2-5
1. Physical Room Layout. Interpersonal communication, visual lines of sight, and the auditory profile of a room are key considerations when designing the physical layout of an OCC.
2. Size of Room. The room should be small enough for individuals to be able to see and hear discussions within the room for situational awareness. However, the room should not be so loud as to hamper communication.
3. Visual Lines of Sight. Personnel should be able to see their colleagues. Walls that segregate personnel are undesirable.
4. Pods. Pod-type workstation areas, where one to four OCC personnel work in small work groups, easily provide for the interactions and load shedding that may be necessary when abnormal or emergency situations develop.
5. Physical Workstation Areas. Because OCC personnel often work long shifts and sit for extended periods of time, the design of physical workstation areas is important.
6. Chairs. Chairs should be comfortable. High-backed chairs that rock, swivel, and have wheels are preferable.
7. Main Desk Surface Area. The main horizontal surface plan of the desk or workstation should not be too high or too low. Workstations that are adjustable to allow for sitting and standing are ideal. There should be ample desk surface area to comfortably spread out work materials.
8. Shelving and Storage. There should be ample shelving to aid in keeping items off the desk surface area. There should also be ample enclosed filing and storage capacity.
This will allow for ease of accessibility to SOPs, the Post-Accident/Incident Plan (PAIP), etc. Shelving and filing containing items such as these should be centrally located and clearly labeled.
2.6 OCC Technology and Design Considerations.
2.6.1 Failure and Redundancy Considerations for Both Systems and Processes. As technology increasingly becomes an essential part of flight operations, failure becomes a greater concern. For example, the temporary failure of an OCC’s LAN may render most of an OCC’s functionality inoperative (e.g., phone system, communication console, email, Internet access, ASDs, weather systems, data link, radios, etc.). Thus, it is important to plan for technology failures and design redundant systems and processes to ensure that the end results provided by contingency systems remain the same. In addition to planning for temporary or less-severe failures and outages, severe technology failures should also be expected and prepared for by the development of an OCC information technology (IT) disaster recovery plan. This plan should be documented, and OCC staff should periodically practice contingency operations so they are prepared for such an eventuality.
2.6.2 C ommon Tec hnology Interruptions. Common technology interruptions that should be planned for when developing, implementing, and integrating an OCC include:
2-6
• Electrical power outages (localized to the building, the local area, or to a broader geographic area),
• LAN outages, and
• Internet Service Provider (ISP) or ISP connectivity outages.
2.6.3 Key Redundancy Considerations for Hardware and Infrastructure. The following considerations should be taken into account when designing redundancy into OCC systems:
2.6.4 IS P Connectivity . Software applications used by OCCs are increasingly becoming Web-based. This means that if an OCC loses its connectivity to the Internet, any Webbased applications become inoperative. Therefore, the FAA recommends that an OCC maintain at least two wholly independent connections to the Internet. The physical connections should enter the facility at physically opposite ends of the building, and they should be provided by two wholly independent companies. For example, two connections from the local telecommunications service providers will both become unavailable if the local telephone company’s network switch goes down. Ideally, these connections should also be load-balanced with automatic failover.
2.6.5 S erver Location . Ideally, OCC servers should be located in a secure data center that is hardened to protect against potential threats (e.g., flooding, hurricanes, tornados, etc.). If a hardened data center is not economically viable, then servers should be located in a secure location, preferably temperature controlled and shielded from fire sprinkler systems.
2.6.6 S ervers. Ideally, servers should be redundant with automatic failover and be Redundant Array of Independent Drives (RAID) configured.
2.6.7 W orkstations . Workstations should be standardized for full interoperability so that any staff member can perform their duties at any workstation. For example, either an OCS or a communications specialist (CS) should be able to comfortably work at the same workstation on alternate shifts. Additionally, an OCC should maintain at least one “hot spare” workstation for immediate use, in case one of the workstations normally in use becomes inoperative.
2.6.8 U ninterruptible Power Supply (UPS). All workstations, servers, switches, and other key infrastructure should have UPS batteries in the power supply chain. The sustainable uptime of various UPS configurations is a cost consideration: the longer the time, the higher the cost. A good middle ground approach may be to install stronger UPS units on vital infrastructure and lighter UPS units on less critical infrastructure. As an example, a good plan may be to install three-hour UPS units on key servers and two workstations, and then install 30-minute UPS units on remaining workstations. It is also worthwhile discussing interruption restoration priorities with the utility companies so they are aware of the critical nature of the HAA operation and could plan restoration priorities accordingly.
2-7 Note: Ensure all staff members and supervisors are aware of VoIP system redundancy characteristics, including whether or not the phone system is operational when the local ISP network is inoperative.
2.6.9 K ey Redundancy Considerations—Processes. OCC SOPs should include alternate processes that provide an equivalent level of safe operations during abnormal conditions.
For example, if an OCC LAN or local workstation fails, then phone numbers and radio frequencies that are accessed electronically may become unavailable. Therefore, a key process for which redundancy is required is an alternate means of accessing phone numbers. The following are basic core processes for which alternate (redundant) processes should be developed. While the list below may look as if it is hardware centric, the list is actually process centric; many processes are now hardware-dependent.
2.6.10 Phones and Communication. Mobile phones may provide a temporary workaround for inoperative main phone systems and radios.
2.6.11 Phone Numbers. A hard copy set of all phone numbers should be kept at each workstation. If the LAN or local workstation fails, all phone numbers that are generally accessed electronically may become inaccessible.
2.6.12 Internet Access. Laptop computers with cellular data modems may provide temporary Internet connectivity while primary connectivity is down.
2.6.13 Flight Monitoring. F light monitoring (refer to § 135.619(a)(3)) processes often rely on electronic applications such as ASDs or specialized communication gear (radio, data link, SATCOM, etc.). In turn, these specialized flight monitoring technologies often rely on Internet and/or LAN connectivity somewhere in the data chain to transmit the aircraft location information to personnel responsible for flight monitoring functions. Therefore, it is important that an operator identifies alternate flight locating procedures in the event that the primary flight monitoring application and procedures become inoperative.
Alternate flight monitoring processes generally call for alternate means of communication to track the aircraft (e.g., communication with outstations, hospitals, law enforcement, other aircraft, air traffic control (ATC), Flight Service Station (FSS), etc.).
2.6.14 IT Support Staff and Processes. An OCC’s technology infrastructure requires IT support staff for ongoing maintenance and support.
2.6.14.1 A n OCC requires IT support to repair inoperative items, including on-call support for critical items that require immediate repair. IT support can be achieved via in-house support staff or external outsourced support staff.
2.6.14.2 An OCC will require an SOP for reporting and tracking inoperative technology resources. Helpdesk ticket software applications can be acquired relatively inexpensively.
2.6.14.3 Information Security (INFOSEC) SOPs should be developed to protect the OCC IT infrastructure from damage, both malicious and unintentional.
2-8
2.6.14.4 Various IT industry best practices should be put in place by an OCC’s IT support staff in order to provide the OCC with business continuity in the event of an IT failure or interruption. Typical IT SOPs provide for information failover, backup, recovery, restoration, and reconstruction. Each of these processes is distinct and requires SOPs to be in place prior to a technology failure event.
1. “Failover” refers to seamless data and process continuity as one system fails (e.g., a hard drive) and a redundant system immediately provides resource continuity despite the failure of the first system.
2. “Backup” refers to the process of preparing a copy of data for later use in the event that the original operational data becomes lost or unusable.
3. “Recovery” refers to the process of recovering data that has been lost from a system.
4. “Restoration” refers to the act of restoring data to an otherwise functioning system.
5. “Reconstruction” refers to the act of reconstructing a software application that has become unusable and needs to be rebuilt from the ground-up.
2.7 Emergency and Abnormal Operations. HAA operators should prepare in advance procedures that most effectively leverage OCC resources during abnormal or emergency operations.
2.7.1 Partial or Full Loss of Function of an OCC. These procedures should address how to effectively manage the partial or full shutdown of an OCC and operational control procedures during partial shutdown events such as power failure, loss of connectivity with the primary ISP, or a complete OCC shutdown event that requires evacuation of the OCC or renders the OCC inaccessible (e.g., fire, earthquake, tornado, flood, etc.).
2.7.2 T otal Shutdown of an OCC. In the event of a total shutdown of the OCC, alternate locations for relocation of the OCC should be preplanned and “go-kits” containing laptop computers and other essential equipment should be immediately available for the OCS to “grab and go” should an emergency evacuation be necessary.
2.7.3 U navailable Facilities. The operator should consider situations where no local facilities are available for re-location of the OCC. In such cases, procedures should be available for maintaining flight monitoring and other processes assigned to the OCC involving flights already airborne, and if mitigation measures to recover functionality fail, the operator should consider invoking a temporary moratorium on launching any new flights during an event that requires temporary shutdown of the OCC. This might include the temporary transfer of OCC duties to other OCC facilities or to mobile resources until an alternate OCC facility is established.
3-1 CHAPTER 3. OPERATIONS CONTROL SPECIALISTS (OCS) DUTIES
AND RESPONSIBILITIES
3.1 OCS Duties. Each certificate holder must describe in its General Operations Manual (GOM) the duties and responsibilities of an OCS, including preflight risk mitigation strategies and risk control measures, and the use of a shift change checklist. The level of operational control authority delegated to the OCS should also be clearly defined in the certificate holder’s Manual and/or described in operations specification (OpSpec) A008.
Per Title 14 of the Code of Federal Regulations (14 CFR) part 135, § 135.619, the minimum duties of an OCS include:
3.1.1 Communications. Ideally, the OCS should be able to communicate, via radio or other means, directly with the helicopter air ambulance (HAA) pilot in order to provide weather advisories and notifications to the pilot if any other factors affecting the overall safety of the flight arise and any mitigation strategies that may be available. If the OCS is routinely unable to communicate directly with pilots, a secondary means, such as relay through a communications center staffed by trained communications specialist (CS), must be available. These procedures should be incorporated into the certificate holder’s Manual or other written standard operating procedure (SOP).
3.1.2 W eather Reporting . The OCS provides pilots with weather briefings, to include current and forecast weather along the planned route of flight. While the OCS may obtain weather from non-National Weather Service (NWS) sources to aid in situational awareness, only information derived from the NWS or other FAA-approved sources should be relayed to the HAA pilot for use in making a “Go” decision. This information provided may be relayed to the HAA pilot by an appropriately trained CS.
• The certificate holder should authorize each OCS to exercise operational control to direct the pilot to decline, divert, abort, or reroute the flight. The OCS should never provide an opinion to the pilot suggesting that a flight can be initiated or completed when weather is a factor. Likewise, in the opinion of the pilot, whenever a flight should not be initiated or continued due to weather or other safety factors, the OCS should not suggest or direct otherwise.
• One principle employed by several operators is the “advise, suggest, direct” concept.
This means the OCS should advise the HAA pilot of any potential hazards along proposed routes, suggest possible mitigation strategies, and in the absence of any effective mitigation strategies, have the operational control authority to direct the HAA pilot to decline the flight, divert the flight, or terminate the flight.
3.1.3 Monitor the Progress of the Flight. The OCS is required to monitor the progress of each HAA flight. This may be accomplished through a variety of means, including satellite tracking, position reports, etc. Weather conditions in the area(s) of operation should be monitored with respect to each HAA flight’s progress, and a documented method should be established to communicate adverse or unforecast deteriorating weather conditions to the HAA pilot. In the event the OCS cannot directly monitor a flight’s progress via satellite or other graphic means, certificate holders should have established procedures for monitoring the flight via position reports or other means.
3-2
3.1.4 Preflight Risk Analysis. Risk Analysis procedures, principles, and policies are documented and are the subject of training by HAA operators. Multiple people with defined and documented roles and who receive specific training are typically involved in an FAA-approved HAA flight operations risk analysis program.
3.1.5 R isk Analysis. Risk analysis is an iterative risk assessment, mitigation, and reassessment process. Risk assessment is one key element of the broader risk analysis process. The risk assessment process should identify hazards, the probability of their occurrence, and the likely severity of the outcome should a hazard occur.
3.1.6 R isk Mitigation . Risk mitigation and its effectiveness in reducing risk is an essential component of the risk analysis program. If the risk assessment rates an individual risk element highly, mitigations may be advisable. Risk mitigations should be preplanned and preapproved, not assembled at the time of need, as unintended consequences may result.
Following application of an effective mitigation, the associated individual and total residual risk factor should be reassessed. This risk mitigation/re-assessment cycle should be repeated until all higher risks are effectively mitigated. Risks that remain high must either be acknowledged and accepted in accordance with the operator’s risk analysis program, or the proposed original flight operation or proposed flight operation modification should be declined.
3.1.7 R isk Threshold. Each individual risk element is weighed against an operator’s individual risk threshold and aggregated (combined risk scores remaining after application of approved mitigation strategies) into a total risk which, in turn, is weighed against the operator’s predetermined aggregate risk threshold. If the final aggregate residual risk and/or individual risk elements exceed the operator’s predetermined thresholds, approval of a higher level of operator management (above the OCS) is required. If this approval cannot be obtained, the flight should be refused (refer to §§ 135.615 and 135.617(a)(5)).
Section 135.617 requires HAA operators to have an FAA-approved and documented risk analysis program that includes procedures for elevating the final post mitigation residual risk to a higher management level for approval when the total risk exceeds a predetermined threshold.
3.1.8 P articipation Requirements . By regulation, the OCS must participate in the preflight risk analysis required by § 135.617. This section contains a brief description of the minimum participation requirements. HAA operators are encouraged to include in their risk analysis program any other requirements they deem appropriate to enhance safety.
3.1.8.1 The OCS must ensure the pilot has completed all required items on the preflight risk analysis worksheet. Procedures for determining the minimum items to be completed on the risk analysis should be detailed in the certificate holder’s approved risk analysis program. Risk analysis is discussed in detail in the current version of AC 135-14, Helicopter Air Ambulance Operations.
3.1.8.2 The OCS must confirm and verify all entries on the preflight risk analysis worksheet. The process of confirming and verifying the risk analysis entries
3-3 should be documented in each certificate holder’s Manual or approved risk analysis program.
3.1.8.3 The OCS must assist the pilot in mitigating any identified risks prior to takeoff and during flight if conditions change unexpectedly.
3.1.8.4 Risk mitigation strategies offered by the OCS should be offered in the form of suggested options that are previously validated by the operator. Risk mitigation strategies made on an ad hoc basis may result in unintended consequences. It’s important to note that the pilot in command (PIC) makes the final decision whether or not a recommended risk mitigation strategy is acceptable for the circumstances at hand. Conversely, the OCS is expected to evaluate mitigation strategies proposed by the PIC and determine their adequacy. The OCS should have the authority to direct the PIC to decline or abort a flight if the proposed risk mitigation is inadequate or inappropriate for the circumstances or if the residual risk remains excessive.
3.1.8.5 Certificate holders are encouraged to document when mitigation strategies are employed and their effect on the safe conduct of a flight.
3.1.8.6 The OCS must acknowledge, in writing, specifying the date and time that the preflight risk analysis worksheet has been accurately completed and that, according to their professional judgment, the flight can be conducted safely.
3.1.8.7 The method of this acknowledgement may be in any manner specified by the certificate holder in their approved risk analysis program. A signature is not required. This acknowledgement may be on the same risk analysis worksheet the PIC completes or on a separate record as long as the record contains the date and time of the acknowledgment, enough information to identify the PIC, the date of flight, the route of flight, that the preflight analysis worksheet has been accurately completed and that, according to the professional judgment of the OCS, the flight may be conducted safely, and any other information deemed appropriate by the certificate holder. The method of acknowledgement may be in writing, electronic, etc., as specified in the approved risk analysis program.
Note: Electronic signature safeguards and data security techniques are evolving rapidly. Discuss this section with your Principal Operations Inspector (POI) at the time of implementation planning (refer to the current edition of AC 120-78, Electronic Signatures, Electronic Recordkeeping, and Electronic Manuals, for more details regarding electronic signatures).
3.1.8.8 When an OCS, in their professional opinion, cannot concur that a flight can be conducted safely, the OCS should direct the PIC not to accept the flight. If the OCS observes a change in the risk analysis factors during the course of an HAA operation, the OCS should advise the PIC, recommend possible
3-4 mitigation strategies, and if the risk becomes unacceptable, direct the PIC to divert or abort the flight. This OCS authority should be documented in the certificate holder’s risk analysis program and GOM.
3.1.9 Emergency Assistance Capabilities. In addition to those duties required by regulation, the OCS can play an important role in providing emergency assistance to PICs during emergency situations such as an encounter with inadvertent instrument meteorological conditions (IIMC). In many circumstances, the OCS may be able to observe aircraft position and maintain communications with the PIC when the aircraft is below air traffic control (ATC) radar and communications coverage. Under these circumstances, the OCC may need to relay information to ATC regarding an aircraft declaring an emergency and the pilot’s intentions. Additionally, the only means by which the PIC may be able to receive accurate weather information or route recommendations to escape severe or deteriorating weather may be through the OCS.
3.2 OCS Shift Change/Relief Procedures. In accordance with § 135.619(c), certificate holders must develop a shift change checklist to be used by OCS personnel during OCS shift changes. Procedures for briefing the on-coming OCS of HAA operations currently in progress and those expecting to begin shortly should be developed, documented, and trained. A similar checklist should be available when relief is being provided to an onduty OCS for breaks, etc. These checklists should, at a minimum, contain:
1. Active HAA operations.
2. Any HAA operations being conducted with a risk level higher than “low” or that required management review that employed risk mitigation strategies.
3. Weather affecting possible flight areas including but not limited to a review of current surface analysis, radar/radar summary, surface prognostic charts, and other information deemed appropriate.
4. Available flight monitoring procedures.
5. Temporary flight restrictions (TFR).
6. Pertinent Notices to Air Missions (NOTAM).
7. Any technology anomalies.
8. Any new flight operations policies, manual changes, etc., that have taken effect since the on-coming OCS’ last shift.
9. Human factors affecting any HAA pilot, OCS, CS, or other company personnel that could affect operations.
10. Helicopter maintenance status.
3.3 CS/OCS Interfaces. Some HAA operators consider it a best practice for OCS to pass routine, non-critical information to the PIC through the communications center in order to ensure all parties (OCC, pilot, and communications center personnel) are aware of information being provided and of any possible route deviations, etc., that might occur as a result of OCS suggestions or direction.
3-5
3.3.1 Direct Communications. In all cases where the OCS is performing a task listed in § 135.619(a) and needs information from or wishes to pass information to the pilot, the OCS normally will communicate directly with the PIC. This direct communications link is crucial when the matter is time-critical or requires technical discourse to achieve a consensus position regarding risk analysis or weather options. It is recommended that the OCS advise the communications center as soon as it is feasible of the nature of the communication and any impacts it might have on the HAA operation.
3.3.2 No n -Normal Event. The OCC should be notified by the CS any time the CS becomes aware of an out of the ordinary event during an HAA operation. Such events include diversions, precautionary landings, or any other event deemed appropriate by the certificate holder. These notification processes should be documented in the certificate holder’s Manual or SOP.
3.4 Accident/Incident Procedures. Procedures should be documented for the OCS to follow in the event of an overdue aircraft or if an aircraft is known to have been involved in an accident or incident. This should include procedures for notification of appropriate company personnel and for notification of emergency medical service (EMS), fire, and police, if necessary, in the area where the aircraft is believed to be located. It is recommended that a listing of all EMS, fire, police dispatch centers, and their phone numbers for the areas where HAA operations are normally conducted be maintained at the OCS work station. The OCS may delegate some Post-Accident/Incident Plan (PAIP) local contact tasks to the CS. This option should be noted as such in the PAIP documentation.
4-1 CHAPTER 4. OPERATIONS CONTROL SPECIALIST (OCS) TRAINING
4.1 Helicopter Air Ambulance (HAA) OCS Training. Title 14 of the Code of Federal Regulations (14 CFR) part 135, § 135.619(d) establishes the requirement and § 135.619(f) establishes the minimum training required for HAA certificate holders operating 10 or more HAAs. Certificate holders operating fewer than 10 HAAs are encouraged to use the same training.
4.1.1 O CS Experience. Preferably, although not required, HAA OCS should be trained helicopter pilots and ideally be highly experienced HAA pilots.
4.1.2 Initial Training. B efore performing the duties of an OCS, each person must satisfactorily complete the certificate holder’s Federal Aviation Administration (FAA)-approved OCS initial training program. Initial training must include a minimum of 80 hours of training on the topics required by § 135.619(f).
4.1.3 Recurrent Training. E very 12 months after satisfactory completion of initial training, each OCS must complete a minimum of 40 hours of recurrent training.
4.2 O CS Prior Experience. A certificate holder may reduce the regulatory requirement of 80 hours of initial training provided the individual has certain prior experience. The training may be reduced as appropriate, but by no more than 40 hours. While the number of training hours may be reduced, all topics listed in § 135.619(f) must still be covered in training. It is recommended that the certificate holder perform a pretraining evaluation to determine which training topic hours may be reduced for persons who have obtained, prior to beginning initial training, a total of at least 2 years of experience during the last 5 years in any one or combination of the following areas:
• Military aircraft operations as a pilot, flight navigator, or meteorologist;
• Air carrier operations as a pilot, Flight Engineer (FE), certified aircraft dispatcher, or meteorologist; or
• Aircraft operations as an air traffic controller or flight service specialist.
Note: Prior experience as a communications specialist (CS) is not a qualifying source of prior experience.
4.3 Training Requirements. OCS regulatory training requirements are specified in § 135.619(f). Other requirements, as determined by the Administrator to ensure safe operations, may be added depending upon individual HAA operator circumstances.
4.3.1 T raining Program Approval. The OCS training program, as required by § 135.619, must be approved by the certificate holder’s Principal Operations Inspector (POI). The required training topics are discussed in paragraph 4-4. Should the operator decide to use contract training resources, the training should be conducted through a 14 CFR part 142 training center or another certificate holder in accordance with § 135.324, and the operator as well as the POI must approve the training curriculum and testing.
4-2
4.3.2 Training Elements. In addition to classroom or computer-based initial training, it is recommended that, after the OCS candidate has passed the knowledge test, initial training include scenario-based, one-on-one supervised, and coached on-the-job training (OJT) leading to the practical test. It must be understood that, in the case of OJT, the OCS acting as trainer must be aware of and is responsible for all actions taken by the OCS candidate under their direct and continuous supervision. Recurrent training should include periodic abnormal/emergency procedures drills. Recurrent training and testing must be accomplished before the end of the twelfth calendar month since the last test was accomplished.
4.3.3 T raining and Testing Personnel Experience. Those persons authorized by the certificate holder to conduct OCS training and testing should be experienced OCS personnel or other persons deemed appropriate and knowledgeable by the certificate holder. Initial OJT may be conducted only by specifically designated and current OCS personnel. This authorization should be shown by position or individual name in the approved OCS training program.
4.3.4 A llocation of Training Hours. While th e training hours specified in § 135.619 must be adhered to, the number of hours dedicated to each topic may be determined by the operator. The operator should develop the training curriculum and training hours based upon the full 80 hour requirements of § 135.619. The training program for OCS would be approved on the basis of the full 80 hours, with an approved means for reducing (but not eliminating) the hours dedicated to each topic based upon the OCS candidate’s prior experience. One method of determining training hours needed for various topics may be the completion of a knowledge assessment by the prospective OCS. This assessment would help determine the depth of knowledge the prospective OCS has with the various topics. The results of the knowledge assessment could be used to allocate training hours appropriately to ensure an adequate depth of knowledge across all subject areas.
4.4 Training Topics. Each certificate holder must have an FAA-approved OCS training program that covers at minimum the following topics:
4.4.1 Aviation Weather. To include:
1. General meteorology;
2. Prevailing weather;
3. Adverse and deteriorating weather;
4. Windshear;
5. Icing conditions;
6. Use of aviation weather products;
7. Available sources of information; and
8. Weather minimums.
4-3
4.4.2 Navigation. To include:
1. Navigational Aids (NAVAID);
2. Instrument approach procedures (IAP);
3. Navigational publications; and
4. Navigation techniques.
4.4.3 Flight Monitoring. To include:
1. Available flight monitoring procedures; and
2. Alternate flight monitoring procedures.
4.4.4 Air Traffic Control (ATC). To include:
1. Airspace;
2. ATC procedures;
3. Aeronautical charts; and
4. Aeronautical data sources.
4.4.5 Aviation Communication. To include:
1. Available aircraft communications systems;
2. Normal communication procedures;
3. Abnormal communication procedures; and
4. Emergency communication procedures.
4.4.6 Aircraft Systems. To include:
1. Communications systems;
2. Navigation systems;
3. Surveillance systems;
4. Fueling systems;
5. Specialized systems;
6. General maintenance requirements; and
7. Minimum equipment lists (MEL).
4.4.7 Aircraft Limitations and Performance. To include:
1. Aircraft operational limitations;
2. Aircraft performance;