House of Commons - Environment, Transport and Regional Affairs

Select Committee on Environment, Transport and Regional Affairs Fourth Report

AIR TRAFFIC CONTROL

1. At its first meeting on 16 July 1997 the Transport Sub-committee of the Environment, Transport and Regional Affairs Committee decided to inquire into air traffic control. Our terms of reference were:

When National Air Traffic Services (NATS) expected to begin operations at the new Swanwick air traffic control centre, and the causes of the delay in its opening

The terms under which the new Prestwick en route air traffic control centre would be constructed, and whether delays at Swanwick would postpone its opening beyond 2001/2

The new Government's policy as to the ownership of NATS and the funding of its capital investment programme.

2. Our original intention was to hear evidence only from NATS and the Department of the Environment, Transport and the Regions (DETR). However, following our meeting with both organisations we decided that we needed to hear the views of a number of other individuals and bodies. NATS was invited back to give further evidence to us towards the end of the inquiry. In addition to the oral evidence we heard, we received more than thirty memoranda and several supplementary papers. We thank all our witnesses for their assistance, and particularly Mr Douglas Mein and Professor Peter Ladkin who travelled from Canada and Germany respectively to give evidence to us. We are also grateful for the help we have received from our specialist advisers, Mr Laurence Price of SH&E, and Mr Robert Gifford, Executive Director of the Parliamentary Advisory Council for Transport Safety.

3. Members of the Sub-committee visited the Swanwick centre in November 1997. In January 1998 our specialist adviser, Laurence Price, visited the new Amsterdam air traffic control centre to obtain information about that project. We wish to thank the hosts at both facilities for their kind assistance.

Background

4. National Air Traffic Services Ltd is a wholly owned subsidiary of the Civil Aviation Authority (CAA) which is, in turn, an independent statutory body for whose performance the Secretary of State for the Environment, Transport and the Regions is accountable. The CAA is required by the Civil Aviation Act 1982 to provide air navigation services in the UK and areas outside the UK for which the country is, by international agreement, responsible. In addition to providing 'en route' air traffic control (ATC) from its centres at West Drayton, Manchester and Prestwick for aircraft passing through the airspace for which it is responsible, NATS also provides air traffic services at most of the major airports in the country and co-ordinates civilian and military air traffic control with the Ministry of Defence through the Joint Air Navigation Services Council. It has 5000 staff and an annual turnover of £500m. In 1996/97 it handled over 4 million aircraft movements.[1]

5. In spite of rapidly growing volumes of air traffic, NATS in recent years has managed to reduce air traffic control delays from their peak in the late 1980s, although delays have increased over the last year. The CAA has moved from being a net borrower from central government (more than £90m in 1994/95) to repaying £30m this year. At the same time it has reduced charges to users. These are set at a 'cost recovery' level which means that although borrowing for investment by NATS counts against the PSBR there is effectively no risk that the government will not have the money repaid.[2]

Investment in new air traffic control centres

6. Following a review last year, NATS reaffirmed its 'two centre' strategy which is designed to allow it to cope with rapidly rising traffic levels while allowing adequate contingency in the event that a centre were put out of action for any reason. The strategy involves closing West Drayton and Manchester en route ATC centres, building an entirely new centre at Swanwick in Hampshire (the New En Route Centre, or NERC) and upgrading the Prestwick centre (the New Scottish Centre, or NSC). The Prestwick centre would provide an immediate 60% contingency cover in the event of NERC failing, rising to 85% over time.[3] NATS said that airlines believed that this was an acceptable level of contingency given the cost of providing additional equipment. The Swanwick centre is being financed through CAA operating profit and government loans, while in 1993 it was announced by the then government that the Prestwick project would be financed through the Private Finance Initiative (PFI), under which the NSC would be designed, built and financed by a private sector consortium but would be operated by NATS as a part of its integrated ATC network. This decision has been reaffirmed by the present government.[4]

The Swanwick centre

History of the project up to January 1997

7. The new facility at Swanwick is required to replace the present facility at the London Area and Terminal Control Centre (LATCC) at West Drayton where there is a severe shortage of space for expansion to meet future demand. Demand on LATCC has grown from 1 million aircraft movements in 1989 to 1.5 million in 1997. The decision to proceed with the centre was taken in 1988, with a projected opening date of 1996. Construction of the building began at Swanwick in 1991 and was completed in 1994.

8. The contract for the definition of the software for the centre was awarded to IBM and Thomson CSF in 1991. In 1992 the implementation contract was let to IBM, with a delivery date of late 1995. During 1993 the system was designed and developed by IBM. In 1994 IBM International Air Traffic Corporation was acquired by LORAL Corporation, which was in turn acquired by Lockheed Martin in March 1996.

9. NATS told us that the technology chosen was "more advanced than anything that is being tried anywhere in the world". When the project was conceived it was thought that the United States would be installing similar technology as part of the Federal Aviation Administration's (FAA) Advanced Automation System, and that NATS would follow its American counterparts. The FAA subsequently "ran into considerable difficulties with this project and in the end abandoned it" in 1995.[5] After this, in November 1995, NATS' acceptance of the NERC system was halted. In January 1996, following software integration problems, NATS and LORAL announced that it was intended to accept the system in June 1997 and operate from December the same year. In December 1996 delays to the availability of the Training and Development Unit (TDU) prompted a further revision of the operational date to March 1998.[6]

10. In November 1996 NATS gave evidence to the then Transport Committee. The previous Chief Executive, Mr Derek McLauchlan, explained that the delay of a year had been caused by problems with the stability of the very complicated software at NERC. When tested on thirty workstations it had performed well, but when tested on 160 stations it had not worked. He told us that the contractors had met all the project milestones they had set since January that year and that he was confident that the system could be made to work.[7] In January 1997 NATS gave evidence to the Transport Committee again. Mr McLauchlan insisted that NERC was due to be operational by March 1998.[8]

Further delays and a new timetable for opening

11. In July 1997 it was announced that the operating date would be further delayed in order to incorporate additional functions into the systems and complete the air traffic controller training programme.[9]

12. In September and October 1997 NATS consulted the government, users and staff on six options for proceeding with the project, which would lead to a number of possible new opening dates.[10] One of these options was chosen and the resulting revised plan was for Lockheed Martin to complete the TDU of the new system by December 1997 and complete and deliver the rest of the operational system by April 1998. This would allow time for training and for the move from West Drayton so that the new centre could be operational in the winter 1999/2000 (it was not considered wise to open it in the busier summer season). NATS told us that during the consultation process its staff were "understandably cautious" and preferred the lower risk option of opening NERC in winter 2000/01. Others preferred moving to Swanwick using the operating methods presently used at LATCC.[11]

13. In view of the delay to Swanwick NATS decided that it was necessary in the meantime to increase the capacity of LATCC, since 10% of flights it handled in summer 1997 were being delayed by an average of over 9 minutes, and delays had increased over the last year. The airspace to the north-east of London, known as the Clacton sector, would therefore be 'resectorised' by winter 1998/99 to allow more air transport movements.

14. The present Chief Executive of NATS, Mr Bill Semple, was appointed in July 1997. When he gave evidence to us in November 1997 he was confident that the TDU would be ready for simulation training to begin on 1 December 1997. He described the actions that NATS and its contractors would take by November 1999 in order to bring the centre into operation. He was confident that he would meet the target date, which remained 1999/2000, but admitted that there was a risk that the programme might not be met. He was unwilling to estimate that risk.[12]

15. On 28 January the Guild of Air Traffic Control Officers (GATCO) told us that it was "concerned that the simulator does not seem to be working correctly and as a result training development units have been cancelled".[13] The union representing air traffic controllers, the Institution of Professionals, Managers and Specialists (IPMS), confirmed that training had not started in January and would not do so before March.[14]

16. The Chairman of the CAA, Sir Malcolm Field, wrote to the Sub-committee on 28 January 1998 with further information on the progress of the NERC project. The winter 1999/2000 target date had not changed, and there was spare simulation capacity and time built into the programme. He said that "the programme of simulations on the Training and Development Unit (TDU) is being re-assessed in the light of a number of change requests and other observations made by air traffic controllers before and during the course of the TDU work-up in December. There had been a clear feeling amongst controllers that their concerns about the system were not being listened to, and that further changes were necessary".[15]

17. Sir Malcolm admitted that there was risk that the programme might not be met, and contingency plans had been drawn up: "the first line of contingency in the programme is to extend the project timescale by one year".[16]

Software

18. Sir Malcolm said that 95% of the 21,000 defects that had been found in 1995 had now been eliminated. It was "a common problem in large software projects that there will be a significant number of defects found during test and development and that these take time to eradicate. Moreover, it is also a fact that new problems will be identified, and that change requests will add to the scale of the software revision task". He told us that "There is clear evidence that the stability and performance of the system, on the currently specified level of software, demonstrates that the system will work and will deliver its capacity".[17]

19. When giving further evidence in February 1998 NATS told us that it was "still working on the programme to bring the New En Route Centre into operation in the winter of 1999/2000", and that this was an achievable date, but that "there are inevitably risks along the road to achieving that".[18] NATS would know by April whether the software was viable and able to do the things for which it was designed, and by October, when extensive simulation work would have been done, it should know whether the target operation date was achievable.[19]

20. Mr Burlyn of the Aviation Study Group (ASG), which was formed in 1992 by aviation specialists with an interest in studying technological change and its effect on aviation personnel, told us that although the specification for Swanwick had included a large number of features to assist controllers, "Progressively the functionality of the system has been reduced bit by bit in order to try and bring it into use" and that there was a danger that this would reduce the amount of additional air traffic control capacity that the centre would offer. The Director Professional of GATCO also said that the facilities and support information offered by the new system were being reduced and was not sure whether the system that remained would be usable.[20]

21. NATS responded: "We are not reducing the functionality of the system ... as part of the programme we have identified a number of functionality changes and functionality additions which have to be made to the system now that it is being exposed to use by operational air traffic controllers. That is what we expected to find." Some additions were being made and some features surplus to requirements were being removed. 90% of the original system specification from the early 1990s was still relevant.[21]

22. Professor Ladkin, Professor of Computer Networks and Distributed Systems at Bielefeld University in Germany, wrote to us to comment on NATS' software development at NERC. He believed that the failure to 'scale up' the operating software from 30 to more than 100 workstations was evidence that there were fundamental system operation problems with the NERC software, and that "There is no reliable method for estimating how or if such problems can be safely engineered out of the system." The problem might also not be as simple as removing a certain number of 'bugs' from lines of computer code: unwanted behaviour in software systems was often more complex than that. It was possible that the system might never work satisfactorily. He stressed the importance of the users of the system-air traffic controllers-trusting it and finding it easy to use if they were to operate it safely and efficiently. He expected that many problems would be found by the users during the training phase and that therefore as much delay could be expected at this stage of the project as at previous ones.[22]

23. Professor Ladkin believed that, of the NATS options, only the final one, to extend the programme further, seemed to be sensible. The other options were flawed because:

if a software project was late, it could not be speeded up much, as resources had to be diverted to train new personnel
reducing functionality in mid-development required careful and considerable re-engineering
adding tasks not in the original project plan hindered development work on the basic system.

He noted that NATS had not proposed one further option, that of abandoning the project and starting afresh: "One wonders why this was apparently not considered. In the case that the system will never work effectively, this is clearly the best option. Experience with other new-generation ATC developments has shown that a careful evaluation of this option 'helps clear the air'."[23]

24. The Executive Editor of Computer Weekly wrote to inform us that in the journal's experience one of the most common causes of public sector computer failures was the inability of project teams to pass bad news up and down the chain of command. Parliament only discovered details of computer disasters years later. He also said that a common cause of failure was a lack of direct involvement of the users of the software until after it was delivered; this had apparently been the case at Swanwick. Although NATS had told the Sub-committee that only 5% of the computer bugs remained in the system, independent specialists had estimated that fixing those 5% could take 95% of the time available to the project team to resolve all outstanding IT issues. He recommended an independent audit of progress with the Swanwick project which could be completed by a single consultant in three weeks.[24]

25. NATS believed that an independent assessment of the integrity of the systems at Swanwick was unnecessary[25] and warned that, because of the complexity of the software, it would probably take more than two or three months.[26]

26. We sought further evidence from our witnesses about how long such an audit could take. The Editors of Computer Weekly magazine reiterated their view that a single knowledgeable consultant who had full access to people and documents could assess whether the Swanwick project was under control within three weeks without any delay to the project. They believed that the independent audit was particularly important because "the Swanwick project shows some of the classic early warning signs of a public sector computing disaster", including repeated missing of revised internal deadlines soon after assurances that the project was on target, serious problems being treated as teething troubles, continual modifications to the system to meet the demands of end users who had not been adequately consulted when the specifications were drawn up, and strong resistance to an independent audit itself. The small effort of an independent audit would confirm whether the project was on target, whether the timetable for testing was too short, or whether the system no longer met its requirements. They told us that "It is a common facet in failures of large projects that they are not abandoned early enough because of the lack of an independent auditor asking the fundamental question: is the project ever likely to be completed satisfactorily or should we pull the plug now?"[27]

27. Professor Ladkin believed that assessing the functionality of the system was a task with two steps: identifying the problem areas, and then assessing their nature and how long it would take to solve them. He estimated that the first stage might take three or four experts about 60-100 hours, but could not estimate how long the second stage would take since it would depend on the nature of the suspected problems.[28] It would not take longer than a year.[29] He believed that a two-stage technical audit was the only way to discover whether the software at NERC could ever be made to work, and that if nothing were done the problem might persist for a further two years.[30]

Cost of the project and the impact of delays

28. Of the total £339m cost of Swanwick, £163m is the cost of the system; most of the rest is the capital cost of the land and buildings.[31] NATS told us in November that all but about £20m of the cost of the system had already been paid to Lockheed Martin.[32] However, it was a fixed price contract, and therefore the cost of solving the problem lay with the contractor. That, NATS said, had cost Lockheed Martin a lot of money.[33] In February NATS said that £11m of the capital cost had still not been paid.[34]

29. The delay to Swanwick has, however, increased the cost of the project. NATS estimated this extra cost to be a net £2.7m, made up of a total of £18.6m of operational, project and other costs, including the cost of resectorising airspace at LATCC and the 58 extra air traffic controllers who were needed for the changeover to the new centre. This cost was offset by 'savings' of £15.9m. However £14.2m of these savings were attributed to deferred depreciation.[35] NATS agreed that this money would still have to be paid at some time in the future.[36]

30. The Swanwick project contrasts with the with the experience of the Netherlands in introducing its new ATC centre at Amsterdam, which will be only 6km from the existing centre. This will open in June1998, having been ordered in 1993 in order to cope with projected demand. It uses as its basis the previous ATC system with modernised hardware and new function enhancements. Some of the features, for instance vertical view stacks and visual display of the approach system, are considered extremely positive and capacity-enhancing developments. The centre's successful completion in this time is attributed to the fact that the organisation had a clear idea from the beginning of what it wanted and that the project manager and the contractor put great efforts into removing software bugs at the development stage rather than on site. Air traffic controllers and engineers were involved in the project from the start, and had constant discussions with the contractors, Raytheon. Within a week of delivery in Amsterdam, 70% of the system was functioning properly.[37]

1 ATC 03, para 2.2. Back

2 ATC 03, para 2.7. Back

3 Some of this eventual capacity would be provided by other facilities (ATC 03A). Back

4 Q82. Back

5 Q14. Back

6 ATC 03; ATC 28A. Back

7 Minutes of Evidence taken before the Transport Committee, 30 October 1996, HC (1996-97) 55-i, QQ57-60. Back

8 Ibid, QQ456-7. Back

9 ATC 01, para 9. Back

10 These options are set out in ATC 03, para 4.8. Back

11 ATC 03, para 4.9. Back

12 QQ8-9. Back