FACTUAL INFORMATION History of the flight Both aircraft were operating scheduled passenger services and were en route from Brisbane to Cairns. JA8104 operating as JAL776, departed Brisbane at 2355 UTC on climb to FL290. VH-CZN departed two minutes later on climb to FL 310. At 0003, a departure message incorporating the secondary surveillance radar (SSR) code allocation message (CAM) was received by the Cairns aircraft data systems officer (ADSO). The message contained four blocks, each of four numerals representing the departure times and assigned SSR codes for JAL776 and VH-CZN. In preparing the flight strips for the two aircraft, the ADSO inadvertently transposed the codes and departure times, resulting in VH-CZN being planned into the Cairns radar data system against the JAL776 code and departure time, and vice versa. At 0055, abeam Townsville estimates of 0017 for JAL776 and 0020 for VH-CZN were passed to Cairns Arrivals. At 0118 both aircraft were handed off from Brisbane Control to Cairns Arrivals. The aircraft were handed off using the phraseology "south by two that is JAL776 and Charlie Zulu November". The handoff was accepted by the Cairns Arrivals controller even though the labels showed VH-CZN to be ahead of JAL776. Subsequent events and relevant times were: Time Event 0123 JAL776 contacted Cairns Arrivals and reported leaving FL259 on descent to FL210. 0123.18 VH-CZN contacted Arrivals and reported maintaining FL330. 0124.55 JAL776 reported approaching FL210 and was given further descent to 9,000 ft. 0125.25 Arrivals asked JAL776 to report their present level. (The reason for this was that the SSR mode-C altitude readout on the radar display showed the aircraft at FL330.) JAL776 reported passing FL210. 0125.45 Arrivals asked Brisbane to crosscheck the level of JAL776. Brisbane advised that JAL776 indicated FL204. 0126.26 Arrivals asked JAL 776 to report groundspeed. The crew advised 448 kts. (Coincidentally, the groundspeed of VH-CZN was also 448 kts at this time as that aircraft had slowed prior to commencing descent.) 0126.47 VH-CZN reported leaving FL330. 0127.00 VH-CZN was asked to verify level and reported FL317. At this time, the controller assumed that there was a fault with the radar display of the SSR mode-C information and called the radar technicians to investigate the problem. 0127.45 VH-CZN was again asked to verify level and reported FL290. 0127.55 VH-CZN was asked why they were so high as they were indicating some 50 NM from Cairns and were well above the normal descent profile. The crew advised that they were on a normal descent profile. 0128.19 JAL776 was again asked to report level and advised passing FL153. 0129 VH-CZN was handed off from Arrivals to Cairns Approach. The Approach controller was told by the Arrivals controller that the aircraft was high and that the SSR mode-C readout may be incorrect. The crew queried the transfer instruction but changed to Approach frequency. 0129.56 VH-CZN contacted Approach and was instructed to descend to 6,500 ft. The crew questioned why they had been transferred to Approach in excess of 60 NM from Cairns. Approach replied that the aircraft was 26 NM from Cairns. The crew then advised that they were 60 DME Cairns and abeam Innisfail. At this point, the Approach controller realised that the radar labels for JAL776 and VH-CZN were transposed. Both aircraft were then processed normally and landed without further incident. Investigation of the occurrence revealed the following: The ADSO had been suffering from a headache for two days prior to the incident. It was still present on the day of the incident but the ADSO felt obliged to attend work as, two days earlier, she had taken the day off because of the headache. In the ATS system in use at the time, aircraft SSR codes were entered manually by ADSOs on receipt of code allocation messages from adjoining ATS centres. There was no cross reference of aircraft levels and codes, either by the ADSO, or by any air traffic controller. Although code allocation messages usually referred to only one aircraft, it was not unusual for two aircraft to be included in one message. In this instance, the four-figure SSR codes as well as the departure times for both aircraft all began with the numerals 23, thus increasing the potential for error when the information was transferred. For a few months preceding the occurrence, there had been problems concerning the SSR mode-C display on Cairns radar. While these had involved correlation of departing aircraft, there were indications of a level of suspicion among the controllers regarding the reliability of the SSR mode-C display. During the radar handoff of the aircraft from Brisbane to Cairns Arrivals, there was no bearing and distance given for the aircraft, either with respect to a common position (such as Townsville) or to each other. This resulted in an opportunity for rectifying the mis-identification of the codes to being missed. Paras 6-9 of the Manual of Air Traffic Services (MATS) 9-5-2 address radar handoff. However, they refer to single aircraft handoffs only and do not address multiple aircraft handoffs. Although the abeam Townsville estimates indicated that JAL776 was ahead of VH-CZN, there were indications that these estimates could be unreliable. It was reported that the day before the incident, two aircraft were handed off by Brisbane with the second aircraft having the earlier estimate. This may have encouraged a climate whereby estimates were considered unreliable indicators of aircraft position. CONCLUSIONS Significant factors The following factors were considered relevant to the development of the incident. 1. The physiological condition of the ADSO may have reduced that persons task efficiency. 2. The code allocation message referred to two aircraft. 3. The ADSO transposed the SSR code information for both aircraft. 4. A check was not conducted to confirm that the correct SSR codes had been entered against each aircraft. 5. The radar handoff was such that positive aircraft identification was not assured. 6. MATS procedures did not cover multiple aircraft handoffs. 7. Previous problems with SSR mode-C readouts may have influenced the controllers to assume that the altitude labels for the aircraft were incorrect. SAFETY ACTION As a result of the investigation, the Bureau of Air Safety Investigation issued the following interim recommendation to the Civil Aviation Authority on 13 December 1994. The response to the interim recommendation from Airservices Australia is also reproduced in part. IR940300 The Bureau of Air Safety Investigation recommends that the Civil Aviation Authority: (i) review message format procedures to ensure that separate messages are used for departure and SSR code allocation information for each aircraft; (ii) review the radar hand-off methods to ensure that individual aircraft validation needs for each unit are appropriate to the equipment and procedures in use at that unit; and (iii) introduce a system of SSR code integrity checks between ATS centres and, where appropriate, between individual sectors within the same centre. Airservices Australia response Head Office and District Office (ATS) meetings were held to discuss the issues and implications of the Bureau's recommendations, and the following changes to procedures have been implemented. Message format has been amended so that double spacing appears between all aircraft departure and code allocation advice. The error rate has been greatly reduced and the problem of "dyslexic" interpolation of callsigns is no longer apparent. Hand off methods between units have been addressed by the issuance of an interim MATS amendment (IMA) 13A effective 18 August 1995. This new procedure was installed by local direction pending the effective publication date. MATS 9-5-2 Para 4.b Add new second sentence so that sub-para reads as follows: b. .... by specifying the location of the radar return by a bearing and distance from a known point or fix, together with the observed track or return. When aircraft are within 10 NM, or a distance as otherwise specified in Local Instructions, of one or more other aircraft, relative position information will also be passed to ensure correct relay of identification. The receiving controller may consider identification positive if only one return observed on the display agrees with the information specified..." MATS 9-5-2 Para 4.f After existing sub-sub-para f. (3) add new NOTE as follows: "NOTE: This technique shall not be applied across boundaries of non-linked RDP systems." Procedures have been introduced into the NDO to provide timely advice of code allocation and insertion into the RDP system, reducing the chances of errors being generated by this work being done at the ATC console. Hand-off procedures are now considered secure to pick up code based errors. Response classification: CLOSED-ACCEPTED