N600XL

Apologies to the passengers and crew aboard Gol 1907, all fatal victims of the accident. There’s little to report about an aircraft struck at altitude (FL370), suffering significant airframe damage, coming apart violently in its fall, and coming to rest in hard-to-access rain forest. Virtually all of the investigation focused on flight crew of the Embraer 135 executive jet and the actions of ATC.N600XL, Gol1907

The principals, N600XL, enroute from Sāo José dos Campos to Manaus, and Gol1907, a B737 from Manaus to Brasilia, were routine until they clipped aerodynamic surfaces flying opposite directions at FL370. The collision occurred ≈480 miles NW of Brasilia, about 20 miles from the city of Peixoto de Azevedo at ≈10°S and 52°W. It’s a sparsely populated area.

Neither saw each other, and although they felt something, the crew of 600XL were unsure what it might have been. At a closure rate of >900 miles per hour, even if they had been able to see each other, it’s unlikely they could have maneuvered to avoid contact. As it was, the 737 lost a good part of its wing and in the ensuing upset, destroyed itself prior to impact. The Embraer was able to fly to and successfully land at a military installation not far from where they were struck.

I recall reading about this accident shortly after it occurred, and I was troubled at the time by some tacks the investigative team apparently were taking. As an instrument rated pilot, as an air traffic controller of thirty years experience, and as someone who has spent many hours on the flight decks of transport aircraft, those tacks seemed to take on a bias toward the two American pilots crewing the Embraer. Moreover, the ATC system, which would have been my primary focus seemed to receive only a passing glance—not surprising, since Brazil’s system is run by the military, and an entire facility's complement (Brasilia ACC) refused to be interviewed.

The part I found most troubling was the notion that a flight plan, which apparently included proposed altitude changes at two fixes along its route, was implemented in its production by Brazil’s automation system. I grew up, in ATC terms, processing flight plans—from hand writing strips for flight plans received from other ATC facilities, Flight Service Stations, BASOPS (military), and even company (airline dispatchers). I don’t ever recall processing altitudes as anything other than a single element. If it was a live flight plan, it was the requested altitude upon departure. If it was a proposal, it was a single requested altitude. In the ATC environment, there is only one altitude that counts, and that is the one processed.

I think there may have been what we called “mission flight plans”, which were planned military operations and whose flight plan was not only prepared solely by the Military Liason and Security office in the facility, but which used the strips they, not Flight Data, prepared. Once automation came into use, there was even a specific prohibition against entering mission flight plans into the system. In any event, there is no correlation to how military flight plans were handled compared to domestic flight plans.

So, if the investigation is to be believed (and I confess up front I’ve never visited a foreign ATC facility, and only having a passing acquaintance of ICAO procedures), their (Brazil’s) system will process strips (once activated), which indicate not only the initial requested altitude, but will process filed altitude change requests as if they’d been assigned. The long and the short of it can be pictured with the following description: N1234 files from A to F initially requesting FL370. Included in the filings are a change to FL360 at C and then a change to FL380 at E arriving at F with successive let down altitude assignments pursuant to landing.

According to the report, both the flight strips and the data block accompanying 600XL’s target, showed FL370 between Sāo José dos Campos and BRS (Brasilia). I don’t know how many fix postings the ACC used in that segment—certainly one for the departure sector and one for the high altitude sector, but once the airplane was in the air and clear of the terminal environment, they were cleared to FL370.

Any strips before BRS would have shown FL370 as the assigned altitude. We are told that the BRS strip would have shown both 370 and the “requested” FL360, and succeeding strips as far as fix E, at which a similar paired altitudes, FL360 and the “requested” FL380. This contrasts with every fundamental of ATC I was ever taught or experienced in my thirty years of (U.S.) experience. The only exception was locally in a sector where, for a variety of reasons, an altitude change was going to take place. In ZJX we would have written the new altitude in red (until assigned), circled it, and then passed it along to the next sector as a revised altitude. Each succeeding sector would write it in black. At ZAU it was the same except we didn’t use red.

The “variety of reasons”? The next sector requested we move the flight to resolve a conflict in his sector, the D-side at the controlling sector wanted the R-side to move him, the flight itself requested a change, or on receipt of a revision from a previous sector. Never, ever would a request for an altitude change appear as the result of the proposed flight plan. You don’t base control on a proposal.

The investigating panel made much of the “hemispheric rule” of altitude assignment, what we in ZJX called the NOSE rule (North Odd, South Even), but in ZAU was the East Odd, West Even rule. It’s a handy rule of thumb, but it doesn’t have the force of authority behind it insofar as ATC operations, particularly Class A airspace, are concerned. And as a followup document from the NTSB points out, the “hemispheric rule” as an imperative only applies in uncontrolled airspace. The airspace in question was absolutely, and by definition controlled as it is identified as Class A airspace—positive control.

At ZJX, as an example, every flight from South Florida up the East Coast and heading for the North East was flown at an odd altitude, despite the fact that the bearing from MIA to JAX is something on the order of 330°. Moreover, there were many times in my ten years of high altitude experience when we might honor a request for what we called WAFDOF ops—wrong altitude for direction of flight. The precept is described by the common phrase, “you can do anything, with coordination”.

An interesting sidebar in this accident also involves altitudes—RVSM, or Reduced Vertical Separation Minima. When dinosaurs roamed the earth we separated airplanes at FL290 and below by 1,000’. Everything from FL290 and up required 2,000’. I was long gone when RVSM was implemented (although it had been rumored) which permits 1,000' vertical separation from FL290 through FL410. Certain requirements were included for it to be applied, but virtually every jet flying has the equipment required for it to be implemented. One of those requirements is TCAS, which is an onboard, transponder based operation of Traffic Conflict Avoidance System.

Now, the requirements are complex, and I don’t know all of them, but TCAS played heavily in this accident. Up front, if fully operational on both aircraft, each pilot would have gotten, first, a Traffic Advisory alert, and then, when they were closer, a Conflict Resolution alert, the transponders from each aircraft coordinating conflict solutions with each other. But, the operation of 600XL’s transponder and TCAS came under suspicion because the ACC radars had difficulty tracking it in the vicinity of BRS and beyond. In fact there were significant communications problems, as well.

I know what it’s like to operate with chronically intermittent equipment, both surveillance and comms. And there’s a huge difference in a support structure that is competent and one that isn’t. I have read several horror stories of the ATC system in Brazil, and it doesn’t surprise me at all to read of the circumstances pertaining to 600XL. It also doesn’t surprise me at all to read between the lines at the effort the investigating board put in to downplay the system aberrations (including ATC personnel and operations). Frankly, I was embarrassed as a controller to see the apparent shortcomings in the ATC process regarding this accident.

As I reported above, never, in my experience, have I seen an active flight plan processed with assigned altitudes displayed based on a proposed flight plan. I’ll admit, sample of one, but we were ingrained with a pretty strict and complex set of rules in our ATC development. Here’s an example. I issued hundreds of clearances to towers requesting IFR for a departure who had called for clearance. “Cleared as filed, maintain (initial altitude below all of my traffic or overlying airspace—3 or 4 thousand not untypical). There was a requirement in the book (FAA Handbook 7110.xxx, our procedures manual) that prescribed we assign a specific altitude, as high as possible and in the stratum filed—below FL180 or above FL180, and if not to in the stratum filed a time/fix when the pilot could expect an altitude in the stratum filed. The way I came up in the system, even though I was instrument rated, it made us very nervous to assign an expected altitude thousands of feet above our sphere of influence.

However, that is one of the bases of lost comm procedures. ATC has to plan on what a pilot would/should do if there’s a catastrophic failure of communications. The argument for the expect altitude phrase was that a business jet, filing for a destination hundreds of miles away, could not make that trip if restricted to only 4,000 feet. Whereas, in the thinner air of the flight levels, they had a fighting chance, even though they might only get FL240 when they’d request FL410. My specific and most troubling example was aircraft filed off DPA for points east, typically requesting altitudes in the high 30s or low 40s. Because the airport underlaid ORD’s airspace, we could only clear them off the ground up to 3 or 4 thousand feet. When they got airborne, we had to take them westbound, climb them with our own departures off ORD to a point where we could go back east with them (typically above about 14,000), and then work them up to FL230, switch them to high altitude, who could then work them up to their requested altitude.

The notion of lost comm was horrifying in that scenario, because not only did it involve ORD, but at least three other sectors in house. Ultimately, we were forced to concede the necessity of an altitude to expect in the stratum filed and it was typically something like this, “…maintain 3 thousand, expect FL410 ten minutes after departure.” I never had to execute lost comm with any of those departures (and DPA is a fairly busy GA airport), but it would have been a coordination nightmare should it happen. Probably not so much fun for the pilot, either.

An inordinate (in my opinion) amount of effort was expended by the investigators with regard to the two pilots’ credentials, experience, and training. You would have thought from reading that they were both 200 hour pilots with wet ink on their licenses. In fact, they were both ATP rated (Airline Transport Pilot) which aren’t given away in Post Toasties boxes. One even had experience as a captain on and American Airlines commuter affiliate, and in an Embraer aircraft, to boot. Both had several thousand hours of experience.

Although the Embraer 135 was a new model for the company, there were certainly familial similarities to sister equipment, and while there were indications that at least one of the pilots was a little behind the power curve on the systems, much of the problem appeared to be based on pressure to get in the air, a common characteristic of corporate jet operations. All of that effort by the investigators would later surface as they attempted to equate unfamiliarity with an accidental (or not) disruption of the TCAS equipment. I hasten to point out that at the same time there were problems with the secondary radar return, as well, and also communications difficulties. Yet, there didn’t seem to be any attempt to address those as a systemic problem with the airframe. There certainly was no attempt to explain how any of them might be related to ACC infrastructure shortcomings.

In the end, the accident clearly was the result of a controller having strips on two airplanes, opposite direction on the same airway, one showing an assigned altitude of FL370 and the other showing an assigned altitude of FL360. The evidence indicates the 600XL was never assigned FL360. The whole case by the investigators seems to hinge on the notion that 600XL would descend, without clearance to FL360 at BRS based on a proposal. That’s not how ATC is done in my experience. My gut reaction is that if I were working the sector, and those were the only two airplanes I had, I might have given a 10° turn to Gol1907, just ’cause. Especially, as I hadn’t heard from the Embraer, yet. But that’s too easy. That’s blindingly clear in hindsight, but only becuase I know how it turned out.

The Brazilians charged the two pilots with causing the deaths of the Gol passengers and crew. They were able to get out of Brazil, but were convicted in absentia. The Brazilians would still like to get them back to Brazil and behind bars, but to no avail. I think the whole episode is an embarrassment to the Brazilian ATC system, the Brazilian military who run the ATC system, and the investigating authority, also the Brazilian military.