Softly spoken Scotsman Colin Chisholm, chief operating officer at National Air Traffic Services (Nats), has the professional manner of a doctor in whom people would be content to entrust their lives.
And to some extent millions of people have entrusted their lives to his care. As the day-to-day head of the safety-critical operations at the new Swanwick air traffic control centre near Southampton, Chisholm is responsible for staff and systems that control thousands of flights every day.
Over the Easter weekend alone, Swanwick's 200 IBM AIX-based workstations, fault-tolerant servers and two million lines of code, written mostly by US aerospace company Lockheed Martin, helped to handle 29,000 flights over England and Wales.
The £623m centre now copes with about 5% more flights than its ageing predecessor at West Drayton, near Heathrow airport. Within a few years, the system is expected to support 30% more flights than West Drayton.
But since going live in January, after nearly six years of delays, it has not performed flawlessly.
"We always recognised that there would be things to refine and improve about this system," said Chisholm.
Leaks of internal documents show that dozens of planner controllers, who are responsible for the transfer of aircraft from one air space to another, have had difficulties reading numbers and characters on their screens and some have made operational mistakes.
In one case a controller submitted an internal report saying that he had "initially co-ordinated" flight AIH978 bound for Glasgow to Cardiff because their location codes differed by only one character.
In his first interview since Swanwick became operational, Chisholm said last week that none of the mistakes reading screens had any impact on safety and all the errors were spotted in seconds.
However, Chisholm accepted that the Health and Safety Executive had considered the screens to be unclear at times and had invoked health and safety law to require improvements.
Further disclosures of internal documents about Swanwick's systems and operations now include "overload" reports which controllers must by law file if they have felt their workload to be excessive.
Since the beginning of this year - Swanwick went live on 27 January - the number of mandatory overload reports has more than doubled when compared to the same period last year, from 12 to 30. The total number of mandatory occurrence reports filed by Swanwick controllers, covering any incident which, if not corrected, would endanger an aircraft or its occupants, has increased from 133 in the first five months of 2001 to 247 in the same period this year.
Typically a mandatory occurrence report would be filed, said Chisholm, after a controller noted a possible loss of separation between aircraft, actual marginal losses of separation, infringements of air space or a military aircraft not performing within agreed procedures.
The increase in overload reports was attributed in part to problems faced by controllers after 100 workstations failed to boot up on 17 May, delaying thousands of passengers for several hours.
Some controllers have claimed that other overload reports are due to a gradual "ramping up" of aircraft handled by Swanwick after initial restrictions on capacity to allow systems to bed down.
They claim that Nats should not increase workloads until staff are acclimatised to the system, especially given teething problems such as unclear screens. But Chisholm insisted that workloads have increased only with the full agreement of all staff.
The increase in mandatory occurrence reports was caused largely by an echo in the headsets of controllers which impeded their voice communications with pilots.
This was put down to a flaw in the headset's microphone and messages being routed between the digital equipment at Swanwick, analogue systems at West Drayton, through to transmitters and back to Swanwick's digital configuration.
The echo problem has now solved, said Chisholm.
He also pointed out that the reporting of concerns, problems and observations is an integral part of the culture of Nats. Controllers are encouraged to file reports so that Nats can exploit constructive criticisms and comments to improve operations, procedures and safety.
"There is no hesitancy about filing [reports]. You'll find that in other parts of the aviation industry as well. That's why air transport is as safe and as good as it is, despite the complexity of the industry," Chisholm said.
There are five main categories of report forms related to the safety of Swanwick's operations. The middle three are mandatory occurrence, overload and engineering reports. These detail "reportable occurrences" which must be filed by law.
The last category is the operational and safety observation report which controllers complete voluntarily. Nats introduced these forms when Swanwick went live to give managers feedback on the system and new working practices.
So far this year 446 safety observation reports have been filed detailing problems such as the momentary mistaken co-ordination of an aircraft from Glasgow to Cardiff.
Chisholm conceded that many of these observations were made by controllers after they had experienced difficulties reading parts of their screens.
"Nobody is pretending that things will be perfect on day one," said Chisholm. "We recognise it won't be. You show me any new complex system especially with a complex human machine interface that is perfect on day one. We have done thousands of hours of testing on it.
"There is no question about it being safe enough to introduce but there was a recognition that we would have a phase of finding improvements and that's where the observation reports idea comes from," he added.
Chisholm believes the word safety in the title of the observation forms is misleading. "If somebody made a mistake [after reading the unclear screens] and it was followed on by three to four other events eventually it could be safety-related but of itself it was not safety-critical," he said.
A likely cure for the unclear screens has now been found, and a working group of controllers, union officials and others have accepted a prototype of a new typeface called Verdana which, with other changes, should make the screens easier to read. Chisholm believes that the changes can be incorporated into a software release and installed by November at the latest.
But the best news for Nats is that, since Swanwick went live, there has been none of the most serious incidents reported by controllers, "risk-bearing Airprox" notices. A risk-bearing Airprox is when aircraft come into close proximity with each other and there is a risk of collision.
"It's probably too early to say there has been a real and significant improvement in safety with the Swanwick system we have to bed it all down but the early signs are very encouraging," Chisholm said.
Some controllers remain concerned, however, that in responding to complaints about the system, Chisholm may be apt to attack the messengers particularly if their criticisms are strident.
He denied this. "Our whole approach to reporting is to encourage a no-blame culture. You'll find that throughout aviation industry. Large numbers of reports don't worry us," Chisholm said. "They would if they were all safety issues but by and large we are trying to encourage people to report things that they think might give us improvement in our operation or have a safety implication.
"It has taken us years to get to this point where people don't feel personally threatened by that," he added.
Chisholm said a major airline last year collected 3,700 mandatory occurrence and non-mandatory reports and was pleased with the result. "That is one major airline. They are encouraging their people to report all they see - but 3,700 is way beyond anything we are dealing with," he said.
Types of report
Operational and safety observation report
Voluntary feedback on the system and working practices. Controllers have filed 446 reports so far this year
Mandatory overload report
Must be filed by law if controllers have felt their workload is excessive. Number of reports filed has risen to 30 this year compared to 12 for the same period last year
Mandatory occurrence report
Covering any incident which, if not corrected, would endanger aircraft or its occupants. Number of reports was 133 last year; this year it is 247
Mandatory engineering report
Details reportable occurrences
Risk-bearing Airprox notice
Filed for most serious incidents where aircraft come into close proximity with each other. No reports this year.
This was first published in June 2002