FACTUAL INFORMATION At 1116 EST, VH-CZW, operating a scheduled passenger service, left Brisbane for Melbourne on climb to flight level (FL) 350. The aircraft was trailing another passenger jet, VH-TJR, by several minutes on the same route. Both aircraft were correctly processed from Brisbane Sector 2G to Brisbane Sector 2R. At 1131, shortly after crossing the Sector 2G/Sector 2R boundary at approximately 85 NM south of Brisbane, the secondary surveillance radar return from CZW faded from the interim radar display system when the crew inadvertently switched the secondary surveillance radar transponder to STANDBY as the aircraft passed FL311. The climb continued to FL350. The flight was no longer monitored by radar. Once the aircraft was beyond 30 nautical miles (NM), the interim radar display system was not capable of displaying primary radar returns as a means of observing the aircraft. The loss of the secondary surveillance radar return was not noticed by the controller on Sector 2R. Consequently, no radar hand-off took place when CZW approached the boundary between Sector 2R and Sector 13T. As a result, the aircraft was not transferred to the next radio frequency. In the absence of a radar hand-off between controllers or a frequency transfer, the Sector 13T controller did not recognise, from the flight progress strip information alone, that CZW was crossing his area of responsibility. As a result, no radar hand-off or frequency transfer took place between Brisbane Sector 13T and Melbourne Sector 16. The aircraft entered Sector 16 airspace without the controller's knowledge. A Melbourne Air Traffic Service Centre standard procedure covering transfer between sectors, relied on co-ordination to activate the aircraft's flight progress strip. At 1235, at the instigation of the Melbourne Sector 6 controller (the control position beyond Sector 16), efforts began to find CZW. The aircraft was identified on radar about 90 NM south-west of Parkes. CZW had been invisible to the interim radar display system for 60 minutes, and as a result had been without radar monitoring services and a search-and-rescue watch for that period of time. The planned level, FL350, could have been allocated to other traffic on, or crossing, the route. In addition, the aircraft had flown approximately 400 NM without the safety net provided by the traffic advisory and collision avoidance system which relies on an operating secondary surveillance radar transponder to render the aircraft visible to other aircraft equipped with the system. The flight crew The crew were unaware that they were involved in an incident. When interviewed, they could not remember how the transponder had been switched to STANDBY. However, the three-position toggle switch was unguarded and vulnerable to being touched inadvertently. The secondary surveillance radar transponder unit was located in the centre console, the area aft of which was often used to rest papers or place trays. On this route, aircraft were often left on the one frequency for extended periods, so the lack of a frequency transfer did not alert the crew of CZW. It was not until they had passed abeam Sydney that the captain became uneasy about the lack of a frequency transfer to Melbourne Control. A radio call to Brisbane Sector 2R asking whether they were required to remain on the frequency, resulted in their being transferred to Melbourne Control and being asked for their secondary surveillance radar transponder code. It was then that they noticed that their transponder was in STANDBY. Interim radar display system (EUROCAT 200 system) In the interim radar display system, the labels of correlated (controlled) tracks which are not under a controller's jurisdiction are displayed in blue. When these tracks are proposed for hand-off to another Sector, the individual track label flashes on the display of the controller to whom the hand-off has been proposed. If the proposed hand-off is accepted, the colour of the label changes to green and ceases to flash. The accepting controller now has operational jurisdiction of the track. When the system ceases to receive a response from the aircraft's transponder, the track enters a Coasting/Aging state. In the case of correlated tracks, this results in the track data on the radar display, and the border of its Active Flight Plan List (AFPL) window entry changing to a linen colour. Within 45 to 60 seconds all of the track data on the radar display disappears. The aircraft's electronic flight plan (now annotated with an "L" to indicate its Lost status) remains in the AFPL for a parameter time, which in this case was 5 minutes, before disappearing. A controller may not have the flight plan window open on his display and thus could miss the aircraft fading from his jurisdiction. There are no significant attention demanding cues or aural alarms associated with a lost track. Initially, during specific simulated exercises conducted in Brisbane, approximately 70% of experienced controllers had failed to detect fading transponder returns. Because of this result, the "failed transponder" scenario was inserted in training exercises. The detection rate of lost tracks increased markedly when controllers became aware of the system's limitations. Secondary surveillance radar transponder failure Anecdotal evidence indicates that secondary surveillance radar transponder failures and lost tracks in the Brisbane interim radar display system were a relatively common occurrence, up to five per week. Local corrective actions prescribed procedures such as reverting to flight progress strip counts versus the number of active tracks on the radar display and extending the history trails to the maximum setting. Flight progress strips Flight progress strips are an integral component of any radar system, including the interim radar display system. They provide search-and-rescue watch for aircraft under jurisdiction and serve as a basis for procedural backup in case the radar system fails. The radar controllers at Sectors 2R and 13T were no longer using the flight progress strips to maintain search-and-rescue action or to provide a cross-boundary check for outbound coordination. The Sector 13T controller was unable to recall why the flight progress strips were held at all. ANALYSIS Interim radar display system The Australian air traffic system, of which the interim radar display system is a part, is primarily dependent on secondary surveillance radar for the provision of radar control of aircraft outside primary control zones. When a transponder return is lost from the interim radar display system, the aircraft can disappear unless the controller is vigilant enough to notice the track fading. The display system is unfriendly to users in that the disappearance is subtle and silent. Monitoring is a task to which humans are ill-suited. Also, noticing the absence of previously displayed information is counter to the human psychological makeup as was evident from early simulator exercises where 70% of controllers failed to notice that a track had faded. Humans are far better suited to noticing new information, hence the use in critical systems of alerting devices such as warning bells/buzzers and coloured lights. The interim radar display system fails to provide these cues when a radar return fades. Flight progress strips One of the defences to guard against an aircraft return fading unnoticed from the interim radar display system is the monitoring and careful processing of the flight progress strip for each aircraft under control. The Procedural Controller at Sector 2R and the adjacent Sector13T, failed to process the flight progress strip for CZW. They were unaware that the strip also represented the basis of the aircraft's search-and-rescue watch. The Melbourne-based controller of Sector 16 relied on coordination from Sector 13T to activate the flight progress strip and accept the aircraft into his jurisdiction. This procedure was in accordance with procedures current in the Melbourne Air Traffic Service Centre. All three controllers lacked situational awareness considering that CZW and TJR had left Brisbane within minutes of each other and were flying the same route. The flight progress strips for both aircraft were almost identical. The Sector 6 controller was aware that two aircraft were supposed to be close together. He questioned the failure of CZW to appear with TJR, thus triggering a response to find the aircraft. At about the same time, a radio transmission from the crew of CZW caused confusion in the Brisbane Air Traffic Service Centre because a controller shift change had taken place and the flight progress strips had been filed. Consequently, no one had any historical knowledge of CZW and there was no visible record. The secondary surveillance radar transponder installation Two deficiencies were noted. The transponder control unit was located towards the rear of the centre console in the cockpit. The control switch was a simple toggle switch with three possible selections, from left to right - transponder 1, STANDBY (centre) and transponder 2. The switch was unguarded and open to an inadvertent knock. Also, the unit lacked any warning device that it was not operating. Very simple transponders used in general aviation have a green lamp which flashes when the unit is being interrogated by a ground-based secondary surveillance radar. Safety implications of flight without a transponder The lack of an operating secondary surveillance radar transponder triggered the fading and loss of the aircraft from the interim radar display system. It left the aircraft without an adequate search-and-rescue watch. The aircraft was flying at FL350, but as far as the system knew, this level was available to any other aircraft. A potential for a collision existed. An operating transponder was also an integral part of the traffic alert and collision avoidance system. Without it, other aircraft fitted with the system could not have been alerted to the aircraft's presence or taken collision-avoiding action. SIGNIFICANT FACTORS 1. The crew of CZW inadvertently switched the secondary surveillance radar transponder to STANDBY. 2. The transponder switch was unguarded and lacked an interrogation light. 3. The transponder return faded from the interim radar display system. 4. The Interim Radar Display System lacked adequate or significant warning devices to alert controllers that a transponder return had faded. 5. The loss of transponder return went unnoticed by the Sector 2R controller. 6. The Sector 2R Procedural controller did not process the flight progress strip for the aircraft correctly. 7. The Sector 13T controller did not become aware that the aircraft was due in his sector. 8. The Sector 13T controller did not process the flight progress strip for the aircraft. 9. The Sector 16 controller did not become aware that the aircraft was due in his sector. 10.The Sector 6 controller alerted the air traffic control system that the aircraft was missing. 11.The flight continued for 60 minutes without the air traffic control system noticing its absence. During this time the aircraft was without an adequate search-and-rescue watch and was flying at an unguarded flight level. SAFETY ACTION As a result of the investigation into this occurrence, the Bureau of Air Safety Investigation issued the following interim recommendations: IR 950230 issued 29 November 1995 "The Bureau of Air Safety Investigation recommends that: Airservices Australia modify current loss of secondary surveillance radar transponder return procedures to ensure that any loss of secondary surveillance radar transponder signal results in immediate attention-demanding visual cues and aural alarms at the relevant controller processing and displays areas within the national radar system. The modifications should incorporate requirements for the controller to acknowledge the aircraft status change". Airservices Australia responded on 27 January 1996. "This recommendation is subject to ongoing investigation, and a resolution is not expected by the response due date. Airservices notes that the recommendation would be equally applicable to AUSCATS as it is to IRDS. In the interim, a software modification to IRDS will be installed in early February. This modification will change the location of "LOST" flight plans to the top of the Active Flight Plan List (AFPL), as is the case in AUSCATS. "Airservices request an extension to IR950230 to mid February 1996, to enable a fuller response to the recommendation". Airservices subsequently responded again on 21 August 1996. "Re: Occurrence 9502038 generating Interim Recommendation: IR 950230 "Investigation of the subject Interim Recommendation as a viable contributor to preventing a re-occurrence of the incident on which the Recommendation was based has recently been completed. This investigation was conducted in parallel with the introduction of a series of measures designed to enhance controller recognition of the loss of transponder replies from aircraft under jurisdiction within the EUROCAT 200 system operations environment. "It is believed that these measures, which have involved software and operating procedure changes and the conduct of an incident-specific human factors review in the Brisbane Area Approach Control Centre, are satisfactorily achieving this enhancement. "Relevant software changes which have been implemented include: "a. Display of "Lost" flight plans at the top of page 1 of the controller's Active Flight Plan List (AFPL) window so that they will normally always be in view; "b. Increasing the lost time parameter (which determines how long the lost plan is displayed in the AFPL) from 5 minutes to 10 minutes; "c. The disabling of the history dot key on controller work station keyboards so that history dots are always selected (as history dot selection contributes to the time taken for a track to age out and therefore the time the Age symbol [visual cue associated with transponder loss] is displayed); and "d. Changing the range of history dots which can be selected to 5-9 in lieu of 1-9 (to help maximise the amount of time the Age symbol is displayed to the controller). "Investigation of the type of software change described in the Interim Recommendation determined that it was both impractical and operationally unacceptable. Several other software change proposals were identified by the relevant Airservices' system specialists in conjunction with affected operations staff, and Thomson Radar Australia (the system supplier). However, the estimated cost of trying to implement the preferred of these proposals was in the order of $250,000 to $260,000. "A decision has now been taken that no further system related changes be pursued in relation to this matter. This decision was made on the basis that: "a. Given the remaining operational life of the system, and the very low frequency with which such incidents are reported to occur, cost/safety benefit analysis would not support this level of expenditure; "b. Even if funding approval could be obtained, the enhancement could not be implemented before late 1996 / early 1997, thereby further reducing its cost/safety benefit; "c. Change proposals for all Airservices' systems are being critically examined for their potential to impact adversely on the introduction of The Australian Advanced Air Traffic Control System, which (in human resource terms) would be the case with the proposed enhancement; "d. "Lost" processing related changes (as described above) were successfully introduced in software Release 6.0 in February this year; "e. ATS Northern District has: "1. amended and/or reinforced relevant Brisbane enroute sector operating procedures and techniques; and "2. introduced transponder failures in simulation exercises. "f. The recommendations from an ATS Northern District Interim Radar Display System (EUROCAT 200) Human Factors Review (currently being finalised) are expected to provide further practical assistance in this matter, including in relation to the roles and responsibilities of existing Executive and Planner positions". Response status: CLOSED - ACCEPTED IR 950192 issued 15 September 1995 "The Bureau of Air Safety Investigation recommends that the Civil Aviation Safety Authority review the design suitability of aircraft transponder control panels fitted to aircraft which operate within Australian airspace. The review should consider mandating: "(i) selector switches which are designed to prevent unintentional deselection of a serviceable transponder, and "(ii) the fitting of a device to alert flight crew that a transponder has been selected to off or standby or has become unserviceable". The Airservices Australia response received 16 November 1995 stated: "Re: IR950192 "Airservices Australia supports this BASI recommendation. "We have experienced a number of transponder difficulties caused by inadvertent crew action. This recommendation simply and effectively addresses these problems". On 23 November 1995, the Civil Aviation Safety Authority indicated: "I refer to your interim recommendation number IR950192 concerning an incident involving Boeing 737, VH-CZW transponder error on 5 July 1995. "Summary "The Authority does not accept the recommendation in light of the costs and alternative measures available. "Background to response "The cost of implementing the recommended modifications on all Australian registered aircraft fitted with Air Traffic Control Transponders would be excessive. A less costly modification to the software of the secondary surveillance radar displays could ensure that the "Lost" aircraft transponder message is highlighted to the controller. Procedures could also be initiated whereby the controller must respond to the message. "This matter will be referred to Airservices Australia for information and comment". Response status: CLOSED - ACCEPTED BASI NOTE: As a result of this occurrence, the operator advised that all aircraft with similar switches were modified to prevent inadvertent deselection of a servicable transponder. IR 950210 Issued 27 November 1995 "The Bureau of Air Safety Investigation recommends that Airservices Australia, in conjunction with the Civil Aviation Safety Authority, publish consolidated documentation for flight crew use which indicates the primary and monopulse secondary surveillance radar coverage, enroute reporting requirements and the importance of ensuring continuous transponder activation in the present radar environment". Airservices Australia response received on 31 January 1996 stated: "Airservices is giving consideration to re-instituting a chart of radar coverage, similar to that which used to exist in Aeronautical Information Publication. Any such chart shall contain a note referring to Aeronautical Information Publication documentation which details the pilot reporting requirements and the transponder activation requirements. With regard to transponders, the instruction to pilots is that "Unless advised otherwise by ATC, pilots of Mode 3A transponder equipped aircraft operating in Australian airspace must activate their transponders, and where a Mode 3C capability is also available it must be activated simultaneously with Mode 3A"." Response status: CLOSED - ACCEPTED Civil Aviation Safety Authority response received 18 February 1997: "In relation to IR950210 regarding the importance of transponder activation, CASA is giving consideration to appending two notes to AIP RADAR-8 para 72.2. One would highlight the importance of transponder activation advising that primary radar coverage only exists within 50nm of major airports and that the remainder of the radar system relies on transponder information. The other would highlight the importance of activation of the transponder for the avoidance of collision through TCAS." Response Status: CLOSED-ACCEPTED IR 950211 issued 27 November 1995 "The Bureau of Air Safety Investigation recommends that: "Airservices Australia and the operating companies jointly provide consolidated frequency selection documentation for in-flight use by flight crew. Such information should indicate a failsafe frequency selection sequence to follow in the event of human or ATS system failures." The Airservices Australia response received 31 January 1996 stated: "Airservices Australia does not fully support this recommendation as the question of who has authority to manage the time or place of a frequency change must be answered. Good practice and safety management require that there is no confusion as to who initiates a frequency change. This responsibility must reside with the controller to avoid frequency changes unbeknown to the system. However, as a planning guide for pilots about when frequency changes would normally occur, there is merit in the recommendation. "Flight Information Area boundaries are currently shown on enroute low charts, due to the combined functionality this chart now has for Instrument Flight Rules and Visual Flight Rules pilots. Sector boundaries and frequencies were, at one time displayed on the Planning Chart Australia. However, the amount of detail that is now displayed on the Planning Chart has increased, which would mean the inclusion of sector boundaries and frequencies would significantly clutter this chart. The continuing consolidation and rationalisation of air traffic control sectors require a more dynamic means of providing up to date consolidated information. This is presently achieved by the issuing of Aeronatical Information Publication Supplements. "Airservices notes that the Civil Aviation Safety Authority does not support the depiction of sector boundaries and frequencies on high level charts, due to chart clutter, particularly along the eastern seaboard of Australia. Additionally, it is Airservices understanding that major Australian operators and overseas operators utilise Jeppesen charts. "Airservices has sought comment from Qantas and Ansett on this proposal, and await their reply". Response status: CLOSED - ACCEPTED IR 950221 issued 27 November 1995 "The Bureau of Air Safety Investigation recommends that the Civil Aviation Safety Authority amend published procedures to require all aircraft operating within controlled airspace to report reaching an assigned level." Civil Aviation Safety Authority response received 5 March 1996: "CASA does not support the recommendation that procedures be amended to require all aircraft operating within controlled airspace to report reaching an assigned level. "Aircraft are not required to report, after having been radar identified, while within radar coverage. The logic being that position information, including the level at which the aircraft is flying, is continuously available to the controller. While reporting top of climb would provide an additional reminder to ATS to check an aircraft's position, so would reports at each of the designated reporting points on the aircraft's route of flight. However, without other cross checks, an aircraft could disappear from the radar screen shortly after having made any report and the fact not be noticed for a considerable period of time. The solution of this problem requires that ATS have in place a means of ensuring detection of aircraft which disappear from radar screens. Such a means is, in fact, part of the radar system and cross checks are incorporated in ATS procedures as a back-up. However, there is a problem with this particular radar system indication and the ATS back-up procedures were apparently not applied to the flight in question. CASA has been advised that ATS is taking action to rectify the system indication problem and ensure controller compliance with procedures requirements." Civil Aviation Safety Authority subsequent response received 18 February 1997: "IR 950221 recommends pilot reporting of reaching an assigned level. This recommendation does not address the issue of immediately alerting the controller to a loss of a transponder symbol, at any time during flight. Such alerting must be achieved by means of radar display systems and controller procedures, not by pilot/controller interactions which may not identify the failure till some time after the event. It is noted that, in the response to BASI IR 950230 (Closed- Accepted). Airservices has listed the actions taken in regard to radar systems and controller procedures." The Airservices Australia response received on 31 January 1996 stated: "This recommendation is not supported. The improved radar data systems now available enable a better use of Mode C information, negating the need for ATC to request levels from pilots, thereby reducing frequency congestion. In the procedural environment, level checks are only instigated as required to resolve particular separation conflicts. Airservices notes that in this incident the subject aircraft was cruising before the next sector." Response status: CLOSED - ACCEPTED.