Description

On 30 June 2015, an Embraer ERJ 170 (SP-LDK) being operated by LOT Polish Airlines on a scheduled international passenger flight from Warsaw to Istanbul as LOT 7293 lost prescribed separation in day VMC against an unseen Dassault Falcon 900 (VP-CGD) being operated by Volkswagen Air Service on an international passenger flight from Stuttgart to Muscat as WGT62N. Both aircraft were level at FL370 in Class 'C' airspace but only the Falcon 900 was in contact with the relevant ATC frequency at the time of the near collision.

Investigation

After the classification of the event as a Serious Incident by the Aircraft Accident Investigation Unit at the Aircraft, Maritime and Railway Accident Investigation Unit Directorate at the Ministry of Transport, Information Technology and Communications, an Investigation Commission was appointed by the Minister. Recorded ATC data from both ACCs involved - from the FDR of the E170 and from the NVM of its CMC (Central Maintenance Computer) - were available to inform the Investigation.

It was noted that the 47 year-old E170 Captain had been employed by LOT for 18 years and had accumulated 12,100 total flying hours including 3,300 hours as a Captain on type. The 45 year-old E170 First Officer had been employed by LOT for 4 months and had accumulated 4,600 total flying total hours of which 1,026 hours were on type.

It was established that the E170 was tracking south eastwards after entering Romanian airspace at FL370 and had been identified on radar when, after 12 minutes, its squawk disappeared from all controller work stations at Bucharest ACC. No attempt was made to query this with the aircraft but during discussion between controllers in the BANAP sector where the aircraft had been when its squawk disappeared and the next ACC sector (DINSI) along its flight planned route, the BANAP sector executive controller "stated that LOT 7293 overflew the sector an hour before". One minute later, in the DINSI sector from which the aircraft would be expected to enter Sofia ACC airspace (see the illustration below), an automatic message was generated with the E170 at FL350 and sent to Sofia ACC. There was still no attempt made to communicate with the E170 or any transmission received from it and it was not transferred to the next sector.

After a further eight minutes, the first query from Romanian military ATC was made to Bucharest ACC as to whether a civil aircraft was flying without a transponder. Various exchanges within ATC followed and after a further 12 minutes, unidentified traffic at FL370 tracking as the E170 might be expected to be was reported by a NATO AWACS aircraft to be overhead the Bucharest/Sofia ACC boundary at FL370 and tracking along the E170 flight planned route. At the same time, the receiving Sofia ACC sector controller (VARNA EAST UPPER) observed an unidentified but corresponding primary target. At this point, the E170 was still on the Bucharest ACC BANAP frequency which it had been on when the transponder squawk had ceased and the crew reported their FIR boundary position on that frequency. Not until it was already 25-30 nm beyond the Bucharest/Sofia ACC boundary did the controller transfer it to the (incorrect) Sofia ACC sector, VARNA WEST, where the crew checked in confirming their level and next waypoint (MATEL).

Meanwhile, the Sofia ACC VARNA EAST controller was checking with an aircraft which was in the vicinity of the E170 primary target whether its crew could see this "unknown and unidentified" aircraft. This northwest-bound aircraft was to the east of the target at FL380 and replied that they could see an aircraft 5nm away and 1,000 feet below them. The controller then advised a second aircraft, the Falcon 900, which was 10nm southwest of the target and on a potentially conflicting south easterly crossing track at FL370, of "traffic information" to the effect that there was unknown traffic at an unknown level in a 10 o' clock position at 13nm crossing left to right. At almost the same time as the E170 was being transferred to the wrong Sofia ACC sector (VARNA WEST) by Bucharest, and with the E170 being subsequently found to be 8/9 nm away, the F900 crew replied that they had the traffic in sight "far away" and that it was at approximately FL400.

Less than a minute later, one of the F900 pilots reported that "I have just seen the traffic and I do not have TCAS on him and he was crossing behind me above…and there was less than FL 400". Examination of radar recordings showed that the E170 had passed 0.9nm behind the F900 at the same level.

At the same time as this was happening, the VARNA WEST controller had informed the E170 crew that they were not providing a secondary target and the crew had switched their transponder back on and been identified. This enabled the controller to transfer the aircraft to the correct Sofia ACC sector and the E170 checked in there two minutes after the minimum separation had occurred.

The Investigation confirmed the time at which the E170 transponder had been switched off from the aircraft CMC data and the corresponding generation of crew alerting messages and other flight deck transponder status annunciations. It was found that the switching of the transponder to STBY would have been followed by an EICAS 'MASTER CAUTION' with display of the message "NAVCOM 1 (2) FAIL" for less than 10 seconds. The lower left hand side of both pilots' PFDs would have annunciated the message "TCAS OFF" in amber upper case letters and both pilots' central pedestal MDCU TCAS status indications would have shown "STBY" in green instead of "TA/RA". The transponder status change was found to be a consequence of a momentary uncommanded failure of a NAV/COM software interface which would have rapidly auto-reset the NAV/COM radios as they were previously but left the transponder in STBY. It was noted that the NAV/COM 1(2) FAIL EICAS Caution would, by design with the software version installed on the aircraft involved, have ceased as soon as the NAV/COM radio function had been restored, leaving just the PFD alerts and the MCDU indications of TCAS OFF/STBY status.

It was noted that the avionics software fault which was capable of causing reversion of the transponder to STBY until manually reinstated had been discovered during initial service experience with the aircraft type and had been identified by Original Equipment Manufacturer (OEM) Honeywell in 2007 and immediately notified to Operators accompanied by appropriate flight crew response procedures based on Honeywell guidance by Embraer. Updated software which eliminated the problem had then been adopted for all new aircraft from January 2010.

The flight crew response procedures notified were as follows:

• If a warning (a light or an audible one) has occurred, even for a moment, and the flight crew is not sure what the warning has exactly been, the status of the TCAS/Transponder system must be checked.
• If the transponder has returned to STANDBY Mode, confirmed by the inscription STANDBY in green colour on MCDU, the flight crew must select again the desired operational mode.
• If both inscriptions STANDBY and TA/RA on MCDU are displayed in white colour, a transponder swap is required before selecting the desired mode.
• In both cases, the flight crew shall check as a must whether the inscription TCAS OFF on PFD disappears or not.

These procedures were found not to have been followed by the E170 crew, although during interview, they advised that they had seen the 'NAVCOM 1 FAIL' message which they claimed had "disappeared after one or two seconds". They had not noticed the PFD cautions or the MDCU status annunciations and had remained unaware of the changed status of the transponder until the absence of a squawk was notified on contact with Sofia ACC 32 minutes later.

The Investigation was unable to establish whether the E170 crew had "acted in conformity with the procedures specified in the Aircraft Operating Manual upon....failure of the transponder, due to lack of a copy of such a manual, which had not been provided to the moment despite a corresponding request". For the same reason, it was not clear whether the pre 2010 software fault had been reflected in those procedures.

Various deficiencies in both ATC procedures and in the performance of particular controllers within existing procedures were identified as having made a significant contribution to the delay in notifying the E170 crew that their squawk had disappeared.

The Main Cause of the conflict was found to be the "unintentional interruption of Air Traffic Service from ACC Bucharest in respect of the southbound E170 after its transponder mode of operation changed to STANDBY which continued as the aircraft entered Sofia FIR".

Three Contributory Factors were also identified as follows:

• The failure of the Embraer 170 flight crew to implement appropriate procedures after the momentary failure of their transponder system.
• The failure of ACC Bucharest to provide timely information on the location, direction of flight and height of the unidentified aircraft previously received from (the AWACS aircraft) to ACC Sofia.
• The failure of ACC Bucharest to implement relevant procedures from the LoA between Sofia and Bucharest ACCs in respect of the transfer of Control, Communications and Aircraft Identification.

Nine Safety Recommendations were made as a result of the Investigation as follows:

• that Romanian ANSP ROMATSA should provide theoretical and practical training and examination of ATCOs in respect of their appropriate actions in cases of special/emergency situations, including transponder failure during flight in Bucharest ACC. [BG.SIA-2015/03/01]
• that Romanian ANSP ROMATSA should provide training for ATCOs which acquaints them with the requirements and provisions of the Letter of Agreement on collaboration between the Sofia and Bucharest ACCs. [BG.SIA-2015/03/02]
• that Romanian ANSP ROMATSA should carry out a check of the competence of those ATCOs in working positions at Bucharest Control during the investigated occurrence. [BG.SIA-2015/03/03]
• that Romanian ANSP ROMATSA should provide training of ATCOs on the Operational Display Sub-system of the SELEX Air Traffic Control Automated System (ATCAS) in respect of the use of the Coast List Table (CLS) - the list of uncorrelated aircraft - and the Sector List (SCL) - the list of traffic being provided with Air Traffic Service in a sector. [BG.SIA-2015/03/04]
• that Romanian ANSP ROMATSA should consult with the manufacturer of its ATCAS equipment about the possibility that after a loss of radar information the system should display the last position of the aircraft statically in an appropriate colour. [BG.SIA-2015/03/05]
• that LOT Polish Airlines should, as soon as possible, provide simulator training on the detection, reporting and response to any interruption to the transponder system by the flight crews operating their Embraer 170 / 175 / 190 / 195 aircraft. [BG.SIA-2015/03/06]
• that ЕАSА and ICAO should request that those operators of Embraer 170 / 175 / 190 / 195 aircraft which use the Primus Epic Load software upgrade it to a version that can display a cautionary EICAS message XPDR (1/2) IN STBY. [BG.SIA-2015/03/07]
• that ANSPs BULATSA and ROMATSA should supplement their Letter of Agreement for collaboration between Sofia and Bucharest ACCs so that it includes the necessary obligations on timely notification under the conditions of “RENEGADE” and/or the flight of an identified aircraft. [BG.SIA-2015/03/08]
• that Bulgarian ANSP BULATSA and the Bulgarian Air Force should enhance the efficiency of coordination between civil and military Air Traffic Service authorities. [BG.SIA-2015/03/09]

The Final Report was completed in December 2016 and made available in English the following month.

Related Articles

• Loss of Separation
• Transponder
• Operation without a Transponder or with a Dysfunctional Transponder
• Engine Indicating and Crew Alerting System (EICAS)
• An aircraft without transponder – Guidance for Controllers