Transmit Brazil

After iust over two years the accident r€port into the mid air collision between a GolÀirlines Boeing 737 and an Ernbraer Legacy business iet over Brazil has been published.The aftermath of this accident had a maior effect on Brâzilian air traffic conlrol. It r€sulted in controllers woddng to nlle, trafÊc chaos, strain between civilian and military ar€as, massive dela'"s, âviation ministers being rcPlaced and intervention frorn the Prcsident. In addition, the American pilots of the Legâcy were arrested and could not leaYe the cormtry for some time. so, after âll of that, has safety in BrazilianÂTc improved and hâs everything that could be done to pr€vent the accident occuffing again been done? IFATCA believes the investigation is a missed opporfuniry. It says the 282 page report examines in great detail the isSues of why the Legacy's transponder was turned off but does not place the same emphasis on the well evidenced failures and safery problems of the Brazllian NIC system and, in particular, the elements that were a parî of the chain of events that lead ro rhe collision. IFATCA says the reporr does focus on some events and problems on the ATC side but does not give clear conclusions. In particular it cites the following paragraph from the report: Thepieces of equipment inuolued in tbe scenario of tbe occurrence did not present designfailures, since tbqt functioned witbin tbeir specifications on tbe day of tbe accident, remouing tbe possibility of a contribution of tbe communication and surueillance systemsand equiprnent. Bert Ruitenberg, IFATCA's human factor specialists points out that: ,the mere fact that equipment'fiinctions within its specifications' doesn't mean the specifications were well-designed! To identify design failures, the content of the specifications needs to be looked at - nor

WHAT HAPPENED . IN BRIEF A Legacy business jet collided wirh a GolAirlines which

subsequently

Boeing 737 crashed

kitling all154 people on board. The Legacy landed safely.The aircraft were flying at the same altitude in opposite directions. The Legacyrs transponder was off at the time of the collision.

how a system functions relative to its specifications.' AUTOMATIC tEVEt CHANGE One key issue identified by IFATCA was the automatic level changes carrried out by the ATC software. It says the reporr hints at several safety issues relating to this tool but does not issue any safety recorrunendations which it says was particular surprising as rhe NTSB issued safety recofiunendation relating to the same system in 2006. The NTSB also reviewed the report and although it agreed wirh the basic facts it says the investigation has identified many safety issues for ATC operations, but these issues need ro be further highlighted. Even though the body of the repofi acknowledges safery deficiencies with ATC, these deficiencies are not sufficiently supported with analysis or reflected in the conclusions or cause of the accident. The loss of effective at traffic control was not the result of a single error, but of a combination of numerous individual and institutional ATC factors, which reflected systemic shortcomings in emphasis on positive air traffic control concepts. A SUMNiARY OF THE FACTS AND COMMENTS FROM THE REPORT FOLLOWS: r The Brasilia ACC (ACC-BS) transmitted an incomplete clearance to the Sâo José ground control relative to the Legacy which was a deviation from procedure. Together with an informal procedure pattern concerning the transmission of clearancesoriginated at Brasilia ACC and disseminated at SâoJosé, which was daily practice, the correct procedures were replaced by the informal procedures.

t8

r The Legacy crew received from Sâo José ground control the incomplete clearance, and understood that the flight Ievel FL370 was authorised all the way up to the destination - Manaus. However, according to rhe active flight plan, the clearance limit for the flight level FL370 was the vertical of Brasilia VOR. (BRSVOR). (Note: ar rhis point the Legacy should have descended to FL360). r \Xrhile the Legacy was en route, the ATCO 1 of secror 5 handed it off to ATCO 1 of sector 7, 52 nautical miles to the south of BRS-VOR, although the limit between sectors 5 and 7 is to the northwest of the BRS-VOR. r The ATCO 1 of sector 5 did not advise either the ATCO 1 of sector 7 or the Legacy pilots the programmed flight level, according to the flight plan filed. The incomplete information transmitted by this ATCO is an indication that he had a low siruational awareness concerning the Legary in his sector. The non-transmission of important information to the ATCO 1 of sectors 7,8 and 9 contributed to the diminishing of the siruational awareness of that controller in relation to the aircraft and the need to change its level and frequency. I'When the Legacy passed over the vertical of BRS-VOR, rhe ATCO 1 0f sector 7 received from his equipment a visual information alert that there was a flight level change prograûlmed to occur over BRS-VOR for the Legacy. This information remained avallable for seven minutes. The ATCO did not make radio contacr with the Legacy to change the aircraft's flight level and to switch the frequenry.

Tronsmil

He did not perceive the Legacy's loss of mode C and assumed that the Legacy was at flight level FL360. He did nor perform the procedures prescribed for the loss of transponder in RVSM airspace. The failure of this ATCO ro acr in relation to the change of frequenry allowed rhe arcraft to get out of the coverage of the frequenqr L25.05 MHz, making it impossible to receive the transmissions. By not contacting the aircraft to change is level at the vertical of Brasilia, the ATCO let the Legaqr join the tJZ6 airway at an incorrect level in relation to the active flight plan. I Seven minutes after the aircraft had passed over BRS-VOR, the Legacy transponder stopped transmitting the mode C akcraft altitude, and, consequently, de-activated the TCAS of the airplane, a fact that was not perceived by the pilots. fhe eTbO 1 of sector 7 did not notice the information alerts relative to the loss of the mode C and did not take the prescribed corrective actions. l'When transferring the responsibility for the aircraft to the relief controller (ATCO 2), the ATCO 1 of sector 7 told him that the aircraft was at flight level Ft360.'tù7henhe passed the information to the ATCO 2 of sector 7 that the aircraft was ar flight level FL360, he inserted a false assumption, which became very difficult ro detecr due to the lack of the transponder altitude information and the impossibility of communication due to the failure to timely instruct the aircraft to change the frequency. r The ATCO 2 of sector 7 started trying to make contacr with the Legaqr 34 minutes after the last fwo-way radio contact. He did not perform the procedures prescribed for the loss of transponder and loss of radar contact within RVSM airspace, and for communications failure, and failed to communicate with the assistant controller. By failing to perform the prescribed procedures for the loss of transponder and radar contact, as well as for communications failure, the ATCO allowed the Legacy ro mainrain rhe incorrect flight level (FL370) on the \JZG airway. r The Legacy crew started trying to make contact with the ACC-BS 57 minutes after the last two-way radio contact. During approximately 32 minutes, nineteen attempts to contact ACC-BS were made bv

Tronsmit

the Legary and seven attempts to contact the aircraft were made by the ACC-BS, all of them unsuccessful, up to the moment of the collision. I Three out of the five frequencies listed in the Jeppesen char-tused by the Legacy pilots were not available. Of the five frequencies for sector 7 that were listed in Jeppesen chart only one was capable of operating on the day of the accident.

r The Assistant-Controller of sector 7 handed off the Legacy ro rhe Amazonic ACC (ACC AZ) and said that ir was at flight level FL360, but did nor menrion that it was without radar contact, without altitude information and without radio contact: The lack of communication with the Assistant-Controller allowed a deficient hand-off of the Legacy ro rhe Amazonic Area Control Centre.

IN THE COCKPTT r The report concludes that the following failures were identified: lack of an adequate planning of the flight, and insufficient knowledge of the flight plan prepared by the Embraer operator; non-execution of a briefing prior to departure; unintentional change of the transponder setting, failure in prioritising attention; failure in perceiving that the transponder was not transmitting; delay in recognising the problem of communication with the air traffic control unit; and non-compliance with the procedures prescribed for communications failure. r The transponder switch off was not perceived by the crew, due to the reduction of the situational awareness relative to the alert of the TCAS condition, which did not drau, the attention of the pilots. The lack of siruational awareness also contributed to the crew's not realising that they had a corrununication problem with the AIC. Although they were maintaining the last flight level authorised by the ACC BS, they spent almost an hour flying at a non-standard flight level for the heading being flown, and did not ask for any confirmation from the ATC. rThe performance deficiencies shown by the crew have a direct relationship with the organisational decisions and processes adopted by the operator: the inadequate designation of the pilots for the operation; the insufficient training for the conduction of the mission, and the routine procedures relative to the planning of the flight, in which there was not full participation of the crew. r The training provided to the Legaal pilots proved insufficient for the flight. The lack of interaction between the pilots was apparent in the difficulties with the division of tasks and in the coordination of the cockpit duties, with both of them devoting their attention to the calculations of the atrcraftweight and balance during the flight. These gaps in the received training favoured a deviation of the pilots' attention to other aspects during the flight, in detriment of the akcraft operation. Such distraction allowed the discontinuance of the transponder transmission to go unperceived.

19

r The repoft also said there had been a lack of communication between controllers and supervisors: lack of information and/or transmission of incorrect information by the ATCO of sectors 5 and 6, the ATCO's 1 and 2, and Assistant-ATCOof sectors 7. 8 and 9. during the execution of the procedures for

THE CONTROTLERS ASSUMED THAT THE TRAFFIC WAS AT A DIFFERENT FLIGHT LEVEL, WITHOUT EVEN BEING IN TWO.WAY RADIO CONTACT WITH THE TEGACY FOR CONFIRnIATION.

coordination and hand-off of the Legaq between sectors and between Control Centres, and at the control position

flight level, along the same airway and were approaching each other in

relief; lack of communication between

opposite directions. The aircraft collided, whereas their crews did not receive any warnings from the respective TCAS

controllers and supervisors. Deviations from the procedures regarding the prescribed phraseology were obserued, in various situations of the ATC activity and in the various control units involved in the accident. Such deviations contributed t<-r the lowering of the siruational awareness of the controllers responsible for controlling the Legacy flight. The supervisors were not advised by the controllers about the problems experienced in the control of the Legacy, an aspect that generated the making of inadequate decisions, which occurred isolatedly and individually, reflecting a deficient coordination of the team resources. The lack of involvement of the supervisors allowed the decisions to be made and the actions to be taken in relation to the Legacy in an individual manner, without due monitoring, advisory and guidance prescribed for the air traffic control. r The ATCO of the Manaus Sub Centre of the ACC AZ showed deviation from the standard procedure during the hand-off of the Boeing 737 and the take-over of the Legacy erroneously confirmed the existence of the Legacy traffic; and did not perform the procedure prescribed for the loss of radar contact. The ATCO did not perceive the control condition of the Legacy as critical, and did not demonstrate discomfort with the siruation, thus displaying a low siruational awareness. This may have been influenced by the information received from the ACC BS that the aircraft was at flight level FL360, and by not being informed that the aircraft had been without radar contact and radio contact for some time. Again, this allowed the two airplanes to fly in opposite directions, along the same airway and at the same flight level. r The Boeing 737 and the Legacy airplanes were maintaining the same

20

teaching and training purposes, as well as for qualifying the personnel for the operation. He said that the Aeronautical Accident Prevention Program prescribed the TRM course several years ago, but its implementation had proved impossible and it has not been held for two or three years. The shortage also hindered the maintenance of a continued training of the controllers, by means of refreshers, TRM training and English courses. It was observed that the annual theoretical evaluation (TGE) was not

systems,as the Legacy'stransponder had

being able to aid in the identification and diagnostic of the controllers' performance

stopped transmitting 54 minutes before the collision. Such a loss also made it impossible for the radars of the ACC-AZ to warn the controllers of the imminent

deficiencies, thus failing to assistin the process of determination of the training needs. There were difficulties in re-creating the operational profile of the

collision, due to the lack of altinrde information.

ATCO's involved, due to the shortage of records relative to the instruction and technical qualification. The effects of the

IN THE ATC CENTRES The authorisation to maintain flight level FL370 was given to the crew of

personnel shortage were reflected in the quality of the services as they contributed

the Legacy, as the result of a clearance transmitted in an incorrect manner. The vertical navigation conducted by the crew ended up being different from the one prescribed in the flight plan that was filed and activated, on account of the instruction incorrectly transmitted that led the Legacy crew to maintain flight level FL37O, The air traffic control units involved, although providing radar surveillance (radar monitoring) service, did not correct the flight level and did not perform the prescribed procedures for altitude verification when they stopped receiving essential information from the transponder due to the loss of mode C. The controllers assumed that the traffic was at a different flight level, without even being in fwo-way radio contact with the Legacy for confirmation. They did not make a coffect hand-off of the traffic betqreen sectors and between FIRs. They maintained RVSM separation when the necessaryrequirements no longer existed. FINAL COMNÂENÏ The shortcomings on the behalf of the controllers are clear to see. To a certain

to the degradation of the controllers' performance andlor to the insufficient technical qualification. Although, as IFATCA and others say, the report does focus on the controllers' and pilots' errors, it does also make a number of recommendations concerning the infrastructure and organisation including English language proficiency, refresher training, software improvements, quality management programmes and TRM. However it is one thing pointing out these issuesbut can an organisation that has so many fundamental and deeply rooted problems actually make the necessary changes. \Tithout more specific recofirrnendations and in depth examinations of the structure and responsibilities it is a very difficult task indeed. As IFATCA says there appears to be a reluctance to expose staff (other than the frontline) and departments in the organisation. And, to make matters worse, the report pointed out that it was hindered by the refusal of the Brasilia ACC controllers to take part in interviews. Clearly then, all the problems are compounded as those who really need to speak out are too fearful of the

shortcomings exist. Take for example the shortage of staff. The commander of the Brasilia ACC said that since 2005.

consequences. IFATCA says the report is a missed oppornrnity but maybe not a lost opportunity - it may be right but surely it

he had been requesting an increase in the number of operators. These were

will be much more than an uphill struggle to ensure everything that can be done has

not only to maintain the shifts but for

been done.

extent it is also clear to see why these

Tronsmit

TFATCASURPRTSED BY THE SYSTEilI On a visit to Brazil,IFATCA found that the cleared flight level on the aircraft label, as it appeared on the radar screen,was not

was issued to Legacy.

only fed by controllers into the system (once the clearance was transmitted by

of the data block is displaying a requested

We recommend modifying the software to make it clear to controllers whether this field

altitude or a cleared altitude.At the least, a 'reminder' feature should be distinguishable from a display that reflects the actual clearance status of the aircraft.

radio to the aircraft, and the aircraft had coffectly read back the clearance), but there were occasions when this was done automatically by the system itself without any direct input from the controllers. This automatic change did not show prominently on the aircraft label as it should (both the fonts and the colours of the label remained the same as before). The'explanation'given was thar this FL was actually the flight plan level of the flight and so it was'normal' to change it

A fn. flight strip for the first segment of the flight.The red circle denores the CFL field - the level authorised byATC and can be changed by the controller.The green circle shows the RFL field or the flight level requested which cannot be changed by the controller. { The data block as seen by theATCO I in sector 7,8,9 who was handling the aircraft which was still in sector 5 having been handed over early.The 37O

automatically when an aircraft passesover a fix (or navigation aid) where a change of flight level is requested by the flight plan.

on the left is in the data block's NIV field which derives information from the aircraft's mode C transponder. No action is required as the mode C data equals that of the authorised flight level (CFL) - the 37O on the right.

IFATCA said'In manyACCs this crucial information of the cleared night level is fed by the controllers into the system once the clearance is transmitted by radio to the aircraft (and this has been correctly read back by the pilot).This'feeding of the system' is sometimes done by hand on paper strips, while other systems are electronic where the input is done directly onto the label of the flight that appears on the screen.rWhat is rrery important, even crucial, is that the groundATC system and

About two minutes before the point of lan expected level change rhe CFL

the aircraft cockpit always dispose of the same information. IFATCA believes that the pilots and the conrrollers fell victim to unacceptable systems traps brought on by 'non€rror tolerant' and'bad s)'stem design'

freld cb anges from autltorised fligltt leuel to requested tligbt leuelfuccording to the concept of the sysrem, the flight level FL36O was the one cleared for the next segment of the flight and the controller has to analyse it and instruct the necessary level change.The previous sector 5 controller did not issue any instructions to the aircraft relative to level

ofATC and flight equipment in use.

The NTSB said:'the use of rhe auromaric cleared altitude field change has the

change nor did the sector 7 controller. The double function of the CFL field is not in the controllers'manual although it is taught.The data block remained like

potential to mislead controllers, is a poor human factors design. and is a clear finding

this for seven minutes and the controller made no calls.

NTSBVIEW

of risk. In fact. this event was one of the frst that is directll'tied to the accident scenario. This feature has the undesirable effect of making the ATC auromarion 'lead' the actual clearance issued to the flight crew. A basic tenet ofATC is ro have a double check of clearances.The automatic change takes away a method for the [controller] to reinforce the proper clearance in his mind. If the controller makes the entry the action of keying in the numbers helps to confirm that he has issued the correct altitude and that the pilot has read back the clearance correctl)'.Therefore, the automatic change of the data block field from'cleared altitude' to'requested altitude' without any indication to, or action by, the [controllers] led to the misunderstanding by the sector

The next data block shows a Z between the height information and CFL field.It can also be seen the there is no longer a circle around the target.The Z indicates

out inefficient procedures to solve the problem presumably having been influenced by the information from the previous controller that the aircraft was

height calculated from 3D radar. which fluctuated from FL36O to FL385. RVSM flight is not permitted under such conditions. From this data block the controller had an indication that the

ar FL360.Y

detection of the aircraft was being obtained by primary radaq and rhat the source of altitude information was then the 3D radar and not the C mode of the aircraft transponder, via secondary radat. Following a controller handover the second controller realised there had been a loss of transponder signal but carried

7 controller about what altitude clearance

Tronsmit

21