TABLE OF CONTENTS 1. EXCELAIRE: THE COMPANY, ITS

TABLE OF CONTENTS
1. EXCELAIRE: THE COMPANY, ITS PEOPLE AND THE PILOTS
1.1. ExcelAire Service, Inc.
1.2. ExcelAire Management and Operations
1.3. ExcelAire’s Inspection by FAA
1.4. ExcelAire’s International Experience
1.5. The Pilots Joseph Lepore and Jan Paladino
2. FACTUAL ANALYSIS
2.1. Introduction
2.2. Air Traffic Control’s Functions
2.3. Verifying flight planning and the aircraft’s suitability prior to the
take-off
2.4. The Provision of Air Traffic Control Services to the Legacy After
Departure From SBSJ and During the Initial Climb
2.5. Control’s clearances for climbing to cruise level 370 until Eduardo
Gomes Airport is reached
2.6. ATC Failures That Caused the Accident
2.6.1. ATC Was Negligent for Not Checking the Inconsistency Between
the Altitude Displayed in the Control System and the Altitude at Which
the Aircraft Was Flying
2.6.2. ATC Was Negligent for Not Contacting the Legacy to Determine
Altitude Change to 360 or, alternatively, Alter the Electronic Strip and
Indicate that the Legacy Was Flying at 370, as Previously Cleared
2.6.3. ATC Was Negligent for Not Adopting the Procedural Rules for
Cases of Transponder Malfunction After Identifying such Malfunction
on the Control Center’s Radar
2.6.4. ATC Was Negligent for Not Assuring the Reduced Vertical
Separation Minimum of 2,000 Feet between the Legacy and the Aircraft
that Operated Gol Flight 1907, Even After the Legacy’s Total Failure in
the Primary and Secondary Radars
2.6.5. Errors of Brasilia and Amazonica Control Centers during the
Coordination for the Transference of the Legacy
2.7. The Chain of Errors of the Air Control is the Direct Cause of the
Accident
3. CENIPA AND NTSB SAFETY RECOMMENDATIONS
4. FREQUENTLY ASKED QUESTIONS
4.1. Questions about the accident
4.2. Questions about the dialogues recorded in the Legacy’s cockpit
5. THE EMBRAER LEGACY 600 135BJ
6. PRODUCTION AND PRE-DELIVERY PROBLEMS WITH N600XL and
EMBRAER’S POST-ACCIDENT CONDUCT
6.1. Production problems with N600XL
6.2. Discrepancies noted during delivery
6.3. The Inspection performed on the aircraft by Embraer right after the
accident
7. AVIONICS EXAMINATION AND DETECTED FAILURES
8. FAA SERVICE DIFFICULTY REPORTS
9. CRIMINALIZING AVIATION ACCIDENTS
10. FINAL CONSIDERATIONS
EXHIBITS
EXHIBIT 1: Joseph Lepore’s Training Record
EXHIBIT 2: Jan Paladino’s Training Record
EXHIBIT 3: Timeline of N600XL’s Flight
EXHIBIT 4: IFALPA’s and APLA’s Safety Bulletins
EXHIBIT 5: CENIPA’s Safety Recommendation
EXHIBIT 6: NTSB’s Safety Recommendation
EXHIBIT 7: Article Published in the Newspaper Folha de S. Paulo
EXHIBIT 8: Joint Resolution Regarding Criminalization of Aviation Accidents
1. EXCELAIRE: THE COMPANY, ITS PEOPLE AND THE PILOTS
1.1. ExcelAire Service, Inc.
ExcelAire is an FAA Certified Air Carrier operating under Federal Aviation
Regulations Part 91 and Part 135 and a federally approved repair station
operating under FAR Part 145.
ExcelAire provides on-demand air charter operations throughout the
world.
ExcelAire manages a fleet of more than 20 private aircraft for the aircraft
owners, including a Global Express – an intercontinental aircraft capable of
flying more than twelve hours nonstop, as well as the New York metropolitan
area’s largest locally-based fleet of 2 Gulfstream jets including GIIs, IIIs, IVs and
the ultra long range GV. The company also operates Hawkers and Lear jets.
Due to the capabilities and range of the aircraft in its fleet, ExcelAire has
a history of international flying. International destinations in just the past year
have included numerous cities throughout South America, Central America, the
Caribbean, Europe, the Middle East, Asia and Africa. ExcelAire aircraft and its
pilots fly regularly into some of the most challenging airports
in the U.S. and the world.
With its roots in aircraft maintenance, ExcelAire’s operating philosophy
has always put safety first, with the industry’s highest standards in
maintenance, pilot experience and recurrent training for its entire staff. Pilot
training standards far exceed those required by FAA regulation.
All ExcelAire pilots attend simulator training twice yearly and all are typerated in the aircraft they fly. This represents a significant investment of time and
money, but the company has always put a high priority on such high standards.
As evidence of this commitment to safety, several years ago ExcelAire
established the position of Flight Safety Officer/Director of Standards for the
company, a position not required by the minimum Part 135 standards. His
duties
include
flight
and
line
checks,
identifying
safety
deficiencies,
disseminating safety information to the air crews and being a conduit for any
anonymous safety-related complaints from the air crews. The Flight Safety
Committee, composed of the Director of Operations, the Flight Safety
Officer/Director of Standards, the Chief Pilot and a maintenance representative
meet monthly to discuss safety issues.
ExcelAire maintenance personnel are all licensed and tested by the FAA.
They perform heavy maintenance on the ExcelAire fleet that few charter
companies are able to perform inhouse. ExcelAire maintenance staff also
receives recurrent training on a regular basis.
ExcelAire is a corporation organized and existing under the laws of the
State of New York, with its principal place of business at Long Island MacArthur
Airport, 200 Hering Drive, Ronkonkoma, New York 11779.
1.2. ExcelAire Management and Operations
ExcelAire currently employs approximately 110 people, of which 50 are
pilots, 40 are professional maintenance personnel and the remaining staff are
administrative and operational. ExcelAire’s senior management team includes
highly experienced personnel with many years of expertise in maintenance,
operations and flying throughout the world.
Bob Sherry
President/Chief Executive Officer
Like the company he founded, Bob Sherry’s aviation roots are in
maintenance. A licensed pilot, Mr. Sherry began his career in the 1970s as a
mechanic on light airplanes. Known for his ability and integrity, a few years later
he became service manager for Flightways of Long Island overseeing a large
staff of technicians. By 1985 Mr. Sherry’s entrepreneurial spirit led to the
founding of Eastway Aircraft Services, specializing in light aircraft maintenance
in its own 1,000 square foot hangar at Long Island MacArthur Airport. Eastway
added structural repair, and began maintaining larger aircraft and the first of
many corporate jets. . As the private jet industry grew in the United States,
Eastway grew with it, leading to Mr. Sherry’s establishment of ExcelAire,
specializing in business jet charter, maintenance, management and sales.
Today ExcelAire and Eastway focus exclusively on providing services to private
jet owners.
Greg Brinkman
Chief Operating Officer
Since earning his pilot’s license in the late 1970s, Greg Brinkman has
been involved in all facets of business aviation, with experience as a corporate
pilot, aircraft owner, entrepreneur and, now, as Chief Operating Officer of
ExcelAire.
Mr. Brinkman has flown helicopters and jets professionally for more than
two decades with expertise in helicopters, corporate jets and international
operations. In 1989, Mr. Brinkman launched Associated Aircraft Group (AAG)
which soon became the largest operator of Sikorsky S 76 helicopters on the
East Coast. United Technologies acquired AAG in 1998. With an in-depth
knowledge of both piloting and business operations, Mr. Brinkman is intimately
involved in the hiring of ExcelAire pilots and holding them to very high
standards.
George Kyriacou
Director of Operations
Overseeing Operations, Maintenance and the Chief Pilot, George
Kyriacou brings a wealth of aviation experience to ExcelAire. A native of
Cyprus, he began flying at the age of 11 as part of the British Royal Air Force’s
“Royal Cadet Program.” Mr. Kyriacou emigrated in the late 1970s to the United
States where he earned his Bachelor and MBA degrees. Before joining
ExcelAire in 1996, Mr. Kyriacou was a pilot and supervised operations and/or
maintenance for several aviation firms in the Northeast. At ExcelAire, Mr.
Kyriacou’s mission is to ensure that the company adheres to FAA regulations as
well as the company’s own stringent standards. He has his Airline Transport
Pilot (ATP) license as well as his Airframe and Powerplant (A&P) with
Inspection Authorization.
Ralph Michielli
Vice President of Maintenance, Director of Maintenance
Ralph Michielli brings almost three decades of expertise and experience
in business jet maintenance to ExcelAire. An FAA licensed Airframe and
Powerplant Technician specializing in jet aircraft, Mr. Michelli holds two key
positions, Vice President of Maintenance and Director of Maintenance.
Beginning in the aviation industry in 1974, Mr. Michielli founded and led two
companies: Seaboard Tank Corporation, a fuel system repair and modification
company and Structural Testing Systems, which performs non-destructive
testing of aircraft. As one of the company’s first employees, Mr. Michielli in 1993
assisted in the launch of ExcelAire Service and now oversees all maintenance
operations as well as serving as a technical liaison between ExcelAire and their
aircraft owners.
1.3. ExcelAire’s Inspection by FAA
ExcelAire is certified as an Air Carrier pursuant to Part 135 of the Federal
Aviation Regulations, 14 C.F.R. § 135 et seq. As a Part 135 operation,
ExcelAire is required to comply with rigorous requirements concerning its
management, operations, maintenance, pilot training and qualifications.
ExcelAire’s operations are overseen on a regular basis by a team of FAA
inspectors. ExcelAire’s Principal Operations Inspector (“POI”) at the FAA is Mr.
Mark Rogers. Mr. Rogers conducts facility operations inspections of ExcelAire
at least two or three times per year, with additional on-site visits to meet with the
Director of Operations, George Kyriacou. This brings Mr. Rogers to ExcelAire’s
facility at least two or three times each month.
ExcelAire also has an FAA Principal Maintenance Inspector (“PMI”), Mr.
Burton Connor, and Principal Avionics Inspector (“PAI”), Mr. William Corr,
assigned to its operation. Mr. Connor and Mr. Corr are at ExcelAire’s facility on
a near-weekly basis. ExcelAire maintains an “open-door” policy and a good
working relationship with the FAA. Mr. Rogers considers ExcelAire to be a “top
notch” company with low pilot and management turnover, good screening of
pilots prior to employment, sound financial condition, and training consistent
with part 135 standards.
1.4. ExcelAire’s International Experience
During the year immediately preceding the accident, ExcelAire flew to 46
different countries around the world. These countries include: Aruba, Australia,
Botswana, Brazil, China, Costa Rica, Croatia, Mexico, Portugal, Russia, South
Africa, Turkey, and the United Arab Emirates, among many others. Please see
the attached table of international destinations visited by ExcelAire from
September, 2005 to September, 2006. Our operations personnel and pilots are
trained and experienced in international air travel. It is a routine part of
ExcelAire’s business.
ExcelAire International Destinations
September, 2005 to September, 2006
1.5. The Pilots Joseph Lepore and Jan Paladino
Joseph Lepore
Capitain
Joseph Lepore was born on June 27, 1964. He is a resident of Bayshore,
New York, where he has lived since 1976. Joe was born in Italy and his family
emigrated to the United States when he was a youth. Joe is married with two
children.
Joe received a Bachelor of Science degree in 1987 from the Florida
Institute of Technology where he majored in Aviation Management. He started
flying in 1982. Joe holds FAA certificates as an airline transport pilot, certified
flight instructor, airplane single and multi-engine instrument airplane ratings. He
has type ratings in the G1159, CE500 and Embraer 145 aircraft. Joe currently
has approximately 9,375 total flight hours. He holds a first class medical
certificate with no limitations.
Prior to working at ExcelAire, Joe was a chief pilot for the American
Tissue Corporation flying the Citation. Prior to that he was a Check Airman and
Captain for Eastway Aviation flying the Citation C550. Joe served as first officer
on the BAe Jetstream 41 for Trans State Airlines, a Part 121 carrier. The
Jetstream that Joe flew at Trans State Airlines had an RMU that was similar to
the one used on the Legacy. Prior to Trans State Airlines, Joe was a pilot for
Business Express Airlines in Portsmouth, New Hampshire. Joe’s pilot certificate
has never been suspended or revoked by the FAA and he has never been cited
for any violation of the Federal Aviation Regulations.
On October 20, 2001 Joe was hired by ExcelAire Service, Inc. At
ExcelAire he has flown the Citation II, Gulfstream II and Gulfstream III aircraft.
In January of 2006, Joe was promoted from first officer to captain on the
Gulfstream. Joe was personally selected to lead the Embraer Legacy program
for ExcelAire.
From August 9, 2006 to August 30, 2006, Joe trained at FlightSafety
International in Houston, Texas to obtain his initial type rating on the EMB-145,
which included the Legacy (EXHIBIT 1).
The training at FlightSafety was provided at no charge to ExcelAire by
Embraer as part of the purchase agreement for the aircraft. FlightSafety is the
world’s largest provider of aviation services, training over 65,000 pilots annually.
The FlightSafety training was comprised of 76 hours of ground training and 26
hours of flight training including 14 hours in the simulator as pilot in command
and 12.5 hours as second in command. As noted in the attached report from
FlightSafety International, Joe demonstrated proficiency in all aspects of his
flight training on the Embraer.
Following their training at FlightSafety, Joe and Jan were given an
opportunity to fly a Legacy with Embraer pilots, before traveling to Brazil to pick
up the new aircraft. Joe and Jan each flew a leg in a Legacy during a round trip
flight between Fort Lauderdale-Hollywood International Airport (FLL) in Florida
and the Charles B. Wheeler Downtown Airport (MKC), in Kansas City, Missouri.
They spent all day with the Embraer pilots. The airplane flew like the
FlightSafety simulator they had trained on, and there were no surprises during
the flights.
After arriving at the Embraer factory in Sao Jose dos Campos, Brazil, Joe
and Jan flew the new aircraft, N600XL, on three separate acceptance flights for
ExcelAire, taking turns in the left seat. These flights were conducted in a
practice area and included a full stall series, a 60 degree bank, a visual
approach to land, and a go-around that allowed two approaches, among other
things. These acceptance flights were again conducted with Embraer factory
pilots on board and totaled approximately four (4) hours. While at the factory,
Joe and Jan also received training from Embraer engineers on software to
calculate performance data such as weight and balance calculations. Embraer
loaded this software into Joe’s laptop computer. They modeled their software
tests using Manuas and the actual weather data for the day of training. Joe and
Jan spent all day every day at the Embraer factory.
Jan Paul Paladino
Second in Command
Jan Paul Paladino was born on April 8, 1972. He is a native of Long
Island, New York. Jan’s father is from Argentina and his mother is Spanish. Jan
speaks Spanish, but not fluently.
He does not speak Portuguese. He is married with no children.
Jan is a graduate of the Embry-Riddle Aeronautical University where he
received his Bachelor of Science degree in Aeronautical Science with a minor in
Aviation Safety.
Jan has a total of approximately 6,400 flight hours including 300 hours as
pilot in command of the Embraer 145 type aircraft. Jan also has 1,405 hours as
an instructor pilot conducting primary, advanced, instrument, single and multiengine instruction.
Jan holds FAA certificates and ratings as an airline transport pilot,
airplane multi-engine and has a flight engineer certificate for the Boeing 727
and type ratings in the BAE 3100 and Embraer 145 aircraft. He holds an FAA
first class medical certificate with no limitations. Jan has never been involved in
any aircraft accidents or major incidents. His pilot certificate has never been
suspended or revoked by the FAA and he has never been cited for any violation
of the Federal Aviation Regulations.
Jan was hired by ExcelAire Service, Inc. on July 25, 2006. Prior to joining
ExcelAire, Jan served as a captain on the Embraer 145 for American Eagle
Airlines, flying scheduled passenger transport operations throughout the United
States and Canada. Prior to his time at American Eagle Airlines, Jan spent 4 ½
years with American Airlines as a first officer on the MD-80 series aircraft flying
throughout the United States and Canada. He was also a flight engineer on the
Boeing 727 based in Miami, flying international routes in Central and South
America and the Caribbean. Prior to joining American Airlines, Jan was a
captain and check airman for Atlantic Coast Airline flying the Jetstream 3100 in
scheduled passenger transport operations throughout the Mid-Atlantic and
Northeast regions of the United States.
From August 9, 2006 to August 30, 2006, Jan trained on the EMB-145 at
FlightSafety International in Houston, Texas. Although Jan already held a type
rating for the EMB-145, ExcelAire requested that he go through the training a
second time since he would be one of the Captains for ExcelAire’s new Legacy
program. The FlightSafety training included 76 hours of ground training and 26
hours of flight training including 12.5 hours in the simulator as pilot in command
and 14 hours as second in command. Jan demonstrated proficiency in all
aspects of his flight training on the Embraer (EXHIBIT 2).
2. FACTUAL ANALYSIS
2.1. Introduction
On September 29, 2006, at approximately 4:47 p.m. local time, a Boeing
737-800 SFP operated by Gol Linhas Aereas Inteligentes collided with an
Embraer Legacy 600 business jet in controlled airspace over the Amazon
region of Brazil as both aircraft proceeded in opposite directions on airway UZ6
at the same assigned altitude, 37,000 feet. All 154 persons aboard the Gol
B737 perished in the accident, which was the worst aviation disaster in Brazil’s
history (EXHIBIT 3).
One of the primary objectives of the air traffic control system in Brazil and
throughout the world is to prevent collisions. This section demonstrates, by
providing a chronological analysis of the events on September 29, 2006, that
there was a singular cause of this mid-air collision: the failure of Brazil’s air
traffic control system to follow its own rules and regulations, as well as
applicable international norms and standards, to ensure that the Gol B737 and
the Legacy were properly separated.
2.2. Air Traffic Control’s Functions
Just as its name suggests, the purpose of the air traffic control (“ATC”)
system is to ensure that aircraft in the sky, as well as those on the ground, are
separated from each other. Proper separation prevents collisions.
The vast majority of flight operations that involve transport category
aircraft, such as airliners and business jets, are conducted under instrument
flight rules (“IFR”). Instrument flight rules permit the pilot (or pilots) of an
appropriately equipped aircraft to navigate and operate the aircraft almost
exclusively with reference to the flight instruments. Aircraft that operate under
IFR in controlled airspace must adhere to clearances issued by ATC. A
clearance is an authorization and/or instruction for an aircraft to proceed under
conditions specified by ATC. An air traffic controller, through the use of
clearances, controls and coordinates the horizontal and vertical progress of a
flight from departure to destination. For example, a request from ATC to an
aircraft to climb to a specified altitude is a clearance because it not only
instructs the pilots of the aircraft to accomplish a particular task, but also limits
the upward movement of the aircraft. Compliance with an ATC clearance is
mandatory, unless there is an emergency or until ATC issues a subsequent
authorization or instruction that alters or amends the prior clearance.
To separate aircraft, an air traffic controller needs to “see” the air traffic in
the particular sector of airspace under his or her control. This is accomplished
through the use of a large computerized display, also referred to as a radar
scope, that provides a “bird’s eye” (or overhead) view of the airplanes flying in
the airspace over which the controller has responsibility. (See FIGURE 1).
Quite simply, ATC is the “traffic cop” of the airways. Just a police officer
coordinates the movement of traffic at an intersection or along a roadway, ATC
controls the movement of aircraft in the sky (and on the ground) to prevent
traffic conflicts or collisions.
To summarize, ATC is required to control and coordinate the movement
of air traffic to ensure that aircraft are properly separated and that no two
aircraft pose a threat of collision to one another.
2.3. Verifying flight planning and the aircraft’s suitability prior to the takeoff
The mid-air collision that occurred over the Amazon region of Brazil on
September 29, 2006 involved a newly manufactured Embraer Legacy 600
business jet (EMB-135BJ), bearing registration N600XL, and a Gol Boeing 737800 SFP that was delivered new from Boeing’s factory to Gol earlier that month.
The Legacy was proceeding on an IFR flight from Professor Urbano Ernesto
Stumpf Airport, Sao Jose Dos Campos (SBSJ) to Eduardo Gomes International
Airport (SBEG) in Manaus.2 SBSJ and SBEG are the International Civil Aviation
Organization (“ICAO”) airport identifiers for these two airports. The Gol B737
was operating as Flight 1907 on an intra-Brazil flight from SBEG to the
Presidente Juscelino Kubitschek Airport in Brasilia.
On September 28, 2006, ExcelAire Service, Inc. accepted delivery of
Legacy 600XL from Embraer at the Embraer factory located at SBSJ. On the
day of departure, September 29, 2006, Embraer electronically transmitted a
flight plan for N600XL to depart SBSJ and proceed under instrument flight rules
to Manaus. The flight plan was prepared by Universal Weather and Aviation,
Inc. (“Universal”). A flight plan is the mechanism for relaying information about a
proposed IFR flight to air traffic control (“ATC”). At a minimum, the flight plan
informs ATC of the departure and destination points, proposed route of flight,
planned cruising altitude(s), and estimated time enroute. In Brazil and
elsewhere, to operate an aircraft in controlled airspace under IFR, a pilot, flight
dispatcher, or other authorized personnel must file an IFR flight plan with the
local air traffic service unit.
A properly completed IFR flight plan provides ATC with information from
which ATC can develop an IFR clearance that it will issue to the pilots prior to
the aircraft’s departure. In ICAO’s PROCEDURES FOR AIR NAVIGATION
SERVICES, RULES OF THE AIR AND AIR TRAFFIC SERVICES, a “Flight
Plan” is defined as “specified information provided to air traffic services units,
relative to an intended flight or a portion of a flight for an aircraft.” In short, the
filed flight plan is a request for a clearance to operate under IFR in controlled
airspace, but a flight plan does not independently authorize such operation. An
ATC clearance is required before an aircraft can operate under IFR in controlled
airspace. Under all circumstances, though, an ATC clearance overrides and
supersedes the information contained in the filed flight plan.
ExcelAire pilots Captain Joseph Lepore and First Officer Jan Paladino
conducted a preflight inspection of the Legacy’s exterior, interior, and flight deck
prior to departure from Sao Jose dos Campos. Lepore and Paladino verified all
systems operated normally, and Paladino requested an IFR departure
clearance from the ATC facility at SBSJ. The IFR departure clearance informs
the crew not only of the clearance limit, which is the point to which air traffic
control will permit the aircraft to proceed in the airspace system, but should also
include the route and altitude assignments. The route and altitude portions of
the IFR clearance restrict the aircraft’s horizontal and vertical movements in
controlled airspace, respectively.
On September 29, 2006, the clearance that the crew of N600XL received
from the SBSJ ATC facility authorized the aircraft to traverse Brazilian airspace
to its destination, Manaus (the clearance limit), climb to an altitude of Flight
Level 370, and proceed direct to the POCOS nondirectional beacon. As the
Legacy was taxiing to the runway for departure, the SBSJ tower controller
amended the clearance to Flight Level 370 and restricted the aircraft on
departure to climb to 8,000 feet.
At approximately 2:51 p.m. local time, the SBSJ tower controller cleared
the Legacy for takeoff from Runway 15, a runway oriented to the southeast, with
a climbing right turn to 8,000 feet after departure. This clearance was
acknowledged and read back by the crew, and the Legacy was airborne shortly
thereafter with a total of seven souls aboard: two crewmembers and five
passengers, who consisted of two Embraer employees, two ExcelAire
employees, and a journalist from the United States.
2.4. The Provision of Air Traffic Control Services to the Legacy After
Departure From SBSJ and During the Initial Climb
Once airborne from SBSJ, ATC removed the altitude restriction of 8,000
feet, authorized the Legacy to climb to Flight Level 370, and instructed the crew
to report when the aircraft passed through 11,000 feet. Next, ATC instructed the
Legacy that its new restriction was Flight Level 200 (20,000 feet).
At approximately 2:57 p.m. local time, just six minutes after takeoff,
N600XL made initial contact with Sector 1 of the Brasilia Area Control Center
(“Brasilia Center” or “BS ACC”), informing the controller that the aircraft was
climbing through 13,800 feet to its assigned altitude of Flight Level 200. The
controller responded by clearing the Legacy to climb to Flight Level 240 (24,000
feet). Jan Paladino, the First Officer, read back and acknowledged the
clearance to Flight Level 240.
As the aircraft was climbing, its position and altitude were displayed on
the scope of the Brasilia Center controller who was providing air traffic services
to the flight. (See FIGURE 2). From this point forward, all time references will be
to Universal Coordinated Time (referred to as “UTC” or “Zulu”) as described in
FIGURE 2.
In FIGURE 2, the Legacy aircraft is represented by a _, which is called a
“target position symbol.” When the target position symbol appears as its does in
FIGURE 2 (i.e., as an addition symbol enclosed in a circle), this indicates to the
controller that the aircraft’s transponder is properly replying to interrogations
made by ATC’s secondary surveillance radar. A transponder is an electronic
device in an aircraft that produces a radio-signal response when it receives a
radar interrogation. The absence of a circle around the data block (as will be
apparent in subsequent figures) is an indication to the controller that ATC’s
surveillance radar is no longer receiving replies from the aircraft’s transponder.
The data block identified in FIGURE 2 gives the controller the requisite
information the controller needs to provide air traffic services to the flight in
accordance with the applicable Brazilian and international rules and
regulations.3 Therefore, foreign pilots operating in Brazil should expect the
provision of ATC services to be consistent with ICAO standards (EXHIBIT 4).
Although a complete description of the data block is set forth in FIGURE
3, some of the most critical information is located on the second line, which
contains an altitude status indicator flanked by two areas that present numerical
information about the aircraft’s actual and planned altitudes. More specifically,
when the three digits on the left side of the second line are followed by a =
(level flight), + (climbing), or – (descending) symbol, this is visual confirmation to
the controller that the aircraft’s transponder is providing Mode C altitude
information to air traffic control. The Mode C feature of the transponder reports
altitude data to air traffic control that is, in turn, displayed on the radar scope in
hundred foot increments. (Mode A provides identification information to ATC,
and Mode S serves as the basis for collision avoidance.) The three numerals in
the right hand side of the second line of the data block represent the altitude
contained in the flight plan for that particular flight segment.
Thus, in FIGURE 2, the altitude status indicator shows that the Legacy is
climbing through a Mode C reported altitude of 19,700 feet and the flight plan
altitude for this segment of the flight is Flight Level 370.
2.5. Control’s clearances for climbing to cruise level 370 until Eduardo
Gomes Airport is reached
As the Legacy climbed through Flight Level 245, it entered Brazil’s “Class
A” airspace, also referred to as the “Upper Control Area,” which is identified as
“UTA” on aeronautical charts. Only IFR flights are permitted to operate in
Brazil’s Class A airspace, and, according to ICAO, all flights in Class A airspace
are provided air traffic control service and must be separated from each other
by ATC. ICAO, ANNEX 11 TO THE CONVENTION ON INTERNATIONAL
CIVIL AVIATION, AIR TRAFFIC SERVICES, § 2.6.1. An example of this
occurred at approximately 18:00Z when Brasilia Center restricted the Legacy’s
climb to Flight Level 310 because of southwest bound traffic one-thousand feet
above it at Flight Level 320. (See FIGURE 4).
At 18:11Z, once clear of conflicting traffic, Brasilia Center cleared the
Legacy to climb and maintain Flight Level 370. The Legacy subsequently
leveled at Flight Level 370 (approximately thirty minutes after departure from
SBSJ) on a direct course to the ARAXA VOR. While on course and level at
Flight Level 370, Brasilia Center advised the Legacy that it was under “radar
surveillance,” which means that ATC’s surveillance radar positively identified
N600XL as the target that the controller was tracking on the radar scope.
The ATC clearance to N600XL to climb to Flight Level 370 was the last
altitude clearance that ATC issued to the aircraft. Accordingly, the crew of
N600XL was required to adhere to this altitude assignment, regardless of the
direction of flight, and had no discretion to deviate from Flight Level 370 without
a subsequent ATC clearance to depart from this altitude. (See FIGURE 5 and
TIMELINE).
2.6. ATC Failures That Caused the Accident
2.6.1. ATC Was Negligent for Not Checking the Inconsistency Between the
Altitude Displayed in the Control System and the Altitude at Which the
Aircraft Was Flying
Approximately fifty nautical miles south of Brasilia, ATC transferred
control of the Legacy to Sector 7 of Brasilia Center. At 18:55Z, two minutes
before the Legacy reached the Brasilia VOR, the Legacy’s data block changed
to alert the controller that ATC approved the requested altitude contained in the
filed flight plan; however the pilot or crew of an aircraft that is operating under
IFR cannot arbitrarily change altitudes without first receiving a clearance from
ATC to do so. (See FIGURE 6). Stated alternatively, the retention of flight plan
altitude information in the data block is of no effect unless the controller
affirmatively acts on it and assigns the aircraft—in this case, N600XL—a
different altitude.
The depiction of the flight plan altitude in the data block is operationally
problematic. In fact, the U.S. National Transportation Safety Board, which is
assisting CENIPA with the investigation into the mid-air collision, has
recommended that ATC’s software be modified to prevent the data block from
displaying flight plan altitudes simply because this information may, and in this
case did, conflict with the altitude assignment given by ATC. (See Section IV:
CENIPA and NTSB Safety Recommendations).
To summarize, at 18:55Z, as the Legacy approached Brasilia, the
change in the second line of the data block to 370=360 should have alerted the
controller that the altitude assignment of Flight Level 370 did not correlate to the
track requirements for the route segment after Brasilia.
After the Legacy passed the Brasilia VOR, the data block continued to
depict a planned cruising altitude of Flight Level 360 for the flight segment along
UZ6 to Manaus. (See FIGURE 7). Now that the Legacy was actually proceeding
northwest on UZ6 at Flight Level 370, the controller should have cleared the
Legacy to a different flight level (i.e., FL 360 or 380) based on the correlation to
track requirements for cruising altitudes. This is the responsibility of ATC—the
pilots cannot independently change altitudes without an ATC clearance to do
so.
2.6.2. ATC Was Negligent for Not Contacting the Legacy to Determine
Altitude Change to 360 or, alternatively, Alter the Electronic Strip and
Indicate that the Legacy Was Flying at 370, as Previously Cleared.
An electronic data strip displays current and planned route and altitude
information to a controller for each flight the controller is presently providing (or
expects to provide) air traffic control services. More specifically, the electronic
data strip provides a controller with estimated times at which an aircraft will
pass a point along its route of flight, as well as the altitudes at which the aircraft
is estimated to cross these points. For example, as N600XL approached the
Brasilia VOR, the electronic data strip for the flight revealed that N600XL was
estimating Brasilia (“BRS”) at 18:55Z, TERES at 19:33Z, and NABOL—the
approximate location of the collision—at 19:54Z. The planned, but unassigned,
altitude after Brasilia was Flight Level 360, with a climb to Flight Level 380 at
TERES. NABOL. (See FIGURE 8).
The Sector 7 controller who was providing air traffic services to the
Legacy as it
proceeded along UZ6 would also have received an electronic data strip for Gol
Flight 1907 as the B737 proceeded southeast on the same airway. The
electronic data strip for Gol Flight 1907 revealed that its planned cruising
altitude was Flight Level 370—the same altitude at which the ATC cleared the
Legacy—and that it was estimated to cross NABOL at 19:59Z, just five minutes
after the Legacy was estimated to cross this fix. (See FIGURE 9). Quite simply,
had Brasilia Center adjusted the Legacy’s altitude in accordance with the
information contained in the data strips, the mid-air collision would not have
occurred.
2.6.3. ATC Was Negligent for Not Adopting the Procedural Rules for Cases
of Transponder Malfunction After Identifying such Malfunction on the
Control Center’s Radar
At 19:02Z, the BS ACC radar display revealed that ATC was not
receiving a reply from radar surveillance interrogations of the Legacy’s
transponder because the circle disappeared from the Legacy’s target position
symbol, leaving only the “+” to represent the aircraft on the controller’s scope.
(See FIGURE 10 and TIMELINE). In place of the = symbol that previously
showed the Legacy level at a reported Mode C altitude of Flight Level 370, the
altitude status indicator after 19:02Z began to display a “Z,” which alerts the
controller that the three numerals to the left of the Z represent the aircraft’s
estimated altitude derived from information supplied by ground-based heightfinding radar.
An aircraft must have an operable transponder to operate in Brazil’s
Upper Control Area. In the event of transponder failure, the ATC unit involved—
in this case, Brasilia Center—should have immediately initiated contact with the
Legacy. More specifically, under the RULES GOVERNING AIR TRAFFIC AND
AIR TRAFFIC SERVICES, designated ICA 100-12 (“ICA”), published by Brazil’s
Defense Ministry, Air Command, the controller must inform: (1) “the pilot when
the ground interrogator or transponder of the aircraft is inoperative, or
functioning deficiently,” ICA § 14.4.9; and (2) “the next control position of the
same body, or the body responsible for the adjacent airspace, when the
transponder of an aircraft is inoperative or functioning deficiently,” ICA §
14.4.10. Also, “when the transponder of an aircraft ceases to present the
desired response signal, the controller must ask the pilot to verify the
functioning of the transponder.” ICA § 14.4.11.
If, through crew action, the Legacy’s transponder signal could not be
restored, then the controller should have coordinated with those controllers who
would subsequently provide air traffic services to N600XL to ensure that they
were aware of the loss of transponder signal and that appropriate non-radar
separation be maintained from all other aircraft. Simply put, this required ATC to
ensure that the Legacy was vertically separated from all other air traffic on its
route of flight by at least 2,000 feet. Additionally, the loss of transponder signal
occurred while N600XL was operating in Reduced Vertical Separation Minimum
(“RVSM”) UTA airspace, which permits controllers to provide vertical separation
of only 1,000 feet to appropriately equipped aircraft (i.e., those with, among
other things, a functioning transponder that has Mode C and Mode S
capabilities). (Non-RVSM separation in the Upper Control Area is 2,000 feet.)
Accordingly, ATC was required, with the loss of transponder signal at
19:02Z, to suspend RVSM operations for the Legacy and provide at least 2,000
feet of vertical separation between it and other traffic along its route of flight.
This included Gol Flight 1907.
Here, the Brasilia Center controller who was providing air traffic services
to the Legacy at 19:02Z (the time the transponder signal was lost) through
19:15Z (the time at which he was relieved) did not advise the pilots of N600XL
that the airplane’s transponder ceased replying to ATC’s secondary radar. The
controller also failed to coordinate with other controllers or his relief to ensure
that N600XL was properly separated from other traffic as it proceeded toward
Manaus on upper airway UZ6 and that it was no longer RVSM compliant.
Vertical separation of the Legacy from other aircraft should have been a
critical consideration shortly after the height-finding radar began estimating the
Legacy’s altitude. More specifically, even though subsequent flight data
recorder parameters confirm that the Legacy remained level at Flight Level 370
until colliding with the Gol B737, the information received from the height-finding
radar estimated the aircraft at a different altitude with nearly every tensecond
sweep of the radar scope after the transponder signal was lost. The estimated
altitudes varied considerably not only from the aircraft’s actual altitude, which
the controller could have easily confirmed with a radio call to N600XL, but also
from the flight planned altitude depicted in the right-hand portion of the second
line of the data block. (See FIGURE 11).
The cessation of transponder returns from the Legacy at 19:02Z and the
erroneous altitude information that subsequently appeared in the data block
should have been apparent to the controller because the radar scope updated
over 300 times and air traffic in the sector where the Legacy was cruising was
extremely light. In fact, there were only five aircraft in the sector during the time
the controller should have taken action.
At approximately 19:15Z, a shift change for the Sector 7 control position
occurred, but the controller who was relieved did not inform his relief that ATC’s
surveillance radar was no longer receiving the Legacy’s transponder. The new
Sector 7 controller, though, was erroneously informed that the Legacy was
cruising at Flight Level 360, but took no action to independently verify the
Legacy’s altitude, even when it was apparent from the target position symbol
that the transponder signal was lost and that the altitude information in the data
block was changing with each update of the scope. In fact, this controller
improperly changed the electronic data strip information for N600XL so that it
incorrectly depicted the airplane’s cruising altitude as Flight Level 360 for the
entire route segment along UZ6. ATC, though, had never cleared or
commanded N600XL to maintain Flight Level 360.
Additionally, at 19:15Z, the approximate time of the Sector 7 shift
change, the electronic data strip information for Gol Flight 1907 was present on
the radar scope. According to information in the electronic data strip for Gol
Flight 1907, the B737 was estimated to pass NABOL intersection at 19:59Z at
Flight Level 370. The electronic data strip information for N600XL revealed to
the controller that the Legacy was estimated to cross this same waypoint at
19:54Z. In the non-transponder and non-RVSM environment that existed
(because ATC was not receiving the Legacy’s transponder returns), Brasilia
Center was required to clear the Legacy to maintain an altitude at or below
Flight Level 350 or at or above Flight Level 390 at least ten minutes prior to the
time these two aircraft were estimated to pass one another.
Alternatively, the BS ACC controller could have attempted to coordinate
an altitude change for Flight 1907 to ensure adequate non-radar separation. In
this case, neither measure was taken.
To summarize, approximately forty-five minutes before the collision, only
the Sector 7 controllers had the requisite information to ensure that this accident
did not occur. (See FIGURE 12).
2.6.4. ATC Was Negligent for Not Assuring the Reduced Vertical
Separation Minimum of 2,000 Feet between the Legacy and the Aircraft
that Operated Gol Flight 1907, Even After the Legacy’s Total Failure in the
Primary and Secondary Radars
At the time that ATC ceased receiving a transponder signal from the
Legacy and during the fifty-five minutes prior to the collision, the air traffic in
Sector 7 of Brasilia Center was light and the complexity was low. The Sector 7
controller made relatively few radio transmissions during the time that the
Legacy was in that sector and extensive periods of time would pass in between
these transmissions. In short, the workload for the Sector 7 controller was
extremely light, leaving him with ample opportunity to take action in response to
the cessation of transponder replies from the Legacy at 19:02Z and thereafter.
At 19:28Z and again at 19:29Z, ATC initiated two radio calls to the
Legacy, requesting the crew to change to a new frequency. These calls
occurred approximately twenty-six minutes after ATC ceased receiving
transponder returns from the Legacy. The delay most likely caused the Legacy
to fly beyond the range of the ATC radio transmitter, resulting in a situation
where the Legacy, even though its radios were operating properly, could not
receive the radio calls from ATC on the last assigned frequency. Moreover, ATC
made no immediate attempt to ensure that the Legacy received these calls or
complied with the instruction to change to a new frequency. There were four
subsequent calls by BS ACC to the Legacy, three of which simply referenced
the aircraft’s call sign, while the fourth was another request for the Legacy to
change to a new ATC sector frequency. Again, the Legacy’s crew did not
respond to any of these transmissions because the aircraft was beyond radio
reception range of the last assigned ATC frequency. (These six transmissions
by Brasilia Center to the Legacy were in English and do not appear on the
cockpit voice recorder transcript of the Legacy.)
At 19:31Z, the target position symbol for the Legacy and the associated
data block disappeared completely from controller’s radar scope. (See FIGURE
13). There is no pilot action that could have caused the complete
disappearance of both the target position symbol and the data block. At this
point, the Legacy was no longer in radar contact, thereby mandating that ATC
provide non-radar separation of 2,000 feet between N600XL and all other traffic,
including Gol Flight 1907, which was proceeding southeast on the same airway
in the opposite direction.
At 19:34Z, the Legacy reappears on the controller’s scope as a primary radar
return without an associated data block. As previously indicated, radar contact
was lost at 19:31Z, so the reappearance of the primary return is insufficient to
radar identify the target as N600XL. (Note, the target position symbol at this
point is just a +, which means that ATC radar is not receiving a reply from the
Legacy’s transponder.) The primary return that likely represents the Legacy
proceeds past TERES and disappears again at 19:38Z. Approximately one
minute later, at 19:40Z, the primary return reappears, but then disappears again
at 19:41Z for the remainder of the flight in Brasilia Center’s airspace. (See
FIGURE 14).
The Sector 7 controllers’ lack of responsiveness to the loss of
transponder signal, their misapprehension of the information contained in the
data block, and their reliance on the erroneous estimates of altitude generated
by the height-finding radar permitted the Legacy to remain at Flight Level 370—
an altitude that placed it in a situation where proper vertical separation with
Flight 1907 could not be maintained. These errors were compounded because
the northwestern portion of Sector 7, which borders the southern portion of
Amazonica center, is an area where loss of radar contact routinely occurs.
Under these circumstances, the Sector 7 controllers should have: (1) taken
appropriate measures to ensure that the Legacy, as it approached the
northwest portion of the sector, was separated at least 2,000 feet vertically from
Gol Flight 1907; and (2) protected the altitudes from Flight Levels 360 through
380 on UZ6 from any other traffic in the vicinity of the Legacy and its cleared
route of flight.
2.6.5. Errors of Brasilia and Amazonica Control Centers during the
Coordination for the Transference of the Legacy
Amazonica Center cleared Gol Flight 1907 to maintain Flight Level 370
as a cruising altitude along UZ6 from Manaus to Brasilia. At some point prior to
the collision, the Sector 7 controller in Brasilia Center informed Amazonica
Center that the Legacy was proceeding northwest on UZ6, but did not inform
the Amazonica Center controller that ATC was not receiving the Legacy’s
transponder or that the Legacy was no longer in radar contact. Without this
information, the Amazonica controller mistakenly believed that adequate vertical
separation existed based on the information contained in N600XL’s data strip
that showed the aircraft was maintaining Flight Level 360 as it proceeded along
UZ6. (Recall that the Brasilia Center controller improperly changed the
electronic data strip on N600XL to permanently indicate— incorrectly—that the
aircraft’s altitude was Flight Level 360.)
In fact, as the Legacy approached Amazonica Center’s airspace, the
Amazonica center controller stated to the controller in Brasilia Center: “We have
it,” referring to the Legacy. This compounded the errors made thus far because
N600XL was not a radar identified target at that time. If there was any
information displayed for the Legacy on Amazonica Center’s radar scope, it was
merely a primary target with a partial data block that did not reveal the aircraft’s
actual altitude, which was Flight Level 370, or even the altitude at which Brasilia
Center represented the aircraft to be cruising, Flight Level 360.
2.7. The Chain of Errors of the Air Control is the Direct Cause of the
Accident
At approximately 19:57Z, Gol Flight 1907 collided with N600XL at Flight
Level 370 in controlled airspace over the Amazon region of Brazil. This accident
was caused by the catastrophic failure of the Brazilian ATC system to:
a. Command a change in altitude for N600XL so that it would not be on a
collision course with Gol Flight 1907 as N600XL approached Brasilia and after it
passed this point;
b. Notify the crew of N600XL that ATC surveillance radar was no longer
receiving replies from the aircraft’s transponder;
c. Coordinate, with other controllers, proper vertical and horizontal
separation from N600XL once it was apparent that ATC was no longer receiving
a reply from the aircraft’s transponder;
d. Confirm N600XL’s altitude during the period where the height-finding
radar provided erroneous estimates of the aircraft’s altitude;
e. Take action when the data block and target position symbol associated
with N600XL disappeared from the controller’s radar scope;
f. Properly protect the altitudes from Flight Levels 360 through 380 on
UZ6 from any other traffic in the vicinity of the Legacy, such as Gol Flight 1907.
3. CENIPA AND NTSB SAFETY RECOMMENDATIONS
Although the investigation into this tragic accident is still in progress,
CENIPA and the National Transportation Safety Board investigators have
observed numerous potential safety issues with the Brazil Air Traffic Control
system. Many of these observed safety flaws in the ATC system, if corrected
earlier, would have averted the September 29, 2006 collision. The interim
recommendations of CENIPA and the NTSB are attached. They include:
•
Assure the level of English proficiency of all air traffic controllers.
•
Modify the ATC radar data software to ensure that the “cleared altitude”
field in the data block does not change automatically. It should only be
changed by the direct action of the controller having responsibility for the
aircraft.
•
Height finding radar can be misleading to controllers and should only be
displayed if specifically requested by the controller and should be
unmistakably distinguishable from Mode C altitude reports from aircraft.
•
The ATC controllers failed to notice the loss of the signal from the
Legacy’s transponder over an extended period of time. The ATC displays
need to be modified to clearly identify the loss of secondary radar returns
through color coding or other methods.
•
The ATC controllers failed to terminate RVSM operation for the Legacy
after the loss of the Mode C transponder. The controllers should be
retrained on RVSM operations.
•
Transfer of control between sectors should include any abnormal
communications status or uncertainties about flight data.
•
ATC must develop procedures to ensure that controllers actively monitor
aircraft altitude, request and confirm altitude changes when in non-mode
C status, and record when aircraft leave and reach assigned altitudes.
•
ATC should take aggressive action to locate an aircraft which has been
simultaneously or unexpectedly lost from radar and radio.
•
Controllers routinely drop the data blocks for aircraft in their area of
responsibility just after handoff. The practice should be stopped.
•
Incomplete relief briefings can cause controllers to make incorrect
assumptions about the status of aircraft within their control and
responsibility. A checklist of critical items to be covered in the briefing
should be established.
4. FREQUENTLY ASKED QUESTIONS
4.1. Questions about the accident
A. Whose responsibility is it to ensure that air traffic is properly separated
so that aircraft do not collide?
Air traffic control (“ATC”). Annex 11 to the Convention on International
Civil Aviation states that the objectives of the air traffic services [ATC] shall be
to:
a) prevent collisions between aircraft;
b) prevent collisions between aircraft on the manoeuvring area and
obstructions on that area;
c) expedite and maintain an orderly flow of air traffic;
d) provide advice and information useful for the safe and efficient
conduct of flights;
e) notify appropriate organizations regarding aircraft in need of search
and rescue aid, and assist such organizations as required.
Brazil is a signatory to these provisions, all of which were promulgated by
the International Civil Aviation Organization (“ICAO”).
B. Why did N600XL and Gol Flight 1907 collide?
Brazil’s air traffic control system failed to ensure proper separation
between these two aircraft. N600XL and Gol Flight 1907 were operating in
Class A airspace, which, in Brazil, is referred to as the Upper Control Area. Only
flights operating under Instrument Flight Rules (“IFR”) are permitted in Class A
airspace, and, according to ICAO Annex 11, ATC is required to provide air
traffic control services to flights operating in Class A airspace to ensure these
aircraft are separated from each other.
N600XL and Gol Flight 1907 were operating under IFR. Through a series
of ATC errors and system deficiencies, ATC cleared both aircraft, which were
headed in opposite directions on the same airway, to cruise at the same
assigned altitude of Flight Level 370 (37,000 feet).
C. Why were both planes at the same altitude, Flight Level 370 (37,000
feet)?
ATC cleared both aircraft to maintain this altitude. More specifically,
Brasilia Center cleared N600XL to maintain Flight Level 370 as its cruising
altitude when it was south of Brasilia. Amazonia Center cleared Gol Flight 1907
to maintain the same cruising altitude. This was not an immediate problem
when the two airplanes were hundreds of miles apart, but as these aircraft
proceeded in opposite directions along upper airway UZ6, information available
to ATC well in advance of the collision should have alerted ATC to alter the
altitude and/or flight path of at least one of these aircraft to prevent the collision.
D. Should N600XL have been at a different altitude based on the
information contained in the flight plan?
No. ATC controls the progress of an IFR flight from departure to
destination through the use of clearances, which are verbal instructions from
ATC that limit the horizontal and vertical movement of an aircraft in controlled
airspace. For example, an ATC request to climb and maintain Flight Level 370
(37,000 feet) is a clearance, and the crew of the aircraft to which this clearance
is issued must acknowledge the clearance and comply with it. The crew cannot
deviate from this altitude assignment unless ATC authorizes a different altitude
or an emergency exists that would preclude compliance with the clearance.
A flight plan is not a clearance and, standing alone, does not even
authorize a pilot to operate in controlled airspace under IFR. Here, even though
N600XL’s flight plan contemplated two altitude changes during the flight, ATC
had cleared both N600XL and Gol Flight 1907 to maintain Flight Level 370 and
never altered this altitude assignment even when it was necessary to do so.
E. Was there a lost communications situation at any time during the
flight?
No. The Legacy’s radios were operational throughout the flight and the
pilots heard transmissions on the assigned ATC frequencies. A significant
number of the transmissions from the Legacy to Brasilia Center that began at
approximately 4:48 p.m. local time were, in fact, recorded by ATC even though
ATC did not respond to these calls. Additionally, the Legacy received Brasilia
Center’s request at 4:53 p.m. to switch to a new frequency, but ATC did not
provide clarification of the digits when the pilots requested the controller to do
so.
F. What is a transponder?
A transponder is an electronic device that transmits information to air
traffic control when ATC’s surveillance radar interrogates it. The transponder’s
reply contains, among other things, altitude data that is, in turn, processed by
ATC’s computers and displayed on the controller’s radar scope. The altitude
information that appears on the controller’s radar scope is the basis upon which
the controller ensures that aircraft are separated vertically from each other. The
transponder also provides collision avoidance information to other aircraft that
are equipped with an on-board Traffic Collision Avoidance System (“TCAS”).
G. Is it significant that N600XL’s transponder was not received by ATC for
approximately fifty-five minutes before the collision?
Yes. Once a controller has positively identified an aircraft through the use
of surveillance radar, the target position symbol that represents the aircraft on
the controller’s scope will change in appearance if ATC is no longer receiving
the aircraft’s transponder signal. Here, ATC surveillance radar ceased receiving
a transponder signal from N600XL at approximately 4:02 p.m. local time. The
collision occurred approximately fifty-five minutes later, at 4:57 p.m. local time.
Under Brazilian regulations, the controller must: (1) inform the pilot when
the transponder signal is no longer received; and (2) inform the next control
position of the same body, or the body responsible for the adjacent airspace,
when the aircraft’s transponder signal is lost. Additionally, Brazilian regulations
require the controller to issue a request to the pilot to verify transponder function
when the transponder ceases to present the desired response signal to ATC.
Here, ATC failed to take any of these required safety measures. The margin of
safety was further compromised when Brazil’s height-finding radar began
providing erroneous and fluctuating estimates of the Legacy’s altitude on the
controller’s scope, leading the controller to incorrectly believe the aircraft was at
an altitude other than Flight Level 370.
At the time ATC ceased receiving the Legacy’s transponder signal, the
aircraft was operating in Reduced Vertical Separation Minimum (“RVSM”)
airspace, which permits high altitude air traffic to cruise within 1,000 feet of each
other. Upon the loss of transponder signal, ATC was also required to suspend
RVSM operations for the Legacy and ensure that, at all times, it was separated
from other air traffic by at least 2,000 feet.
Accordingly, ATC’s failure to appropriately respond and take action when
ATC surveillance radar failed to receive N600XL’s transponder signal was a
critical cause of the midair collision.
H. What is the danger of criminalizing aviation accidents?
The pilots of the Legacy are facing the potential for criminal prosecution
under Brazilian law, and there have been some suggestions that certain
controllers may also be targets in a criminal probe. The International
Convention on Civil Aviation, as well as leading flight safety institutions and
organizations, are steadfastly opposed to charging those involved in aviation
accidents and incidents with criminal offenses because it severely inhibits the
flow of information that could avert accidents in the future. Brazil has agreed to
abide by the relevant ICAO provisions, and, accordingly, should formally
request that the federal prosecutor and police in Sinop cease their criminal
investigation into this accident.
4.2. Questions about the dialogues recorded in the Legacy’s cockpit
A. 18:37:36 Z – You know, someone else having the engineer pulling the
numbers with me, and we kept doing ‘em and like, oh, please shut up. And
I’m like *, what’s going on, you know. I’m going, this can’t be right. I know
that, but then again, I don’t want to be wrong and take off***.
Question: Was there any doubt about the navigation and takeoff procedures?
Answer: No. The dialogue from which this comment is taken concerns a
discussion about the location of the aircraft’s center of gravity. Prior to the flight
on September 29, 2006, the pilots calculated and fully understood the location
of the aircraft’s center of gravity. The comment that “this can’t be right” refers to
a discussion Jan Paladino had earlier that week with an Embraer engineer
wherein the engineer mistakenly provided center of gravity information to
Paladino in the metric system, rather than in English recognized the
discrepancy and requested the engineer to provide the information in English
units.
To summarize, the crew of N600XL ensured that the aircraft was loaded
within its center of gravity and weight limitations on September 29, 2006.
B. 18:38:40 Z – Are they speaking English to you guys or Portuguese?
Question: Explain if the English language used by the controllers caused
problems of communications between the aircraft and ATC.
Answer: The vast majority of the transmissions the pilots heard while operating
in Brazilian airspace were in Portuguese. Even though the Brazilian air traffic
controllers addressed the Legacy in English, some of those transmissions
revealed a lack of proficiency with the English language. The pilots avoided any
operational issues or problems that could have arisen from a miscommunication
by requesting clarification from air traffic control (“ATC”) whenever necessary.
On February 19, 2007, the media reported that the Brazilian Air Force will
mandate that air traffic controllers undergo a course on the English language
(EXHIBIT 5).
C. 18:39:09 Z – I, I had a feeling it was going to be eight thousand feet**
what it it. And when we went to, t the tower, she immediately gave it to us.
Uh, it’s just the phraseology like line up and takeoff.
Question: Were there doubts about the flight altitude or about the procedures
to be followed during flight?
Answer: No. Prior to takeoff from Sao Jose dos Campos (SBSJ), the crew
received an instrument flight rules (“IFR”) departure clearance. According to that
clearance, N600XL was cleared to fly the “OREN Departure,” which is a
published standard instrument departure procedure for SBSJ. There is no initial
altitude specified on the aeronautical chart that depicts the OREN Departure, so
the crew requested clarification from ATC. The controller did not respond to the
crew’s requests for clarification. Shortly before takeoff, the controller eventually
issued a clearance to N600XL to maintain 8,000 feet on departure.
D. 18:39:29 Z – Hate to have the Brasilian Air Force on our ass.
Question: What is the meaning of this phrase?
Answer: The use of this phrase relates to the crew’s decision to request
confirmation of the initial altitude prior to departure. Simply put, this comment
reflects (in a colloquial way) the crew’s decision to take the necessary
precautions to comply with applicable rules, regulations, and clearances, rather
than risk a misunderstanding with the Brazilian aeronautical authorities.
E. 18:41:14 Z – Still working out the Kinks on how to work this stuff. This
FMS.
Question: Were there any doubts about handling the FMS?
Answer: No. The pilots were proficient in their understanding and use of the
Flight Management System (“FMS”) installed in the Legacy. The crew
accurately loaded the required information into the FMS prior to departure from
SBSJ and commanded the proper inputs to the FMS throughout the flight.
F. 18:41:56 Z – ‘Cause the airshow’s not initialized to the FMS right now
‘cause it’s giving us an hour and a half.
Question: Were there doubts about handling the FMS or did the equipment
have any problems?
Answer: No. The Legacy is equipped with a feature called the “Airshow,” which
is a passenger information system that portrays, on a television screen located
in the cabin, the airplane’s position relative to a geographic map. The Airshow
also displays the estimated time of arrival and the flight time remaining until
landing. The in-flight entertainment system on most modern commercial
airliners is equipped with the same feature.
Some of the information supplied to the Airshow comes from the
Legacy’s FMS. The comment made at this particular time was from a passenger
who is an Embraer employee, remarking that the information on the Airshow
display may not be synchronized with the aircraft’s FMS. Regardless, the
Airshow is not a component that, in any way, affects the safety of flight or
navigation.
G. 18:42:09 Z – I just want to make sure we’re going to right direction.
Question: Was there a doubt about the heading to follow and about the
navigation?
Answer: No. The flight crew understood the route clearance, and the aircraft
was proceeding on course at this time. At no point did air traffic control question
the Legacy about its heading or route assignment, and the pilots were aware of
the aircraft’s position along the route of flight at all times. Given these facts, the
comment should not (and cannot) be construed literally.
H. 18:51:00 Z – I don’t even know what to call these guys. I’m just gonna
say….
Question: Was there any doubt about how to communicate with the Brazilian
ATC controller?
Answer: There was no doubt. This remark was made while the copilot sought
to confirm that the frequency change was to another controller within Brasilia
Center.
I. 18:51:11 Z – November six sero sero Xray Lima, aquawk ident. Radar
surveilance.
Question: What did you understand for the expression “radar surveillance”?
Answer: The pilots understand this term to mean that the Brasilia Center
controller whose responsibility it was to provide air traffic services to N600XL
positively identified the aircraft on the radar scope through ATC’s surveillance
radar. Under these circumstances, the provision of air traffic services is
accomplished through radar-derived information.
J. 18:51:20 Z – Oh @ (fucking), I forgot to do that..
Question: What was forgotten?
Answer: Nothing was forgotten. This remark was made to confirm that the
IDENT button on the aircraft’s Radio Management Unit was depressed in
response to the controller’s request to do so. After pressing the IDENT button,
the data block that represented N600XL on the controller’s scope flashed in
short intervals to confirm for the controller that the aircraft was identified through
the use of ATC’s surveillance radar.
K. 18:59:30 Z – Hey, did you do this at RTO one? Aw, did I? I’m sorry. I
didn’t even check.
Question: What was not checked?
Answer: At that particular time, the crew was discussing preliminary
performance data for the takeoff from Manaus on the following day. The
reference to “RTO one” describes a rejected takeoff scenario, and the captain’s
comment was an acknowledgement of the preliminary nature of the
performance calculations. The comment in no way related to the performance
planning for the flight to Manaus from SBSJ.
L. 19:18:31 Z – So we did a pretty good way off ou head. Althought I think I
figure, you figure about three thousand pounds…doing the wag. But the
burn was more. You and I thought that the burn would be eight thousand.
Turned out to be ninety eight hundred.
Question: Was there any mistake on the fuel calculation for the trip?
Answer: No. The discussion regarding fuel load was exclusively with reference
for the flight from Manaus to Fort Lauderdale that was scheduled to occur on
the following day.
M. 19:25:16 Z – We should get through this flight that way to build our
confidence so we don’t # (fuck) anything up.
Question: Was the aircraft crew unsure about accomplishing the flight?
Answer: No. The pilots were confident of their abilities to properly operate the
aircraft and its systems. (They demonstrated their confidence and abilities
throughout the emergency descent and landing.)
N. 19:59:13 - 19:59:15 Z – Dude, you have the TCAS on? Yes, the TCAS is
off.
Question: What was meant by this exchange?
Answer: The affirmative response “yes” to the question whether the TCAS was
“on” confirms that “TA/RA” (Traffic Advisories and Resolution Advisories) was
displayed in the ATC/TCAS window of the Radio Management Unit. TA/RA is
the normal in-flight operational mode for the transponder and TCAS. The
phrase, “the TCAS is off,” confirmed that the TCAS display did not “pop up” to
provide the crew a visual indication of a Traffic Advisory (“TA”) or Resolution
Advisory (“RA”).
5. THE EMBRAER LEGACY 600 135BJ
The Embraer Legacy 600 is a mid sized business jet based on the
Embraer 135, but which includes extra fuel tanks and winglets, similar to those
on the Embraer 145. The Legacy will carrry 16 passengers up to a range of
3,250 nautical miles at 459 knots. It is 86 feet 5 inches long and has a wingspan
of 68 feet 11 inches.
The Legacy is equipped with the Honeywell Primus 1000 integrated
avionics suite. Two] IC-600 computers are the primary components of the
integrated system. They interface with the aircraft’s systems and manage
information on the aircraft’s displays. There are five CRT displays in the cockpit
for the flight crew including two primary flight displays (PFDs) on the pilot’s and
copilot’s panel, two multifunction displays (MFDs) on the pilots and copilot’s
panel, and one engine indication and crew alerting system (EICAS) display on
the center panel. In addition, there are two radio management units (RMUs) on
either side of the EICAS on the center panel.
The Legacy is equipped with a Traffic and Collision Avoidance System
(“TCAS”), which provides indications of possible airborne traffic conflicts to the
crew. The system provides both visual and aural warnings and recommended
evasive actions to avoid other aircraft intruding in the aircraft’s expected flight
path. The TCAS computer receives data from the aircraft’s transponders and
radio altimeter as well as the signals transmitted by other aircraft. The TCAS
tracks all transponder-equipped proximate traffic to determine whether it could
become a threat.
If the TCAS determines that the predicted path of another aircraft will
cross its path, it will issue a Traffic Advisory (“TA”) approximately 35 to 45
seconds prior to such conflict. The pilot can then take preventive action if
necessary. The TCAS will issue a Resolution Advisory (“RA”) if a conflict is
expected within 20 to 30 seconds. Voice messages will advise the pilot of the
actions to be taken (climb or descend) to avoid the conflict.
The area monitored by the TCAS can be displayed manually on the MFD
or can be set to auto mode, in which case it will “pop up” on the MFD to provide
a visual indication of any Traffic Advisory or Resolution Advisory. The Vertical
Speed Indicator on the PFD will indicate the necessary vertical speed to avoid
the possible conflict. The TCAS system will not give warnings below 180 feet of
altitude.
The transponder can be set to one of five modes, which will be displayed
on the RMU: STANDBY, ATC ON (replies on Modes S and A, no altitude
reporting), ATC ALT (replies on Modes A, C, and S with altitude reporting), TA
ONLY
(TCAS
advisory
mode
is
selected),
or
TA/RA
(TCAS
traffic
advisory/resolution advisory mode is selected). Resolution Advisories can only
be generated when the intruding aircraft is equipped with responding Mode S or
Mode C transponders. Traffic Advisories can be generated for intruding aircraft
with operative Mode S, Mode C, or Mode A transponders. The TCAS system
will not provide any indication (TA or RA) of aircraft without operative
transponders.
6. PRODUCTION AND PRE-DELIVERY PROBLEMS WITH N600XL and
EMBRAER’S POST-ACCIDENT CONDUCT
6.1. Production problems with N600XL
At
least
one
significant
incident
occurred
during
the
production/manufacture of the aircraft that may explain the failure of the
transponder and Traffic Collision and Avoidance System (“TCAS”) on
September 29, 2006. An avionics component that houses some of the Legacy’s
communications radio and one of its transponders was returned to Honeywell,
the manufacturer, in April, 2006 for malfunctions. In fact, the unit was returned
to Honeywell after Embraer installed it in an aircraft that came off its production
line before N600XL. Additionally, one of the Legacy’s Radio Management Units,
which is part of the Honeywell avionics suite installed on the aircraft, was also
returned to Honeywell because it also malfunctioned after it was installed on a
previous airplane. Notwithstanding the previous malfunctions with these
avionics components, and the fact that these components had been used
previously in other aircraft, Embraer decided to integrate them into the Legacy it
sold to ExcelAire. Embraer neither revealed to ExcelAire that these components
were not “factory fresh,” nor did it inform ExcelAire that they were previously
returned to Honeywell for corrective action.
Additionally, several noteworthy maintenance problems were registered
in the Legacy’s flight logs that evidence defects in the aircraft which could have
contributed to, or explain, a failure of the transponder/TCAS system on
September 29, 2006. For instance, during a production flight on July 12, 2006,
Embraer identified inoperative displays related to wing antiicing.
Likewise, on a pre-delivery test flight that took place on September 11,
2006, the meteorological radar, which is integrated into the aircraft’s avionics
suite, failed to pass a flight test. Subsequently, on September 14, 2006, the
meteorological radar failed again, and although Embraer’s corrective measures
indicate that the problem was apparently identified, no actual corrective action
was logged.
During the September 11, 2006 test flight, the flight crew was advised,
through the airplane’s warning system, of a display unit overheat condition that
occurred during landing. Embraer’s only corrective action was to substitute the
display unit, rather than analyzing the cause of such overheating. On
September 18, 2006, the display units on the aircraft had to be readjusted due
to vibrations that occurred on a second test flight.
During “Pre-delivery Flight I” on September 22, 2006, only one week prior
to the apparent collision with Gol Flight 1907, Embraer logged three significant
problems with the aircraft.
First, navigation failures were noted on one Flight Management System
display, and frequencies on the other Flight Management System display failed
to appear throughout the flight. The Flight Management System in the Legacy,
as with most modern aircraft, is a computerized avionics component that assists
the flight crew in navigation, flight planning, and aircraft control functions. This
squawk necessitated the replacement of one of the aircraft’s integrated
navigation units.
Second, one of the flight management system computers shut down
during the final approach, requiring the replacement of the associated
control/display unit. (This is analogous to replacing an entire desktop computer
system.)
Finally, the anti-ice system failed during “Pre-delivery Flight I,” requiring
Embraer to replace a sensor. This failure, though, persisted through “Predelivery Flight II,” which occurred on the same day.
6.2. Discrepancies noted during delivery
ExcelAire representatives traveled to the Embraer facility in Sao Jose
dos Campos, Sao Paulo, Brazil, on September 23, 2006 via commercial
airplane along with and Embraer sales representative in order to perform a prepurchase inspection on the Legacy, which at the time, still displayed its
temporary Brazilian registration number. The inspection process was expected
to last three days.
As set forth above, the purpose of the pre-purchase inspection is to
ensure the basic operating condition of the airplane and to ensure that the
aircraft is compliant with certain specifications. ExcelAire’s representative first
inspected the Legacy on September 26, 2006, after three noteworthy
discrepancies involving the aircraft’s electrical and anti-ice systems were
identified. The first acceptance flight for N600XL occurred on September 26,
2006. As the Embraer test pilots were performing a preflight check of the flight
deck, they elected to start the aircraft’s auxiliary power unit (APU). Prior to
starting the APU, Embraer’s own procedures require that the pilots deselect the
aircraft’s two avionics master switches, which are pushbuttons located on the
overhead panel.
Deselecting the avionics master switches prior to APU start isolates
critical avionics equipment from possible voltage transients that may occur
during the APU start sequence. When the master switches are deselected, the
flight displays should turn off; however, when the Embraer test pilots deselected
the master switches prior to starting the APU on the first acceptance flight, the
captain’s Primary Flight Display (PFD) and copilot’s Multi-Function Display
(MFD) remained “on.”1 As a result, it is likely that some of the avionics busses
on which critical avionics equipment, like the transponder, are located were still
connected to the electrical system, even though the switch position should have
isolated them.2
Although
Embraer
attempted
to
troubleshoot
the
problem
for
approximately forty-five minutes, Embraer ultimately decided to start the
Legacy’s APU with the captain’s PFD and copilot’s MFD still illuminated. As
such, it is likely that, on September 26, 2006, critical avionics equipment on the
Legacy were placed at risk for exposure to electrical transients during the APU
start.
During an acceptance flight on September 27, 2006, the test pilots found
both Flight Management System images blinking/flickering throughout the flight.
Embraer’s subsequent inspection revealed that the systems were improperly
connected, giving reason to suspect that other systems could have, likewise,
had faulty connections.
During a nighttime ground taxi test to attempt to reconcile the persistent
problems with the anti-ice system, ExcelAire noted that the cabin lights would
flicker with changes from APU to engine generator power. N600XL was the first
Legacy equipped with LED cabin lights, and ExcelAire wanted to ensure that
they would be repaired by Embraer. After a series of exchanges/discussions
between ExcelAire representatives and Embraer management, Embraer finally
provided a letter of intent to correct the problem after delivery. Embraer
management informed ExcelAire that the problem would be rectified by
installing a current regulator in the airplane’s electrical system. After Embraer
agreed to repair the LED malfunction, ExcelAire was prepared to accept the
aircraft and return to Long Island.
Although the impact of these multiple problems on the accident of
September 29, 2006 remains unknown as of this writing, the malfunctions and
anomalies mentioned here raise serious
uestions regarding the fitness of the aircraft delivered to ExcelAire by Embraer.
At a minimum, until such time as the nature and cause of each and every one of
these discrepancies is completely investigated, any attempt to assign blame to
the pilots for transponder and TCAS related issues is entirely premature.
6.3. The Inspection performed on the aircraft by Embraer right after the
accident
On the ground at the Cachimbo air force base following the accident, the
Brazilian military and Embraer personnel videotaped a test procedure in the
cockpit. During this test, Joe Lepore was ordered to occupy the right seat, and
an unidentified Embraer employee sat in the left seat. Another Embraer
employee, Donovan Koch, knelt at the pedestal and videotaped while reading
off a checklist from a laptop. A member of Brazil’s military, perhaps from
CENIPA, stood to the left of Mr. Koch, and ExcelAire’s corporate representative
stood behind Mr. Koch. A video was made prior to power-up, scanning the
entire cockpit, then power was applied and all self-tests were run while
videotaping. All tests passed. Mr. Koch asked Joe to retrieve flight plans from
the Flight Management System, and there was some discussion until the other
ExcelAire pilot, Jan Paladino, offered further explanation.
ExcelAire’s representative observed Embraer personnel download some
data onto a laptop, then go to the back of the aircraft and download some data
from the flight recorders. To date, ExcelAire is uncertain what data was
downloaded from its airplane directly to the laptop. Embraer personnel also
removed the flight recorders from the Legacy, and Mr. Koch subsequently
assumed possession of them.
7. AVIONICS EXAMINATION AND DETECTED FAILURES
Before acceptance of the Legacy aircraft from Embraer as well as during
the accident flight, anomalies were noted in the avionics of the new aircraft.
While the problems noted during the acceptance flights were reported as
cleared prior to delivery, the investigation has revealed that the Radio
Management Unit and Communication Unit installed in N600XL were not new,
and in fact each had been removed from other aircraft before they were
installed by
Embraer in this aircraft.
The Radio Management Unit (“RMU”) is a display which provides control
of the radio, transponder and TCAS, among other functions. The investigation
to date has uncovered that the RMU on the pilot’s side of the cockpit, RMU #1,
had previously been installed in two other aircraft. RMU # 1 was first installed by
Embraer on its assembly line into aircraft serial number 145-939, on October 5,
2005. On October 10, 2005 it was removed from aircraft 145-939, on the
assembly line, due to "when pushing ½ function the information becomes
dashed on display."
On November 7, 2005 the unit was sent for repair. On December 20,
2005 RMU #1 was installed in aircraft serial number 145-946 on Embraer’s
assembly line. On March 13, 2006 it was removed from aircraft 145-946 due to
report of "unit is blank." On March 18, 2006 it was again sent for repair to
Honeywell.
Honeywell Service Report No. 110295 provides further details on this
repair.
On May 10, 2006 RMU # 1 was then installed on aircraft number 145-965,
which latter became N600XL. ExcelAire was not advised that the RMU installed
in its aircraft was not a new unit, had been previously installed in two other
aircraft, and was not advised that it already had a long repair history before
delivery to ExcelAire.
The Communication Unit or “RCZ” is an integrated communication unit
which incorporates the Transponder, TCAS and VHF communications. The
investigation has disclosed that the RCZ #1 (pilot’s side) on N600XL had been
previously installed on, and removed from, aircraft serial number 145-952 on
April 3, 2006. On April 5, 2006 it was removed from 145-952 due to "Unit was
rejected as requested by Honeywell to verify in laboratory the functionality
XPDR MOD.S EHS - DOS. ECM H 3269". On April 7, 2006 RCZ #1 was tested
by Honeywell and returned to stock at Embraer. On May 24, 2006, it was
installed on aircraft 145-965, which later became N600XL. Again, ExcelAire was
never advised that the RCZ, including its transponder and TCAS, on its new
aircraft had previously been installed on another aircraft, and were not informed
that it had been rejected for use on that previous aircraft.
Post-accident testing of the avionics, including the RMU and RCZ, has
been trusted to Honeywell, which manufactured the units. For this testing, the
various components were removed from the aircraft and transported to
Honeywell’s facility in Arizona.1 That testing is ongoing, yet it has yielded some
interesting results, which may bear on the reliability of these supposedly new
units. For example, an excessive amount on non-conductive silicone was found
inside the antenna connectors of the transponder.
Loose connectors on the avionics of this aircraft were previously noted during
Embraer’s production flight testing of this aircraft. Specifically, the Flight
Management System (“FMS”) Computer #1, on two occasions failed during
production test flights. During the first failure, on September 22, 2006, the FMS
went blank while the aircraft was on final approach. The second failure was on
September 27, 2006 when the FMS was found to be “blinking.” The cause of
that problem -- two days before the accident flight -- was found to be a
connector with a “bad contact.”
Another anomaly noted during the Honeywell testing is that while the aircraft
was cruising in level flight at 37,000 feet, the TCAS received a “weight on
wheels” signal meaning that it then thought the aircraft was on the ground. As
noted previously, the TCAS system will not function when the aircraft believes
that it is below 180 feet.
Testing conducted to date has not disclosed the cause for this erroneous
signal. The results of the complete Honeywell testing are not yet available and
additional testing is required.
8. FAA SERVICE DIFFICULTY REPORTS
A review of the FAA’s Service Difficulty Report database identifies nine
instances of TCAS and/or transponder failure during operation in Embraer
135/145 aircraft. One of these failures occurred during taxi, the remainder
occurred during climb or cruise flight. Of these nine incidents, five involved a
failure of both transponders. In three of the nine incidents, maintenance was
unable to find any defect in the TCAS and/or transponder. By comparison, there
was only one SDR report of transponder failure and no reports of TCAS failure
on any listed variant of the Boeing 737-800. This represents a failure rate on
Embraer 135/145 aircraft that is more than ten-times the rate of failure on the
Boeing 737-800.1 The Service Difficulty Reports are summarized in the
following table. Copies of the referenced SDRs are attached.
9. CRIMINALIZING AVIATION ACCIDENTS
Annex 13 of the International Convention on Civil Aviation, titled
AIRCRAFT ACCIDENT AND INCIDENT INVESTIGATION, imposes certain
obligations on the State in which an aircraft accident occurs. One of the central
tenets embodied in Annex 13 is an admonishment that information developed
during an accident investigation should not be inappropriately used for
subsequent disciplinary, civil, administrative and criminal proceedings. Annex
13, to which Brazil is a signatory, makes it clear that the sole objective of the
investigation of an aviation accident or incident is to prevent similar occurrences
in the future and not to apportion blame or liability.
This policy is consistent with the long-recognized understanding that
aviation safety depends on cooperation and the free flow of information.
Criminal investigations and prosecution, though, jeopardize the cooperation that
is essential to improving safety and preventing accidents in the future. The free
flow of information stops when well-minded persons involved in the aviation
sector fear for their freedom, and, individuals, particularly, may be reluctant to
offer information that could be subsequently used against them. Simply put,
Annex 13 was promulgated so that these impediments do not stand in the way
of accident investigations, the central purpose of which are ensure that similar
tragedies do not occur in the future.
Additionally, aviation accident investigations are becoming more complex
and are taking longer to complete. Given this already challenging environment,
aviation authorities cannot afford to lose voluntary party cooperation. When
accidents are criminalized, aviation employees, who were otherwise willing to
cooperate with air safety authorities, instead exercise their right for fear of selfincrimination. Air safety authorities must then look elsewhere for answers to
aviation accidents; answers that may never be found. In its Note to Article 5.12
of Annex 13, which governs records developed during accident investigations,
ICAO warns:
[1] information given voluntarily by persons interviewed during the
investigation of an accident or incident, could be utilized
inappropriately for subsequent disciplinary, civil, administrative
and criminal proceedings. If such information is distributed, it may,
in the future, no longer be openly disclosed to investigators. Lack
of access to such information would impede the investigation
process and seriously affect flight safety.
This is not to say that truly criminal conduct should go unpunished. In the
aviation arena, there are situations where criminal prosecution is necessary and
appropriate, such as an act of terrorism or reckless endangerment. Annex 13
and,
more
recently,
the
JOINT
RESOLUTION
REGARDING
THE
CRIMINALIZATION OF AVIATION ACCIDENTS (“JOINT RESOLUTION”), to
which the world’s leading flight safety institutions are signatories, recognize that
saboteurs and those who act willfully or in a manner that is particularly
egregious, should not escape criminal liability.
More significantly, though, the JOINT RESOLUTION is steadfastly
opposed to the criminalization of accidents where no such evidence is present,
with the signatories noting, in particular, the criminal investigation into this
particular accident. (See Exhibit A: JOINT RESOLUTION, at 1.)
The people being investigated in this matter have devoted their entire
professional lives to aviation safety. Mr. Lepore and Mr. Paladino have been
subject to questioning by the aviation authorities of the United States and have
answered the questions posed as candidly as possible in the interest of aviation
safety.
The aviation industry needs proactive participation of its members to
avoid future catastrophes. Mindful of and saddened by the loss of life as a result
of this accident and in hopes of preventing future tragedies, ExcelAire reminds
those with the responsibility for discerning the causes of this accident of the dire
need not to criminalize the current investigation at the expense of the safety of
the public-at-large.
10. FINAL CONSIDERATIONS
On September 29, 2006, at approximately 4:47 p.m. local time, a Gol
Boeing 737-800 SFP collided with an Embraer Legacy 600 business jet in
controlled airspace over the Amazon region of Brazil. All 154 persons aboard
the Gol B737 perished in the accident, which was the worst aviation disaster in
Brazil’s history.
A review of the air traffic control (“ATC”) transmissions and cockpit voice
recorders confirm that both aircraft were cleared by ATC to fly at the same
assigned altitude along the same airway in opposite directions. This collision
course was established more than an hour before the eventual accident, yet
because of a series of failures of the air traffic control system, the air traffic
controllers responsible for these two aircraft never realized their error until it
was too late.
Shortly after the collision, an investigation was begun by CENIPA with
assistance from the National Transportation Safety Board pursuant to ICAO
Annex 13. The purpose of this ongoing investigation is to determine the causes
of this accident so as to prevent similar occurrences in the future. A separate
criminal investigation of this accident was also begun shortly after the collision.
It is the policy of Brazil and all other signatories to the ICAO convention,
however, that aircraft accident investigations should not be the subject of
criminal prosecution. Criminalization of aviation accidents is contrary ICAO
Annex 13 because it impairs the search for their true cause.
A number of potential causes for this accident have been uncovered by
the Annex 13 investigation, resulting in a series of preliminary safety
recommendations being issued by CENIPA and the NTSB. Among the
recommendations issued to date are: to improve the English language
proficiency of the air traffic controllers; to re-train air traffic controllers on RVSM
operations, including procedures to be followed if an aircraft loses Mode C
(altitude reporting) transponder capability; to modify the air traffic displays to
eliminate confusing and unnecessary height-finding radar data; and to clearly
indicate the loss of secondary radar returns for an aircraft through color coding
or other methods. In addition, the air traffic controllers must be trained to take
aggressive action to locate an aircraft that has been simultaneously or
unexpectedly lost from radar and/or radio contact.
None of the safety recommendations issued to date relate to the conduct
of the pilots of the Legacy, who were not presented with any indications from
the flight instruments that their new aircraft had stopped replying to ATC radar
interrogations or that there was a problem with the avionics. In fact, shortly after
the impact, the pilots of the Legacy confirmed that the Legacy’s Traffic Collision
Avoidance System (“TCAS”) was “on” and the TCAS traffic advisory/resolution
advisory display, which “pops-up” to alert the pilots to conflicting traffic, was still
off. The safety investigation has also confirmed that ATC received a significant
number of the radio calls made by the Legacy before the collision, but failed to
respond.
Certain components of the new Legacy aircraft’s avionics have been
examined by their manufacturer to determine why no warning was given prior to
the collision with the Gol flight. This testing has disclosed a number of
anomalies in the avionics of the Legacy, including the fact that the Radio
Management Unit (“RMU”) and the Communications Unit (“RCZ”), were not new
components. The RMU, which displays the status of the TCAS, had failed and
been removed from two other aircraft before being installed on the “new” aircraft
sold to ExcelAire. The RCZ, which includes the Mode C transponder, had been
rejected from one other aircraft prior to being installed on the Legacy. The
testing has also disclosed errors in the installation of the avionics components,
including the use by Embraer of an “excessive amount” of non conductive
silicone in antenna connections to the transponder. Just two days prior to the
accident flight the Flight Management System (“FMS”) computer failed during a
flight test due to a faulty connector. Numerous faults were also recorded in the
memory of the TCAS unit, including several erroneous air-ground transition
faults that appear to have occurred during the final flight even though the Flight
Data Recorder confirms that the Legacy never deviated from its assigned
altitude. Additional testing of these and other components still installed on the
aircraft is required.
Although there are problems with the avionics of the Legacy, the principal
cause of this accident was the failure of ATC to follow its own rules and
regulations to ensure that the aircraft were properly separated. This accident
occurred under instrument flight rules (“IFR”) in controlled airspace. Under
these conditions, the movement of aircraft, both horizontally and vertically, is
controlled by ATC through the issuance of clearances. A clearance is a
mandatory instruction to the aircraft that must be complied with unless there is
an emergency.
Prior to departure, Embraer electronically transmitted the Legacy’s flight
plan to ATC providing, among other things, the proposed route of flight and
altitudes for the trip from Sao Jose dos Campos (“SBSJ”) to Manaus. This plan
proposed a cruising altitude of 37,000 feet from SBSJ to Brasilia at which point
the Legacy planned to descend to 36,000 feet until reaching TERES, a
waypoint approximately 228 nautical miles northwest of Brazilia. At TERES, the
Legacy planned to climb to a cruising altitude of 38,000 feet until reaching
Manaus. Shortly after takeoff, however, ATC cleared the Legacy to climb and
maintain 37,000 feet, and ATC never directed or authorized the Legacy to
change its cruise altitude at any point after this clearance was issued.
The position of the Legacy was monitored by ATC through its secondary
surveillance radar returns. These returns use information provided by the
aircraft’s Mode C transponder to identify the aircraft on the ATC radar scopes
and provides, in addition, the altitude of the aircraft. This information appears in
a data block on the ATC scopes, which also lists the planned altitudes for the
leg of the flight.
Approximately two minutes before the Legacy reached Brasilia, its data
block indicated that a change in altitude had been planned, yet the controller did
not alter his clearance for the Legacy to maintain its 37,000 feet cruise altitude.
Approximately five minutes after passing Brasilia, and fifty-five minutes prior to
the accident, ATC stopped receiving the Legacy’s Mode C transponder signal.
This loss of the Legacy’s transponder signal is shown in the ATC data block, yet
the controller responsible for the Legacy never communicated this fact to the
Legacy as he was required to do, so that the crew could check their
transponder or switch to another transponder. The controller also failed to
advise any other controllers that the Legacy’s transponder was inoperative or to
coordinate non-radar separation of the Legacy along its planned route of flight.
The loss of the Legacy’s signal occurred while the aircraft was operating
in Reduced Vertical Separation Minimum (“RVSM”) airspace, which requires a
working Mode C transponder on each aircraft as the vertical separation of
aircraft is only 1,000 feet. Once the
Legacy’s transponder signal was lost, the Legacy was no longer permitted to
operate in RVSM airspace. The pilots of the Legacy could not, and did not know
that ATC was not receiving their Mode C transponder signal. The controller
should have directed the Legacy to descend to an altitude where greater
vertical separation of aircraft is provided, which is at or below 35,000 feet. The
controller failed to advise the Legacy to leave the RVSM airspace.
When the Legacy’s Mode C signal was lost, the ATC system
automatically substituted a far less accurate height-finding radar estimation of
the Legacy’s altitude in the data block. The altitude estimated by the heightfinding radar changed with nearly every sweep of the radar, varying
considerably from both the actual altitude and the planned altitude of the
aircraft. The height-finding radar showed altitudes varying from 33,300 feet to
39,000 feet, yet despite the fact that this was apparently occurring in RVSM
airspace, the controller took no action. (Following the accident but before the
Flight Data Recorder was read, investigators actually believed that the Legacy
had been performing acrobatics, presumably based on these erroneous
readings). The loss of Mode C and the wild fluctuations in altitude should have
been noticed by ATC as traffic in that airspace was extremely light at the time.
Thirteen minutes after the Legacy’s Mode C signal was lost, the
controller responsible for the Legacy was relieved. The controller not only failed
to inform his relief that the Legacy’s Mode C signal had been lost, but
erroneously informed his relief that the Legacy was at a cruise altitude of 36,000
feet. The relief controller took no action to confirm the Legacy’s altitude even
though it was apparent from the data block that the Legacy’s Mode C signal had
been lost and its estimated altitude was changing every ten seconds with each
sweep of the scope. At about that time, the controller responsible for the Legacy
should have received information that the Gol flight 1907 was cleared to Brasilia
on the same airway and at the same altitude as the Legacy.
Approximately thirteen minutes after coming on duty, the relief controller
made his first attempts to reach the Legacy by radio. The purpose of those calls
was to advise the Legacy to change to a new ATC frequency. The relief
controller received no response to his calls and the transcript of the Legacy’s
cockpit voice recorder shows that these calls were not received by the Legacy.
Two minutes later, at 19:31Z, radar contact with the Legacy was lost, as the
Legacy’s data block disappeared entirely from the controller’s radar scope. The
controller responsible for the Legacy took no action in response to this inability
to establish radio or radar contact with the aircraft. The near simultaneous loss
of radio and radar contact with the aircraft should have resulted in immediate
and emergency actions by ATC to reestablish contact.
From 19:48Z until 19:52Z, the Legacy made twelve attempts to reach
ATC without success. The crew of the Legacy received a transmission from
ATC at 1953:54Z instructing them to change their frequency, but an immediate
request to repeat the frequency and seven additional attempts to reach ATC by
the Legacy went unanswered. At 19:56:54Z the Legacy and the Gol collided
with tragic consequences.
The materials collected herein provide both a factual background and
expert analysis of the events of September 29, 2006. We have identified the
principal failures of the ATC system that if left uncorrected will continue to
endanger the flying public on the airways of Brazil. With the benefit of hindsight,
we can see the signs, one after another, that should have alerted controllers to
the impending disaster in time to avert it.
The true causes of this accident were systemic, not criminal. If ATC had
simply followed its own rules and regulations as noted in the interim
recommendations from CENIPA and the NTSB, this accident would have been
avoided. By identifying the true causes of this accident, we have the opportunity
to prevent this from ever happening again.
EXHIBIT 1
Joseph Lepore’s Training Record
EXHIBIT 2
Jan Paladino’s Training Record
EXHIBIT 3
Timeline of N600XL’s Flight
EXHIBIT 4
IFALPA’s and APLA’s Safety Bulletins
EXHIBIT 5
CENIPA’s Safety Recommendation
I. SAFETY RECOMMENDATION
A proposal of the accident investigation authority of the State
conducting the investigation, based on information derived from the
investigation, made with the intention of preventing accidents or
incidents. .Ref. ICAO Annex 13.
II. Preliminary safety recommendations
The preliminary safety recommendations issued by the Comission are:
1.
DECEA shall, immediately:
a)
Review the Brazilian AIP, in order to update it, with emphasis on
the inclusion of rules and procedures of the Brazilian Air Traffic Control.
b)
Train the ATCO in the correct procedure accomplishment in the
Air Traffic Control Clearances, as defined in items 8.4.8, 8.4.9 and 8.4.10
of ICA 100-12 AIR RULES AND AIR TRAFFIC CONTROL SERVICES.
c)
Assure the level of English proficiency for all ATCO of the Brazilian
Air Traffic Control System, as well as provide the necessary means to
fulfill the ICAO Annex I SARP and Doc 9835.
d)
Assure the adherence of all ATCO to follow all the Hand-over
procedures for sectors or adjacent centers.
e)
Assure that written procedures for lost of communication are
completely followed by all ATC units.
f)
Assure that all ATCO attend specific ATC rules and procedure
training class, considering the recommendations on letters (b), (c), (d),
and (e) of this document.
g)
Standardize and operationalize the use of OFF SET feature in the
lack of communication and or radar coverage regions.
h)
Implement a new presentation (effective alert system) of loss of
transponder mode “c” in the ATC software in use, in order to increase the
ATCO situation awareness.
EXHIBIT 6
NTSB’s Safety Recommendation
Although the investigation is still in progress, and no cause has yet been
determined, investigators observed numerous potential ATC safety issues:
1.
Safety issue: Automated datablock changes can be easily overlooked
by controllers and are potentially misleading.
Recommendation: Determine the risks and benefits of modifying radar
data processing software to ensure that the contents of the “cleared altitude”
field of ATC data blocks can only be changed by direct action of the controller
having responsibility for the aircraft. Report the findings of the analysis to
DIPAA. If found to be desirable, modify ATC software as described.
2.
Safety issue: Height finder, or 3D, radar values do not indicate aircraft
altitude to the same accuracy as mode C, and can be misleading to controllers.
Although potentially valuable for emergency or air defense purposes, for ATC
purposes, there is no reason to routinely display height-finder information to civil
controllers.
Recommendation: Display height-finder derived altitude to controllers
only upon request through a keyboard entry or other means of selection. When
height-finder data is being displayed, ensure that it is unmistakably
distinguishable from mode C altitude reports received from aircraft.
3.
Safety issue: ATC functions and collision avoidance equipment depends
heavily on properly operating transponders. The length of time that N600XL was
without secondary radar targets was far beyond what would be expected for
momentary radar coverage variations. The controller should have detected this
and contacted the crew to correct the observed problem with the transponder.
Recommendation: Modify display methods to more clearly identify loss
of secondary radar returns from an aircraft, through color-coding or other readily
detectable means.
4.
Safety issue: Document 7030 states that non-radar separation must be
applied to a non-transponder aircraft. Additionally, RVSM requires an operable
mode C transponder. The loss of secondary and mode C returns should have
provoked the controller to revert to standard vertical separation between
N600XL and all other aircraft.
Recommendation: Reinforce RVSM training for controllers, especially
the need to terminate RVSM operations when an aircraft no longer can comply
with the required equipage standards.
5.
Safety issue: N600XL had not responded to radio calls for at least 30
minutes at the time of handoff to Manaus/Amazonia Centre, however this
information was not passed to the Manaus/Amazonia controller. Brasilia should
have advised Manaus/Amazonia that N600XL was not responding to ATC calls
during the coordination call.
Recommendation: Ensure that transfer-of-control procedures between
ATC sectors include the communication of all relevant information about the
aircraft involved, any abnormal communications status, and any uncertainties
about flight data such as assigned route or altitude.
6.
Safety issue: The transponder return from N600XL was not displayed
during the period where the aircraft would have descended to FL360 based on
the datablock. However there was no procedure or action taken to ensure the
aircraft was at the expected altitude. Such a procedure or action should have
detected that N600XL had never left 370 or reported reaching FL360.
Recommendation: Develop procedures to ensure that controllers
actively monitor aircraft altitude, request and confirm altitude changes when in
non-mode C status, and record when aircraft leave and reach assigned
altitudes.
7.
Safety issue: N600XL was without 2-way communications with ATC for
approximately 400 miles. Although ATC made a number of calls to the aircraft,
they were unanswered, and no additional action was taken. With no required
reporting on the part of the crew, they did not detect that communications may
have been lost for about one hour. Also, after the loss of transponder, and
inability to communicate with the crew, the primary radar target also
disappeared, potentially indicating a dire situation for the aircraft (i.e. electrical
failure, forced landing, etc.)
Recommendation: Develop procedures to detect loss of radio
communications with aircraft under CINDACTA control, for example, by
requiring more frequent position reports or requiring controllers to periodically
call each aircraft to confirm radio contact. Direct controllers to aggressively
attempt to re-establish contact with aircraft that appear to be unresponsive,
including attempted relays through other aircraft in the area. Make blind
broadcasts if necessary to advise aircraft of their suspected lost communication
status, and to advise flight crews of status changes such as loss of radar
contact or termination of radar service. Take aggressive action to locate an
aircraft which has been simultaneously or unexpectedly lost from radar and
radio.
8.
Safety issue: When viewing ATC displays, it was not uncommon to for
investigators to observe full datablocks disappearing from display just after
handoff, and prior to crossing a sector boundary, indicating that controllers were
routinely dropping datablocks prior to the airplane exiting the sector. This
practice increases the likelihood that a controller will forget about an aircraft that
is still his responsibility to separate from other traffic.
Recommendation: Ensure that controllers continuously display data
blocks for aircraft operating in their areas of responsibility, even after transfer of
communications to another sector.
9.
Safety issue: Investigators learned that there was no way to record
ATC position relief briefings, in which critical information about the status of
aircraft, navaids, and other flight safety information is relayed between
controllers. An incomplete relief briefing can cause controllers to inadvertently
make incorrect assumptions and instructions.
Recommendation: Establish a checklist for controllers to cover critical
items at position relief briefings, and record briefings in a similar manner to the
recordings of radio communications.
EXHIBIT 7
Article Published in the Newspaper Folha de S. Paulo
EXHIBIT 8