Loss of separation

Overview

At Sydney Airport in the early evening of 5 August 2019, the crews of 3 aircraft were using runway 34R in various phases of flight:

• de Havilland Canada Dash 8 operated by QantasLink, nearing the end of the landing approach
• Boeing 737 registered VH-VZO and operated by Qantas, on the final segment of an independent visual approach
• Airbus A330 registered VH-EBJ and operated by Qantas, awaiting instructions and clearance to line up and take off and make a right turn to track to the east via the MARUB SIX area navigation (RNAV) standard instrument departure (SID).

The airport was operating with parallel runway operations using a runway configuration of 34L and 34R for arrivals and departures. At the time, there were no other aircraft in the area directly relevant to the occurrence. The Sydney automatic terminal information service broadcast the wind was from 30° at 12 kt with a crosswind of 10 kt. The conditions were clear and it was in the early evening after last light.[1]

The above traffic was managed by air traffic control (ATC) in the Sydney Tower in the ‘aerodrome controller – east’ (ADC) position, responsible for operations using runway 34R and the airspace east of the airport. This position was filled by two people:

• a controller who was in the late stages of training for the ADC role and who managed traffic in the vicinity of the airport (trainee ADC)
• an on-the-job-training-instructor (OJTI), who was assisting and supervising the trainee ADC, and held the overall responsibility for the provision of safe air traffic services by the ADC position.

When the Dash 8 had landed and taxied off the runway, the trainee ADC issued a clearance to the A330 crew for an immediate take-off, and they complied. Assessing that there could be insufficient runway separation between the A330 on the take-off roll and the anticipated arrival of the 737 at the runway threshold, the trainee ADC instructed the 737 crew to conduct a missed approach.

The 737 flight crew initiated the missed approach procedure by climbing on the runway heading but did not commence the mandatory right turn on passing 600 ft. The 737 turned when instructed by the trainee ADC. Meanwhile, the A330 followed the SID track (MARUB SIX) by turning right shortly after passing the departure end of the runway, and the two flight paths began to converge (Figure 1).

Both aircraft continued turning right and climbing. The A330 flight crew then received an audible traffic collision advisory system (TCAS) alert (‘TRAFFIC TRAFFIC’). The A330 first officer looked out the right rear flight deck window and saw the 737 above in a climbing turn and in close proximity. The aircraft came within about 0.42 NM horizontally and 508 ft vertically, with the two aircraft abeam of each other and turning right.

The trainee ADC issued further instructions to both aircraft. Before the minimum required separation standard was met, but with the separation increasing as the 737 accelerated ahead of the A330, the trainee ADC transferred the 737 to the approach controller.[2]

Figure 1: Overview of aircraft flight paths

White lines link the locations of the two aircraft at the same point in time.

Source: Google Earth, annotated by the ATSB

Events prior to the occurrence

Dash 8 approach and landing

The first aircraft in the approach and landing sequence for runway 34R was a De Havilland Canada DHC-8 (Dash 8) turboprop aircraft, operated by QantasLink. Its flight crew made contact with Sydney tower (the ADC) at 1827:55.

Boeing 737 instrument arrival

The second aircraft in the arrival sequence was a Boeing 737, registered VH-VZO, operated by Qantas Airways as scheduled passenger transport flight QF545 from Brisbane, Queensland to Sydney, New South Wales.

The captain was the pilot monitoring (PM)[3] and the FO was pilot flying (PF).

Prior to descent, ATC issued the flight crew with a clearance for the ‘BOREE ONE ALPHA’ area navigation (RNAV) arrival to runway 34R. This standard instrument arrival (STAR) comprised a series of altitude limits and waypoints that diverted aircraft inbound from the north to the east of the airport to fly parallel to the runway in a southerly direction until ATC provided radar vectors to intercept the northerly approach path (335°) of runway 34R.[4]

The 737 flight crew were also cleared to conduct an independent visual approach (IVA)[5] to runway 34R and programmed the flight management computer (FMC) with the GBAS[6] landing system (GLS) runway 34R instrument approach procedure (a GPS-based type of instrument approach). This provided guidance for a straight-in approach to a point on the runway threshold, published as waypoint RW34R, on the typical glide-path angle of 3°.

For a missed approach during this IVA, the crew were required to follow the instructions on the runway 34R approach chart (Figure 2). If a missed approach was initiated at or after the missed approach point, at about 0.5 NM from the runway (corresponding to the approach path intersecting with the decision altitude[7] of 220 ft), flight crews were to maintain the approach track (335°) until a mandatory right turn at 600 ft onto a heading of 070°.[8] The specified level-off altitude was 2,000 ft or as directed by ATC. If the missed approach was initiated before the missed approach point, flight crews were expected to maintain the approach track until reaching the missed approach point, then follow the procedure.

In accordance with standard operator procedures, the flight crew completed an arrival and approach briefing before descent. According to the crew, they reviewed all of the standard items, including the approach chart.

The captain recalled checking that the missed approach procedure loaded in the FMC was consistent with the approach chart. Both flight crew members later reported that they were familiar with the missed approach procedure for runway 34R and had discussed the risk of inadvertently climbing above the 2,000 ft level-off altitude, which was lower than typical at other locations.

They also discussed the requirement to turn right in a missed approach. The flight crew did not discuss how a missed approach would be flown with regard to the autopilot flight director system (AFDS)[9] modes, or whether the autopilot would be engaged, or how they would manage configuration changes during the required low-level manoeuvring.

The FO mentally noted that the GLS approach had speed restrictions but the flight crew did not discuss the required speeds. As the STAR did not join the GLS runway 34R approach, the flight crew observed a discontinuity between the two procedures in the FMC route legs page (in a GLS approach, the aircraft follows a predetermined approach path and angle). This meant that there was no active waypoint for AFDS guidance. There was no standard procedure for the crew to resolve the discontinuity.

During descent, the captain contacted Sydney air traffic control (the approach controller) and reported being visual with runway 34R in sight. The approach controller was responsible for the arrival sequence prior to transfer of aircraft to the aerodrome controller. The controller advised the ATSB that it was a normal day and they did not recall any details of the approach sequence of the Dash 8 and 737.

Figure 2: Sydney GLS runway 34R approach chart with missed approach requirements defined by blue boxes and approach speed requirements highlighted in yellow

Source: Qantas Airways, annotated by ATSB

The approach controller issued the flight crew a series of radar vectors to intercept the final approach for runway 34R. The FO selected the aircraft’s AFDS lateral mode to heading select (HDG SEL) to maintain the assigned headings.

After engaging heading select mode the flight crew did not update the route legs page in the FMC. As a result, the active FMC waypoint (the one to which the FMC would guide the flight crew or autopilot in LNAV) remained behind the aircraft’s position when it later passed through the waypoint (see 737 automatic flight system).

3The approach controller later cleared the flight crew for an independent visual approach (IVA).

Passing 4,300 ft, at 1827:19, the 737 flight crew selected flaps 1. At 10 NM track distance from the runway 34R threshold the aircraft was decelerating through 200 kt (the IVA required speed was 160–185 kt).

Descending through 2,300 ft, the aircraft was fully established on the approach with the autopilot and autothrottle engaged.

At 1830:05, as the 737 was passing about 1,850 ft and about 6.2 NM from the threshold, the approach controller instructed the flight crew to contact Sydney tower (a role carried out by the trainee ADC).

At this time, recorded data showed that the Dash 8 was 4.5 NM (8.4 km) ahead of the 737. Successive arrivals were to be at least 5 NM (9.3 km) apart unless there was prior coordination between the two controllers (see Surveillance separation).

Airbus A330 taxi to holding point

The flight crew of Airbus A330, registered VH-EBJ, was operating scheduled passenger transport flight QF459 for Qantas Airways from Sydney to Melbourne, Victoria. The captain was the PM and the FO was the PF.

The A330 crew was cleared to depart via the MARUB SIX RNAV departure (Figure 3). This was a commonly-used standard instrument departure (SID) for jet aircraft taking off from runway 34R and tracking south. On reaching 500 ft, flight crews were required to make a right turn onto a south-easterly heading to intercept an easterly track (075°) from the airport to waypoint MARUB.[10] From there, aircraft were turned right onto a southerly track and a further right turn after passing 10,000 ft.

At 1824:58, the trainee ADC cleared the A330 to taxi to the holding point at the southern end runway 34R.

Figure 3: Sydney SID MARUB SIX RNAV departure plate

Source: Jeppesen

Concurrent 737 final approach and A330 departure

The trainee ADC cleared the Dash 8 to land at 1830:08. At 1830:21, when the 737 was 5.3 NM (9.5 km) from the runway 34R threshold, the flight crew selected flaps 15 and landing gear down. At 1830:24 the 737 flight crew established contact with the ADC. The aircraft was descending through 1,200 ft on a stable approach in landing configuration with flaps 30 and both the glideslope and localiser hold modes engaged. The 737 was gaining on the Dash 8 which was about 4.1 NM (7.5 km) ahead.

At 1830:31, the aircraft passed waypoint OLSOG, 4.8 NM (8.6 km) on the extended runway centreline, decelerating through 180 kt (with no wind). The approach chart (Figure 2) required flight crews to be 150–160 kt at this point, and if unable to comply, crews were to advise ATC. The 737 flight crew did not do so.

The Dash 8 was ahead of the 737 continuing its approach to runway 34R. The trainee ADC and OJTI both recalled that the Dash 8 appeared slower than a typical Dash 8 during approach and landing and then when vacating the runway. Radar data showed the ground speed of Dash 8 averaged 100 kt in the minute leading up to it crossing the runway 34R threshold. Airservices reported that the typical speed for a Dash 8 is 120–140 kt over the threshold.

At 1831:04, as the Dash 8 crossed the runway 34R threshold, the trainee ADC instructed the A330 flight crew to line up and wait on runway 34R (Figure 4Figure 4).

Figure 4: Position of the 737 when the A330 was instructed to line up

Source: Google Earth, annotated by the ATSB

At this time, the 737 was 3.3 NM from the runway 34R threshold, fully configured for landing (gear down and flaps 30), and was decelerating through 153 kt (Figure 5).

Figure 5: Representation of an ATC display when the A330 crew was instructed to line up showing location of the A330, Dash 8 and 737 aircraft and an exemplar separation measurement (light yellow).[11]

Source: Airservices Australia, annotated by the ATSB

The OJTI recalled that when the trainee ADC instructed the A330 to line-up in preparation for a departure, they glanced at the traffic display and noted that the 737 on approach was about 3.5 NM from the runway. At the time, the OJTI considered the gap to be ‘ambitious’ but if the preceding Dash 8 turned off early and the right phrases were used for an immediate take-off it should be expected to work.

At 1831:10, the trainee ADC instructed the 737 flight crew to reduce to minimum speed. The captain responded that they were at minimum speed. Flight data recorded that at that time the 737 was about 3.1 NM from the runway threshold with an airspeed of 155 kt and reducing, which was slightly above the selected approach speed and the minimum approach speed.[12]

The Dash 8 had landed but was still on the runway. At 1831:20 the trainee ADC instructed the A330 flight crew to expedite the line-up and be ready for an immediate departure. The captain responded that they were ready (for take-off).

At this time, the 737 was about 2.7 NM from the runway threshold with an airspeed of about 152 kt. The 737 captain recalled mentioning to the FO ‘this is not going to work’ and mentally preparing for a potential missed approach. The FO disconnected the autopilot and autothrottle at 1832:24 in preparation for a manually flown go-around should it be required.

At 1831:45, with the Dash 8 vacating the runway via the first available exit (T2), the trainee ADC advised the A330 flight crew, ‘on 34R cleared for immediate take-off’ (Figure 6). The 737 was now 1.8 NM from the runway threshold with a ground speed of 140 kt. The A330 FO pushed the power levers forward for take-off once the aircraft was lined up at 1831:54.

Figure 6: Sequence from A330 clearance for take-off

Source: Google Earth, annotated by the ATSB

The OJTI recalled they did not expect the trainee ADC to issue the take-off clearance but this was not discussed with the trainee. They asked the trainee if the runway separation standard would be met, to which the trainee replied ‘no’.[13] The OJTI also recalled asking the trainee ‘if you send [the 737] around, what are we going to do?’

At 1831:58, the trainee ADC instructed the 737 flight crew to ‘go around’ (conduct a missed approach). Initially, that instruction was mistakenly issued to the A330 (‘Qantas 459’) before immediately being corrected to the 737 (‘Qantas 545’). At 1832:02, the 737 captain read back the instruction. The 737 was descending through about 400 ft and was 1.2 NM (2.2 km) from the runway 34R threshold.

At this time the A330 was accelerating past 60 kt. The A330 captain recalled hearing the trainee ADC issue the 737 a go-around instruction and expected the take-off clearance to be cancelled. The A330 captain also recalled being aware of the potential conflict between their planned departure track via the SID and the 737 concurrently on the 34R missed approach. However, no further instruction was given by the controller, and the A330 flight crew continued the take-off in accordance with their clearance.

The trainee ADC later advised the ATSB that cancelling the A330 take-off clearance was an option but there would be risk involved. The OJTI considered that as the A330 was accelerating and it was difficult to visually assess speed at night, it would not be appropriate to cancel the take‑off clearance.

There was a tower shift manager (TSM) on duty in the tower, who performed direct supervision of the operating environment, and was required to support, intervene, or broadly direct activities. During this time the TSM was assisting a surface movement controller[14] and was not actively supervising or aware of the developing traffic scenario on runway 34R. The OJTI wanted to report the missed approach to the TSM, as procedures required, but gaining the TSM’s attention would require leaving the trainee ADC unsupervised.

737 missed approach

At 1832:03, at about 350 ft and about 1.0 NM (1.8 km) from the runway threshold, the 737 flight crew commenced a manually-flown go-around and missed approach procedure. The FO pressed the take-off/go-around (TOGA) button[15] and called for the captain to select flaps 15, which the captain actioned at 1832:08. Once a positive climb was established the FO called for the landing gear to be selected up, and this was actioned by the captain.

At 1832:15, the 737 overflew the missed approach point while climbing through 400 ft, tracking on the runway heading. The aircraft passed through the mandatory missed approach turn altitude (600 ft) at 1832:21. The FO later stated that they believed the missed approach point was still ahead of the aircraft’s position and therefore delayed commencement of the right turn. The FO also recalled expecting the navigation mode to change from TOGA to lateral navigation (LNAV) and command the right turn, but that did not happen. The flight director lateral guidance instead maintained the runway track.

Passing about 600 ft the FO called for flap 5. The captain later reported hesitating before retracting the flaps because of an outdated procedure where flap retraction could only be commenced above 1,000 ft. The captain set flap 5 at 1832:23, and the FO commenced acceleration while still maintaining runway track.

At 1832:28 and accelerating through 160 kt, the 737 passed the pre-programmed missed approach point in the FMC (incorrectly located at the runway 34R threshold; see Runway 34R missed approach procedure) and was climbing through 860 ft to the right of the runway. The A330 had just commenced rotation.

The OJTI recalled they were aware that two aircraft departing on the MARUB SID and missed approach track concurrently would potentially conflict due to the inherent design of the two procedures. As a way of prompting a response, the OJTI asked the trainee ADC where the A330 was going to be tracking. The trainee ADC described the tracking of aircraft on the MARUB SID, which indicated to the OJTI that the trainee had understood they were going to have to apply tactical separation by adjusting the missed approach tracking of the 737 to increase the spacing with the departing A330.

The TSM was still assisting the other controller and remained unaware of the missed approach and developing conflict.

Air traffic control vectoring and close proximity

At 1832:31, passing about 920 ft, the 737 flight crew retracted flaps to flaps 1 while continuing to maintain runway track. The A330 was about 0.7 NM (1.2 km) ahead and beginning to climb.

Immediately after this, the trainee ADC instructed the 737 flight crew to turn right to heading 100°, thinking at the time that this would provide divergence from the A330 that was going to intercept the 075° radial. The trainee’s expectation was that the 737 would turn well before the crossing runway and be manoeuvring south of the 075 radial. The trainee ADC did not issue a traffic alert or a safety alert.[16]

The OJTI later reported that while the trainee’s choice of action would not have been the OJTI’s ‘first choice’ they expected the trainee to manage it. The OJTI was mindful that, at this point in the training, the trainee ADC was meant to be demonstrating the ability to work without instructor intervention. The OJTI later reported that they would have preferred the trainee ADC to cancel the A330’s SID and issue its flight crew a heading to the right of the runway centreline (such as 030°), but the OJTI did not communicate this to the trainee.[17]

The 737 was then at about 980 ft, which was below the minimum vectoring altitude (MVA) of 1,500 ft in this area (see Compromised separation). The turn instruction did not include phrasing to indicate the safety or urgency of the situation (such as traffic ahead) and responsibility for terrain clearance could not be assigned to the flight crew. A visual separation standard was still being applied between the two aircraft (see Air traffic control recorded data).

At 1832:37, about 1.1 NM (2.1 km) past the missed approach point and climbing through about 1,100 ft, the 737’s autopilot was engaged, the lateral mode was changed to heading select, and it commenced turning off the runway track (335°). The 737’s bank angle reached 25° (a standard rate turn) at 1832:51 and a steady turn at an average 210 kt was maintained until 1833:42; this gave an average turn radius of about 1.4 NM (2.6 km).

Due to the high nose attitude and increased workload during the climbing turn the flight crew did not see the A330, which was 0.6 NM (1.2 km) ahead of them and just passing the departure end of the runway at an altitude of about 350 ft.

The trainee ADC recalled that, at this point, there was quite a bit of distance between the two aircraft and the 737 looked like it was starting to turn south of the 075 radial. According to the trainee, for most of the time they were looking out the windows and able to see the aircraft clearly and judge speed, distance, and angle of bank. In addition the trainee ADC was looking at the radar display for speed and height.

The OJTI later reported they were monitoring the aircraft visually and were confident that the aircraft would not collide.

The A330 flight crew recalled that they were aware of the other aircraft being behind them conducting the missed approach procedure. The A330 FO looked for the 737 at about 1832:41, expecting it to have made an earlier right turn in accordance with the published missed approach procedure, but was unable to see it.

At 1832:44, passing about 650 ft, the A330 FO, who was PF, commenced a right turn to track in accordance with the MARUB SID. The FO later stated that after passing the turn altitude (500 ft) they delayed making the turn by a few seconds in the knowledge that the 737 was behind them.

The A330’s rate of climb at the initiation of the turn was about 2,800 ft/min. The A330 reached its average bank angle through the initial part of the turn (23°) at 1832:52 with an average airspeed of 141 kt and turn radius of about 0.7 NM (1.3 km). That is, as both aircraft turned, the A330 was turning tighter and travelling slower than the 737.

At 1832:50 the A330’s traffic collision avoidance system (TCAS) began to generate a traffic advisory[18] (TA) visual and aural annunciation. At this point the aircraft were 0.5 NM (0.9 km) and 600 ft apart. In response, the A330 FO verbalised the TA and confirmed that they had control in accordance with Qantas procedures. Figure 7 shows the position and flight paths of the aircraft through this period, and Figure 8 shows how an ATC display might appear if a controller measured the separation at this point.

Figure 7: Concurrent right turns and close proximity

Source: Google Earth, annotated by the ATSB

Figure 8: ATC display showing both aircraft at the time of A330 TCAS TA

Image represents a typical ATC display but is not necessarily representative of the display shown to any controller at the time of the occurrence. The separation measurement was manually added during a later replay of the occurrence and is approximate.

Source: Airservices Australia, annotated by the ATSB

The FO looked for the 737 again but was still unable to see it. A few seconds later the A330 FO saw the 737 in close proximity out the rear flight deck window towards the right rear quarter. In response, the FO reduced the aircraft’s angle of bank to widen the turn further away from the 737. Recorded data showed the rate of turn decreasing at 1833:06.

The FO advised the captain that ‘the 737 is very close’. In response, the captain reportedly instructed the FO to continue climbing at maximum rate, do not accelerate, and keep climbing until they were through 4,000 ft. The 737 captain recalled observing a TCAS TA alert but could not remember hearing an aural alert.

Throughout this period the trainee ADC was coordinating with the approach controller about the 737’s missed approach and anticipated track and altitude. The OJTI reported being confident that the 737 would pull ahead of the A330 in the turn. At 1833:03:

• Separation between the aircraft had reduced to a minimum of about 0.42 NM (0.78 km) horizontally and about 508 ft vertically. At this time, the two aircraft were approximately abeam of each other and turning right. The A330 was climbing at about 1,900 ft/min and the 737 was levelling off at the altitude required by the approach chart (2,000 ft).[19]
• Intending to increase the separation distance, the trainee ADC instructed the 737 flight crew to turn further right to 120°. Its heading was about 022° at the time.

The trainee ADC later reported that the A330 made an earlier and tighter turn than other widebody jet aircraft typically make (although still complying with the SID). This had unexpectedly brought the A330 closer towards the 737’s anticipated track.

At 1833:09, the trainee ADC issued a further instruction to the 737 crew to climb to 3,000 ft.

Increasing separation

At 1833:17, the A330 captain made a radio transmission to the ADC, stating ‘that was very close – you could have asked us to do a heading’. At around this time, the A330’s TCAS TA ceased.

Intending to stop the A330’s turn, the trainee ADC issued an instruction to the A330 flight crew to turn ‘left’ to 100°. Initially, the trainee ADC did not cancel the SID clearance as was required before issuing vectors. After the A330 captain advised that the A330 was following a SID, the trainee ADC instructed the A330 flight crew to cancel the SID and turn ‘left’ to 100°.

The A330’s heading was about 070° at the time, almost directly behind the 737, with both aircraft turning right. The A330 was accelerating slowly through 158 kt while the 737 was maintaining about 205 kt before accelerating further; as a result, the distance widened.

Figure 9: Indicative ATC display at 1833:03 (the time of the closest horizontal distance)

Image represents a typical ATC display but is not necessarily representative of the display shown to a controller at the time of the occurrence. The separation measurement was manually added during a later replay of the occurrence and is approximate.

Source: Airservices Australia, annotated by the ATSB

The two flight paths then crossed with the 737 about 0.8 NM (1.5 km) ahead of the A330 (Figure 10). The trainee ADC asked the 737 flight crew to contact the approach controller at 1834:03 without first coordinating with the approach controller. At this time the two aircraft were about 1.2 NM (2.2 km) and 400 ft apart. This was less than the surveillance separation standard required for the transfer without coordination.[20]

The 737 climbed to 3,000 ft and was issued radar vectors for a second approach to runway 34R, landing at 1841. The A330 climbed to 5,000 ft and continued the planned flight to Melbourne.

Figure 10: Flight paths after the occurrence

Source: Google Earth, annotated by the ATSB

Context 

Air traffic control

Overview

Airservices Australia is Australia's principal civil air navigation service provider (that is, the provider of air traffic services for civil airports and airspace). The functions of Airservices are outlined in the Air Services Act 1995 and include the provision of air navigation services, aeronautical information, and aviation rescue and fire fighting services. The Manual of air traffic services (MATS)[21] stated the objectives of air traffic services were to:

1. prevent collisions between aircraft;
2. prevent collisions between aircraft on the manoeuvring area and obstructions on that area;
3. expedite and maintain an orderly flow of air traffic;
4. provide advice and information useful for the safe and efficient conduct of flights; and
5. notify appropriate organisations regarding aircraft in need of search and rescue aid, and assist such organisations as required.

This section details the context around the air traffic services aspects of the occurrence, including objectives and functions of Airservices and the manner in which they were applied, the involved personnel, separation standards, and flight path design. Unless otherwise specified, document references are from the version current at the time of the occurrence.

Personnel information

Trainee aerodrome controller

The trainee aerodrome controller (ADC), along with the on-the-job training instructor (OJTI), were controlling aircraft landing and departing on runway 34R at Sydney Airport from the Sydney air traffic control (ATC) Tower. At the time of the occurrence, the trainee ADC was completing their last shift before a performance assessment (check) for initial grant of the ADC rating that was scheduled for the next day.

The controller had joined Airservices and started initial tower training in 2012. On completion of training, the controller was stationed for about 4 years in the tower of a regional airport.

In November 2017, the controller commenced training for the surface movement control role at Sydney tower. The controller operated in this role until training was commenced for the Sydney tower ADC role in April 2019.

Training records indicate that the controller was judging spacing (for departures between arriving aircraft) well and had been advised to always have an ‘out’ (contingency plan). As the training progressed, the controller was instructed to make those decisions with less reliance on confirmation from the various OJTIs.

In regard to missed approaches, training records show that the controller was advised that ensuring separation from the preceding departure was more important than advising the departure controller about it. Also discussed was instructing aircraft to turn during missed approaches below minimum vectoring altitude (MVA) at night and compromised separation phraseology.

Two routine performance assessments were carried out by different check controllers in May and June 2019 to ascertain training progress. In general, the controller was found to be at the expected competency level for the respective stages of training.

Both check controllers noted that traffic volume during each assessment was relatively light and further experience in more challenging traffic and weather conditions (including at night) would be beneficial. There was no recorded concern about traffic sequencing or application of separation standards, although it was noted on the first assessment that the controller was a bit more conservative with traffic spacing than necessary.

On 23 July 2019, the controller began a 3-day performance assessment (check) conducted by a check controller as a prerequisite for granting of an aerodrome controller rating for the west, east, and coordinator functions in Sydney tower. The assessment report recorded that during the first 2 days the controller was able to process the traffic in a safe and expeditious manner. This was in the context of favourable weather conditions but relatively fast approaches (due to winds above 600 ft) and receiving aircraft that had reduced spacing at the time of transfer (less than the required 5 NM spacing).

The check controller also noted in the report that there is a ‘fine line’ between maximising the departure rate while ensuring separation, and that there is a need to always have a ‘way out’ – especially at night or in instrument meteorological conditions. This was prompted by an example of ‘bare’ (minimum) runway separation standard between departing and landing aircraft on runway 34R, with advice that if the crew of the approaching aircraft conducted a missed approach from short final approach, it would have been difficult to ensure separation if the departing aircraft was tracking via the MARUB standard instrument departure (SID).

During the check, the controller was questioned about a range of local procedures that could be implemented in different scenarios at Sydney. The check controller assessed that the controller’s knowledge was inadequate for issue of the rating and the check did not progress to Day 3. As part of a new training plan, the controller completed some additional classroom theory and was scheduled for 5 training shifts before another check, that was scheduled for the day after the occurrence.

The controller advised there had been some interruptions to the ADC training due to personal circumstances leave and there had been constraints on study outside of work hours. Although the controller described the training program as disjointed, it was completed within the average time frame for this rating of 12 weeks and none of the OJTIs had commented that there was any change to the controller’s skills on return from leave.

A review of the trainee ADC’s training records identified that one OJTI was involved in the initial practical training then was intermittently involved in subsequent training along with 8 other OJTIs. The controller advised the ATSB that, in their opinion, a variety of trainers could be positive as they can offer multiple perspectives and can address different areas, but there was a lack of continuity that probably hindered some aspects of the training.

Following the unsuccessful check, another OJTI was rostered for the additional training shifts. This was the same OJTI who was supervising the trainee ADC during the occurrence. The trainee considered this to be a positive phase of the training.

On 11 and 12 June 2019, the controller had completed practical emergency refresher training with a check controller in the Airservices tower simulator. This included a compromised separation exercise involving runways 16L/R by day. The check controller recorded that it was a good result and valuable part of the ADC training.

On the day of the incident, the controller recalled wanting the training process to be complete. Although recalling not feeling the pressure to perform or the upcoming check itself, after conversations with other people the trainee felt the check ‘was weighing in the back of [their] mind’.

On-the-job training instructor

The OJTI who was supervising the trainee ADC at the time of the occurrence had about 7 years previous experience as a tower and approach controller in the United States. After moving to Sydney, the OJTI converted the US qualifications and held all of the ratings for Sydney tower except shift manager. The OJTI endorsement was obtained in February 2019 and the OJTI had been a training instructor for one other controller prior to the occurrence.

On 12 and 13 June 2019, the OJTI had completed practical emergency refresher training with a check controller in the tower simulator. This included a compromised separation exercise involving runway 16L/R by day.

The OJTI was aware that the trainee ADC had been unsuccessful in the first performance assessment (check) because of knowledge deficiency rather than practical controlling skill. The OJTI was assigned to provide additional training to prepare the trainee for a performance assessment (check) that was scheduled for the day following the occurrence. If any intervention was required on the day of the occurrence, the OJTI was aware that the check would be postponed.

Prior to the day of the occurrence, the OJTI had supervised the trainee ADC on 3 shifts, all within the preceding week. The records indicate that the trainee was performing well with no requirement for the OJTI to provide prompts during controlling. In those previous training shifts, there were no missed approaches and the OJTI was confident in the trainee’s gap selection. As part of the training, the OJTI and trainee ADC reviewed minimum vector altitudes and some ways to manage missed approaches at night.

Tower shift manager

The tower shift manager (TSM) was a supervisory position responsible for the tactical management of risk while maintaining efficient air traffic operations. The purpose of supervision in the air traffic management context is to provide tactical management of risks while maintaining efficient air traffic operations. To achieve this, the TSM was required to directly supervise and maintain situation awareness of the immediate operating environment. Where necessary, the TSM role included supporting, intervening, or directing activities.

A TSM did not have authority to direct a controller to issue an operational instruction (the operational controller may accept advice from the TSM, but is always responsible for traffic separation).

Other aspects of the TSM role included management of controller resources across positions, providing ad hoc assistance to controllers, and administrative tasks. Ad hoc assistance tasks included to support the workload of the surface movement controller and provide break relief for other controllers as required.

The TSM had been in air traffic control since 1981, primarily in various roles at Sydney, and had been operating in the tower since 2004. Most of the shifts were conducted in the TSM role.

At the time of the occurrence, the TSM was temporarily engaged in the coordinator role for a surface movement controller. In that role, the TSM used a computer to locate and pre-activate the flight plans of taxiing aircraft. During busy periods, this allowed the surface movement controller to focus on monitoring ground traffic visually. The coordinator roles were not usually specially staffed, and as a result, this task was routinely done by the TSM during the afternoon/evening peak period.

Fatigue analysis

A review of both the OJTI and trainee’s roster and sleep information found there was a low likelihood the trainee and OJTI were experiencing a level of fatigue known to have an adverse effect on performance.

Air traffic control recorded data

Air traffic control (ATC) audio recordings and radar data records were obtained from Airservices. The audio recordings provided radio communications between controllers and flight crews. Radar data records provided aircraft position, speed and altitude information.

Separation standards

Definition

Separation is the concept of using approved separation standards, associated conditions and procedures to ensure spacing between aircraft is never less than a prescribed separation minimum. The Manual of air traffic services (MATS) defined separation as:

In this context, the minimum separation can be measured in horizontal and/or vertical distance, or by time. Separation standards are a means to ensure separation between aircraft, the ground and protected airspace using longitudinal, lateral, vertical, and visual criteria and minima. The separation standards applicable to this occurrence are detailed in the following sections.

A 'loss of separation' was defined by Airservices as:

A related concept was ‘inadequate separation assurance’ (ISA) which Airservices defined as:

Surveillance separation

An ATS surveillance system can include information from radar, ADS-B,[22] or any other system that enables ATC to identify and locate aircraft.

The horizontal separation minimum based on ATS surveillance information is 5 NM (9.3 km), which may be reduced to not less than 3 NM (5.6 km) if the aircraft are under the control of a terminal control unit or associated control tower.

The Airservices Sydney operational procedures[23] detailed minimum aircraft separation distances for arrivals and departures at Sydney Airport. When runways 34L and 34R were in use for arrivals and departures, the terminal control unit (TCU)[24] was required to ensure the distance between successive arrivals was no less than 5 NM when transferred to the tower. This distance could be reduced after prior coordination between the TCU and tower.

In its safety investigation into the occurrence, Airservices found that:

The Airservices report also stated:

Within the tower’s airspace, successive arrivals and departures needed to be kept 3 NM apart. There was no separate restriction on spacing between aircraft departing from and arriving to the same runway, except for the runway separation standard (see Runway separation). When visual separation could not be applied between an aircraft departing from one runway and an aircraft executing a missed approach from the other runway, controllers were to ensure that the missed approach course diverged by at least 30° from the departure course unless another separation standard applied.

Runway separation

Runway separation standards are to ensure that a runway area is not occupied by another aircraft or obstruction when air traffic services (ATS) clear an aircraft for take-off or landing. The standards outline the requirements for separation of aircraft operating to and from runways and the required distances, expressed in units of time or distance, between departures and arrivals in a number of configurations, on the same, crossing or parallel runways.

When an aircraft was landing behind a preceding departing aircraft, controllers were instructed to:

An aerodrome controller could only issue a landing clearance after:

When the runway was occupied by a preceding aircraft landing or taking off, controllers were instructed that they may:

The ATSB estimated that the 737 would have required a landing clearance by about 1832:15, and at the time at which the 737 would have crossed the threshold (about 1832:26), the A330 would have just been passing the first runway exit and about to lift off.

Wake turbulence separation

Wake turbulence[25] standards must be applied for aircraft departing or conducting a missed approach behind another aircraft. Separation in a surveillance-equipped tower environment such as Sydney was generally based on time and/or distance criteria.

Wake turbulence separation was determined by grouping aircraft types according to maximum take-off weight and wake turbulence characteristics. The maximum take-off weight of the A330 placed the aircraft in the heavy category and the 737 in the medium category. Between these two types, with the heavier aircraft ahead, a distance separation minimum of 2 minutes or 5 NM was generally applicable.

A wake turbulence standard was not required between an aircraft landing behind an aircraft taking off on the same runway. If the landing aircraft, however, conducts a missed approach behind one departing, the aircraft in the missed approach is now considered a departing aircraft. Consequently, a controller should issue a wake turbulence caution to the flight crew of the following aircraft when less than the applicable wake turbulence standard exists.

Visual separation

Visual separation is a means of spacing aircraft through the use of visual observation by a tower controller. The use of visual separation allows a reduction in separation from that required when using a procedural or surveillance standard.

A tower controller was permitted to use visual separation if:

• the aircraft were continuously visible to the controllers
• the projected flight paths did not conflict
• there were wide margins when judging relative distance or height, and
• there was no possibility of aircraft being in close proximity.

To visually separate aircraft, controllers were instructed to primarily use azimuth (horizontal angle). Other considerations included:

• faster following aircraft and closure rates
• projected flight paths
• the possibility of visual errors.

In the event of a missed approach, the controller must apply and maintain visual separation until another separation standard may be applied.

Limitations of visual separation

The MATS noted that visually determining the relative distance of aircraft in close proximity can be in error or affected by optical illusions.

The ATSB investigation (AO-2015-084) discussed limitations of using visual separation at night, specifically a controller’s judgement of distance being limited by the physiology of the human eye.

In July 2013, the United States National Transportation Safety Board (NTSB) issued a safety recommendation to the Federal Aviation Administration (FAA). It raised safety concerns about use of visual separation to resolve aircraft conflicts at airports where ATC procedures permitted independent take-off and landing operations on separate, non-intersecting runways with intersecting arrival or departure paths. In these circumstances, with different geometry to the Sydney occurrence, ATC were unable to ensure safe separation in the event of a missed approach. The NTSB stated:

The NTSB additionally stated:[26]

In response to the safety recommendation, the FAA responded that:

The NTSB closed the recommendation with the status ‘Closed-Acceptable action’.

Separation assurance

Separation assurance can be either strategic or tactical. Strategic separation assurance includes the development of air traffic practices to reduce the likelihood of aircraft coming into conflict, particularly where traffic frequency congestion may impair control actions. Tactical separation assurance is an activity conducted by the controller that includes traffic planning and conflict avoidance. Where two routes converge, such as at a runway, strategic separation is not possible; nevertheless, routes are designed to optimise separation while being tactically managed by air traffic controllers.

To achieve the first objective specified in the MATS (avoiding collisions between aircraft), ATS have preventative defences in place to assure aircraft remain separated, and recovery defences when separation is comprised or lost. The MATS described the responsibilities for aircraft separation for ATS as follows:

The separation standard may vary depending on a number of factors, including the type of airspace in which the aircraft are operating, and may specify horizontal or vertical distances, or separation based on a flying time between two aircraft passing the same location.

Controllers proactively plan to avoid conflict between aircraft, rather than to wait for or allow a conflict to develop before its resolution.

Sydney Airport information

Background

Sydney Airport is a major international airport which facilitates international, domestic, and regional aircraft movements. It has two parallel runways that are oriented 16/34, separated by about 1 km, and another runway oriented 07/25. The Sydney tower is located to the east of runway 16R/34L and south of runway 07/25.

The airport is located in a low-lying area adjoining Botany Bay. The elevation of terrain to the east of runway 34R within a 10 NM radius is generally no higher than 150 ft with some terrain to the north-east rising up to about 350 ft. The major obstacles rising to a maximum of 1,100 ft were buildings located in the city, about 5 NM (9 km) to the north-north-east of the airport.

Air traffic control at Sydney Airport

Airservices provided 24-hour air traffic services at Sydney Airport. The Sydney Airport Demand Management Act 1997 (Cth) imposed, among other things, a maximum limit on the number of aircraft movements (landings and take-offs) at the airport in any 60-minute period of operation.

The on-duty controllers responsible for the management and sequencing of arrival and departure aircraft inside the Sydney terminal control area were located in the Terminal Control Unit (TCU). That unit operated from a building located at Sydney Airport, separate to the tower.

The on-duty controllers responsible for all aircraft and vehicle movements on taxiways, runways and in the immediate vicinity of the airport were located in the tower. They were responsible for 4 NM around the airport and separation was primarily on a visual basis supplemented by radar displays.

At the time of the occurrence, the air traffic control mode at Sydney was parallel runway operations with independent visual approaches (IVA) to runway 34L and 34R. Independent departures were in effect from runway 34L and 34R.

Arrivals to runway 34R were managed by the approach and director controllers in the TCU before being transferred to the ADC to a boundary approximately 4 NM from the runway 34R threshold and at or below 500 ft.

Independent visual approaches

Independent visual approaches (IVA) allowed two aircraft to be on final approach to parallel runways at Sydney in visual meteorological conditions (VMC). Depending on the meteorological conditions, an IVA could be initiated from a circuit or from an instrument approach once a pilot was visual (could see the runway).

The Aeronautical information publication (AIP) Australia outlined important instructions and advisory information to pilots for the conduct of an IVA. Once ATC cleared a pilot for an IVA the requirements of the procedure must be followed.

Pilots were instructed to fly accurate headings when being vectored for final approach and that it was imperative to intercept the final approach path without overshooting the assigned runway centreline.

Another requirement was that pilots must operate at approach speeds of 160–185 kt when 10 NM from the runway threshold and 150–160 kt when 5 NM from the runway threshold. ATSB analysis of track distance indicated that the 737 was at about 200 kt at 10 NM and 180 kt at 5 NM.

Standard instrument departures and arrivals

At most major airports flight crew navigate their aircraft along flight paths which are known as standard instrument departures (SIDs) and standard terminal arrival routes (STARs). SID and STAR flight paths provide controllers and flight crew with:

• separation standards built into the airspace design for departing and arriving aircraft
• improved flight path predictability
• reduced complexity and workload for pilots and controllers.

At Sydney, in most cases flight path design used open STARs, which did not join directly with instrument approach procedures. Open STARs required the director controller to provide radar headings to link the STAR with final approach.

According to Airservices, the MARUB SIX SID had been published and in operation since about 1997.

Supervision of air traffic control

Controller duty of care

The Airservices National ATS procedures manual (NAPM) provided guidance to all controllers on their duty of care requirements. It outlined that all controllers who are aware of information of an unsafe situation or potential unsafe situation are expected to take all necessary action to remove that risk. It was also expected that the extent of the action required will be driven by professional judgement given the circumstances and would include an assessment of the likelihood of the event occurring and the potential severity of the outcome.

Tower – Supervision and Operational Command Authority

The Airservices National ATS administration manual (NAAM) provided guidance on supervision and operational command authority (OCA). It stated the purpose of supervision in operational environments:

The Sydney tower shift manager (TSM) position held OCA and was therefore required to perform direct supervision of the operating environment within Sydney Tower’s area of responsibility. Direct supervision required the TSM to be physically present within the immediate operating environment and maintain situational awareness of that environment. The NAAM stated:

The NAAM included a limitation in the exercising of OCA, in stating that:

Airservices advised the ATSB that the supervisor (TSM) could not have assisted with the provision of safety alerts or wake turbulence caution.

On-the-job instruction

Air traffic control training comprised theoretical, simulator and on-the-job components. On-the-job instruction is conducted in the workplace by specially trained instructors (OJTI).

While conducting training, an OJTI would hold overall responsibility for the provision of a safe and efficient air traffic service, as a trainee would either be not licenced or not endorsed.

During the training period, a trainee would be given increasing levels of responsibility for the control and separation of aircraft, but the OJTI must monitor the trainee’s performance and ensure that any errors or omissions that may impact safety can be corrected in a timely manner. Intervention strategies for an OJTI range from questioning the trainee, to suggesting an alternate course of action, to directing the trainee, and finally to intervening by taking over or overriding the trainee.

Airservices defined a progressive ‘prompting hierarchy’ to be applied by OJTIs to allow a trainee to develop the required skills throughout the development of a safety situation while ensuring it will be effectively managed:

Direct intervention was considered a ‘last resort’ and only used to ensure safety. To facilitate this, the communication system enabled the OJTI to override the trainee’s transmissions.

On the night of the occurrence, the OJTI was cognisant of compromising the assessment and considered that any level of intervention would result in a failed assessment for the trainee ADC.

Compromised separation

Compromised separation recovery

Separation of aircraft is considered to be compromised when separation standards have been infringed, or where separation assurance is absent to the extent that a breakdown of separation is imminent.

In accordance with the MATS, controllers were required to:

The MATS required that, except in certain circumstances, controllers issue a safety alert prefixed by the phrase 'SAFETY ALERT' when they become aware that an aircraft is in a situation that places it in unsafe proximity to another aircraft.

The MATS required a controller to issue traffic avoidance advice, prefixed by the phrase 'AVOIDING ACTION', to an aircraft that is receiving an ATS surveillance service and in the controller’s judgement is in a situation that places it at risk of a collision with another aircraft under surveillance.

The phraseology to be used by ATC when providing safety alerts and avoiding action was contained in the AIP. An example of a generic traffic alert is:

It was permissible for a controller to abbreviate safety alerts and traffic avoidance advice phraseologies to ensure timely provision of advice.

Vectoring at night below minimum vectoring altitude

In daytime, vectoring aircraft at low altitudes was permitted because flight crews could visually maintain adequate height to avoid ground and obstacle collisions. To do this, controllers could assign terrain clearance responsibility to the flight crews.

The MATS stated that a controller could only provide an instrument flight rules (IFR) aircraft with a vector in visual meteorological conditions (VMC) by day.

At night when radar vectoring, the controller needed to retain the responsibility for ensuring terrain clearance is maintained as pilots may not be able to see terrain and obstacles. For this reason, controllers were generally not permitted to vector aircraft below a minimum vectoring altitude (MVA) at night.

The MVA was the lowest altitude a controller may assign to a pilot in accordance with a radar terrain clearance chart (RTCC). The MVA (minimum RTCC) was 1,500 ft in the area the 737 flight crew was initially vectored (Figure 11).

In response to recent occurrences at surveillance towers where tower controllers had vectored aircraft conducting a missed approach without complying with the MATS requirements, Airservices issued a standardisation directive to all surveillance towers (including Sydney), effective 18 June 2019. The Airservices safety investigation report stated:

When controllers become aware that an aircraft is in unsafe proximity to terrain or an obstacle they are required to issue a safety alert to the pilot.

In addition to the occurrence controllers, the ATSB interviewed several other Sydney tower controllers from Sydney tower to understand their view of how they would deal with a similar situation as the occurrence. The general view was that in line with the requirement for controllers to provide a duty of care in an unsafe situation, their professional judgement was that the least-risk option to aircraft was to issue vectors below MVA at night and issue a safety alert terrain to the flight crew. These controllers were aware this was not in accordance with the MATS but commented that it had become a normalised solution to the hazard.

Figure 11: Extract of replayed ATC display showing 737 location when its crew was instructed to turn right (from 800 ft) and relevant radar terrain clearance chart (RTCC) levels

Source: Airservices Australia, annotated by the ATSB

Application of best judgement and initiative

The MATS stated:

Similarly, the Airservices National ATS Procedures Manual stated:

Compromised separation training

Compromised separation recovery training was required for all ATC endorsement training courses. This comprised a training workshop and a simulator exercise. The learning outcomes for the compromised separation training workshop were:

• identify the critical sector/unit hot spots for compromised separation and unsafe proximity
• describe critical actions and responsibilities in the event of compromised separation or unsafe proximity, including phraseology and with reference to sector/unit specific scenarios
• identify aircraft performance considerations critical to resolution of sector/unit specific situations.

Points to be covered included the requirements for safety alerts or traffic avoidance information, and the issuance of accurate timely and well delivered instructions to de-conflict. This training workshop was assessed by the on-line compromised separation training package.

Along with 4 other emergency training sessions, the compromised separation simulator exercise was conducted by a check controller at the Airservices tower simulator. This was a practical application of the topics from the training workshop, and was based on parallel runway 16L/R operations by day.

Following this initial training, tower controllers were required to complete the knowledge-based online training package annually and the skills-based simulator training at least every 3 years.

At the time of the occurrence, Airservices had no compromised separation recovery training scenarios for conflicts on the MARUB SID / runway 34R missed approach procedure, or for compromised separation scenarios where aircraft were below the MVA at night at Sydney.

Flight path design

General information

Airservices designs flight paths in compliance with Civil Aviation Safety Authority (CASA) regulations and standards, and International Civil Aviation Organization (ICAO) standards and recommended practices (SARPs). CASA has mandated that flight path design in Australia must comply with the ICAO SARPs for instrument flight procedure design, except where varied by Australian legislation/manual of standards.

In accordance with Civil Aviation Safety Regulations (CASR) Part 173, CASA has certified Airservices as an organisation permitted to design approach and departure procedures for aircraft operating under instrument flight rules (IFR). The certification process requires a chief designer to manage flight path design and a team of qualified designers.

Design objectives, constraints, and guidance

International Civil Aviation Organization publications

When designing flight paths consideration is given to multiple elements outlined in ICAO publications Procedures for air navigation services – Aircraft operations (PANS-OPS, ICAO Doc 8168) and Procedures for navigation services – Air traffic management (PANS-ATM, ICAO Doc 4444). These include terrain and obstacle clearance, wake turbulence, meteorological conditions, aircraft performance, climb gradients, descent profiles, speeds, rate of turn, angle of bank (turning movement) and the airspace available to safely contain the procedure. Operationally significant design criteria are specified on the charts for each procedure.

Australian legislation

The Air Services Act 1995 requires that Airservices:

1. In exercising its powers and performing its functions, must regard the safety of air navigation as the most important consideration.
2.  Subject to subsection (1), [Airservices] must exercise its powers and perform its functions in a manner that ensures that, as far as is practicable, the environment is protected from:

The latter subsection required, among other things, consideration of elements such as environmental impact (including noise) and community impact associated with flights around airports.

Long Term Operating Plan

Airservices also needed to follow Ministerial directions including, in the case of Sydney Airport, a direction to follow the Long Term Operating Plan (LTOP).[27]

The Ministerial direction meant that Airservices must ensure that, subject to safety and weather conditions:

• as many flights as practical use flight paths over water or non-residential areas where aircraft noise has the least impact on people
• the rest of the air traffic is spread or shared over surrounding communities as fairly as possible
• runway modes (patterns of aircraft movement) change throughout the day so individual areas have some respite from aircraft noise on most days.

In practice, these requirements limited the options available for the design and operation of flight paths such as SIDs and missed approach paths, although the Ministerial direction emphasised that ‘the safety of aviation operations is not to be compromised.’

Among the ‘main matters raised relevant to the Ministerial direction’ were ‘concerns of individuals and community groups about flight paths over specific areas, including flight corridors to the north’ of Sydney Airport. The LTOP stated:

When runway 16L/34R was built in the mid-1990s, take-offs to the north from runway 34R were initially not permitted. From 19 October 1996, Airservices introduced new procedures to further reduce the number of overflights of the areas that had been exposed to the greatest levels of aircraft noise. The LTOP stated:

Sydney flight paths generally direct aircraft departing from runway 34R to the east, while aircraft departing from the parallel runway 34L are directed to the north and west. This distributes the noise of departures from each runway across different areas.

Flight Safety Foundation guidance

The Flight Safety Foundation is an international non-profit organisation that provides impartial, independent, expert safety guidance and resources for the aviation and aerospace industry. It identifies global safety issues, sets priorities and serves as a catalyst to address these concerns through data collection and information sharing, education, advocacy and communications.

The Go-Around Decision Making and Execution Project: Final Report to Flight Safety Foundation (Blajev and Curtis, 2017) recommended that:

Implementation advice for the Flight Safety Foundation recommendation regarding a missed approach point design included:

Implementation

Prior to the publication of a flight path, Airservices ensures that flight path designs are compliant with the CASR through, among other requirements, designs carried out by qualified designers in accordance with ICAO Doc 8168. CASA then conducts flight validations to ensure procedures are safe and flyable and that they meet applicable design standards.

For instrument approach procedures, the missed approach design provides a minimum obstacle clearance to aircraft climbing along the specified missed approach path. This ensures aircraft are protected from obstacles and terrain when conducting a missed approach providing the aircraft remains on the missed approach procedure track.

Air traffic services safety management

Safety management systems

ICAO Annex 11 required air traffic service providers to have a safety management system (SMS) and stated that system shall:

Based on the ICAO document 9859 (Safety management manual), the CASR Part 172 outlined an SMS framework with four major components:

• safety policy, objectives and planning
• safety risk management
• safety assurance
• safety training and promotion.

Airservices had a CASA-approved SMS which was oversighted in accordance with CASR Part 172.

Safety risk management

Safety risk management includes hazard identification, safety risk assessments and safety risk mitigation. The ICAO Safety management manual stated:

Organisational investigations of safety occurrences and hazards are an essential activity of the overall risk management process in air traffic services. Investigations identify latent system deficiencies and missing or inadequate defences for which corrective safety action can be taken to ensure continuous improvement to an organisation’s entire safety system.

Risk assessment and mitigation at Sydney airport

Operational risk assessments

The Airservices risk management and mitigation measures of local Sydney tower hazards were recorded in the Sydney tower operational risk assessment (ORA). ORAs were managed and reviewed in accordance with the requirements of the Airservices SMS. They were described by Airservices as ‘a higher level representation of the threats and barriers and one artefact reviewed as the outcome of safety risk management activities’.[28]

The Airservices ORA review procedure described the roles and responsibilities for the identification, assessment, and management of hazards/threats. Furthermore, it described when ORA reviews should be conducted, stating:

Airservices ORAs were based on the ‘bow-tie’ model as a risk evaluation method to analyse and demonstrate causal relationships in high-risk scenarios such as a mid-air collision. Risk in bow-tie methodology is elaborated by the relationship between hazards/threats, top events, and consequences. Controls are used to display what measures an organisation has in place to control the risk. Controls can be proactive and reactive. A third control classification is escalation control which is used to manage escalation factors. Escalation factors are certain conditions that can make a control fail.

Identification of conflict scenarios

The ATSB examined all 10 Sydney tower ORAs for item ‘H-01-Conflict in the air’ from 2012 to 2019. At the time of the occurrence the most recent review was Sydney tower ORA (H-01-Conflict in the air) version 6.1, dated 3 July 2019. It identified a top event of ‘Inappropriate or lack of control action or advice’ with the hazard of ‘Conflict in the air’. The threats contained in the ORA relevant to this occurrence were:

• controller incorrectly applies standards or procedures
• independent parallel departures
• missed approach (go-around)
• unexpected pilot action
• loss of separation with obstacle (terrain)
• loss of separation (including runway separation).

The ORAs did not include specific scenarios involving loss of separation. More specifically, the ORAs did not include the potential MARUB SID / runway 34R missed approach conflict as a threat or escalation factor. Additionally, the Sydney tower ORA did not contain the hazard of compromised separation when aircraft were below the MVA at night.

Evaluation of risk controls

Each of the threats had identified defensive barriers to prevent the associated threat from realising the top event and subsequently the hazard. Most of these barriers were procedural in nature and included supervision, compromised separation rules and procedures, the issuing of safety alerts, and pilot action.

Airservices advised ATSB that threats associated with aircraft concurrently following the MARUB SIX SID and runway 34R missed approach procedures were ‘known’ and that the risk was ‘effectively managed.’ Airservices reasoned that ‘there had not been an occurrence history or operational assurance activities that had identified systemic risk control shortfalls’ with the management of MARUB SIX SID and runway 34R missed approach traffic scenarios to indicate that the level of risk was not as low as reasonably practicable.

Civil Aviation Safety Authority oversight

The Civil Aviation Safety Authority (CASA) has the responsibility of oversighting and ensuring Airservices maintained and operated its ATS functions in accordance with the Manual of Standards for CASR Part 172 and approved procedures in the MATS. This oversight consisted of regulatory audits of Airservices functions such as air navigation service delivery and flight path design management, and the Airservices SMS.

CASA completed a surveillance audit on Sydney Tower in July–August 2018, one year before the occurrence. The report stated:

Runway 16R is a runway to the west of and parallel to runway 34R and refers to operations in the opposite direction. Regarding the runway 16R occurrence rates, the CASA report stated:

No issues regarding runway 34R were raised.

Related occurrences

Airservices data

Airservices advised the ATSB that in the 2019 calendar year, there were 348,730 movements at Sydney and within the Airservices occurrence reporting system there were 349 reports where ‘go around’ was recorded as the primary occurrence type. However, due to limitations in recorded data and the type of occurrences that were required to be reported, it was not possible to obtain detailed data on related occurrences at Sydney involving aircraft concurrently following the MARUB SIX SID and runway 34R missed approach procedures and the level of controller intervention, if any, that resulted.

Controller interviews

Of 9 Airservices controllers interviewed by the ATSB, 8 indicated that the MARUB SIX SID and the runway 34R missed approach procedure was a recognised concern. Some discussed the absence of compliant options to resolve a potential conflict as being problematic. One controller interviewed by the ATSB estimated that intervention due to the potential for conflict between the MARUB SIX SID and runway 34R missed approach procedures occurred 10 to 20 times in a year (day and night).

ATSB occurrence data

A search of ATSB occurrence records from 2013-2022 did not identify any other losses of separation associated with aircraft concurrently using the MARUB SIX SID and a missed approach from runway 34R.

On 5 reported occasions, including the one under this investigation, an aircraft on approach to runway 34R conducted a missed approach due to a potential conflict with another aircraft taking off from the same runway. All were initially reported to the ATSB as a missed approach; the occurrence under investigation was revised to include the loss of separation category after further enquiries from the ATSB based on the Qantas reports. No flight path data for the other occurrences were available at the time of review.

ATSB study into loss of separation occurrences in Australian airspace

The ATSB research report Loss of separation between aircraft in Australian airspace – January 2008 to June 2012 (AR-2012-034) found that ‘assessing and planning’ or ‘monitoring and checking’ errors were involved in most individual controller actions that contributed to loss of separation (LOS) occurrences. Ineffective management of compromised separation before it became a LOS was categorised as an assessing and planning error. Monitoring and checking errors included controller actions associated with maintaining awareness of traffic disposition.

In addition, the ATSB research found that of the LOS occurrences in which ATC actions were contributory, about one quarter involved communication errors. These included not passing traffic information to pilots once separation was compromised. The research found that task demands were the most common type of local condition identified in LOS occurrences where controllers were involved – in particular, high workload and distractions. Common in all ATC environments, these local conditions were more common in the tower environment.

2015 loss of separation in Adelaide

On 18 May 2015, there was a series of LOS occurrences and vectors issued to flight crew below the minimum vector altitude (MVA) in the airspace around Adelaide Airport, South Australia.[30] An Airservices safety investigation into the occurrences identified the following safety issues:

• Compromised separation training for controllers at Adelaide Tower did not incorporate scenarios where aircraft were below the minimum vector altitude at night.
• The updated Intervention Techniques and Prompting initial qualification training was not provided to existing OJTIs or workplace assessors. Additionally, the relevant refresher training module had not been updated.
• There were no defined explicit requirements, including the required phraseology, for coordinating the transfer of separation responsibility between controllers.

Airservices subsequently advised that each of the safety issues had been addressed and all related safety actions had been completed. The ATSB reviewed the Airservices report, safety issues and safety actions. Based on this review, the ATSB considered it was very unlikely that further investigation would identify any systemic safety issues and discontinued the investigation.

Losses of separation in Melbourne

Occurrence information

In October 2011, at night at Melbourne Airport, Victoria and during land and hold short operations (LAHSO), an aircraft on final approach to land on runway 34 conducted a missed approach while another aircraft was landing on runway 27. LAHSO allowed for simultaneous landings on crossing runways, with the requirement that one aircraft stops well before the intersection of the runways. As the aircraft in the missed approach was below the MVA, the controller was unable to issue a radar vector to ensure separation. The occurrence was reported but the ATSB did not investigate.

On the evening of 5 July 2015, with LAHSO in effect at Melbourne Airport, a Boeing 777 was cleared for an immediate take-off from runway 34 while two Boeing 737s were on approach to runways 34 and 27. This resulted in the crew of the 737 on approach to runway 27 initiating a missed approach, followed by the crew of the 737 on approach to runway 34 being instructed by ATC to go around. The 737 on approach to runway 34 was then radar vectored by ATC below the MVA.

Civil Aviation Safety Authority response

On 2^nd November 2015 CASA wrote to the ATSB and Airservices listing a number of key concerns involving Melbourne operations, which included:

• the requirement for IFR aircraft to remain on the published missed approach procedure until reaching the lowest safe altitude
• the procedural restrictions on ATC not to issue turn instructions applicable while the aircraft is below the MVA during a missed approach at night that takes the aircraft outside the protections of the published missed approach
• the limitations on the ability of ATC to provide effective separation to aircraft at night based on visual observation
• the limitations on pilots of IFR aircraft to see and manoeuvre to avoid one another at night
• the lack of demonstrated training competency of air traffic controllers in the handling of night-time compromised separation.

In the same correspondence CASA also stated:

… the (air traffic management) system should not rely, as a primary means of defence, on vectoring or heading changes for (instrument flight rules) category aircraft at night that are below the appropriate minimum altitude.

ATSB investigation

The ATSB investigation[31] into the 2015 occurrence reported that:

The ATSB identified a safety issue, stating that ‘the hazard associated with the inability to separate aircraft that are below the appropriate lowest safe altitude at night was identified but not adequately mitigated.’ The ATSB also found that:

Safety actions

In response to the occurrence, Airservices introduced:

• a stagger procedure for arrival pairs to prevent unsafe proximity in the event of a missed approach
• training for Melbourne ATC Tower controllers in compromised separation recovery at night during LAHSO
• a safe sector to allow controllers to vector aircraft to a path clear of obstacles when below the MVA following a missed approach at Melbourne during LAHSO.

The safe sector at Melbourne had been assessed for obstacle clearance and found suitable for vectoring the aircraft below the MVA at night. CASA issued Airservices with a partial exemption to the MATS to allow this. The exemption only applied during LAHSO at Melbourne at night, and had certain conditions including that controllers could only vector aircraft when they were above 600 ft and only towards an internally-published region (the safe sector). Melbourne tower controllers also had to be trained in the use of safe sectors. The exemption was renewed at intervals and was current at the time of the Sydney occurrence.

In November 2015 Airservices advised CASA that it intended to roll out a national program to further enhance the knowledge and skills of tower controllers. The action would involve enhancements to night-time compromised separation training for risk situations.

To implement this, an Airservices standards manager emailed line training managers to include scenarios where aircraft are below the MVA at night in their respective training packages. However, the Airservices system for assigning safety-related tasks and assuring their completion (CIRRIS) was not used. Consequently, some Airservices line training managers, including those at the Sydney and Gold Coast airports, had not incorporated compromised separation scenarios where aircraft are operating below the MVA at night at the time of the Sydney occurrence.

Several Sydney controllers interviewed by the ATSB for the current investigation stated that the provision for controllers to use safe sectors would improve safety by providing compliant options to reduce the risk of unsafe proximity without increasing the risk of terrain/obstacle collision.

Flight operations

Overview

This section details the context around the flight operations aspects of the occurrence, including personnel, aircraft information, procedures, and flight crew training. Unless otherwise specified, document references are from the version current at the time of the occurrence.

Personnel information

737 flight crew

Both 737 flight crew members held an air transport pilot licence (ATPL) aeroplane and Class 1 aviation medical certificate. They reported no recent or ongoing medical or personal issues likely to have influenced their performance.

The captain had about 19,017 hours of aeronautical experience, including 13,680 hours on 737 variants. The captain reported feeling alert at the time of the occurrence.

The first officer (FO) had about 7,710 hours of aeronautical experience, including 1,460 hours on 737 variants. The FO reported feeling a little tired at the time of the occurrence. They reported getting a normal amount of sleep in the nights before the occurrence. ATSB analysis indicated that the FO was probably not experiencing a level of fatigue known to have an adverse effect on performance.

A330 Flight crew

Both A330 flight crew members held an ATPL aeroplane and Class 1 Aviation medical certificate and were appropriately qualified to conduct the flight.

The A330 captain had a total of 19,100 hours flight time, with about 335 hours on A330 variants. They reported feeling fully alert at the time of the occurrence.

The FO had a total of 12,105 hours flight time, with 2,945 hours on A330 variants. They reported feeling fully alert at the time of the occurrence.

ATSB analysis indicated there was a low likelihood that either A330 pilot was experiencing a level of fatigue known to have an adverse effect on performance.

Aircraft information

737 flight management computer

The 737 flight management computer (FMC) contained a navigation database that included most of the information presented on navigation charts as well as additional data used for navigation. Lateral navigation guidance (LNAV) and vertical navigation guidance (VNAV) could be coded using the FMC and displayed on flight instruments.

Typically, flight crews can program the FMC with arrival routes that join runway approaches to provide continuous lateral navigation guidance. At Sydney, most of the STARs were open, which meant there was a discontinuity between the last waypoint of the STAR and the instrument approach. Once the aircraft reached the end of the STAR route and/or were vectored from the STAR to intercept the instrument approach, LNAV automatically disconnected.

A route discontinuity was displayed on the central display unit (CDU) with an alert message and associated message indications (Figure 12). A flight crew could resolve the discontinuity by entering an adjoining waypoint in the CDU. There was no requirement to do this.

Figure 12 displays an example route legs page with a route discontinuity present indicated by a break in the waypoints and the message ‘route discontinuity’. Also displayed is the joining of waypoints when the discontinuity is cleared.

Figure 12: Example flight management computer route legs page with discontinuity present (top) or cleared (bottom)

Source: Qantas Airways, annotated by the ATSB

737 automatic flight system

Overview

The 737 automatic flight system (autopilot) consisted of an autopilot flight director system and autothrottle, in conjunction with a flight management computer and mode control panel.

In normal autopilot operation, the flight director and autothrottle were controlled automatically to fly a pre-programmed and optimised flight path through climb, cruise, and descent.

To select the desired mode, flight crew pushed the applicable mode selector switches, which illuminated when active. Flight mode annunciations were displayed above the attitude indicator on the outboard display unit (primary flight display).

The engaged flight modes were displayed in green letters and armed modes were displayed in smaller, white letters beneath the engaged modes. A highlighting rectangle appeared around the relevant mode annunciation for a period of 10 seconds following mode engagement.

To manoeuvre the aircraft in a missed approach, the following modes could be used:

• lateral navigation (LNAV)
• heading select (HDG SEL)
• go-around (GA).

A standard rate turn was at a 25° bank angle, and the flight crew could also select other bank angles up to 30°.

Lateral navigation mode

To engage LNAV in flight, an active route must be entered in the flight management computer. LNAV will automatically disconnect on reaching a route discontinuity or when other modes such as HDG SEL are engaged.

When LNAV mode is selected, flight director roll is commanded to intercept and track via the active route. This route can include airways, SIDs, STARs, instrument approach and missed approach path.

When conducting an instrument approach, following localiser (LOC) capture the roll (lateral) mode window will display LNAV in white (armed), providing the engagement criteria in flight is met. This visual display is the only indication to pilots that LNAV guidance will be available during a missed approach (Figure 13).

Figure 13: 737 indications on ground-based augmentation system landing system (GLS) approach displaying when LNAV becomes armed

Source: Qantas Airways, annotated by the ATSB

Heading select mode

The HDG SEL mode commands a turn to the heading selected by the pilot on the mode control panel and maintains that heading.

Go-around mode

Go-around mode is engaged by pushing either of the take-off/go-around (TOGA) buttons. An autopilot go-around can be conducted in certain conditions or flight crew can carry out a manual flight director procedure.

In the manual procedure, with the first push of either TOGA button:

• autothrottle (if armed) engages and advances thrust to produce 1,000 to 2,000 ft/min rate of climb
• pitch mode engages in TOGA
• flight director commands pitch 15 degrees nose up until reaching programmed rate of climb.
• roll mode maintains existing ground track and, above 400 ft radio altitude, LNAV will engage (if TOGA to LNAV equipped and no route discontinuities after missed approach point).

Above 400 ft, the flight crew can terminate the go-around mode by selecting a different pitch or roll mode.

Traffic collision avoidance system

In accordance with regulatory requirements, the 737 and A330 were each equipped with an advanced traffic alert and collision avoidance system (TCAS). This system operated independently of air traffic control (ATC) by using on-board surveillance capability to detect other transponder-equipped aircraft. The relative position of aircraft were presented as coded symbols on the TCAS display with two levels of traffic alerting:

• Traffic advisory (TA) for potential collision threats (40 seconds from closest point of approach) – aural message ‘TRAFFIC, TRAFFIC’, and TRAFFIC annunciation on the display
• Resolution advisory (RA) for real collision threats (25 seconds from closest point of approach) – aural message with vertical guidance, and corresponding annunciation on the display.

In most encounters, two aircraft will declare the other to be a threat at slightly different times.[32]

All RA are inhibited below approximately 1,000 ft above ground level (AGL) and all TCAS aural alerts are inhibited when below approximately 500 ft. This is to ensure that alerts are not generated during certain phases including initial take-off climb and go-arounds for two reasons: to avoid distracting the flight crew at a critical phase of flight and, because the aircraft is already flying close to the performance limit (body angle/attitude and thrust).

An example TCAS RA indication showing the relative location of a ‘threat’ aircraft (in amber) on an Airbus navigation display is shown in Figure 14. In this display, the other aircraft is ahead, to the right, 600 ft above, and descending.

Qantas arranged for the A330 TCAS computer to be analysed. A review of the recorded data showed that during the occurrence the A330 received a TA without any RAs. The 737 flight data did not record traffic alerts.

Figure 14: Example TCAS display

Source: Airbus

Enhanced ground proximity warning system

Both the A330 and 737 were equipped with an enhanced ground proximity warning system (EGPWS). The purpose of the EGPWS is to warn the flight crew of potentially hazardous situations, such as a collision with terrain. It detects terrain collision threats and triggers aural and visual indications.

Runway 34R missed approach procedure

Missed approach from visual approach

The AIP described the procedure for a missed approach (go-around) from a visual approach:

In this case, the missed approach procedure for the GLS runway 34R approach (used by the 737 crew) required flight crew to maintain runway track (335°) and at 600 ft turn right, track 070° and climb to 2,000 ft (Figure 2).

The Jeppesen and Airservices instrument approach charts depicted the missed approach path for runway 34R tracking straight ahead until well north of the departure end of runway 34R before the right turn (Figure 2). Missed approaches initiated before or at the missed approach point will reach the mandatory 600 ft right turn well before the turn depicted on the chart.

Determination of the missed approach point location

The AIP defined a missed approach point as:

For instrument landing system (ILS) and GLS approaches, the point of intersection of an electronic glide path with the applicable decision altitude is used to determine the missed approach point. The location of a missed approach point varied depending on a number of factors, and there was typically no fixed missed approach point in published approach procedures. However, operators could pre-program a missed approach point into aircraft navigation computers to help flight crews manage this phase of flight (particularly when commencing a missed approach before reaching the missed approach point); see Flight management computer missed approach waypoint.

In practice, the missed approach point is the last point that flight crew need to decide to conduct a missed approach when they have not made visual contact with the runway. However, missed approaches can be conducted after the missed approach point for other reasons, including obstructed runways or any issue making a normal landing difficult.

In the context of instrument approaches, the AIP stated:

Flight management computer missed approach waypoint

The 737’s FMC uses predefined waypoints to navigate the aircraft along the approach and missed approach path. The location of the runway 34R threshold is marked in the FMC with waypoint RW34R.

The missed approach point is the point at which the glidepath intercepts the decision altitude. A reference missed approach point (where the nominal glidepath intercepts the decision altitude) was pre-programmed into the FMC so that flight crews could use it as guidance for following the missed approach procedure. The location of the reference missed approach point could vary depending on the approach type and chart.

After the occurrence, Qantas conducted a review of these waypoints for 9 different approaches to runway 34R and found that 8 of the waypoints programmed into the FMC were incorrectly located at the runway threshold instead of on the final approach path before the runway. These included the waypoint for the approach carried out by the 737 flight crew during the occurrence: it should have been about 0.5 NM before the threshold.

History of Sydney runway 34R tracking

Several controllers interviewed by the ATSB advised there was a recognised variation of aircraft tracking via the runway 34R missed approach path.

Figure 15 shows a composite of recorded runway 34R missed approach tracking (in red) between July 2017 and March 2019 illustrating how the paths can cross or converge with typical aircraft tracks following the MARUB SIX SID (grey). A small number of tracks also crossed the ENTRA FIVE SID.

The OJTI reported that in their experience with similar situations to the occurrence, even with 5 NM spacing, a missed approach still results in conflict.

Figure 15: Aircraft tracks for runway 34R missed approaches (red) compared with tracks following the MARUB SIX and ENTRA FIVE SIDs (grey) from July 2017 to March 2019

Some of the variation in aircraft tracking, particularly for missed approaches, is likely to be due to control instructions issued. In addition, this diagram shows all departures and missed approaches, not just those that are concurrent, for which additional data was not available.

Source: Airservices, annotated by the ATSB.

Qantas procedures

Go-around and missed approach procedure

The Qantas 737 Flight Crew Operations Manual (FCOM) contained a procedure for the conduct of a missed approach. That procedure included the following actions required above 400 ft:

The Qantas 737 Flight crew training manual (FCTM) provided supplementary guidance to flight crews on the management of all engines operating go-arounds and missed approaches. It provided the following advice when using the flight director:[33]

The FCTM also contained information on how to manage initial manoeuvring if required by a missed approach procedure. It stated:

Automation systems management and communication

The Qantas Flight administration manual (FAM) described the preferred method for flight crew to manage automatic flight management systems. It highlighted that while automation can be a valuable tool for flight crew, a good understanding of the systems and an awareness of the flight modes was required.

To maintain a positive awareness of the automation system status, and to ensure that both flight crew had a shared understanding of any mode changes, standard operating procedures (SOPs) outlined in the FAM were to be applied. This included a number of standard calls and procedures.

The most relevant procedure to this occurrence was the verbalisation of any changes to the flight mode or autopilot status. In most situations that entailed a call by the pilot flying acknowledging that a change had occurred followed by a ‘checked’ confirmation call from the pilot monitoring. The flight crew did not recall verbalising these calls.

Flight crew training

During recurrent simulator training and checking, pilots had opportunities to practice go-around procedures, including go-arounds with one engine inoperative, and with all engines operating. All Qantas pilots were required to demonstrate proficiency in go-arounds biannually. Qantas advised that in the 3 years prior to the occurrence there were no cyclic training go-around exercises conducted specifically on Sydney runway 34R for pilots on the 737 fleet.

The 737 captain recalled flying the runway 34R missed approach some years prior in the simulator. At that time there had been a number of aircraft overshooting the 2,000 ft level off altitude which increased risk of a loss of separation with overflying aircraft. As such, the training emphasis was on the threat being not capturing the low altitude level off.

The 737 FO advised that they had not flown the Sydney 34R missed approach procedure in the simulator and had only conducted one go-around in the aircraft. That go-around was conducted at Melbourne Airport in day VMC and the procedure required the pilot to fly straight ahead on runway track and climb to 4,000 ft.

The ATSB reviewed the 737 captain and FO’s training records and found both pilots had met the competency standard for one engine inoperative and all engines operating go-arounds.

Recorded data

Both the 737 and A330 aircraft involved in the occurrence were fitted with a flight data recorder (FDR) and cockpit voice recorder (CVR) as required by legislation.

The CVR data recorded during the occurrence was overwritten during subsequent operation of the aircraft. Both FDRs included data over the period of the occurrence.

Safety analysis

Introduction

On the night of 5 August 2019, aircraft landing and taking off from runway 34R were controlled from the Sydney air traffic control (ATC) tower via the ‘aerodrome controller (ADC) – east’ position. That position was operated by a trainee ADC and an on-the-job supervisor.

Following the landing of a Dash 8, the trainee ADC cleared the Airbus A330 to line up and take off while the Boeing 737 was on final approach to land. After realising that runway separation could not be assured, the trainee controller instructed the 737 to go around (conduct a missed approach). During the subsequent missed approach and turn to the right, the 737 came into close proximity with the A330 on its initial climb and turn to the right. This was classified as a ‘loss of separation’ under the ATSB’s occurrence classification system.

The loss of separation and close proximity between the 737 and the A330 was the culmination of a series of events that, individually, would only be minor concerns but collectively resulted in a significant incident.

This analysis first examines the development of the occurrence, and then discusses associated air traffic management and flight operations considerations.

Speed control on approach

The operational requirements for independent visual approaches (IVA) at Sydney and the instrument approach chart used by the flight crew detailed the speed control requirements for aircraft on approach.

In the initial parts of the approach the 737 flight crew operated at higher speeds than specified for the IVA. The aircraft was well above the maximum speed when 10 NM from the threshold and did not attain the required speed until after the trainee aerodrome controller (ADC) instructed the A330 crew to line up.

Although this did not have any detrimental effect on the 737’s operation (as the approach was stable), it contributed to the reduction of spacing between the 737 and the preceding Dash 8 and gave the trainee ADC less time to process the A330 departure. The flight crew did not advise air traffic control (ATC) of this increased speed, as required by the approach chart, and this probably affected the trainee ADC’s judgement of the amount of time available before the 737 would cross the runway threshold, as detailed in the following section.

Adherence to published approach speed limits aids to improve safety and efficiency by bringing more predictability to arrival sequences. This provides controllers with information used to manage separation standards between aircraft.

Sequencing of arriving aircraft

Aircraft arriving at Sydney Airport were sequenced for landing by the approach controller, who operated from the terminal control unit (TCU) at the airport. When aircraft were established on approach, they were transferred from the approach controller to the applicable aerodrome controller in the tower—in this case, the ADC position.

The local instructions applicable at the time specified the minimum distance between successive arrivals to runway 34R to be 5 NM. This distance could be reduced in some cases (not below 3 NM) if there was prior coordination between the approach and aerodrome controllers.

In this case, the spacing between the landing Dash 8 and the following 737 on approach was 4.5 NM when the 737 was instructed to contact the tower (ADC), and 4.1 NM when the ADC was first contacted. However, the approach controller had not coordinated with the trainee ADC for the transfer as required by the Sydney operational procedures.

The director controller did not later recall details of the arriving aircraft and operations in the TCU were described as normal. The sequencing of aircraft arrivals is dynamic and subject to a number of variables such as traffic density, aircraft performance, operator procedures, and environmental conditions.

In this case, the primary factor was the difference in aircraft performance as the aircraft in the approach sequence was a turboprop Dash 8 with a relatively low approach speed compared to the 737. Although the approach controller would have taken this speed difference into account, the Dash 8 was still slower than expected and the 737 was faster than specified for the independent visual approach. Had the 737 been 5 NM behind the Dash 8 and not 4.1 NM when the crew first contacted the ADC, there would likely have been enough additional spacing (about 0.9 NM) and time (about 25 seconds) for the A330 to take off without the 737 needing to conduct a missed approach: the A330 would have been crossing the departure end of the runway at about the same time the 737 would have reached the missed approach point.

Airservices found that Sydney TCU controllers routinely sequenced aircraft arrivals with less than the required 5 NM spacing without prior communication with Sydney Tower, and that this non‑conforming practice had been normalised. While some variability in aircraft spacing is expected in the dynamic Sydney terminal environment and ADCs are required to exercise their judgement as to the suitability of gaps for departures, provision of spacing within parameters generally reduces ADC workload and associated risk of traffic management misjudgements.

Although ADCs had access to radar position information for aircraft on approach, their primary focus was on visual separation of the aircraft on the runway and within 4 NM of the airport. As a result, ADCs may not have time to maintain an awareness of the distance between aircraft on approach. In that context, advance notice from the approach controller of less than 5 NM spacing (in accordance with operational procedures) would help an ADC to plan arrivals and departures and reduce the risk of compromised runway separation and associated go-arounds.

Management of the landing and departing aircraft

In visual meteorological conditions, the trainee ADC sequenced departing aircraft between arriving aircraft according to visual separation standards with supplementary information, mainly from the air traffic display. Although the distance between the arriving aircraft could be measured on the display, this was a dynamic parameter and required diversion of attention from the primary task of visual separation.

Controllers are expected to optimise traffic flow with minimal delays while still safely managing separation in accordance with the applicable standards. The standard most relevant at this point in the occurrence was the runway separation standard where, in simple terms, only one aircraft at a time was permitted to be on (or over) the runway.

It was permissible to instruct an aircraft to line-up for take-off behind a landing aircraft, but a take‑off clearance could not be given until the runway ahead was clear. In this case, the trainee ADC was required to anticipate the time taken for:

• the preceding landing Dash 8 to clear the runway
• the departing A330 to become airborne then turn or be clear of the runway required by the following 737
• the following (landing) 737 to reach the runway threshold.

Although the 737 was at close to its minimum approach speed by the time the Dash 8 crossed the runway threshold, the spacing had reduced to 3.3 NM. If the approach controller had advised the ADC of the non-conforming spacing, or the ADC controllers were aware that the 737 was faster than the specified approach speed, the trainee ADC and OJTI would have been prompted to pay closer attention to the 737’s proximity when considering the plan for the A330’s departure. The trainee aerodrome controller’s judgement of the spacing between the Dash 8 and 737 was therefore likely affected by incomplete appreciation of their initial spacing and speed difference.

The trainee ADC and OJTI both reported being aware that the spacing between the arriving Dash 8 and following 737 aircraft was less than the specified minimum of 5 NM by the time the Dash 8 crossed the threshold. However, the trainee ADC must have still anticipated that there was a sufficient gap at this time to allow the A330 to depart. It is likely that, having formulated a plan to allow the A330 to take-off between the Dash 8 and 737, and in the absence of knowledge about the 737 not maintaining the specified speed, the gradual reduction in spacing as the Dash 8 approached had not been enough of a prompt for the trainee ADC to challenge their commitment to the plan.

To execute the plan, the trainee ADC expedited the departure of the A330 by lining it up to hold on the runway so the crew was ready to start the take-off roll as soon as the Dash 8 was clear of the runway. The trainee ADC did not consult with the OJTI before initiating the A330 departure and there was no obligation to do so.

In any case, once the Dash 8 was clear of the runway the trainee ADC issued a clearance to the A330 for an immediate take-off, and the crew complied.

As the A330 started to roll the trainee ADC’s attention turned to the 737 on final approach, and the OJTI asked whether the runway separation standard would be met. The trainee ADC correctly assessed that the A330 might not be clear before the 737 passed over the threshold, so instructed the 737 crew to go around (conduct a missed approach) to avoid a runway loss of separation.

This was about 12 seconds after clearing the A330 for take-off. At this point, the 737 was 1.2 NM (2.2 km) from the threshold and the A330 was rolling and accelerating through 60 kt. The trainee ADC had the option to instruct the A330 crew to reject the take-off but (reasonably) wanted to avoid the risks associated with rejected take-offs.

The OJTI advised it was difficult to visually assess aircraft speed at night and there was no speed data for aircraft on the runway. Based on judgement and experience, the OJTI did not intervene and cancel the A330’s take-off clearance because it might have increased the risk to safety of the aircraft.

From that point onwards, although infringement of the runway separation standard was prevented, there was an increased potential for conflict because the MARUB SIX departure and the missed approach procedure both involved low-level right turns onto similar easterly tracks. This required controller intervention. The trainee ADC and OJTI had to maintain separation visually (at night) by judging and anticipating the three-dimensional positions, speeds and flight paths of both aircraft; this was complicated by the fact that both were climbing and turning, both at different rates.

Issues around the procedure design and procedural constraints are addressed in Air traffic management considerations.

737 flight path during missed approach

When instructed to go around (conduct a missed approach), the 737 crew was required to fly to the missed approach point and then follow the missed approach procedure for the runway 34R GLS approach unless otherwise advised by ATC. As specified on the approach chart, this was an initial track of 335° (runway bearing), then a mandatory right turn at 600 ft onto a 070° track, and climb to 2,000 ft.

As the aircraft would already be climbing before it reached the missed approach point, it would be expected that the aircraft would be above 600 ft at or soon after the missed approach point and then commence the turn. In this occurrence, however, the flight crew did not commence the turn until after this when at 1,100 ft, after they were instructed by the trainee ADC.

The 737 flight crew had an early awareness that separation from the rolling A330 would be marginal and they initiated the missed approach without delay. The initial actions were performed correctly. The crew had briefed the procedure for Sydney, which required the turn to be initiated after the landing gear and initial flap retraction, and for further flap retraction to be delayed. However, the first officer (FO) as pilot flying (PF) inadvertently followed the trained procedure for missed approaches (which was applicable to airports other than Sydney and did not involve an early turn). There were several contextual factors that likely contributed to this relatively late turn.

Missed approaches generally result in a high flight crew workload, particularly when they are manually flown like this one. Research has found that during missed approaches, there is an increase in the number of flight crew errors including flight path deviations (Dehais and others, 2017). Aspects of this missed approach that increased crew workload included a level-off altitude that was lower than typical, and the need for a turn soon after passing the missed approach point.

Another aspect of this missed approach was management of the automatic flight system. For operations at Sydney, Airservices used standard terminal arrival routes (STARs) that did not provide a continuous navigation path from the STAR to the approach. Therefore, in aircraft flight management computers (FMCs), there is a discontinuity in the route leg positions between last waypoint of the STAR and first waypoint of the runway instrument approach.

When the 737 flight crew programmed the assigned STAR and the runway 34R GLS approach they identified the FMC discontinuity. However, once the flight crew was assigned headings to intercept the IVA they did not update the FMC route legs page to have the active waypoint in front of the aircraft’s position. While there was no requirement for the flight crew to do so, this resulted in the lateral navigation (LNAV) mode not engaging during the missed approach.

The FO (as PF) saw that the LNAV mode did not automatically engage as expected when the aircraft climbed through 400 ft. Because LNAV was not engaged, there was no prompt for the FO to turn when reaching the missed approach point. The turn would normally be initiated at 600 ft after this point, but the FO was likely initially confused and distracted by the absence of LNAV, delaying the corrective action (turning manually or through the use of heading select and autopilot).

For the flight director to direct the turn the FO would have needed to select a roll mode such as HDG SEL (heading select). Because this was not done, the flight director guidance remained oriented to the runway track. For the same reason there was also no prompt to turn soon after this, when the aircraft overflew the flight management computer’s (FMC) actual pre-programmed missed approach point (incorrectly located at the runway threshold; see Runway 34R missed approach point coding).

The flight crew did not verify whether the missed approach route was being tracked in accordance with the published procedure. They were probably focussed on the aircraft’s configuration and speed, as well as the 2,000 ft level‑off altitude which they had previously identified as their main threat. The flight director guidance was commanding the FO to maintain runway track, which they followed until the trainee ADC instructed them to turn right about 15 seconds after they passed the missed approach point.

Automatic systems management and automation surprise can pose problems for flight crews. When modes are different from those expected for the flight phase or when modes are neither called out or checked, the flight path can deviate from what is expected. Distractions (such as hesitation over the misremembered procedure on the minimum altitude for flap retraction, and the navigation mode not changing as expected) probably also initially drew their attention away from the need to turn. In this context, and not yet completely certain about the required flight path, it would be reasonable to follow the flight director in the interim.

Another contextual consideration was the diagrammatic depiction of the missed approach on the approach chart. This showed a turn starting beyond the departure end of the runway rather than at or soon after the missed approach point as was probably intended. Although this diagram was not primary guidance for the missed approach procedure, and so unlikely to have contributed in this instance, it potentially provided the crew with a misleading mental model of when the turn would be expected to start.

In summary, the 737’s flight crew workload was high during the initial stages of the missed approach and the turn required by the procedure was not made until the crew were instructed by the trainee ADC. Distractions, an uncorrected route discontinuity, and potentially the depiction of the missed approach route on the approach chart well after the runway, were all potential factors.

Although the non-conforming missed approach alone did not affect the safe operation of the 737 and would not have been a concern in the absence of other traffic, the later turn positioned the 737’s flight path closer to that of the A330.

Trainee ADC response to conflict scenario

Throughout the missed approach sequence, the trainee ADC was applying visual separation. In the first phase of the missed approach, the 737 was travelling in the general direction of the tower, and it was after last light, which probably affected both controllers’ ability to visually determine the position of the 737 from the tower.

Another contextual factor was the historical variability in the location of the height-based right turn in the first part of the missed approach (Figure 15 and discussed further in Missed approach and departure procedures). This meant that the tower controllers could not develop a consistent visual reference to aid in their assessment of aircraft conformance to the runway 34R missed approach procedure (since other aircraft they saw likely turned at differing points).

In summary, it may not have been obvious at first that the 737 flight path was not conforming to the missed approach procedure.

From recent discussion of the scenario of an aircraft taking off concurrently with an aircraft going around from runway 34R, the trainee ADC was aware of the potential for compromised separation. The trainee ADC was also aware that an intervention might be required to preserve separation and that vectoring was not permitted at night below the MVA. Instead, the trainee ADC appropriately applied ‘best judgement and initiative’, which allowed controllers to work outside of prescribed actions when the safety of an aircraft may be considered to be in doubt, as in this case.

Observing that the 737 was not turning, the trainee ADC instructed the 737 crew to turn right onto a heading of 100°. This was about 9 seconds after the 737 passed through the 600 ft mandatory turn height, as described in 737 flight path during missed approach. By turning the 737 further than the default 070°, the trainee ADC was intending to direct the 737 onto a flight path that was divergent to the A330 in the process of turning to intercept the 075° radial. The trainee ADC’s likely mental model of the situation at this point is shown in Figure 16.

The trainee ADC’s instruction to the 737 to turn, soon after the aircraft passed 600 ft, was an important factor in keeping the two aircraft apart. However, in the absence of any other intervention, the instruction to turn would not prevent separation from being compromised. As the turn progressed, the 737 flight path was further to the north than the trainee ADC had anticipated due in part to the radius of turn (as a result of the 737’s increased speed since passing the missed approach point). The instruction to turn to heading 100° instead of the 070° specified by the procedure had no effect in the early part of the turn that was critical to separation.

Further, the trainee ADC did not issue the 737’s turn instruction using the phrase required for avoiding action, which would have alerted the 737 flight crew of the potential traffic conflict with the A330 and emphasised the reason for the instruction. As a result, their immediate response was not assured, and the turn was not made at the fastest possible rate. ATSB analysis indicated that a maximum-rate turn probably would have increased the minimum distance between the aircraft to about 0.55 NM (1.0 km). The trainee ADC also did not issue either flight crew with a safety alert to advise of the unsafe proximity situation.

Figure 16: Trainee ADC’s likely mental model of the approximate flight paths the aircraft were expected to take after issuing the instruction for the 737 to turn

Partial flight paths of the occurrence aircraft are shown for comparison (in faint orange and blue).

Source: Google Earth, annotated by the ATSB.

The trainee ADC’s separation model relied on the assumption that the flight path of the A330 would be further north than it was (prior to intercepting the 075 radial). The trainee ADC recalled that the A330’s turn was earlier and tighter than their recollection of other widebody jet aircraft taking off from that runway. Although that was their experience, the flight path was reasonably consistent with typical MARUB SIX departures (see Missed approach and departure procedures and Figure 15).

Although the 737 crew initiated the right turn about 6 seconds after the trainee ADC began issuing the instruction, the A330 also started to turn in accordance with the SID.

The A330 crew received an audible traffic advisory alert from the traffic collision avoidance system (TCAS) and the first officer sighted the 737. An alert was not generated by the 737 TCAS, probably because of differences in the calculations by each system. Shortly afterwards the separation between the aircraft reduced to 0.42 NM (800 m) laterally and about 508 ft vertically. This was the closest proximity during the occurrence.

As stated previously, the trainee ADC was applying visual separation in the terminal area. The Manual of air traffic services (MATS) allowed for visual separation of aircraft in the vicinity of aerodromes only when the projected flight paths of the aircraft do not conflict, with consideration of faster following aircraft, and with ‘wide margins’ when judging relative distance or height due to the possibility of visual errors. The ATSB considered that these conditions were not met, which makes the occurrence a loss of separation.

There are limitations to the human visual system at night (Gibb and others 2010). For example, in the absence of other cues, the apparent size of an object is related to its brightness rather than its image size. As a result, the judgment of distance is extremely difficult at night (Isaac and Ruitenberg 1999). The MATS stated that ‘visual determination of the relative distance of aircraft in close proximity can be in error or affected by optical illusion’.

In the context of having no time to plan for the conflict, the trainee ADC did not make a change, initially, to the flight path of the A330. Although the constraints of vectoring at night also applied to the A330, the trainee ADC had the option to instruct the A330 crew to turn to a more northerly heading. This would have reduced the risk of unsafe proximity without any significant terrain/obstacle collision risk.

About 30 seconds after assigning the initial turn instruction to the 737 crew, the trainee ADC instructed the crew to continue the right turn onto 120° to provide further separation. The 737’s heading was then passing through 022°, and with the disposition of the 2 aircraft and the A330 still turning, this instruction had no immediate effect on separation.

After a further 20 seconds and a transmission from the A330 flight crew to advise that they had passed ‘very close’ to the other aircraft, the trainee ADC instructed the A330 crew to turn left heading 100°. A left turn by the A330 at this time would have increased the gap further. In fact, this heading would have required a right turn from the A330’s current heading (about 070°), indicating that the trainee ADC thought that the A330 had turned further south than it had, and the instruction had limited effect. Nevertheless, the 737 was now ahead of the A330 and travelling faster so the spacing widened.

Following the loss of separation, the trainee ADC transferred the 737 to the approach controller without a separation standard having been established and without coordinating a transfer of separation responsibility with the approach controller. As a result, the 737 was under the control of the approach controller without a required surveillance separation standard.

On-the-job training and supervision

The trainee ADC was operating under the supervision of a qualified on-the-job training instructor (OJTI) who was responsible for the safety and efficiency of the aerodrome control function for runway 34R. Although the OJTI had the authority to override the trainee ADC, any intervention would have resulted in deferral of the check planned for the next day. In addition, and based on the trainee ADC’s recent performance, the OJTI was expecting the trainee ADC to identify and manage traffic conflicts with minimal prompting and no intervention. The trainee ADC had been operating with similar expectations.

When the trainee ADC instructed the A330 crew to line-up then cleared them for an immediate take-off, the OJTI considered the sequencing of the A330 departure was ‘ambitious’ but this was not communicated to the trainee at the time because there was a possibility the plan could work and would be an opportunity for the trainee ADC to demonstrate a solution. Once the trainee ADC instructed the 737 crew to conduct a missed approach, the OJTI was aware that the aircraft would need to be separated and prompted the trainee ADC to focus on a resolution.

The OJTI reported they would have preferred the trainee ADC to cancel the SID and provide the A330 flight crew with a heading to the right of the runway centreline (such as 030°) to resolve the compromised separation but did not communicate this to the trainee. As described above, the trainee instructed the 737 crew to turn right to heading 100°. The OJTI recalled understanding the trainee’s logic for the instructions, but would not have chosen this strategy to resolve the situation and believed more azimuth could have been provided to the 737.

There were differing understandings between the trainee ADC and OJTI in managing the compromised separation situation. Communications effectiveness depends on shared assumptions, a shared mental model or shared situation awareness (Salas and others 1995). Research in mental models and shared awareness has found that information that is shared in strategic mental models allows team members to have common explanations of the meaning of task cues, make a compatible assessment of the situation, and form common expectations of additional task and information requirements. This shared level of situational awareness allows them to take appropriate actions, whether gathering additional information critical to making a decision, or implementing a particular procedure (Salas and others 1994).

As part of on-the-job instruction of Airservices controllers, a prompting hierarchy is used to guide the performance of the trainee. The purpose of the prompting hierarchy is to assist with determining the trainee’s readiness for a final check with the underlying premise that, in an air traffic control context, the OJTI is maintaining the traffic picture and commences prompting once a potential safety occurrence is identified, and they can then be certain that the trainee has identified the issue, and that the solution is satisfactory.

In this case, after the A330 was cleared for take-off, the OJTI asked the trainee ADC whether the runway separation standard would be met. This successfully prompted the trainee ADC to reassess the spacing between the two aircraft and led to the instruction for the 737 to go around.

The OJTI then prompted the trainee ADC to resolve the separation issue by directing the trainee’s attention to resolving the situation, asking ‘what are we going to do’ and to provide the aircraft with more horizontal separation. From this communication, the trainee ADC likely believed they shared the same understanding of the situation and had chosen the same solution, or at least a feasible one.

However, the OJTI did not use the higher levels to communicate to the trainee ADC the urgency of the situation, did not prompt the trainee ADC to share their mental model of the emerging traffic picture or confirm that the trainee ADC was projecting the flight paths accurately. This also meant that the trainee ADC may not have had sufficient prompts to question their interpretation of the developing situation. It is likely the OJTI was cognisant that the trainee ADC needed to demonstrate competence without intervention, and was reluctant to provide additional instructions to manage and recover from the compromised separation situation effectively.

The OJTI was monitoring the aircraft visually and was confident that they would not collide. However, for the separation of two aircraft at night, it is desirable to have a wide buffer to account for potential errors in judging and predicting flight paths, and the two controllers allowed the distance between the aircraft to decrease without further effective intervention.

As the situation developed and the A330 began turning towards the 737, the controllers’ ability to maintain visual separation began to be compromised and the controllers probably misjudged the proximity and direction of the two projected flight paths. This limitation may be illustrated by the trainee ADC’s instruction for the A330 to turn ‘left’ to heading 100°. With both aircraft heading away from the tower at this point, a left turn would have been an obvious solution to separate them, but this instruction indicated that the trainee ADC’s understanding of at least the A330’s flight path was erroneous. The error was not corrected by the OJTI.

Although the gap was widening by this point, it meant the A330 continued to turn towards the 737 instead of away as intended. While the OJTI’s judgement that the 737 would pull ahead of the A330 in the turn was correct, the separation by the time the flight paths crossed was still only about 0.8 NM (1.5 km) and any unanticipated variation in speeds or flight paths could have resulted in it reducing further.

Tower shift manager supervision

In the time leading up to and immediately following the occurrence, the tower shift manager (TSM) was engaged in supporting another controller to reduce their workload. After the 737 crew was instructed to go-around, the OJTI wanted to notify the TSM in accordance with accepted practice but could not leave the trainee ADC unsupervised, and could not gain the TSM’s attention.

As a result, the TSM was not aware of the missed approach and separation issue until after the event. This limited the effectiveness of the TSM role as a risk control for the ADC controller position as they could not provide operational supervision to tactically manage the risk.

Air traffic management considerations

Missed approach and departure procedures

Airservices is required to design procedures in accordance with international technical standards and the primary principle of safety along with other considerations such as noise, environment, and flight operations and restrictions imposed through the Ministerial direction and Long Term Operating Plan. For safety assurance, segregation of aircraft flight paths reduces complexity and workload for pilots and controllers.

Although each instrument procedure separately met regulatory design requirements, the concurrent use of the MARUB SIX SID and the runway 34R missed approach procedure could result in converging flight paths, depending on the timing and radius of each turn as well as the relative speeds (Figure 17).

Figure 17: Potential aircraft tracks for runway 34R missed approaches compared with tracks following the MARUB SIX SID

Standard-rate turns are taken at 25° bank. All turns in blue, orange and white are shown with a constant 0.8-NM radius, which is a standard-rate turn at 160 kt, or a 1.4-NM radius, which is a standard-rate turn at 210 kt. The red turn has a constant 1.4-NM radius. Partial flight paths of the occurrence aircraft are shown for comparison (in faint orange and blue).

Source: Google Earth, annotated by the ATSB.

Generally, aircraft conducting a missed approach are required to turn once climbing through 600 ft once at or past the missed approach point. The turn point could change depending on the climb gradient and the location and height at which a missed approach is initiated and there was no clear limit on the extent to which an aircraft could continue on the runway heading before initiating the turn.

Missed approaches that commence the turn near the 737’s missed approach point would generally not come as close to the departure paths as in this occurrence, albeit still closer than the 3‑NM (5.6 km) separation standard (the blue track in Figure 17). However, this would require a missed approach to be initiated early enough before that point for the aircraft to have reached 600 ft. A more serious compromise could occur if the missed approach turn is initiated well after the missed approach point, and particularly if the missed approach turn is also wider than the other aircraft’s departure turn (for example taken at a higher speed). Both of these scenarios occurred in this case.

In general, the missed approach procedure was more likely to result in a wider turn than an aircraft on the MARUB SIX SID, because:

• an aircraft conducting a missed approach was more likely to have a higher speed, because it would start accelerating from the landing speed and from an earlier point
• there was no minimum bank angle required for the missed approach turn, whereas the MARUB SIX SID turn required a minimum 25° bank angle.

Recorded data indicated that the majority of missed approaches from runway 34R followed a similar path to that of the 737, either intersecting with or crossing the typical MARUB SIX SID track (Figure 15). Although there was some variation in where the missed approach turns began, most appeared to have been initiated from above the runway, as the 737 did in this occurrence. These tracks either merged with or came close to the MARUB SIX SID radial or crossed the typical departure track heading south-east to meet the MARUB radial.

Conversely, there was little variation in the MARUB SIX SID tracks, with most aircraft commencing the turn before crossing runway 07/25 and following a similar flight path to the A330 in this occurrence. The ATSB estimated the average track to intercept the MARUB radial was about 100°, resulting in the tracks converging with the runway 34R missed approach heading (070°) at a typical angle of 30°.

As stated previously, the extent of conflict depends on a number of factors. Approach spacing appears to be one of the most important. Air traffic controllers can allow for this by ensuring sufficient initial spacing between the aircraft to reduce the likelihood of a missed approach to prevent a runway separation issue and to reduce the potential for conflict if a missed approach occurs for other reasons. However, if approach spacing is reduced below the minimum, as it was in this instance and as Airservices reported was ‘habituated’ among Sydney controllers, a controller might judge that there is enough spacing to allow a third aircraft to depart between them, in which case:

• the risk of a missed approach is increased due to the traffic ahead and
• the risk of the runway 34R missed approach path then coming into conflict with the third (departing) aircraft on the MARUB SIX SID also increases due to the initial proximity of the following aircraft.

Therefore, spacing should only be reduced if the aircraft can still be kept apart with minimal, or no, intervention.

In addition, the Flight Safety Foundation (Blajev and Curtis, 2017) recommended avoiding missed approach procedures that had a low first stop altitude and an early turn. These characteristics were both present in the runway 34R missed approach procedure and probably contributed to the 737 flight crew’s workload in this occurrence, increasing the likelihood of a more serious loss of separation.

It is important to note that there were constraints on the manner in which Airservices were permitted to design the departure and missed approach procedures, particularly the Long Term Operating Plan and Ministerial direction associated with it. However, these documents also emphasised that ‘the safety of aviation operations is not to be compromised’ and this occurrence is an indicator that the current departure and missed approach procedures do compromise safety, at least to some extent.

Airservices stated there had not been an occurrence history that indicated systemic risk control shortfalls with the management of MARUB SIX SID and runway 34R missed approach scenarios to indicate that the level of risk was not as low as reasonably practicable. Although it was anecdotally reported that controller intervention due to the potential for conflict between the MARUB SIX SID and runway 34R missed approach procedures occurred 10 to 20 times in a year, and controllers interviewed by the ATSB generally recognised it as a known hazard, a search of the ATSB database found that no comparable occurrences had been reported. This would not account for some other events, such as those that do not result in a loss of separation (due to controller intervention) but were still a separation concern. Also, it was not possible to obtain detailed data on the level of controller intervention, if any, that resulted. Furthermore, low-incidence hazards are still important to control when there is a potential for a catastrophic consequence.

Controller options for mitigating loss of separation

As a result of the potential for conflict with the concurrent use of the MARUB SIX SID and the runway 34R missed approach procedure, a controller needed to modify the flight path of one or both aircraft to maintain separation. The only resolution in this situation would be to issue headings and/or altitude instructions to one of the aircraft (that is, vector the aircraft) to establish divergent tracks and/or altitude spacing. During the occurrence the trainee ADC and the OJTI formulated separate resolution plans, both of which required aircraft to be vectored at low level.

However, this could be problematic at night because the MATS only allowed vectoring below the MVA in daylight. In daytime, vectoring at low altitudes was permitted because flight crews could visually maintain adequate height to avoid ground and obstacle collisions. To do this, controllers could assign terrain clearance responsibility to the flight crews.

Controllers interviewed by the ATSB stated that in line with the requirement for controllers to provide a duty of care in an unsafe situation, their professional judgement was that, when faced with this time- and safety-critical conflict situation, the least-risk option to aircraft was to issue vectors below MVA at night and issue a safety alert for terrain to the flight crew. These controllers were aware this was not in accordance with the MATS but commented that it had become a normalised solution to the hazard.

In the absence of effective, compliant options, these controllers have needed to break a rule under the cover of a general allowance to apply their ‘best judgement and initiative’ to ensure safety. Although the existence of this type of rule is appropriate and allows controllers to manage unforeseen situations using their initiative and experience, this type of rule should not be applied as a normalised solution. Instead, the underlying reasons for conflict should be removed (so that the situation does not, or is very unlikely to, arise) or controllers should be provided with compliant options to resolve them. If vectoring below the MVA is a normalised solution to a known, recurring problem, it needs to be effectively managed and controlled by Airservices at a systemic level.

In 2015, CASA advised Airservices that the air traffic management system should not rely, as a primary means of defence, on vectoring or heading changes below the MVA at night. However, the Airservices standardisation directive reiterating limitations on vectoring at night indicates that this was a tactic that controllers continued to employ, and that Airservices was aware of it. The underlying reasons for controllers to breach this requirement were apparently not identified and addressed, but likely included situations where separation was (or was going to be) compromised and controllers needed to intervene. These situations likely included the concurrent use of the MARUB SIX SID and runway 34R missed approach procedures.

A broadly similar issue had been addressed at Melbourne Airport in 2016 in response to a loss of separation involving a missed approach at night. The ATSB investigation identified that ‘in the event of a simultaneous go-around at night during LAHSO [land and hold short operations] at Melbourne Airport, there was no safe option available for air traffic controllers to establish a separation standard and to ensure a collision did not occur when aircraft were below the minimum vector altitude.’ In response to this occurrence, Airservices implemented strategies (permitted by CASA exemption) that permitted terrain clearance to be maintained when vectoring aircraft below the MVA at night, including controller training and the implementation of a safe sector.

Although related issues existed elsewhere, these safety actions only applied at Melbourne Airport and only under specific circumstances (during LAHSO operations at night).

Safety risk management

According to Airservices, the MARUB SIX SID had been published and in operation since about 1997. As discussed above, the issue of the flight path design and reduced separation assurance between the MARUB SID and runway 34R missed approach procedures was generally recognised among Airservices controllers. This is consistent with this trainee ADC having discussed it with at least 2 trainers.

Airservices considered the risk to be effectively managed. However, as noted in previous sections, the ATSB identified a number of limitations with the management of risk for operations involving conflicts between aircraft on the MARUB SIX SID and the runway 34R missed approach. Accordingly, the investigation considered potential reasons why these problems existed and had not been addressed.

Airservices identified and managed risk through operational risk assessments (ORA), and had an ORA specifically for Sydney airport. The ORA identified a mid-air collision as a threat; however, it mostly did not list specific threat scenarios such as the potential conflict between the MARUB SIX SID and the runway 34R missed approach procedure. This suggests that any risk assessment for this scenario, and others, were not recorded and it was not possible to evaluate their validity.

The ATSB found that the generalised ORA defensive barriers had limited effectiveness in addressing risk. Specifically:

• Supervision: During normal operations, the Sydney tower shift manager rosters undertook non‑supervisory tasks that restricted their ability to maintain direct supervision of the operating environment and therefore did not ensure the defensive barrier was available.
• Compromised separation rules and procedures: Airservices did not have a prescribed procedure or training for managing compromised separation recovery when the aircraft was below MVA at night. In addition, a standardisation directive to controllers prohibited them from vectoring aircraft below the MVA at night.
• Safety alerts: Safety alerts rely on the timely recognition and memory by the controller. In this occurrence, no safety alert for traffic proximity or terrain was issued by any controller to flight crew.
• Pilot action: the TCAS traffic advisory (TA) and resolution advisory (RA) functions are inhibited at low altitudes, and there are limitations on the ability of pilots to see and manoeuvre to avoid one another at low heights, at night or in instrument conditions. In this case, the 737 flight crew had no knowledge of the intended departure tracking of the A330 via the MARUB SID and the aircraft attitude during the missed approach prevented both pilots from sighting the A330. Meanwhile, the A330 FO was only able to see the 737 when looking back during the turn after a TCAS TA had already activated, and the A330 captain would not have been able to see the other aircraft until after the conflict began resolving.

Previous ATSB and Airservices investigations had identified related safety issues at other locations (notably Melbourne and Adelaide) including scenarios that involve vectoring below MVA at night, compromised separation procedures, and controller training.

In November 2015, CASA wrote to Airservices regarding operations at Melbourne Airport, expressing ongoing concern with a number of issues. Some of these were relevant to Sydney operations and the scenarios discussed in the current report. While safety action was undertaken by Airservices and CASA at other Australian airports to manage local issues, the lessons were not applied on a national level, and not at Sydney Airport.

Airservices likely would have identified suitable risk controls for the MARUB SIX SID and runway 34R missed approach conflict, had it:

• broadened the scope of lessons learned at other airports
• considered the effects of routine controller non-compliance in the application of arrival spacing which increased the risk of missed approaches on runway 34R
• identified variations in tracks of aircraft on the runway 34R missed approach including more northerly flight paths which increased the risk of conflict with aircraft departing on the MARUB SIX SID
• considered the reasons for controllers knowingly making a non-compliant action to vector aircraft below the MVA at night to prevent a more serious loss of separation (the prevalence of which prompted a directive to controllers reiterating that this was not permitted)
• formally identified and managed the risk.

This could have led to the identification of risk control and mitigation shortfalls and timely action taken to reduce risk. Through proactive and predictive hazard identification processes involving specific scenarios, it is probable that at least some of the risk controls associated with the MARUB SIX SID and runway 34R missed approach conflicts would have been improved, particularly in terms of compromised separation procedures at night.

Tower controller training and assessing

Key aspects of this occurrence, including sequencing of arriving and departing traffic and recovery from compromised separation, were taught to controllers through classroom instruction and on‑the-job training, and ultimately checked. Although this trainee ADC’s training was reported to have been somewhat disjointed and lacking continuity of trainers (likely as a consequence of trainee or OJTI unavailability), there was no evidence to indicate any deficiencies with this training and the trainee ADC had demonstrated capability to manage traffic without missed approaches.

The trainee ADC had completed the required compromised separation training for Sydney Airport and was expected to be aware of the higher risk scenarios, recognise potential conflicts, and issue instructions for deconfliction and safety alerts to flight crews. Within the aviation industry, incorporating scenarios within training has been used extensively with flight crew (Fowlkes and others 1998). The potential for conflict between the MARUB SIX SID and runway 34R missed approach procedures had been discussed in the trainee ADC’s check about 2 weeks before the occurrence and reviewed with the OJTI prior to the occurrence.

Although the trainee ADC had been made aware of this potential conflict and challenge to keep aircraft separated, especially below the MVA at night, the delivery of this information relied on the individual trainers and, to some extent, whether relevant scenarios arose during training. This meant that trainees would not necessarily be exposed to this scenario or others requiring aircraft to be vectored when below the MVA at night. While it is not possible to present every conceivable variety of scenario, controllers should be presented with scenarios that they have a realistic chance of encountering and presents a significant risk, especially if the only option for resolution is non-compliant.

There are a number of potential benefits in providing tower-specific compromised separation simulator training. It could provide a valuable opportunity for controllers to apply and trial compromised separation recovery techniques, in a controlled training environment, for the airspace on which they are endorsed, and with aircraft types with which they are familiar.

In summary, although Airservices provided compromised separation recovery training for Sydney tower controllers, this did not include scenarios involving aircraft below the minimum vector altitude at night.

Runway 34R missed approach point coding

Following the occurrence, Qantas conducted a review of the 737 FMC database for Sydney runway 34R approaches. The review determined that in all but one instance, the location of the missed approach point was at the runway threshold, the same location as the published RW34R waypoint. This did not conform to the published instrument approach procedures, where the missed approach point would be along the approach path before the runway.

Detection of this discrepancy would only be highlighted to flight crew after a thorough check of the FMC data compared with the missed approach point as published on the chart for the approach being flown.

In the case of the runway 34R approach, the erroneous waypoint location could lead flight crew into delaying the commencement of the right turn (if already at 600 ft) by up to 0.5 NM for the GLS approach.

In this instance, given LNAV did not automatically engage, displacement of the missed approach point did not contribute to the occurrence. It did, however, have the potential to confuse the flight crew and might explain some of the non-conforming missed approach paths recorded by Airservices.

Findings

From the evidence available, the following findings are made with respect to the close proximity involving Boeing 737 VH-VZO and Airbus A330 VH-EBJ at Sydney Airport, New South Wales, on 5 August 2019.

Contributing factors

• The 737 flight crew did not maintain the aircraft’s speed within the specified range during the first part of final approach, and did not advise air traffic control of this non-compliance as required by the approach procedure.
• The spacing between the landing Dash 8 and the following 737 on approach reduced to less than 5 NM without the required coordination between the approach controller and aerodrome controller position prior to transfer.
• The trainee aerodrome controller’s judgement of the spacing between the Dash 8 and 737 was likely affected by incomplete appreciation of their initial spacing and speed difference. As a result, the A330 was instructed to line up and was then issued a clearance for an immediate take‑off without sufficient spacing to prevent a runway separation issue or go-around. Because the respective departure and missed approach procedures both involved climbing from a low level and tracking to the east, this led to a compromised separation situation.
• After initiating the missed approach, the 737 flight crew inadvertently continued on the runway heading above the mandatory 600 ft turn beyond the missed approach point, and did not turn until instructed by the trainee aerodrome controller. As a consequence, the flight path of the 737 was closer to that of the A330’s departure track than it would have been if the turn had been commenced at the required height.
• Although the trainee aerodrome controller’s instruction for the 737 to initiate the turn reduced the collision risk, the extension of the turn to 100° did not mitigate the short-term effect of the delayed and relatively large-radius turn of the 737, or modify the A330’s projected flight path. Further, the aerodrome controller did not issue the 737’s turn instruction using the phrase required for avoiding action or issue a safety alert to either flight crew.
• After the missed approach was initiated, the on-the-job training instructor’s prompts to the trainee aerodrome controller were at the lower level of the prompting hierarchy and did not reflect the potential criticality of the situation or elicit an effective response.
• The Airservices Australia MARUB SIX standard instrument departure and the missed approach procedure for runway 34R directed aircraft onto outbound tracks that did not sufficiently assure separation between aircraft following the procedures concurrently. (Safety issue)
• Although Airservices Australia applied operational risk assessments to high-level threats, it did not formally assess and manage the risk of specific threat scenarios. As a likely result, Airservices did not formally identify and risk manage the threat of separate aircraft concurrently carrying out the MARUB SIX standard instrument departure and a missed approach from runway 34R at Sydney Airport, even though it had been a known issue among controllers generally. (Safety issue)

Other factors that increased risk

• The tower shift manager (TSM) was fully engaged in a controller function and was not aware of the missed approach and development of the compromised separation until after the event. This negated the TSM role as a risk control and increased the risk that a compromised separation would not be managed effectively.
• The missed approach points pre-programmed into the flight management computer of Qantas 737s were incorrect for 8 different approaches to Sydney runway 34R. The missed approach points were located over the runway threshold, which was not consistent with the locations of the missed approach points as determined by the relevant instrument approach charts.
• Airservices Australia did not have procedural controls to separate aircraft concurrently carrying out the MARUB SIX standard instrument departure and a missed approach from runway 34R at Sydney Airport while below the minimum vector altitude at night. (Safety issue)
• Airservices Australia’s compromised separation recovery training for Sydney tower controllers did not include scenarios involving aircraft below the minimum vector altitude at night. (Safety issue)
• After the occurrence, the trainee aerodrome controller transferred the 737 to the approach controller without the separation standard being met and without coordination.

Safety issues and actions

Separation assurance of concurrent procedures

Safety issue number: AO-2019-041-SI-04

Safety issue description: The Airservices Australia MARUB SIX standard instrument departure and the missed approach procedure for runway 34R directed aircraft onto outbound tracks that did not sufficiently assure separation between aircraft following the procedures concurrently.

Risk management of specific threat scenarios

Safety issue number: AO-2019-041-SI-02

Safety issue description: Although Airservices Australia applied operational risk assessments to high-level threats, it did not formally assess and manage the risk of specific threat scenarios. As a likely result, Airservices did not formally identify and risk manage the threat of separate aircraft concurrently carrying out the MARUB SIX standard instrument departure and a missed approach from runway 34R at Sydney Airport, even though it had been a known issue among controllers generally.

Absence of procedural controls to separate aircraft below the minimum vector altitude at night when on identified conflicting flight paths

Safety issue number: AO-2019-041-SI-01

Safety issue description: Airservices Australia did not have procedural controls to separate aircraft concurrently carrying out the MARUB SIX standard instrument departure and a missed approach from runway 34R at Sydney Airport while below the minimum vector altitude at night.

Compromised separation recovery training

Safety issue number: AO-2019-041-SI-05

Safety issue description: Airservices Australia’s compromised separation recovery training for Sydney tower controllers did not include scenarios involving aircraft below the minimum vector altitude at night.

Safety action not associated with an identified safety issue

Additional safety action by Airservices Australia

Airservices advised that it had or would conduct the following safety actions in response to this occurrence:

• Standardisation Directive (DIR_19_0039) issued to ensure controllers adhere to the agreed spacing for arriving aircraft as detailed in the Sydney Operational Procedure (LoA_3183) and the requirement to coordinate any reduction to these distances.
• Establish an operations manager-led focus group to facilitate joint discussion between the Sydney Tower and Terminal check and standardisation supervisors to foster an increased understanding of shared risk factors.
• Group circular reinforcing the arrival and departure spacing requirements, expectations and procedure design objectives.
• Issue a safety alert to airlines on the importance of adherence to published missed approaches to increase the understanding of shared risk factors.
• Temporary Local Instruction (TLI_19_0340) issued to advise TSMs [tower shift managers] to operate as a stand-alone role and only combine with other roles following a risk assessment.
• Redesign the Sydney TSM roster to allocate stand-alone TSM during core hours.

Additional safety action by Qantas Airways Limited

In response to the occurrence, Qantas:

• promulgated communications to flight crew ‘highlighting the event and the importance of approach speeds and the missed approach point’
• updated its 737 flight management computer missed approach point coding
• incorporated missed approaches from Sydney Airport runway 34R in its cyclic training sessions
• tested and confirmed flight management system transition to lateral navigation (LNAV) during different approach types to Sydney Airport runway 34R
• updated its flight data analysis program to:
  • monitor approach speeds at key points for compliance with approach speed requirements
  • record traffic collision avoidance system (TCAS) traffic advisory (TA) data in addition to resolution advisory (RA) data.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• captain and first officer of the 737
• captain and first officer of the A330
• trainee aerodrome controller
• on-the-job training instructor
• director controller
• tower shift manager
• Qantas Airways
• Civil Aviation Safety Authority
• Airservices Australia
• recorded data from the 737 and A330.

References

Blajev, T and Curtis, W (2017) Go-Around Decision Making and Execution Project: Final Report to Flight Safety Foundation. Flight Safety Foundation.

Dehais, F, Behrend, J, Peysakhovich, V, Causse, M and Wickens, CD (2017) Pilot flying and pilot monitoring’s aircraft state awareness during go-around execution in aviation: A behavioral and eye tracking study, The International Journal of Aerospace Psychology, 27(1-2): 15-28.

Fowlkes, J, Dwyer, DJ, Oser, RL and Salas, E (1998) Event-based approach to training (EBAT), The International Journal of Aviation Psychology, 8(3): pp. 209-221.

Gibb, R, Gray, R and Scharff, L (2010) Aviation visual perception, Routledge, London.

Isaac AR and Ruitenberg B (1999) Air traffic control: human performance factors, Routledge, London.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• captain and first officer of the 737
• captain and first officer of the A330
• trainee aerodrome controller
• on-the-job training instructor
• director controller
• tower shift manager
• Qantas Airways
• Civil Aviation Safety Authority
• Airservices Australia.

Submissions were received from:

• the captain of the A330
• Qantas Airways
• Civil Aviation Safety Authority
• Airservices Australia.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.