When the Exercise Reveals the Plan: Contingency Testing at a Regional Aerodrome
A regional aerodrome with 1.1 million annual passengers runs its first full-scale contingency exercise in four years. The scenario is a bomb threat to an aircraft on the apron during the morning peak. The aerodrome security programme names a crisis coordination centre in the terminal's administrative block, 90 metres from the terminal. During the exercise, the centre's radio repeater fails, the alternative phone bridge is not tested, and the duty manager cannot reach the police commander for 22 minutes. The evacuation route for the eastern pier passes through a corridor that is also the designated route for arriving passengers from a neighbouring gate, producing counterflow. The exercise controller halts the exercise at 55 minutes; the debrief reveals that 6 of 14 actions in the contingency plan were never attempted because staff did not know they existed.
1. Evaluate the exercise findings and decide which failures are plan defects and which are training or competence defects.
Read the worked answer
Sort the findings by cause, because the remedy differs. The radio repeater failure and the untested phone bridge are equipment and plan-verification defects: the plan assumed a communications capability that had never been validated. The 22-minute delay in reaching the police commander is a consequence of that, but also raises a plan question - was there a designated fallback contact sequence, and was it written down? The counterflow on the eastern pier is a plan defect: the evacuation route was designated without checking it against normal passenger flows. The six unattempted actions are a training and familiarity defect, but they may also be a plan defect if the plan is so long that staff cannot hold it. The distinction matters because the corrective action differs: plan defects require revision and re-validation, training defects require instruction and practice, and equipment defects require engineering and testing. The instructor should also flag a fourth category: governance. An exercise not run for four years, with a plan never validated, is a programme management failure that sits with the aerodrome operator's leadership, not with the individuals on the day.
2. What should the revised exercise and validation cycle look like, and how would you justify the cost to an operator facing budget pressure?
Read the worked answer
Propose a tiered cycle rather than relying on a single large exercise every few years. Monthly: communications checks - radio repeater, phone bridge, contact lists - logged and signed. Quarterly: tabletop exercises with the duty managers, police, and ground handlers, testing decision-making and the fallback contact sequence. Annually: a functional exercise testing one or two specific capabilities in depth, such as evacuation routing or crisis centre activation, rather than attempting the whole plan at once. Every three years: a full-scale exercise with external agencies. After every exercise, a corrective action register with owners and deadlines, reviewed at management level. The justification to the operator is risk-based: the 22-minute communications gap is a measurable exposure, and the cost of a repeater test is trivial against the cost of that gap in a real event. The counterflow finding shows that a plan untested against real passenger flows is an assumption, not a control. Frame the cycle as assurance - the operator is buying evidence that its plan works, which is also what the competent authority will ask for.
3. How would you design the debrief so that it produces honest information rather than defensiveness?
Read the worked answer
Separate the hot debrief from the cold debrief. The hot debrief, immediately after the halt, captures facts and immediate safety concerns only - no analysis, no blame. The cold debrief, within a week, uses a structured timeline and asks what happened, what was expected, and what differed, in that order. Ground rules: the exercise is a test of the system, not of individuals; anyone who reports a problem is doing the organisation a service. Use the exercise controller's log and the communications recordings as the factual spine so the discussion is evidence-based rather than recollection-based. Ask each function to present its own findings before commenting on others. Capture the six unattempted actions without treating them as a disciplinary matter - the question is why the plan was unknown, not who failed. Produce a written report with findings, causes, corrective actions, owners, and dates, and circulate it. The instructor's role is to model the behaviour: if the debrief chair defends the plan, the room will go quiet and the next exercise will produce less information.