Unsafe proximity and radar vector below minimum vector altitude involving a Boeing 777-31HER, A6-EBU, and two 737-838s, VH-VXS and VH-VYE, Melbourne Airport, Victoria, on 5 July 2015

At 1808 Eastern Standard Time^[1] on 5 July 2015, an Emirates Boeing 777‑31HER (B777), registered A6‑EBU and flight number 405, conducting a scheduled passenger flight to Changi Airport, Singapore was issued instructions to line up on runway 34^[2] (Figure 1) at Melbourne Airport. The instruction was issued by a trainee Melbourne Aerodrome Controller (trainee tower controller)^[3] following discussion with her on‑the‑job training instructor (tower OJTI). Also in the Tower were the Melbourne Tower Coordinator (coordinator) and a controller providing both Melbourne Surface Movement Control and Airways Clearance Delivery. At the same time, two Qantas Boeing 737‑838s (B737s) were about 5 NM (9 km) from the threshold of their respective runways under land and hold short operations (LAHSO):^[4]

• the B737 on final for runway 27, registered VH‑VXS (VXS) and flight number 449, was conducting a scheduled passenger flight from Sydney, New South Wales
• the B737 on final for runway 34, VH‑VYE (VYE) and flight number 819, was conducting a scheduled passenger flight from Canberra, Australian Capital Territory.

Under LAHSO, the B737 tracking to land on runway 34 was required to land and stop before the intersection with runway 27, allowing the other B737 to land on the full length of runway 27.

About 30 seconds later, as the B777 continued to taxi towards the runway, the aircraft was cleared for an immediate take-off.^[5] In one continuous movement, the B777 flight crew followed the taxiway lights onto the runway and executed a 90˚ turn to line up on the runway centre line prior to commencing the take-off roll.^[6] This manoeuvre took longer than the trainee tower controller and the tower OJTI had anticipated and, by the time the B777 had commenced the take-off roll at 1810, VXS was at about 2.5 NM (5 km) from the runway 27 threshold passing 1,300 ft above mean sea level (AMSL)^[7] on descent and VYE was less than 2 NM (4 km) from the runway 34 threshold passing 1,100 ft on descent.

Due to the slower than anticipated speed by the B777 commencing its take-off roll, the trainee tower controller requested the flight crew of VXS to reduce to minimum speed. The flight crew responded that they were at minimum speed. The tower OJTI then asked the trainee tower controller to inform the flight crew of VXS that, in the event of a missed approach, the flight crew were to expedite climb to 4,000 ft as there was ‘traffic departing the crossing runway.’ In response to this transmission, at 1810, the flight crew of VXS advised that they were going around.^[8] At that time, VXS was about 1.2 NM (2.2 km) from the runway 27 threshold passing 900 ft on descent and VYE was about 1 NM (2 km) from the runway 34 threshold passing 800 ft on descent.

Figure 1: Melbourne Airport diagram with runways 27 and 34 indicated (green and blue respectively) and the location where the B777 entered runway 34 indicated by a purple arrow

Source: Airservices Australia, modified by the ATSB

The coordinator expressed concern that the departing B777 was still occupying runway 34 and that a runway separation standard would not be maintained with the arriving VYE.^[9] Receiving what he deemed an unsatisfactory response from the tower OJTI, the coordinator then instructed the trainee tower controller to send VYE around.^[10] At the same time as the trainee tower controller instructed the flight crew of VYE to go around, at 1811, a runway 34 occupancy caution activated in the Tower because the B777 was still on runway 34 and VYE was less than 15 seconds flight time from the threshold.^[11] Two seconds later, the caution upgraded to a warning as VYE was now less than 10 seconds flight time from the threshold descending through 500 ft and the B777 was still on the runway, passing taxiway FOXTROT (Figure 2). At that time, VXS was less than 1 NM (2 km) from the runway 27 threshold climbing through 1,100 ft.

Figure 2: Melbourne Airport diagram with runways 27 and 34 indicated (green and blue respectively), and the location of the B777 (purple arrow) passing taxiway FOXTROT (yellow) at 1810:34

Source: Airservices Australia, modified by the ATSB

Seconds later the flight crew of VYE reported that they had commenced the go-around. Surveillance data showed that the B777 was still on runway 34, south of the intersection with runway 27. The trainee tower controller then advised the flight crew of VYE that a B737 (i.e. VXS) was going around on runway 27 but used the incorrect runway identification – runway 34 instead of runway 27.

At 1810:43, as VYE flew over the threshold of runway 34, surveillance data showed the aircraft climbing through 600 ft with the B777 still on the runway, still south of the intersection with runway 27, with VXS less than 0.3 NM (0.6 km) from the threshold of runway 27 climbing through 1,200 ft.

Nine seconds later at 1810:52, as VYE left 1,000 ft on climb overhead runway 34 (Figure 3), the trainee tower controller was instructed to tell the flight crew to turn right onto a heading of 360˚ while the aircraft was below the minimum vector altitude (MVA) of 2,000 ft.^[12] At that time, surveillance data showed the B777 north of the runway 27 intersection climbing through 800 ft and VXS overhead runway 27 climbing straight ahead through 1,700 ft. Shortly afterwards, the trainee tower controller issued a wake turbulence caution to the flight crew of VYE^[13] in relation to the B777 departing runway 34.

Figure 3: Melbourne Airport diagram showing the location and height of the B777 (purple), VH‑VXS (green) and VH‑VYE (blue) at 1810:52

Source: Airservices Australia, modified by the ATSB

Fourteen seconds later at 1811:18, VYE was just south of runway 27 and climbing through 2,100 ft – now above the MVA of 2,000 ft. All aircraft were now tracking well clear of each other and their flight paths were diverging, with the B777 continuing to Changi and the two 737s being re-sequenced to land at Melbourne Airport without further incident.

At no time was traffic information^[14] provided to the flight crew of the B777 regarding either B737.

Airservices Australia (Airservices) surveillance data showed that separation between the two B737s reduced to about 0.9 NM (2 km) and 900 ft as VXS crossed runway 34 in front of VYE, climbing in the missed approach on runway 27. At that time, VYE was also climbing, conducting a go-around from runway 34. The tower controller was responsible for maintaining a separation standard and the only available standard was visual.^[15] However, due to the limitations of human vision at night^[16] and the disposition and trajectory of traffic at the time, visual separation could not be assured.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Runway number: the number represents the magnetic heading of the runway.
3. See the section titled On-the-job instruction.
4. See the section titled Land and hold short operations.
5. Immediate take-off: A clearance for immediate take-off may be issued to an aircraft before it enters the runway. On acceptance of such clearance the aircraft shall taxi out to the runway and take off in one continuous movement.
6. See the section titled Entering runway 34.
7. Above mean sea level (AMSL): the elevation (on the ground) or altitude (in the air) of an object, relative to the average sea level datum. Unless stated otherwise, all heights referenced in this report are AMSL.
8. Go-around: a standard manoeuvre in which flight crew discontinue the approach, increase power and reconfigure the aircraft to climb. See also the section titled Missed approach and go-around.
9. See the section titled Runway separation standard.
10. See the section titled Controller best judgement and duty of care.
11. See the section titled Advanced Surface Movement Guidance Control System.
12. Minimum vector altitude (MVA): the lowest altitude a controller may assign to a pilot in accordance with a radar terrain clearance chart that has resulted from a survey of obstacles in the area.
13. See the section titled Wake turbulence separation standard.
14. See the section titled Traffic information.
15. Visual separation standard: A means of spacing aircraft using visual observation by a tower controller, or by a pilot when the pilot is assigned separation responsibility.
16. See the section titled Vision at night.

Personnel information

The Melbourne Tower (Tower) was staffed by four Airservices air traffic controllers, the:

• trainee Melbourne Aerodrome Controller (trainee tower controller)
• Melbourne Aerodrome Control on-the-job training instructor (tower OJTI)
• Melbourne Coordinator (coordinator)
• a controller performing the combined duties of the Melbourne Surface Movement Controller and the Melbourne Airways Clearance Delivery Controller.

With the exception of the trainee tower controller, each controller was correctly endorsed and no fatigue‑related issues were identified. The tower OJTI and the coordinator were also endorsed in all Tower control positions.

The trainee tower controller was on her fourth under-training shift and had not used or observed land and hold short operations (LAHSO) before. Though she had 11 years’ experience working in busy control towers overseas, the trainee tower controller held no endorsements at Melbourne Airport.

All controllers had completed the Tower-specific compromised separation recovery training.^[17]

The flight crew from the three involved aircraft were correctly licenced and fit for duty.

Entering runway 34

A senior Tower controller reported that, during the day, most aircraft line up on runway 34 by following the runway 16 taxi-off markings (in yellow on Figure 4), entering the runway via a curve. Some aircraft also follow this path at night, but some follow the taxiway lighting onto runway 34, resulting in a 90˚ turn to line up in the departure direction (in orange on Figure 4).

Figure 4: Threshold of runway 34 at Melbourne Airport, showing the curved line-up track in yellow, and the track in orange that follows the taxiway lighting

Source: Google Maps, modified by the ATSB

The trainee tower controller and the tower OJTI both reported that, when issued with a clearance for an immediate take-off, they had expected the Boeing 777‑31HER (B777) to line up via the curved entry to runway 34. The controllers believed that by entering runway 34 via a 90˚ turn, the B777’s take-off was delayed.

‘Cleared for an immediate take-off’, is an internationally used phrase that requires the flight crew to taxi onto the runway and take off in one continuous movement. It does not specify the runway entry technique.

The B777 flight crew later reported that they did taxi out and take off in one continuous movement and recorded data supports this. Further, the operator advised that, as performance calculations required the full length of the runway, the 90-degree line up manoeuvre was required.

Missed approach and go-around

When, for any reason, flight crew judge that an approach cannot be continued to a successful landing, a missed approach or go-around is flown. For this reason, a clearance to land authorises the flight crew to go-around or carry out a missed approach. An approach may be discontinued for a number of reasons including:

• The required visual references have not been established by the decision altitude/height or minimum descent altitude/height or is acquired but is subsequently lost.
• The approach is, or has become, unstable.
• The aircraft is not positioned so as to allow a controlled touchdown within the designated runway touchdown zone with a consequent risk of aircraft damage with or without a runway excursion if the attempt is continued.
• The runway is obstructed.
• Landing clearance has not been received or is issued and later cancelled.
• A go-around is being flown for training purposes.

A missed approach procedure is designed for each instrument approach to provide terrain and obstacle protection. When flight crew conduct a missed approach from a visual approach, they must initially remain on runway track and remain visual until re-cleared by the controller. As the flight crew must reconfigure the aircraft during the missed approach, workload can be high.

Land and hold short operations

To improve airport capacity and air traffic system efficiency, LAHSO involves aircraft landing and holding short of an intersecting runway (see Figure 1 for the runway configuration at Melbourne Airport) while another aircraft takes off or lands on an intersecting runway. At Melbourne Airport, the landing rate during LAHSO is about 44 aircraft per hour, and about 24 when LAHSO is not in use. Also used in Canada and the US, in Australia LAHSO is only available to operators who have received authorisation from the Civil Aviation Safety Authority to participate in the procedure. During LAHSO, the aircraft issued a hold short requirement is classified as the ‘active participant’, and the aircraft which has unrestricted use of the full length of the crossing runway is classified as the ‘passive participant’. Under LAHSO, simultaneous take-off and landing is permitted only during the day, but simultaneous landings are permitted day and night. In Australia, with the exception of one operator, foreign-operated aircraft are not permitted to participate in LAHSO.

LAHSO has been used in Australia for over 20 years and, at the time of the occurrence, was used at Adelaide, Darwin and Melbourne airports. The procedure is used by day only at Darwin Airport^[18] as the crossing runway, runway 18/36, is not lit at night. Following an Airservices review of this occurrence, LAHSO is no longer used at night at Adelaide Airport. At Melbourne Airport, on the day of the occurrence, end of civil twilight was 1743, about half an hour prior to the occurrence.

LAHSO was only conducted when certain cloud base and visibility conditions existed – the cloud base, or ceiling, must not be less than the minimum vector altitude (MVA) within 8 NM (15 km) of the Airport and the visibility not less than 8 km. With an elevation of 434 ft and the highest MVA within 8 NM (15 km) being 2,400 ft, the minimum cloud base for LAHSO at Melbourne Airport was 2,000 ft above ground level. Documentation also required that the Automatic Terminal Information Service broadcast include advice that LAHSO was in progress and stipulate which runway was in use for both arriving and departing aircraft, and which was for arriving aircraft only. All of these requirements were met on the night of this occurrence.

On occasions, an aircraft may require the ‘landing only’ runway for departure, referred to as an off‑mode departure. Managing arriving and departing aircraft operating under LAHSO is made more complex when an off-mode departure is required.

To ensure LAHSO participants are aware of the other aircraft, specific phraseology is stipulated. When landing is approved for an active participant during LAHSO, the following phraseology is used:

• Controller: ‘(callsign) (other aircraft type) departing (or landing) on crossing runway, hold short runway (number) cleared to land runway (number)’
• Flight crew: ‘hold short runway (number) cleared to land runway (number) (callsign)’

The phraseology used for the passive participant is:

• Controller: ‘(callsign) (other aircraft type) landing on crossing runway will hold short cleared to land (or to take-off) runway (number)’
• Flight crew: ‘cleared to land (or take-off) runway (number) (callsign)’

Additionally, during LAHSO, the tower controller is responsible for maintaining visual separation in the event of a missed approach or a dual missed approach. This is until such time as another separation standard can be applied, either 3 NM (6 km) or 1,000 ft.

Runway separation standard

For the aircraft involved in this occurrence, separation standards require that the aircraft landing behind a departing aircraft cannot cross the runway threshold until the preceding aircraft is airborne and:

• has either commenced a turn, or
• is beyond the point on the runway at which a landing aircraft could be expected to complete its landing roll and there is sufficient distance to enable the landing aircraft to manoeuvre safely in the event of a missed approach.

Wake turbulence separation standard

In addition to providing runway separation, wake turbulence^[19] standards must also be applied for aircraft departing or going around behind another aircraft. Separation is either time- or distance-based, and is determined by the wake turbulence categories of the aircraft involved. The maximum take-off weight of the B777 place the aircraft in the heavy aircraft category, and the B737‑838 in the medium category. The time-based standard between the aircraft was 2 minutes, and the applicable distance standard is 5 NM (9 km). As Melbourne is a radar tower environment, only the distance standard was applicable.

A wake turbulence standard is not required between an aircraft landing behind an aircraft taking off on the same runway. If the landing aircraft, however, conducts a missed approach behind one departing, the aircraft in the missed approach is considered a departing aircraft. As the trainee tower controller did on this occasion, the controller should issue a wake turbulence caution to the flight crew of a following aircraft when less than the applicable wake turbulence standard exists.

Traffic information

Traffic information is issued by an air traffic controller to alert flight crew to other known or observed traffic. This traffic may be in proximity to the position or intended route of the aircraft, and the issued traffic information helps the flight crew avoid a collision. Traffic information should be provided when, in the controller’s judgement, one aircraft may observe another aircraft and could be uncertain of their intention.

Traffic information should be concise and, to assist flight crew in identifying other aircraft, may include the following information if deemed relevant by the controller:

• aircraft identification
• type and description, if unusual
• position information
• direction of flight or route of the aircraft
• level
• intentions of the pilot.

The provision of traffic information, and the content of that information, is reliant on the controller’s assessment of the underlying need.

Compromised separation recovery training

Compromised separation recovery actions are important emergency response actions. They need to be implemented by controllers promptly and accurately when determined that separation standards have been, or will shortly be, compromised. To ensure emergency response actions are conducted effectively, they need to be regularly practiced. Skill decay is more likely to occur when tasks are rarely performed (Arthur et al., 1998), as is the case for compromised separation recovery actions during actual controlling.

Controllers are required to issue safety alerts to pilots of aircraft as a priority when the controller becomes aware that aircraft are considered to be in unsafe proximity. This is the case unless a pilot advises that action is being taken to resolve the situation, or that the other aircraft is in sight. No safety alerts were issued by the trainee tower controller during this occurrence.

An ATSB investigation into a loss of separation assurance near Tindal, Northern Territory in 2014 found that Airservices had not provided controllers with effective simulator-based compromised separation recovery training. This report, ATSB investigation AO-2014-074 – Loss of separation assurance involving A 330 9V‑STQ and A320 VH‑VFH near Tindal, Northern Territory on 24 April 2014, available on the ATSB website, was not released until May 2016, after the occurrence under investigation here.

Vision at night

The tower controller can provide heading information to flight crew to establish and/or ensure separation in the event of a missed approach and, if the aircraft is below the MVA, by day the controller can transfer the responsibility for terrain clearance to the flight crew. As the human visual perceptual system, however, is physiologically limited in perceiving within a night-time environment (Gibb et al., 2010), the responsibility for terrain clearance when an aircraft is being radar vectored at night must remain with the controller.

Another issue discussed by Gibb et al. relates to flight crew susceptibility to glare from bright city lights during approach and landing at night. A review of US investigation reports into accidents and incidents from 1978 to 2005 found 58 documented vision-related accidents and incidents, with 93 per cent occurring during the approach and landing phase.

Additionally, because of the absence of any size cues at night (i.e. at night the apparent size of an object is related to its brightness rather than its image size) the judgement of distance is extremely difficult (Isaac and Ruitenberg, 1999). In providing visual separation, controllers should rely primarily on azimuth; for example, one aircraft to the northwest and another to the northeast. To ensure that aircraft are not in close proximity, caution should be exercised when using a judgement of relative distance or height for visual separation.

Though flight crew can sight and monitor another aircraft at night, the physiological limitations limit their ability to visually separate. These same physiological limitations hinder a controller’s ability to monitor aircraft at night visually, both when attempting to separate visually and in determining if an aircraft is on the runway or airborne.

Controller best judgement and duty of care

The Civil Aviation Safety Regulations Part 172 contains the standards for the provision of air traffic services. The regulations include advice that:

…the provider may deviate from the standards if an emergency, or other circumstance, arises that makes the deviation necessary in the interests of aviation safety.

The Manual of Air Traffic Services^[20] includes:

Best Judgement. Do not allow anything in these instructions to preclude you from exercising your best judgement and initiative when:

a. The safety of an aircraft may be considered to be in doubt: or

b. A situation is not covered specifically by these instructions.

The Airservices National Air Traffic Service Procedure Manual^[21] includes:

Duty of care. Upon becoming aware of information such that it would be reasonable to conclude that an unsafe situation has, or may occur, it would be expected that all necessary action is taken to remove that risk.

Note: The extent of the action required will be driven by professional judgement given the particular circumstances and would include an assessment of the likelihood of the event occurring and the potential severity of the outcome.

Further, the National Air Traffic Service Procedure Manual includes:

Reasonable assurance. A controller’s professional judgement that they have ‘reasonable assurance’ of achieving a particular separation standard requires them to be certain that:

a. The disposition and relative performance of all aircraft, vehicle or persons concerned are such that at all times and under normal operation the separation between them will not be less than that mandated;

b. If the anticipation of an aircraft, vehicle or person operating in the expected way is essential to achieving separation then that aircraft, vehicle or person is provided with sufficient information to make them aware of the dependency; and

Any equipment, the continued operation of which is necessary to assure separation, is operating within normal parameters and there is no reason to expect that the serviceability or performance will change.

On-the-job instruction

Air traffic control training comprises theoretical, simulator and on-the-job components. On-the-job instruction is conducted in the workplace by specially trained instructors. The trainee may move through control positions in a hierarchical manner – for example Surface Movement Control then Aerodrome Control (tower), although the trainee involved in this occurrence had started as a tower trainee.

Airservices stated that the overriding principle for an OJTI is that safety must never be compromised. The training for OJTI also included information about the types of errors to be expected:

• Those that must be prevented as they would compromise safety
• Those that must be corrected immediately
• Those where correction can be delayed as the trainee could learn from the outcome
• Those that result from a lack of experience where correction is not necessary.

Intervention strategies for an OJTI range from questioning the trainee, to suggesting an alternate course of action, to directing the trainee, and finally to intervening by taking over or overriding the trainee. Intervention is the last resort and only used to ensure safety.

While conducting training, overall responsibility for the provision of a safe and efficient air traffic service resides with the OJTI, as the trainee is either not licenced or not endorsed. During the training period, the trainee will be given more and more responsibility for the control and separation of aircraft, but the OJTI must monitor the trainee’s performance and ensure that any errors or omissions that may impact safety can be corrected in a timely manner. To facilitate this, the communication system provides a facility to enable the OJTI to override the trainee’s transmissions.

Advanced Surface Movement Guidance Control System

The Melbourne Tower is fitted with an integrated tower automation suite that presents information to controllers by way of a number of computer screens. Different integrated tower automation suite installations exist to incorporate the differing automation available in control towers across Australia. The Melbourne Airport integrated tower automation suite incorporates an Advanced Surface Movement Guidance Control System – a system that provides the controller with surveillance data for vehicles and aircraft on the ground, and airborne aircraft in the immediate vicinity of the Airport. The Advanced Surface Movement Guidance Control System generates aural alerts based on two logics:

• Time to threshold for an arrival on a single runway if the Advanced Surface Movement Guidance Control System detects a vehicle or aircraft (targets) on that runway:
  • Caution: 15 seconds from that runway’s threshold
  • Warning: 10 seconds from that runway’s threshold.
• Target to target where a collision risk exists between two targets.

In addition to the aural caution and warning, the controller also received a visual representation of the caution and warning alerts.

On receipt of an Advanced Surface Movement Guidance Control System caution or warning, the controller is required to scan the aerodrome traffic immediately to assess the integrity of the alert. If required, the controller should then issue traffic advice, control instructions and/or a safety alert. Though the controller did not issue any traffic or safety alerts, she had already instructed the B737 on final for runway 34 to go around prior to the activation of the caution and the warning.

Airborne collision avoidance system limitations

Regular public transport aircraft are fitted with airborne collision avoidance systems (ACAS) that, independently of any ground-based air traffic control system, provide collision avoidance protection by advising flight crew of traffic in their immediate area. Traffic advisories (TAs) provide a visual representation of the proximate traffic to assist flight crew to sight that aircraft. Resolution advisories (RAs) provide recommended vertical escape manoeuvres (either climb or descend) to either increase or maintain existing vertical separation between aircraft. When the two aircraft involved are capable of RAs, ACAS uses data from both aircraft to determine the best solution and issues coordinated and complimentary RAs to the flight crew – one to climb and the other to descend. Consequently, flight crew are taught to respond to an RA regardless of any instruction from a controller.

The collision system logic is complex and is based on sensitivity levels, time intervals to the closest point of approach and the size of the protected volume around the aircraft. Critically, the sensitivity level is based on the altitude of the aircraft and, below 1,000 ft above ground level, RAs are inhibited and TAs are only issued when the proximate aircraft is within 20 seconds to the closest point of approach. In this occurrence, with Melbourne Airport at 434 ft, RAs would not have been issued when the aircraft were below 1,434 ft, i.e. during the time of their closest proximity.

ACAS is considered the last line of defence against a mid-air collision and should not be relied on as a separation method.

Terrain awareness and warning systems

Regular public transport aircraft are also fitted with terrain awareness and warning systems (TAWS). This system relates aircraft position, which should be from a GPS source which can be internal to the equipment or fed from the aircraft flight management system, to an almost worldwide terrain/obstacle/airport database which the equipment manufacturer regularly updates. A comprehensive set of reliable cautions and warnings can be generated which use both the radio altimeter and relative position. TAWS provides a forward looking terrain avoidance function that looks ahead of the aircraft along and below its lateral and vertical flight path and provides suitable alerts if a potential controlled flight into terrain threat exists.

Like the ACAS, a TAWS is considered the last line of defence against controlled flight into terrain and should not be relied on as a separation method.

Previous occurrences

In October 2011, at Melbourne Airport, at night and during LAHSO, an aircraft on final to land on runway 34 conducted a missed approach while another aircraft was landing on runway 27. As the aircraft in the missed approach was below the MVA, the controller was unable to issue a radar vector to ensure separation. The occurrence was reported but ATSB did not investigate.

__________

17. See the section titled Compromised separation recovery training.
18. Air traffic services at Darwin Airport are provided by the Department of Defence.
19. Wake turbulence: turbulence from wing tip vortices that result from the creation of lift. Those from large, heavy aircraft are very powerful and persistent, and are capable of causing control difficulties for smaller aircraft either following or below.
20. Manual of Air Traffic Services (MATS): MATS is a joint document of the Department of Defence (Defence) and Airservices Australia (Airservices) and is based on the rules published in the Civil Aviation Safety Authority Civil Aviation Safety Regulations Part 172 – Manual of Standards (MOS) and the International Civil Aviation Organization (ICAO) standards and recommended practices, combined with rules specified by Defence and Airservices. The requirements and obligations details in MATS are in accordance with provisions and regulations of the Air Navigation Act 1920, Air Services Act 1995, and Defence Instructions.
21. National Air Traffic Service (ATS) Procedure Manual (NAPM): NAPM details the procedures used by Airservices Australia to standardise service delivery when using ATS system tools and must be applied to all ATS units.

At night on 5 July 2015, three aircraft came into unsafe proximity during take-off and landing at Melbourne Airport, Victoria. Shortly afterwards, one aircraft was radar vectored in a missed approach while below the minimum vector altitude (MVA). This analysis discusses the relevant controller actions and the organisational issues identified during the investigation.

Use of runway 34 for off-mode departures

Sequencing for arriving aircraft at Melbourne Airport has been computerised to ensure consistency and efficiency. The sequencing tool, MAESTRO, is used by Airservices at a number of airports and uses the actual position and speed information from their surveillance system to determine each aircraft’s landing runway and position in the sequence. This information is displayed to the controllers to enable them to use speed control, vectoring or holding to achieve an orderly traffic flow.

When land and hold short operations (LAHSO) are in place for runways 27 and 34, both runways are available for arriving aircraft, but only runway 27 is available for departing aircraft. Some larger aircraft, however, require runway 34 for departure due to its greater length. Additionally, runway 34 can be more attractive to departing aircraft due to a shorter taxi distance, or the runway being better aligned to their departure direction.

MAESTRO builds a gap into the runway 27 arrival sequence to allow for departing aircraft. Aircraft departing from runway 34 are considered off-mode during LAHSO, and a controller must fit departures into the arrival sequence based on their best judgement. For the aircraft involved in this occurrence, runway separation requires that a landing aircraft cannot touch down until the preceding departing aircraft, using the same runway, is airborne.

On the night of this occurrence, in the gap between arrivals sequenced to runway 34, one off‑mode departure had already used runway 34 prior to the B777 being lined up. Though the flight crew of the B777 had received the current Automatic Terminal Information Service^[22] stating that LAHSO were in use, being an international operator, the flight crew may not have been aware that both runways at Melbourne Airport were being used for simultaneous arrivals and they were not told about the B737s on final for both runways.

In a statement, the captain of the aircraft on final for runway 27, VH‑VXS (VXS), reported he had heard the instruction to the B777 for an immediate departure. After observing the preceding aircraft depart from runway 34, he believed that his aircraft would be in close proximity to the B777 when they landed, so he had asked the first officer to prepare for a missed approach. Shortly after, and having determined that there was insufficient spacing with the B777, the captain instructed the first officer to initiate a missed approach as the B737 was approaching 500 ft above ground level.

The coordinator became concerned about the sequence when he realised that the flight crew of the B777 had not been advised of the B737 (VXS) going around from final runway 27. Due to the limitations of human vision at night, judgement of distance is extremely difficult, and the coordinator was concerned that the B777 flight crew may have elected to initiate a rejected take-off if they perceived the B737 as a possible threat. If the B777 had rejected the take-off and remained on the runway, there may have been insufficient runway behind that aircraft for the landing roll of the B737 on final for runway 34, VH‑VYE (VYE). Additionally, the coordinator was concerned that there was a high probability that the runway separation standard would not be achieved between the B777 and VYE.

The coordinator communicated his concerns to the trainee tower controller and the tower OJTI. On receiving what he deemed an unsatisfactory response, and believing the situation to be safety‑ and time‑critical, the coordinator instructed the trainee tower controller to send VYE around. The trainee tower controller and the tower OJTI later reported that, as the B777 commenced the take-off roll, they also had concerns about the sequence and the potential for a loss of separation between the two aircraft using runway 34. However, immediately prior to that they both thought that the sequence, while ‘tight’, would work. In that context, if separation relies on an expected rate of aircraft ground movement that may not occur, it is prudent to have an alternative plan. This is more important if the involved aircraft is large and/or operated by international flight crew who may be less familiar with the airport. However, on this occasion the actions of the B777 flight crew were appropriate.

Given the specific LAHSO phraseology required to be used by the Tower controller, and the necessity for a read back by the flight crew of VYE of the restriction to hold short, there may have been insufficient time available for the trainee tower controller to clear both arriving aircraft to land. The trainee tower controller, on her first exposure to LAHSO, had about 29 seconds to:

• issue a landing clearance to the flight crew of VYE, including the restriction to hold short of runway 27
• receive a correct read back of the restriction from the flight crew
• issue a landing clearance to the flight crew of VXS, including advice that VYE was landing on runway 34 but would hold short of runway 27.

Had the line-up and take-off clearance for the B777 been delayed, the two B737s would have landed under LAHSO and the B777 could have then departed without any time pressure. Alternatively, the provision of traffic information on the two B737s to the flight crew of the B777 would have made them aware of the traffic situation and provided the option of expediting their departure or remaining clear of the runway.

Unsafe proximity

Two aircraft arriving simultaneously for different runways during LAHSO are separated by the requirement that one aircraft lands and stops prior to the intersection of the runways. When one or both aircraft however, conduct a missed approach, another separation standard is required. The only available standard was visual. As both aircraft were tracking towards the runway intersection, the controller could not be assured that visual separation would be maintained as the judgement of distance at night is limited by the physiology of the human eye.

Airservices surveillance data showed that separation between the two B737s reduced to about 0.9 NM (2 km) and 900 ft as VXS crossed runway 34 in front of VYE, as VXS climbed in the missed approach on runway 27. At that time, VYE was also climbing, conducting a go-around from runway 34. The tower controller was responsible for maintaining visual separation; however, due to the limitations of its application at night, a surveillance (radar) separation standard of 3 NM (6 km) or 1,000 ft was arguably more appropriate.

As a clearance to land is also a clearance to conduct a missed approach, controllers should have a plan for such an eventuality and act on that plan in a timely manner.

The action of the coordinator in instructing the trainer tower controller to send VYE around changed what was a potential loss of runway separation into a loss of separation between airborne aircraft.

Radar vectors

Though VYE, while going around on runway 34, did not fly through the flight path of the B777 as it executed the go-around, it was 1.5 NM (3 km) behind the B777 instead of the required wake turbulence standard of 5 NM (9 km). The radar vector and caution were issued by the trainee tower controller to expedite the re-establishment of a standard. Additionally, the radar vector increased the divergence between the flight paths of the two B737s when VXS was 0.9 NM (2 km) ahead of VYE and 900 ft above, passing from the right to left.

When an aircraft is vectored by a controller, the responsibility for navigation and terrain clearance is transferred from the flight crew to the controller. A MVA is calculated to ensure terrain clearance at the stated minimum levels and vectoring below the MVA would only be conducted in an emergency situation. At the time of the occurrence, the coordinator believed that the situation was both time- and safety-critical, and he deemed that issuing a radar vector below MVA was the only course of action available, and that action had earlier been sanctioned by his manager.^[23] As such, he told the trainee controller to issue the radar vector to the flight crew of VYE.

Hazard assessment and mitigation strategies

Following correspondence from the Civil Aviation Safety Authority (CASA) prior to October 2011 about concerns in relation to separating aircraft below the appropriate lowest safe altitude at night during two-runway operations at Brisbane Airport, Airservices had suspended that type of operation at Brisbane. As stated earlier,^[24] in 2011 one of a LAHSO arrival pair at Melbourne Airport conducted a go-around at night and the controller was unable to radar vector to ensure separation. The day after the 2011 occurrence at Melbourne Airport, CASA again wrote to Airservices requesting an explanation as to:

… what safety precautions are in place to ensure the safety of aircraft participating in LAHSO at night and why this procedure should not be suspended at night until the safety study … is completed.

In a letter to Airservices a week later, CASA stated:

… the (air traffic management) system should not rely, as a primary means of defence, on vectoring or heading changes for (instrument flight rules) category aircraft at night that are below the appropriate minimum altitude.

The safety study referenced in CASA’s initial letter was published by Airservices in October 2012 and included two relevant hazards:

• Hazard 901/1 – a go-around at night causing a loss of the ability of controllers to provide separation.
• Hazard 901/10 – two aircraft perform a go-around.

At the time of the safety study’s publication, two controls had been put in place to address Hazard 901/1:

• cloud ceiling increased to the MVA
• the visibility standard increased to 8 km (4 NM).

Only the first of the following controls identified for Hazard 901/10, however, had been met:

• Only conduct LAHSO at aerodromes and at times when a reasonable benefit is being realised and these times or conditions to be identified in (local instructions).
• Formalise sequencing intervals or cut off distances to reduce likelihood of go-arounds during LAHSO caused by an occupied runway.
• Implement procedures to reduce pilot initiated go-arounds due to unstable approach for which there is (a controller) attribution.

CASA continued to express concern in relation to aircraft separation following a go-around at night, early in 2013 providing a discussion paper again articulating concerns about the safety of aircraft below MVA and providing options, including the instigation of a stagger between LAHSO arrival pairs. In April 2013, Melbourne Tower controllers also expressed concerns and were advised by management that radar vectoring below MVA at night was acceptable as a last resort.

In January 2015, following a CASA audit of LAHSO at Melbourne Airport, they made the following observation:

To reduce the risk of aircraft in close proximity, CASA requests that Airservices review the procedures to achieve separation assurance following a double go-around, especially the ability of the tower controller to provide visual separation in certain meteorological conditions.

Airservices ‘noted’ the finding and determined that the issue was being considered in an extant review of LAHSO at Melbourne Airport.

Airservices suspended night LAHSO at Melbourne Airport in November 2015, 4 months after this occurrence. An Airservices survey of obstacles later confirmed that limited radar vectors below MVA did not pose a hazard to aircraft at night, and, in April 2016, CASA issued an exemption to Airservices to radar vector below MVA at night at Melbourne Airport as long as a number of conditions were met. The CASA exemption is limited to aircraft involved in LAHSO. That day, night LAHSO was reintroduced at Melbourne Airport. Another control instigated by Airservices in early 2016, though recommended by CASA in early 2013, was a stagger for arriving LAHSO pairs:

to reduce the risk of two aircraft being in ‘unsafe proximity’ (i.e. passing the runway intersection within 20 seconds of each other) in the case of a double go-around.

Though Airservices was aware of the hazard from at least October 2011, as noted by CASA, in early 2013 the only controls put in place or proposed were preventative in nature i.e. designed to reduce the risk of an aircraft conducting a missed approach at night during LAHSO at Melbourne Airport. Not until 2016 did Airservices put in place a recovery control^[25] – a surveyed area where aircraft could be radar vectored when below MVA at night. Had Airservices pursued a recovery control after the 2011 occurrence, the radar vector issued by the trainee tower controller would have been in accordance with documented procedure and training, and would not have resulted in a breakdown of separation with terrain.

Compromised separation recovery training

At the time of this occurrence, the compromised separation recovery training for Melbourne Tower controllers was conducted in a simulator, using various scenarios relevant to Melbourne Airport.

Though one training scenario involved aircraft conducting missed approaches from both runways under LAHSO, the scenario was during daylight hours. As LAHSO is only conducted in visual meteorological conditions, during the day the controller can assign the responsibility for terrain clearance to the flight crew when radar vectors were issued below the MVA.

At night when radar vectoring, the controller must retain the responsibility for terrain clearance. No LAHSO-related simulator training scenarios were at night, though night-time scenarios have now been added.

__________

22. Automated Terminal Information Service (ATIS): The provision of current, routine information to arriving and departing aircraft by means of continuous and repetitive broadcasts during the hours when the unit responsible for the service is in operation.
23. See the section titled Hazard assessment and mitigation strategies.
24. See the section titled Previous occurrences.
25. Recovery control: designed to recover a critical situation to a safe outcome.

From the evidence available, the following findings are made with respect to the unsafe proximity and radar vector while below the minimum vector altitude involving a Boeing 777‑31HER, registered A6-EBU, and two Boeing 737‑838s, registered VH‑VXS and VH‑VYE, at Melbourne Airport on 5 July 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The decision to clear the flight crew of A6‑EBU for an immediate take-off, combined with the aircraft’s slower than anticipated rate of movement, resulted in it coming into proximity with VH‑VXS and VH‑VYE.
• The proximity between A6‑EBU, VH‑VXS and VH‑VYE resulted in the flight crew of VH-VXS on final for runway 27 electing to go around and the flight crew of VH-VYE on final for runway 34 being instructed to go around on the direction of the Melbourne Coordinator.
• Although initiated due to a safety concern, the decision by the Melbourne Coordinator to instruct the crew of VH‑VYE to go around resulted in an airborne loss of separation compared to a potential loss of separation on the ground.
• The simultaneous go-arounds conducted by VH-VYE and VH-VXS, sequenced to land on intersecting runways under land and hold short operations at Melbourne Airport, resulted in the controller issuing a radar vector to the flight crew of VH-VYE while the aircraft was below minimum vector altitude to assure surveillance and wake turbulence separation.
• The radar vector issued at night to the flight crew of VH-VYE when no other options were available, though intended to ensure wake turbulence and surveillance separation behind A6‑EBU and separation assurance with VH-VXS, did not assure terrain and obstacle clearance.
• The hazard associated with the inability to separate aircraft that are below the appropriate lowest safe altitude at night was identified but not adequately mitigated. This resulted in a situation where, in the event of a simultaneous go-around at night during land and hold short operations at Melbourne Airport, there was no safe option available for air traffic controllers to establish a separation standard when aircraft were below minimum vector altitude. [Safety issue]

Other factors that increased risk

• The lack of night-time compromised separation training scenarios for the Melbourne Air Traffic Control Tower controllers increased the risk of the controllers responding inappropriately when aircraft were in proximity at night.
• The automated sequencing system used by Airservices Australia at Melbourne Airport (MAESTRO) did not ensure that two aircraft would not arrive at the intersection of the runways at the same time during land and hold short operations, increasing the risk of unsafe proximity at the intersection.

Sources of information

The sources of information during the investigation included:

• Airservices Australia
• the Civil Aviation Safety Authority
• the airlines involved
• flight crew from VH‑VXS, VH‑VYE and A6‑EBU
• the air traffic controllers involved.

References

Arthur, W., Bennett, W., Stanush, P.L. & McNelly, T.L., 1998, ‘Factors that influence skill decay and retention: A quantitative review and analysis,’ Human Performance, vol. 11, pp. 57-101.

Gibb, R., Gray, R. & Scharff, L., 2010, Aviation visual perception, Ashgate, Surrey, England.

Isaac, A. R. with Ruitenberg, B., 1999, Air traffic control: human performance factors, Ashgate, Aldershot, England.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

Submissions were received from Airservices Australia, the Civil Aviation Safety Authority, the airlines involved, the flight crew from VH‑VXS and VH‑VYE, the Dubai Civil Aviation Authority and the involved air traffic controllers. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Melbourne Aerodrome Control On-the-job Training Instructor details

Melbourne Tower Coordinator details

The safety issue identified during this investigation is listed in the Findings and Safety issue and actions sections of this report. The ATSB expects that the safety issue identified by the investigation should be addressed by the relevant organisation. In addressing this issue, the ATSB prefers to encourage the relevant organisation to initiate safety action proactively, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.

Hazard associated with the inability to separate aircraft below the appropriate lowest safe altitude at night

Safety Issue: AO-2015-084-SI-01

Safety issue description:

The hazard associated with the inability to separate aircraft that are below the appropriate lowest safe altitude at night was identified but not adequately mitigated. This resulted in a situation where, in the event of a simultaneous go-around at night during land and hold short operations at Melbourne Airport, there was no safe option available to air traffic controllers to establish a separation standard when aircraft were below minimum vector altitude.

Additional safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety actions by Airservices Australia in response to this occurrence:

• Training in night-time compromised separation recovery during LAHSO was completed by all Melbourne Tower controllers in March 2016.
• On 10 March 2016, an arrival stagger was introduced for LAHSO arrival pairs to ensure that, in the event of a missed approach, the aircraft would not be in unsafe proximity at the runway intersection.