Perceived Risks

Principal Safeguards (Changes instituted as a result of the PPP are in italics.)

1. Potential risks relating to the overall management of safety

1.1 That safety risks and incidents might not be adequately reported.

There is a range of reporting arrangements involving pilots, air traffic engineers, controllers, NATS management and independent bodies:

Independent Reporting

■  Mandatory Occurrence Reports. Pilots, engineers and controllers are bound by law to report serious safety-related incidents to the Safety Regulator.

■  Independent Air Proximity Board, which takes reports from pilots or controllers of aircraft "near misses".

■  CHIRP (Confidential Human Factors Incident Reporting Programme). An independent charitable trust to which aviation staff can report incidents in confidence.

■  Overload reports, are filed by controllers when they consider that a situation has occurred during which they experienced excessive workload to the point where safety was, in their view, compromised.

NATS Internal Reporting

■  Automated safety performance monitoring equipment. NATS controllers have equipment known as short term conflict alert, which warns them when distances between aircraft may become too small unless corrective action is taken. This acts as a safety net while other equipment records incidents when minimum separation distances have been breached, for appropriate action by management.

■  Since the PPP, there has been more extensive reporting of the most serious risk-bearing, safety incidents to the Board of NATS, including the Government's Partnership Directors. One of the Government's Partnership Directors chairs the Board's Safety Review Committee.

■  NATS plans to institute an extra Voluntary Reporting System in 2002 to complement the Mandatory Occurrence Report scheme, and a central database for analysing safety data from 2003.

1.2. That action may not be taken to reduce the number of flights in a sector to a safe level once a potential overload is discovered.

If NATS management consider that there is a potential risk to safety from the expected number or configuration of aircraft in a particular sector, the normal recourse is to reduce the number of flights entering that sector. This is done by holding flights at UK airports, and contacting the Central Flow Management Unit at Brussels, which will limit the flow of traffic into UK sectors. The controls that ensure that this happens are:

■  The head of the Safety Regulation Group of the Civil Aviation Authority (the "Safety Regulator") is aware of, and audits the process to determine Target Sector Flows.

■  Action can be taken by NATS to stop or reduce the traffic departing from UK airfields.

■  NATS constantly monitors the traffic planned to enter a sector so that flow restrictions can be imposed in a timely manner via the CFMU.

1.3.That the safety regulator may not be sufficiently resourced and empowered to be effective.

The Independent Enquiry into the Paddington Rail crash of 1999 concluded that under-resourcing of the Safety Regulator had been a factor in the background to the incident. The Safety Regulator told us that the Authority had sufficient powers and resources to regulate NATS, in particular:

■  The Safety Regulator is now fully separated from NATS as a consequence of the PPP.

■  Safety Inspectors have unrestricted rights of access to Centres, which they continually exercise.

■  The Regulator considers it has sufficient inspectors to exercise the required programme of visits to Air Traffic Control Centres. Formal separation of NATS from the CAA has not changed the way in which the Safety Regulator addresses safety issues in NATS, so additional inspectors are not considered to be required.

■  The Regulator meets regularly with NATS' Directorate of Safety and Quality, and with operational managers.

■  The Safety Regulator has stronger powers than did rail safety regulators - these include the right to enforce its decisions through the Air Navigation Order 2000.

■  The Safety Regulator has powers to prevent new arrangements such as incentives on staff to handle more flights, or punishment of staff involved in incidents, if it considers these would be detrimental to safety.

■ During 2002/3, the Safety Regulator will conduct audits on the safety performance of NATS En Route, Oceanic and Airport services. Reports will be made to the CAA Board in March 2003, but any urgent issues arising from the PPP would be dealt with in advance.

2.  Potential risks associated with pressures to maximise income

2.1  That the operator may try to handle more flights than it is safe to do

There are a variety of safeguards against this risk including:

■  The Safety Regulator sees proposals to increase en route or Oceanic capacity. The Safety Regulator is able to audit and if necessary challenge capacity proposals that it considers unsafe.

■  Controllers are highly trained professionals, with ground rules for the number of flights they should be expected to handle. They would be likely to object strongly to moves designed to make them handle excessive traffic levels.

■  There is a legal responsibility on controllers to report overloading via the MOR scheme. Other reporting schemes exist (see 1.1 above)

■  Controllers comply with detailed, fixed procedures to ensure the separation of flights.

2.2 That the operator may try to offer a preferential service to aircraft of certain customers, in a way that could be unsafe.

■Clauses in NATS' licence and the Airline Group's partnership agreement with government forbid such discrimination.

■  Any systematic preference would quickly become apparent to other customers - pilots would notice. The commercial advantages of such discriminatory activity would not be significant unless carried out systematically.

■  Controllers are trained to process aircraft on a "first come, first served" basis, and would be likely to object. The only times this is normally disregarded are to improve flow of traffic (e.g a small aircraft cannot follow close behind a large one, as it would be buffeted by the air disturbance in the wake of the large aircraft), or if two aircraft from the same airline wished to exchange places in a waiting stack.

■  There are standard scales of charges for all customers, recovered through the independent Eurocontrol clearing house.

3. Potential risks associated with attempts to minimize costs

Capital Costs and Investment

3.1  That there may be risks to safety if the operator seeks to defer investment.

■  NATS' Business Plan requires the approval of Shareholders and the CAA in respect of form, scope and level of detail.

■  Older and less reliable equipment will be limited in terms of the number of aircraft movements it can process, thereby restricting NATS' income in the long term. Therefore the benefits of deferring investment are largely short-term.

3.2  That the operator may seek to reduce investment

Overall NATS' draft business plan for 2002 schedules 21 per cent of total capital investment for the development of service and safety for the next ten years, some £188 million. Investment safety projects include:

■ Further "Safety net" systems based at Area Control Centres or on aircraft, to warn of the possibility of collisions.

■Automation of Traffic Control functions to reduce the possibility of human error.

Again, cancellation of safety-supporting investment would have a short-term financial benefit, but in the longer term would be likely to mean a stagnation in capacity rather than reduced levels of safety.

3.3  That the operator might try to rush in new investment before it is fully ready.

■  Any proposed changes to NATS' equipment or procedures has to be accompanied by a Safety Case, which must be approved by the safety regulator. Such Safety Cases should show a systematic approach to risk management, and state how risks will be managed in the new environment

Operating costs

3.4.  That the operator might seek to reduce the number of controllers

■NATS' Business Plan shows that they intend to increase the number of operational controllers by over 13 per cent over the next 10 years. Any reduction in levels per shift of operational controllers would require the safety regulator's approval, and would probably lead to a reduction in NATS' handling capacity.

3.5.  That proposed reductions in the Engineering capability of NATS might detract from reliability of systems

In its 2002 business plan, NATS envisages substantial cuts in engineering staff in four tranches over the next 10 years.

■ NATS will inform the safety regulator of any proposed cuts through a formal process and will have to show how it proposes to manage those aspects of the business so that safety will not be compromised by a reduction in engineering capacity. The regulator will be able to challenge the process.

3.6. That reduced numbers of Air Traffic Assistants might have implications for safety

NATS plans to reduce significantly the number of its Air Traffic Assistants over the next 10 years. These staff provide support to controllers.

■  Any significant reduction in the number of assistants would require the approval of the safety regulator.

3.7 That measures to increase the rate at which new controllers are qualified might have implications for safety

NATS has proposed reducing the average time a trainee takes to his/her first validation by 20 per cent . Once a controller is validated on a particular sector, he/she can work unsupervised. NATS also hopes to be able to improve the success rate for testing for the first validation. NATS also plans to improve the pass rate from its College of Air Traffic Control from 70 per cent to 85 per cent within two years.

■  The safety regulator will gain assurance through the College assessment and verification process that standards are not allowed to decline. Additionally, the safety regulator oversees training and initial competence examinations at all ATC units and maintains ongoing oversight of controller competence on at least an annual basis.

■ NATS has proposed the use of non-UK instructors. The safety regulator has insisted that NATS put in place processes which deliver assurance on the levels of instructor competence whatever their background. Similarly, if NATS wished to employ non-UK controllers on an operational basis, the safety regulator would first decide on an individual basis what level of additional training such controllers might require before taking up operational posts

3.8. That more flexible working hours for controllers might have implications for safety

■ NATS has proposed changes to controllers' working hours to make them more flexible. Any changes that would take the hours worked by ATCOs outside of the requirements laid down by CAA require the safety regulator's approval.