If you wish to contribute or participate in the discussions about articles you are invited to join SKYbrary as a registered user


The Temporary Operating Instruction

From SKYbrary Wiki

Toolkit Navigation
"Problems, as well as solutions, are often far more complex than imagined, and require a systemic approach." Image: NATS Press Office CC BY-NC-ND 2.0

In early 2014, the UK experienced a prolonged period of low atmospheric pressure. At the same time, there was an unusual cluster of level busts at the transition altitude, which were thought to be linked to incorrect altimeter setting on departure into the London TMA.

Level busts have been, and remain, a key risk in NATS operation. Longer-term strategic projects, such as the redesign of the London TMA and the raising of the Transition Altitude, are expected to provide some mitigation. However, to respond tactically to the perceived trend in the short-term, it was decided to issue a Temporary Operating Instruction (TOI) to controllers.

The TOI required the inclusion of additional phraseology when an aircraft was cleared from an altitude to a Flight Level during low pressure days. The additional phraseology was “standard pressure setting” e.g. “BigJet123, climb now FL80, standard pressure setting”. The change was designed to remind pilots to set the altimeter to the standard pressure setting (1013 hPa) and so reduce level busts associated with altimeter setting. As this phrase was deemed to be an instruction, it was mandatory for flight crews to read back this phrase.

The TOI was subject to the usual procedural hazard assessment processes and implemented on 20 February 2014 on a trial basis, with a planned end date of 20 May 2014, after which the trial results would be evaluated. The change was detailed in Notices to Airmen (NOTAMs).

During the first day of implementation, several occurrence reports were received from controllers, who noted that flight crews did not understand the meaning of the phraseology, and did not read back as required. This led to additional radio telephony to explain the instruction, and therefore additional workload and other unintended consequences.

These reports prompted us to consider the level bust problem, the TOI and the response to its introduction as events unfolded, consistent with a Safety-II perspective. We used some systems thinking techniques and reflected on the ten principles. The results highlighted that the TOI was a simple, locally rational, but unfortunately ineffective solution to a more complex problem.

We started with the systems thinking perspective of going ‘up and out’, to make sense of the issue in the context of system. First, we drew a system map (Open University, 2014a, b) [1][2]. This describes the structure of a system under consideration from a particular perspective and for a particular purpose (in this case, to prevent level busts associated with incorrect altimeter setting). The main elements of the system were people, equipment, rules and procedures, information, operational environment and training. Each of these elements had sub-elements, some of which had further sub-elements.

We then considered the interactions between sub- elements using influence diagrams (Open University, 2014a, c) [3][4]. For instance, the atmospheric pressure (operational environment) influences the transition level (rules and procedures). The controller (people) influences the pilot (people) via RT instructions (information). Many interactions were identified, and those that were considered most influential in the context of the TOI were considered further. The ten principles were used to help examine the interactions between the TOI and altimeter setting.

Considering first the view of the person, the pilots and controllers are field experts, but in this case time was constrained, which limited the normal level of involvement in the development of the procedure. In terms of the pilot’s local rationality, many pilots would fly into the London TMA only infrequently. To these, the goal of the instruction may have been unclear, and interpretation variable. Of course, none intended to deviate from their level (just culture).

Moving on to system conditions and considering demand and pressure, the nature of work changes in low atmospheric pressure; there is a need to pay closer attention. The NOTAM acts as a resource, but not necessarily an effective one, since time to listen and interpret is limited (a constraint), as is time for RT to clarify the “standard pressure setting” instruction. On the ATC side, the initial TOI was published following standard process, but this may not have been the most effective means of communicating the need for change or to ensure clarity of understanding by the user.

When considering system behaviour, the interactions and flows are more complex than might appear. For many pilots (especially frequent users of the TMA), there is an expectation regarding RT phraseology. Deviations from this can be confusing and trigger requests for clarification, which disrupt flow. When reading briefings, there is a trade-off between efficiency and thoroughness. Reading all briefings very thoroughly might delay arrival into the ops room. Similarly, in radio- telephony under time pressure, efficiency is prioritised; attention to the readback may be reduced to attend to other information, such as radar. Performance variability, both intended and unwanted, is relevant. RT was already deliberately tailored, for example to pilots who might be unfamiliar with the London TMA and the transition altitude, based on perceived language proficiency, country of origin or operator. Requiring that all instructions contain the additional phraseology removed an element of flexibility.

In terms of the outcome, what occurred could be seen as a case of emergence. The TOI was associated with increased workload from confusion, additional RT, delays and incomplete readbacks. Our analysis was based on normal work, as the source of both success and failure (equivalence). The initial analysis was of work-as-imagined, but from a systems perspective. The next planned stage was to consider work-as-done via observation in the ops room. However, it became clear by the end of the first week of implementation that the ‘one size fits all approach’ taken in the TOI was not sustainable, and the TOI was cancelled.

Subsequently, a safety notice was issued highlighting the level bust issue and the range of operating techniques which were already being applied in day- to-day work to protect against the issue. The notice included a range of phraseology options, changes to controller style, circumstances known to contribute to level busts, consideration of the cockpit workload at the time of an instruction, and other techniques.

This experience is probably very familiar to many readers. Procedures are a common way to solve problems, but can have unintended consequences. In this case, the system map and influence diagram showed that the TOI was linked only very indirectly to the altimeter setting (a stronger link being the airline SOPs). This insight, along with consideration of the principles, showed that problems, as well as solutions, are often far more complex than imagined, and require a systemic approach.

Craig Foster Future Safety Specialist, NATS, UK

Anthony Smoker Manager Operational Safety Strategy, NATS, UK

Christine Deamer Safety Assurance Advisor, NATS, UK

Bill Leipnik Manager Swanwick Operational Safety Improvement, NATS, UK


Steven Shorrock Safety Development Project Leader, EUROCONTROL


  1. ^ Open University. (2014a). System maps and influence diagrams (basic tutorial).
  2. ^ Open University. (2014b). System maps (detailed guidance).
  3. ^ Open University. (2014a). System maps and influence diagrams (basic tutorial) .
  4. ^ Open University. (2014c). Influence diagrams (detailed guidance)

Source: EUROCONTROL (2014). Systems Thinking for Safety: A White Paper. Brussels.