Description

On 7 March 2020, an Embraer ERJ190 (C-FMZW) being operated by Air Canada on a scheduled international passenger flight from Toronto Pearson to Denver as ACA1037 rejected its takeoff at high speed in normal day visibility condition after a bird strike. At this time a Boeing 777-300 (C-FJZS) being operated by Air Canada on a scheduled domestic passenger flight from Toronto Pearson to Halifax as ACA606 was also accelerating for takeoff on the same runway and when the crew saw the ERJ190 ahead they too initiated a high speed rejected takeoff and a safe separation between the two aircraft was achieved. 

Investigation

An Investigation was carried out by the Canadian Transportation Safety Board (TSB). The FDR and CVR from both aircraft were downloaded and relevant data obtained. Flight crew experience was not recorded but it was found that the experienced TWR controller involved had been working at Toronto airport for 16 years and was an experienced instructor. It was, however, also noted that “he had never seen a high speed rejected takeoff in either a controller or an instructor capacity”.

What Happened

At the time of the event under investigation, the Toronto TWR controller was covering both the TWR North and TWR South positions whilst standing at the TWR North desk position. Parallel runways 06L and 05 were in use for both arriving and departing traffic. The traffic level, which consisted of “a small number of aircraft arriving but a constant line up of aircraft awaiting departure”, was described as “moderate”. 

To expedite departures, the controller was using “visual departure separation procedures” as provided for in the MATS (Manual of Air Traffic Services). These procedures were predicated on the following method of ensuring the separation of successive departures from the same runway:

“A controller may authorise the second aircraft to take off, provided that one of the following applies before the second aircraft begins its take-off roll: 

▪    The first aircraft has departed and turned to clear the departure path.

▪    The first aircraft has departed and reached a point on the departure path where it will not conflict with the second aircraft.”

The Embraer 190 was cleared to take off from runway 06L and as soon as it had begun its take-off roll with the Captain as PF, the Boeing 777 was instructed to line up on the same runway. Twenty three seconds after beginning its takeoff roll, the Embraer 190 passed 50 knots as it continued to accelerate. Three seconds later, the A-SMGCS track label on the controller’s display indicated that it was airborne at 500 feet amsl at a speed of 50 knots. 

Twenty seconds later, the Embraer 190 was still on the ground and 7 knots below the applicable V1 of 146 KIAS when both pilots saw birds passing their side of the aircraft and the Captain, having heard a fuselage side impact ahead of the left engine and concluding that there was a risk of engine ingestion, decided to reject the takeoff and did so 1½ seconds later. This prompt action resulted in the maximum achieved ground speed being 139 knots.

Half a second before the bird strike occurred had occurred to the Embraer 190, the TWR controller issued takeoff clearance to the Boeing 777 on which the First Officer was acting as PF. Simultaneously with this and the immediate readback, a call from the Embraer First Officer that they were rejecting their takeoff was made but not heard by either the controller or the 777 flight crew. At the time of the simultaneous radio calls, the Embraer 190 was about 1,500 metres from the beginning of the 2,956 metre-long runway and rapidly decelerating, having begun to do so six seconds before the Boeing 777 began its takeoff roll.

For the next 25 seconds, the controller directed his attention to two aircraft on approach to runway 05 and to his displays before returning his attention to the runway 06L threshold and instructing a Jazz Aviation flight to line up. Meanwhile, the Boeing 777 was accelerating through 80 KCAS when its flight crew saw that the Embraer 190 was still on the runway ahead and half a minute after beginning their takeoff, a rejected takeoff was initiated 127 KCAS, 29 knots below the applicable V1. A subsequent maximum of 133 KCAS was reached before deceleration took effect and by the time their subsequent call announcing the rejected takeoff was made, the two aircraft were 1,500 metres apart. Twelve seconds after commencing the rejected takeoff, the Boeing 777 decelerated through a ground speed of 50 knots and the TWR controller, still unaware that the Embraer 190 was on the runway, acknowledged the rejected take off call. After failing to find evidence that it was airborne, the controller then saw it on the runway and made contact following which it exited the runway. 

The only Runway Incursion Monitoring and Conflict Alerting System (RIMCAS) stage 2 (critical conflict risk) generated due to the proximity of the two aircraft did not occur until the conflict risk was already being addressed and within 10 seconds, the Embraer 190 had exited the end of the runway at Taxiway D7 and the Boeing 777 had come to a stop slightly past the mid-point on the runway.

Why It Happened

It was found that the A-SMGCS track labels for the radar targets of both the aircraft involved had automatically changed to indicate that the aircraft were in the air even though neither had left the ground. The Embraer 190 showed as airborne for approximately 52 seconds - all the time it had exceeded 50 knots - and the Boeing 777 showed as airborne for approximately 23 seconds - all the time it had exceeded 100 knots. Both aircraft were simultaneously shown as airborne over the runway for two seconds. Since the RIMCAS is a sub-system of the A-SMGCS, this false data meant that collision avoidance alerting did not occur until both aircraft had decelerated below the speeds at which they would be detected as ‘on-ground’. Because of the Undetected Simultaneous Transmission (USiT) of the Embraer 190 crew announcing their rejected takeoff, prevention of a potentially serious ground collision had been wholly dependent on the timely sighting of an aircraft ahead by the Boeing 777 crew coupled with their prompt response.

It was noted that the RIMCAS receives air/ground status of aircraft from a Multi-Sensor Tracker (MST), which uses an aircraft’s ground speed, acceleration, and ‘Ground Bit Set’ (GBS) values, the latter being sent as a Mode S reply message from the aircraft which is initially received by the MLAT system and then sent to the MST. The MST then uses configurable speed and time values to “determine” the air/ground status of an aircraft. The relevant ground speed value for “minimum speed for takeoff when GBS is OK” was set to 50 knots so that once a departing aircraft exceeds 50 knots ground speed, an aircraft will show as airborne unless, as in the case of the Boeing 777, the aircraft’s GBS value is higher, in which case the change in status from ‘on-ground’ to ’in-air’ will be delayed until that value is reached provided it is available from the MLAT system. This system configuration was proposed by the RIMCAS supplier and approved by NAV CANADA as ANSP.

It was noted that the RTCA Minimum Operational Performance Standards (MOPS) for Air Traffic Control Radar Beacon Systems/Mode S, DO-181 MOPS, required that “aircraft with the ability to automatically determine their in-air/on-ground status through weight-on-wheels sensors or other means are required to use such a capability to detect and transmit their status”. However, where this capability does not exist, DO181, with its focus on airborne conflict detection and pre-dating both A-SMGCS and RIMCAS, accepts any threshold value below 100 knots. The Investigation noted that aircraft other than the Embraer 190 “may have different override threshold values of less than 100 knots as well”.  

It was found that Transport Canada did not require Canadian airport operators to install an A-SMGCS and that it was considered that the main reason for such systems being installed was to increase airport capacity during reduced visibility whilst maintaining safety standards in such circumstances. The A-SMGCS installed at Toronto was found to combine inputs from surveillance radar, surface movement radar and the MLAT system but the Investigation “was unable to determine the rationale behind the RIMCAS default values (or) what the full extent of the repercussions would be if the parameters were modified and the setting of the in-air status at takeoff were delayed”. It was recognised that although a RIMCAS can be configured to overcome these limitations, doing this could cause false warnings to be generated “which might reduce controllers’ confidence in the sub-system”. Finally, it was found that although each TWR controller position has its own A-SMGCS display, no formal training in its use is provided so that controllers’ have to “learn how to use the system through experience and on-the-job training”.

The Findings as to Causes and Contributing Factors were formally documented as follows:

1. In order to achieve an expeditious flow of traffic, the controller was using pilot-applied visual departure separation procedures (in accordance with) NAV CANADA’s Manual of Air Traffic Services. In this occurrence, the operations conducted under the pilot-applied visual departure separation procedure were optimized to a point where separation was not assured. 
2. Given the Embraer 190’s speed and position on the runway, the controller was not expecting a high-speed rejected takeoff. He assessed that the aircraft was becoming airborne and no longer required his attention and monitoring. As a result, he issued the take-off clearance to the Boeing 777 even though the Embraer 190 was still on the runway. 
3. The Embraer 190 struck a bird and conducted a rejected takeoff at a critical point during its take-off roll, just before the Boeing 777 received its take-off clearance and started its own take-off roll. 
4. The first officer of the Embraer 190 made a radio call reporting the rejected takeoff, but this call went undetected by the controller or the Boeing 777 flight crew as it was overlapped by the radio call from the first officer of the Boeing 777 reading back the take-off clearance. As a result, neither the controller nor the Boeing 777 flight crew were aware that the Embraer 190 was rejecting the takeoff. 
5. Because the controller was expecting the Embraer 190 to take off without interruption, he shifted his attention and priority to other aircraft movements. Focus on these tasks, combined with operating from the north tower position, reduced the controller's opportunity to detect the Embraer 190’s rejected takeoff and delayed the response to the conflict. 
6. The Boeing 777 flight crew visually sighted the Embraer 190, believed it would soon be airborne and saw no apparent risk of collision; however, they were unaware that it was conducting a rejected takeoff and decelerating. Proceeding as authorised, the Boeing 777 flight crew commenced their take-off roll while the Embraer 190 was still on the runway, which resulted in a runway incursion and risk of collision. 
7. The Embraer 190’s transponder transmitted that the aircraft was in air after the aircraft accelerated past 50 knots. As a result, although compliant with current standards, an inaccurate in-air status was transmitted for approximately 52 seconds while the aircraft remained on the ground during its take-off roll and rejected takeoff. 
8. The RIMCAS relies on data from aircraft systems designed to provide aircraft flight status data for use by airborne surveillance systems. The use of this data by RIMCAS led to the inaccurate identification of the Embraer 190 and the Boeing 777 as in the air whilst both were still on the ground. This resulted in late and inaccurate RIMCAS alerts and delayed the response to the risk of collision. 
9. A risk of collision occurred when the accelerating Boeing 777 was travelling at 133 knots indicated airspeed and was approximately 1500 metres from the decelerating Embraer 190. The risk was mitigated once the Boeing 777 flight crew rejected their takeoff after recognising that the Embraer 190 was still on the runway ahead of them.

One formally stated Finding as to Risk was also identified as follows:

• If the logic which determines flight status within the Runway Incursion Monitoring and Conflict Alert Sub-system (RIMCAS) has a latency of several seconds, the resulting delays in conflict detection increase the risk that the RIMCAS alerts will be ineffective.

Safety Action taken as a result of the event was recorded as including, in summary, the following:

1. The TSB issued an Aviation Safety Advisory to highlight the importance of accurate flight status data being validated and transmitted by transponders and how this data is received, validated and used by runway monitoring and conflict alert systems. It encouraged OEMs of aircraft transponder systems and A-SMGCS which include runway conflict alerting systems, certification authorities and ANSPs to work together on improving these systems so that they interact effectively and work as intended to reduce the risk of collisions on runways.
2. ANSP NAV CANADA published an Information Bulletin for Toronto TWR personnel to advise that RIMCAS alerts “may not be generated when Embraer E-jets and some aircraft manufactured by Dassault, Gulfstream, Learjet, and Textron Aviation (formerly Cessna) are departing”.
3. Transport Canada published an Aviation Safety Alert on the potential for inaccurate airborne status to be transmitted by transponders of departing aircraft and its consequences for RIMCAS which was subsequently updated to refer to potential variability in transponder airborne status thresholds and how these can be adjusted by the OEM.  

The Final Report of the Investigation was authorised for release on 16 March 2022 and it was officially released on 14 June 2022. No Safety Recommendations were made.  

Related Articles

• Runway Incursion
• Rejected Takeoff
• A-SMGCS
• Bird Strike
• Undetected Simultaneous Transmission