Aviation Investigation Report A00H0002

Two Lufthansa German Airlines Airbus A340 aircraft were on nearly reciprocal tracks at flight level 370: DLH411, registration D-AIBC, was eastbound; DLH420, registration D-AIGO, was westbound. At approximately 95 nautical miles north of Sydney, Nova Scotia, the pilot of DLH411 advised the Gander, Newfoundland, air traffic controller that he had received a traffic alert and collision-avoidance system (TCAS) traffic alert showing another aircraft at his 12 o'clock position, 20 miles ahead. The controller instructed DLH411 to turn left 20 degrees and instructed DLH420 to descend to flight level 360. After following the controller's instruction, the pilot of DLH411 advised he was climbing the aircraft in response to a TCAS resolution advisory. DLH420 received a resolution advisory to descend. Radar separation had decreased to approximately 3 nautical miles lateral spacing before 1000 feet vertical spacing was achieved. The minimum required radar separation in this airspace was 5 nautical miles laterally or 1000 feet vertically.

1.1 History of the flight

Lufthansa German Airlines flight 420 (DLH420), an Airbus A340, was en route from Frankfurt, Germany, to Boston, Massachusetts. The routing through Canadian domestic airspace was via CYMON intersection to EBONY intersection. At 1750:52 Atlantic daylight time (ADT),^{Footnote 1} on exiting oceanic airspace at flight level (FL) 360, DLH420 contacted the Gander, Newfoundland, Area Control Centre (ACC) domestic high (east) sector controller. FL360 would not be available for the domestic portion of the flight, so the domestic high (east) controller cleared DLH420 to FL370. Because of the structure of the airspace in effect at the time, DLH420 would not be able to remain at FL370 after about 1900. Based on the pilot's information that the flight would be able to climb to FL390 in approximately one hour, the controller entered information on the flight progress strip to indicate that DLH420 was at FL370 and would have to be cleared to FL390 at 1850. Once the flight progress strips for DLH420 were updated with that information, one of them would have been passed to the west sector controller. Control of DLH420 was handed over to the domestic high (west) controller at 1829:34 on frequency 125.25 megahertz.

DLH411, also an Airbus A340, was on a flight from Newark International Airport, New Jersey, to Munich, Germany, and was routed through Canadian domestic airspace from TUSKY intersection direct to DOTTY intersection. This track would cross the track of DLH420 approximately 95 nautical miles (nm) north of Sydney, Nova Scotia. Moncton, New Brunswick, ACC initiated a radar handoff of DLH411 with the Gander domestic high (west) controller at 1839:32 as the flight was approaching the NIK intersection (located on the Moncton/Gander boundary) and stated that DLH411 was at FL370. One minute eight seconds later, DLH411 established radio contact with the Gander domestic high (west) controller on frequency 133.55 megahertz and confirmed level at FL370. The oceanic portion of the clearance was passed to DLH411 at 1840:48, at which time DLH411 requested FL380 or maximum FL390. After a brief conversation to clarify the request, DLH411 was told that the request for the higher altitude was under consideration. At this point, the first Gander domestic high (west) controller was relieved by another controller.

Image

At 1850:43, the pilot of DLH411 advised the second controller that he had received an alert from the on-board traffic alert and collision-avoidance system (TCAS) equipment of another aircraft 20 miles ahead at the same altitude. The second controller responded at 1850:49 with instructions first to turn left now, then to turn left 20 degrees. The pilot acknowledged the instructions. Immediately afterward, at 1850:59, the second controller instructed DLH420 to descend to FL360 to provide additional separation between the two aircraft. The second controller confirmed the readback from DLH420 and added an instruction to commence the descent without delay.

No traffic information was provided to DLH420, and since the crew of DLH420 were on a different frequency, they did not hear the report of traffic from DLH411. DLH420 received a resolution advisory (RA) to descend when the two aircraft were approximately 15 nm apart. Since the crew had already initiated descent in accordance with the second controller's instructions, they did not report the RA; however, they increased their rate of descent. At 1851:39, the pilot of DLH411 advised the controller that he had commenced a climb as a result of a TCAS RA. Shortly thereafter he acquired the other aircraft visually. DLH420 levelled at FL360 and DLH411 reached FL376 as the aircraft passed abeam. When the aircraft had passed and the required lateral spacing was achieved, DLH420 was cleared to maintain FL390, and DLH411 was cleared back on course to return to FL370. In addition to monitoring the flight paths of the two aircraft, the second controller was also working with another aircraft, an executive jet 15 nm north of the track of the two Lufthansa aircraft. The executive jet was in descent from FL410 for an approach into Stephenville, Newfoundland. The proximity of the executive jet to DLH411 limited the extent to which the second controller could turn DLH411 to the north.

Image

At the time of the warning from DLH411 indicating that the two Lufthansa aircraft were 20 miles apart, they were closing at 16.5 nm per minute. By the time the second controller had issued a descent clearance to DLH420, and the pilot reported leaving FL370 at 1851:11, the aircraft were 13.6 nm apart. Recorded radar information indicates that DLH411 began a turn when the two aircraft were 11 nm apart, and DLH420 showed a descent out of FL370 when they were 8.5 nm apart. The 20-degree left turn for DLH411 was sufficient to achieve a 2.4-nm lateral spacing between the two aircraft as they passed; however, the turn did not provide sufficient spacing to prevent a TCAS RA from being triggered in each aircraft. The climb by DLH411 and the descent by DLH420 provided vertical spacing of 1400 feet at the point of closest approach.

The occurrence took place at 1851, at 47°35′ north latitude, 61°20′ west longitude, approximately 95 nm north of Sydney, within the Gander ACC domestic high (west) sector.

Extrapolation of the original flight tracks indicates that the aircraft would have come within 0.5 nm horizontally had they not taken evasive action. TCAS is mandatory equipment for large passenger-carrying air transport aircraft flying in United States-controlled airspace. For this reason, many aircraft flying through Canadian-controlled airspace are equipped with TCAS even though this equipment is not required by Canadian Aviation Regulations.

1.2 Personnel information

1.2.1 First high domestic (West) controller

The first controller had more than 29 years' controlling experience in Gander ACC. On the day of the occurrence, the controller had been on duty since 1430 and, after returning from a break at approximately 1800, took over the domestic high (west) radar position. He was working the position alone without a data controller. Traffic was reported as light, with little complexity. At approximately 1840, the controller indicated to the supervisor that he required immediate relief. After a short handover briefing to the second controller, he left the operations room at approximately 1845.

1.2.2 Second high domestic (West) controller

The second controller had four years' experience as a qualified instrument flight rules controller. On the day of the occurrence, he started his shift at 1330 controlling in the domestic high (east) sector and went on a break at 1800. At approximately 1845, he was unexpectedly recalled to work by the supervisor to take over the control position from the first controller, that is, the domestic high (west) sector. At the time of the occurrence, six aircraft were under his control.

1.3 Aids to navigation

All required aids to navigation were functioning properly. The radar data-processing system (RDPS) and the RDPS situational displays (RSiT) in Gander ACC were functioning properly.

1.4 Communications

Air-ground-air communications frequencies used by Gander ACC controllers in the control of DLH411 and DLH420 were serviceable. There were no communications problems reported by the controllers or aircrew. Because of the size of the west high sector, two different frequencies were being used to communicate with aircraft: one frequency providing coverage of the western portion of the sector; the other, the eastern portion. As a result, the two aircraft involved in this occurrence were on different frequencies, and DLH420 did not hear the report of opposite-direction traffic at the same altitude. When the controller initially instructed DLH420 to descend to FL360, the rate of descent selected was consistent with normal operation because the crew was not aware of nearby conflicting traffic. Only when DLH420 received a TCAS RA was the rate of descent increased. As a result, additional time was required to achieve the required spacing.

Air Traffic Control Manual of Operations (ATC MANOPS), article 507, states that controllers are to issue a safety alert to an aircraft if they are aware the aircraft is at an altitude that, in the controller's judgement, places it in unsafe proximity to another aircraft. The phraseology to be used was "traffic alert [position of traffic, if time permits], advise you turn right/left [specific heading, if appropriate]" or "climb/descend [specific altitude, if appropriate] immediately." This phraseology serves to highlight the immediate danger to the aircrew and to illicit a quick response to the instruction. The controller did not use the safety-alerting phraseology.

1.5 Air traffic controloperations – Gander area control centre

1.5.1 Structured airspace

Structured airspace is designed to allow the most effective use of a limited block of airspace for heavy, primarily one-way, intercontinental traffic flows through the Gander and Moncton ACC control areas. The traffic flow changes direction approximately every twelve hours, with the daytime flow primarily westbound and the nighttime flow eastbound. To meet the demands of the oceanic flow, most available altitudes are designated for a specific direction at specific times of the day (Gander Unit Operations Manual, Part 4—High Domestic Procedures). FL370, normally an eastbound altitude, becomes a westbound altitude from 1000 to 1900.

At the time of the occurrence, westbound traffic was still allowed at FL370. From the time eastbound DLH411 entered Moncton ACC airspace, it had been cleared to fly at an inappropriate altitude for direction of flight. The altitude box on the flight progress strip for DLH411 was required, by published procedures, to be marked with the appropriate symbol to indicate a wrong-way altitude. The Moncton controller had marked the flight progress strip appropriately, but omitted to specifically mention the wrong-way altitude at the time of the handoff to Gander ACC. It was not the Gander controller's normal practice to mark the flight progress strips to indicate a wrong-way altitude under similar circumstances, close to the time of termination of the structured airspace.

The first and second Gander high west controllers were aware of the limitations of using FL370 for westbound flights. The first controller had planned to issue a climb clearance to DLH420 before 1850, in accordance with the information written on the flight progress strip. The unexpected position handover and his rapid exit from the operations took place at approximately 1845. He had not issued the climb clearance to DLH420, nor did he inform the second controller of the requirement to issue the clearance. The second controller's own work practice was to not leave westbound aircraft at FL370 if their boundary estimates were close to the cut-off time for the westbound structure. For example, if a westbound aircraft's estimate for the boundary with Moncton ACC was close to or later than the cut-off time, he would normally assign an appropriate altitude as soon as practicable. At the time he took over the high west sector, approximately 1845, he did not expect any westbound aircraft to be at FL370 because it was so close to the cut-off time of 1900. On seeing the two Lufthansa flights on the radar, the second controller assumed they were both eastbound flights. However, he did not recall that approximately one hour earlier, when controlling traffic in the high east sector, he had cleared DLH420 from FL360 to FL370 and determined that the aircraft could climb to FL390 at 1850. The second controller marked this information on the flight progress strip at that time, although the clearance for the delayed climb to FL390 would not be issued until just before 1850. This was not consistent with what he indicated was his normal work practice.

1.5.2 Controller actions

The first controller had spent the previous day on a course at the ACC. At the beginning of his shift on the day of the occurrence, the first controller felt fine; however, about 45 minutes after having taken over the west sector, he advised the supervisor that he required an immediate break. As a result, the second controller was recalled early from his break, to take over the position. The second controller came to the west sector position and received a quick briefing on the traffic situation. The first controller then immediately left the operations room. The second controller looked at the radar indicator module (IM) and observed both Lufthansa flights at FL370. Because he had not been briefed that there was a conflict to be resolved and because he was also used to seeing up to four eastbound Lufthansa flights at this time of the evening, he assumed that both aircraft were eastbound. This, combined with his assumption that the westbound altitude structure was, in effect, no longer in use because it was close to the termination time, reinforced his perception that DLH411 and DLH420 were flying in the same direction at the same altitude.

After completing a check of the radar IM, the second controller began a flight progress board check; however, it was not completed in the five to seven minutes he worked at the position before the occurrence. He interrupted his board check several times to respond to requests from other controllers regarding air traffic matters. He also responded to an executive jet requesting descent for landing at Stephenville and coordinated an appropriate altitude for an aircraft transiting the east and west sectors at an altitude that conflicted with the structured airspace. He considered these higher priorities because he had received no information at the handover to indicate an impending conflict.

When the second controller received the report from DLH411 about traffic ahead at the same altitude, he instructed DLH411 to turn left 20 degrees. The executive jet inbound to Stephenville was of concern. The executive jet was approximately 15 miles north of DLH411 and already descending from FL410 to FL290. The controller had to ensure that appropriate lateral spacing was maintained between these two aircraft.

Certain published procedures for marking and handling flight progress strips are designed as defences to help a controller keep track of flights that require special attention. One such procedure involves placing a red "W" in the altitude box as a warning indicator, along with the conflicting aircraft's identification and the conflict point and times. Another procedure is the circling, in red (or the use of "WW" at Gander ACC) of an aircraft's altitude to indicate that it is flying at an altitude inappropriate for the direction of flight. The cocking of a flight progress strip is a strip-handling procedure that can draw the attention of a controller to an uncompleted action. None of these techniques were used. The domestic high level procedures for altitude assignment, principally FL370, were ambiguous. When the westbound structure was in place, individual controllers used varying practices for eastbound aircraft at FL370.

1.5.3 Handover

During the handover briefing, neither controller referred to the handover checklist, which was available at each control position. The general traffic situation was covered during the handover; however, the fact that DLH420 was to be cleared from FL370 to FL390 at 1850 was not mentioned.

As outlined in the Air Traffic Services Administration and Management Manual, article 203.2, Position Responsibility, "managers shall ensure that unit guidelines are developed, which provide direction for controllers . . . to follow, at the time of transfer of position responsibility." The guidelines must "contain a checklist for each operational position, to be used at the time of transfer . . . ." ATC MANOPS, article 113.2.A.4, states that the relieving controller is to refer to the checklist before receiving the handover briefing from the controller being relieved; however, it is not stated that the checklist must be referred to by either the relieving controller or the controller being relieved during the verbal portion of the briefing. A checklist was available at the west sector position when the controllers were conducting the handover briefing. Neither controller used the checklist, and neither was in the habit of doing so. Interviews conducted with controllers in the course of other TSB investigations have revealed that checklists are seldom if ever used during position handover briefings. (See Appendix A for a copy of the Gander high level domestic specialty checklist.) Item 4 on the high level domestic briefing checklist refers specifically to traffic information, including possible/probable separation problems, delayed clearances (for example, climb, reroute, etc.), and outstanding items requiring action.

1.5.4 Direction of flight indications

Controllers receive information on direction of aircraft flight from a number of sources. The strips at Gander ACC indicate, by different coloured printing on the strips, whether an aircraft is eastbound or westbound. Red denotes westbound, black denotes eastbound. This differentiation helps controllers detect conflicts between aircraft moving in opposite directions.

Gander ACC is equipped with the new RSiT. These displays are 51-centimetre-square colour monitors capable of displaying air traffic out to a range of 750 nm. As the radar beam sweeps by a target, the target position is updated and a new target is displayed. The time between radar updates is approximately five seconds. This target movement, together with a short series of trail dots, indicates to the controller the direction of flight. The longer the range displayed on the IM (or the slower the aircraft), the less apparent is the movement of the target, and the less obvious the trail of dots. Although different colours are used to delineate airspace boundaries and other information, the aircraft tag colour is the same for all aircraft, regardless of the direction of flight.

Controllers are provided with a number of tools to indicate direction of flight. All eastbound or all westbound aircraft can be marked automatically with direction-of-flight arrows. Projected track lines may be placed on specific aircraft targets (or on all aircraft targets, if desired) to indicate an aircraft's projected flight track based on its current heading (updated with each sweep of the radar) for a controller-selectable time period. Projected track lines may be used by controllers to display direction of flight, determine estimates, or highlight potential conflicts. Similarly, to help a controller highlight potential conflicts, a range bearing line can be displayed that connects two aircraft targets, an aircraft and a geographic location, or two geographic locations. Individual aircraft targets may also be marked with a circle (halo), which can be used to attract the controller's attention to some uncompleted action. However, there is no common method to depict direction of flight on the IM; controllers have developed individual practices when using these tools.

1.5.5 Automated conflict-alerting system

The radar processing system in use at Gander ACC is not equipped with an automated conflict-alerting system. The purpose of an automated conflict-alerting system is to provide warning that a loss of separation is about to occur or has occurred and thereby give the controller time to act to prevent an actual loss of separation or conflict from occurring. In 1990, the Canadian Aviation Safety Board (CASB) identified the need for the development and installation of automated conflict prediction and alerting systems in the Canadian air traffic services system (CASB Recommendation 90-36). Although work to deploy an operational system has been ongoing—by Transport Canada and, more recently, Nav Canada—such a system has not yet been deployed.

As a result of the TSB investigation into a loss-of-separation occurrence in 1999 (TSB Report No. A99H0001), the TSB recommended, for the consideration of Nav Canada and the Minister of Transport, that:

In this occurrence, only TCAS provided a warning in time for action to be taken to prevent a potential accident. However, reliance on TCAS as the sole automated defence against human error does not provide protection for all passenger-carrying aircraft, because TCAS is not mandatory in Canadian-controlled airspace.

Nav Canada is in the process of developing an air traffic control conflict alert system and began testing of the system in Toronto ACC on 31 March 2001. TC will monitor the testing and assess the necessity of a regulatory approach to address the Board's recommendation.

2.1 General

The lack of an automated ground-based conflict detection and alerting system and the lack of regulations requiring transport aircraft to be equipped with TCAS continues to put air travellers at risk. Although Nav Canada has been working on the development and deployment of a radar-based automated conflict detection and alerting system, the company has been unsuccessful to date. Transport Canada intends to amend the Canadian Aviation Regulations to require passenger-carrying transport aircraft to be equipped with TCAS within the next few years. These issues will not be further analyzed in this report. The remainder of the analysis will deal with the issues of controller situational awareness, controller work practices, and management practices.

2.2 Situational awareness

From the time the second controller took over responsibility for the west sector position at approximately 1845, he did not have all the information necessary to ensure that his mental model of the traffic situation—his situational awareness—was correct. Looking at the RSiT, he concluded, based on previous experience of seeing up to four aircraft from this airline flying eastbound at this time of day, that both Lufthansa flights must be eastbound. Two additional factors reinforced his mental model. First, it was not his practice to use a normally eastbound altitude (FL370) for westbound aircraft close to the cut-off time of 1900. In fact, among the controllers there were differences in work practices related to the use of the structured altitude procedures within Gander ACC domestic airspace. Second, due to the long range displayed on the RSiT, the trail dots shown behind each radar target were smaller and harder to see. There is no standardized method for indicating direction of flight on the radar IMs. The second controller did not, therefore, detect that DLH420 was flying westbound. Since information concerning a potential conflict was not passed between the two controllers at the handover briefing, the second controller did not see any requirement to immediately complete a detailed check of the flight progress strips. This resulted in the second controller having reduced situational awareness and not detecting that the two aircraft were on converging courses.

Procedural defences were in place to help the controllers gather correct and current information and so develop accurate mental models of the air traffic situation. However, neither controller used the defences consistently in this occurrence. The first controller did not highlight strips for the two aircraft to indicate a potential conflict, the strip for DLH411 was not cocked to indicate an uncompleted action, nor was the altitude marked to indicate that DLH411 was flying at an altitude not in accordance with the current structure for the airspace.

2.3 Controller work practice defences

The defences provided by following published strip-marking procedures—such as indicating the potential conflict on each strip, marking altitudes not appropriate for direction of flight, and cocking strips—were not used and, therefore, were ineffective in preventing this occurrence. The first controller had not expected to leave his operating position so quickly and before solving the conflict between the two aircraft. A clue to the direction of flight, the differently coloured printing on the strips, was not effective as a defence because the controller had not yet progressed, in his board check, to a review of the strips for the two Lufthansa aircraft.

The controller did not provide traffic information or use established safety-alerting phraseology. Consequently, the pilot of DLH420 initially selected a normal rate of descent, rather than one reflecting the urgency of the situation. This increased the time needed to achieve the required 1000-foot vertical spacing between the two aircraft and thereby lengthened the time the two aircraft were at risk.

2.4 Management practices

Although handover checklists were available in Gander ACC, there is no stated requirement directing controllers to use the checklist during transfer of position responsibility briefings. Had the two controllers been required to refer to the checklist, critical information concerning the two aircraft flying toward each other at the same altitude would likely have come to light. Since controllers are not required to use handover checklists during handover briefings, there is a continued risk that critical information could be overlooked, thereby leading to losses of separation or midair collisions.

ATC units have standardized methods to indicate direction of flight on flight progress strips, but not to show direction of flight on the IM. The direction of flight can be shown by colour-coded printing on the flight progress strip or by printing the aircraft identification at the appropriate end of the strip. Controllers have a number of techniques and tools on the IM, but the choice of which to use (or not to use) is left to each controller. This is not consistent with the principle established for standardized coding of strips for direction of flight. In this occurrence, had a standard method for depiction of flight on the IM been established and used by all controllers, the second controller might have been alerted to the two Lufthansa aircraft flying toward each other.

3.1 Findings as to causes and contributing factors

1. The handover briefing between the two controllers was incomplete, and the available position handover checklist was not used. These actions deprived the second controller of critical information about the conflict between the two aircraft.
2. The first controller did not use standard work practices, as required by published procedures. As a result, the second controller did not detect critical information pertaining to the two aircraft.
3. The second controller misinterpreted the direction of flight of DLH420. Consequently, he was not aware that this aircraft was in conflict with DLH411.
4. The second controller did not complete a flight progress board check in the few minutes between assuming control of the position and the time of the occurrence. This eliminated the defence provided by the colour-coded printing on the strips.

3.2 Findings as to risk

1. There are no written requirements mandating controllers to use the available handover checklist during transfer of position briefings. As a result, the checklists are used only sporadically, which can lead to information being missed during the many times that handovers take place in the course of a day.
2. There is no standard method by which controllers depict direction of flight on the radar indicator module; this can lead to information being overlooked or misinterpreted.
3. Although required by published air traffic control procedures, the altitude on the strip for DLH411 was not marked as "wrong way". This omission may have reduced the likelihood of the oncoming controller detecting the conflict.
4. An automated conflict-alerting system is not yet available to alert Canadian controllers of impending air traffic conflicts; however, a system is being developed.
5. The second controller did not use the approved safety-alerting phraseology to instruct the pilot of DLH420 to descend to flight level 360. As a result, the two aircraft were exposed to a risk of collision for longer than necessary, and there was a delay in achieving the required minimum 1000-foot vertical spacing.

4.0 Safety action taken

As a result of this occurrence, Gander Area Control Centre (ACC) has included a mandatory requirement for controllers to complete the briefing checklist when assuming responsibility for a sector. This action was initiated on 15 August 2000, and the Gander Unit Operations Manual was updated on 22 March 2001.

On 18 April 2001, the TSB forwarded Aviation Safety Information Letter A000043-1 to Nav Canada to encourage consideration of a method, applicable to all Air Traffic Services units across the country, to reduce the risks associated with memory-dependent transfer of position responsibility briefings and to ensure that critical information will not be forgotten.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 21 August 2001.

Appendix A – Gander ACC briefing checklist

HIGH LEVEL DOMESTIC (BRIEFING CHECK LIST)

1. CONFIRM AREA OF RESPONSIBILITY
   • IDENTIFY ADJACENT SECTORS/UNITS
2. CONFIRM EQUIPMENT STATUS
   • FREQUENCIES(SECTOR(S), CD, IFSS, ETC.)
   • HOTLINES
   • RADAR OUTAGES
   • NAVAID OUTAGE
3. CONTROL INFORMATION
   • STRUCTURED AIRSPACE
   • SIGNIFICANT WEATHER
   • ASPRVS
   • TRAFFIC FLOW RESTRICTIONS
4. TRAFFIC INFORMATION
   • POSSIBLE/PROBABLE SEPARATION PROBLEMS
   • DELAYED CLEARANCES (I.E., CLIMB, REROUTE, ETC.)
   • OUTSTANDING ITEMS REQUIRING ACTION

Appendix B – Glossary

ACC

area control centre

ADT

Atlantic daylight time

ATC

air traffic control

CASB

Canadian Aviation Safety Board

DLH

Lufthansa German Airlines

FL

flight level

IM

indicator module

MANOPS

manual of operations

N

north

nm

nautical mile(s)

RA

resolution advisory

RDPS

radar data-processing system

RSiT

radar data-processing system situational display

TCAS

traffic alert and collision-avoidance system

TSB

Transportation Safety Board of Canada