Aviation Investigation Report A99H0001

Canadian Airlines International Flight 987 (CDN 987), a Boeing 767, departed Toronto, Ontario, en route to Vancouver, British Columbia, at flight level (FL) 390. Air Canada Flight 118 (ACA 118), a Boeing 767, departed Calgary, Alberta, en route to Toronto at FL 370. Approximately 55 nautical miles (nm) west of the Langruth, Manitoba, VOR (very high frequency omni-directional radio range), ACA 118 requested and was cleared to climb to FL410. The pilot of CDN 987, when approximately 35 nm west of the Langruth VOR, advised the controller that he was climbing out of FL 390 because of a traffic alert and collision-avoidance system (TCAS) resolution advisory (RA) straight ahead. A loss of separation occurred when the two aircraft passed within 3 nm horizontally with less than 1 000 feet of vertical spacing. The required separation is 5 nm horizontally or 2 000 feet vertically.

Air Traffic Control Services

The two aircraft were being controlled by the Winnipeg Area Control Centre controller responsible for the Gimli high-level en route sector (see Appendix A). CDN 987, westbound and level at FL 390, contacted the Gimli controller at 1046:21 central standard time (CST),^{Footnote 1} shortly after he had taken over the position at approximately 1045. The Gimli controller radar-identified the aircraft, checked the route of flight through the sector indicated on the flight progress strip, and confirmed that there was no conflicting traffic for CDN 987 at that altitude. ACA 118, eastbound and level at FL 370, contacted the Gimli controller at 1053:25 and was radar-identified. The flight progress strip was appropriately marked.

The NAV CANADA Air Traffic Control Manual of Operations (ATC MANOPS) directs controllers being relieved to provide verbal briefings to relieving controllers when requested. Air Traffic Services Administrative and Management Manual (ATSAMM) specifies information that may be included in checklists during transfer-of-position responsibility. Among the items included in ATSAMM 203.2B Note A. are "[p]otential confliction, arrival and departure information, and traffic patterns."

When the Gimli controller took over the Gimli sector approximately 15 minutes before the occurrence, he was briefed by the outgoing controller on a future potential overtake conflict between ACA 118 and another aircraft (C-GMTR) at the same altitude and on the same track approximately 40 nm ahead. Though the potential conflict was not projected to occur within the Gimli sector, it is common practice to provide advance warning to the adjacent sector on situations that may require later attention. Initially, the Gimli controller was briefed that ACA 118 was overtaking C-GMTR with a 10-knot speed differential. However, when he received the handoff for ACA 118 at 1053:25, he saw that the speed differential was approximately 30 knots.

To help identify potential aircraft conflicts, the radar controller has at his or her disposal a tool known as the predict track line. This tool electronically displays a line on the radar indicator module (IM) showing the predicted direction and expected travel distance of an aircraft present-position symbol based on the time (in minutes) entered by the controller. Replay of the radar tape indicates that the Gimli controller used this device at 1053, seven minutes before the conflict, to determine the positions of all aircraft displayed on the IM 10 minutes in the future. At this time, ACA 118 had not yet contacted the Gimli controller. When contact was made, there was no indication that ACA 118 would request an altitude change that would put the aircraft in conflict with CDN 987, which was at a higher altitude.

A second tool available to the radar controller is the range-and-bearing line (RBL). This electronic device displays a line on the IM indicating the range in nm and the relative magnetic bearing of two selected points or targets; the points may be moving or stationary. At 1057:20, the Gimli controller established an RBL between ACA 118 and C-GMTR to monitor their proximity. At the time that the RBL was established between ACA 118 and C-GMTR, CDN 987 was 9 nm south-east of C-GMTR on a westbound heading. The distance between ACA 118 and C-GMTR was approximately 37 nm, which meant that the overtake would not approach a conflict situation until over one hour later, well outside the Gimli controller's area of responsibility. However, at 1058:12, when ACA 118 requested clearance to climb to FL 410, the Gimli controller adopted this altitude change as the solution to the perceived overtake conflict and provided climb clearance immediately at 1058:16. At this point, CDN 987 was 32 nm from ACA 118 on a bearing of 103 degrees magnetic and was 7 nm south-west of C-GMTR. The RBL function was not used between ACA 118 and CDN 987.

Aircraft present-position symbols displayed on the IM are identified by data blocks that contain information about the aircraft, including call sign, altitude, and ground speed. The data blocks are connected to the present-position symbol by a short line and are positioned relative to the present-position symbol, either in a fixed position as determined by the controller or automatically (an auto tag) to avoid overlapping other data blocks in close proximity. When the Gimli controller took over the sector, he did not realize that the auto tag function was not engaged. Use of the auto tag feature is not mandatory.

When CDN 987 passed C GMTR at approximately 1058, the data blocks of the two aircraft partially overlapped. Because the auto tag feature was not selected, the data blocks did not automatically deconflict. As a result, the call sign portion of the data block for CDN 987 was obscured by the altitude readout of C-GMTR and the altitude portion of the data block for CDN 987 was obscured by the present-position symbol of C-GMTR. At the time of the ACA 118 request to climb, at 1058:12, the data blocks of C-GMTR and CDN 987 were still partially overlapping, obscuring parts of both the call sign and the altitude for CDN 987.

At 1100:01, CDN 987 contacted the Gimli controller and reported leaving FL 390 because of a TCAS contact straight ahead, climbing. The pilot of CDN 987 reported that the TCAS had first provided a warning and then changed to an RA, indicating that the traffic was 800 feet below. At that time, he disconnected the autopilot and, in accordance with company policy to adhere to RA directives, climbed the aircraft at maximum performance to comply with the rate commanded by the RA. The Air Canada flight was subsequently acquired visually to the north. After reaching FL 399, CDN 987 returned to the assigned cruising altitude of FL 390. The pilot of ACA 118 reported that the crew had acquired the Canadian flight at approximately 15 miles and received a traffic alert followed by an RA at FL 382. The crew of ACA 118 did not follow the RA directions to descend because they had CDN 987 in sight and were convinced that separation was assured visually. Air Canada policy is that pilots shall follow RA instructions. The installation of TCAS in aircraft registered and intended for flight in Canada is entirely at the discretion of the carrier.

Controller Workload

The traffic volume was described as light to moderate, and all necessary equipment was serviceable and being used as required. The controller's workload leading up to the occurrence was as follows. In the 6 minutes 36 seconds before the TCAS RA declaration by CDN 987, that is, between the check-in of ACA 118 on frequency at 1053:25 and the TCAS call by CDN 987 at 1100:01, the Gimli controller passed or received 13 estimates from adjacent sectors and updated the required flight progress strips. These landline exchanges occupied approximately 3 minutes (45 per cent of the controller's time during this interval). Other routine radio exchanges with various aircraft totalled approximately 41 seconds. Approximately 69 seconds (17 per cent of the available time) was occupied in transmitting non-critical, non-control ride information (turbulence reports) to aircraft. The worst flight condition described was "light chop". A.I.P. Canada defines light chop as turbulence that causes slight, rapid, and somewhat rhythmic bumpiness without appreciable changes in aircraft altitude or attitude. Inside the aircraft, "[o]ccupants may feel a slight strain against seat belts or shoulder straps. Unsecured objects may be displaced slightly. Food service may be conducted and little or no difficulty is encountered in walking."

ATC MANOPS directs controllers to forward weather reports from pilots in flight (PIREPs) to concerned aircraft if the weather is of significance.

The total time spent passing or receiving information via radio to and from aircraft and via landline to and from other sectors totalled 4 minutes 50 seconds (73 per cent of the available time). The last 80 to 90 seconds prior to the TCAS RA (composed of 69 seconds of controller transmissions, approximately 10 seconds of aircraft acknowledgements, and approximately 10 seconds of silence between transmissions) were taken up almost exclusively with exchanges involving non-control, non-critical ride-related information. Additional time allotted to computing estimates, manipulating the computer inputs to the radar data processing system (RDPS), and updating and arranging flight progress strips other than during landline communications is unknown.

Article 131 of ATC MANOPS specifies that control service be given priority over other services. The Air Traffic Control (ATC) service definition in ATC MANOPS rates the passing of flight information, such as information on adverse weather conditions, as having a much lower priority than the provision of instrument and visual control services, such as preventing collisions and expediting traffic. However, because of user expectations and requests for the provision of ride information (though not by the aircraft involved in this occurrence), controllers habitually provide it. Interviews with controllers during this and other investigations have indicated that this expectation can be a serious distraction from the business of providing aircraft separation. In the 1990 Report on a Special Investigation into Air Traffic Control Services in Canada, the Canadian Aviation Safety Board (CASB) noted that "the multiple tasks of the controller (i.e., monitoring, communications, flight data preparation, interaction with the computer, etc.) are all highly vulnerable to distraction." In general, when a sector is staffed with a radar and a data controller, the radar controller has the time to provide this desired information.

Controller Work History

NAV CANADA Functional Goal #1, from NAV CANADA Focus on Safety in ATS (Information Bulletin ATSI - 9702, 02 October 1997), requires that controllers provide full-time, attentive flight monitoring and flight information services. All other assignments are secondary. In the analysis of Functional Goal #1, NAV CANADA noted that "many occurrences are primarily a result of 'acts of omission' or 'lack of attention.' These situations often arise because an individual's attention is diverted by items having a much lower priority." Acts of omission and lack of attention can also arise because of decreased arousal due to low workload.

The Gimli controller was the sole worker in the Gimli sector, performing both the radar and data controller duties, and was fully qualified to perform both duties. Single-staffing of the Gimli sector is a normal practice and meets NAV CANADA's defined staffing standards. The Gimli controller had 26 years' experience as an instrument flight rules controller and had worked in the Winnipeg specialty, of which Gimli is one of the sectors, for 18 years. The Winnipeg specialty has four sectors, each of which is configured for a radar and a data controller, for a total of eight working positions. Gimli and Dryden are high-level sectors; Winnipeg East and Winnipeg West are low-level sectors. Winnipeg East and Winnipeg West sectors were also single-staffed at the time of the occurrence. Staffing during this time of the day provides six controllers and two supervisors, one designated to provide relief breaks and the other as a stand-back supervisor. However, the stand-back supervisor was working a control position (the combined radar and data positions in the Winnipeg West sector) when the loss of separation occurred. The assignment of a supervisor to a control position to provide position relief breaks is a common event.

The Gimli controller had been on duty for 4 hours 15 minutes since the beginning of his shift and had been in the Gimli sector for 15 minutes since his last break. He was on the first day of normal shift work. However, he had worked an overtime shift the previous day, from 0945 to 1800. This afforded 12 hours 45 minutes off between shifts. He slept for approximately 6 hours during this period, his normal night-time sleep duration. He had worked 6 of the previous 7 days. In the previous 32 days, he had worked 16 regular shifts, 6 scheduled overtime shifts, and 2 unscheduled overtime shifts. The labour contract between NAV CANADA and the Canadian Air Traffic Control Association specifies that employees' days of rest shall be consecutive and not less than two. On only two occasions in the previous 32 days had the Gimli controller had at least two consecutive days off. Large amounts of overtime and limited consecutive days off were not unusual in the Winnipeg Area Control Centre during the previous year. The labour contract between NAV CANADA and the Canadian Air Traffic Control Association specifies that controllers shall work an average of 34 hours per week. The contract specifies that this is a weekly average over one year. Over the previous 32 days, under normal circumstances, that average would total approximately 155 hours. The Gimli controller worked 198 hours during this period. During the previous 32 days, he was on duty from 14 to 16 hours in a 24-hour period on 6 occasions, with less than 10 hours off between those shifts. On 3 of those occasions, the 8-hour sleep opportunity had occurred during the afternoon and early evening, when sleep is usually shorter and less restorative.

Behavioural indicators of sleep debt or fatigue^{Footnote 2} include poor executive function (planning), misallocation of attentional resources, degraded ability to integrate information, narrowed attention (which leads to forgetting or ignoring important tasks), and reduced ability to divide mental resources among different tasks (reduced parallel processing ability).

The number of hours that controllers may work during a time interval is at the discretion of the employer, within limits set by labour contracts. In the 1990 Report on a Special Investigation into Air Traffic Control Services in Canada, the CASB noted that:

• Excessive reliance on overtime presents serious potential for controller fatigue and may exacerbate the current staffing shortage through increased sick leave and, ultimately, increased controller attrition. To achieve a safer and more equitable distribution of the workload, the CASB recommends that:
  • The Department of Transport set a limit on the number of work shifts permissible in a nine-day cycle, the minimum number of days off between shift cycles, and the maximum number of hours worked in any 24-hour period.

  • CASB 90-15

Transport Canada accepted this recommendation in principle. However, no limits were established.

In the same report, the CASB noted that:

• Given the frequency of inattention errors, decision-making errors, information transfer and coordination problems, etc.; given the naturally fatiguing effects of a rotating shift cycle; and given the exacerbating effects of the current workload and overtime situation, further restrictions on the work-rest cycles are required. In addition to the restrictions recommended in CASB 90-15, the CASB recommends that:
  • The Department of Transport make and enforce further restrictions on:
  • the maximum number of hours which can be worked at a particular control position without a relief break; and
  • the minimum number of rest hours between shifts.

  • CASB 90-37

Transport Canada rejected this recommendation on the premise that the contract was being honoured and that current practices did not affect safety. Because current practices were acceptable to both the employer and the Canadian Air Traffic Control Association, they would continue. The agreement between NAV CANADA and the Canadian Air Traffic Control Association ratified on 13 August 1999 requires a minimum of 10 hours between shifts and the establishment of a committee consisting of the two parties together with Transport Canada to study several issues, including shift work and fatigue. The agreement further specifies that Transport Canada act on recommendations through the regulatory process.

TSB Investigation Reports A93C0208, A94C0232, A96O0196, A97P0153, A97A0150, A97H0006, A98H0002, and A98H0004 and SECURITAS Report A99Z0015 have dealt with issues of excessive overtime, understaffing, lack of relief breaks, inadequate rest periods, and controller fatigue.

Prior to assuming duties in the Gimli sector, the Gimli controller had been on a relief break. During the break, he had been in informal discussions with management concerning a proposal to change the sector boundaries of parts of the Winnipeg airspace. This plan, to be implemented in the near future, was a source of considerable controversy among controllers. The Gimli controller was concerned that the change could adversely affect controller training and job satisfaction.

Conflict Alert

The original performance specifications for the ATC RDPS software included provisions for aircraft conflict detection and alerting. During testing in the late 1980s and early 1990s, the RDPS conflict alert function was found to have several faults and was not considered acceptable for operational use. This function is not yet in operational use. The CASB recommended, in 1990, that:

The Department of Transport accelerate all technical initiatives with a potential for providing controllers with automated conflict prediction and alerting.

CASB 90-36

Transport Canada accepted the recommendation and advised that minimum sector altitude warning systems / conflict alert would be implemented "as the Radar Data Processing Systems are brought online with the introduction of the Radar Modernization project beginning in June 1990." Early in 1997, NAV CANADA advised that the unavailability of the conflict alert feature of the RDPS was an ongoing issue. The conflict alert feature was still under development. It was hoped that the feature would be available with the 700 version of the RDPS software then scheduled for release in the fall of 1997. Early in 1998, NAV CANADA advised that software testing of this functionality was currently underway and on-site testing was planned for the fall of 1998. Operational acceptance was expected to be lengthy. Software testing of the conflict alert functionality is still underway. NAV CANADA, in its Corporate Safety Plan 1998/99, stated that it is committed to "the national installation of minimum sector altitude warning systems/conflict alert (MSAW/CA) on existing surveillance systems." No implementation date was mentioned, nor was there an indication of what resources were to be dedicated to the realization of this commitment.

During the investigation of this occurrence, the recorded radar information was played back to determine time sequences and keyboard inputs of the controller. The radar recording is designed to record exactly the keying sequences and the IM indications as seen by the controller. However, the RBL line did not show during the replay, even though the RBL keying indications and the movement of the position entry device, the mouse pointer, did indicate that the two aircraft, ACA 118 and C-GMTR, had that function applied to them. The RBL functioned appropriately when activated prior to the occurrence.

The Gimli radar controller had before him all the information required to detect and resolve the conflict between ACA 118 and CDN 987 well before the loss of separation occurred. The IM display of the targets, notwithstanding the temporary partial obscuring of the data block for CDN 987, together with the flight progress strip information available to him provided the data necessary to plan, execute, and monitor aircraft separation.

The shift record and the reports of the Gimli controller indicate that he had worked several extra overtime shifts in the immediate past. An irregular shift rotation had likely disturbed circadian rhythms, and this, together with a regular sleep period of six hours, may have contributed to a sleep debt.

The first error leading to the loss of separation was the clearance for ACA 118 to climb to FL 410. Since the take-over briefing given by the previous controller, the Gimli controller had been contemplating the eventual conflict that was to be created by the overtaking of C-GMTR by ACA 118. (Preoccupation with a single task demonstrates misallocation of attentional resources.) When ACA 118 requested a climb to FL 410, the Gimli controller forgot the opposite direction traffic, CDN 987 at FL 390 (lapse of memory). He immediately adopted that altitude change as the solution to the perceived problem, without conducting the appropriate scan of the IM for possible conflicting traffic. (Loss of situational awareness shows a degraded ability to integrate information.)

Having issued a climb clearance to ACA 118 (the plan and execute portions of the separation process), the Gimli controller's next responsibility was to monitor the progress of that clearance. The Gimli controller was controlling only a light traffic load. Being an experienced controller, he expected that he would be able to provide the same level of service to the aircraft under his control, even though he was performing the combined duties of the radar and the data controller. When a controller must perform both jobs at the same time, the established habit of providing "nice-to-have" information may be difficult to break. Furthermore, strong habit intrusion is particularly likely to occur when fatigue is present. The Gimli controller concentrated on providing ride information to aircraft when he should have been attending to the separation of aircraft (perseveration).

The schedule and sleep opportunities experienced by the Gimli controller reflected a pattern known to result in an elevated on-the-job error rate. The clearance that led to the conflict, the forgetting of the position of CDN 987, and the provision of ride information while the conflict was developing are all consistent with fatigue but were not sufficient to prove that the errors were necessarily fatigue induced. Although the Gimli controller had been on a relief break only 15 minutes prior to the loss of separation, he had not rested during the break. Instead, he had engaged in a potentially stress-producing discussion with management. Without disengagement of attention for relaxation and recovery, there is little or no recovery during a break.

The common practice of single-staffing sectors within the Winnipeg specialty of the Winnipeg Area Control Centre led to a situation in which the controller was left to control traffic with no ground-based human or electronic back-up.

Transport Canada previously rejected the CASB recommendation to make and enforce restrictions on hours of work, on the premise that the contract was being honoured and that current staffing practices did not impact on safety. At the time of the CASB safety recommendation, Transport Canada was both the employer and the regulator of the ATC system.

The TCAS fitted in the occurrence aircraft provided the conflict alert and resolution solution in the absence of that function by the air traffic service.

Findings as to causes and contributing factors

1. The Gimli controller did not perform a suitable scan of the IM for conflicting traffic prior to issuing climb clearance to ACA 118.
2. The traffic volume was light to moderate. However, in the 6 minutes 36 seconds before the occurrence, the Gimli controller was occupied for at least 73 per cent of the time in passing and receiving estimates via landline, in routine exchanges with other aircraft, and in passing non-control ride information to aircraft. The latter consumed most of the final 80 to 90 seconds prior to the occurrence.
3. In the previous 32 days, the Gimli controller had worked significant amounts of overtime, had worked several periods with minimal time off between shifts, and on only two occasions had experienced 2 or more consecutive days off.
4. The Gimli controller's behaviour before and during the occurrence was consistent with the behaviour of a person experiencing fatigue. Fatigue was probably a factor in this occurrence.
5. The circumstances of the Gimli controller's work-rest cycle increased the risk of an occurrence resulting from fatigue-induced errors.
6. Though planned for implementation to meet air traffic service needs in the early 1990s, a functioning, automated conflict prediction and alert tool, as recommended by the CASB in 1990, was not available.
7. The passing of lower-priority ride reports distracted the controller from higher- priority separation tasks, such as radar monitoring during the climb of ACA 118. Strong habit intrusion, possibly facilitated by fatigue, likely caused him to pass these reports of light turbulence which were not safety-imperative.
8. The designated stand-back supervisor was working at another sector at the time of the occurrence; therefore, a potential level of defence was not in place.
9. The controller involved in this occurrence was qualified and current at the position.
10. All control equipment available to the controller was serviceable and being used.
11. Staffing in the sector met unit standards. The Gimli sector was often staffed with one controller performing both the radar and the data tasks.
12. The radar replay of the occurrence did not indicate the RBL that the controller used to determine the distance between ACA 118 and C-GMTR.
13. The crew of CDN 987 complied with company policy regarding TCAS RAs. When the crew of ACA 118 did not take the action called for in the TCAS RA, they increased and prolonged the requirement for CDN 987 to take evasive action.

Action Taken

The Canadian Air Traffic Control Association and NAV CANADA concluded a collective agreement which increased the minimum time between shifts from 8 hours to 10 hours and reduced the maximum consecutive hours of work from 12 hours to 11 hours.

NAV CANADA has initiated a process to reduce the number of extended shifts worked by controllers. As well, NAV CANADA has adopted a policy of staffing all air traffic services units to 105 per cent of NAV CANADA's defined staffing levels and has committed 50 million dollars annually to training in order to reach this goal.

Action Required

Risk-of-collision occurrences between large transport-category aeroplanes operating in a radar environment continue to occur in Canadian airspace. There are several ground and airborne layers of defence to prevent midair collisions caused by human errors. The last available ground-based defence that could have prevented this occurrence, human redundancy, was absent because the sector was operated by only one controller and the supervisor was actively controlling at another position. The TCAS provided an airborne defence that alleviated this dangerous situation. However, reliance on a TCAS as the sole automated defence against human error leading to midair collisions does not provide protection for all Canadian passenger-carrying aircraft. There are no Canadian regulatory requirements for TCAS installation on domestic, passenger-carrying aeroplanes, and there are no requirements for TCAS on any cargo aeroplanes.

The TSB has investigated other similar loss-of-separation occurrences (A98H0002, A97H0007, and A99W0064, under investigation) that contain many of the same elements addressed in this report. In the most recent occurrence (A00H0002, under investigation), two Airbus A340 aeroplanes were at the same altitude on undetected collision courses over the Gulf of St. Lawrence when the pilot of one aeroplane received a TCAS advisory and alerted the controller. These occurrences raise concerns about the lack of adequate, ground-based, conflict prediction and alerting systems in Canada.

The CASB identified the need to develop and install automated conflict prediction and alerting systems in the Canadian air traffic services system in its recommendation CASB 90-36. Although work has been ongoing over the years by Transport Canada, and most recently by NAV CANADA, there are no definitive commitments to set an implementation date.

There are serious consequences to midair collisions between large transport-category aeroplanes. Additionally, there is a lack of sufficient ground-based defences to contain normal levels of human error, which may lead to losses of separation. Therefore, the Board recommends, for the consideration of both NAV CANADA and the Minister of Transport, that:

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 13 June 2000.

Appendix A—Gimli Sector

Image

Appendix B—Glossary

ACA 118

Air Canada Flight 118

ATC

Air Traffic Control

ATC MANOPS

Air Traffic Control Manual of Operations

ATS

Air Traffic Services

ATSAMM

Air Traffic Services Administrative and Management Manual

CASB

Canadian Aviation Safety Board

CDN 987

Canadian Airlines International Flight 987

FL

flight level

IM

indicator module

N

north

nm

nautical miles

PIREPs

pilot weather reports

RA

resolution advisory

RBL

range-and-bearing line

RDPS

radar data processing system

TCAS

traffic alert and collision-avoidance system

TSB

Transportation Safety Board of Canada

UTC

coordinated universal time

VOR

very high frequency omni-directional radio range

W

west

°

degrees

′

minutes