Boeing Co 737-476, VH-TJY

A Boeing 737 (B737) registered VH-TAW (TAW) was inbound to Ayers Rock from Sydney at flight level (FL) 320. A B737 registered VH-TJY (TJY) departed Ayers Rock for Sydney with a planned level of FL350. The Alice Springs sector controller calculated the estimated time of passing for the aircraft as 1328 Central Standard Time (CST). The controller entered FL310 into The Australian Advanced Air Traffic Control System (TAAATS) for TJY but unintentionally instructed the crew to "Climb to amended FL330". At 1321 CST, after the crew of TAW had reported on the sector frequency, the controller requested them to "Report sighting and passing TJY on climb to FL310". The crew of TAW responded that they would advise. The crew of TJY heard the controller's transmission and queried their assigned level of FL330. The controller advised that crew that they had been assigned FL310. The crew of TJY, having passed FL320, elected to continue the climb and at 1322 CST they reported maintaining FL330. The application of standard separation required the aircraft to be established 1,000 ft vertically apart ten minutes prior to the estimated time of passing. There was an infringement of separation standards.

Reduced vertical separation minimum (RVSM) procedures had been introduced across the Australian airspace on 1 November 2001. Those procedures reduced the previous 2,000 ft vertical separation standard for aircraft operating above FL290 to 1,000 ft for approved aircraft operating between FL290 and FL410. Both aircraft were RVSM approved and the controller had undergone RVSM training prior to the change in procedure.

The controller had seven years experience in air traffic control and was rated on the Alice Springs sector in June 2000. During the 12 months prior to the incident the controller had spent the majority of his time working on that sector. The controller was included on the team leader roster in September 2001.

The Ayers Rock sector position was located in the Melbourne Air Traffic Control centre. Team leaders worked a daily shift from 0830 to 1630 Eastern Summer Time (ESuT). The incident shift was the seventh day of the controller's shift period. After arriving at work the controller, as the team leader, was advised that a rostered controller was unavailable. He unsuccessfully sought approval to call in a replacement controller. The controller then self-briefed and from 0900 to 1030 ESuT operated one of the Group's control positions. The controller had a break during which he endeavoured to resolve the controller shortfall by roster adjustments before returning to another operating position at 1100 ESuT. The controller had scheduled a 1330 ESuT meeting for a project he was working on and organised his periods at the console to ensure that he was able to attend that meeting. He took a second break at 1230 ESuT before taking over the Alice Springs sector position at 1300 ESuT. He reported that he had lunch during one of the breaks when he left the operations room for about 10 minutes.

The controller reported that there was a medium level of air traffic. The Alice Springs sector was combined with the low-level Todd sector. That required the controller to operate on three radio frequencies. There were also several aircraft on frequency with similar callsigns, including aircraft registered: VH-TJY, VH-TJJ, VH-TAW and VH-TJD. Each of those aircraft required separation action or clearance adjustment. It was during that time that the controller made a communication error in that a crew was addressed by an incorrect callsign. That error was undetected but did not affect safety.

The crew of TJY had planned to operate at FL350 and the controller was aware that there was insufficient time to establish the required passing standard. He intended to maintain TJY at FL310 until it had passed TAW. The crew of TJY reported departure from Ayers Rock to the controller at 1311 and shortly after, were cleared to enter controlled airspace "On track to Oodnadatta, and planned route, on climb to amended FL330". The crew read back that clearance. The controller used the cleared flight level field in the aircraft's label on the air situation display to change the level to FL310. Analysis of the recorded system and audio data confirmed that the controller had entered, and accepted, FL310 in TAAATS and had transmitted FL330 to the crew.

It was likely that the controller was distracted by thoughts of the pending meeting. He may also have been fatigued to some degree as he had been occupied with either operational or administrative tasks since commencing work and had not had an adequate rest period.

It is possible that the controller did not appreciate the error, because the read back by the pilot phonologically matched the information stored in the controller's short-term memory. The controller had issued a clearance of FL330 to the crew and this was the same flight level that was read back.

The aviation system relied on the instruction and readback cycle used by pilots and controllers to prevent misunderstanding. The nature of interacting with TAAATS can make the controller response to the clearance read back an automatic process that provides no clue to input errors. While the read back process used two parties, a pilot and a controller, to challenge and check each other, the data input to TAAATS was reliant on controller self-checking. The occurrence highlighted the limitations inherent in using individuals to check their own work. Controllers need to be aware of the potential for error when checking TAAATS data inputs against clearance read backs.

The situational awareness of the crew of TJY, and their query regarding the assigned flight level, ensured that the situation was clarified and safety was maintained.

The investigation found a safety deficiency relating to the limitations of self-checking of data inputs by controllers. Any outcome from the investigation of the safety deficiency will be published on the Australian Transport Safety Bureau website www.atsb.gov.au.