Aviation Investigation Report A00C0211

Air Canada flight 148, a Boeing 747, departed Vancouver, British Columbia, en route to Toronto, Ontario, at flight level (FL) 370. Air Canada flight 1155, an Airbus A319, departed Montreal, Quebec, en route to Vancouver at FL390. Both flights were under radar control. The crew of the Boeing 747 requested and was cleared to climb to FL410 approximately 116 nautical miles (nm) west of the Lumsden, Saskatchewan, VOR (very high frequency omni-directional radio range). Approximately 43 nm west of the Lumsden VOR, the crew of the Airbus A319 advised the air traffic controller that there was traffic 5 miles straight ahead and 1000 feet above. The two aircraft passed with zero horizontal and 1100 feet vertical spacing. The required minimum separation was 5 nm horizontally or 2000 feet vertically.

The Boeing 747 was being controlled by the Lumsden sector controller in the Saskatchewan specialty of Winnipeg Area Control Centre (ACC). When the controller took over the Lumsden sector radar position at about 1604 central daylight time,^{Footnote 1} the Lumsden data position was staffed by the Saskatchewan specialty supervisor. Traffic level was assessed as light, with low complexity, and moderate workload. The staffing in the Saskatchewan specialty met unit standards, and all necessary equipment was serviceable.

Based on the traffic level, the supervisor and controller agreed that two controllers were no longer required; therefore, about five minutes after taking over the radar position, the controller also assumed the data position and the supervisor returned to his supervisory duties. It is an accepted and common practice for a controller to work both the radar and data positions simultaneously. Factors considered when deciding if a controller will work both positions are traffic conditions, controller experience and capabilities, controller workload, and available staff.

The controller had 29 years' experience, and was qualified for both the radar and data positions. He was on his fourth day of work after two days off. He had been on duty for five hours since the beginning of the shift, and immediately before taking over at the Lumsden sector he had taken a 30 minute rest break.

At 1610:47 the crew of the Boeing 747 requested a climb to FL410 from their cruising altitude of FL370. Immediately following the request, the controller issued clearance to climb to FL410 and the Boeing 747 vacated FL370 at 1611:12. At this time the Airbus A319 was still being controlled by the Broadview sector radar controller, and was 128 nm to the east. The two flights were on reciprocal tracks. The Boeing 747 crew initiated the climb in vertical speed mode with 400-500 feet per minute (fpm) selected as a rate of climb. The crew was not required to report their climb rate to the controller, and did not do so. The controller did not issue any instructions with respect to the required climb rate, nor did he instruct the crew to report passing a specific altitude.

The data block for each aircraft displayed on the radar indicator module (IM) includes a vertical motion indicator that appears when the aircraft climb or descent rate exceeds 600 fpm. The vertical motion indicator did not appear in the data block for the Boeing 747 at any time during the climb because the climb rate never exceeded the 600 fpm threshold.

The IM can be configured to display projected track lines (PTLs) that indicate the extrapolated position of an aircraft at a specified number of minutes in the future. PTLs may be displayed in two modes. In one mode the controller specifies both the desired targets and a time for the length of the track projection; the IM then displays the PTLs until the controller deactivates this mode. In the other mode, PTL ALL, the controller specifies a time for the length of the track projection, and the IM displays PTLs for all targets on the IM for a short time determined by the current setting for the variable system parameter (VSP). The VSP can be set by the data systems coordinator for 0 to 10 seconds, but is normally set at 6 seconds. PTLs are based on current track and ground speed and are updated with each radar scan; therefore, the track projection will change if an aircraft turns or changes speed. Because of these limitations, the controller did not use PTLs to identify traffic conflicts. However, he did use both modes of PTLs a number of times to confirm estimates and control decisions, including a PTL placed on the target of the Boeing 747 at 1612:24 to confirm the estimate for Lumsden.

There are additional methods available to highlight conflicts on the IM, such as halos around aircraft targets or range bearing lines connecting aircraft targets; however, there are no standard methods for indicating conflicts on the IM. None of these additional methods were used by the controller.

The Air Traffic Control Manual of Operations (ATC MANOPS) specifies the warning indicators to be used on flight progress strips to attract a controller's attention to potentially hazardous or critical situations. The flight progress strip is annotated with a red "W" in the area that most clearly identifies the reason for the warning. The practice among controllers at the Winnipeg ACC is to use a red "W" to identify potential conflicts such as aircraft at the same altitude with crossing tracks. Generally they do not use a red "W" where one aircraft is climbing or descending through the altitude of another aircraft on a reciprocal track. The controller did not use a red "W" on the flight progress strips for the Boeing 747 or the Airbus A319.

ATC MANOPS describes cocking of flight progress strips as "an essential control technique used to remind controllers that some further action must be performed", and directs that a strip be cocked when "potential situations requiring investigation or further action" exist. Winnipeg ACC controllers use this technique to remind them of traffic conflicts such as the one in this occurrence. The controller's normal working practice was to cock a flight progress strip when a climb clearance was issued, and to uncock it immediately when the action of advising the next sector of the revised altitude was complete. When the climb clearance was issued, the flight progress strip for the Boeing 747 had already been cocked to remind the controller that the Lumsden estimate had not yet been passed to the Broadview sector, so he did not need to cock it because of the climb clearance. At 1613:44 he passed the estimate and the altitude of FL410 for the Boeing 747 to the Broadview sector, and Broadview acknowledged. However, the controller could not recall uncocking the flight progress strip at that time, and it could not be determined if the flight progress strip had been uncocked.

The controller saw the target for the Boeing 747 climbing through FL380 at 1614:30. He again made the assessment that there was no potential for conflict between the two flights, and did not issue any restrictions or instructions.

From 1614:38 until 1615:34 the controller communicated with three other flights, with the Edmonton ACC, and accepted control of Canadian Regional Airlines flight 1458, a Fokker F28 from the underlying Great Plains sector. This flight contacted the Lumsden controller at 1615:27, climbing eastbound through FL290, at which time its radar target was centred longitudinally between the Boeing 747 and the Airbus A319. From 1615:43 to 1618:19, in addition to monitoring the IM, the controller was occupied exchanging data about the Fokker F28 with the Broadview controller, emptying the flight progress strip printer and processing flight progress strips, double-checking estimates, and preparing to pass them to other sectors. All of these tasks are normal controller duties.

Interviews with Winnipeg ACC controllers disclosed that non-pertinent flight progress strips were produced. When combining or splitting control sectors, support staff are required to reprogram the computer system to send the flight progress strips to a printer at the appropriate sector. The reprogramming occasionally lags behind the sector reconfigurations. As well, flight progress strips are printed well in advance of the arrival of a flight in a sector. As a result, some flight progress strips are printed at sectors for flights that will not be controlled by that sector. Conversely, a sector may not receive a flight progress strip for a flight that will be controlled by that sector. This requires controllers to perform additional coordination to ensure those controllers that needed the flight progress strip would have it, and also to dispose of non-pertinent flight progress strips. The Lumsden sector had undergone one of these reconfigurations before the occurrence, and the controller was diverting some of his attention to process and discard non-pertinent flight progress strips. There was no information that the controller was missing any pertinent flight progress strips.

Quicklook "ALL" is an IM function that displays full data blocks for all correlated targets currently displayed on the IM. Normally, only aircraft being controlled by that sector display full data blocks, with other targets showing only the controller jurisdiction symbol. Quicklook is activated by pressing a button on the IM control panel, and must be deactivated by a second press of the same button. Quicklook "ALL" was active on the Lumsden IM at 1614:49 at about the time the controller accepted control of the Fokker F28, and was deactivated at 1616:35. Additionally, at 1616:50 PTL "ALL" was selected on for all the targets on the Lumsden IM.

At 1618:25 the crew of the Airbus A319 reported to the controller that their traffic alert and collision avoidance system (TCAS) indicated traffic 1000 feet above and 5 nm ahead. At the same time, the controller became aware of the traffic conflict on his IM. The two aircraft were 5 nm apart, with the Boeing 747 climbing through FL399. At 1618:32 the controller advised the Airbus A319 that the traffic they had reported was another Air Canada flight, climbing through FL400. At 1618:36 the controller instructed the Boeing 747 to continue the climb without delay. At 1618:39 the Boeing 747 advised the controller that they had the traffic in sight, and that there was no chance of collision. No evasive action was taken by either flight. At 1618:46 the two aircraft passed with zero horizontal and 1100 feet vertical spacing.

The TCAS produces advisories to indicate a potential collision threat. The traffic advisory (TA) indicates that the estimated time to the closest point of approach of an intruder aircraft's trajectory is between 35 and 48 seconds, and also that the intruder aircraft will be within 1200 feet but not less than 800 feet relative altitude at the closest point of approach. Both crews received a TA. The Canadian Aviation Regulations (CARs) do not require TCAS to be installed in aircraft flying in Canadian airspace.

In 1987, Transport Canada issued Information Bulletin 8709, directing managers to brief controllers about the proper use of strip-cocking techniques to prevent operating irregularities. In 1992, Safety Bulletin 9201 emphasized the need for complete attention to detail to prevent loss of separation between aircraft climbing on reciprocal tracks while under radar control. In 1995, Safety Bulletin 9501 recommended the use of procedural reminders to alert controllers to the need to monitor closely aircraft on reciprocal tracks. It recommended the use of restrictions such as track or heading changes to ensure separation was maintained. In 1999, Nav Canada issued ATC Information Bulletin 1999-2, describing the capabilities of conflict alert software. In 2000, Nav Canada issued Safety Bulletin 2000-1, emphasizing the need for controllers to closely monitor aircraft separation to confirm the accuracy of their expectations of aircraft performance, and to take alternative action if their expectations are proven to be incorrect.

The original performance specifications for the ATC radar data processing system (RDPS) software included provisions for aircraft conflict alerts. During testing in the late 1980s and early 1990s, the RDPS conflict alert function was found to have several faults and was not considered acceptable for operational use. This function was still not operational at the time of this occurrence. In the investigation report on occurrence A99H0001, involving a loss of separation between two Boeing 767 aircraft west of Langruth, Manitoba, the TSB made a recommendation for the consideration of both Nav Canada and Transport Canada that:

Nav Canada responded that testing of conflict alert software was underway. A national release of the software is planned following completion of testing and development.

The controller expected that the Boeing 747 would achieve a climb rate sufficient to assure adequate spacing from the Airbus A319. He did not expect any conflict, so he cleared the Boeing 747 to climb through the altitude of the Airbus A319. Because he expected no conflict, he did not impose any restrictions for the climb, such as a specified heading or climb rate. Nor did he instruct the crew to report climbing through a specific altitude to remind him to reassess his separation plan.

However, the plan was flawed because the actual climb rate was less than the controller had expected. The controller did not recognize information that could have led him to realize his climb rate expectation was incorrect. He did not notice that the vertical motion indicator in the Boeing 747 data tag was absent, indicating that the climb rate was below the 600 fpm threshold. He observed the Boeing 747 climbing through FL380, but did not recognize that the climb to that point had been slower than he had expected. He did not realize that his separation plan was flawed because his expectation of climb performance was not disproved. Therefore, he did not take any action to ensure separation would be maintained, or to remind himself to reassess the plan as the climb progressed further.

The flight progress strip for the Boeing 747 had already been cocked to remind the controller that the Lumsden estimate had not yet been passed to the Broadview sector, so he did not need to cock it because of the climb clearance. His normal working practice was to uncock a flight progress strip when the action of advising the next sector of an estimate was complete; therefore, it is probable that he uncocked the flight progress strip once Broadview had received the Lumsden estimate and altitude of FL410 for the Boeing 747. Had the estimate been passed to Broadview before the climb clearance was issued, it is likely the controller would have cocked the flight progress strip when he issued the clearance, and then uncocked it when the new altitude was passed. Because of this practice, it is likely he would not have left the strip cocked as a reminder even if he had identified a conflict. As a result, the controller did not have any procedural cues reminding him to monitor the climb because he probably uncocked the flight progress strip, and also because he did not use a red "W" on the flight progress strips for either aircraft.

The controller's selection of Quicklook "ALL" at 1614:49 was likely made so the controller could see the data tag for the Fokker F28 after he was asked by Great Plains to approve the climb for that aircraft to FL330. It is possible that the controller focussed on the need to ensure separation between the Fokker F28 and other aircraft, diverting his attention from the potential conflict between the Boeing 747 and the Airbus A319. The location of the Fokker F28, between the Boeing 747 and the Airbus A319, may have prevented him from noticing the developing conflict.

During the period from 1615:43 to 1618:19, the controller was occupied with other activities that diverted his attention from monitoring the climb of the Boeing 747. Because there was no second controller to perform the data position duties, he was maintaining the flight data board, emptying the flight progress strip printer, and processing flight progress strips, including non-pertinent flight progress strips not relevant to his sector. He was also double-checking estimates and preparing to pass them to other sectors. The practice of not using a data controller during periods of low traffic increased the workload of the radar controller and reduced the time available for flight monitoring.

Diverting attention away from the IM for any length of time results in a breakdown of the defence afforded by effective scanning techniques. With no other defences in place, such as conflict alerting, use of a red "W," cocking of flight progress strips, an instruction for altitude call-outs from the Boeing 747, or a second controller working the data position, the controller's attention was not directed back to the developing conflict. The controller did periodically monitor the IM, as indicated by the de-selection of Quicklook "ALL" at 1616:35, and the activation of PTL "ALL" at 1616:50; however, this monitoring was not sufficient to detect the conflict.

A loss of separation occurred because the controller cleared the Boeing 747 to climb and allowed the two aircraft to pass with less than the minimum required separation of 5 nm laterally or 2000 feet vertically, as specified in CAR 801.08 and the associated standard.

There are several ground and airborne layers of defence to prevent midair collisions caused by human error. In this occurrence, the ground-based defences failed despite existing procedures and despite reminders in the five bulletins described above that emphasized the need for proper procedures and monitoring. TCAS, fitted in both occurrence aircraft to comply with the regulations of states other than Canada, provided the initial conflict alert just before the controller recognized the conflict, but too late to prevent a loss of separation. The possibility for controller misjudgement and diversion of attention to other tasks exists; however, there is currently no automated conflict-alerting system available in Canada to provide a defence against the failure to recognize aircraft conflicts.

Findings as to causes and contributing factors

1. The controller cleared the Boeing 747 to climb through the altitude of the Airbus A319, and did not monitor the flight paths of the aircraft closely enough to prevent a loss of separation.
2. The controller's expectation that the Boeing 747 would climb at a rate sufficient to assure required separation was incorrect. He did not detect the lower-than-expected climb rate, although visual clues were available on the IM.
3. The controller did not use published flight progress strip marking or handling procedures to alert him to the need to monitor the climb of the Boeing 747, nor did he use available IM display tools to help identify the conflict. These are memory aides only and are predicated on the recognition of a conflict in the first place.
4. The controller was occupied with traffic and other duties that reduced the time available for monitoring the flight paths of the Boeing 747 and the Airbus A319.

Findings as to risk

1. There is no functioning conflict-alerting tool available to warn controllers of impending air traffic conflicts, although Nav Canada is currently testing software.
2. The practice of combining the radar and data positions in a sector reduces the opportunity to detect conflicts and take timely action to prevent a loss of separation.
3. The CARs currently do not require TCAS to be installed in aircraft flying in Canadian airspace.

Other findings

1. The TCAS system in each aircraft warned the flight crews of the conflict.

Safety action taken

Transport Canada reported that a notice of proposed amendment (NPA) was presented at a June 2000 Canadian Aviation Regulations Advisory Council technical committee meeting. The NPA states the following:

. . . by 1 January 2003 no person shall conduct a take-off in a turbine-powered aeroplane that has a maximum certificated take off weight of more than 15,000 kg or for which a type certificate has been issued authorizing the transport of more than 30 passengers, unless the aeroplane is equipped with an airborne collision avoidance system (ACAS) that conforms to the aircraft equipment and maintenance standards.

Transport Canada stated that the amendment to the CARs will exceed the International Civil Aviation Organization standard which will come into effect in 2003.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 3 October 2001.