Coverstory
razil began the new century with aircraft. Scheduled commercial aviation and an ExcelAire Embraer Legacy 600 col‑ meaningful improvements in had zero fatalities and zero accidents lided at 37,000 ft. Both aircraft were flying civil aviation safety. The annual from 2003 to 2005. The perception on the same airway, in opposite direc‑ count for all civil aircraft acci‑ grew that Brazil finally had reached the tions. The business jet pilots conducted dentsB decreased from 75 to 58 between top ranks of aviation safety, particularly an emergency landing at a nearby air base 1997 and 2005, while the number of in air traffic management.1 with nobody injured. The 737 spiraled into fatal accidents decreased from 40 to 22 Then all hell broke loose on a bright the jungle, and 154 people died. (Figure 1). Meanwhile, the civil fleet in afternoon over the Amazon jungle on Public trust in the soundness of Brazil increased from 9,962 to 10,831 Sept. 29, 2006, when a Gol Boeing 737‑800 the country’s air traffic control (ATC ) A System UNDER FIRE Brazil struggles to return to world-class safety status.
BY EDVALDO PEREIRA LIMA
18 | flight safety foundation | AeroSafetyWorld | November 2007 coverStory
system began to shat‑ Brazilian Civil Aviation Safety 1997–2005 ter. In parallel with the technical investigation 80
begun by the Center 70 for the Investigation 60 and Prevention of Aeronautical Acci‑ 50
dents (CENIPA), the 40 Federal Police started 30 a criminal investiga‑ Cindacta I in Brasilia tion of its own. It was 20 is the busiest part said that the two U.S. 10 of Brazil’s air traffic Accidents per year pilots of the business Fatal accidents per year control system and 0 jet would be indicted, 1997 1998 1999 2000 2001 2002 2003 2004 2005 A System UNDER FIRE the place most as well as the air traffic Year heavily impacted by controllers (ATCOs) Note: controller discord and who were working the Data include commercial aviation (scheduled and non-scheduled service), corporate aviation, air taxi operations, helicopters and private aircraft. system disruptions. Legacy flight. The business jet, Source: CENIPA on a delivery flight Figure 1 out of Embraer’s main plant, had departed from São José dos Campos to four ACCs, of which Cindacta I is the busiest. North America via Manaus. The 737 was flying It covers 1.5 million square km (0.6 million sq south from Manaus to Brasília. News was leaked mi), including the capital city, Brasília, and three that the Legacy should have descended from other major cities, São Paulo, Rio de Janeiro and 37,000 ft to 36,000 ft after overflying Brasília, Belo Horizonte. Five of the busiest airports in which it seems, never happened. The Brasília Brazil are in Cindacta I airspace. Area Control Center (ACC) lost radio contact ATCOs working at Cindacta I felt the with the Legacy and failed to regain contact until pressure. The additional controller absences the tragedy occurred. The business jet’s transpon‑ compounded a heavy workload for the already der, it appears, was not on. In June 2007, a federal understaffed work force. That pressure, the court judge proceeded with indictments against possible prosecution of their colleagues and both Legacy pilots and four ATCOs. the apparent lack of leadership for three days immediately following the accident combined to A Road of Trials create a sense of betrayal among the controllers. A month after the accident, on Oct. 20, a cascade Controller leaders said that the ATCOs of events began that nearly brought the air trans‑ decided not to work to extreme limits. Instead port system in Brazil to its knees. On that day, a of each controller monitoring up to 25 aircraft small number of ATCOs who had monitored the simultaneously in a sector, they would stick to two flights were removed from work at Cindacta a maximum of 14. They also leaked to the me‑ I, the top ACC in Brazil’s ATC system. Several dia news of malfunctioning equipment. Flights others requested and took medical leaves. began to be delayed throughout the Brazilian Brazil Flight Information Region (FIR) air‑ network. On and off through the end of the space covers 22.0 million square km (8.5 square year, hundreds of flights were delayed more mi), of which 8.5 million square km (3.3 million than one hour, a dozen flights were cancelled sq mi) are over Brazil’s vast territory. The con‑ every day, and the situation at major airports © DECEA tinental airspace management is split between was chaotic.
www.flightsafety.org | AeroSafetyWorld | November 2007 | 19 Coverstory
Brazilian Airspace Coverage they did not trust their equipment and did not trust their command‑ ers. They said ATCOs were the subject of un‑ just and overly severe punishment by their military superiors.2 In June 2007, the Command of Aero‑ nautics (COMAER), the top executive layer of the FAB, tried to stem the conflict with a tough approach: a few ATCO leaders were jailed for several ● Cindacta I days, removed from ● Cindacta II duties at top ACCs ● Cindacta III and forbidden to talk ● Cindacta IV to the news media without authoriza‑ tion. Some controllers continue at press time
Note: to face prosecution in Cindacta is a Portugese acronym for Integrated Air Defense and Air Traffic Control Center a military court for
Source: DECEA the original accident or for the job actions Figure 2 that followed. The initial federal response was adding an additional element of tension indifferent, as if the problem had not to the situation. A Brief Background reached the magnitude that it had; On Nov. 2, the military management Brazil’s civil aviation infrastructure the first statement by the govern‑ began to press ATCOs to work extra has been developed with backing of ment held that the problem would be hours; the controllers reacted by handling the federal government through FAB solved soon by hiring an additional even fewer aircraft. On Dec. 15, an equip‑ and some of its key branches. The 60 ATCOs. ment failure at Cindacta I paralyzed most Department of Civil Aviation (DAC) However, another volatile problem air traffic in Brazil for several hours. eventually became the civil aviation or‑ then became public. Civil ATC is man‑ On March 30, this year, controllers at ganizational body. When Brazil signed aged by the Brazilian Air Force (FAB) Cindacta I and Cindacta IV at Manaus the Chicago Convention in 1944, FAB through its Department of Airspace Con‑ stopped working, grounding nearly all managed ATC. By the 1970s, an inte‑ trol (DECEA). The ATCOs are mostly civil air traffic for several hours. They de‑ grated air defense and ATC system was FAB personnel, but there also are civilian nied that they were sabotaging the ATC implemented, putting both military and professionals working in the organiza‑ system, creating the crisis. They said they civil aviation operations under a single tion, as well as civilian staff providing had previously pointed out system weak‑ umbrella. This would save resources in services to DECEA but hired by Infraero, nesses but had been ignored. They cited a developing country much in need of the airport body. The difference in wages “an incompatibility between military life upgrading to a world-class airspace en‑ in favor of Infraero ATCOs is significant, and air traffic control” and stated that vironment. The system eventually was
20 | flight safety foundation | AeroSafetyWorld | November 2007 coverStory
named the Brazilian Airspace Control nological upgrades were implemented In May 2006, as hardware approached System (SISCEAB), and its executive in 1991 and 2002. By the late 1990s, the end of its operational life, DECEA body became DECEA. with the establishment of Cindacta launched a revitalization plan to com‑ SISCEAB evolved with the establish‑ IV and the full implementation of the pletely replace navigational aids — 755 ment of four Integrated Air Defense and Amazon Surveillance System (SIVAM), pieces of equipment — by 2008/2009. In Air Traffic Control Centers, which gave Brazil achieved total airspace radar fact, 16 pieces of equipment were to have birth to the Portuguese acronym Cin‑ coverage. Software upgrades became been replaced in 2007. dacta. A center would be established at Brazilian products over time. each of the four territorial FIRs in Brazil, Last year, according to DECEA, A Shadow Side starting with Cindacta I in Brasília in Brazil had in place a complex air traf‑ When Public Labor Prosecutor Fábio October 1976. Thirty years later, the four fic management system, comprising de Assis Fernandes last year examined centers were fully established, including a technological arsenal of 70 primary ATC labor/management relations, he Cindacta II in Curitiba, III in Recife and radars, 81 secondary radars, 16 weather found it unreasonable to believe that the IV in Manaus (Figure 2). Each of these radars, six approach radars, one ground air transport crisis was due to a bunch stations operates an air defense section control radar, and myriad navigational of rioting ATCOs. He produced a report and an ACC for civil air traffic. aids, including 77 VHF omnidirectional that stated, “The problems of the air At the same time, a plan was ad‑ radios (VORs), six distance measuring transport segment in Brazil are old and vanced to provide full radar coverage equipment (DME)/VORs, 95 DMEs, structural, unknown by civilian society above 29,000 ft for the entire Brazilian 235 nondirectional beacons, 157 visual due to the lack of transparency and a territory. A consortium set up by the approach slope indicators, 18 VHF di‑ control model characteristic of a milita‑ French firm THOMSON-CSF and the rection finders, 37 instrument landing rized system.” Emphasis was given to his Brazilian Hidroservice engineering systems (ILSs), 24 localizer approach view that ATCOs cannot be blamed for company won a bid to provide hard‑ systems (ALSs) and 4,634 VHF/UHF/ errors caused by equipment malfunc‑ ware and software for Cindacta I. Tech‑ HF communication radios. tions. “The responsibility to maintain
© Tamon Takeoka/AirTeamImages.com
www.flightsafety.org | AeroSafetyWorld | November 2007 | 21 Coverstory
adequate radar and radio network operations The Brazilian Court of Audit (TCU) also took belongs to the employers. It is undeniable that the a systemic approach. An audit report the TCU existence of failures and poor reliability creates released last December states, “The development tensions and emotional stresses on the workers and growth of air transport, which reflects on the who are in the position to provide effective air economy, are restrained by the operational capac‑ traffic control.”3 ity of the air traffic control body.” This capacity Fernandes found support from workplace is dependent on the right coordination of the health specialist Rita de Cássia Araújo, an different agencies related to civil aviation and on employee of the Municipal Secretary of Health “the right availability of budget resources, as the for the city of São Paulo. Updating a dissertation system must expand to respond to the current she wrote in 2000 at the University of São Paulo lack of a link between the growth of flights and on the working environment of ATCOs at both the real possibility of controlling a greater num‑ the São Paulo–Guarulhos International Airport ber of aircraft,” the report said.5 Control Tower and at the São Paulo Terminal Federal government bodies related to ATC Area Approach Control, she said the situation include the Civil Aviation National Council has improved only slightly. In a recent article, (CONAC), COMAER, airport manager In‑ Araújo noted that, “turned scapegoats, control‑ fraero and the National Civil Aviation Agency lers’ spirit has hit bottom.” (ANAC), which replaced DAC in early 2006 and She emphasized that the military mindset is now the independent civil aviation regulatory typical of the “political-management context of agency, no longer linked to the FAB. the Brazilian civil aviation should be considered Those bodies should work with close co‑ as contributing to an additional mental and operation, but the TCU judged that they were physiological load, wearing out ATCOs. The not. DAC had built a professional aviation staff, submission to the rigid hierarchical discipline but ANAC’s first management staff was selected and other stressful conditions — alternate shifts, using political criteria and was not up to the Military controllers’ low wages, double work shifts, low professional challenge. However, after the July TAM Airbus wages are noticeably self-esteem and family problems — affect their A320 accident at Congonhas, the Minister of lower than their physical vigilance at work.” Defense was replaced and attempts were made civilian counterparts Further, Araújo said that the lack of dia‑ to get those agencies working together in a more in the same facilities. logue between ATCOs
and their supervisors © DECEA would lead control‑ lers to hide latent failures. And those, she points out, “are evident in the heart of systemic structures before an accident happens, introduced by higher hierarchical levels associated with institutional and man‑ agement layers.” To improve the reliability of a system, she said, those latent failures must be identified.4
22 | flight safety foundation | AeroSafetyWorld | November 2007 coverStory
efficient way.6 Changes brought some improve‑ happening. While all ments, but much remains to be done. bodies were linked to Another problem singled out by the TCU COMAER, there was is the lack of adequate finance resources to re‑ planning management spond to the specific needs of the various play‑ unity. When Infraero ers. Basically, resources come from airport and was separated, and air transport taxes and service fees collected by later ANAC replaced Infraero. Of the total collected, Infraero should DAC, we lost that.” keep 41 percent, up to a maximum of R$90 mil‑ The lack of lion (US$51.1 million) per year, to cover its own dialogue between expenses and transfer 51 percent to COMAER, government agen‑ which funds DECEA. The audit report pointed cies allowed the out that Infraero is retaining amounts beyond commercial aviation both its R$90 million limit and beyond its 41 route network to be percent share. structured to pass “In the last six years,” says the audit report, through two main “Infraero failed to pass to COMAER some hubs: Congonhas © DECEA R$582 million.” As a result, the report says, airport in São Paulo DECEA had required, for 2004 and 2005, and Brasília International Airport. Any weather Borges resources of about “R$715 million and R$667 problem in Congonhas affected the systemwide million, respectively, for the operation, main‑ route network. If traffic was deviated to São tenance, development and modernization of Paulo–Guarulhos International Airport at peak SISCEAB, but was granted R$468.7 million for hours, the number of gates there could not ac‑ 2004 and R$495 million for 2005.” commodate the traffic, and aircraft had to wait The report says that the crisis that began on taxiways for gates to open. in 2006 was not a surprise, as several technical This system at press time was being rearranged alerts issued by DECEA and COMAER an‑ by ANAC, mostly as a result of the TAM A320 ticipated the problem well in advance, but the accident in July. Airlines were told to avoid using Ministry of Planning and the Civil House of the Congonhas as a hub for domestic long haul opera‑ President of the Republic did not pay attention tions. As a result of route network restructuring, to those alerts. “The crisis,” states the report, “Cindacta I’s [share of] air traffic management is “is no more than a sequence of errors regarding to decline from 56 percent of all Brazilian traffic to budget cuts on proposals elaborated by DECEA, 40 percent, as traffic will be shifted to Cindacta III limitations imposed upon the expenditure of in Recife and Cindacta II in Curitiba,” Borges said. approved budget, indifference to the need to “Operational positions will be increased in both expand and modernize SISCEAB and the inef‑ ACCs, from eight to 24 consoles in Curitiba and ficient allocation of human resources.”7 from four to 18 in Recife, by 2017.” Technology is not an issue, he said. Besides A View From the Hot Seat en route radars, Brazil has terminal radars at all Air Major Brigadier Ramon Borges Cardoso is the major terminal areas. Ten weather radars in the interim General Director of DECEA, which man‑ Amazon area and seven in Southern Brazil, the ages some 4,000 aircraft movements every day. two most critical regions in this aspect, provide “Airspace control is dependent on a balance sufficient coverage. with the airport infrastructure and the air trans‑ “We are implementing monopulse secondary port route network,” Borges said, explaining the radars, a first step to Mode S, then [we will] im‑ situation in Brazil. “Any unbalancing on any of plement definitively CSN/ATM [communication these sectors affects the other two. And this is navigation surveillance/air traffic management],” www.flightsafety.org | AeroSafetyWorld | November 2007 | 23 Coverstory
Borges said. “Automatic dependent line, originally set for next March (see be implemented instead. COMAER’s surveillance–contract (ADS-C) and story, p. 25). Under these requirements, position is that, by that time, a separa‑ controller-pilot data link are being tested ATCOs are expected to be able to com‑ tion be done. The FAB will provide on the Europe–South America corridor; municate at Level 4 — an “operational” air defense utilizing radars, and a civil digital clearance delivery is to start this proficiency with English — using both agency and its civil control centers will year in São Paulo, Rio de Janeiro and technical phraseology and plain English. do air traffic control. Civilian ATCOs Brasília.” “We plan to have one English-proficient would then perform activities today At Cindactas II and III, software is ATCO at every shift, but it is impossible done by military personnel.” ●
being changed from French products to have all 4,000 ATCOs [expected for Edvaldo Pereira Lima is an aviation journalist to Brazilian developments produced 2009] trained to colloquial English level living in Brazil. by Atech, based on DECEA’s specifica‑ by then,” he said. tions. Cindactas I and IV already have There’s a real problem if you look Notes
new Brazilian software, with CNS/ATM at it another way, Borges says: “Native 1. Data released by CENIPA. Available at functionalities incorporated. English-speaking pilots sometimes press time in Portuguese at
for lack of capacity in airspace control. here. They request procedures that exist 4. Araújo, Rita de Cássia.“Prevenção ou However, as flight numbers are to keep in the United States only. … The ATCO Punição? Considerações Para Revisão growing — we expect 12 percent per doesn’t understand what he is asking. da Lógica no Controle do Tráfego Aéreo year growth in the next five years — We have to work with IATA [Interna‑ no Brasil” (“Prevention or Punishment? we’ll be able to respond. Some 600 new tional Air Transport Association] and Considerations on the Reviewing of Air Traffic Control Logic in Brazil”). Released ATCOs are to join by the end of 2008.” ask them to help pass along to pilots the by the author. That may be of some help, but there’s need to apply ICAO rules here.” another obstacle to be overcome. FAB Hierarchical conflicts between 5. “Acórdão 2420/2006 — Plenário — Relatório de Levantamento de Auditoria cannot grow its labor force beyond a ATCOs and their superiors are seen in a no Sistema de Controle do Tráfego limit set by law. COMAER now is work‑ linear way by Borges. Military personnel Aéreo.” Audit report signed by Minister ing with the House of Representatives know they will work under military rules, Augusto Nardes. Available at press time in to change that, allowing a 20 percent in‑ in a military-managed environment, Portuguese at
24 | flight safety foundation | AeroSafetyWorld | November 2007