Aviation Investigation Report A03H0001

Lufthansa Airlines flight 8161 (DLH8161), a MD-11, was en route from John F. Kennedy International Airport, New York, USA, to Frankfurt/Main International Airport, Germany, via the TUSKY intersection direct to 48° north 050° west, at flight level 330. DLH8161 was expecting a clearance to climb to FL350 for the oceanic crossing. Continental Airlines flight 65 (COA65), a Boeing 757-224, was en route from Lisboa, Portugal, to Newark, New Jersey, USA, via 48° north 050° west direct the Torbay very high frequency omni directional range direct TUSKY intersection, at flight level 330.

When the aircraft were approximately 100 nautical miles apart, the controller issued a climb clearance to DLH8161 to provide the required separation. However, the radio frequency used to communicate with DLH8161 had failed as a result of a problem in the landline connecting Gander Area Control Centre with the peripheral station used for radio transmissions, and the clearance did not reach the crew. The aircraft were approximately 30 nm apart before radio contact was restored using alternate means, and the controller cleared DLH8161 to climb to flight level 350. At about the same time, a supervisory controller, using a backup radio, issued a clearance to COA65 to descend to flight level 320. The aircraft had four nautical miles lateral and 3000 feet vertical spacing when they passed, at approximately 1200 Newfoundland standard time. The radar separation minima of five nautical miles lateral or 1000 feet vertical between the aircraft was not assured until after radio contact was restored.

At the time of the occurrence, the Gander, Newfoundland and Labrador, high domestic airspace comprised four sectors. The occurrence took place in the most southerly sector which extended horizontally from St. Anthony, Newfoundland and Labrador, to the southern boundary of Gander controlled airspace, a distance of approximately 450 nm, and vertically above flight level (FL) 280. This airspace was south of and outside of that day's organized track structure, and contained a mixture of eastbound and westbound traffic. A single controller was responsible for this sector, which was the normal practice in this specialty. The traffic level was moderate with some complexity. From the time communication with Lufthansa Airlines flight 8161 (DLH8161) was lost until it was re-established, the Gander controller (controller), who had qualified in the specialty two months previously, was controlling and coordinating the movement of 15 aircraft. The supervisor was in the high domestic specialty at the supervisor's position and was not aware of the communications failure until informed by the controller approximately 10 minutes after radio contact was lost.

When DHL8161 initially contacted the controller at 1128 Newfoundland standard time^{Footnote 1}, on frequency 134.7 megahertz (MHz), the aircraft was cruising at FL330 eastbound toward the COLOR intersection. The flight had a clearance for the oceanic crossing which included a remark to expect FL350. The controller cleared DLH8161 to fly direct to 48° north 050° west, which shortened the aircraft's route to the oceanic entry point and would take the aircraft approximately 12 nm south of the Torbay VOR. The controller was primarily using radar separation minima in the airspace under his control. One of the stipulations for applying radar separation is the requirement for direct pilot-to-controller communications.

COA65, flying westbound at FL330, was approaching the boundary between oceanic and domestic airspace at 48° north 050° west. The crew had been instructed to contact the controller at this point on frequency 134.7 MHz. Aircraft entering Gander domestic airspace from oceanic airspace are not radar identified until after direct communications is established with the controller.

At 1147, in order to establish vertical separation between the aircraft, the controller cleared DLH8161 to FL350 (see Appendix A), but received no readback from the crew. Over the next eight minutes, the controller attempted to contact DLH8161 on 134.7 MHz nine times, but did not receive a response. DLH8161 was not observed to change altitude and remained at FL330. The most common occurrences of communication failures at Gander ACC are linked to problems with the aircraft.

At 1148, a Moncton Area Control Centre (ACC) controller advised the controller that another flight had returned to Moncton's frequency after being sent to the Gander frequency 134.7 MHz because it had not received a response on the assigned frequency. The controller advised Moncton ACC to again send that aircraft over to 134.7 MHz, and if no success, to ask the aircraft to try 132.05 MHz. The controller also attempted to contact several other flights in the southern portion of the sector that were expected to be monitoring 134.7 MHz, but received no answer.

The controller contacted the coordinator of the International Flight Service Station (IFSS) and determined that DLH8161 had not contacted the IFSS. At 1155:03, the controller requested a westbound aircraft in the vicinity, and operating on another frequency, to switch to the guard frequency (121.5 MHz), attempt to contact DLH8161 and COA65, and request that they contact Gander ACC. The controller did not specify a frequency for the aircraft to use. A short time later the controller initiated a second call to the IFSS coordinator and requested him to contact DLH8161 using a SELCAL^{Footnote 2} and request the pilot to contact Gander ACC on frequency 133.9 MHz. The controller also requested that the IFSS coordinator send COA65 to the controller's frequency early.

The controller then advised the Gander high domestic supervisor that he was unable to contact DLH8161. The supervisor walked to the controller's work position and observed, from the controller's voice switch communications system (VSCS) communications control panel (CCP) display, that the controller's transmissions on 134.7 MHz were not going out to the aircraft (see Figure 1). The supervisor contacted the IFSS coordinator to re-confirm that they were not in communication with DLH8161 or COA65. The supervisor then used a multi-channel, tunable, back-up radio and was able to communicate with COA65 on 134.7 MHz. At 1155:22, the supervisor cleared COA65 to descend immediately to FL320, which was acknowledged by the crew. Recorded radar information indicates that COA65 commenced descent at 1156. COA65 was not instructed to change to a serviceable main frequency after the supervisor issued the descent clearance, and the back-up radio was left unmonitored.

At 1156:03, DLH8161 contacted the controller on frequency 133.9 MHz and was immediately instructed to climb to FL350. The crew of DLH8161 acknowledged the clearance and at 1156:15 recorded radar information indicated that DLH8161 commenced the climb. The controller had not been able to communicate with either aircraft for the previous eight minutes. The aircraft had been closing at a rate of 16 nm per minute on nearly reciprocal tracks. Twenty seconds after DLH8161 commenced a climb, the minimum vertical separation of 1000 feet was achieved. COA65 and DLH8161 had closed to within 18 nm.

From 1157 to 1159 the controller continued to try to contact COA65 several times on 134.7 MHz, but did not receive a response. At 1159:56, the controller requested another aircraft in the vicinity to contact COA65 on frequency 134.7 MHz and instruct the crew to contact Gander ACC on 132.05 MHz. COA65 contacted the controller at 1201:22 on 132.05 MHz and was instructed to change the transponder code to a discreet value in preparation for radar identification. As a result of the occurrence, a change of controllers at the high domestic position was completed at 1204:29, and COA65 was subsequently radar identified. During the handover briefing, a problem with a frequency was mentioned, but alternate action to restore communications with all aircraft was not discussed.

The supervisor advised the technical personnel of a problem with frequency 134.7 MHz at approximately 1200. Internal checks completed by the technical staff confirmed that there was a fault in the lines connecting the ACC to the peripheral station (PAL) site at Trepassey; there was no fault found in the main or back-up radios located at the PAL site. There is no alarm that activates in Gander ACC to warn technical staff of this type of failure. The company that maintains the link between Gander ACC and the PAL site was contacted at 1234. The lines between the ACC and the Trepassey PAL site became serviceable at 1237 while the NAV CANADA technician was discussing the outage with a company representative. No reason for the failure has been found.

The VSCS is the primary interface for controllers to access the radios and landlines. The VSCS CCP is a display module (see Figure 1) located at each control position. The CCP is a touch sensitive screen which displays all the air/ground frequencies and landlines available to controllers. Each frequency is displayed separately on the screen by a rectangular icon. Different sections of the frequency icon show green depending on what the controller is doing: receiving, transmitting or has pressed the 'press to talk' switch but no transmission occurs (this indicates that there is a fault).

Image

The VSCS training provided to controllers included both classroom instruction and hands-on practice. The controller involved in this incident was not aware that the specific green pattern in the frequency icon for 134.7 MHz indicated that he was not actually transmitting on that frequency, even though he had depressed the 'press-to-talk' switch. This was the only direct indication to the controller that there was an air traffic control (ATC) communications equipment failure. During the investigation it was determined that some other controllers were also not aware of the significance of the various green light indications on the CCP.

A number of frequencies available to Gander ACC controllers are strategically located at PAL sites to ensure that radio communications are available over the entire airspace for which Gander ACC has jurisdiction. The radios have a range of approximately 200 nm, depending partly on the aircraft's altitude. The Trepassey PAL site is situated so as to provide radio communications to aircraft flying through the southern portion the airspace controlled by Gander ACC. NAV CANADA has contracted a commercial service provider to maintain the links between the PAL sites and Gander ACC. Both the VSCS and ACC Emergency Communications System (ACCECS)^{Footnote 3} are linked to the main and back-up radios at the PAL sites through these links.

A level of redundancy is provided in the connection modes (i.e., land line or microwave) between Gander ACC and most PAL sites. The landlines between the Gander ACC and the Trepassey PAL site are routed through St. John's, Newfoundland and Labrador, and only a single line per frequency is available for the portion from St. John's to Trepassey. It was determined that the connection between Gander ACC and St. John's was working, but a failure had occurred in the line between St. John's and Trepassey. As a result, the frequency 134.7 MHz, located at Trepassey, was not available to the controller. Both 134.7 MHz and 132.05 MHz are located at the Trepassey PAL site and are connected to Gander ACC by separate communications links. The transmitter and receiver for 133.9 MHz, the frequency on which DLH8161 eventually contacted Gander, is located at Gander. A separate multi-channel, tunable, radio was available at Gander ACC for use in the event of a communications failure; however, not all Gander controllers were aware of its availability, location, or coverage area.

The Air Traffic Control Manual of Operations(ATC MANOPS), Section 6, describes the procedures for controllers to follow when it is determined that a communications failure has occurred with an aircraft. Controllers receive classroom instruction during both the initial and regional ATC training courses on how to deal with communications failures, including alternate methods of restoring communications with aircraft. The emphasis is on communications failures which originate with the aircraft. During training sessions at Gander ACC, there is no simulation of a communications failure of the ATC portion of the equipment, nor is this type of communications failure procedure reviewed during refresher training. ATC MANOPS does not provide specific direction to controllers in the event that there is a communications failure due to ATC related equipment problems. Another NAV CANADA publication, the Flight Services Manual of Operations (FS MANOPS), Section 1112, provides specific steps that flight services specialists should follow if they are unable to contact an aircraft after calling the frequencies on which the aircraft is believed to be listening. Controllers do not normally reference this publication.

Radio communications are essential for positive control of air traffic. A controller must quickly determine the cause of any communications failure and decide on the best course of action to re-establish communications. When DLH8161 did not read back the clearance to climb to FL350, the controller initially concluded that it was the aircraft that had a communications failure. Because of past experience, many controllers do not initially consider that ATC equipment may be involved when making an assessment of a communications failure but instead conclude it is an aircraft problem. Not all Gander controllers were provided with adequate training or simulation of ground-based communications failures and the necessary steps to quickly re-establish communications. As a result, valuable time was lost in repeated attempts to contact DLH8161 on a frequency that was not working.

The controller was presented with clues that the communications failure was not restricted to one aircraft: the display indication on the controller's VSCS CCP, and comments from other aircraft and from Moncton ACC controllers that there was a problem contacting the sector on 134.7 MHz. Even when he requested another aircraft to call DLH8161, the controller did not specify another serviceable frequency that could have been used. The controller did switch to the VSCS back-up mode; however, because the failure was in the line to the PAL site, this action had no effect.

The VSCS CCP display provided one clue that the loss of communications was caused by a failure in the ATC communications system and not by the aircraft; however, the differences in the display indications on the VSCS CCP was not obvious to the controller. A glance at the frequency icon would have shown what the controller expected to see whenever he attempted to activate the frequency, that is, an overall green indication. However, only a close look and detailed familiarity with the meaning of the different types of display patterns on the frequency icon would have alerted the controller that he was not getting out on the frequency. Although the controller had received instruction on the operation of the VSCS during training, and had used this equipment for a number of months, he was not aware of the variety of display patterns nor of their exact meaning. The controller involved in the incident was not alone in not knowing the meaning of the presentation on the VSCS CCP frequency icon. The supervisor, on looking at the VSCS CPP, did recognize that the controller was not transmitting on 134.7 MHz.

The controller was not aware that a multi-channel, tunable, back-up radio was available in another specialty in Gander ACC. This controller was not alone in being unaware of this resource. The aircraft's flight path was near the outer limit of expected coverage of that radio; therefore, COA65 was close enough to Gander ACC to be within range of the multi-channel, tunable, back-up radio. It was determined that other controllers were unaware of the coverage area of the radio. Coincidentally, DLH8161 contacted the controller at the time the supervisor was communicating with COA65. This allowed the controller to issue a clearance to climb to FL350 immediately, reducing the time the two aircraft were in conflict.

The communications problem was not completely resolved after the two aircraft achieved the required spacing. COA65 was left on frequency 134.7 MHz by the supervisor, but the multi-channel tunable back-up radio was no longer being monitored. The controller, under the impression that DLH8161 had contacted him on 134.7 MHz, thought that 134.7 MHz was now serviceable. The technical staff was not alerted to the problem with 134.7 MHz until 1200, 15 minutes after the problem first appeared, because the controller had not realized at the time that the communications problem originated with the ground based equipment. During the handover between the incident controller and the relieving controller, there was no clear indication which frequencies were operating, and what action had or had not been taken to ensure all aircraft were being transferred to a serviceable frequency. The line connecting the Gander ACC to the Trepassey PAL site was still unserviceable at the time of the handover.

A commercial service provider under contract to NAV CANADA is responsible for maintaining the links between the Gander ACC and PAL sites. The VSCS and ACCECS system at Gander ACC are connected to the main and back-up radios at the PAL sites through these links. There is only one line per frequency available for the section between St. John's and Trepassey. The failure of this line resulted in the severing of the connections between Gander ACC and the PAL site and the loss of the main frequency (134.7 MHz) for that area. There was no back-up to this line and, therefore, no alternative ways for the controller to access 134.7 MHz. Neither the service provider nor the NAV CANADA facility received a warning indication that a line failure had occurred. It is up to the controllers to determine that there has been a failure in the communications system and alert the technical staff; approximately 15 minutes passed before the technicians were advised of the failure.

In this occurrence, two aircraft on reciprocal tracks at the same altitude were not assured of safety of flight for a period of approximately 10 minutes because no alternate to radar separation minima was in place during the time that communication with the two aircraft was not available. Both aircraft were eventually contacted and issued clearances to descend (COA65) and climb (DLH8161), and the minimum required vertical separation was achieved when the aircraft were approximately one minute flying time apart.

Findings as to causes and contributing factors

1. There was a failure in the line linking Gander ACC to the ATC frequencies at the Trepassey PAL site. The cause of the failure could not be determined.
2. The communications failure between the Gander controller and two aircraft on nearly reciprocal tracks flying at the same altitude resulted in the safety of flight for the two aircraft not being assured.
3. The controller did not recognize that there was a failure of the frequency used to control aircraft in the southern section of the airspace.
4. The controller was not aware that the communications voice switch control panel gave a green indication even when the transmission on one of the frequencies was not completed. This resulted in a delay in establishing alternate communications with the aircraft.

Findings as to risk

1. Some controllers at Gander ACC were not aware that a tunable, multi-channel radio, which could be used as a back-up radio in the event of a main transmitter failure, was located in the operations room, nor were they aware that the radio may not provide adequate coverage to reach all aircraft in the airspace for which a controller may be responsible.
2. The training of Gander controllers in how to recover from a communications failure and the resources available to re-establish communications with aircraft under their control is not practised in simulation training. This could delay the recovery from a communications failure and result in a loss of separation or risk of collision.
3. There is no alternate method for controllers at Gander ACC to access the radios located at the PAL site in the event of a failure in the lines connecting the ACC to the PAL site. The main and back-up radios at the PAL are connected to the ACC using the same links.

Other findings

1. The Gander ACCECS uses the same links to connect the ACC to PAL frequencies as are used by the VSCS. A power failure or a failure of the VSCS at Gander ACC and a simultaneous loss of the links connecting the ACC to the PAL site would result in a complete loss of communications on all those frequencies served by the failed links.

Safety action taken

It was not common knowledge among technicians and controllers that an anomaly in the communications control panel (CCP) of the voice switch communication system (VSCS) existed that allowed a green transmitter light on the CCP to indicate that the transmitter has been keyed and should be transmitting when in fact it was not. This deficiency has been identified to NAV CANADA's Operational System Requirements Branch for resolution.

There has been little new training for the Gander ACC High Domestic Specialty for a number of years, and as a result there was no emphasis in the unit qualification training plan for trainees to receive training in the use of the tunable transceiver equipment. The recently qualified controllers have been briefed in the use of the transceiver and provisions have been made in this year's annual recurrent training to provide simulation, and to include the topic of lost communications and the means to a quick recovery.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 03 December 2003.

Appendix A - Sequence of Events

Image