Testimony of Carol Carmody
Acting Chairman, National Transportation Safety Board
before the Committee on Appropriations
Subcommittee of Transportation and Related Agencies
House of Representatives
Regarding Aviation Safety
March 28, 2001
Good morning, Chairman Rogers and members of the Committee. It is a pleasure to represent the National Transportation Safety Board (NTSB) before you today and to provide testimony today regarding aviation safety issues.
As demonstrated by last summer's flight cancellations, the continued growth of commercial aviation and the general aviation fleet continue to strain the U.S aviation system infrastructure. This growth is challenging the Federal Aviation Administration's (FAA) air traffic control (ATC) system, and requires additional oversight and vigilance to ensure the safety of the aviation transportation system.
According to the FAA, the number of air travelers will increase from 604.1 million in 2000, to more than 926.6 million by 2012. In addition, the FAA projects that aircraft operations at air route traffic control centers will increase from 46 million in 2000, to about 61.7 million in 2012, growing 2.5 percent each year. The number of passengers on foreign flag air carriers traveling to or from the United States is also expected to increase from approximately 139.2 million in 2000, to 267 million by 2012.
We cannot emphasize strongly enough that a number of issues must be addressed to prevent aviation catastrophes as operations increase. I would like to discuss three of those issues today: runway incursions, errors committed by air traffic controllers, and FAA oversight.
FAA data show there were 429 runway incursions in the United States last year, more than twice the 200 incursions that occurred in 1994, and a significant increase from the 322 incursions in 1999. In 2000, the rate of runway incursions per 100,000 operations was .63, up from .47 in 1999. As of March 19, 2001, 81 runway incursions have already been reported.
Fortunately, there have been few actual collisions and the number of fatalities has been small. Although most runway incursions have involved small general aviation aircraft, many of the factors involved could affect air carrier airplanes, and the possibility for a catastrophic accident only increases with time if the rate of errors is not reduced.
In testimony presented before this subcommittee two years ago, then-Chairman Jim Hall stated that the Safety Board "remains concerned that FAA efforts to address runway incursions through technological development falls short of what is needed." Two years later, our position has not changed. The following are just a few of the runway incursions we have investigated in the past year:
February 2000 - At Detroit, Michigan, the crew of a Northwest DC-10 on final approach initiated a go-around maneuver to avoid a Northwest A320 cleared for takeoff. The airplanes missed each other by 300 feet vertical and .44 miles horizontal.
March 2000 - At Sarasota, Florida, the tower air traffic controller cleared a Cessna airplane onto the runway in front of another Cessna airplane that was on takeoff, resulting in a collision and the loss of four lives.
May 2000 - At Chicago's Midway Airport, an American Trans Air Boeing 727 was on final approach when the flight crew initiated a go-around maneuver shortly before landing to avoid a Rockwell Aero Commander that was holding in position for takeoff. The Boeing 727 passed about 60 feet over the other aircraft.
May 2000 -- At Chicago's Midway Airport, a Cessna Citation business jet was holding in position on runway 31C awaiting takeoff clearance when the tower controller cleared a Beech King Air to land on the same runway. Distracted with other duties, the controller failed to resolve the conflict until the King Air crossed the airport boundary. The controller instructed the King Air pilot to go around but not in time to avoid overflying the Citation. The aircraft missed each other by an estimated 400 feet.
December 2000 - At Providence, Rhode Island, the flight crew of a USAirways A320 aborted its takeoff because a Southwest Boeing 737 was protruding over the hold short line on the active runway. The USAirways airplane was traveling approximately 30 to 70 knots when it passed in front of the Southwest airplane. Because the visibility was 1/4 mile with fog and blowing snow, the tower could not see the area of the incursion. The tower was not equipped with a ground radar system or other type of ground movement safety system.
January 2001 - At Seattle-Tacoma International Airport, a TWA MD-80 flew over an American Airlines MD-80, missing it by an estimated 60 feet. The tower local controller had cleared TWA for takeoff from runway 16L and instructed American Airlines to hold short of the runway. However, the flight crew misunderstood the controller and crossed 16L. Visibility at the time of the incident was 1/4 mile with fog.
March 2001 - At Fort Lauderdale International Airport, Florida, a Delta Air Lines Boeing 767 flew over a USAirways Boeing 737, missing it by less than 100 feet. The Delta airplane was cleared to land on runway 27R while on 5-mile final approach, and the USAirways airplane was cleared to taxi into position and hold on runway 27R. At the time of the incident, the tower controller was distracted by other duties and failed to advise the Delta flight crew of the USAirways airplane's departure from runway 27R or to advise the USAirways flight crew of the Delta airplane's arrival, as required by FAA procedures.
The Safety Board is also assisting in the investigation of an October 2000, accident in which 81 people died when a Singapore Airlines Boeing 747 struck a concrete barrier and hit a construction site as it mistakenly took off from a closed runway at Taipei's Chiang Kai-shek International Airport, Taiwan.
The runway incursion issue has been on the Board's "Most Wanted" list since its inception in 1990. This list highlights issues the Board believes should be acted on as soon as possible because they have the most potential to improve safety, save lives, and reduce accidents and injuries.
Since 1973, the Safety Board has issued almost 100 safety recommendations to the FAA regarding runway incursion issues. On July 6, 2000, the Safety Board issued six additional safety recommendations to the FAA regarding this matter, and information regarding those recommendations is below. You will note that three of the six recommendations are in an unacceptable status.
Although the FAA has taken numerous actions in response to Safety Board recommendations, as well other runway incursion-related recommendations made by the Department of Transportation's Inspector General and others, it is disconcerting that the number of runway incursions has not diminished.
In 1991, the FAA stated that the cornerstone of its runway incursion efforts was the development and implementation of the Airport Movement Area Safety System, or AMASS. AMASS works by generating an audible and visual alert to controllers when an aircraft or vehicle is occupying a runway and an arriving aircraft is 1/2 to 3/4 mile from the runway threshold or a departing aircraft on the runway is detected by the system and is moving at approximately 44 knots or greater. However, the visual and audible alert parameters were not based on human performance studies. Rather, they were empirically determined based on a prototype AMASS system.
Following the investigation of an incident that occurred at O'Hare International Airport in 1999, the NTSB asked the FAA to conduct a simulation of AMASS performance using data from several runway incursion incidents investigated by the Safety Board. The simulations showed that AMASS would not have generated warnings in sufficient time for controllers and flight crews to respond effectively and prevent the incidents. Following the simulation, the FAA in 1999 modified its position and has now stated that AMASS will not prevent runway incursions but, rather, runway collisions.
In 1991, the NTSB recommended that the FAA expedite efforts to fund the development and implementation of an operational system analogous to the airborne conflict alert system to alert controllers to pending runway incursions at all terminal facilities that are scheduled to receive airport surface detection equipment (A-91-29). In March 2000, nine years after the recommendation was made, the Board changed its status from "Open-Acceptable" to "Open-Unacceptable" action for several reasons. As mentioned above, the software system envisioned by the FAA to translate radar data into alerts that would warn controllers of an impending runway incursion or collision will have substantially fewer capabilities than initially planned. The Board does not believe that AMASS as currently designed meets the safety goals of the original system promised by the FAA.
Since the FAA awarded its AMASS development contract in September 1990, there has been one delay after another. For example:
Safety Board staff have since been informed that AMASS did not pass the initial operational test and evaluation at San Francisco in February, and that additional tests are scheduled for April 2001.
The Safety Board remains concerned that AMASS may not be through the test and evaluation phase and fully operational at the 34 major airports that will receive the system for some time. The Board is also concerned that current AMASS parameters may not provide controllers and flight crews sufficient time to react and intervene to maintain safe separation in all circumstances. Therefore, the Safety Board continues to assess the ability of AMASS to prevent runway collisions under various conditions and the need for the FAA to conduct additional simulations of AMASS performance to test its ability to provide effective alerts under real-world scenarios. Such simulations would need to take into account variables such as pilot-controller reaction times, aircraft performance, and meteorological factors (for example, visibility and wind speed).
In October 1993, the FAA reported that it was evaluating several different technologies for managing airport surface movements, including differential global positioning systems, loop and magnetic sensors, and marine X-band radar systems, in lieu of installing full airport surface detection equipment, also known as ASDE, at lower-activity airports. On March 23, 1998, the FAA stated that it was continuing research and development of low-cost ASDE alternatives, including evaluation of marine X-band radar and phased-array radar systems. The FAA also stated that it was investigating the use of inductive loops for aircraft detection and collaborating with the National Aeronautics and Space Administration to test and demonstrate an integrated surface movement management system. Safety Board staff have been briefed by NASA on work it has accomplished in heads-up displays and moving map displays that would provide aircraft movement information directly to controllers and pilots. The initial demonstrations for these technologies have indicated that they provided timely alerting for the flight crew and increased surface situational awareness. These technologies appear to offer reliable accurate traffic information directly to the controllers and flight crews much faster than transmitting ground based alerts to the aircraft.
The FAA advised the Board that on November 22, 2000, it awarded the ASDE-X contract to Sensis Corporation, and that an operational readiness demonstration was scheduled for April 2003.
Mr. Chairman, in 1993, FAA estimated that AMASS would cost $59.8 million and be installed in 1996. The Department of Transportation's Inspector General reported in March 2000, that costs were then estimated to reach $151.8 million, a $92 million increase. We can only assume that this figure is higher today. Board staff has also been advised that the cost of the ASDE-X systems has increased from an initial projection of $100,000 to more than $9 million.
It has been nearly 10 years since the Board issued its recommendation that the FAA expedite efforts to fund the development and implementation of an operational system to alert controllers to pending runway incursions at all terminal facilities that are scheduled to receive airport surface detection equipment. Ten years later, all such systems remain under development, and none have been commissioned for full operational use at any airport in the United States. The Safety Board continues to be concerned that, despite many years of research and development and the expenditure of nearly $100 million, the FAA has been unable to procure surface surveillance equipment suitable for use at airports to prevent runway incursions. The FAA needs to establish criteria for installation of airport ground surveillance systems and commit to a specific date for completion of the acquisition and delivery of these systems.
The FAA recently established programs to address runway incursions centered on identifying the potential severity of an incursion and reducing the likelihood of incursions through training, technology, communications, procedures, airport signs/marking/lighting, data analysis and developing local solutions. The FAA's initiatives include:
Technological advances may help accomplish some of the FAA's goals, but there is no single solution that will cover all situations. Awareness and education are important, but in a system as complex as airport traffic control, human mistakes are unavoidable. Some of the Board's recommendations over the years have focused on building in essential redundancies to compensate for inevitable lapses in human performance. We urge the FAA to continue to explore methods to make certain that the air traffic environment is robust and able to minimize the impact of human mistakes before they result in an accident or incident.
Finally, the Board notes that the most recent Director of the FAA's Runway Safety Program is retiring after only a few months in the position. This program, and we have seen several versions, has lacked consistent leadership and staff. We urge FAA management to rectify this situation.
On January 17, 2001, the FAA and the National Air Traffic Controllers Association (NATCA) signed a memorandum of understanding (MOU) that modified existing FAA procedures for identifying and processing operational errors. The changes implemented by this MOU establish a new subcategory of operational errors known as "technical violations," and appear to prohibit certain quality assurance and training activities following technical violations. The MOU also precludes the FAA from suspending or revoking control tower operator licenses and air traffic facility ratings in response to demonstrated performance problems.
According to the MOU, the FAA defines a "technical violation" as any operational error in which the aircraft involved pass each other with at least 80 percent of standard ATC separation, either vertically or horizontally. The Safety Board is concerned that this provision does not take into account the circumstances causing such an error and could result in the classification of clearly unsafe incidents as mere "technical violations."
For example, a head-on encounter between two air carriers that was resolved by a Traffic Alert and Collision Avoidance System resolution advisory could be classified as a technical violation if the pilots reacted quickly enough to maintain 80 percent of required vertical separation. If controller performance were found to be causal, it would be expected that the FAA would take appropriate remedial action, including retraining or disciplinary action if warranted. However, the MOU appears to preclude the FAA from doing so.
In a letter dated February 7, 2001, (attachment #1), the Safety Board expressed concern about the change in FAA policy that this provision implies. Standards that can be violated repeatedly without consequence are no longer standards. It would appear that unrestricted application of this provision would in effect result in reducing separation standards to 80 percent of their present values. We are not aware of any FAA studies that demonstrate that current separation standards could be safely reduced or that this change was coordinated with users of the ATC system.
It is the Safety Board's opinion that if the FAA believes that current standards are overly restrictive and can be safely reduced, it would have been prudent for the FAA to perform appropriate analyses and make the results available to interested parties for examination before implementation.
The following are examples of errors and deviations classified as technical violations rather than operational errors since the NATCA MOU was signed in January 2001:
Following receipt of the Board's February 7, 2001, letter, FAA officials briefed Safety Board staff on its development of a risk assessment index for classifying the severity of an operational error. The index considers vertical separation, horizontal separation, closure rate, flightpaths, and controller awareness of the conflict. The FAA's classification system appears to be a reasonable approach to evaluating operational errors, and Safety Board staff have suggested that using this proposed process to identify and classify technical violations as those situations in which minor, non-hazardous errors have occurred would be more appropriate than classifying errors based solely on distance between aircraft regardless of the surrounding circumstances.
Using this system to classify a limited number of non-hazardous errors as technical violations may be appropriate, but this should not be done without performing a sufficient investigation to decide whether corrective actions are needed to prevent recurrence. Regardless of how the FAA addresses this concern, we would expect that only those errors and deviations that result from very minor misjudgments under controlled circumstances would qualify as technical violations, that the acceptable number of these violations would be strictly limited, and that such errors would not become routine during ATC operations. In addition, arbitrarily classifying all operational deviations as technical violations clearly mischaracterizes incidents that result in serious safety problems as minor when, in fact, controller actions caused dangerous situations.
The MOU also appears to preclude the FAA from revoking or suspending controller airman certificates and facility ratings as a means of addressing performance deficiencies. It is difficult to discern the safety benefit on the FAA prospectively waiving the right to suspend or revoke facility ratings or initiate a certificate action against a controller who demonstrates serious performance deficiencies. If an individual's performance is of such concern that these actions appear to be necessary, we expect that the FAA would proceed accordingly.
The Safety Board views the effectiveness of the FAA's quality assurance processes as critical to the safety and reliability of the air traffic control system. If properly followed, FAA procedures for the investigation of operational errors appear to provide a reasonable basis for the establishment of causal factors and the development of appropriate remedial actions. The integrity and thoroughness of its quality assurance program require the FAA to place a high priority on ensuring that operational errors and deviations are fully investigated, causal factors are identified, and corrective measures are applied whenever deficiencies in ATC system performance are found.
FAA oversight has been of concern to the Board for several years. After the May 11, 1996, accident involving ValuJet Airlines flight 592 in the Florida Everglades, the FAA directed a 90-day safety review of its Flight Standards Office. The review determined that the FAA's regulatory oversight system -- PTRS -- needed to be replaced. The manager of the Flight Standards Division for the FAA's Western Pacific Region chaired the committee that sponsored the development of Air Transportation Oversight System (ATOS) as the FAA's new oversight system for all Part 121 carriers. Sandia National Laboratories, a Department of Energy national security laboratory in New Mexico, was a consultant in the development of ATOS because of the laboratory's expertise in system safety.
According to FAA staff, ATOS was intended to replace PTRS because that data repository system had reached a plateau and there was no way to make further safety gains. Also, a January 2000 FAA fact sheet stated that ATOS replaced the regular surveillance work program and National Aviation Safety Inspection Program (NASIP) inspections with a more flexible, focused inspection program that utilized new data analysis tools.
The ATOS program is designed to conduct inspections in 7 air carrier systems (aircraft configuration control, manuals, flight operations, personnel training and qualifications, route structure, flight rest and duty time, and technical administration,) 14 air carrier subsystems, and 88 elements. ATOS has eight processes that are linked in a closed-loop system. These processes follow:
The ATOS program currently includes 10 major airlines-Alaska, America West, American, Continental, Delta, Northwest, Southwest, Trans World, United, and US Airways. ATOS program implementation began in October 1998. Only surveillance data for the 10 carriers are currently being recorded under ATOS; certification activities and data for the 10 carriers are still recorded under PTRS. According to the Flight Standards Division manager, all collected ATOS data is entered into a database located on the FAA's Intranet. As part of module 7 (analysis), each carrier is to be assigned an analyst.
The Flight Standards Division manager indicated that the FAA had developed a plan to extend ATOS to the remaining Part 121 carriers (about 140 carriers) and new entrant carriers but that the FAA was reluctant to proceed until ATOS was fully developed and the necessary resources were available. In its report on the Fine Airlines flight 101 accident that occurred in Miami, Florida on August 7, 1997, the Safety Board expressed concern that "some operators that may benefit most from additional scrutiny were not included in the initial implementation phases of the ATOS program" and that there was already considerable surveillance at the 10 major carriers.
The Safety Board is examining the ATOS program as part of its on-going investigations of the American Airlines flight 1420 accident at Little Rock, Arkansas, and the Alaska Airlines flight 261 accident near Point Magu, California. FAA staff recently indicated that ATOS would not have detected some of the changes in the Alaska Airlines' maintenance practices for the horizontal stabilizer jackscrew assembly that may have resulted in the accelerated wear noted on the unit from the accident airplane.
We will be certain to keep the Committee advised of developments regarding the Board's review of this program.
Mr. Chairman, that completes my testimony. I would be pleased to respond to any questions you may have.