Transmit Brazil

8/14/2019 Transmit Brazil

http://slidepdf.com/reader/full/transmit-brazil 1/4

After iust over two years the accident r€port into the mid air collision between a GolÀirlines Boeing 737 and an ErnbraerLegacy business iet over Brazil has been published.The aftermath of this accident had a maior effect on Brâzilian air trafficconlrol. It r€sulted in controllers woddng to nlle, trafÊc chaos,strain between civilian and military ar€as,massive dela'"s,âviation ministers being rcPlaced and intervention frorn the Prcsident. In addition, the American pilots of the Legâcy werearrested and could not leaYe the cormtry for some time. so, after âll of that, has safety in BrazilianÂTc improved and hâseverything that could be done to pr€vent the accident occuffing again been done?

IFATCA believes the investigation is a

missed opporfuniry. It says the 282 pagereport examines in great detail the isSuesof why the Legacy's transponder wasturned off but does not place the sameemphasis on the well evidenced failuresand safery problems of the Brazllian NICsystem and, in particular, the elementsthat were a parî of the chain of eventsthat lead ro rhe collision.

IFATCA says the reporr does focus onsome events and problems on the ATCside but does not give clear conclusions.In particular it cites the followingparagraph from the report:

Thepieces of equipment inuolued in tbescenario of tbe occurrence did not presentdesign ailures, since tbqt functionedwitbin tbeir specifications on tbe day oftbe accident, remouing tbepossibility of acontribution of tbe communication andsurueillance systemsand equiprnent.

Bert Ruitenberg, IFATCA'shumanfactor specialists points out that: ,the

mere fact that equipment'fiinctionswithin its specifications' doesn't mean

the specifications were well-designed! Toidentify design failures, the content of thespecifications needs to be looked at - nor

WHAT HAPPENED . IN BRIEF

A Legacy business jet collided

wirh a GolAirlines Boeing 737which subsequently crashed

kitling all154 people on board.

The Legacy landed safely.The

aircraft were flying at the same

altitude in opposite directions.

The Legacyrs transponder wasoff at the time of the collision.

how a system functions relative to its

specifications.'

AUTOMATIC tEVEt CHANGEOne key issue identified by IFATCA wasthe automatic level changes carrried outby the ATC software. It says the reporrhints at several safety issues relating tothis tool but does not issue any safetyrecorrunendations which it says wasparticular surprising as rhe NTSB issuedsafety recofiunendation relating to thesame system in 2006. The NTSB also

reviewed the report and although itagreed wirh the basic facts it says theinvestigation has identified many safetyissues for ATC operations, but theseissuesneed ro be further highlighted.Even though the body of the repofiacknowledges safery deficiencies withATC, these deficiencies are not sufficientlysupported with analysis or reflected inthe conclusions or cause of the accident.The loss of effective at traffic control wasnot the result of a single error, but of acombination of numerous individual and

institutional ATC factors, which reflectedsystemic shortcomings in emphasis onpositive air traffic control concepts.

A SUMNiARY OF THE FACTS ANDCOMMENTS FROM THE REPORTFOLLOWS:

r The Brasilia ACC (ACC-BS) transmittedan incomplete clearance to the SâoJoséground control relative to the Legacywhich was a deviation from procedure.Together with an informal procedure

pattern concerning the transmission ofclearancesoriginated at BrasiliaACC anddisseminated at SâoJosé, which was dailypractice, the correct procedures werereplaced by the informal procedures.

r The Legacy crew received from Sâo

José ground control the incompleteclearance, and understood that the flightIevel FL370 was authorised all the wayup to the destination - Manaus. However,according to rhe active flight plan, theclearance limit for the flight level FL370was the vertical of Brasilia VOR. (BRS-

VOR). (Note: ar rhis point the Legacyshould have descended to FL360).

r \Xrhile the Legacy was en route, theATCO 1 of secror 5 handed it off to ATCO

1 of sector 7, 52 nautical miles to thesouth of BRS-VOR,although the limitbetween sectors 5 and 7 is to the north-west of the BRS-VOR.

r The ATCO 1 of sector 5 did not adviseeither the ATCO 1 of sector 7 or theLegacy pilots the programmed flight level,according to the flight plan filed. Theincomplete information transmitted bythis ATCO is an indication that he had alow siruational awareness concerning theLegary in his sector. The non-transmissionof important information to the ATCO 1of sectors7,8 and 9 contributed to thediminishing of the siruational awarenessof that controller in relation to the aircraftand the need to change its level andfrequency.

I'When the Legacy passedover thevertical of BRS-VOR,rhe ATCO 1 0f sector7 received from his equipment a visualinformation alert that there was a flightlevel change prograûlmed to occur over

BRS-VOR or the Legacy. This informationremained avallable for seven minutes.The ATCO did not make radio contacrwith the Legacy to change the aircraft'sflight level and to switch the frequenry.

t8Tronsmil



He did not perceive the Legacy's loss ofmode C and assumed that the Legacy wasat flight level FL360. He did nor performthe procedures prescribed for the lossof transponder in RVSMairspace. Thefailure of this ATCO ro acr in relationto the change of frequenry allowed rhearcraft to get out of the coverage of

the frequenqr L25.05MHz, making itimpossible to receive the transmissions.By not contacting the aircraft to change islevel at the vertical of Brasilia, the ATCOlet the Legaqr join the tJZ6 airway at anincorrect level in relation to the activeflight plan.

I Seven minutes after the aircraft hadpassed over BRS-VOR, he Legacytransponder stopped transmittingthe mode C akcraft altitude, and,consequently, de-activated the TCAS ofthe airplane, a fact that was not perceivedby the pilots. fhe eTbO 1 of sector 7 didnot notice the information alerts relativeto the loss of the mode C and did not takethe prescribed corrective actions.

l'When transferring the responsibilityfor the aircraft to the relief controller(ATCO 2), the ATCO 1 of sector 7 toldhim that the aircraft was at flight levelFt360.'tù7henhe passed he informationto the ATCO 2 of sector 7 that the aircraft

was ar flight level FL360, he inserted afalse assumption, which became verydifficult ro detecr due to the lack of thetransponder altitude information and theimpossibility of communication due tothe failure to timely instruct the aircraft tochange the frequency.

r The ATCO 2 of sector 7 started trying tomake contacr with the Legaqr 34 minutesafter the last fwo-way radio contact.He did not perform the procedures

prescribed for the loss of transponderand loss of radar contact within RVSMairspace, and for communications failure,and failed to communicate with theassistantcontroller. By failing to performthe prescribed procedures for the lossof transponder and radar contact, aswell as for communications failure, theATCO allowed the Legacy ro mainrain rheincorrect flight level (FL370) on the \JZGairway.

r The Legacy crew started trying to makecontact with the ACC-BS 57 minutes afterthe last two-way radio contact. Duringapproximately 32 minutes, nineteenattempts to contact ACC-BSwere made bv

Tronsmit

the Legary and seven attempts to contactthe aircraft were made by the ACC-BS,allof them unsuccessful, up to the momentof the collision.

I Three out of the five frequencies listedin the Jeppesen char-tused by the Legacypilots were not available. Of the fivefrequencies for sector 7 that were listed inJeppesen chart only one was capable ofoperating on the day of the accident.

r The Assistant-Controller of sector 7handed off the Legacy ro rhe AmazonicACC (ACC AZ) and said that ir was atflight level FL360, but did nor menrion

that it was without radar contact,without altitude information and withoutradio contact:

The lack of communication with theAssistant-Controller allowed a deficienthand-off of the Legacy ro rhe AmazonicArea Control Centre.

IN THECOCKPTTr The report concludes that the following failures were identified: lack ofan adequate planning of the flight, and insufficient knowledge of the flightplan prepared by the Embraer operator; non-execution of a briefing prior todeparture; unintentional change of the transponder setting, failure in prioritisingattention; failure in perceiving that the transponder was not transmitting; delayin recognising the problem of communication with the air traffic control unit;and non-compliance with the procedures prescribed for communications failure.

r The transponder switch off was not perceived by the crew, due to thereduction of the situational awareness relative to the alert of the TCAS condition,which did not drau, the attention of the pilots. The lack of siruational awarenessalso contributed to the crew's not realising that they had a corrununicationproblem with the AIC. Although they were maintaining the last flight levelauthorised by the ACC BS, they spent almost an hour flying at a non-standardflight level for the heading being flown, and did not ask for any confirmation

from the ATC.

rThe performance deficiencies shown by the crew have a direct relationshipwith the organisational decisions and processes adopted by the operator: theinadequate designation of the pilots for the operation; the insufficient trainingfor the conduction of the mission, and the routine procedures relative to theplanning of the flight, in which there was not full participation of the crew.

r The training provided to the Legaal pilots proved insufficient for the flight.The lack of interaction between the pilots was apparent in the difficultieswith the division of tasks and in the coordination of the cockpit duties, withboth of them devoting their attention to the calculations of the atrcraftweightand balance during the flight. These gaps

in the received training favoured adeviation of the pilots' attention to other aspects during the flight, in detrimentof the akcraft operation. Such distraction allowed the discontinuance of thetransponder transmission to go unperceived.

19



r The repoft also said there had been

a lack of communication between

controllers and supervisors: ack of

information and/or transmission of

incorrect information by the ATCO of

sectors 5 and 6, the ATCO's 1 and 2, and

Assistant-ATCOof sectors7. 8 and 9.

during the execution of the procedures forcoordination and hand-off of the Legaq

between sectors and between Control

Centres, and at the control position

relief; lack of communication between

controllers and supervisors. Deviations

from the procedures regarding the

prescribed phraseology were obserued, in

various situations of the ATC activity and

in the various control units involved in the

accident. Such deviations contributed t<-r

the lowering of the siruational awareness

of the controllers responsiblefor

controlling the Legacy flight.

The supervisors were not advised

by the controllers about the problems

experienced in the control of the Legacy,

an aspect that generatedthe making of

inadequate decisions, which occurred

isolatedly and individually, reflecting

a deficient coordination of the team

resources. The lack of involvement of

the supervisors allowed the decisions to

be made and the actions to be taken in

relation to the Legacy in an individual

manner, without due monitoring, advisoryand guidance prescribed for the air traffic

control.

r The ATCO of the Manaus Sub Centre

of the ACC AZ showed deviation from

the standard procedure during the

hand-off of the Boeing 737 and the

take-over of the Legacy erroneously

confirmed the existence of the Legacy

traffic; and did not perform the procedure

prescribed for the loss of radar contact.

The ATCO did not perceive the controlcondition of the Legacy as critical, and

did not demonstrate discomfort with

the siruation, thus displaying a low

siruational awareness. This may have

been influenced by the information

received from the ACC BS that the aircraft

was at flight level FL360, and by not

being informed that the aircraft had been

without radar contact and radio contact

for some time. Again, this allowed the

two airplanes to fly in opposite directions,

along the same airway and at the same

flight level.

r The Boeing 737 and the Legacy

airplanes were maintaining the same

20

THE CONTROTLERS

ASSUMED THAT THE TRAFFIC

WAS AT A DIFFERENT FLIGHT

LEVEL, WITHOUT EVEN BEING

IN TWO.WAY RADIO CONTACT

WITH THE TEGACY FOR

CONFIRnIATION.

flight level, along the same airway

and were approaching each other in

opposite directions. The aircraft collided,

whereas their crews did not receive

any warnings from the respective TCAS

systems,as the Legacy's ransponder had

stopped transmitting 54 minutes before

the collision . Such a loss also made it

impossible for the radars of the ACC-AZ

to warn the controllers of the imminent

collision, due to the lack of altinrdeinformation.

IN THE ATC CENTRESThe authorisation to maintain flight

level FL370 was given to the crew of

the Legacy, as the resu lt of a clearance

transmitted in an incorrect manner. The

vertical navigation conducted by the

crew ended up being different from the

one prescribed in the flight plan that was

filed and activated,on account of the

instruction incorrectly transmitted that led

the Legacy crew to maintain flight levelFL37O,

The air traffic control units involved,

although providing radar surveillance(radar monitoring) service, did not

correct the flight level and did not

perform the prescribed procedures for

altitude verification when they stopped

receiving essential information from the

transponder due to the loss of mode C.

The controllers assumed that the traffic

was at a different flight level, without

even being in fwo-way radio contact withthe Legacy for confirmation. They did

not make a coffect hand-off of the traffic

betqreen sectors and between FIRs. They

maintained RVSMseparation when the

necessary equirements no longer existed.

FINAL COMNÂENÏ

The shortcomings on the behalf of the

controllers are clear to see. To a certain

extent it is also clear to see why these

shortcomings exist. Take for example

the shortage of staff. The commander

of the Brasilia ACC said that since 2005.

he had been requesting an increase n

the number of operators. These were

not only to maintain the shifts but for

teaching and training purposes, as well

as for qualifying the personnel for the

operation. He said that the Aeronautical

Accident Prevention Program prescribed

the TRM course several years ago, but its

implementation had proved impossible

and it has not been held for two or three

years. The shortage also hindered themaintenance of a continued training of

the controllers, by means of refreshers,

TRM training and English courses.

It was observed that the annual

theoretical evaluation (TGE) was not

being able to aid in the identification and

diagnostic of t he controllers' performance

deficiencies, hus failing to assist n

the process of determination of the

training needs. There were difficulties in

re-creating the operational profile of the

ATCO's involved, due to the shortage

of records relative to the instruction and

technical qualification. The effects of the

personnel shortage were reflected in the

quality of the services as they contributed

to the degradation of the controllers'

performance andlor to the insufficient

technical qualification.

Although, as IFATCA and others say,

the report does focus on the controllers'

and pilots' errors, it does also make a

number of recommendations concerning

the infrastructure and organisation

including English language proficiency,refresher training, software improvements,

quality management programmes and

TRM.

However it is one thing pointing out

these issuesbut can an organisation

that has so many fundamental and

deeply rooted problems actually make

the necessary changes. \Tithout more

specific recofirrnendations and in depth

examinations of the structure and

responsibilities t is a very difficult task

indeed. As IFATCA says there appearsto be a reluctance to expose staff (other

than the frontline) and departments in

the organisation. And, to make matters

worse, the report pointed out that it

was hindered by the refusal of the

Brasilia ACC controllers to take part in

interviews. Clearly then, all the problems

are compounded as those who really

need to speak out are too fearful of the

consequences.

IFATCA says the report is a missed

oppornrnity but maybe not a lost

opportunity - it may be right but surely it

will be much more than an uphill struggle

to ensure everything that can be done has

been done.

Tronsmit



TFATCA URPRTSED YTHE SYSTEilIOn a visit to Brazil,IFATCA found that thecleared flight level on the aircraft label, asit appeared on the radar screen,was notonly fed by controllers into the system(once the clearance was transmitted by

radio to the aircraft, and the aircraft hadcoffectly read back the clearance),but

there were occasions when this was doneautomatically by the system itself without

any direct input from the controllers.

This automatic change did not showprominently on the aircraft label as it

should (both the fonts and the colours of

the label remained the same as before).

The'explanation'given was thar this FL

was actually the flight plan level of the

flight and so it was'normal' to change itautomatically when an aircraft passesovera fix (or navigation aid) where a change

offlight level is requested by the flight plan.

IFATCAsaid'In manyACCs this crucialinformation of the cleared night level isfed by the controllers into the system oncethe clearance is transmitted by radio tothe aircraft (and this has been correctly

read back by the pilot).This'feeding ofthe system' is sometimes done by handon paper strips, while other systemsareelectronic where the input is done directlyonto the label of the flight that appears onthe screen.rWhat s rrery important, evencrucial, is that the groundATC system and

the aircraft cockpit always dispose of thesame information. IFATCA believes thatthe pilots and the conrrollers fell victim tounacceptable systems raps brought on by'non€rror tolerant' and'bad s)'stem design'ofATC and flight equipment in use.

NTSBVIEWThe NTSB said:'the use of rhe auromariccleared altitude field change has thepotential to mislead controllers, is a poor

human factors design.and is a clear findingof risk. In fact. this event was one of the frstthat is directll'tied to the accident scenario.This feature has the undesirable effectof making the ATC auromarion 'lead' theactual clearance issued to the flight crew.A basic tenet ofATC is ro have a double

check of clearances.The automatic changetakes away a method for the [controller]to reinforce the proper clearance in hismind. If the controller makes the entrythe action of keying in the numbers helpsto confirm that he has issued the correctaltitude and that the pilot has read back theclearance correctl)'.Therefore, the automaticchange of the data block field from'cleared

altitude' to'requested altitude' without anyindication to, or action by, he [controllers]led to the misunderstanding by the sector7 controller about what altitude clearance

was issued to Legacy.

We recommend modifying the software tomake it clear to controllers whether this fieldof the data block is displaying a requested

About two minutes before the point of

lan expected level change rhe CFL

The next data block shows a Z betweenthe height information and CFL field.Itcan also be seen the there is no longer acircle around the target.The Z indicatesheight calculated from 3D radar.whichfluctuated from FL36O o FL385. RVSMflight is not permitted under suchconditions. From this data block thecontroller had an indication that thedetection of the aircraft was beingobtained by primary radaq and rhat thesource of altitude information was thenthe 3D radar and not the C mode of theaircraft transponder, via secondary radat.

Following a controller handover thesecond controller realised there had beena loss of transponder signal but carried

A fn. flight strip for the first segment of the flight.The red circle denores the CFLfield - the level authorised byATC and can be changed by the controller.The greencircle shows the RFL field or the flight level requested which cannot be changed by thecontroller.

{ The data block as seen by theATCOI in sector 7,8,9 who was handlingthe aircraft which was still in sector 5

having been handed over early.The 37Oon the left is in the data block's NIVfield which derives information from theaircraft's mode C transponder. No actionis required as the mode C data equals thatof the authorised flight level (CFL) - the

37Oon the right.

altitude or a cleared altitude.At the least, a'reminder' feature should be distinguishable

from a display that reflects the actual

clearance status of the aircraft.

freld cb anges from autltorised fliglttleuel to requested tligbt leuelfuccordingto the concept of the sysrem, the flight

level FL36Owas the one cleared forthe next segment of the flight and thecontroller has to analyse it and instructthe necessary level change.The previoussector 5 controller did not issue anyinstructions to the aircraft relative to levelchange nor did the sector 7 controller.The double function of the CFL field isnot in the controllers'manual althoughit is taught.The data block remained likethis for seven minutes and the controllermade no calls.

out inefficient procedures to solvethe problem presumably having beeninfluenced by the information from theprevious controller that the aircraft wasar FL360.Y

Tronsmit

Documents

Transmit Brazil