Aviation Investigation Report A01C0155

Air Canada flight ACA3578, an Airbus A320, departed Calgary, Alberta, en route to Toronto, Ontario, at flight level (FL) 370. Northwest Airlines flight NWA853, a Boeing 757, departed Detroit, Michigan, en route to Anchorage, Alaska, at FL350. Both flights were under radar control. NWA853 requested and received clearance to climb to FL370 approximately 43 nautical miles (nm) southeast of the Red Lake, Ontario, VOR (VHF omnidirectional range). When NWA853 was approximately 35 nm southeast of the Red Lake VOR, the air traffic controller noticed that the two flights were at the same altitude, travelling toward each other on reciprocal tracks. He issued instructions to reestablish separation, but the two aircraft passed with 1.5 nm horizontal and 600 feet vertical spacing. The required minimum separation was 5 nm horizontally or 2000 feet vertically.

Winnipeg Area Control Centre (ACC) is organized using a number of specialties, each responsible for a portion of the airspace comprising the Winnipeg Flight Information Region. Saskatchewan, Ontario, and Winnipeg are three of these specialties. Each specialty is divided into sectors, each of which is responsible for a portion of the airspace. On the evening of the occurrence, the Winnipeg specialty had four sectors open: East low-level, West low-level, Gimli high-level, and Dryden high-level. The occurrence took place in the Dryden high-level sector.

Winnipeg ACC was undergoing airspace restructuring as part of a national airspace reorganization plan. With airspace restructuring, new controllers were being qualified in only low- or high-level airspace operations, but not both, while some controllers who were trained before the restructuring were still dual-qualified in low- and high-level airspace. Nav Canada management and the Canadian Air Traffic Control Association agreed that dual-qualified controllers would normally work in only low- or high-level sectors during a shift, but not both. This agreement also included a provision that permitted team supervisors to work low- and high-level sectors during a shift. Because new controllers were not dual-qualified and because dual-qualified controllers normally did not work both low- and high-level sectors during a shift, staffing requirements were elevated. However, the number of available controllers did not increase correspondingly. Staffing requirements were expected to be temporarily increased only during the restructuring phase and were expected to return to normal when the restructuring was completed. Consequently, Winnipeg ACC was understaffed.

The shift schedule for the Winnipeg specialty required nine controllers on the evening of the occurrence: four in the high-level sectors, four in the low-level sectors, and one as the team supervisor. Only seven qualified controllers were on duty; the specialty was missing one low-level controller and the team supervisor. One high-level controller, who was dual-qualified was designated as the acting team supervisor, enabling him to work low- and high-level sectors during the shift. The shift manager expected that the acting supervisor would be controlling and did not expect him to perform any supervisory duties. The acting team supervisor also understood that he was expected to be controlling and not perform any supervisory duties. Therefore, the specialty had three controllers working low-level sectors, three working high-level sectors, and the acting team supervisor working either low- or high-level sectors, as required, during the shift.

The Saskatchewan and Ontario specialties were also understaffed: Saskatchewan by four controllers and Ontario by three controllers. Winnipeg ACC traffic capacity was reduced because of staff shortages, and air traffic flow management restrictions had been implemented. These restrictions required the Winnipeg specialty controllers to provide the Ontario and Saskatchewan specialties with 20 nautical miles (nm) longitudinal separation between aircraft at the same altitude on similar tracks, and to deny aircraft direct routings or clearance to fly at altitudes inappropriate for the direction of flight.

The two flights involved in the occurrence were controlled by the Dryden sector controller, who was working the radar and data positions of the sector. It is an accepted and common practice for a controller to work radar and data positions simultaneously. Factors considered when deciding whether a controller will work both positions are traffic conditions, controller experience and capabilities, controller workload, and available staff. Traffic was assessed as heavy, with high complexity and high workload. Twenty minutes before the occurrence, the controller had moved from one control console to another so that maintenance could be carried out on the first console to correct a display problem. All necessary equipment was serviceable at the console to which he moved. When the Dryden controller moved, a second controller working at another console asked him whether he needed someone to work the data position. The Dryden controller stated that he would get established at the new console, then assess the need for a data controller. Once established at the new console, he became absorbed in his control duties and did not assess the need for assistance.

At the time of the occurrence, two of the three high-level controllers in the Winnipeg specialty were working the two high-level sectors; the third high-level controller was on a break. The acting team supervisor was working a low-level sector. Standback supervision was not provided.

The Dryden controller had 21 years experience, with 7 years as an instrument flight rules controller. He was dual-qualified and scheduled to work only high-level airspace on the day of the occurrence. The controller was qualified for radar and data positions. He was on his second day of work after four days leave and five days off. He had been on duty for seven hours since the beginning of his shift and had taken a 15-minute rest break before taking over the Dryden sector. He had been working the Dryden sector for about one hour at the time of the occurrence.

At 2012:24 central daylight time,^{Footnote 1} the Dryden controller agreed with the sector to the east to have an eastbound aircraft descend from flight level (FL) 390, an altitude inappropriate for direction of flight; at 2014:00, he cleared it to descend to FL370, an appropriate altitude. At 2024:07, he denied a request from a westbound aircraft for a direct routing to a position well to the west, mentioning the flow restrictions as the reason for the denial. These two control actions indicate that the controller was aware of air traffic flow management restrictions.

ACA3578 was at FL370 eastbound toward the Red Lake VOR (VHF omnidirectional radio range) and was cleared after Red Lake to Sioux Lookout and then to the Marathon VOR, as was shown on the flight progress strip. At 2023:35, ACA3578 was about 10 nm west of Red Lake and requested clearance to proceed direct to Marathon. The controller told the aircraft to stand by.

At 2024:15, NWA853 was at FL350 and about 45 nm southeast of Red Lake, between Sioux Lookout and Red Lake, flying northwest toward Red Lake. NWA853 told the controller that they were experiencing turbulence and requested clearance to climb to FL370. The climb was requested for passenger comfort rather than for safety of flight. The controller confirmed with ACA3578 that there was no turbulence at FL370 and used projected track lines (PTLs) from the targets of ACA3578 and NWA853 on his radar indicator module (IM) to make a traffic conflict assessment. PTLs are updated with each radar scan and are based on current track and ground speed; the track projection will not display an impending flight-planned turn. At that time, ACA3578 was still flying eastward toward Red Lake, and the PTLs displayed a projected track for ACA3578 eastward past Red Lake. The controller did not look at the flight progress strip for ACA3578 to confirm its routing after Red Lake. Based on the PTLs, he assessed that adequate spacing between the two flights would be maintained. At 2024:30, the controller cleared NWA853 to climb to FL370.

From 2024:58 until 2026:30, the Dryden controller coordinated the NWA853 altitude change with sectors to the west and north. He also received approval from the sector to the east to clear ACA3578 direct to Marathon. At 2026:25, NWA853 levelled off at FL370.

Canadian Aviation Regulation (CAR) 602.34 requires that aircraft operate at altitudes appropriate to the direction of flight, unless another altitude is assigned by air traffic control (ATC). Air Traffic Control Manual of Operations (ATC MANOPS) 432.2.C permits controllers to assign an altitude inappropriate to the direction of flight if a pilot requests it because of turbulence, provided that the pilot informs the controller of the time at which the flight can be cleared to an appropriate altitude and provided that the altitude has been approved by the affected sectors. After NWA853's request for FL370, an altitude inappropriate for the direction of flight, the crew indicated that they could accept FL390, the next higher appropriate altitude, in about 30 minutes. Controllers of the affected sectors to the west and north approved the wrong-way altitude.

ATC MANOPS 432.3 requires that, when applying section 432.2.C, a controller must issue radar vectors or offset tracks to establish an aircraft at least 5 nm from the centreline of the airway. "This procedure is intended to maintain controller involvement and provide an additional margin of safety while aircraft are operating on wrong way altitudes." The controller did not issue any instructions to offset NWA853 from the airway.

When a cruising altitude inappropriate to the aircraft track is assigned, ATC MANOPS 432.6 requires controllers to post warning indicators by circling the altitude in red on the flight progress strip. The altitude "370" on the flight progress strip for NWA853 was circled in red.

Air traffic controllers issue clearances and instructions to pilots to achieve control objectives. Pilots are required to comply with all clearances received and accepted by them and are required to comply with all instructions directed to and received by them. Clearances are authorizations; instructions are directives.

At 2026:35, just as the controller was beginning to issue a direct-to-Marathon clearance to ACA3578, he saw on the IM that the two flights were on reciprocal tracks at the same altitude. He immediately issued instructions to ACA3578 to turn left 15° and cleared NWA853 to maintain FL350. ACA3578 turned as instructed; NWA853 questioned the controller about the descent clearance and did not immediately descend. The controller made a second more direct, but ambiguous, transmission instructing NWA853 to descend, followed by a third, very clear and urgent transmission instructing them to descend. At 2027:18, after the third transmission, NWA853 commenced a descent.

Pilots and controllers form mental pictures of the relative positions of aircraft to assist them in understanding an overall traffic situation. When involved in a communication exchange, pilots and controllers usually process received information using mental expectations that seem most appropriate for the activity they are performing at the time of the communication. If a message is unexpected or unusual, the mental expectation held by the information receiver may hinder understanding of the message and could delay a response to new information. NWA853 had been level at FL370 for only 18 seconds when the controller cleared NWA853 to descend to FL350; the crew was not aware of oncoming traffic and was not anticipating a descent clearance.

ATC MANOPS 507.1 instructs controllers to "issue a safety alert to an aircraft if you are aware the aircraft is at an altitude which . . . places it in unsafe proximity to . . . another aircraft." The specific phraseology used in such a situation is "traffic alert (position of traffic, if time permits), advise you turn right/left (specific heading, if appropriate), or climb/descend (specific altitude, if appropriate) immediately." The Dryden controller did pass traffic information to both flights but did not use ATC MANOPS 507.1 safety alert phraseology to emphasize the urgency of the situation.

In 1997, TSB issued Aviation Safety Advisory 970038 suggesting that Nav Canada may wish to consider additional means of emphasizing the special need for standard safety alert phraseology. This safety advisory followed an investigation of a number of occurrences in which controllers did not use safety alert phraseology specified in ATC MANOPS 507.1 in situations that should have evoked a sense of urgency. Nav Canada took action by issuing Air Traffic Services Bulletin 9801 about safety alert phraseology and by making this subject a mandatory portion of refresher training given to controllers in 1998/1999. The occurrence controller received this refresher training in February 1999.

Both aircraft involved were equipped with traffic alert and collision-avoidance systems (TCASs); CARs do not require TCAS to be installed in aircraft flying in Canadian airspace. TCAS is designed to operate independently of ATC and provides traffic alerts (TAs) and resolution advisories (RAs) to a flight crew. TAs are intended to help crews see conflicting traffic and to alert them to the possibility of an RA. RAs warn crews of potential collisions and provide descent or climb commands to enable them to avoid an intruder aircraft. TCAS uses a datalink between aircraft transponders to provide complementary RAs (one aircraft climbing and one aircraft descending).

About 20 seconds after the controller identified the conflict and issued instructions, both flight crews received TCAS TAs. About 20 seconds after the TAs, both crews were following the controller's instructions when they received RAs. ACA3578 received an RA to descend, and NWA853 received an RA to climb; the controller had instructed NWA853 to descend. Each crew independently decided to disregard the RA commands because they were each aware of the controller's instructions to the other crew and were each already following the controller's instructions. CARs do not compel pilots to comply with RA commands. Air Canada's flight operations manual states that "compliance with TCAS RESOLUTION ADVISORY commands is mandatory, unless, in the opinion of the Captain, doing so would compromise the safe operation of the flight, or unless the flight crew has better information . . . about the intruder causing the RA." The Northwest Airlines flight operations manual states that "compliance with RA guidance is mandatory to ensure safe separation." Northwest Airlines Boeing 757 Operating Procedures state that "during the RA, pilots must maintain situational awareness . . . TCAS is simply another ‘tool' to help reduce the collision potential." CARs require flight crews to report a deviation from a clearance in response to a TCAS RA; however, no report is required if there is no deviation in response to an RA. Neither flight crew reported a RA to the controller.

The minimum spacing between the flights occurred at 2027:42; NWA853 could see ACA3578, although ACA3578 never did see NWA853. At 2027:47, the controller cleared ACA3578 to proceed direct to Marathon. NWA853 levelled off at FL350 at 2028:44.

The acting team supervisor was working at the Winnipeg West low-level sector and was alerted to the occurrence by a change in the Dryden controller's voice. He instructed the controller working the Winnipeg East sector to monitor the West sector and left his position to inform the shift manager of the occurrence. By the time the shift manager and the acting team supervisor arrived at the Winnipeg specialty, the occurrence controller was handing over the Dryden sector to a controller who had just arrived from the break room. The occurrence controller was removed from control duties once the sector handoff had been completed.

The original performance specifications for the ATC radar data processing system (RDPS) software included provisions for aircraft conflict alerting. During testing, the RDPS conflict-alert function was found to have several faults and was not considered acceptable for operational use. This function was still not operational at the time of this occurrence. In the investigation report on occurrence A99H0001, involving a loss of separation between two Boeing 767 aircraft west of Langruth, Manitoba, TSB made a recommendation for the consideration of both Nav Canada and Transport Canada that:

When NWA853 requested a climb to FL370, the controller used the PTL function to assess the situation; therefore, he was aware of a potential conflict with ACA3578. Because PTLs are based on current track and ground speed rather than a flight-planned track, the PTL for ACA3578 extended east past Red Lake, rather than southeast toward Sioux Lookout. ACA3578 had just requested direct to Marathon, and the controller did not confirm the routing on the ACA3578 flight progress strip. Consequently, the controller's mental picture of the track of ACA3578 was eastward from Red Lake, likely replacing any previous knowledge of the flight-planned route to Sioux Lookout. As a result, he assessed that ACA3578 would not conflict with NWA853 at FL370.

Vertical separation of aircraft travelling in opposite directions provides a defence against loss of separation, risk of collision, and collision. Because the controller approved a wrong-way altitude for NWA853, this defence was negated. ATC MANOPS provides an additional procedural defence of a red circle around the flight progress strip altitude and 5 nm track offsets when a wrong-way altitude is in use. The controller circled the flight progress strip altitude in red but did not issue instructions to offset NWA853 from the airway. A second defence against risk of collision was thus negated.

The Winnipeg specialty was short staffed, and there was no standback supervisor to monitor the controller's workload and provide assistance before or at the time of the occurrence. Because no second controller was performing data position duties, the controller's workload was increased and the time available for flight monitoring was reduced.

The controller was aware of air traffic flow management restrictions. However, despite the restrictions, he approved a wrong-way altitude for NWA853 and took steps to provide a direct routing for ACA3578. From 2024:58 until 2026:30, the controller was occupied with activities related to the wrong-way altitude for NWA853 and the direct routing for ACA3578. Because of these activities, his attention was likely diverted from monitoring traffic on the IM at a time when a conflict between NWA853 and ACA3578 could have been more easily resolved.

Diverting attention away from the IM for any length of time breaks down the defence afforded by effective scanning techniques. Without other defences in place, such as automated conflict alerting or a second controller working the data position, the controller's attention was not directed back to a developing conflict.

When the controller's attention was directed back to the IM, he recognized a conflict and took measures to separate the aircraft. He did not use safety alert phraseology, but his instructions to ACA3578 were effective in that the aircraft did turn. NWA853 had just levelled off at FL370 when cleared to maintain FL350. The crew were not expecting a descent clearance, nor were they aware of oncoming traffic; therefore, the controller's issuance of a descent clearance was not compelling enough to trigger an immediate corrective response. Rather than accepting and complying, NWA853's initial response was to question the descent clearance. The query prompted the controller to issue an ambiguous instruction to descend, followed shortly by a very clear instruction to descend. The initial use of a descent clearance, rather than safety alert phraseology, increased the time needed to achieve the required spacing between the two aircraft and increased the time the two aircraft were at risk.

TCAS operates independently of ATC and produces complementary RAs for each aircraft involved. Because of the independent operation of TCAS, the controller could not know when a TCAS RA would occur and also could not know that the TCAS RA would contradict instructions he issued. Because TCAS and ATC are not coordinated and because each crew decided independently on their course of action, there was a chance that one crew would follow the controller's instructions and that the other crew would follow the TCAS commands, thereby negating the defence of complementary TCAS commands and increasing the risk of collision.

Findings as to causes and contributing factors

1. The controller cleared NWA853 to an altitude inappropriate for direction of flight, did not issue instructions to establish NWA853 five nautical miles offset from the airway, and did not monitor the flight paths of NWA853 and ACA3578 closely enough to prevent a loss of separation.
2. The controller's expectation that ACA3578 would track eastward from Red Lake was incorrect. He therefore did not recognize the need for a separation plan in conjunction with a wrong-way altitude clearance for NWA853.
3. The controller's workload was assessed as high, with high complexity. He further increased his workload by approving the wrong-way altitude for NWA853 and by coordinating a direct routing for ACA3578. High workload reduced the time available for monitoring the flight paths of NWA853 and ACA3578.
4. The Winnipeg specialty was understaffed by two controllers, resulting in increased workload for controllers on duty.

Findings as to risk

1. At the time of the occurrence, an automated conflict alerting system was not available to alert Canadian controllers of impending air traffic conflicts.
2. The time that the two aircraft were exposed to a risk of collision was increased because the controller did not use standard safety alert phraseology.
3. The practice of combining radar and data positions in a sector reduces the opportunity to detect conflicts and take timely action to prevent losses of separation.
4. Risk of collision was increased because TCAS and air traffic control are not coordinated. Each flight crew independently decided to disregard the TCAS resolution advisory commands because they were contradictory to instructions the controller had already issued.
5. At the time of the occurrence, there was no standback supervision in the Winnipeg specialty. The acting team supervisor was not expected to function as a supervisor, was working at a control position before and during the time of the occurrence, and was unable to adequately carry out any supervisory function.
6. CARs do not require traffic alert and collision-avoidance systems (TCASs) to be installed in aircraft flying in Canadian airspace.

Other findings

1. The controller refresher training on safety alert phraseology was not effective.

Safety action taken

As of July 2002, automated conflict prediction and alerting capability has been implemented in both Moncton and Edmonton ACCs, and is being implemented in Winnipeg ACC. The Board is pleased with progress made to date by Nav Canada and looks forward to implementation of conflict prediction and alerting capability throughout the entire system.

On 27 September 2002, Transportation Safety Board sent an Aviation Safety Advisory (615-A020026) to Transport Canada suggesting that they may wish to review current regulations and TCAS guidance material with a view toward developing clear procedures to prevent a risk of collision in the event of conflict between ATC instructions and TCAS RA commands.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 21 August 2002.

Appendix A

Image