Skyguide Safety Bulletin no. 37

Inside
this issue
Editorial
By Simon Maurer, S 2
International
regulation
by CASO, Andrea Muggli 3-5
Lessons learned
SAMAX / RIMCAS improvements 6-7
KONIL SID 8-9
Safety - More Important
than Compliance 10-11
Technical SIRs
Status report 12-13
Strategy
Safety Strategy 2012-2016 14
#37 January/February/March 2012 - www.skyguide.ch/dossiers/safety management
editor:thomas.novotny@skyguide.ch - intranet:skyline/issue/safety/safety bulletin

safety bulletin – editorial
How safe are our safeguards?
A few thoughts on safety standards
and rules, and the possible
unintended risks of bad rulemaking
and overregulation.
I was recently invited by SwissRe
(Swiss Reinsurance Company,
www.swissre.com) to present and
speak at a forum on a topic pointed
out in the recent WEF 2012 global
risk report, titled “how safe are our
safeguards?”. The report claims
that “unintended negative consequences
of regulations [...] were
tightly coupled with many other
global risks”, and “indicates far
reaching weaknesses in regulations
[...]”. The Global Risk was specifically
looking at a case from within
a system widely recognized as
being very safe, and successfully
regulated – aviation. The case was
about the 2010 Eyjafjallajökull
eruption and the subsequent disruptions
in air travel. Most of the
participants were from banking
and the insurance business; so the
discussion was also looking at possible
learnings from aviation for
the financial business.
Rules and standards serve a variety
of purposes; they protect, they
create certainty, predictability and
reliability, the assist, just to name
a few. Please find in this Safety
Bulletin a reprinted article from
2007, giving very good insight into
the mechanics of rules.
So, how safe are our safeguards?
In our complex system, which
grew and prospered on standards
and recommended practices basically
since its beginning one hun-
2
dred years ago, this is worth a few
thoughts.
For us practitioners, as we not only
daily live with (safety) rules and
standards, but to a large degree
continuously produce our rules
ourselves, this is worth even more
thoughts!
We certainly all agree that the
“right” rules are important, and
crucial for the safe and efficient
provision of our services. But we
also all perceive that there are
«wrong» rules, those that seem
illogical, unhelpful, or counterproductive
(or unsafe even).
Rulemaking is a very delicate and
difficult process, and the risk of
“misruling” is often underestimated.
Furthermore, unintended
consequences of rules mostly only
reveal much later – and reversing
rules is even more difficult. So,
what does a «good rule» look like?
In principle, we should know what
ingredients can be used to “cook”
the better rules. One way is to carefully
assemble the ingredients,
using the correct expertise, and to
systematically assess the impact,
and think about possible unintended
consequences (the safety
assessment can help here). To
practitioners, who are supposed
to apply the rule, the sense and
aim of the rule should be care-
fully explained. Another way is to
actively assess the success of the
rule once it is in use (i.e. test your
cooking); we can do this by means
of reporting, for example, and we
must improve it if necessary (or
remove it!). This implies that rules
must be adhered to in order to
judge their effectiveness; if people
do not stick to rules and do not
report, improvement becomes
impossible or random.
But we know also what can make
bad rules. From observation, bad
rules can emerge in the aftermath
of an incident, e.g. under political
pressures, where good practices for
rulemaking are disregarded. “Liability
rules” I call those that are
purely aimed at liability apportioning,
not at safety improvement
(although they sometimes are disguised
as safety rules, but clearly
are not). A typical collateral damage
of such bad rules is overregulation;
e.g. when rare operational
exceptions that should and can be
dynamically handled by practitioners
are ruled too tightly.
It would be unwise to only blame
the others for bad rulemaking – we
must first start in our own house,
and by all means make good rules,
and live by the example. But then,
we must contribute as much as we
can (and are allowed to) to international
rulemaking, and even more,
fight against unhelpful, counterproductive,
anti-safety rules. If it
does not improve safety – bad rule!
Enjoy the reading of this issue of
the Safety Bulletin!
Simon Maurer S
WEF Global Risk Report 2012:
http://www3.weforum.org/docs/
WEF_GlobalRisks_Report_2012.pdf

safety bulletin – international regulation
Internationale Regulierung:
Chancen und Gefahren für ein
wirksames Safety Management
Pour le texte en francais veuillez
suivre le lien suivant
F: http://www.dievolkswirtschaft.
ch/fr/editions/200706/Muggli.
html
Die Standardisierung des moder -
nen Safety Management befindet
sich in einem Spannungsfeld.
Sie ist einerseits ein Instrument
hoher Interoperabilität und Inves -
titionssicherheit; anderseits hat
sie eine gewisse systeminhärente
Trägheit zur Folge. Im nachfolgenden
Artikel wird die Wirkungsweise
der bisherigen resultatbezogenen
Regulierung einer
komplementären prozessbezogenen
Regulierung gegenübergestellt.
Schliesslich wird die Be-
deutung der Regulierung im
Licht von Safety Management
komplexer Systeme behandelt. 1
Andrea Norbert Muggli
Civil Aviation Safety Officer,
Generalsekretariat
Departement für Umwelt, Verkehr,
Energie und Kommunikation
UVEK, Bern
andrea.muggli@gs-uvek.admin.ch
www.uvek.admin.ch/caso
Das Resultat der Standardisierung im Luftverkehrssystem ist eine beispielhafte Sicherheitsleistung bei einem
gewaltigen Verkehrsvolumen: Die heutige weltweite professionelle Flugoperation fordert jährlich im Durchschnitt
nicht mehr Todesopfer als der schweizerische Strassenverkehr. Im Bild: Systemcheck vor Abflug eines
Übersee-Linienflugs. Bild: Keystone
Die Luftfahrt gehört zu den wenigen
Systemen, die seit einem
halben Jahrhundert systematisch
international normiert und reguliert
werden, von der Internationalen
Zivilluftfahrt-Organisation
(Icao). Gegenstand der Regulierung
sind hoheitliche, wirtschaftliche
und technisch-operationelle
Aspekte, die alle in Wechselbe-
3
ziehung zueinander stehen. So hat
ein hohes Mass an internationaler
Standardisierung mitentschei dend
zum Erfolg dieses landesübergreifend
funktionierenden Verkehrs trä-
gers beigetragen. Es besteht ein
dichtes Netz von so genannten
Standards and Recommended Practices
(Sarps) für alle wesentlichen
Bereiche der Luftfahrt:
– Flugoperation und -verfahren;
– Ausbildung und Lizenzierung
der Besatzungen;
– Herstellung, Zertifizierung und
Unterhalt der Luftfahrzeuge;
– Bereitstellung und Betrieb der
Infrastruktur, wie z.B. Flugsicherung
und Flughäfen. (Allerdings
besteht hier eine stellenweise
deutlich kleinere Regu -

safety bulletin – international regulation
Internationale Regulierung
lierungsdichte, weil diese Leistungen
in der Vergangenheit
teilweise stark hoheitlichen Cha-
rakter hatten.)
Vorteile der
Standardisierung...
Durch die stark durchdringende
Standardisierung wurde ein hoher
Grad an Interoperabilität erreicht.
Diese wiederum erlaubt ohne
Weiteres den grenzüberschreitenden
Betrieb und den vergleichsweise
einfachen Markteintritt von
betreibenden Gesellschaf ten, aber
auch von Herstellern und Dienstleistern.
Die Zertifizierungs- und
Zulassungsverfahren – gerade für
Flugzeuge und Triebwerke – sind
im Wesentlichen vereinheitlicht
und gegenseitig anerkannt. Dies
ermöglicht Herstellern überhaupt,
Produktinnovationen am
internationalen Markt zu rentabilisieren.
Sie kommen der Wirtschaftlichkeit,
dem Umweltschutz
und insbesondere der Sicherheit
zugute. Gerade Investitionen
eines Be treibers in Umweltschutz
und Sicherheit sind mit klassischen
Return-on-Investment-
Berechnungen schwer abzubilden,
weil der Nutzen entweder
buchhalterisch gar nicht zu be -
ziffern ist oder zumindest erheblich
zeitverzögert eintreten wird.
Ohne internationale Standardisierung
wären diese Investitionen
noch schwieriger zu tätigen.
Das Safety Management profitiert
erheblich von der Standardisie-
rung. Zum einen ist in den Standards
und Empfehlungen der verschiedenen
Luftverkehrs-Organi -
sationen 2 ein immenses Wissen
über den sicheren Betrieb dieses
komplexen Systems verdichtet.
Zum andern erlauben diese Sarps
die Operationalisierung der Exper -
tise und brechen teilweise die systeminhärente
Komplexität. Das
Resultat ist eine beispielhafte Leistung
bezüglich Sicherheit bei
einem gewaltigen Verkehrsvolumen:
Die heutige weltweite professionelle
Flugoperation fordert
jährlich im Durchschnitt nicht
mehr Todesopfer als der schweizerische
Strassenverkehr.
...und deren Grenzen
Die Standardisierung birgt aber
auch Nachteile und Gefahren.
Zunächst sind die Sarps von
Menschenhand, vielfach im Konsensverfahren,
eingeführt wor-
den. Gezwungenermassen in Kauf
zu nehmende Unzulänglichkeiten
menschlichen Tuns führen zur
Erkenntnis, dass die Standards
und Empfehlungen nicht lückenlos
und nicht fehler- und widerspruchsfrei
sein können. Folglich
kann selbst die strikte Einhaltung
der Sarps nicht zur totalen Sicherheit
führen. Allein aus diesem
Grund wird ein Restrisiko im
System bestehen bleiben. Zu diesen
Unzulänglichkeiten kommen
auch unvermeidbare Risiken durch
die Anwender als sozio-technische
Systeme. Auch bestausgestaltete
Sicherheitskulturen können den
4
Anspruch der Risikofreiheit nicht
erfüllen. Die Bereitschaft, ein
Restrisiko zu tragen, ist eine
gesellschaftspolitische Frage.
Deutlich ausgeprägter ist folgende
Herausforderung der Standardisierung:
Die in den hoch kompetitiven
Märkten operierenden
Unternehmen können versucht
sein, sich auf die Erfüllung der
gesetzlich bindenden Standards
zu beschränken und auf die Um -
setzung der empfohlenen Praktiken
zu verzichten. Diese Diskussion
wird zuweilen auch unter
den Begriffen «Regeln der Technik»
und «Stand der Technik»
geführt.
Überdies wird die Feststellung
nicht überraschen, dass Partikularinteressen
von Marktteilnehmern
und Staaten dazu führen
können, dass in einer internationalen
Organisation relevante Er-
kenntnisse nicht immer in Empfehlungen
oder gar Standards
münden. Die zuweilen langsame
Weiterentwicklung der Sarps oder
die aufwändigen Zertifizierungsverfahren
können die Nutzung
technisch einführungsreifer und
sicherheitsförderlicher Innovationen
verzögern oder gar verhindern.
Der erwähnte international
erleichterte Marktzugang (dank
der Standardisierung und der
gegenseitig anerkannten Zulassung)
wird teilweise durch den
Aufwand der Normerfüllung
abge schwächt.
Neuer prozessbezogener
Ansatz
Im Umfeld bisher hoheitlich wahrgenommener
Aufgaben besteht
ein struktureller Bedarf an Standardisierung.
Das wird besonders
deutlich im Bereich der Flugsicherung,
die bisher von einer teilweise
dünnen resultatbezogenen
Regulierung geprägt ist. Eurocontrol
hat dies erkannt und für
alle am geplanten Single European
Sky interessierten Flugsicherungsgesellschaften
einen neuen,
komplementären prozessbezogenen
Ansatz entworfen. Die Eurocontrol
Safety Regulatory Requirements
(Esarrs) geben nicht
technische Detailspezifikationen
vor, sondern verlangen von den
Flugsicherungsdienstleistern Meta-
strukturen.
Diese Metastrukturen fokussieren
auf den konstruktiven Umgang
mit Störungen und Fehlern, die
Ausbildung und Lizenzierung,
die Risikobeurteilung von Systemänderungen
sowie die Art und
Weise, wie Systeme grundsätzlich
zu spezifizieren, entwerfen, bauen
und zu prüfen sind. Für das
Sicherheitsmanagement ist dies
ein erfolgversprechender Ansatz:
Er ist technisch-operationell
lösungs neutral und deshalb im
Vergleich zum Bottom-up-Ansatz
nicht demselben Änderungsrhythmus
unterworfen. Diese
relative Stabilität ist der erreichbaren
Sicherheit grundsätzlich
förderlich. Insgesamt ist der pro-

safety bulletin – international regulation
Internationale Regulierung
zessorientierte Ansatz darauf ausgerichtet,
eine stete Verbesserung
in den Unternehmen zu erwirken.
Der schiere Umfang und die
Komplexität des bisherigen internationalen
Normenwerks verhindern
zuweilen eine hinreichend
schnelle Anpassung an die Entwicklung.
Umgang mit
Komplexität
Das Luftfahrtsystem ist breit gefächert.
Es vernetzt Teilbranchen
mit vollständig unterschiedlichen
Geschäftsmodellen, Technologien
und Berufsgruppen mit der ganzen
Breite an Bildungsansprüchen.
Das System ist grenzübergreifend
und mit politischen,
wirtschaftlichen, psychologischen
und technischen Rückkoppelungen
versehen. Die Standards und
guten Praktiken leisten einen
wesentlichen Beitrag zur Interoperabilität
im System.
Auf der Mikroebene sind die Sarps
ein wesentliches Werkzeug für die
Gestaltung der Arbeitsprozesse in
den verschiedenen Teilbranchen
und zur Sicherstellung vorhersagbarer
Resultate dieser operationellen
Prozesse – einem zentralen
Anliegen aus Sicht der Sicherheit.
Komplexe, sehr sicherheitssensitive
Arbeiten – wie zum Beispiel
ein Triebwerkwechsel inklusive
Betriebstest – werden dank solcher
Strukturen an (lizenzierte) Mitarbeitende
ohne Tertiärausbildung
endgültig delegiert. Wenngleich
die Sarps bedeutende Arbeitsvorgänge
delegierbar machen, so
bleibt trotz hohem Anspruch
an das Verantwortungsbewusstsein
der Ausführenden und deren
Vorgesetzten – insbesondere in
Bezug auf die Ausbildung und den
lernenden Umgang – das menschliche
Tun mit Fehlern behaftet.
Die Sarps bilden aber auch die
Grundlage für die Interoperabilität
auf der Makroebene. Das
grenz übergreifende Zusammenspiel
von Flugsicherung, Flugwetterdiensten
sowie der Einsatz­
und Routenplanung der Flug ­
gesellschaften ist beispielsweise
auf dieses Normenwerk angewiesen.
Auch hier steht die Vorhersagbarkeit
der Resultate für be­
herrschte Prozesse und ist neben
der kommerziellen Bedeutung
eines reibungslosen Betriebs von
direkter Bedeutung für die Luftfahrtsicherheit.
Das gesamte internationale Normenwerk
ist schliesslich eine
wesentliche Hilfe gerade für kleinere
Länder. Die von Icao, Eurocontrol
und anderen Organisationen
geschaffenen Strukturen
wären für kleinere Länder kaum
erreichbar und mit den Handelspartnern
abstimmbar. Der Preis
für die Übernahme der internationalen
Standards ist allerdings,
dass die Einflussmöglichkeiten
eines einzelnen Staates eher klein
sind. Um die Gestaltungsmöglichkeiten
zu wahren, ist eine kon­
5
sequente und aktive Teilnahme in
den massgebenden internationalen
Gremien erforderlich.
Suche nach
dem Gleichgewicht
Aus Sicht der Luftfahrtsicherheit
bieten international abgestützte
und gelebte Sarps eine der wesentlichen
Voraussetzungen für ein
nachhaltig wirksames Safety Mana­
gement. Dies gilt sowohl für technisch­operationelle
und organisatorische
wie auch für institutionelle
Belange. Offenbar gibt es
einen Zusammenhang zwischen
der Tiefe der vorhandenen Sicherheitskultur
bei Ausführenden und
Kadern einerseits und der Langjährigkeit
relevanter Sarps andererseits.
Ebenso bedeutend scheint auch
die Beobachtung, dass Standards
und empfohlene Praktiken dem
konkreten Gegenstand oder Prozess
gerecht werden müssen. Ein
Zuwenig ist der erreichbaren
Sicherheit ebenso abträglich wie
ein Zuviel. Relevante Lücken können
im kompetitiven Umfeld dazu
verleiten, auf sicherheitsrelevante
Massnahmen zu verzichten. Bei
überbordenden oder zu schnell
verschärften Sarps besteht die
Gefahr, dass die Aufmerksamkeit
ungebührlich vom weiterlaufenden
Tagesgeschäft abgelenkt wird.
Wirksames Safety Management
lebt – neben den hier ins Zentrum
gerückten Regeln – von stetiger,
langfristig angelegter Entwicklung
und vom Wahrnehmen der
Verantwortung nach dem Stand
der Technik. Zum künftigen
Stand der Technik wird eine Firmenkultur
gehören müssen, die
unerwartete Fehler und Risiken
als natürliche Begleiterscheinungen
anerkennt, sich gleichzeitig
aber systemisch darauf einrichtet,
diese als Teil des Tagesgeschäfts
nachhaltig und schnell einzudämmen.
Article on International Regulation, by
Andrea Muggli (from 2007)
1 Nicht Thema dieses Artikels sind
Aspekte der Security (Gefahren
im Bereich des Terrorismus und
der Kriminalität).
2 Neben der Icao u.a. die Federal
Aviation Administration (FAA),
die Europäische Agentur für Flugsicherheit
(Easa) und Eurocontrol.

safety bulletin – lessons learned
SAMAX/RIMCAS Alerts and Measures
As in the last two years some
SIRs and numerous OIRs have
been filed mainly on false alerts
the following feedback was given
to the authors of these reports
which is probably of interest for
other collaborators.
Remark:
Some statements are derived from
an SR investigation report on the
matter published in November
2011 and a report from the SAMAX
Steering Committee. Thanks also
to the TDE team for review and
the photos from TNR (also on title
page).
In 2011 many activities have been
undertaken by the project team to
improve the situation of SAMAX-
RIMCAS system.
Please find hereafter a summary
of the measures taken.
Technical Situation
A complete analysis of the actual
technical situation of the SAMAX/
RIMCAS equipment has been established
by technical services in 2011.
All relevant elements of the whole
information chain from the RADAR
(SMR), MLAT System, Tracker,
RIM CAS functionality etc. have
been included for ZRH and GVA.
This detailed analysis of the limitations/problems
identified by the
users includes also possible solu-
tions and actions in order to serve
as a basis for decisions of the
SAMAX core team as well as for
the SAMAX Steering Committee.
Performed activities
Since the official ODD of the
RIMCAS application several im -
provement measures (tuning) have
been performed.
In order to react to late alarms
on crossing runways (16/28) a
modification is operational since
6
begin ning of July which allows for
earlier warnings.
A further and more effective improv-
ement which enables the software
to distinguish vehicles from aircrafts
aims to get alarms as early as
possible in case two aircrafts are
moving on intersecting Runways
and also to get less alerts between
vehicles doing Runway check on one
Runway and aircrafts on the other
intersecting Runway. This software
is operational since Dec. 2011.
Next steps from
TECHNICS:
The SAMAX Core Team established
a roadmap on the basis of
the above mentioned SAMAX
Report. High priority items have
been analysed and possible solutions
elaborated including cost,
priority and schedule.
On this base, the SAMAX Steering
Committee decided on 4 th of
Nov. 2011 on the following
Actions:

safety bulletin – lessons learned
SAMAX/RIMCAS Alerts and Measures
For GVA:
1. Project ‘2nd SMR’
– Target: Improve primary coverage to reduce the number of false targets
+ ensure redundancy
– Suggested schedule: Start the analysis a.s.a.p. (location!) Project start
= May 2012
2. Project ‘MDS upgrade GVA’ (MDS4 + the addition and/or relocation
of RUs)
– Target: Improve coverage to reduce the number of false targets (incl.
reduction of “jumping veelos”)
(MDS4: improved and adapted MDS-Software)
– Suggested schedule: Start in May 2012
SAMAX-MDS Receive Unit Antenna
7
SAMAX-MDS Receive Unit
For ZRH:
Project ‘MDS upgrade ZRH’ (MDS4 + the addition and/or relocation
of RUs)
– Target 1: Improve coverage (especially Echo N, Zone S) to reduce the
number of false targets together with the current project request of
FZAG regarding the new stands / ‘Schallschutzhalle’. Coverage needs
to be improved as required by the FZAG safety assessment
– Target 2: Reduce the number of ADS-B false targets (“jumping veelos”)
(MDS4: improved and adapted MDS-Software)
– Suggested schedule: From 2012 – November 2013
Otto Grimm
SRO-T

safety bulletin – lessons learned
KONIL SID
For some assiduous readers, this
name will call back memories
dating back to 2006 & 2007. For
others, it will be source of more
recent encounters whilst it will
not say anything to a last portion
of people. For those, I will rapidly
go through the history of
this topic.
A couple of years back, air traffic
controllers working at Geneva
Tower and Departure sectors
reported quite a high number of
flights deviating from the published
KONIL standard instrument
departure route (SID). This
route has the particularity of turning
right turn relatively early (distance
~1.5 km from the runway
threshold / altitude of 200 m from
the ground) and to impose a double
restriction of maximum speed
(190 kts indicated airspeed) and
minimum bank angle (25°). These
restrictions, published according to
IFR terrain and obstacle calculations,
are there to keep the aircraft
clear of the Jura chain. At the time,
the maps published by a Data
Provider did not contain all the
restrictions of the departure route
and we were able to have them
corrected as well as displayed on a
separate sheet. For more information,
please refer to the September
2006 http://skydoc/llisapi.dll/open/
2044823 and June 2007 http://skydoc/llisapi.dll/open/2045022editions
of the Safety Bulletin.
The reporting of such deviations
then dropped for a couple of years
before increasing again end of
2009. This lead the Head of OPS
TWR/APP, to request a survey of
this issue and try to define which
recurring information we could
8
highlight. One of the main outcomes
was that the deviations
were more likely to happen to
business jets with high performances
than to more standard
commercial airliners. Unfortunately,
the answers we got from
the companies we wrote to did
not help us identify any other
issue.
The results allowed skyguide
to present the problem to the
AGF (Arbeitsgruppe Flugverfahren:
working group on flight
procedures under the lead of
our regulator). This group of
experts came up with an innovative
solution which consisted in
modifying the route description,
thus making the aircraft comply
with the speed restriction until
being established on a defined
track (QDM 041 GLA). This was
published with the May 2010
amendment of the Swiss AIP.
While monitoring the impact of
the change for the following
months, it is not until end of 2010
that a new survey was conducted.
Beginning of February 2011, an
Austrian based company provided
us with a very valuable feedback.
They had taken a closer look to the
Flight Management System (FMS)
and compared the route coding for
the KONIL SID on their Global
Express and Learjet/Challenger fleet.
It appeared that for ones equipped
with an FMS manufactured by
Rockwell Collins [Figure 1], the
FMS Database shows a speed limitation
of 190kts until the aircraft is
established on the 041° track.
However, in the FMS manufactured
by Honeywell [Figure 2 &

safety bulletin – lessons learned
Figure 1
KONIL SID
Rockwell Collins FMS (KONIL Departure)
3], the FMS Database shows a
speed limitation of 190kts valid
only until the 1st waypoint “*ALT02”
on the extended RWY centreline.
The speed restriction then drops
and the speed may be increased
to the default speed of 250kts
below FL100.
C:\Users\Norman Rose\Desktop\Departure Violation LSGG - Geneva\Departure Deviation VJS734.doc
The Global Express (fitted with a
Honeywell FMS) was the only aircraft
within their fleet that has
a fully integrated autothrottle
computer which commands the
speedbug automatically according
to the FMS database. In other
words, there is no pilot input
required although the crew can
manually override the system.
Page 2 of 4
The Rockwell Collins FMS Database shows a speed limitation of 190kts until the aircraft is
established on the 041° track.
This is fine if the
system if error
free and the crew
are fully aware of
the route to fly
and can monitor
continuously the
attitude of the aircraft. However,
small deviations may go unnoticed
by the crew but with potentially
high consequences.
While the company published a
safety alert recommending to use
still possible of course).
manual speed when departing on
the KONIL Departure route, we
contacted the manufacturer and
shared our concerns with them.
Honeywell was very prompt in
mandating the Data Provider that
coded the routes in their FMS
Database to correct the bug.
C:\Users\Norman Rose\Desktop\Departure Violation LSGG - Geneva\Departure Deviation VJS734.doc
Since the update of the FMS database,
the issue seems to have
slowly faded away. But past expe-
HONEYWELL FMS (KONIL Departure)
9
Page 3 of 4
The 190kts speed limit in the Honeywell FMS Database for the KONIL5C Departure is only valid
for the first waypoint “*ALT02” on the extended RWY centreline.
Background Information
Figure 2 Figure 3
The Global Express XRS aircraft is the only aircraft within the VistaJet fleet which has a fully
integrated Autothrottle computer which commands quences. the Speedbug When automatically the weather according con- to the
FMS database during normal operations (no pilot input required anymore, but manually override
HONEYWELL FMS (KONIL Departure)
The 190kts speed limit in the Honeywell FMS Database for the KONIL5C Departure is
for the first waypoint “*ALT02” on the extended RWY centreline.
Background Information
rience has taught me to be cautious
and to stay on my toes!
The KONIL issue may be a never
ending story… However, I am
confident that we have contributed
to increase the level of safety
for all our customers. And by
“we”, I mean:
– the TWR/APP ATCOs who actively
participated to the surveys
– the OOTX team for their valuable
support and extensive research
– the Deputy Flight Safety &
Accident Prevention Manager
of the Austrian company
– the AGF for their support
– the Data Providers and FMS
manufacturer
The Global Express XRS aircraft is the only aircraft within the VistaJet fleet which
integrated Autothrottle computer which commands the Speedbug automatically accor
FMS database during normal operations (no pilot input required anymore, but manual
still possible of course).
Why is this a skyguide
problem?
Indeed, we may ask ourselves this
question as it is the pilot’s respon-
C:\Users\Norman Rose\Desktop\Departure Violation LSGG - Geneva\Departure Deviation VJS734.doc
sibility to comply with the pub-
lished departure route. However,
as a responsible ANSP, we can
not overlook a safety problem
that could have disastrous conse-
dition allow ground contact and
the aircraft has excellent climb
performances (which allows it to
rapidly be above the Jura chain),
we could be tempted to consider
the safety impact of non compliance
to the published speed as less
severe. But what could happen
in low visibility conditions with
poor climbing performances and
a non adherence to the speed
restriction? One of our missions is
not having to find out!
We have all read that Safety is
everybody’s concern; there’s no
doubt about that! But Safety
improvement is only possible if
you have a good teamwork…
Ivan Rochat
Safety Domain Manager Geneva

safety bulletin – lessons learned
Safety - More Important
than Compliance
Late in 2011, skyguide became
aware that at Geneva Airport, we
were non-compliant with an
ICAO provision regarding wake
turbulence separation for a
displaced threshold. The ICAO
provision (described in ICAO
PANS-ATM 4444 § 5.8.4 §a) was
correctly described in ATM Manual
Switzerland, but was not
applied in practice. Skyguide
compliance with ICAO regulation
is required under Swiss law,
so we immediately sought to
introduce measures to correctly
comply. For departures from
the LSGG displaced threshold
RWY05, the current ICAO provision
requires that for a light or
medium category departure following
a heavy arrival, or light
departure following a medium
arrival, the aircraft is separated
by 2 minutes.
This change was safety assessed
and introduced on 10 November
2011. However, following implementation,
a significant increase
in complexity was encountered by
the Geneva Aerodrome Control-
Photo (wikipedia): the air flow from the wing of this agricultural plane is made visible by a technique that
uses colored smoke rising from the ground.
lers and this prompted skyguide
to more closely assess the ICAO
requirement. What we found was
surprising! While only Paragraph
b) of the ICAO text allowed application
“if the projected flight
paths are expected to cross”, for
10
some strange reason (despite
seeming equally valid), this flexibility
was not permitted for Paragraph
a).
For many years skyguide has been
active in the field of wake turbu-
lence separation research. These
activities included participation
in WakeNet, an international
Wake Turbulence forum, the
ICAO/EUROCONTROL/FAA
Wake Vortex Task Force, and contributing
to several programmes

safety bulletin – lessons learned
Safety - More Important than Compliance
seeking to review and update the
current ICAO wake turbulence
separation requirements.
This involvement has allowed us
to develop real expertise in the
field and to establish respected
international contacts. Our
deeper assessment of the Geneva
issue found, that several ANS providers
(including US FAA and UK
NATS) already deviated from the
ICAO provision and also applied
“if the projected flight paths are
expected to cross” to Paragraph
a). However, through coordination
at EUROCONTROL, we
learnt that several other European
States complied fully with the
ICAO text resulting in both
reduced capacity and a potential
reduction in safety (due to the
increase in complexity). Others,
had the ICAO provision fully prescribed,
but ignored the requirement
in operational practice..
Skyguide expert analysis showed
categorically that the ICAO text
was wrong and that the increase
in complexity for the Geneva controllers
negatively impacted on
safety. This prompted several concurrent
actions, including contacting
FOCA and launching a
process to deviate from the ICAO
requirement. We also raised the
issue internationally with EASA
and EUROCONTROL, and also
critically with ICAO. After several
meetings to fully explore the issue,
FOCA approved a deviation from
the ICAO requirement on 12th
February 2012 and this allowed
Geneva Operations to publish a
Service Order on 27th February
2012, applying “if the projected
flight paths are expected to cross”
to paragraph a), which significantly
reduces the complexity,
and therefore provides a positive
safety benefit for operations.
Later, prompted by skyguide
ICAO investigated internally and
learned that they had always
intended that the line “if the projected
flight paths are expected to
11
cross” should be applied equally
in both paragraph a) and paragraph
b), but somehow a transposition
error more than 35 years
ago, established the current text of
the requirement. Today, ICAO
has accepted the error and is moving
quickly to correct it. When
this occurs, skyguide will again be
compliant and we will be able to
remove the ICAO deviation from
ATM Manual Switzerland and the
Swiss AIP. Additionally, globally
the diversity of application and
level of complexity will be
reduced. Runway throughputs
will be increased and safety levels
at least preserved.
What does this show? Important
lessons can be gained from this
experience. The first is that compliance
does not always equal
safety and although correct application
of international standards
normally enhances safety, care
must always be taken to ensure
this is the case. The second lesson
is that investment in our experts
and their involvement in international
working groups pays benefits.
In this case, our experts had
the necessary knowledge, international
contacts, and recognition
within the wake turbulence
domain to be able to successfully
challenge the ICAO standard.
Finally, and perhaps most importantly,
skyguide’s commitment to
‘safety is the first priority’ overcame
major hurdles and helped to
ensure our operation continued
to remain safe, despite an incorrect
international regulation
established more than 35 years
ago!
Rod McGregor, OOT
Head of OPS regulation
Isa ALAKALAY
Head of ATM procedures

safety bulletin – technical SIRs
SIR status report in T department
The Origin,
I’d like to come back with a short
re-introduction of the SIR, just as
a reminder, and answer to few
questions: what is a SIR? when I
can use it, what can I report?
What is a SIR?
It stands for “Safety Improvement
Report”. It is a VOLUNTARY
reporting system designed to
encourage people to report
UNSATISFACTORY STATES (as
opposed to the OIR which is
made to report actual occurrence),
which they believe, could
have significance for safety and
on the basis of which we could
IMPROVE something. Your re -
port can be confidential or not, it
is up to you to decide, but for sure
this reports remains totally internal
because we do not need to
report it to authorities.
What can I report?
The SIR is made to capture situation
that have a potential to cause
incidents! In other words, in
some specific circumstances, the
sequence of event may bring to an
incident. Those issues should be
reported to your management in
the first place. In case you do not
have any positive reaction, or you
think no adequate solution has
been brought, then you can write
a SIR.
It is also the way to remind of a
well know situation that is not
comfortable. This to make sure
the situation is not forgotten
(RIMCAS).
Can I write a SIR regarding the
coffee machine at the canteen?
Well... is it a safety problem for
ATM? If the answer is no then
maybe it is better you talk to
people working at the canteen;)
You may have a better feedback.
Anyway if you write a SIR that is
not relevant, the Safety department
will inform you. On the
13 Open
12
other hand, it is better to write a
SIR when you feel uncomfortable
with a situation instead of not
saying anything!
Do I have to write my SIR
in English?
You can use one of the main
languages used at SKYGUIDE
(English, German or French). The
most important is that you can
describe the situation and that
people understand you.
Figure 1 (13 open January 2011, 15 open Dec. 2011, and 15 new SIR)
An example
Let’s look at one SIR we had not
long ago. It is an interesting one
because it has to do with technics,
operations and human factors.
Without going in detail, the SIR
was written after an emergency
situation. During the event, the
person under pressure gave obsolete
information without noticing
that the info was from the previous
day.
15 Open
15 New

safety bulletin – technical SIRs
SIR status report in T department
Just looking at it from the technical
side, we have many ways to
give information to the ATCO on
a screen, and even more ways to
show that the info is not up to
date!
One easy way is just to write the
information “date” and “time”
somewhere on the screen. But
under certain circumstances, it
may not be obvious to see it.
(Maybe you can try the “test your
awareness: do the test” on youtube
and you will be surprised!) Any
other solution? Yes, we can do
much better! Just by changing a
8 Close
5 Transfer
to O
background or a colour information
would make it much more
the reliable. It is what we did in
Dübendorf and it will come in
GVA in May. Thanks to the author,
we can improve the “readability”
of the information. Just looking
at the screen we know if the
information is up-to-date or not,
no need to read any text!
Let’s go back to 2011
Can we say we had a good year
about SIR or a bad year in T?
Maybe it would be interesting to
define what is good or bad, but we
will think about it later.
13
To resume 2011 I can say:
We had 13 SIR open on the 1 st of
January 2011 and 15 at the end of
the same year.
During the period we had 15 new
SIR.
We were able to close 8 SIR, it
means a technical solution has
been implemented.
Now lets look at the SIR process,
when a SIR is assigned to the T
department, the concern division
will find a technical solution. If
the solution require a new order
for the Operation department,
8 Plan
3 RIMCAS
Ghost
6 In
Evaluation
then we “transfer” the SIR to the
concern unit in O. It means the
Operation will decide to change
the system or not depending on
added value.
From the 15 SIR open, 8 have a
planned solution or a solution
propose. 6 are under investigation,
it means we try to understand
the problem describe in the
SIR and we find a solution to it.
One is on standby.
Jean-Pierre Lambert, TTC
SPOC technical SIRs

safety bulletin – strategy
Safety Strategy 2012-2016
In a recent article for EHS Today,
Terry L. Mathis talks about question
marks around safety strategy.
Mentioning Plato’s assertion
that the unquestioned life is not
worth living, he then links it to
his statement that an unquestioned
safety strategy is not
worth following either. To justify
the presence of the above citation
in this editorial, I believe it
is important to give you an idea
about what we are currently
doing in terms of safety strategic
goals and objectives for the
upcoming five years within our
company.
The first issue of the safety bulletin
of 2012 starts with an update
on the new safety strategy 2012-
2016, which skyguide has started
to develop at an early stage this
year. Our current safety strategy
2009-2013 is coming to the end
of its existence, having complet-
ed two thirds of its objectives
and respective goals by now.
Confronted with a number of
challenges from BMS, the SES
Performance Scheme, together
with other strategic, operational
and financial objectives, the
Executive Board has approved
the development of a new fiveyear
safety strategy.
The main purpose of updating
the safety strategy is to have a
clear view of the direction to
develop as a company when we
speak about safety, and how we
are going to accomplish this.
Having our focus on the safety
ambition level from Compliance
to what we call Best Practice, we
can determine the orientation of
the strategy with respect to the
achievement of identified objectives
and goals.
Design and timeline
The design of the strategy will be
sketched on the way, as we progress
through our development
steps, with inputs and feedback
from O, T, C (by delegated participants
in the work package) and
from the SSG-SG (by regular
presentations and consultations).
Doing so facilitates us to be consistent
with the real safety targets
of our company and our daily
operational environment characteristics.
We keep an up-to-date
monitoring of international and
national requirements, while performing
benchmarking and gap
analysis with our counterpart
organisations across Europe.
Nevertheless, striving to comply
with HRO principles is one of our
main considerations. Hence, our
The SAFETY PRIZE is coming soon!
A detailed information will be published shortly
14
new safety strategy will pursue to
continuously improve our organisation,
with direct communication
between top management
and front-line personnel.
Regarding how we will proceed in
obtaining the physical documents
to stand proof for our new safety
strategy, we have structured our
workload on a timeline frame,
having the end of September 2012
as an official release point.
Implementation and
measuring
Keeping track of our progress and
measuring the evolution of our
strategy shall be done through
the quarterly Safety Performance
Cockpit and the Annual Safety
Report, which will ultimately
serve as means of control for both
the S department and senior management.
Ana Maria Cotofan
SDE