What happened
Two separate airspace incidents occurred within the Tahiti Flight Information Region (FIR) in early 2002 involving Qantas and United Airlines aircraft.
On 31 January 2002, three aircraft were operating near the PUMIS waypoint. The flight QFA26 requested a climb to FL330 via datalink. The air traffic controller, who was managing the tower alone at the time, mistakenly sent a pre-formatted message to QFA26 instructing it to "CLIMB TO AND MAINTAIN F330, DUE TO TRAFFIC." However, the controller had intended to instruct a different aircraft, QFA25, to maintain its level. This instruction caused QFA26 to climb into the path of ANZ1, which was at FL340. The aircraft avoided a collision after the ANZ1 crew identified the conflict via TCAS. The pilots of both Qantas flights subsequently filed airprox reports.
On 8 February 2002, a second incident occurred involving QFA25, ANZ5, and UAL841. The controller intended to clear QFA25 to FL350 only after it had cleared the path of ANZ5 to avoid a conflict with UAL841. However, the controller sent the climb authorization via datalink prematurely. Upon realizing the error, the controller attempted to contact the pilot via HF radio, but the pilot did not respond. The controller eventually corrected the instruction via a second datalink message, instructing the aircraft to maintain FL330.
The investigation
The investigation, conducted by the BEA in collaboration with the ATSB, examined the operational environment in the Tahiti FIR. Investigators reviewed the VIVO system, which is used for flight visualization and Controller-Pilot Data Link Communication (CPDLC). The investigation focused on the technical performance of the HF radio, the adequacy of tower manning, and the effectiveness of controller training on the VIVO interface. The investigation also looked into the use of pre-formatted versus free-text messages by both pilots and controllers.
Findings
Several contributing factors were identified in both incidents:
- Controller Error: In the first event, the controller sent an incorrect instruction due to a failure to re-read a pre-formatted message. In the second event, the controller sent a clearance prematurely due to a reflex action.
- Human-Machine Interface: The VIVO system's interface contributed to errors, specifically regarding the ease of sending pre-formatted messages and the difficulty in validating messages during high workload.
- Staffing Levels: During the first incident, the controller was working alone in the tower, which increased the risk of error during high-traffic periods.
- Communication Quality: Poor sound quality on the HF radio frequency made it difficult for the controller to understand the situation and hindered the transcription of radio exchanges.
- Training and Procedures: There was a lack of ongoing training for the VIVO system, and the use of CPDLC messages was not always strictly standardized, with pilots occasionally using free-text messages that were not promptly addressed.