Revisiting The Brazilian Midair

On September 29, 2006, a Boeing 737-800 operated by Gol Airlines and a brand-new Embraer Legacy 600 business jet flown by Long Island, N.Y.-based charter operator Excelaire on its initial ferry flight to the U.S., collided 37,000 feet above Brazils Amazon jungle. All 148 passengers and six crewmembers aboard the Boeing, engaged in a scheduled flight from Manaus to Rio de Janeiro, were fatally injured. The Legacy, with two crew and five passengers aboard, had departed Sao Jose

dos Campos for Manaus. It was substantially damaged in the collision but made a successful emergency landing at a nearby military base.

In our January 2007 issue, we took a close look at the events leading up to this tragedy, including loss of communication between ATC and the Legacy, its transponder-and TCAS equipment-being inoperative for a crucial portion of the flight, ATCs failure to recognize its flight path and altitude conflicted with the Boeing, and what we labeled the “Lost-comms Fallacy”: How does a crew on an IFR flight plan know to implement lost-communications procedures if they dont know comms have been lost? Recently, Brazilian authorities completed a report on their investigation, including release of cockpit voice recordings from both aircraft. Additionally, the NTSB, which Brazil invited to participate in the investigation, submitted its comments. With additional information available, its time to revisit this midair collision and the lessons it can teach.

As we noted in our January 2007 article, “Because it involved two very modern jets operating under IFR and equipped with the latest in collision avoidance equipment, and because it occurred in controlled airspace, this is an accident that simply should not have happened.” We could have added to that statement information regarding Brazils modern ATC system, along with a discussion of the hyper-accurate altimetry and navigation systems required in RVSM (reduced vertical separation minima) airspace implemented throughout the world between 1997 and 2005. In fact, its arguable the accident happened because of RVSM and the accuracy it demands.

Think about it: In years past something called the “Big Sky Theory” applied to so much of the altimetry and navigation standards. That theory held that, even if ATC screwed up and violated separation standards or-as in this case-put two oncoming aircraft at the same altitude-the inevitable variables in tracking a VOR radial or selecting barometric pressure in a Kollsman window provided a margin of error against midair collisions.

Instead, this midair collision occurred in spite of all the “slack” built into the system. As the computer-generated image on the facing page demonstrates, the two aircraft were pretty much at the same altitude and displaced only 60 or so feet laterally. In the scheme of things, those are “noise-level” errors, the values of which dont really matter. In years past, with less-accurate systems, you couldnt have put these two aircraft that close together if you tried.

The other automation-related event helping ensure this tragedy involves the way Brazils ATC system computer inserts a flights “cleared” altitude into the datablock displayed on controllers screens. In the event, they were presented with ambiguous data showing what the NTSB described as both the Embraers requested and cleared altitude. As the NSTB summarized it, “a design in which two distinctly different pieces of information…appear identical on the display is clearly a latent error.” Brazilian authorities defended this data presentation by noting, “controllers have always operated the system in this manner,” according to the NTSB.

The NTSB went on to note the original clearance received by the Embraer crew cleared them to maintain FL370. Upon reaching the Brasilia VOR (BRS), the flight turned northwest to follow airway UZ6. As the NTSB drily put it, “The automatic change to the cleared altitude field did not accurately reflect the status of [the Embraers] clearance.” See below for an excerpt of the relevant FAA/NACO en route chart.

Were not for a moment suggesting automation is bad. But-just like nuclear power can be used for good things and bad-automation also must be tamed, controlled and monitored. Evidence from this tragedy suggests we have a distance to travel still before we achieve that objective regularly.

In addition to the display of the cleared altitude as part of the Embraers datablock, the flights initial clearance must be scrutinized. According to Brazilian authorities, the initial clearance given the Embraer read as follows:

Brazilian authorities state this clearance was not correctly transmitted to the crew. As one result, the crew erroneously believed the flight was cleared to maintain FL370 all the way to its destination. Further, Brazilian authorities maintain the clearance transmitted information differing from the filed flight plan. Significantly, at no point did Brazilian ATC amend the Embraers cruising altitude.

Brazilian authorities also maintain the clearance did not contain a clearance limit. However, the NTSB differs with this conclusion, stating, “We believe that the ground controllers statement clearance to Eduardo Gomes could not realistically be interpreted as anything other than the clearance limit item of the clearance.” Indeed, any U.S.-domestic crew receiving this clearance would understand a) their flight was cleared to its destination and, b) FL370 would be its cruising altitude. Any altitude restrictions or changes differing from those in the clearance-including those found in the Oren departure procedure-would be communicated by ATC once the flight became airborne.

The Brazilian report also took the Embraer crew to task for failing to change altitude at BRS-without an enabling clearance-in what it felt was compliance with the hemispheric altitude rule.

Again, the NTSB differed, noting, “The crew flew the route precisely as cleared and complied with all ATC instructions. The crews awareness of their current altitude and its relation to the hemispheric convention applicable to the course of flight north of Brasilia is entirely independent of the requested level in the flight plan.”

Later in its response, the Board added, “Hemispherical altitudes such as those shown on the index of an IFR chart or in the Aeronautical Information Manual, although used as conventions by ATC, are only a requirement when operating in uncontrolled airspace. The implication that a crew should somehow observe hemispherical altitudes while being positively controlled by an ATC facility is incorrect.”

Shortly after the Embraer crossed BRS and turned northwest, its transponder stopped responding to ATC interrogations. A primary radar target (not augmented by the on-board transponder) continued to display the airplanes position and, for a time, a military height-finding radars data was added to the display, correctly noting the Embraers presence at FL370. As the business jet flew further away from BRS, however, that radar failed to accurately track the flight and-in a tragic coincidence-indicated a descent to FL360 before failing to track the target altogether. As previously mentioned, the ATC radars displayed what the Brazilian system presumed was the “cleared” altitude associated with the Embraer, not its actual altitude.

Why the transponder stopped transmitting is not known. No professional flight crew would intentionally disable that system in high-altitude airspace. Both the Brazilian report and the NTSBs response spend time considering placement of footrest guards mounted beside on either side of the Embraers center console. According to the NTSB, the “guard is designed to prevent unintended interactions with the buttons of the RMU1 [radio management unit 1] and other flight deck controls.”

The best theory going is one of the Embraers crew used what the NTSB labeled “a very comfortable resting position” involving “resting the feet on top of the footrest guards rather than inside” them. If the left-seat occupant placed his foot as described, it could make unintended contact with RMU1 without his knowledge.

Finally, as the NTSB put it, “N600XL proceeded for an inordinately long time without two-way communication.” As we discussed in our January 2007 article and as the NTSB more succinctly summarizes, “The challenge for the N600XL crew was that they continued to hear transmissions from ATC and other airplanes, which was misleading for them.”

As with most any aviation accident, major or minor, many things had to happen in sequence before this tragedy occurred. Investigators generally refer to the chain of events leading to an accident; break virtually any link in the chain and the accident is prevented. This accident, sadly, lives up to that clich. There were ample opportunities for many parties involved in this accident to break the chain of events leading to tragedy.

The only participants not in a position to break the chain were the Boeings crew and passengers.