Air traffic controller representatives have expressed strong concerns over the Brasilia area control centre connected with September’s fatal mid-air collision, claiming that automated procedures may have contributed to the accident.
Representatives of the International Federation of Air Traffic Controllers’ Associations (IFATCA) visited the Cindacta-1 centre last month, days after a Gol Linhas Aéreas Boeing 737-800 was struck by an Embraer Legacy jet over the Amazon, resulting in the loss of all on board the larger aircraft.
One specific feature of the Cindacta-1 system’s configuration has generated particular alarm. The federation states that it is permitted automatically to update certain altitude-clearance information on the controller’s display, without controller intervention.
IFATCA believes that this aspect of the system, combined with the loss of transponder-derived altitude data from the Legacy at a crucial moment, may have misled controllers and helped create the circumstances for the collision.
Within a typical control centre the altitude to which an aircraft has been cleared normally appears on a controller’s display as part of the flight’s data-block. Once a controller issues a new altitude clearance to the aircraft by radio, this information is fed manually into the system – ensuring that pilots and controllers are kept within the information loop.
But the Brasilia system, says IFATCA, is capable of updating the cleared flight level on the display automatically, once an aircraft passes a particular waypoint, to the altitude given by the flight plan – without any direct involvement from the controller, and with no prominent indication that such an update has taken place.
“Of course the situation is not that dramatic when all runs well and according to the book,” says the federation. “In these cases, when scanning the radar screen, controllers will notice the discrepancy, issue a proper descent clearance, and so correct the situation.”
But on the date of the accident the Legacy’s flight plan called for an altitude change from FL370 to FL360 after passing the Brasilia VOR beacon. During the transition across the VOR there was no radio communication between the aircraft and the Cindacta-1 centre, and the Legacy maintained its altitude of FL370 as it joined an airway to head for Manaus.
Even though the aircraft was still at FL370, says IFATCA, the Cindacta-1 system nevertheless automatically updated the Legacy’s cleared flight level to FL360 – as given by the flight plan – despite there having been no formal clearance issued by air traffic control.
Seven minutes after the Legacy crossed the Brasilia VOR, the Cindacta-1 centre lost all secondary radar information from the jet. This included all altitude information transmitted by the aircraft’s transponder. Loss of this information, says IFATCA, would have eliminated a crucial indication to controllers that there was a mismatch over the Legacy’s altitude.
“There is no ‘reminder’ when the transponder goes off the air after the passage of the Brasilia VOR, and before the controller has an opportunity to note the problem,” says the federation. “Because the [transponder altitude report] is not being received, there is no ‘check and balance’ system working.”
It adds that while Brazilian military three-dimensional primary radar is designed to provide flight-tracking and altitude information in the event that secondary surveillance data is lost, long-range triangulation can result in an aircraft’s altitude being inaccurately calculated.
“To date IFATCA has not received a convincing explanation of why the software of [the Cindacta-1 centre] is tuned in such a strange way,” says the federation. “We are also at a loss to understand why the very unreliable calculations of military primary radars are shown to civilian controllers.”
It says that, during a handover between controllers about 45min before the accident, the Legacy’s altitude was passed as being FL360. The aircraft was actually still at FL370, the same altitude as the Gol 737 heading along the same airway in the opposite direction.
IFATCA describes the Cindacta-1 set-up as “non-error tolerant” and says it believes this created an “unacceptable system trap” which ultimately reduced the situational awareness of the controllers and pilots.
Source: FlightGlobal.com
