Systems Thinking for Safety: A White Paper. Brussels.