TABLE OF CONTENTS 1. EXCELAIRE: THE COMPANY, ITS
Transcription
TABLE OF CONTENTS 1. EXCELAIRE: THE COMPANY, ITS
TABLE OF CONTENTS 1. EXCELAIRE: THE COMPANY, ITS PEOPLE AND THE PILOTS 1.1. ExcelAire Service, Inc. 1.2. ExcelAire Management and Operations 1.3. ExcelAire’s Inspection by FAA 1.4. ExcelAire’s International Experience 1.5. The Pilots Joseph Lepore and Jan Paladino 2. FACTUAL ANALYSIS 2.1. Introduction 2.2. Air Traffic Control’s Functions 2.3. Verifying flight planning and the aircraft’s suitability prior to the take-off 2.4. The Provision of Air Traffic Control Services to the Legacy After Departure From SBSJ and During the Initial Climb 2.5. Control’s clearances for climbing to cruise level 370 until Eduardo Gomes Airport is reached 2.6. ATC Failures That Caused the Accident 2.6.1. ATC Was Negligent for Not Checking the Inconsistency Between the Altitude Displayed in the Control System and the Altitude at Which the Aircraft Was Flying 2.6.2. ATC Was Negligent for Not Contacting the Legacy to Determine Altitude Change to 360 or, alternatively, Alter the Electronic Strip and Indicate that the Legacy Was Flying at 370, as Previously Cleared 2.6.3. ATC Was Negligent for Not Adopting the Procedural Rules for Cases of Transponder Malfunction After Identifying such Malfunction on the Control Center’s Radar 2.6.4. ATC Was Negligent for Not Assuring the Reduced Vertical Separation Minimum of 2,000 Feet between the Legacy and the Aircraft that Operated Gol Flight 1907, Even After the Legacy’s Total Failure in the Primary and Secondary Radars 2.6.5. Errors of Brasilia and Amazonica Control Centers during the Coordination for the Transference of the Legacy 2.7. The Chain of Errors of the Air Control is the Direct Cause of the Accident 3. CENIPA AND NTSB SAFETY RECOMMENDATIONS 4. FREQUENTLY ASKED QUESTIONS 4.1. Questions about the accident 4.2. Questions about the dialogues recorded in the Legacy’s cockpit 5. THE EMBRAER LEGACY 600 135BJ 6. PRODUCTION AND PRE-DELIVERY PROBLEMS WITH N600XL and EMBRAER’S POST-ACCIDENT CONDUCT 6.1. Production problems with N600XL 6.2. Discrepancies noted during delivery 6.3. The Inspection performed on the aircraft by Embraer right after the accident 7. AVIONICS EXAMINATION AND DETECTED FAILURES 8. FAA SERVICE DIFFICULTY REPORTS 9. CRIMINALIZING AVIATION ACCIDENTS 10. FINAL CONSIDERATIONS EXHIBITS EXHIBIT 1: Joseph Lepore’s Training Record EXHIBIT 2: Jan Paladino’s Training Record EXHIBIT 3: Timeline of N600XL’s Flight EXHIBIT 4: IFALPA’s and APLA’s Safety Bulletins EXHIBIT 5: CENIPA’s Safety Recommendation EXHIBIT 6: NTSB’s Safety Recommendation EXHIBIT 7: Article Published in the Newspaper Folha de S. Paulo EXHIBIT 8: Joint Resolution Regarding Criminalization of Aviation Accidents 1. EXCELAIRE: THE COMPANY, ITS PEOPLE AND THE PILOTS 1.1. ExcelAire Service, Inc. ExcelAire is an FAA Certified Air Carrier operating under Federal Aviation Regulations Part 91 and Part 135 and a federally approved repair station operating under FAR Part 145. ExcelAire provides on-demand air charter operations throughout the world. ExcelAire manages a fleet of more than 20 private aircraft for the aircraft owners, including a Global Express – an intercontinental aircraft capable of flying more than twelve hours nonstop, as well as the New York metropolitan area’s largest locally-based fleet of 2 Gulfstream jets including GIIs, IIIs, IVs and the ultra long range GV. The company also operates Hawkers and Lear jets. Due to the capabilities and range of the aircraft in its fleet, ExcelAire has a history of international flying. International destinations in just the past year have included numerous cities throughout South America, Central America, the Caribbean, Europe, the Middle East, Asia and Africa. ExcelAire aircraft and its pilots fly regularly into some of the most challenging airports in the U.S. and the world. With its roots in aircraft maintenance, ExcelAire’s operating philosophy has always put safety first, with the industry’s highest standards in maintenance, pilot experience and recurrent training for its entire staff. Pilot training standards far exceed those required by FAA regulation. All ExcelAire pilots attend simulator training twice yearly and all are typerated in the aircraft they fly. This represents a significant investment of time and money, but the company has always put a high priority on such high standards. As evidence of this commitment to safety, several years ago ExcelAire established the position of Flight Safety Officer/Director of Standards for the company, a position not required by the minimum Part 135 standards. His duties include flight and line checks, identifying safety deficiencies, disseminating safety information to the air crews and being a conduit for any anonymous safety-related complaints from the air crews. The Flight Safety Committee, composed of the Director of Operations, the Flight Safety Officer/Director of Standards, the Chief Pilot and a maintenance representative meet monthly to discuss safety issues. ExcelAire maintenance personnel are all licensed and tested by the FAA. They perform heavy maintenance on the ExcelAire fleet that few charter companies are able to perform inhouse. ExcelAire maintenance staff also receives recurrent training on a regular basis. ExcelAire is a corporation organized and existing under the laws of the State of New York, with its principal place of business at Long Island MacArthur Airport, 200 Hering Drive, Ronkonkoma, New York 11779. 1.2. ExcelAire Management and Operations ExcelAire currently employs approximately 110 people, of which 50 are pilots, 40 are professional maintenance personnel and the remaining staff are administrative and operational. ExcelAire’s senior management team includes highly experienced personnel with many years of expertise in maintenance, operations and flying throughout the world. Bob Sherry President/Chief Executive Officer Like the company he founded, Bob Sherry’s aviation roots are in maintenance. A licensed pilot, Mr. Sherry began his career in the 1970s as a mechanic on light airplanes. Known for his ability and integrity, a few years later he became service manager for Flightways of Long Island overseeing a large staff of technicians. By 1985 Mr. Sherry’s entrepreneurial spirit led to the founding of Eastway Aircraft Services, specializing in light aircraft maintenance in its own 1,000 square foot hangar at Long Island MacArthur Airport. Eastway added structural repair, and began maintaining larger aircraft and the first of many corporate jets. . As the private jet industry grew in the United States, Eastway grew with it, leading to Mr. Sherry’s establishment of ExcelAire, specializing in business jet charter, maintenance, management and sales. Today ExcelAire and Eastway focus exclusively on providing services to private jet owners. Greg Brinkman Chief Operating Officer Since earning his pilot’s license in the late 1970s, Greg Brinkman has been involved in all facets of business aviation, with experience as a corporate pilot, aircraft owner, entrepreneur and, now, as Chief Operating Officer of ExcelAire. Mr. Brinkman has flown helicopters and jets professionally for more than two decades with expertise in helicopters, corporate jets and international operations. In 1989, Mr. Brinkman launched Associated Aircraft Group (AAG) which soon became the largest operator of Sikorsky S 76 helicopters on the East Coast. United Technologies acquired AAG in 1998. With an in-depth knowledge of both piloting and business operations, Mr. Brinkman is intimately involved in the hiring of ExcelAire pilots and holding them to very high standards. George Kyriacou Director of Operations Overseeing Operations, Maintenance and the Chief Pilot, George Kyriacou brings a wealth of aviation experience to ExcelAire. A native of Cyprus, he began flying at the age of 11 as part of the British Royal Air Force’s “Royal Cadet Program.” Mr. Kyriacou emigrated in the late 1970s to the United States where he earned his Bachelor and MBA degrees. Before joining ExcelAire in 1996, Mr. Kyriacou was a pilot and supervised operations and/or maintenance for several aviation firms in the Northeast. At ExcelAire, Mr. Kyriacou’s mission is to ensure that the company adheres to FAA regulations as well as the company’s own stringent standards. He has his Airline Transport Pilot (ATP) license as well as his Airframe and Powerplant (A&P) with Inspection Authorization. Ralph Michielli Vice President of Maintenance, Director of Maintenance Ralph Michielli brings almost three decades of expertise and experience in business jet maintenance to ExcelAire. An FAA licensed Airframe and Powerplant Technician specializing in jet aircraft, Mr. Michelli holds two key positions, Vice President of Maintenance and Director of Maintenance. Beginning in the aviation industry in 1974, Mr. Michielli founded and led two companies: Seaboard Tank Corporation, a fuel system repair and modification company and Structural Testing Systems, which performs non-destructive testing of aircraft. As one of the company’s first employees, Mr. Michielli in 1993 assisted in the launch of ExcelAire Service and now oversees all maintenance operations as well as serving as a technical liaison between ExcelAire and their aircraft owners. 1.3. ExcelAire’s Inspection by FAA ExcelAire is certified as an Air Carrier pursuant to Part 135 of the Federal Aviation Regulations, 14 C.F.R. § 135 et seq. As a Part 135 operation, ExcelAire is required to comply with rigorous requirements concerning its management, operations, maintenance, pilot training and qualifications. ExcelAire’s operations are overseen on a regular basis by a team of FAA inspectors. ExcelAire’s Principal Operations Inspector (“POI”) at the FAA is Mr. Mark Rogers. Mr. Rogers conducts facility operations inspections of ExcelAire at least two or three times per year, with additional on-site visits to meet with the Director of Operations, George Kyriacou. This brings Mr. Rogers to ExcelAire’s facility at least two or three times each month. ExcelAire also has an FAA Principal Maintenance Inspector (“PMI”), Mr. Burton Connor, and Principal Avionics Inspector (“PAI”), Mr. William Corr, assigned to its operation. Mr. Connor and Mr. Corr are at ExcelAire’s facility on a near-weekly basis. ExcelAire maintains an “open-door” policy and a good working relationship with the FAA. Mr. Rogers considers ExcelAire to be a “top notch” company with low pilot and management turnover, good screening of pilots prior to employment, sound financial condition, and training consistent with part 135 standards. 1.4. ExcelAire’s International Experience During the year immediately preceding the accident, ExcelAire flew to 46 different countries around the world. These countries include: Aruba, Australia, Botswana, Brazil, China, Costa Rica, Croatia, Mexico, Portugal, Russia, South Africa, Turkey, and the United Arab Emirates, among many others. Please see the attached table of international destinations visited by ExcelAire from September, 2005 to September, 2006. Our operations personnel and pilots are trained and experienced in international air travel. It is a routine part of ExcelAire’s business. ExcelAire International Destinations September, 2005 to September, 2006 1.5. The Pilots Joseph Lepore and Jan Paladino Joseph Lepore Capitain Joseph Lepore was born on June 27, 1964. He is a resident of Bayshore, New York, where he has lived since 1976. Joe was born in Italy and his family emigrated to the United States when he was a youth. Joe is married with two children. Joe received a Bachelor of Science degree in 1987 from the Florida Institute of Technology where he majored in Aviation Management. He started flying in 1982. Joe holds FAA certificates as an airline transport pilot, certified flight instructor, airplane single and multi-engine instrument airplane ratings. He has type ratings in the G1159, CE500 and Embraer 145 aircraft. Joe currently has approximately 9,375 total flight hours. He holds a first class medical certificate with no limitations. Prior to working at ExcelAire, Joe was a chief pilot for the American Tissue Corporation flying the Citation. Prior to that he was a Check Airman and Captain for Eastway Aviation flying the Citation C550. Joe served as first officer on the BAe Jetstream 41 for Trans State Airlines, a Part 121 carrier. The Jetstream that Joe flew at Trans State Airlines had an RMU that was similar to the one used on the Legacy. Prior to Trans State Airlines, Joe was a pilot for Business Express Airlines in Portsmouth, New Hampshire. Joe’s pilot certificate has never been suspended or revoked by the FAA and he has never been cited for any violation of the Federal Aviation Regulations. On October 20, 2001 Joe was hired by ExcelAire Service, Inc. At ExcelAire he has flown the Citation II, Gulfstream II and Gulfstream III aircraft. In January of 2006, Joe was promoted from first officer to captain on the Gulfstream. Joe was personally selected to lead the Embraer Legacy program for ExcelAire. From August 9, 2006 to August 30, 2006, Joe trained at FlightSafety International in Houston, Texas to obtain his initial type rating on the EMB-145, which included the Legacy (EXHIBIT 1). The training at FlightSafety was provided at no charge to ExcelAire by Embraer as part of the purchase agreement for the aircraft. FlightSafety is the world’s largest provider of aviation services, training over 65,000 pilots annually. The FlightSafety training was comprised of 76 hours of ground training and 26 hours of flight training including 14 hours in the simulator as pilot in command and 12.5 hours as second in command. As noted in the attached report from FlightSafety International, Joe demonstrated proficiency in all aspects of his flight training on the Embraer. Following their training at FlightSafety, Joe and Jan were given an opportunity to fly a Legacy with Embraer pilots, before traveling to Brazil to pick up the new aircraft. Joe and Jan each flew a leg in a Legacy during a round trip flight between Fort Lauderdale-Hollywood International Airport (FLL) in Florida and the Charles B. Wheeler Downtown Airport (MKC), in Kansas City, Missouri. They spent all day with the Embraer pilots. The airplane flew like the FlightSafety simulator they had trained on, and there were no surprises during the flights. After arriving at the Embraer factory in Sao Jose dos Campos, Brazil, Joe and Jan flew the new aircraft, N600XL, on three separate acceptance flights for ExcelAire, taking turns in the left seat. These flights were conducted in a practice area and included a full stall series, a 60 degree bank, a visual approach to land, and a go-around that allowed two approaches, among other things. These acceptance flights were again conducted with Embraer factory pilots on board and totaled approximately four (4) hours. While at the factory, Joe and Jan also received training from Embraer engineers on software to calculate performance data such as weight and balance calculations. Embraer loaded this software into Joe’s laptop computer. They modeled their software tests using Manuas and the actual weather data for the day of training. Joe and Jan spent all day every day at the Embraer factory. Jan Paul Paladino Second in Command Jan Paul Paladino was born on April 8, 1972. He is a native of Long Island, New York. Jan’s father is from Argentina and his mother is Spanish. Jan speaks Spanish, but not fluently. He does not speak Portuguese. He is married with no children. Jan is a graduate of the Embry-Riddle Aeronautical University where he received his Bachelor of Science degree in Aeronautical Science with a minor in Aviation Safety. Jan has a total of approximately 6,400 flight hours including 300 hours as pilot in command of the Embraer 145 type aircraft. Jan also has 1,405 hours as an instructor pilot conducting primary, advanced, instrument, single and multiengine instruction. Jan holds FAA certificates and ratings as an airline transport pilot, airplane multi-engine and has a flight engineer certificate for the Boeing 727 and type ratings in the BAE 3100 and Embraer 145 aircraft. He holds an FAA first class medical certificate with no limitations. Jan has never been involved in any aircraft accidents or major incidents. His pilot certificate has never been suspended or revoked by the FAA and he has never been cited for any violation of the Federal Aviation Regulations. Jan was hired by ExcelAire Service, Inc. on July 25, 2006. Prior to joining ExcelAire, Jan served as a captain on the Embraer 145 for American Eagle Airlines, flying scheduled passenger transport operations throughout the United States and Canada. Prior to his time at American Eagle Airlines, Jan spent 4 ½ years with American Airlines as a first officer on the MD-80 series aircraft flying throughout the United States and Canada. He was also a flight engineer on the Boeing 727 based in Miami, flying international routes in Central and South America and the Caribbean. Prior to joining American Airlines, Jan was a captain and check airman for Atlantic Coast Airline flying the Jetstream 3100 in scheduled passenger transport operations throughout the Mid-Atlantic and Northeast regions of the United States. From August 9, 2006 to August 30, 2006, Jan trained on the EMB-145 at FlightSafety International in Houston, Texas. Although Jan already held a type rating for the EMB-145, ExcelAire requested that he go through the training a second time since he would be one of the Captains for ExcelAire’s new Legacy program. The FlightSafety training included 76 hours of ground training and 26 hours of flight training including 12.5 hours in the simulator as pilot in command and 14 hours as second in command. Jan demonstrated proficiency in all aspects of his flight training on the Embraer (EXHIBIT 2). 2. FACTUAL ANALYSIS 2.1. Introduction On September 29, 2006, at approximately 4:47 p.m. local time, a Boeing 737-800 SFP operated by Gol Linhas Aereas Inteligentes collided with an Embraer Legacy 600 business jet in controlled airspace over the Amazon region of Brazil as both aircraft proceeded in opposite directions on airway UZ6 at the same assigned altitude, 37,000 feet. All 154 persons aboard the Gol B737 perished in the accident, which was the worst aviation disaster in Brazil’s history (EXHIBIT 3). One of the primary objectives of the air traffic control system in Brazil and throughout the world is to prevent collisions. This section demonstrates, by providing a chronological analysis of the events on September 29, 2006, that there was a singular cause of this mid-air collision: the failure of Brazil’s air traffic control system to follow its own rules and regulations, as well as applicable international norms and standards, to ensure that the Gol B737 and the Legacy were properly separated. 2.2. Air Traffic Control’s Functions Just as its name suggests, the purpose of the air traffic control (“ATC”) system is to ensure that aircraft in the sky, as well as those on the ground, are separated from each other. Proper separation prevents collisions. The vast majority of flight operations that involve transport category aircraft, such as airliners and business jets, are conducted under instrument flight rules (“IFR”). Instrument flight rules permit the pilot (or pilots) of an appropriately equipped aircraft to navigate and operate the aircraft almost exclusively with reference to the flight instruments. Aircraft that operate under IFR in controlled airspace must adhere to clearances issued by ATC. A clearance is an authorization and/or instruction for an aircraft to proceed under conditions specified by ATC. An air traffic controller, through the use of clearances, controls and coordinates the horizontal and vertical progress of a flight from departure to destination. For example, a request from ATC to an aircraft to climb to a specified altitude is a clearance because it not only instructs the pilots of the aircraft to accomplish a particular task, but also limits the upward movement of the aircraft. Compliance with an ATC clearance is mandatory, unless there is an emergency or until ATC issues a subsequent authorization or instruction that alters or amends the prior clearance. To separate aircraft, an air traffic controller needs to “see” the air traffic in the particular sector of airspace under his or her control. This is accomplished through the use of a large computerized display, also referred to as a radar scope, that provides a “bird’s eye” (or overhead) view of the airplanes flying in the airspace over which the controller has responsibility. (See FIGURE 1). Quite simply, ATC is the “traffic cop” of the airways. Just a police officer coordinates the movement of traffic at an intersection or along a roadway, ATC controls the movement of aircraft in the sky (and on the ground) to prevent traffic conflicts or collisions. To summarize, ATC is required to control and coordinate the movement of air traffic to ensure that aircraft are properly separated and that no two aircraft pose a threat of collision to one another. 2.3. Verifying flight planning and the aircraft’s suitability prior to the takeoff The mid-air collision that occurred over the Amazon region of Brazil on September 29, 2006 involved a newly manufactured Embraer Legacy 600 business jet (EMB-135BJ), bearing registration N600XL, and a Gol Boeing 737800 SFP that was delivered new from Boeing’s factory to Gol earlier that month. The Legacy was proceeding on an IFR flight from Professor Urbano Ernesto Stumpf Airport, Sao Jose Dos Campos (SBSJ) to Eduardo Gomes International Airport (SBEG) in Manaus.2 SBSJ and SBEG are the International Civil Aviation Organization (“ICAO”) airport identifiers for these two airports. The Gol B737 was operating as Flight 1907 on an intra-Brazil flight from SBEG to the Presidente Juscelino Kubitschek Airport in Brasilia. On September 28, 2006, ExcelAire Service, Inc. accepted delivery of Legacy 600XL from Embraer at the Embraer factory located at SBSJ. On the day of departure, September 29, 2006, Embraer electronically transmitted a flight plan for N600XL to depart SBSJ and proceed under instrument flight rules to Manaus. The flight plan was prepared by Universal Weather and Aviation, Inc. (“Universal”). A flight plan is the mechanism for relaying information about a proposed IFR flight to air traffic control (“ATC”). At a minimum, the flight plan informs ATC of the departure and destination points, proposed route of flight, planned cruising altitude(s), and estimated time enroute. In Brazil and elsewhere, to operate an aircraft in controlled airspace under IFR, a pilot, flight dispatcher, or other authorized personnel must file an IFR flight plan with the local air traffic service unit. A properly completed IFR flight plan provides ATC with information from which ATC can develop an IFR clearance that it will issue to the pilots prior to the aircraft’s departure. In ICAO’s PROCEDURES FOR AIR NAVIGATION SERVICES, RULES OF THE AIR AND AIR TRAFFIC SERVICES, a “Flight Plan” is defined as “specified information provided to air traffic services units, relative to an intended flight or a portion of a flight for an aircraft.” In short, the filed flight plan is a request for a clearance to operate under IFR in controlled airspace, but a flight plan does not independently authorize such operation. An ATC clearance is required before an aircraft can operate under IFR in controlled airspace. Under all circumstances, though, an ATC clearance overrides and supersedes the information contained in the filed flight plan. ExcelAire pilots Captain Joseph Lepore and First Officer Jan Paladino conducted a preflight inspection of the Legacy’s exterior, interior, and flight deck prior to departure from Sao Jose dos Campos. Lepore and Paladino verified all systems operated normally, and Paladino requested an IFR departure clearance from the ATC facility at SBSJ. The IFR departure clearance informs the crew not only of the clearance limit, which is the point to which air traffic control will permit the aircraft to proceed in the airspace system, but should also include the route and altitude assignments. The route and altitude portions of the IFR clearance restrict the aircraft’s horizontal and vertical movements in controlled airspace, respectively. On September 29, 2006, the clearance that the crew of N600XL received from the SBSJ ATC facility authorized the aircraft to traverse Brazilian airspace to its destination, Manaus (the clearance limit), climb to an altitude of Flight Level 370, and proceed direct to the POCOS nondirectional beacon. As the Legacy was taxiing to the runway for departure, the SBSJ tower controller amended the clearance to Flight Level 370 and restricted the aircraft on departure to climb to 8,000 feet. At approximately 2:51 p.m. local time, the SBSJ tower controller cleared the Legacy for takeoff from Runway 15, a runway oriented to the southeast, with a climbing right turn to 8,000 feet after departure. This clearance was acknowledged and read back by the crew, and the Legacy was airborne shortly thereafter with a total of seven souls aboard: two crewmembers and five passengers, who consisted of two Embraer employees, two ExcelAire employees, and a journalist from the United States. 2.4. The Provision of Air Traffic Control Services to the Legacy After Departure From SBSJ and During the Initial Climb Once airborne from SBSJ, ATC removed the altitude restriction of 8,000 feet, authorized the Legacy to climb to Flight Level 370, and instructed the crew to report when the aircraft passed through 11,000 feet. Next, ATC instructed the Legacy that its new restriction was Flight Level 200 (20,000 feet). At approximately 2:57 p.m. local time, just six minutes after takeoff, N600XL made initial contact with Sector 1 of the Brasilia Area Control Center (“Brasilia Center” or “BS ACC”), informing the controller that the aircraft was climbing through 13,800 feet to its assigned altitude of Flight Level 200. The controller responded by clearing the Legacy to climb to Flight Level 240 (24,000 feet). Jan Paladino, the First Officer, read back and acknowledged the clearance to Flight Level 240. As the aircraft was climbing, its position and altitude were displayed on the scope of the Brasilia Center controller who was providing air traffic services to the flight. (See FIGURE 2). From this point forward, all time references will be to Universal Coordinated Time (referred to as “UTC” or “Zulu”) as described in FIGURE 2. In FIGURE 2, the Legacy aircraft is represented by a _, which is called a “target position symbol.” When the target position symbol appears as its does in FIGURE 2 (i.e., as an addition symbol enclosed in a circle), this indicates to the controller that the aircraft’s transponder is properly replying to interrogations made by ATC’s secondary surveillance radar. A transponder is an electronic device in an aircraft that produces a radio-signal response when it receives a radar interrogation. The absence of a circle around the data block (as will be apparent in subsequent figures) is an indication to the controller that ATC’s surveillance radar is no longer receiving replies from the aircraft’s transponder. The data block identified in FIGURE 2 gives the controller the requisite information the controller needs to provide air traffic services to the flight in accordance with the applicable Brazilian and international rules and regulations.3 Therefore, foreign pilots operating in Brazil should expect the provision of ATC services to be consistent with ICAO standards (EXHIBIT 4). Although a complete description of the data block is set forth in FIGURE 3, some of the most critical information is located on the second line, which contains an altitude status indicator flanked by two areas that present numerical information about the aircraft’s actual and planned altitudes. More specifically, when the three digits on the left side of the second line are followed by a = (level flight), + (climbing), or – (descending) symbol, this is visual confirmation to the controller that the aircraft’s transponder is providing Mode C altitude information to air traffic control. The Mode C feature of the transponder reports altitude data to air traffic control that is, in turn, displayed on the radar scope in hundred foot increments. (Mode A provides identification information to ATC, and Mode S serves as the basis for collision avoidance.) The three numerals in the right hand side of the second line of the data block represent the altitude contained in the flight plan for that particular flight segment. Thus, in FIGURE 2, the altitude status indicator shows that the Legacy is climbing through a Mode C reported altitude of 19,700 feet and the flight plan altitude for this segment of the flight is Flight Level 370. 2.5. Control’s clearances for climbing to cruise level 370 until Eduardo Gomes Airport is reached As the Legacy climbed through Flight Level 245, it entered Brazil’s “Class A” airspace, also referred to as the “Upper Control Area,” which is identified as “UTA” on aeronautical charts. Only IFR flights are permitted to operate in Brazil’s Class A airspace, and, according to ICAO, all flights in Class A airspace are provided air traffic control service and must be separated from each other by ATC. ICAO, ANNEX 11 TO THE CONVENTION ON INTERNATIONAL CIVIL AVIATION, AIR TRAFFIC SERVICES, § 2.6.1. An example of this occurred at approximately 18:00Z when Brasilia Center restricted the Legacy’s climb to Flight Level 310 because of southwest bound traffic one-thousand feet above it at Flight Level 320. (See FIGURE 4). At 18:11Z, once clear of conflicting traffic, Brasilia Center cleared the Legacy to climb and maintain Flight Level 370. The Legacy subsequently leveled at Flight Level 370 (approximately thirty minutes after departure from SBSJ) on a direct course to the ARAXA VOR. While on course and level at Flight Level 370, Brasilia Center advised the Legacy that it was under “radar surveillance,” which means that ATC’s surveillance radar positively identified N600XL as the target that the controller was tracking on the radar scope. The ATC clearance to N600XL to climb to Flight Level 370 was the last altitude clearance that ATC issued to the aircraft. Accordingly, the crew of N600XL was required to adhere to this altitude assignment, regardless of the direction of flight, and had no discretion to deviate from Flight Level 370 without a subsequent ATC clearance to depart from this altitude. (See FIGURE 5 and TIMELINE). 2.6. ATC Failures That Caused the Accident 2.6.1. ATC Was Negligent for Not Checking the Inconsistency Between the Altitude Displayed in the Control System and the Altitude at Which the Aircraft Was Flying Approximately fifty nautical miles south of Brasilia, ATC transferred control of the Legacy to Sector 7 of Brasilia Center. At 18:55Z, two minutes before the Legacy reached the Brasilia VOR, the Legacy’s data block changed to alert the controller that ATC approved the requested altitude contained in the filed flight plan; however the pilot or crew of an aircraft that is operating under IFR cannot arbitrarily change altitudes without first receiving a clearance from ATC to do so. (See FIGURE 6). Stated alternatively, the retention of flight plan altitude information in the data block is of no effect unless the controller affirmatively acts on it and assigns the aircraft—in this case, N600XL—a different altitude. The depiction of the flight plan altitude in the data block is operationally problematic. In fact, the U.S. National Transportation Safety Board, which is assisting CENIPA with the investigation into the mid-air collision, has recommended that ATC’s software be modified to prevent the data block from displaying flight plan altitudes simply because this information may, and in this case did, conflict with the altitude assignment given by ATC. (See Section IV: CENIPA and NTSB Safety Recommendations). To summarize, at 18:55Z, as the Legacy approached Brasilia, the change in the second line of the data block to 370=360 should have alerted the controller that the altitude assignment of Flight Level 370 did not correlate to the track requirements for the route segment after Brasilia. After the Legacy passed the Brasilia VOR, the data block continued to depict a planned cruising altitude of Flight Level 360 for the flight segment along UZ6 to Manaus. (See FIGURE 7). Now that the Legacy was actually proceeding northwest on UZ6 at Flight Level 370, the controller should have cleared the Legacy to a different flight level (i.e., FL 360 or 380) based on the correlation to track requirements for cruising altitudes. This is the responsibility of ATC—the pilots cannot independently change altitudes without an ATC clearance to do so. 2.6.2. ATC Was Negligent for Not Contacting the Legacy to Determine Altitude Change to 360 or, alternatively, Alter the Electronic Strip and Indicate that the Legacy Was Flying at 370, as Previously Cleared. An electronic data strip displays current and planned route and altitude information to a controller for each flight the controller is presently providing (or expects to provide) air traffic control services. More specifically, the electronic data strip provides a controller with estimated times at which an aircraft will pass a point along its route of flight, as well as the altitudes at which the aircraft is estimated to cross these points. For example, as N600XL approached the Brasilia VOR, the electronic data strip for the flight revealed that N600XL was estimating Brasilia (“BRS”) at 18:55Z, TERES at 19:33Z, and NABOL—the approximate location of the collision—at 19:54Z. The planned, but unassigned, altitude after Brasilia was Flight Level 360, with a climb to Flight Level 380 at TERES. NABOL. (See FIGURE 8). The Sector 7 controller who was providing air traffic services to the Legacy as it proceeded along UZ6 would also have received an electronic data strip for Gol Flight 1907 as the B737 proceeded southeast on the same airway. The electronic data strip for Gol Flight 1907 revealed that its planned cruising altitude was Flight Level 370—the same altitude at which the ATC cleared the Legacy—and that it was estimated to cross NABOL at 19:59Z, just five minutes after the Legacy was estimated to cross this fix. (See FIGURE 9). Quite simply, had Brasilia Center adjusted the Legacy’s altitude in accordance with the information contained in the data strips, the mid-air collision would not have occurred. 2.6.3. ATC Was Negligent for Not Adopting the Procedural Rules for Cases of Transponder Malfunction After Identifying such Malfunction on the Control Center’s Radar At 19:02Z, the BS ACC radar display revealed that ATC was not receiving a reply from radar surveillance interrogations of the Legacy’s transponder because the circle disappeared from the Legacy’s target position symbol, leaving only the “+” to represent the aircraft on the controller’s scope. (See FIGURE 10 and TIMELINE). In place of the = symbol that previously showed the Legacy level at a reported Mode C altitude of Flight Level 370, the altitude status indicator after 19:02Z began to display a “Z,” which alerts the controller that the three numerals to the left of the Z represent the aircraft’s estimated altitude derived from information supplied by ground-based heightfinding radar. An aircraft must have an operable transponder to operate in Brazil’s Upper Control Area. In the event of transponder failure, the ATC unit involved— in this case, Brasilia Center—should have immediately initiated contact with the Legacy. More specifically, under the RULES GOVERNING AIR TRAFFIC AND AIR TRAFFIC SERVICES, designated ICA 100-12 (“ICA”), published by Brazil’s Defense Ministry, Air Command, the controller must inform: (1) “the pilot when the ground interrogator or transponder of the aircraft is inoperative, or functioning deficiently,” ICA § 14.4.9; and (2) “the next control position of the same body, or the body responsible for the adjacent airspace, when the transponder of an aircraft is inoperative or functioning deficiently,” ICA § 14.4.10. Also, “when the transponder of an aircraft ceases to present the desired response signal, the controller must ask the pilot to verify the functioning of the transponder.” ICA § 14.4.11. If, through crew action, the Legacy’s transponder signal could not be restored, then the controller should have coordinated with those controllers who would subsequently provide air traffic services to N600XL to ensure that they were aware of the loss of transponder signal and that appropriate non-radar separation be maintained from all other aircraft. Simply put, this required ATC to ensure that the Legacy was vertically separated from all other air traffic on its route of flight by at least 2,000 feet. Additionally, the loss of transponder signal occurred while N600XL was operating in Reduced Vertical Separation Minimum (“RVSM”) UTA airspace, which permits controllers to provide vertical separation of only 1,000 feet to appropriately equipped aircraft (i.e., those with, among other things, a functioning transponder that has Mode C and Mode S capabilities). (Non-RVSM separation in the Upper Control Area is 2,000 feet.) Accordingly, ATC was required, with the loss of transponder signal at 19:02Z, to suspend RVSM operations for the Legacy and provide at least 2,000 feet of vertical separation between it and other traffic along its route of flight. This included Gol Flight 1907. Here, the Brasilia Center controller who was providing air traffic services to the Legacy at 19:02Z (the time the transponder signal was lost) through 19:15Z (the time at which he was relieved) did not advise the pilots of N600XL that the airplane’s transponder ceased replying to ATC’s secondary radar. The controller also failed to coordinate with other controllers or his relief to ensure that N600XL was properly separated from other traffic as it proceeded toward Manaus on upper airway UZ6 and that it was no longer RVSM compliant. Vertical separation of the Legacy from other aircraft should have been a critical consideration shortly after the height-finding radar began estimating the Legacy’s altitude. More specifically, even though subsequent flight data recorder parameters confirm that the Legacy remained level at Flight Level 370 until colliding with the Gol B737, the information received from the height-finding radar estimated the aircraft at a different altitude with nearly every tensecond sweep of the radar scope after the transponder signal was lost. The estimated altitudes varied considerably not only from the aircraft’s actual altitude, which the controller could have easily confirmed with a radio call to N600XL, but also from the flight planned altitude depicted in the right-hand portion of the second line of the data block. (See FIGURE 11). The cessation of transponder returns from the Legacy at 19:02Z and the erroneous altitude information that subsequently appeared in the data block should have been apparent to the controller because the radar scope updated over 300 times and air traffic in the sector where the Legacy was cruising was extremely light. In fact, there were only five aircraft in the sector during the time the controller should have taken action. At approximately 19:15Z, a shift change for the Sector 7 control position occurred, but the controller who was relieved did not inform his relief that ATC’s surveillance radar was no longer receiving the Legacy’s transponder. The new Sector 7 controller, though, was erroneously informed that the Legacy was cruising at Flight Level 360, but took no action to independently verify the Legacy’s altitude, even when it was apparent from the target position symbol that the transponder signal was lost and that the altitude information in the data block was changing with each update of the scope. In fact, this controller improperly changed the electronic data strip information for N600XL so that it incorrectly depicted the airplane’s cruising altitude as Flight Level 360 for the entire route segment along UZ6. ATC, though, had never cleared or commanded N600XL to maintain Flight Level 360. Additionally, at 19:15Z, the approximate time of the Sector 7 shift change, the electronic data strip information for Gol Flight 1907 was present on the radar scope. According to information in the electronic data strip for Gol Flight 1907, the B737 was estimated to pass NABOL intersection at 19:59Z at Flight Level 370. The electronic data strip information for N600XL revealed to the controller that the Legacy was estimated to cross this same waypoint at 19:54Z. In the non-transponder and non-RVSM environment that existed (because ATC was not receiving the Legacy’s transponder returns), Brasilia Center was required to clear the Legacy to maintain an altitude at or below Flight Level 350 or at or above Flight Level 390 at least ten minutes prior to the time these two aircraft were estimated to pass one another. Alternatively, the BS ACC controller could have attempted to coordinate an altitude change for Flight 1907 to ensure adequate non-radar separation. In this case, neither measure was taken. To summarize, approximately forty-five minutes before the collision, only the Sector 7 controllers had the requisite information to ensure that this accident did not occur. (See FIGURE 12). 2.6.4. ATC Was Negligent for Not Assuring the Reduced Vertical Separation Minimum of 2,000 Feet between the Legacy and the Aircraft that Operated Gol Flight 1907, Even After the Legacy’s Total Failure in the Primary and Secondary Radars At the time that ATC ceased receiving a transponder signal from the Legacy and during the fifty-five minutes prior to the collision, the air traffic in Sector 7 of Brasilia Center was light and the complexity was low. The Sector 7 controller made relatively few radio transmissions during the time that the Legacy was in that sector and extensive periods of time would pass in between these transmissions. In short, the workload for the Sector 7 controller was extremely light, leaving him with ample opportunity to take action in response to the cessation of transponder replies from the Legacy at 19:02Z and thereafter. At 19:28Z and again at 19:29Z, ATC initiated two radio calls to the Legacy, requesting the crew to change to a new frequency. These calls occurred approximately twenty-six minutes after ATC ceased receiving transponder returns from the Legacy. The delay most likely caused the Legacy to fly beyond the range of the ATC radio transmitter, resulting in a situation where the Legacy, even though its radios were operating properly, could not receive the radio calls from ATC on the last assigned frequency. Moreover, ATC made no immediate attempt to ensure that the Legacy received these calls or complied with the instruction to change to a new frequency. There were four subsequent calls by BS ACC to the Legacy, three of which simply referenced the aircraft’s call sign, while the fourth was another request for the Legacy to change to a new ATC sector frequency. Again, the Legacy’s crew did not respond to any of these transmissions because the aircraft was beyond radio reception range of the last assigned ATC frequency. (These six transmissions by Brasilia Center to the Legacy were in English and do not appear on the cockpit voice recorder transcript of the Legacy.) At 19:31Z, the target position symbol for the Legacy and the associated data block disappeared completely from controller’s radar scope. (See FIGURE 13). There is no pilot action that could have caused the complete disappearance of both the target position symbol and the data block. At this point, the Legacy was no longer in radar contact, thereby mandating that ATC provide non-radar separation of 2,000 feet between N600XL and all other traffic, including Gol Flight 1907, which was proceeding southeast on the same airway in the opposite direction. At 19:34Z, the Legacy reappears on the controller’s scope as a primary radar return without an associated data block. As previously indicated, radar contact was lost at 19:31Z, so the reappearance of the primary return is insufficient to radar identify the target as N600XL. (Note, the target position symbol at this point is just a +, which means that ATC radar is not receiving a reply from the Legacy’s transponder.) The primary return that likely represents the Legacy proceeds past TERES and disappears again at 19:38Z. Approximately one minute later, at 19:40Z, the primary return reappears, but then disappears again at 19:41Z for the remainder of the flight in Brasilia Center’s airspace. (See FIGURE 14). The Sector 7 controllers’ lack of responsiveness to the loss of transponder signal, their misapprehension of the information contained in the data block, and their reliance on the erroneous estimates of altitude generated by the height-finding radar permitted the Legacy to remain at Flight Level 370— an altitude that placed it in a situation where proper vertical separation with Flight 1907 could not be maintained. These errors were compounded because the northwestern portion of Sector 7, which borders the southern portion of Amazonica center, is an area where loss of radar contact routinely occurs. Under these circumstances, the Sector 7 controllers should have: (1) taken appropriate measures to ensure that the Legacy, as it approached the northwest portion of the sector, was separated at least 2,000 feet vertically from Gol Flight 1907; and (2) protected the altitudes from Flight Levels 360 through 380 on UZ6 from any other traffic in the vicinity of the Legacy and its cleared route of flight. 2.6.5. Errors of Brasilia and Amazonica Control Centers during the Coordination for the Transference of the Legacy Amazonica Center cleared Gol Flight 1907 to maintain Flight Level 370 as a cruising altitude along UZ6 from Manaus to Brasilia. At some point prior to the collision, the Sector 7 controller in Brasilia Center informed Amazonica Center that the Legacy was proceeding northwest on UZ6, but did not inform the Amazonica Center controller that ATC was not receiving the Legacy’s transponder or that the Legacy was no longer in radar contact. Without this information, the Amazonica controller mistakenly believed that adequate vertical separation existed based on the information contained in N600XL’s data strip that showed the aircraft was maintaining Flight Level 360 as it proceeded along UZ6. (Recall that the Brasilia Center controller improperly changed the electronic data strip on N600XL to permanently indicate— incorrectly—that the aircraft’s altitude was Flight Level 360.) In fact, as the Legacy approached Amazonica Center’s airspace, the Amazonica center controller stated to the controller in Brasilia Center: “We have it,” referring to the Legacy. This compounded the errors made thus far because N600XL was not a radar identified target at that time. If there was any information displayed for the Legacy on Amazonica Center’s radar scope, it was merely a primary target with a partial data block that did not reveal the aircraft’s actual altitude, which was Flight Level 370, or even the altitude at which Brasilia Center represented the aircraft to be cruising, Flight Level 360. 2.7. The Chain of Errors of the Air Control is the Direct Cause of the Accident At approximately 19:57Z, Gol Flight 1907 collided with N600XL at Flight Level 370 in controlled airspace over the Amazon region of Brazil. This accident was caused by the catastrophic failure of the Brazilian ATC system to: a. Command a change in altitude for N600XL so that it would not be on a collision course with Gol Flight 1907 as N600XL approached Brasilia and after it passed this point; b. Notify the crew of N600XL that ATC surveillance radar was no longer receiving replies from the aircraft’s transponder; c. Coordinate, with other controllers, proper vertical and horizontal separation from N600XL once it was apparent that ATC was no longer receiving a reply from the aircraft’s transponder; d. Confirm N600XL’s altitude during the period where the height-finding radar provided erroneous estimates of the aircraft’s altitude; e. Take action when the data block and target position symbol associated with N600XL disappeared from the controller’s radar scope; f. Properly protect the altitudes from Flight Levels 360 through 380 on UZ6 from any other traffic in the vicinity of the Legacy, such as Gol Flight 1907. 3. CENIPA AND NTSB SAFETY RECOMMENDATIONS Although the investigation into this tragic accident is still in progress, CENIPA and the National Transportation Safety Board investigators have observed numerous potential safety issues with the Brazil Air Traffic Control system. Many of these observed safety flaws in the ATC system, if corrected earlier, would have averted the September 29, 2006 collision. The interim recommendations of CENIPA and the NTSB are attached. They include: • Assure the level of English proficiency of all air traffic controllers. • Modify the ATC radar data software to ensure that the “cleared altitude” field in the data block does not change automatically. It should only be changed by the direct action of the controller having responsibility for the aircraft. • Height finding radar can be misleading to controllers and should only be displayed if specifically requested by the controller and should be unmistakably distinguishable from Mode C altitude reports from aircraft. • The ATC controllers failed to notice the loss of the signal from the Legacy’s transponder over an extended period of time. The ATC displays need to be modified to clearly identify the loss of secondary radar returns through color coding or other methods. • The ATC controllers failed to terminate RVSM operation for the Legacy after the loss of the Mode C transponder. The controllers should be retrained on RVSM operations. • Transfer of control between sectors should include any abnormal communications status or uncertainties about flight data. • ATC must develop procedures to ensure that controllers actively monitor aircraft altitude, request and confirm altitude changes when in non-mode C status, and record when aircraft leave and reach assigned altitudes. • ATC should take aggressive action to locate an aircraft which has been simultaneously or unexpectedly lost from radar and radio. • Controllers routinely drop the data blocks for aircraft in their area of responsibility just after handoff. The practice should be stopped. • Incomplete relief briefings can cause controllers to make incorrect assumptions about the status of aircraft within their control and responsibility. A checklist of critical items to be covered in the briefing should be established. 4. FREQUENTLY ASKED QUESTIONS 4.1. Questions about the accident A. Whose responsibility is it to ensure that air traffic is properly separated so that aircraft do not collide? Air traffic control (“ATC”). Annex 11 to the Convention on International Civil Aviation states that the objectives of the air traffic services [ATC] shall be to: a) prevent collisions between aircraft; b) prevent collisions between aircraft on the manoeuvring area and obstructions on that area; c) expedite and maintain an orderly flow of air traffic; d) provide advice and information useful for the safe and efficient conduct of flights; e) notify appropriate organizations regarding aircraft in need of search and rescue aid, and assist such organizations as required. Brazil is a signatory to these provisions, all of which were promulgated by the International Civil Aviation Organization (“ICAO”). B. Why did N600XL and Gol Flight 1907 collide? Brazil’s air traffic control system failed to ensure proper separation between these two aircraft. N600XL and Gol Flight 1907 were operating in Class A airspace, which, in Brazil, is referred to as the Upper Control Area. Only flights operating under Instrument Flight Rules (“IFR”) are permitted in Class A airspace, and, according to ICAO Annex 11, ATC is required to provide air traffic control services to flights operating in Class A airspace to ensure these aircraft are separated from each other. N600XL and Gol Flight 1907 were operating under IFR. Through a series of ATC errors and system deficiencies, ATC cleared both aircraft, which were headed in opposite directions on the same airway, to cruise at the same assigned altitude of Flight Level 370 (37,000 feet). C. Why were both planes at the same altitude, Flight Level 370 (37,000 feet)? ATC cleared both aircraft to maintain this altitude. More specifically, Brasilia Center cleared N600XL to maintain Flight Level 370 as its cruising altitude when it was south of Brasilia. Amazonia Center cleared Gol Flight 1907 to maintain the same cruising altitude. This was not an immediate problem when the two airplanes were hundreds of miles apart, but as these aircraft proceeded in opposite directions along upper airway UZ6, information available to ATC well in advance of the collision should have alerted ATC to alter the altitude and/or flight path of at least one of these aircraft to prevent the collision. D. Should N600XL have been at a different altitude based on the information contained in the flight plan? No. ATC controls the progress of an IFR flight from departure to destination through the use of clearances, which are verbal instructions from ATC that limit the horizontal and vertical movement of an aircraft in controlled airspace. For example, an ATC request to climb and maintain Flight Level 370 (37,000 feet) is a clearance, and the crew of the aircraft to which this clearance is issued must acknowledge the clearance and comply with it. The crew cannot deviate from this altitude assignment unless ATC authorizes a different altitude or an emergency exists that would preclude compliance with the clearance. A flight plan is not a clearance and, standing alone, does not even authorize a pilot to operate in controlled airspace under IFR. Here, even though N600XL’s flight plan contemplated two altitude changes during the flight, ATC had cleared both N600XL and Gol Flight 1907 to maintain Flight Level 370 and never altered this altitude assignment even when it was necessary to do so. E. Was there a lost communications situation at any time during the flight? No. The Legacy’s radios were operational throughout the flight and the pilots heard transmissions on the assigned ATC frequencies. A significant number of the transmissions from the Legacy to Brasilia Center that began at approximately 4:48 p.m. local time were, in fact, recorded by ATC even though ATC did not respond to these calls. Additionally, the Legacy received Brasilia Center’s request at 4:53 p.m. to switch to a new frequency, but ATC did not provide clarification of the digits when the pilots requested the controller to do so. F. What is a transponder? A transponder is an electronic device that transmits information to air traffic control when ATC’s surveillance radar interrogates it. The transponder’s reply contains, among other things, altitude data that is, in turn, processed by ATC’s computers and displayed on the controller’s radar scope. The altitude information that appears on the controller’s radar scope is the basis upon which the controller ensures that aircraft are separated vertically from each other. The transponder also provides collision avoidance information to other aircraft that are equipped with an on-board Traffic Collision Avoidance System (“TCAS”). G. Is it significant that N600XL’s transponder was not received by ATC for approximately fifty-five minutes before the collision? Yes. Once a controller has positively identified an aircraft through the use of surveillance radar, the target position symbol that represents the aircraft on the controller’s scope will change in appearance if ATC is no longer receiving the aircraft’s transponder signal. Here, ATC surveillance radar ceased receiving a transponder signal from N600XL at approximately 4:02 p.m. local time. The collision occurred approximately fifty-five minutes later, at 4:57 p.m. local time. Under Brazilian regulations, the controller must: (1) inform the pilot when the transponder signal is no longer received; and (2) inform the next control position of the same body, or the body responsible for the adjacent airspace, when the aircraft’s transponder signal is lost. Additionally, Brazilian regulations require the controller to issue a request to the pilot to verify transponder function when the transponder ceases to present the desired response signal to ATC. Here, ATC failed to take any of these required safety measures. The margin of safety was further compromised when Brazil’s height-finding radar began providing erroneous and fluctuating estimates of the Legacy’s altitude on the controller’s scope, leading the controller to incorrectly believe the aircraft was at an altitude other than Flight Level 370. At the time ATC ceased receiving the Legacy’s transponder signal, the aircraft was operating in Reduced Vertical Separation Minimum (“RVSM”) airspace, which permits high altitude air traffic to cruise within 1,000 feet of each other. Upon the loss of transponder signal, ATC was also required to suspend RVSM operations for the Legacy and ensure that, at all times, it was separated from other air traffic by at least 2,000 feet. Accordingly, ATC’s failure to appropriately respond and take action when ATC surveillance radar failed to receive N600XL’s transponder signal was a critical cause of the midair collision. H. What is the danger of criminalizing aviation accidents? The pilots of the Legacy are facing the potential for criminal prosecution under Brazilian law, and there have been some suggestions that certain controllers may also be targets in a criminal probe. The International Convention on Civil Aviation, as well as leading flight safety institutions and organizations, are steadfastly opposed to charging those involved in aviation accidents and incidents with criminal offenses because it severely inhibits the flow of information that could avert accidents in the future. Brazil has agreed to abide by the relevant ICAO provisions, and, accordingly, should formally request that the federal prosecutor and police in Sinop cease their criminal investigation into this accident. 4.2. Questions about the dialogues recorded in the Legacy’s cockpit A. 18:37:36 Z – You know, someone else having the engineer pulling the numbers with me, and we kept doing ‘em and like, oh, please shut up. And I’m like *, what’s going on, you know. I’m going, this can’t be right. I know that, but then again, I don’t want to be wrong and take off***. Question: Was there any doubt about the navigation and takeoff procedures? Answer: No. The dialogue from which this comment is taken concerns a discussion about the location of the aircraft’s center of gravity. Prior to the flight on September 29, 2006, the pilots calculated and fully understood the location of the aircraft’s center of gravity. The comment that “this can’t be right” refers to a discussion Jan Paladino had earlier that week with an Embraer engineer wherein the engineer mistakenly provided center of gravity information to Paladino in the metric system, rather than in English recognized the discrepancy and requested the engineer to provide the information in English units. To summarize, the crew of N600XL ensured that the aircraft was loaded within its center of gravity and weight limitations on September 29, 2006. B. 18:38:40 Z – Are they speaking English to you guys or Portuguese? Question: Explain if the English language used by the controllers caused problems of communications between the aircraft and ATC. Answer: The vast majority of the transmissions the pilots heard while operating in Brazilian airspace were in Portuguese. Even though the Brazilian air traffic controllers addressed the Legacy in English, some of those transmissions revealed a lack of proficiency with the English language. The pilots avoided any operational issues or problems that could have arisen from a miscommunication by requesting clarification from air traffic control (“ATC”) whenever necessary. On February 19, 2007, the media reported that the Brazilian Air Force will mandate that air traffic controllers undergo a course on the English language (EXHIBIT 5). C. 18:39:09 Z – I, I had a feeling it was going to be eight thousand feet** what it it. And when we went to, t the tower, she immediately gave it to us. Uh, it’s just the phraseology like line up and takeoff. Question: Were there doubts about the flight altitude or about the procedures to be followed during flight? Answer: No. Prior to takeoff from Sao Jose dos Campos (SBSJ), the crew received an instrument flight rules (“IFR”) departure clearance. According to that clearance, N600XL was cleared to fly the “OREN Departure,” which is a published standard instrument departure procedure for SBSJ. There is no initial altitude specified on the aeronautical chart that depicts the OREN Departure, so the crew requested clarification from ATC. The controller did not respond to the crew’s requests for clarification. Shortly before takeoff, the controller eventually issued a clearance to N600XL to maintain 8,000 feet on departure. D. 18:39:29 Z – Hate to have the Brasilian Air Force on our ass. Question: What is the meaning of this phrase? Answer: The use of this phrase relates to the crew’s decision to request confirmation of the initial altitude prior to departure. Simply put, this comment reflects (in a colloquial way) the crew’s decision to take the necessary precautions to comply with applicable rules, regulations, and clearances, rather than risk a misunderstanding with the Brazilian aeronautical authorities. E. 18:41:14 Z – Still working out the Kinks on how to work this stuff. This FMS. Question: Were there any doubts about handling the FMS? Answer: No. The pilots were proficient in their understanding and use of the Flight Management System (“FMS”) installed in the Legacy. The crew accurately loaded the required information into the FMS prior to departure from SBSJ and commanded the proper inputs to the FMS throughout the flight. F. 18:41:56 Z – ‘Cause the airshow’s not initialized to the FMS right now ‘cause it’s giving us an hour and a half. Question: Were there doubts about handling the FMS or did the equipment have any problems? Answer: No. The Legacy is equipped with a feature called the “Airshow,” which is a passenger information system that portrays, on a television screen located in the cabin, the airplane’s position relative to a geographic map. The Airshow also displays the estimated time of arrival and the flight time remaining until landing. The in-flight entertainment system on most modern commercial airliners is equipped with the same feature. Some of the information supplied to the Airshow comes from the Legacy’s FMS. The comment made at this particular time was from a passenger who is an Embraer employee, remarking that the information on the Airshow display may not be synchronized with the aircraft’s FMS. Regardless, the Airshow is not a component that, in any way, affects the safety of flight or navigation. G. 18:42:09 Z – I just want to make sure we’re going to right direction. Question: Was there a doubt about the heading to follow and about the navigation? Answer: No. The flight crew understood the route clearance, and the aircraft was proceeding on course at this time. At no point did air traffic control question the Legacy about its heading or route assignment, and the pilots were aware of the aircraft’s position along the route of flight at all times. Given these facts, the comment should not (and cannot) be construed literally. H. 18:51:00 Z – I don’t even know what to call these guys. I’m just gonna say…. Question: Was there any doubt about how to communicate with the Brazilian ATC controller? Answer: There was no doubt. This remark was made while the copilot sought to confirm that the frequency change was to another controller within Brasilia Center. I. 18:51:11 Z – November six sero sero Xray Lima, aquawk ident. Radar surveilance. Question: What did you understand for the expression “radar surveillance”? Answer: The pilots understand this term to mean that the Brasilia Center controller whose responsibility it was to provide air traffic services to N600XL positively identified the aircraft on the radar scope through ATC’s surveillance radar. Under these circumstances, the provision of air traffic services is accomplished through radar-derived information. J. 18:51:20 Z – Oh @ (fucking), I forgot to do that.. Question: What was forgotten? Answer: Nothing was forgotten. This remark was made to confirm that the IDENT button on the aircraft’s Radio Management Unit was depressed in response to the controller’s request to do so. After pressing the IDENT button, the data block that represented N600XL on the controller’s scope flashed in short intervals to confirm for the controller that the aircraft was identified through the use of ATC’s surveillance radar. K. 18:59:30 Z – Hey, did you do this at RTO one? Aw, did I? I’m sorry. I didn’t even check. Question: What was not checked? Answer: At that particular time, the crew was discussing preliminary performance data for the takeoff from Manaus on the following day. The reference to “RTO one” describes a rejected takeoff scenario, and the captain’s comment was an acknowledgement of the preliminary nature of the performance calculations. The comment in no way related to the performance planning for the flight to Manaus from SBSJ. L. 19:18:31 Z – So we did a pretty good way off ou head. Althought I think I figure, you figure about three thousand pounds…doing the wag. But the burn was more. You and I thought that the burn would be eight thousand. Turned out to be ninety eight hundred. Question: Was there any mistake on the fuel calculation for the trip? Answer: No. The discussion regarding fuel load was exclusively with reference for the flight from Manaus to Fort Lauderdale that was scheduled to occur on the following day. M. 19:25:16 Z – We should get through this flight that way to build our confidence so we don’t # (fuck) anything up. Question: Was the aircraft crew unsure about accomplishing the flight? Answer: No. The pilots were confident of their abilities to properly operate the aircraft and its systems. (They demonstrated their confidence and abilities throughout the emergency descent and landing.) N. 19:59:13 - 19:59:15 Z – Dude, you have the TCAS on? Yes, the TCAS is off. Question: What was meant by this exchange? Answer: The affirmative response “yes” to the question whether the TCAS was “on” confirms that “TA/RA” (Traffic Advisories and Resolution Advisories) was displayed in the ATC/TCAS window of the Radio Management Unit. TA/RA is the normal in-flight operational mode for the transponder and TCAS. The phrase, “the TCAS is off,” confirmed that the TCAS display did not “pop up” to provide the crew a visual indication of a Traffic Advisory (“TA”) or Resolution Advisory (“RA”). 5. THE EMBRAER LEGACY 600 135BJ The Embraer Legacy 600 is a mid sized business jet based on the Embraer 135, but which includes extra fuel tanks and winglets, similar to those on the Embraer 145. The Legacy will carrry 16 passengers up to a range of 3,250 nautical miles at 459 knots. It is 86 feet 5 inches long and has a wingspan of 68 feet 11 inches. The Legacy is equipped with the Honeywell Primus 1000 integrated avionics suite. Two] IC-600 computers are the primary components of the integrated system. They interface with the aircraft’s systems and manage information on the aircraft’s displays. There are five CRT displays in the cockpit for the flight crew including two primary flight displays (PFDs) on the pilot’s and copilot’s panel, two multifunction displays (MFDs) on the pilots and copilot’s panel, and one engine indication and crew alerting system (EICAS) display on the center panel. In addition, there are two radio management units (RMUs) on either side of the EICAS on the center panel. The Legacy is equipped with a Traffic and Collision Avoidance System (“TCAS”), which provides indications of possible airborne traffic conflicts to the crew. The system provides both visual and aural warnings and recommended evasive actions to avoid other aircraft intruding in the aircraft’s expected flight path. The TCAS computer receives data from the aircraft’s transponders and radio altimeter as well as the signals transmitted by other aircraft. The TCAS tracks all transponder-equipped proximate traffic to determine whether it could become a threat. If the TCAS determines that the predicted path of another aircraft will cross its path, it will issue a Traffic Advisory (“TA”) approximately 35 to 45 seconds prior to such conflict. The pilot can then take preventive action if necessary. The TCAS will issue a Resolution Advisory (“RA”) if a conflict is expected within 20 to 30 seconds. Voice messages will advise the pilot of the actions to be taken (climb or descend) to avoid the conflict. The area monitored by the TCAS can be displayed manually on the MFD or can be set to auto mode, in which case it will “pop up” on the MFD to provide a visual indication of any Traffic Advisory or Resolution Advisory. The Vertical Speed Indicator on the PFD will indicate the necessary vertical speed to avoid the possible conflict. The TCAS system will not give warnings below 180 feet of altitude. The transponder can be set to one of five modes, which will be displayed on the RMU: STANDBY, ATC ON (replies on Modes S and A, no altitude reporting), ATC ALT (replies on Modes A, C, and S with altitude reporting), TA ONLY (TCAS advisory mode is selected), or TA/RA (TCAS traffic advisory/resolution advisory mode is selected). Resolution Advisories can only be generated when the intruding aircraft is equipped with responding Mode S or Mode C transponders. Traffic Advisories can be generated for intruding aircraft with operative Mode S, Mode C, or Mode A transponders. The TCAS system will not provide any indication (TA or RA) of aircraft without operative transponders. 6. PRODUCTION AND PRE-DELIVERY PROBLEMS WITH N600XL and EMBRAER’S POST-ACCIDENT CONDUCT 6.1. Production problems with N600XL At least one significant incident occurred during the production/manufacture of the aircraft that may explain the failure of the transponder and Traffic Collision and Avoidance System (“TCAS”) on September 29, 2006. An avionics component that houses some of the Legacy’s communications radio and one of its transponders was returned to Honeywell, the manufacturer, in April, 2006 for malfunctions. In fact, the unit was returned to Honeywell after Embraer installed it in an aircraft that came off its production line before N600XL. Additionally, one of the Legacy’s Radio Management Units, which is part of the Honeywell avionics suite installed on the aircraft, was also returned to Honeywell because it also malfunctioned after it was installed on a previous airplane. Notwithstanding the previous malfunctions with these avionics components, and the fact that these components had been used previously in other aircraft, Embraer decided to integrate them into the Legacy it sold to ExcelAire. Embraer neither revealed to ExcelAire that these components were not “factory fresh,” nor did it inform ExcelAire that they were previously returned to Honeywell for corrective action. Additionally, several noteworthy maintenance problems were registered in the Legacy’s flight logs that evidence defects in the aircraft which could have contributed to, or explain, a failure of the transponder/TCAS system on September 29, 2006. For instance, during a production flight on July 12, 2006, Embraer identified inoperative displays related to wing antiicing. Likewise, on a pre-delivery test flight that took place on September 11, 2006, the meteorological radar, which is integrated into the aircraft’s avionics suite, failed to pass a flight test. Subsequently, on September 14, 2006, the meteorological radar failed again, and although Embraer’s corrective measures indicate that the problem was apparently identified, no actual corrective action was logged. During the September 11, 2006 test flight, the flight crew was advised, through the airplane’s warning system, of a display unit overheat condition that occurred during landing. Embraer’s only corrective action was to substitute the display unit, rather than analyzing the cause of such overheating. On September 18, 2006, the display units on the aircraft had to be readjusted due to vibrations that occurred on a second test flight. During “Pre-delivery Flight I” on September 22, 2006, only one week prior to the apparent collision with Gol Flight 1907, Embraer logged three significant problems with the aircraft. First, navigation failures were noted on one Flight Management System display, and frequencies on the other Flight Management System display failed to appear throughout the flight. The Flight Management System in the Legacy, as with most modern aircraft, is a computerized avionics component that assists the flight crew in navigation, flight planning, and aircraft control functions. This squawk necessitated the replacement of one of the aircraft’s integrated navigation units. Second, one of the flight management system computers shut down during the final approach, requiring the replacement of the associated control/display unit. (This is analogous to replacing an entire desktop computer system.) Finally, the anti-ice system failed during “Pre-delivery Flight I,” requiring Embraer to replace a sensor. This failure, though, persisted through “Predelivery Flight II,” which occurred on the same day. 6.2. Discrepancies noted during delivery ExcelAire representatives traveled to the Embraer facility in Sao Jose dos Campos, Sao Paulo, Brazil, on September 23, 2006 via commercial airplane along with and Embraer sales representative in order to perform a prepurchase inspection on the Legacy, which at the time, still displayed its temporary Brazilian registration number. The inspection process was expected to last three days. As set forth above, the purpose of the pre-purchase inspection is to ensure the basic operating condition of the airplane and to ensure that the aircraft is compliant with certain specifications. ExcelAire’s representative first inspected the Legacy on September 26, 2006, after three noteworthy discrepancies involving the aircraft’s electrical and anti-ice systems were identified. The first acceptance flight for N600XL occurred on September 26, 2006. As the Embraer test pilots were performing a preflight check of the flight deck, they elected to start the aircraft’s auxiliary power unit (APU). Prior to starting the APU, Embraer’s own procedures require that the pilots deselect the aircraft’s two avionics master switches, which are pushbuttons located on the overhead panel. Deselecting the avionics master switches prior to APU start isolates critical avionics equipment from possible voltage transients that may occur during the APU start sequence. When the master switches are deselected, the flight displays should turn off; however, when the Embraer test pilots deselected the master switches prior to starting the APU on the first acceptance flight, the captain’s Primary Flight Display (PFD) and copilot’s Multi-Function Display (MFD) remained “on.”1 As a result, it is likely that some of the avionics busses on which critical avionics equipment, like the transponder, are located were still connected to the electrical system, even though the switch position should have isolated them.2 Although Embraer attempted to troubleshoot the problem for approximately forty-five minutes, Embraer ultimately decided to start the Legacy’s APU with the captain’s PFD and copilot’s MFD still illuminated. As such, it is likely that, on September 26, 2006, critical avionics equipment on the Legacy were placed at risk for exposure to electrical transients during the APU start. During an acceptance flight on September 27, 2006, the test pilots found both Flight Management System images blinking/flickering throughout the flight. Embraer’s subsequent inspection revealed that the systems were improperly connected, giving reason to suspect that other systems could have, likewise, had faulty connections. During a nighttime ground taxi test to attempt to reconcile the persistent problems with the anti-ice system, ExcelAire noted that the cabin lights would flicker with changes from APU to engine generator power. N600XL was the first Legacy equipped with LED cabin lights, and ExcelAire wanted to ensure that they would be repaired by Embraer. After a series of exchanges/discussions between ExcelAire representatives and Embraer management, Embraer finally provided a letter of intent to correct the problem after delivery. Embraer management informed ExcelAire that the problem would be rectified by installing a current regulator in the airplane’s electrical system. After Embraer agreed to repair the LED malfunction, ExcelAire was prepared to accept the aircraft and return to Long Island. Although the impact of these multiple problems on the accident of September 29, 2006 remains unknown as of this writing, the malfunctions and anomalies mentioned here raise serious uestions regarding the fitness of the aircraft delivered to ExcelAire by Embraer. At a minimum, until such time as the nature and cause of each and every one of these discrepancies is completely investigated, any attempt to assign blame to the pilots for transponder and TCAS related issues is entirely premature. 6.3. The Inspection performed on the aircraft by Embraer right after the accident On the ground at the Cachimbo air force base following the accident, the Brazilian military and Embraer personnel videotaped a test procedure in the cockpit. During this test, Joe Lepore was ordered to occupy the right seat, and an unidentified Embraer employee sat in the left seat. Another Embraer employee, Donovan Koch, knelt at the pedestal and videotaped while reading off a checklist from a laptop. A member of Brazil’s military, perhaps from CENIPA, stood to the left of Mr. Koch, and ExcelAire’s corporate representative stood behind Mr. Koch. A video was made prior to power-up, scanning the entire cockpit, then power was applied and all self-tests were run while videotaping. All tests passed. Mr. Koch asked Joe to retrieve flight plans from the Flight Management System, and there was some discussion until the other ExcelAire pilot, Jan Paladino, offered further explanation. ExcelAire’s representative observed Embraer personnel download some data onto a laptop, then go to the back of the aircraft and download some data from the flight recorders. To date, ExcelAire is uncertain what data was downloaded from its airplane directly to the laptop. Embraer personnel also removed the flight recorders from the Legacy, and Mr. Koch subsequently assumed possession of them. 7. AVIONICS EXAMINATION AND DETECTED FAILURES Before acceptance of the Legacy aircraft from Embraer as well as during the accident flight, anomalies were noted in the avionics of the new aircraft. While the problems noted during the acceptance flights were reported as cleared prior to delivery, the investigation has revealed that the Radio Management Unit and Communication Unit installed in N600XL were not new, and in fact each had been removed from other aircraft before they were installed by Embraer in this aircraft. The Radio Management Unit (“RMU”) is a display which provides control of the radio, transponder and TCAS, among other functions. The investigation to date has uncovered that the RMU on the pilot’s side of the cockpit, RMU #1, had previously been installed in two other aircraft. RMU # 1 was first installed by Embraer on its assembly line into aircraft serial number 145-939, on October 5, 2005. On October 10, 2005 it was removed from aircraft 145-939, on the assembly line, due to "when pushing ½ function the information becomes dashed on display." On November 7, 2005 the unit was sent for repair. On December 20, 2005 RMU #1 was installed in aircraft serial number 145-946 on Embraer’s assembly line. On March 13, 2006 it was removed from aircraft 145-946 due to report of "unit is blank." On March 18, 2006 it was again sent for repair to Honeywell. Honeywell Service Report No. 110295 provides further details on this repair. On May 10, 2006 RMU # 1 was then installed on aircraft number 145-965, which latter became N600XL. ExcelAire was not advised that the RMU installed in its aircraft was not a new unit, had been previously installed in two other aircraft, and was not advised that it already had a long repair history before delivery to ExcelAire. The Communication Unit or “RCZ” is an integrated communication unit which incorporates the Transponder, TCAS and VHF communications. The investigation has disclosed that the RCZ #1 (pilot’s side) on N600XL had been previously installed on, and removed from, aircraft serial number 145-952 on April 3, 2006. On April 5, 2006 it was removed from 145-952 due to "Unit was rejected as requested by Honeywell to verify in laboratory the functionality XPDR MOD.S EHS - DOS. ECM H 3269". On April 7, 2006 RCZ #1 was tested by Honeywell and returned to stock at Embraer. On May 24, 2006, it was installed on aircraft 145-965, which later became N600XL. Again, ExcelAire was never advised that the RCZ, including its transponder and TCAS, on its new aircraft had previously been installed on another aircraft, and were not informed that it had been rejected for use on that previous aircraft. Post-accident testing of the avionics, including the RMU and RCZ, has been trusted to Honeywell, which manufactured the units. For this testing, the various components were removed from the aircraft and transported to Honeywell’s facility in Arizona.1 That testing is ongoing, yet it has yielded some interesting results, which may bear on the reliability of these supposedly new units. For example, an excessive amount on non-conductive silicone was found inside the antenna connectors of the transponder. Loose connectors on the avionics of this aircraft were previously noted during Embraer’s production flight testing of this aircraft. Specifically, the Flight Management System (“FMS”) Computer #1, on two occasions failed during production test flights. During the first failure, on September 22, 2006, the FMS went blank while the aircraft was on final approach. The second failure was on September 27, 2006 when the FMS was found to be “blinking.” The cause of that problem -- two days before the accident flight -- was found to be a connector with a “bad contact.” Another anomaly noted during the Honeywell testing is that while the aircraft was cruising in level flight at 37,000 feet, the TCAS received a “weight on wheels” signal meaning that it then thought the aircraft was on the ground. As noted previously, the TCAS system will not function when the aircraft believes that it is below 180 feet. Testing conducted to date has not disclosed the cause for this erroneous signal. The results of the complete Honeywell testing are not yet available and additional testing is required. 8. FAA SERVICE DIFFICULTY REPORTS A review of the FAA’s Service Difficulty Report database identifies nine instances of TCAS and/or transponder failure during operation in Embraer 135/145 aircraft. One of these failures occurred during taxi, the remainder occurred during climb or cruise flight. Of these nine incidents, five involved a failure of both transponders. In three of the nine incidents, maintenance was unable to find any defect in the TCAS and/or transponder. By comparison, there was only one SDR report of transponder failure and no reports of TCAS failure on any listed variant of the Boeing 737-800. This represents a failure rate on Embraer 135/145 aircraft that is more than ten-times the rate of failure on the Boeing 737-800.1 The Service Difficulty Reports are summarized in the following table. Copies of the referenced SDRs are attached. 9. CRIMINALIZING AVIATION ACCIDENTS Annex 13 of the International Convention on Civil Aviation, titled AIRCRAFT ACCIDENT AND INCIDENT INVESTIGATION, imposes certain obligations on the State in which an aircraft accident occurs. One of the central tenets embodied in Annex 13 is an admonishment that information developed during an accident investigation should not be inappropriately used for subsequent disciplinary, civil, administrative and criminal proceedings. Annex 13, to which Brazil is a signatory, makes it clear that the sole objective of the investigation of an aviation accident or incident is to prevent similar occurrences in the future and not to apportion blame or liability. This policy is consistent with the long-recognized understanding that aviation safety depends on cooperation and the free flow of information. Criminal investigations and prosecution, though, jeopardize the cooperation that is essential to improving safety and preventing accidents in the future. The free flow of information stops when well-minded persons involved in the aviation sector fear for their freedom, and, individuals, particularly, may be reluctant to offer information that could be subsequently used against them. Simply put, Annex 13 was promulgated so that these impediments do not stand in the way of accident investigations, the central purpose of which are ensure that similar tragedies do not occur in the future. Additionally, aviation accident investigations are becoming more complex and are taking longer to complete. Given this already challenging environment, aviation authorities cannot afford to lose voluntary party cooperation. When accidents are criminalized, aviation employees, who were otherwise willing to cooperate with air safety authorities, instead exercise their right for fear of selfincrimination. Air safety authorities must then look elsewhere for answers to aviation accidents; answers that may never be found. In its Note to Article 5.12 of Annex 13, which governs records developed during accident investigations, ICAO warns: [1] information given voluntarily by persons interviewed during the investigation of an accident or incident, could be utilized inappropriately for subsequent disciplinary, civil, administrative and criminal proceedings. If such information is distributed, it may, in the future, no longer be openly disclosed to investigators. Lack of access to such information would impede the investigation process and seriously affect flight safety. This is not to say that truly criminal conduct should go unpunished. In the aviation arena, there are situations where criminal prosecution is necessary and appropriate, such as an act of terrorism or reckless endangerment. Annex 13 and, more recently, the JOINT RESOLUTION REGARDING THE CRIMINALIZATION OF AVIATION ACCIDENTS (“JOINT RESOLUTION”), to which the world’s leading flight safety institutions are signatories, recognize that saboteurs and those who act willfully or in a manner that is particularly egregious, should not escape criminal liability. More significantly, though, the JOINT RESOLUTION is steadfastly opposed to the criminalization of accidents where no such evidence is present, with the signatories noting, in particular, the criminal investigation into this particular accident. (See Exhibit A: JOINT RESOLUTION, at 1.) The people being investigated in this matter have devoted their entire professional lives to aviation safety. Mr. Lepore and Mr. Paladino have been subject to questioning by the aviation authorities of the United States and have answered the questions posed as candidly as possible in the interest of aviation safety. The aviation industry needs proactive participation of its members to avoid future catastrophes. Mindful of and saddened by the loss of life as a result of this accident and in hopes of preventing future tragedies, ExcelAire reminds those with the responsibility for discerning the causes of this accident of the dire need not to criminalize the current investigation at the expense of the safety of the public-at-large. 10. FINAL CONSIDERATIONS On September 29, 2006, at approximately 4:47 p.m. local time, a Gol Boeing 737-800 SFP collided with an Embraer Legacy 600 business jet in controlled airspace over the Amazon region of Brazil. All 154 persons aboard the Gol B737 perished in the accident, which was the worst aviation disaster in Brazil’s history. A review of the air traffic control (“ATC”) transmissions and cockpit voice recorders confirm that both aircraft were cleared by ATC to fly at the same assigned altitude along the same airway in opposite directions. This collision course was established more than an hour before the eventual accident, yet because of a series of failures of the air traffic control system, the air traffic controllers responsible for these two aircraft never realized their error until it was too late. Shortly after the collision, an investigation was begun by CENIPA with assistance from the National Transportation Safety Board pursuant to ICAO Annex 13. The purpose of this ongoing investigation is to determine the causes of this accident so as to prevent similar occurrences in the future. A separate criminal investigation of this accident was also begun shortly after the collision. It is the policy of Brazil and all other signatories to the ICAO convention, however, that aircraft accident investigations should not be the subject of criminal prosecution. Criminalization of aviation accidents is contrary ICAO Annex 13 because it impairs the search for their true cause. A number of potential causes for this accident have been uncovered by the Annex 13 investigation, resulting in a series of preliminary safety recommendations being issued by CENIPA and the NTSB. Among the recommendations issued to date are: to improve the English language proficiency of the air traffic controllers; to re-train air traffic controllers on RVSM operations, including procedures to be followed if an aircraft loses Mode C (altitude reporting) transponder capability; to modify the air traffic displays to eliminate confusing and unnecessary height-finding radar data; and to clearly indicate the loss of secondary radar returns for an aircraft through color coding or other methods. In addition, the air traffic controllers must be trained to take aggressive action to locate an aircraft that has been simultaneously or unexpectedly lost from radar and/or radio contact. None of the safety recommendations issued to date relate to the conduct of the pilots of the Legacy, who were not presented with any indications from the flight instruments that their new aircraft had stopped replying to ATC radar interrogations or that there was a problem with the avionics. In fact, shortly after the impact, the pilots of the Legacy confirmed that the Legacy’s Traffic Collision Avoidance System (“TCAS”) was “on” and the TCAS traffic advisory/resolution advisory display, which “pops-up” to alert the pilots to conflicting traffic, was still off. The safety investigation has also confirmed that ATC received a significant number of the radio calls made by the Legacy before the collision, but failed to respond. Certain components of the new Legacy aircraft’s avionics have been examined by their manufacturer to determine why no warning was given prior to the collision with the Gol flight. This testing has disclosed a number of anomalies in the avionics of the Legacy, including the fact that the Radio Management Unit (“RMU”) and the Communications Unit (“RCZ”), were not new components. The RMU, which displays the status of the TCAS, had failed and been removed from two other aircraft before being installed on the “new” aircraft sold to ExcelAire. The RCZ, which includes the Mode C transponder, had been rejected from one other aircraft prior to being installed on the Legacy. The testing has also disclosed errors in the installation of the avionics components, including the use by Embraer of an “excessive amount” of non conductive silicone in antenna connections to the transponder. Just two days prior to the accident flight the Flight Management System (“FMS”) computer failed during a flight test due to a faulty connector. Numerous faults were also recorded in the memory of the TCAS unit, including several erroneous air-ground transition faults that appear to have occurred during the final flight even though the Flight Data Recorder confirms that the Legacy never deviated from its assigned altitude. Additional testing of these and other components still installed on the aircraft is required. Although there are problems with the avionics of the Legacy, the principal cause of this accident was the failure of ATC to follow its own rules and regulations to ensure that the aircraft were properly separated. This accident occurred under instrument flight rules (“IFR”) in controlled airspace. Under these conditions, the movement of aircraft, both horizontally and vertically, is controlled by ATC through the issuance of clearances. A clearance is a mandatory instruction to the aircraft that must be complied with unless there is an emergency. Prior to departure, Embraer electronically transmitted the Legacy’s flight plan to ATC providing, among other things, the proposed route of flight and altitudes for the trip from Sao Jose dos Campos (“SBSJ”) to Manaus. This plan proposed a cruising altitude of 37,000 feet from SBSJ to Brasilia at which point the Legacy planned to descend to 36,000 feet until reaching TERES, a waypoint approximately 228 nautical miles northwest of Brazilia. At TERES, the Legacy planned to climb to a cruising altitude of 38,000 feet until reaching Manaus. Shortly after takeoff, however, ATC cleared the Legacy to climb and maintain 37,000 feet, and ATC never directed or authorized the Legacy to change its cruise altitude at any point after this clearance was issued. The position of the Legacy was monitored by ATC through its secondary surveillance radar returns. These returns use information provided by the aircraft’s Mode C transponder to identify the aircraft on the ATC radar scopes and provides, in addition, the altitude of the aircraft. This information appears in a data block on the ATC scopes, which also lists the planned altitudes for the leg of the flight. Approximately two minutes before the Legacy reached Brasilia, its data block indicated that a change in altitude had been planned, yet the controller did not alter his clearance for the Legacy to maintain its 37,000 feet cruise altitude. Approximately five minutes after passing Brasilia, and fifty-five minutes prior to the accident, ATC stopped receiving the Legacy’s Mode C transponder signal. This loss of the Legacy’s transponder signal is shown in the ATC data block, yet the controller responsible for the Legacy never communicated this fact to the Legacy as he was required to do, so that the crew could check their transponder or switch to another transponder. The controller also failed to advise any other controllers that the Legacy’s transponder was inoperative or to coordinate non-radar separation of the Legacy along its planned route of flight. The loss of the Legacy’s signal occurred while the aircraft was operating in Reduced Vertical Separation Minimum (“RVSM”) airspace, which requires a working Mode C transponder on each aircraft as the vertical separation of aircraft is only 1,000 feet. Once the Legacy’s transponder signal was lost, the Legacy was no longer permitted to operate in RVSM airspace. The pilots of the Legacy could not, and did not know that ATC was not receiving their Mode C transponder signal. The controller should have directed the Legacy to descend to an altitude where greater vertical separation of aircraft is provided, which is at or below 35,000 feet. The controller failed to advise the Legacy to leave the RVSM airspace. When the Legacy’s Mode C signal was lost, the ATC system automatically substituted a far less accurate height-finding radar estimation of the Legacy’s altitude in the data block. The altitude estimated by the heightfinding radar changed with nearly every sweep of the radar, varying considerably from both the actual altitude and the planned altitude of the aircraft. The height-finding radar showed altitudes varying from 33,300 feet to 39,000 feet, yet despite the fact that this was apparently occurring in RVSM airspace, the controller took no action. (Following the accident but before the Flight Data Recorder was read, investigators actually believed that the Legacy had been performing acrobatics, presumably based on these erroneous readings). The loss of Mode C and the wild fluctuations in altitude should have been noticed by ATC as traffic in that airspace was extremely light at the time. Thirteen minutes after the Legacy’s Mode C signal was lost, the controller responsible for the Legacy was relieved. The controller not only failed to inform his relief that the Legacy’s Mode C signal had been lost, but erroneously informed his relief that the Legacy was at a cruise altitude of 36,000 feet. The relief controller took no action to confirm the Legacy’s altitude even though it was apparent from the data block that the Legacy’s Mode C signal had been lost and its estimated altitude was changing every ten seconds with each sweep of the scope. At about that time, the controller responsible for the Legacy should have received information that the Gol flight 1907 was cleared to Brasilia on the same airway and at the same altitude as the Legacy. Approximately thirteen minutes after coming on duty, the relief controller made his first attempts to reach the Legacy by radio. The purpose of those calls was to advise the Legacy to change to a new ATC frequency. The relief controller received no response to his calls and the transcript of the Legacy’s cockpit voice recorder shows that these calls were not received by the Legacy. Two minutes later, at 19:31Z, radar contact with the Legacy was lost, as the Legacy’s data block disappeared entirely from the controller’s radar scope. The controller responsible for the Legacy took no action in response to this inability to establish radio or radar contact with the aircraft. The near simultaneous loss of radio and radar contact with the aircraft should have resulted in immediate and emergency actions by ATC to reestablish contact. From 19:48Z until 19:52Z, the Legacy made twelve attempts to reach ATC without success. The crew of the Legacy received a transmission from ATC at 1953:54Z instructing them to change their frequency, but an immediate request to repeat the frequency and seven additional attempts to reach ATC by the Legacy went unanswered. At 19:56:54Z the Legacy and the Gol collided with tragic consequences. The materials collected herein provide both a factual background and expert analysis of the events of September 29, 2006. We have identified the principal failures of the ATC system that if left uncorrected will continue to endanger the flying public on the airways of Brazil. With the benefit of hindsight, we can see the signs, one after another, that should have alerted controllers to the impending disaster in time to avert it. The true causes of this accident were systemic, not criminal. If ATC had simply followed its own rules and regulations as noted in the interim recommendations from CENIPA and the NTSB, this accident would have been avoided. By identifying the true causes of this accident, we have the opportunity to prevent this from ever happening again. EXHIBIT 1 Joseph Lepore’s Training Record EXHIBIT 2 Jan Paladino’s Training Record EXHIBIT 3 Timeline of N600XL’s Flight EXHIBIT 4 IFALPA’s and APLA’s Safety Bulletins EXHIBIT 5 CENIPA’s Safety Recommendation I. SAFETY RECOMMENDATION A proposal of the accident investigation authority of the State conducting the investigation, based on information derived from the investigation, made with the intention of preventing accidents or incidents. .Ref. ICAO Annex 13. II. Preliminary safety recommendations The preliminary safety recommendations issued by the Comission are: 1. DECEA shall, immediately: a) Review the Brazilian AIP, in order to update it, with emphasis on the inclusion of rules and procedures of the Brazilian Air Traffic Control. b) Train the ATCO in the correct procedure accomplishment in the Air Traffic Control Clearances, as defined in items 8.4.8, 8.4.9 and 8.4.10 of ICA 100-12 AIR RULES AND AIR TRAFFIC CONTROL SERVICES. c) Assure the level of English proficiency for all ATCO of the Brazilian Air Traffic Control System, as well as provide the necessary means to fulfill the ICAO Annex I SARP and Doc 9835. d) Assure the adherence of all ATCO to follow all the Hand-over procedures for sectors or adjacent centers. e) Assure that written procedures for lost of communication are completely followed by all ATC units. f) Assure that all ATCO attend specific ATC rules and procedure training class, considering the recommendations on letters (b), (c), (d), and (e) of this document. g) Standardize and operationalize the use of OFF SET feature in the lack of communication and or radar coverage regions. h) Implement a new presentation (effective alert system) of loss of transponder mode “c” in the ATC software in use, in order to increase the ATCO situation awareness. EXHIBIT 6 NTSB’s Safety Recommendation Although the investigation is still in progress, and no cause has yet been determined, investigators observed numerous potential ATC safety issues: 1. Safety issue: Automated datablock changes can be easily overlooked by controllers and are potentially misleading. Recommendation: Determine the risks and benefits of modifying radar data processing software to ensure that the contents of the “cleared altitude” field of ATC data blocks can only be changed by direct action of the controller having responsibility for the aircraft. Report the findings of the analysis to DIPAA. If found to be desirable, modify ATC software as described. 2. Safety issue: Height finder, or 3D, radar values do not indicate aircraft altitude to the same accuracy as mode C, and can be misleading to controllers. Although potentially valuable for emergency or air defense purposes, for ATC purposes, there is no reason to routinely display height-finder information to civil controllers. Recommendation: Display height-finder derived altitude to controllers only upon request through a keyboard entry or other means of selection. When height-finder data is being displayed, ensure that it is unmistakably distinguishable from mode C altitude reports received from aircraft. 3. Safety issue: ATC functions and collision avoidance equipment depends heavily on properly operating transponders. The length of time that N600XL was without secondary radar targets was far beyond what would be expected for momentary radar coverage variations. The controller should have detected this and contacted the crew to correct the observed problem with the transponder. Recommendation: Modify display methods to more clearly identify loss of secondary radar returns from an aircraft, through color-coding or other readily detectable means. 4. Safety issue: Document 7030 states that non-radar separation must be applied to a non-transponder aircraft. Additionally, RVSM requires an operable mode C transponder. The loss of secondary and mode C returns should have provoked the controller to revert to standard vertical separation between N600XL and all other aircraft. Recommendation: Reinforce RVSM training for controllers, especially the need to terminate RVSM operations when an aircraft no longer can comply with the required equipage standards. 5. Safety issue: N600XL had not responded to radio calls for at least 30 minutes at the time of handoff to Manaus/Amazonia Centre, however this information was not passed to the Manaus/Amazonia controller. Brasilia should have advised Manaus/Amazonia that N600XL was not responding to ATC calls during the coordination call. Recommendation: Ensure that transfer-of-control procedures between ATC sectors include the communication of all relevant information about the aircraft involved, any abnormal communications status, and any uncertainties about flight data such as assigned route or altitude. 6. Safety issue: The transponder return from N600XL was not displayed during the period where the aircraft would have descended to FL360 based on the datablock. However there was no procedure or action taken to ensure the aircraft was at the expected altitude. Such a procedure or action should have detected that N600XL had never left 370 or reported reaching FL360. Recommendation: Develop procedures to ensure that controllers actively monitor aircraft altitude, request and confirm altitude changes when in non-mode C status, and record when aircraft leave and reach assigned altitudes. 7. Safety issue: N600XL was without 2-way communications with ATC for approximately 400 miles. Although ATC made a number of calls to the aircraft, they were unanswered, and no additional action was taken. With no required reporting on the part of the crew, they did not detect that communications may have been lost for about one hour. Also, after the loss of transponder, and inability to communicate with the crew, the primary radar target also disappeared, potentially indicating a dire situation for the aircraft (i.e. electrical failure, forced landing, etc.) Recommendation: Develop procedures to detect loss of radio communications with aircraft under CINDACTA control, for example, by requiring more frequent position reports or requiring controllers to periodically call each aircraft to confirm radio contact. Direct controllers to aggressively attempt to re-establish contact with aircraft that appear to be unresponsive, including attempted relays through other aircraft in the area. Make blind broadcasts if necessary to advise aircraft of their suspected lost communication status, and to advise flight crews of status changes such as loss of radar contact or termination of radar service. Take aggressive action to locate an aircraft which has been simultaneously or unexpectedly lost from radar and radio. 8. Safety issue: When viewing ATC displays, it was not uncommon to for investigators to observe full datablocks disappearing from display just after handoff, and prior to crossing a sector boundary, indicating that controllers were routinely dropping datablocks prior to the airplane exiting the sector. This practice increases the likelihood that a controller will forget about an aircraft that is still his responsibility to separate from other traffic. Recommendation: Ensure that controllers continuously display data blocks for aircraft operating in their areas of responsibility, even after transfer of communications to another sector. 9. Safety issue: Investigators learned that there was no way to record ATC position relief briefings, in which critical information about the status of aircraft, navaids, and other flight safety information is relayed between controllers. An incomplete relief briefing can cause controllers to inadvertently make incorrect assumptions and instructions. Recommendation: Establish a checklist for controllers to cover critical items at position relief briefings, and record briefings in a similar manner to the recordings of radio communications. EXHIBIT 7 Article Published in the Newspaper Folha de S. Paulo EXHIBIT 8