Description

On 3 December 2020 an Embraer 195-200 (PR-AUJ) operated by Azul was on a scheduled passenger flight from Rio de Janeiro Santos Dumont to Sao Paulo Congonhas as AZU4003 and on final approach. Meanwhile, a Boeing 737-800 (PR-GUD)  operated by GOL on a scheduled passenger flight had lined up to depart from runway 35L at Sao Paulo Congonhas for Salvador as GLO1770. The two aircraft came into very close proximity (22 metres vertically) in day visual conditions (VMC) after the E195 was twice instructed to make a very late go-around (both times using an incorrect callsign prefix). 

The runways at Sao Paulo Congonhas relative to the Control Tower location. [Reproduced from the Official Report]

Investigation

An Accident Investigation was carried out by CENIPA, the Brasilian Aeronautical Accident Investigation and Prevention Centre. The cockpit voice recorder (CVR), flight data recorder (FDR) and quick access recorder (QAR) were removed from both aircraft and their relevant data were downloaded. Air traffic control (ATC) transcripts and radar recordings were also obtained.

The Embraer 195 captain had a total of 8,756 hours flying experience, of which 1,577 hours were on type. The first officer had a total of 3,962 hours flying experience, of which 345 hours were on type. The Boeing 737 captain had a total of 5,676 hours flying experience, of which 1,398 hours were on type, and the first officer had a total of 2,644 hours flying experience, of which 652 hours were on type. The tower controller in position had 11 years experience as a controller, the most recent two of which had been as tower controller at Congonhas following nine years as an area controller at Curitiba ACC. It was noted that COVID-19 precautions in force at the time had meant that the morning controller shift had a delayed report time of 0800LT (normally 0545) following a remote online briefing, but the shift still finished at 1345LT. As permitted, the tower controller was working without an assistant, and it was found that the Shift Supervisor only recognised the minimal separation between the two aircraft after hearing the go-around instruction being given.

What Happened

In late morning, the departing 737 was instructed to line up on runway 35L after a Gol Boeing 737-800 on short final. At that time, an Azul ERJ 195 was next in sequence to land on the same runway, with 6.9 nm to run and at 185 KCAS and therefore just over 2 minutes from landing. Still without a landing clearance when passing 269 feet agl with only 0.7nm to go, the ERJ crew queried “the presence of an aircraft on the landing runway threshold." The immediate response from tower was a landing clearance, which was immediately followed by the departing 737 crew responding that they were on the runway 35L threshold having been instructed to “line up and wait." The tower controller then instructed the Azul Embraer 195 to go around (although initially confused the call by beginning it with “Gol” instead of “Azul”). In the absence of an immediate response from the Embraer 195, he repeated his instruction after four seconds, again using (a different) incorrect callsign prefix at which point the Embraer transmitted that it was going around. At that time, it was 370 metres from the runway 35L threshold with 12 seconds to touchdown and descending through 213 feet agl.

QAR data from the 737 showed that the Embraer had crossed the runway threshold at 113 feet which, based on the height above the runway of the 737 vertical stabiliser (41.2 feet), meant that the minimum vertical separation between the two aircraft had been 71.8 feet. Thirty seconds after the Embraer had gone around, the 737 was cleared for takeoff. The Embraer was radar vectored onto another approach to 35L and landed without further event five minutes later.

The tower controller had issued conflicting clearances to the two aircraft involved and was only alerted to the error by the 737 crew. This crew saw the Embraer 195 approaching on their TCAS display and, on hearing its landing clearance being given, immediately reminded the controller of their position having complied with ATC instructions. By this time, they had been in position at the runway threshold for “more than three minutes."  

Why It Happened

Whilst it was apparent that the origin of the conflict, which was regarded as a runway incursion, was controller error, the context for this error was examined. It was stated by tower controllers that the view of both the 17R and 35L thresholds from the visual control room (VCR) was partly obscured and that “there were no specific procedures for these blind spots that would allow visual monitoring of aircraft during landing and takeoff operations." It was also found that although the duties of the tower supervisor included a requirement to “supervise the duties of controllers in operational positions,” this had not been occurring when the tower controller’s error had been made, reportedly because the supervisor had been “filling out the occurrence log book." It was also found that the supervisor had failed to remove the controller involved after the conflict had occurred and had also failed to notify the airport operator of it, when both were mandatory requirements.

Four Contributory Factors were identified as follows:

• Inadequate Tower Controller Attention
  The tower controller did not pay attention to the scenario that was unfolding and authorised the landing of the ERJ 195 on runway 35L whilst it was occupied by another aircraft. Thus, the lapse of attention allowed the worsening of the scenario of aircraft approaching below the expected minimums.
• Inappropriate Tower Controller Attitude
  The tower controller did not perform a visual scan of the runway, as provided for in the ‘ATS Runway Incursion Prevention Program’. If the controller had performed this procedure, they would have recognised that the 737 was still on runway 35L and would not have authorised the landing of the ERJ195. At the time of the incident, the tower supervisor was not paying attention to the tasks being performed by the controllers on duty because he was filling out the incident logbook.
• Absence of Tower Supervisor Perception
  When asked about the reasons that led him not to intervene, the tower supervisor stated that at the time of the runway incursion, he was filling out the incident logbook, which reduced his situational awareness, specifically by impairing the visualisation of the runway incursion scenario that occurred.
• Inadequate Monitoring by the Tower Supervisor
  There was no adequate monitoring by the tower supervisor of the tower controller’s actions, which would have facilitated an assertive correction to avoid the runway incursion conflict.

Five Safety Recommendations were issued based in the investigation findings as follows:

• The National Civil Aviation Agency (ANAC) should disclose the lessons learned in this investigation to aerodrome operators who have declared themselves capable of performing operations governed by Brasil Civil Aviation Regulation No. 121, so that they may be used to promote operational safety within the scope of each operator's SMS. [IG-144/CENIPA/2020 - 01]
• The Department of Airspace Control (DECEA) should work together with airport operator AENA Brasil to include hot spots in the Congonhas Aerodrome Chart, aiming to alert pilots operating at that aerodrome about the locations with the highest incidence of runway incursions, as well as the points that cannot be seen by the controller occupying the tower supervisor position. [IG-144/CENIPA/2020 - 02]
• The Department of Airspace Control (DECEA) should, together with Airport Operator AENA Brasil, evaluate the feasibility of implementing technological measures that increase the level of situational awareness of pilots and air traffic controllers, mitigating the risks of runway incursions at Congonhas. [IG-144/CENIPA/2020 - 03]
• The Department of Airspace Control (DECEA) should work with the Sao Paulo Airspace Control Authority (DTCEA-SP) with the aim of adopting solutions to mitigate or eliminate the visual obstruction that the concrete structures of the Congonhas tower cause in the view of the runway from the tower controller operational position. [IG-144/CENIPA/2020 - 04]
• The Department of Airspace Control (DECEA) should disclose the lessons learned in this investigation to the ANSPs that operate at aerodromes that have a Runway Safety Team, so that these providers are instructed to communicate runway incursions to the local aerodrome operator as soon as possible as provided for in the Air Force Command Instruction 81-4 “Program for Preventing Runway Incursion Occurrences in the Provision of Air Traffic." [IG-144/CENIPA/2020 - 05]

The Final Report was released on 29 October 2024 but only in Portuguese.

Related Articles

• Runway Incursion
• Loss of Separation
• Controller Blind Spot (SKYclip)
• Vigilance in ATM
• Visual Scanning Technique
• Controller Detection of Manoeuvring Area Conflicts
• The Tower Controller
• Hot Spots at Aerodromes