After iust over two years the accident r€port into the mid air collision between a GolÀirlines
Boeing
Legacy business iet over Brazil has been published.The aftermath of this accident had a maior effect
conlrol. It r€sulted in controllers woddng to nlle, trafÊc chaos, strain between civilian and military ar€as,
âviation ministers being rcPlaced and intervention frorn the Prcsident. In addition, the American pilots
arrested and could not leaYe the cormtry for some time. so, after âll of that, has safety in BrazilianÂTc improved
everything that could be done to pr€vent the accident occuffing again been done?
IFATCA believes the investigation is a
missed opporfuniry. It says the 282 page
report examines in great detail the isSues
of why the Legacy's transponder was
turned off but does not place the same
emphasis on the well evidenced failures
and safery problems of the Brazllian NIC
system and, in particular, the elements
that were a parî of the chain of events
that lead ro rhe collision.
IFATCA says the reporr does focus on
some events and problems on the ATC
side but does not give clear conclusions.
In particular it cites the following
paragraph from the report:
Thepieces of equipment inuolued in tbe
scenario of tbe occurrence did not present
designfailures, since tbqt functioned
witbin tbeir specifications on tbe day of
tbe accident, remouing tbe possibility of a
contribution of tbe communication and
surueillance systemsand equiprnent.
Bert Ruitenberg, IFATCA's human
factor specialists points out that: ,the
mere fact that equipment'fiinctions
within its specifications' doesn't mean
the specifications were well-designed! To
identify design failures, the content of the
specifications needs to be looked at - nor
WHAT HAPPENED . IN BRIEF
A Legacy business jet collided
wirh a GolAirlines Boeing 737
which subsequently crashed
kitling all154 people on board.
The Legacy landed safely.The
aircraft were flying at the same
altitude in opposite directions.
The Legacyrs transponder was
off at the time of the collision.
t8
how a system functions relative to its
specifications.'
AUTOMATIC tEVEt CHANGE
One key issue identified by IFATCA was
the automatic level changes carrried out
by the ATC software. It says the reporr
hints at several safety issues relating to
this tool but does not issue any safety
recorrunendations which it says was
particular surprising as rhe NTSB issued
safety recofiunendation relating to the
same system in 2006. The NTSB also
reviewed the report and although it
agreed wirh the basic facts it says the
investigation has identified many safety
issues for ATC operations, but these
issues need ro be further highlighted.
Even though the body of the repofi
acknowledges safery deficiencies with
ATC, these deficiencies are not sufficiently
supported with analysis or reflected in
the conclusions or cause of the accident.
The loss of effective at traffic control was
not the result of a single error, but of a
combination of numerous individual and
institutional ATC factors, which reflected
systemic shortcomings in emphasis on
positive air traffic control concepts.
A SUMNiARY OF THE FACTS AND
COMMENTS FROM THE REPORT
FOLLOWS:
r The Brasilia ACC (ACC-BS) transmitted
an incomplete clearance to the Sâo José
ground control relative to the Legacy
which was a deviation from procedure.
Together with an informal procedure
pattern concerning the transmission of
clearancesoriginated at Brasilia ACC and
disseminated at SâoJosé, which was daily
practice, the correct procedures were
replaced by the informal procedures.
737 and an Ernbraer
on Brâzilian air traffic
massive dela'"s,
of the Legâcy were
and hâs
r The Legacy crew received from Sâo
José ground control the incomplete
clearance, and understood that the flight
Ievel FL370 was authorised all the way
up to the destination - Manaus. However,
according to rhe active flight plan, the
clearance limit for the flight level FL370
was the vertical of Brasilia VOR. (BRS-
VOR). (Note: ar rhis point the Legacy
should have descended to FL360).
r \Xrhile the Legacy was en route, the
ATCO 1 of secror 5 handed it off to ATCO
1 of sector 7, 52 nautical miles to the
south of BRS-VOR, although the limit
between sectors 5 and 7 is to the north-
west of the BRS-VOR.
r The ATCO 1 of sector 5 did not advise
either the ATCO 1 of sector 7 or the
Legacy pilots the programmed flight level,
according to the flight plan filed. The
incomplete information transmitted by
this ATCO is an indication that he had a
low siruational awareness concerning the
Legary in his sector. The non-transmission
of important information to the ATCO 1
of sectors 7,8 and 9 contributed to the
diminishing of the siruational awareness
of that controller in relation to the aircraft
and the need to change its level and
frequency.
I'When the Legacy passed over the
vertical of BRS-VOR, rhe ATCO 1 0f sector
7 received from his equipment a visual
information alert that there was a flight
level change prograûlmed to occur over
BRS-VOR for the Legacy. This information
remained avallable for seven minutes.
The ATCO did not make radio contacr
with the Legacy to change the aircraft's
flight level and to switch the frequenry.
Tronsmil
 He did not perceive the Legacy's loss of
mode C and assumed that the Legacy was
at flight level FL360. He did nor perform
the procedures prescribed for the loss
of transponder in RVSM airspace. The
failure of this ATCO ro acr in relation
to the change of frequenry allowed rhe
arcraft to get out of the coverage of
the frequenqr L25.05 MHz, making it
impossible to receive the transmissions.
By not contacting the aircraft to change is
level at the vertical of Brasilia, the ATCO
let the Legaqr join the tJZ6 airway at an
incorrect level in relation to the active
flight plan.
I Seven minutes after the aircraft had
passed over BRS-VOR, the Legacy
transponder stopped transmitting
the mode C akcraft altitude, and,
consequently, de-activated the TCAS of
the airplane, a fact that was not perceived
by the pilots. fhe eTbO 1 of sector 7 did
not notice the information alerts relative
to the loss of the mode C and did not take
the prescribed corrective actions.
l'When transferring the responsibility
for the aircraft to the relief controller
(ATCO 2), the ATCO 1 of sector 7 told
him that the aircraft was at flight level
Ft360.'tù7henhe passed the information
to the ATCO 2 of sector 7 that the aircraft
was ar flight level FL360, he inserted a
false assumption, which became very
difficult ro detecr due to the lack of the
transponder altitude information and the
impossibility of communication due to
the failure to timely instruct the aircraft to
change the frequency.
r The ATCO 2 of sector 7 started trying to
make contacr with the Legaqr 34 minutes
after the last fwo-way radio contact.
He did not perform the procedures
prescribed for the loss of transponder
and loss of radar contact within RVSM
airspace, and for communications failure,
and failed to communicate with the
assistant controller. By failing to perform
the prescribed procedures for the loss
of transponder and radar contact, as
well as for communications failure, the
ATCO allowed the Legacy ro mainrain rhe
incorrect flight level (FL370) on the \JZG
airway.
r The Legacy crew started trying to make
contact with the ACC-BS 57 minutes after
the last two-way radio contact. During
approximately 32 minutes, nineteen
attempts to contact ACC-BS were made bv
Tronsmit
the Legary and seven attempts to contact r The Assistant-Controller of sector 7
the aircraft were made by the ACC-BS, all handed off the Legacy ro rhe Amazonic
of them unsuccessful, up to the moment ACC (ACC AZ) and said that ir was at
of the collision. flight level FL360, but did nor menrion
that it was without radar contact,
I Three out of the five frequencies listed without altitude information and without
in the Jeppesen char-tused by the Legacy radio contact:
pilots were not available. Of the five The lack of communication with the
frequencies for sector 7 that were listed in Assistant-Controller allowed a deficient
Jeppesen chart only one was capable of hand-off of the Legacy ro rhe Amazonic
operating on the day of the accident. Area Control Centre.
IN THE COCKPTT
r The report concludes that the following failures were identified: lack of
an adequate planning of the flight, and insufficient knowledge of the flight
plan prepared by the Embraer operator; non-execution of a briefing prior to
departure; unintentional change of the transponder setting, failure in prioritising
attention; failure in perceiving that the transponder was not transmitting; delay
in recognising the problem of communication with the air traffic control unit;
and non-compliance with the procedures prescribed for communications failure.
r The transponder switch off was not perceived by the crew, due to the
reduction of the situational awareness relative to the alert of the TCAS condition,
which did not drau, the attention of the pilots. The lack of siruational awareness
also contributed to the crew's not realising that they had a corrununication
problem with the AIC. Although they were maintaining the last flight level
authorised by the ACC BS, they spent almost an hour flying at a non-standard
flight level for the heading being flown, and did not ask for any confirmation
from the ATC.
rThe performance deficiencies shown by the crew have a direct relationship
with the organisational decisions and processes adopted by the operator: the
inadequate designation of the pilots for the operation; the insufficient training
for the conduction of the mission, and the routine procedures relative to the
planning of the flight, in which there was not full participation of the crew.
r The training provided to the Legaal pilots proved insufficient for the flight.
The lack of interaction between the pilots was apparent in the difficulties
with the division of tasks and in the coordination of the cockpit duties, with
both of them devoting their attention to the calculations of the atrcraftweight
and balance during the flight. These gaps in the received training favoured a
deviation of the pilots' attention to other aspects during the flight, in detriment
of the akcraft operation. Such distraction allowed the discontinuance of the
transponder transmission to go unperceived.
19
r The repoft also said there had been
a lack of communication between
controllers and supervisors: lack of
information and/or transmission of
incorrect information by the ATCO of
sectors 5 and 6, the ATCO's 1 and 2, and
Assistant-ATCOof sectors 7. 8 and 9.
during the execution of the procedures for
coordination and hand-off of the Legaq
between sectors and between Control
Centres, and at the control position
relief; lack of communication between
controllers and supervisors. Deviations
from the procedures regarding the
prescribed phraseology were obserued, in
various situations of the ATC activity and
in the various control units involved in the
accident. Such deviations contributed t<-r
the lowering of the siruational awareness
of the controllers responsible for
controlling the Legacy flight.
The supervisors were not advised
by the controllers about the problems
experienced in the control of the Legacy,
an aspect that generated the making of
inadequate decisions, which occurred
isolatedly and individually, reflecting
a deficient coordination of the team
resources. The lack of involvement of
the supervisors allowed the decisions to
be made and the actions to be taken in
relation to the Legacy in an individual
manner, without due monitoring, advisory
and guidance prescribed for the air traffic
control.
r The ATCO of the Manaus Sub Centre
of the ACC AZ showed deviation from
the standard procedure during the
hand-off of the Boeing 737 and the
take-over of the Legacy erroneously
confirmed the existence of the Legacy
traffic; and did not perform the procedure
prescribed for the loss of radar contact.
The ATCO did not perceive the control
condition of the Legacy as critical, and
did not demonstrate discomfort with
the siruation, thus displaying a low
siruational awareness. This may have
been influenced by the information
received from the ACC BS that the aircraft
was at flight level FL360, and by not
being informed that the aircraft had been
without radar contact and radio contact
for some time. Again, this allowed the
two airplanes to fly in opposite directions,
along the same airway and at the same
flight level.
r The Boeing 737 and the Legacy
airplanes were maintaining the same
20
THE CONTROTLERS
ASSUMED THAT THE TRAFFIC
WAS AT A DIFFERENT FLIGHT
LEVEL, WITHOUT EVEN BEING
IN TWO.WAY RADIO CONTACT
WITH THE TEGACY FOR
CONFIRnIATION.
flight level, along the same airway
and were approaching each other in
opposite directions. The aircraft collided,
whereas their crews did not receive
any warnings from the respective TCAS
systems,as the Legacy'stransponder had
stopped transmitting 54 minutes before
the collision. Such a loss also made it
impossible for the radars of the ACC-AZ
to warn the controllers of the imminent
collision, due to the lack of altinrde
information.
IN THE ATC CENTRES
The authorisation to maintain flight
level FL370 was given to the crew of
the Legacy, as the result of a clearance
transmitted in an incorrect manner. The
vertical navigation conducted by the
crew ended up being different from the
one prescribed in the flight plan that was
filed and activated, on account of the
instruction incorrectly transmitted that led
the Legacy crew to maintain flight level
FL37O,
The air traffic control units involved,
although providing radar surveillance
(radar monitoring) service, did not
correct the flight level and did not
perform the prescribed procedures for
altitude verification when they stopped
receiving essential information from the
transponder due to the loss of mode C.
The controllers assumed that the traffic
was at a different flight level, without
even being in fwo-way radio contact with
the Legacy for confirmation. They did
not make a coffect hand-off of the traffic
betqreen sectors and between FIRs. They
maintained RVSM separation when the
necessaryrequirements no longer existed.
FINAL COMNÂENÏ
The shortcomings on the behalf of the
controllers are clear to see. To a certain
extent it is also clear to see why these
shortcomings exist. Take for example
the shortage of staff. The commander
of the Brasilia ACC said that since 2005.
he had been requesting an increase in
the number of operators. These were
not only to maintain the shifts but for
teaching and training purposes, as well
as for qualifying the personnel for the
operation. He said that the Aeronautical
Accident Prevention Program prescribed
the TRM course several years ago, but its
implementation had proved impossible
and it has not been held for two or three
years. The shortage also hindered the
maintenance of a continued training of
the controllers, by means of refreshers,
TRM training and English courses.
It was observed that the annual
theoretical evaluation (TGE) was not
being able to aid in the identification and
diagnostic of the controllers' performance
deficiencies, thus failing to assistin
the process of determination of the
training needs. There were difficulties in
re-creating the operational profile of the
ATCO's involved, due to the shortage
of records relative to the instruction and
technical qualification. The effects of the
personnel shortage were reflected in the
quality of the services as they contributed
to the degradation of the controllers'
performance andlor to the insufficient
technical qualification.
Although, as IFATCA and others say,
the report does focus on the controllers'
and pilots' errors, it does also make a
number of recommendations concerning
the infrastructure and organisation
including English language proficiency,
refresher training, software improvements,
quality management programmes and
TRM.
However it is one thing pointing out
these issuesbut can an organisation
that has so many fundamental and
deeply rooted problems actually make
the necessary changes. \Tithout more
specific recofirrnendations and in depth
examinations of the structure and
responsibilities it is a very difficult task
indeed. As IFATCA says there appears
to be a reluctance to expose staff (other
than the frontline) and departments in
the organisation. And, to make matters
worse, the report pointed out that it
was hindered by the refusal of the
Brasilia ACC controllers to take part in
interviews. Clearly then, all the problems
are compounded as those who really
need to speak out are too fearful of the
consequences.
IFATCA says the report is a missed
oppornrnity but maybe not a lost
opportunity - it may be right but surely it
will be much more than an uphill struggle
to ensure everything that can be done has
been done.
Tronsmit
 TFATCASURPRTSED
BY THE SYSTEilI
On a visit to Brazil,IFATCA found that the
cleared flight level on the aircraft label, as
it appeared on the radar screen,was not
only fed by controllers into the system
(once the clearance was transmitted by
radio to the aircraft, and the aircraft had
coffectly read back the clearance), but
there were occasions when this was done
automatically by the system itself without
any direct input from the controllers.
This automatic change did not show
prominently on the aircraft label as it
should (both the fonts and the colours of
the label remained the same as before).
The'explanation'given was thar this FL
was actually the flight plan level of the
flight and so it was'normal' to change it
automatically when an aircraft passesover
a fix (or navigation aid) where a change of
flight level is requested by the flight plan.
IFATCA said'In manyACCs this crucial
information of the cleared night level is
fed by the controllers into the system once
the clearance is transmitted by radio to
the aircraft (and this has been correctly
read back by the pilot).This'feeding of
the system' is sometimes done by hand
on paper strips, while other systems are
electronic where the input is done directly
onto the label of the flight that appears on
the screen.rWhat is rrery important, even
crucial, is that the groundATC system and
the aircraft cockpit always dispose of the
same information. IFATCA believes that
the pilots and the conrrollers fell victim to
unacceptable systems traps brought on by
'non€rror tolerant' and'bad s)'stem design'
ofATC and flight equipment in use.
NTSBVIEW
The NTSB said:'the use of rhe auromaric
cleared altitude field change has the
potential to mislead controllers, is a poor
human factors design. and is a clear finding
of risk. In fact. this event was one of the frst
that is directll'tied to the accident scenario.
This feature has the undesirable effect
of making the ATC auromarion 'lead' the
actual clearance issued to the flight crew.
A basic tenet ofATC is ro have a double
check of clearances.The automatic change
takes away a method for the [controller]
to reinforce the proper clearance in his
mind. If the controller makes the entry
the action of keying in the numbers helps
to confirm that he has issued the correct
altitude and that the pilot has read back the
clearance correctl)'.Therefore, the automatic
change of the data block field from'cleared
altitude' to'requested altitude' without any
indication to, or action by, the [controllers]
led to the misunderstanding by the sector
7 controller about what altitude clearance
Tronsmit
was issued to Legacy.
We recommend modifying the software to
make it clear to controllers whether this field
of the data block is displaying a requested
A fn. flight strip for the first segment of the flight.The red circle denores the CFL
field - the level authorised byATC and can be changed by the controller.The green
circle shows the RFL field or the flight level requested which cannot be changed by the
controller.
About two minutes before the point of
lan expected level change rhe CFL
The next data block shows a Z between
the height information and CFL field.It
can also be seen the there is no longer a
circle around the target.The Z indicates
height calculated from 3D radar. which
fluctuated from FL36O to FL385. RVSM
flight is not permitted under such
conditions. From this data block the
controller had an indication that the
detection of the aircraft was being
obtained by primary radaq and rhat the
source of altitude information was then
the 3D radar and not the C mode of the
aircraft transponder, via secondary radat.
Following a controller handover the
second controller realised there had been
a loss of transponder signal but carried
altitude or a cleared altitude.At the least, a
'reminder' feature should be distinguishable
from a display that reflects the actual
clearance status of the aircraft.
{ The data block as seen by theATCO
I in sector 7,8,9 who was handling
the aircraft which was still in sector 5
having been handed over early.The 37O
on the left is in the data block's NIV
field which derives information from the
aircraft's mode C transponder. No action
is required as the mode C data equals that
of the authorised flight level (CFL) - the
37O on the right.
freld cb anges from autltorised fligltt
leuel to requested tligbt leuelfuccording
to the concept of the sysrem, the flight
level FL36O was the one cleared for
the next segment of the flight and the
controller has to analyse it and instruct
the necessary level change.The previous
sector 5 controller did not issue any
instructions to the aircraft relative to level
change nor did the sector 7 controller.
The double function of the CFL field is
not in the controllers'manual although
it is taught.The data block remained like
this for seven minutes and the controller
made no calls.
out inefficient procedures to solve
the problem presumably having been
influenced by the information from the
previous controller that the aircraft was
ar FL360.Y
21