Aviation Investigation Report A03P0244

The Continental Airlines Boeing 757-200, Flight COA422, departed from Seattle-Tacoma International Airport, Washington, at 1617 Pacific daylight time en route to Anchorage, Alaska, with the flight panned at flight level (FL) 310. At the same time, an Asiana Airlines Boeing 747-400, Flight AAR284, was cruising at FL370 from Anchorage to Los Angeles, California.

After COA422 departed Seattle, the Seattle Sector 3 radar controller inadvertently cleared the aircraft to FL370, instead of the flight-planned FL of FL310. Later, the air traffic controllers in the West and Holberg/Nootka Sectors of the Vancouver Area Control Centre did not detect the discrepancies between the FL that had been coordinated with Seattle for COA422 (FL310), the FL entered on the flight progress strip (FL310), and the aircraft's actual FL (FL370). As a result, the required separation standards were not applied in Canadian-controlled airspace, and a loss of separation occurred.

While COA422 was in Canadian-controlled airspace, in the vicinity of the Port Hardy VORTAC (very high frequency omni-directional radio range), the Vancouver controller realized that COA422 was on a reciprocal track and at the same FL as AAR284, and instructed COA422 to turn left. Shortly thereafter, both aircraft responded to a Traffic Alert and Collision Avoidance System Resolution Advisory. These actions resulted in a spacing of 1.5 nautical miles (nm) lateral and 1400 feet vertical. The minimum required separation in this airspace was 5 nm lateral or 1000 feet vertical spacing.

On departure, COA422 was cleared to 15 000 feet. After accepting control of COA422, the Seattle Air Route Traffic Control Center (ARTCC) Sector 3 radar controller inadvertently cleared CAO422 to flight level (FL) 370 rather than FL310. The pilot of COA422 read back FL370 as the cleared FL, but the controller did not detect the incorrect FL. At the time, the Seattle Sector 3 data controller, who was responsible for maintaining the flight data strips, was on the telephone and did not hear the clearance to FL370. The Seattle Sector 3 data controller entered FL310 as the FL on the flight data strip and did not confirm this information with the radar controller. Shortly thereafter, the Seattle radar controller was relieved from the control position for a break. The relieving controller subsequently passed an estimate for COA422 abeam Tofino and the FL of FL310 to the next control agency en route, the Vancouver West (West) sector.

The crew of COA422 did not question the clearance to FL370 instead of the flight-planned FL of FL310. They had determined that FL370 was within the performance envelope for this aircraft, and there was an additional benefit of reduced fuel consumption at the higher altitude.

COA422 was handed-off to the West sector controller, in accordance with established inter-unit Air Traffic Control (ATC) agreements. During the verbal exchange between the Vancouver and Seattle controllers, it was stated the COA422 was climbing to FL310. At hand-over, COA422 was on a Seattle ARTCC transponder code. This provided only a digitized radar target and altitude on the West radar situation (RSit) display. To obtain full data block information, including the aircraft flight number, FL, and speed, the transponder code for COA422 had to be changed to the Vancouver Air Control Centre (ACC) assigned code. Once COA422 was on the new code, a full data block was displayed with the aircraft target.

At 1632:17 Pacific daylight time,^{Footnote 1} COA422 contacted the West controller and reported passing FL310 for FL370 (see Appendix A). The West controller acknowledged with the word "roger" and, in the same transmission, asked the pilot to change the transponder code. No annotation to indicate reported FL was entered on the flight data strip. The West controller did not observe the change in FL as COA422 continued the climb above FL310 and did not notice that COA422 was at FL370 for the 10 minutes prior to the handover to the Holberg/Nootka sector.

COA422 levelled at FL370 at 1637:34, shortly after crossing the airspace boundary between Seattle and Vancouver. The pilot did not report reaching the FL; there is no requirement under United States Federal Aviation Administration regulations for the pilot to do so, unless specifically requested by air traffic control. Canadian procedures published in the Aeronautical Information Publication, Rules of the Air and Air Traffic Services, section 8.3, require that "On initial contact with ATC or when changing from one ATC frequency to another, pilots of IFR [instrument flight rules] and controlled VFR [visual flight rules] flights shall state the assigned cruising altitude and, when applicable, the altitude through which the aircraft is climbing or descending."

The West controller used the range/bearing line function of the RSit to estimate an abeam Port Hardy time for COA422 of 1658 and, at 1642:19, passed this information, along with the FL of FL310, to the Holberg controller. In the same exchange, the Holberg controller provided the West controller an abeam Tofino estimate of 1613 for AAR284 at FL370. The discrepancy in the FL of COA422 between what was displayed on the RSit and what was being coordinated was not detected.

On initial contact with the Holberg controller at 1648:34, the pilot of COA422 reported a FL of FL370. The Holberg controller acknowledged this report with the word "roger," but did not follow his own practice or the published procedure of placing a check mark (✓) beside the FL on the flight data strip for COA422. Canadian controllers are not required to read back the FL reported by the pilot on initial contact.

Just before COA422 contacted the Holberg controller, two landlines had started ringing on his console. After he acknowledged COA422, the controller answered the Port Hardy Flight Service Specialty line and issued a clearance for a departure and then answered the other call from the Oakland oceanic sector.

AAR284 contacted the Holberg controller at 1647:55, reporting a FL of FL370. The Holberg controller placed a check mark (✓) beside the FL on the flight data strip for AAR284, in accordance with his normal practice and published procedures. COA422 and AAR284, approximately 156 nm apart on reciprocal tracks and at the same FL, were now both under the control of the Holberg controller and were displayed on his RSit. The controller did not notice that COA422 was at FL370 and did not detect the conflict with AAR284.

At 1655:37, the Holberg controller identified a departing aircraft four nm northeast of Port Hardy. Shortly thereafter, he noticed that the FL for COA422 displayed on the RSit was FL370 instead of the expected FL310. At 1657:09 the Holberg controller issued instructions for COA422 to turn left 30 degrees. COA422 reported in the turn at 1657:21, after which the Holberg controller asked COA422 to confirm its FL of FL370. The recorded radar data showed that COA422 commenced the turn at 1657:39. COA422 was 13 nm south of Port Hardy and 15 nm from AAR284 at the time the controller first noticed the FL discrepancy.

At 1657:29, due to limitations in radar coverage in that specific area, the radar system lost track of AAR284. This was indicated on the RSit by a change of the aircraft's data tag to a blue colour and the altitude information in the data tag being replaced with the letters CST (coast mode). These changes to the data tag indicated to the controller that the aircraft target was in a coast mode and the aircraft was not being tracked by the radar. The controller was no longer able to establish the exact position of this aircraft in relation to other aircraft in the vicinity. AAR284 was re-acquired by the radar system at 1658, when the two aircraft were passing abeam each other with less than two nm spacing. The required separation was five nm lateral or 1000 feet vertical.

When the pilot of COA422 started the turn, he advised the Holberg controller that he had initiated a climb as a result of a Traffic Alert and Collision Avoidance System (TCAS) Resolution Advisory (RA) warning. At 1657:47, the pilot of AAR284 advised the Holberg controller that he was descending due to a TCAS RA warning. Recorded radar information indicated AAR284 descended to FL358 and COA422 climbed to FL374. The crew of COA422 saw AAR284 after commencing the left turn and determined that the risk of collision was no longer present; however, they followed the TCAS RA. At no time during the conflict did the controller provide traffic information to either aircraft.

The Vancouver West complex (specialty) is composed of four sectors; West, Holberg, Nootka, and Sandspit. At the time of the incident, the Holberg and Nootka sectors were combined and staffed by one controller. The West and Sandspit sectors were each staffed by one controller. The supervisor was working the Sandspit sector. A total of five controllers were available, including the supervisor. Traffic levels were light to moderate in all three sectors, with some complexity in the Holberg/Nootka sector, resulting from unusual aircraft routings in both the east and west segments of the sector.

The Holberg controller had three years experience in air traffic control, all in the Vancouver ACC. He had worked the midnight shift from 2200 on 10 August 2003 until 0630 on 11 August 2003. A supervisor called him at home later that morning, asking him to come back to work for an overtime shift from 1630 that afternoon. The controller had slept about two hours the previous day, prior to commencing the midnight shift, and approximately six hours on the day of the incident. The Holberg controller reportedly did not feel tired prior to coming on shift. Both the ACC shift manager and the West complex supervisor were aware that the Holberg controller was on a short changeover from the previous midnight shift.

Sleep research has shown that a reduced amount of sleep can lead to fatigue, the effects of which can result in a lower level of attention or missed information in a multi-task situation. Human performance literature reports that, in most instances, fatigued individuals are not in a good position to evaluate or monitor their own performance.

The Vancouver West controller had worked in the Vancouver ACC for four years and had eight years of ATC experience in total. He had been working days, but was off for the four days prior to 10 August 2003. He had worked from 1345 on August 10, until 0015 on August 11. On 11 August 2003, he came to work at 1300 and was scheduled to complete the shift at 2130 that night.

In general, a controller's mental model of the traffic situation is based on information received from a variety of sources, including radar, flight progress strips, and verbal information from other controllers or pilots. Once a certain mental model is developed,^{Footnote 2} there is a tendency to accept information that concurs with the model and subconsciously reject information that does not match the model. It sometimes requires extraordinary levels of concentration to apply new information, or some salient or important cue for individuals to change their existing mental models.

Individuals can generally process only a limited amount of information at a time and must, therefore, prioritize incoming information so that it does not exceed the limit of their processing capability. Listening to an incoming verbal message at the same time as thinking about the next control action requires a controller to quickly switch between those tasks. There is, therefore, a risk that some item in either task, such as a specific word or a future step, will be missed.

One of the defence mechanisms to prevent such an occurrence is the NAV CANADA published strip-marking procedures. However, those procedures were not followed completely in this incident and were, therefore, ineffective in renewing the controller's mental model. Previous Transportation Safety Board (TSB) investigations^{Footnote 3} have shown that in a radar environment, flight data strips are used more for record keeping and less to provide direct control of aircraft. The flight data strips assist controllers in determining if there are any conflicts in the medium to long term. This defence relies primarily on a controller's ability to accurately perceive all of the incoming information and accurately cross-check that information with other available resources, such as other active flight data strips and information available on the RSit.

Although the RSit display of the altitude of COA422 did not match the controller's mental model, it was insufficient to draw his attention to the discrepancy. The task of scanning an area in order to discern details (i.e. random scanning) in that area is a difficult task, because people generally are not efficient random scanners.^{Footnote 4}

The Vancouver ACC Radar Data Processing System did not provide any type of conformance monitoring or conflict detection for aircraft under the control of Vancouver ACC. Conformance monitoring would have alerted the controller that COA422 was climbing above the flight-planned FL, or one that had been assigned or coordinated by the controller. A conflict alert system would have provided advance warning that COA422 and AAR284 had less than the required separation, and that immediate action by the controller was necessary to resolve the conflict. Conflict alert became operational in Vancouver ACC controlled airspace above 19 500 feet in December 2003.

The following factors can be shown to have contributed to a risk of collision between the two aircraft:

• the mental model of the controllers was based on erroneous information regarding the cleared FL of COA422;
• the lack of a detailed review by the controllers of the aircraft data presented on the RSit and the flight data strips, to enable them to update their mental model;
• the FL information received from the aircrew was not confirmed by a readback, nor is there a requirement to do so;
• the Radar Data Processing System is not able to automatically cross-check, independent of a controller's action, an aircraft's flight planned track and altitude/FL with the actual route of the flight and altitude/FL ;
• the lack of a ground-based collision avoidance system at Vancouver ACC at that time; and
• the scheduling of a short changeover from a midnight to an afternoon shift for one of the controllers, which may have set up a condition of fatigue.

The realization by the Holberg controller that there was a conflict and the issuing of the turn was sufficient to prevent a mid-air collision; however, it was too late to prevent the loss of separation or prevent the TCAS from generating RAs in both aircraft cockpits.

The initial action by the Seattle ARTCC Sector 3 radar controller (i.e. inadvertently issuing the clearance to FL370) was not detected during the readback from the pilot of COA422. The most plausible reason for this was that the Seattle radar controller was expecting to hear FL370, and there was no other salient cue present to lead him to conclude that the FL issued and read back was the incorrect one.

Based on the data passed from controller to controller and the flight data strip, however, all parts of the air management system - the Seattle ARTCC Sector 3 data controller, as well as the Vancouver ACC controllers - was operating under the assumption that COA422 was climbing to FL310, and was providing separation for that flight up to and including that FL. The Seattle ARTCC and Vancouver ACC controllers' mental models did not match the reality of the situation, which lead to the risk of collision between COA422 and AAR284.

The error defence provided by the NAV CANADA strip-marking procedures was bypassed when the Vancouver controllers did not annotate the altitude boxes to indicate that the altitude provided by the pilot matched that on the flight data strip. Inadequate information processing and cross-checking led to a lack of situational awareness and an inaccurate mental model among Vancouver ACC controllers.

The random scanning task is challenging for most people and is rarely carried out effectively. A conscious, self-enforced practice to carry out a detailed check of all displayed elements of a data block on initial contact with an aircraft is designed to lead to the confirmation of accurate data and the detection of potential conflicts. An automated comparison between the aircraft's actual FL and flight plan data or electronic flight data strip information may have alerted the controller to the developing conflict and prevented this incident.

The hand-off and the initial radio contact by an aircraft are critical times when controllers are expected to review and verify important information in detail. Passive acknowledgement of new information - the single word "roger," for instance - rather than a deliberate and active review of each element of the information, may not provide the important cues to assist the controller in detecting potential discrepancies. Once a controller's mental model is firmly established, it resists being modified, even if subsequent data conflicts with the mental model. As a result, the ability of controllers to accurately forecast the future position and status of aircraft under their control is reduced.

There are a number of situations in which a readback of information is not required by regulations or procedures, and a simple acknowledgement that information was heard is considered sufficient (often with the word "roger"). Had the FL information been heard and processed by the controllers, they may have been cued to the discrepancy between the FL stated by the pilot and that contained in the controller's mental model of the situation, and taken appropriate action. In this incident, the pilot of COA422 stated that the flight was climbing to, or level at, FL370 in three separate radio transmissions. By reading back the FL to the pilot, the controller may have detected the discrepancy.

The pilot of COA422 did not advise the West controller on reaching the cleared FL of FL370. Although not a requirement under U.S. regulations, Canadian published procedures do require pilots to make such a report. This omission eliminated an opportunity for the West controller to realize that the aircraft was at a different FL than what he expected.

There was no automated conflict probe, conflict detection, or conformance-monitoring capability functional in Vancouver ACC. This type of technological support would have warned that COA422 had climbed above the flight-planned FL of FL310. Similarly, without the short-term conflict alerting system, it was the combination of a last-minute turn and a TCAS alert that prevented a possible mid-air collision. Conflict alert is in operation in several area control centres in Canada, including Vancouver.

The distraction resulting from competing air traffic priorities at the time of initial contact by COA422 with both the West and Holberg controllers may have disrupted their normal practice of comparing the FL written on the strip with the FL stated by the pilot. In both the Holberg/Nootka and the West sectors, each controller was working alone and was responsible for all activities associated with the radar and data positions. This required them to divide their attention among several tasks and elevated the risk that some information may have been missed or its importance minimized. In this incident, all references by COA422 to FL370 were missed, as was the display of FL370 on the data tag.

The Holberg controller had worked a previous midnight shift and had six hours sleep before starting his next shift. The controller's sleep-wake pattern likely increased his level of fatigue and elevated the risk of task-performance decrements. His performance during this incident raised the possibility that he was operating with a sleep debt.

Findings as to causes and contributing factors

1. The Seattle ARTCC controller inadvertently cleared COA422 to FL370 rather than FL310, and none of the involved controllers - Seattle, West or Holberg - detected that the aircraft was flying at FL370 and not FL310, despite many clues. The result was that ATC was not providing separation for COA422 between FL310 and FL370, resulting in a loss of separation and risk of collision.

Findings as to risk

1. A single controller was working a combined data and radar position in the Sandspit, West and Holberg/Nootka sectors, which was a normal practice for the level of traffic experienced at the time of the incident. However, this placed an increased demand on the controller to properly prioritize his actions and ensure that the required level of attention was focussed on the immediate task. In short, it increased the risk that information would be missed.
2. The distraction resulting from competing air traffic priorities, such as changing the transponder code immediately after the initial communication from COA422, may have disrupted the West controller's normal practice of comparing the FL written on the strip with the altitude information provided by the pilot.
3. The Holberg controller was working a shift after the minimum 10 hours off, after having completed a midnight shift. The controller may have been working with a sleep debt, with a resulting reduction in his alertness level.

Other findings

1. Canadian published procedures require a pilot to report when he/she is reaching the FL to which the flight has been initially cleared. There is no equivalent requirement in U.S. regulations for pilots to do so. COA422 did not report reaching FL370, and this eliminated an opportunity for the Vancouver West controller to detect that COA422 was at a different FL than what was expected.
2. There was no automated conflict detection or conformance monitoring system operational in Vancouver ACC at that time. Either one of these technological supports may have alerted the controller that COA422 had climbed above the flight-planned FL, or provided a warning of the conflict with AAR284.

Safety action taken

NAV CANADA's conflict alert function is now operational in Vancouver ACC controlled airspace above 14 000 feet. Additionally, other functions such as an airspace warning feature and special-use airspace incursion detection equipment are being progressively developed, tested, and deployed.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 07 September 2004.

Appendix A - Sequence of Events

Image