While the COVID-19 pandemic raged around us, I was standing in our approach control’s radar room and my supervisor had just taken a call from our overlying center. Eyebrow raised, I asked, “Bad news?”
“Center took a COVID hit,” my sup said, “So they’re closing down overnight for cleaning.”
Controllers normally work in close quarters, sharing touch screens, phones, and keyboards, and breathing the same air. An epidemiologist would cringe if they saw our radar rooms or tower cabs.
Most ATC facilities nationwide divided controllers into two or three, nonoverlapping teams to minimize exposure if a controller tests positive. Fewer people per shift means higher workload and some ATC services being curtailed, as my colleague Elim Hawkins outlined in the August 2020 IFR.
These teams are scheduled on separate days, and expected to be available for recall on their days off. So, if someone on Team A tests positive, the facility closes down (typically overnight) for a professional cleaning. The next day, Team B would work while Team A quarantined until each of A’s members tested negative. Center was implementing that very plan, which minimizes impact on pilots and aircraft operators.
If an ATC facility shuts down, though—even temporarily—airplanes still need to get places. What if their routes or arrival/departure airports lie in that closed facility’s area? That’s when controllers elsewhere step up.
Never Surrender
Like aircraft, ATC facilities have redundancy, but some things are absolutely critical. You’re (hopefully) familiar with your aircraft’s Minimum Equipment List (MEL). If something on that list breaks, your “go-fly” day could become a “no-go” day.
Once airborne, different failures impact a flight’s ability to continue. Did one of your two radios quit? That’s probably an inconvenience, but doesn’t end the flight. However, if you’re in a twin and one of your two engines quits … well, you’re looking for a place to land. In ATC facilities successively degrading capabilities are Operational Contingency Levels, or OCLs.
Let’s establish a baseline where everything is working. Imagine a terminal radar approach control (TRACON) that’s combined with an attached tower. The radar side has four scopes and four frequencies. Its tower has three freqs: Tower, Ground, and Clearance. The facility uses a single terminal radar located in its airspace, backed up by radar feeds from the overlying center.
Suddenly, two out of four radar frequencies fail. Affected radar controllers use portable radios to move their planes over to the two remaining freqs. Coincidentally, a hardware issue cuts the center radar feed, leaving no radar redundancy. Technical Operations personnel (TechOps) are notified that repairs are needed. Meanwhile, the pilots outside might never notice a change. This OCL is called an ATC Alert, where ops appear normal, but additional failures might degrade services.
Unfortunately, the attached tower is about to experience something shared by every tower I’ve ever worked: plumbing issues. From the sink behind the tower controllers, the smell of raw sewage bursts forth. Gagging, eyes watering, the controllers tell the radar room to hold all arrivals, broadcast to all aircraft on tower freqs that they’re evacuating the tower, and bolt down the stairs.
Does the world stop just because the tower filled with noxious gas? No. What happens to an airport when its tower closes? It becomes—you guessed it—a non-towered airport. Controllers in the radar room pull up the clearance, ground, and tower frequencies, print out the flight plans, and issue hold-forrelease clearances to departures. Arrivals are issued IFR cancellation instructions. Without Ground, aircraft are on their own taxiing.
This OCL status is ATC Limited, where a terminal facility loses one segment of its operation—either the radar room or the tower—but can still safely provide partial services. Let’s take note of something else. Despite the calamities described, this facility is still running its own airspace. Operations are impacted, but they are limping along under their own power. What happens when that’s no longer possible? We’ve reached the last OCL level: ATC Zero.
Zeroed Out
If ATC Limited is a partial engine power loss, ATC-Zero is a complete engine failure. Things are going down, and safety— always the key word—is potentially compromised.
What if the facility lost power and the backup generator didn’t kick on? The battery backup won’t last forever. Soon, the scopes and radios will quit, and they’ll be blind and more-or-less deaf and mute, relying only on portable radios with limited range. If they can’t see or talk to the aircraft, zero services can be provided. Therefore: ATC-Zero.
Equipment failure is only one obvious cause. Let’s not forget the human factor. Gear can be repaired or replaced. Lives can’t. In the world of COVID-19, even with masks, reducing personnel in the building, and maintaining distance, controllers fight the law of averages.
As of this writing, over 180 controllers have tested positive for COVID-19, affecting over 120 facilities. At least one has died: Mike King of Key West Tower. His 37-year career began in the U.S. Air Force. He later joined the FAA, spending 20 years at Tampa Tower/Approach, before retiring out of the FAA and transitioning to the KEYW contract tower. Three weeks after his COVID-19 diagnosis in July 2020, he passed away at age 66. He’d just bought a new condo.
With so many deaths in the USA, we’re trying not to add to the statistics. Remember how we share workspaces and equipment? If one of us tests positive, everywhere that controller went in the facility is considered exposed. Radar rooms, tower cabs, break rooms, bathrooms are all exposed. For full decontamination, the facility must be shut down so outside cleaning crews can do a thorough job. No controllers means, again, ATC-Zero.
There are many reasons for an ATCZero call beyond equipment failure or a COVID-19 cleaning. Security threats, natural disasters like earthquakes and hurricanes, a fire, or anything else that threatens people or equipment can trigger ATC-Zero. A bomb scare and fires necessitate evacuation. During a hurricane, radar installations may be shut down and their dishes unlocked so they can weathervane in the winds. Without a minimum level of people and functional equipment, operations become impossible or unsafe.
Dividing by Zero
While ATC-Zero seems like it’s the last hurrah, even that OCL is divided into four levels of severity. These are defined by the reason and how long before things will be back up and running.
When an ATC facility needs assistance, it can call on other facilities under, above, or around it to pick up the load and keep traffic safely moving.
Level one predicts a fast recovery. Regarding our imaginary TRACON whose backup generator didn’t automatically kick on, it could be just a couple minutes before a tech manually engages the generator. Meanwhile, its controllers prevent any more aircraft from entering their airspace. That includes telling all towers under their jurisdiction to stop departures and asking neighboring radar facilities to hold or reroute traffic.
Level two is a short-term shutdown— like COVID-19 cleanings. Still, even if it’s a relatively short closure, air traffic needs to keep moving. To maintain services, the affected facility passes its airspace to one or more neighboring facilities. For example, an impacted TRACON can give its airspace to overlying center controllers, who have some familiarity with the airports in that airspace. Arriving or departing aircraft will be assigned the center’s frequencies.
What if a center goes down? That’s a lot of airspace. But, centers have multiple TRACONs under their purview. Instead of aircraft going around or above those approach facilities, they can be routed through them at lower altitudes. TRACONs that don’t normally touch can coordinate to expand their airspace so they can hand off aircraft to one another directly. It likely means more circuitous routes at less fuel-efficient altitudes, but at least the traffic is getting services and going somewhere.
Level three involves substantial, but repairable damage. Imagine a hurricane’s aftermath. The facility could be physically damaged. Roads could be blocked. Personnel might have evacuated. While days or weeks might pass before it’s back on line, there is eventual light at the end of the tunnel. Meanwhile, like with level two, the airspace is divested to the neighboring facilities.
Finally, there’s the level four—the facility is irreparably damaged. Perhaps a terrible fire left the whole facility a smoking hulk. There’s no telling when—or if—it’ll work traffic again. While higherups decide what to do, that traffic still needs to flow. Some of the destroyed facility’s controllers, tech ops, and support personnel will relocate to neighboring facilities and work their home airspace from afar. Whatever it takes to accomplish the mission will be done.
When 2004’s Hurricane Ivan made its devastating landfall in Pensacola, FL, it tore off the Pensacola TRACON’s roof. As the sun rose the following morning over a shattered city, its rays touched radar scopes that had never seen the light of day. Blue skies looked down upon debris-covered keyboards, waterlogged computers, and sensitive equipment flecked with pink insulation and debris. ATC-Zero was declared.
As dire as things looked, though, the old TRACON’s story didn’t end there. Construction crews, controllers, and Technical Operations personnel set to work cleaning and repairing the TRACON. Some of the radar controllers relocated to nearby Pensacola Tower, which withstood the storm. Using the tower’s radar displays, they were able to provide limited approach services to the myriad military, rescue, disaster relief, and media flights descending on the Gulf Coast.
A mere 20 days after a vicious storm gave it a skylight, the TRACON was able to reopen with three-quarters of its scopes operational, a testament to the perseverance and teamwork of everyone involved. —TK
Getting it Done
With the news our overlying center was going ATC-Zero for its COVID-19 cleaning, my facility had to prepare. It was only a level-two event, just a few hours of closure overnight. Traffic was thankfully expected to be light.
Phone calls were made. A plan was formulated: use the TRACONs. Now, there’s no magic switch that suddenly sets everything in motion. The details needed to be worked out between controllers, tech ops, and management.
The first element? People. We and one of our adjacent TRACONs had our usual midnight-shift crews, so we were covered. However, another neighboring TRACON usually closed overnight and gave up their airspace to the center. Instead, they brought in a couple controllers on overtime so they could remain open until morning.
Second was pre-arranged coordination. Typical TRACONs own up to between 10,000 and 15,000 feet. Altitudes at or above 18,000 feet require specialized “flight level” phraseology and procedures that many of us had simply never used. So, Center assigned all the airspace above them up to 17,000 to those TRACONs. That way we were working within our capabilities and training.
Additionally, any center airspace between the TRACONs was divided up. Given that we were working under unusual circumstances, we went with the path of least resistance. If there was a 20 mile no-man’s-land gap between us and the next TRACON, with a particular fix smack in the middle, we took the 10 miles on our side of that fix, and they took the 10 miles on their side. We also ensured each TRACON had the maps and frequencies for the others to ensure we were putting aircraft on the correct freqs and altitudes.
In the end, it worked out pretty smoothly. Airplanes got where they needed to go, even if it was via routes and altitudes they hadn’t expected. We learned from any unforeseen hiccups encountered along the way, so if we need to do this again, we can do it even better. The experience was both humbling and gratifying, knowing that if we ever need help, we can depend on these friends and colleagues to have our backs, and look out for our traffic when we can’t.
