The Fickle Hand of Fate: The crash of Gol Transportes Aéreos flight 1907
Note: this accident was previously featured in episode 42 of the plane crash series on June 23rd, 2018, prior to the series’ arrival on Medium. This article is written without reference to and supersedes the original.
On the 29th of September 2006, a Boeing 737 operating for Brazilian low-cost carrier Gol vanished from radar over the Amazon rainforest, taking with it 154 passengers and crew in what was then Brazil’s worst air disaster. But as rescue crews began to search for the remains of the shattered Boeing, it became clear that they were dealing with no ordinary crash, but a mid-air collision — and against all odds, the other plane had landed safely. At a remote military base, soldiers were interrogating the seven crew and passengers of a brand new business jet, which was on its inaugural flight when something ripped off its wingtip at 37,000 feet. It was obvious right away what had occurred. Somehow, the business jet and the passenger flight had collided, like two arrows fired from opposite ends of the country, only to meet head-on in the blink of an eye, their contact so brief that neither crew ever saw the other. Why, then, were the two planes on the same course at the same altitude? Someone had made a mistake, but who? The question of who bore responsibility for the disaster would go on to consume Brazil’s aviation industry, even as the crash laid bare systemic failings, both in Brazil and around the world, which allowed a series of improbable events to escalate into a nearly unprecedented catastrophe.
◊◊◊
In the summer of 2000, Brazilian aircraft manufacturer Embraer announced the development of a sleek new business jet, christened the Legacy 600. Based off Embraer’s existing E135 short-range passenger jet, the Legacy 600 promised to carry up to 13 passengers at altitudes up to 41,000 feet, while offering a luxurious, partitioned cabin replete with a fully functional galley, extensive in-flight entertainment, and a seating area which could convert into a bedroom. With a starting price tag of $25 million and a fuel burn rate of 300 gallons per hour, owning and operating a Legacy 600 required considerable capital, and the jet was mostly aimed at large companies seeking private executive transports, as well as charter airlines which offered on-demand jet services to wealthy clients.
One prospective customer was ExcelAire, an air charter and executive transport company based at Long Island Macarthur Airport in New York. Founded in 1985, ExcelAire started out as an aircraft maintenance company before later branching out into corporate aviation, and by 2006 it had a fleet of 20 aircraft — some wholly owned, others leased from private owners — which included Falcon 900s, Cessna Citations, Gulfstreams, and Learjets, along with several helicopters.
That year, the company decided to break new ground by purchasing its first ever Embraer business jet, the by now well-established Legacy 600, which was intended to supplement ExcelAire’s on-demand fleet. But buying a multi-million-dollar business jet is not so simple as walking into a dealership, handing over a check, and receiving the keys, and it was in the complex process of transferring the aircraft from Embraer to ExcelAire that the story of the eventual disaster began, weeks before the ill-fated flights met over the Amazon.
Because ExcelAire had never previously operated an Embraer jet, perhaps the most important logistical question facing the company was who would fly it from the Embraer manufacturing plant in Brazil back to ExcelAire’s home base in the United States. The company did not have any pilots already trained to fly Embraer jets, but one of its major clients, who planned to use the Legacy frequently, had already specified the pilots it wanted, and ExcelAire was in the process of training them at an Embraer simulator in Texas. Among them was 42-year-old Captain Joseph Lepore, who until that point had been flying the smaller Gulfstream III. He had almost 10,000 flying hours and extensive experience operating to international destinations, especially in the Caribbean, so he was chosen to be pilot in command during the delivery flight from Brazil. For the second-in-command position, ExcelAire hired 34-year-old Captain Jan Paul Paladino, who had been flying the similar Embraer 145 regional jet for commuter airline American Eagle. Although he had no previous experience with air charter operations, ExcelAire wanted someone who was already somewhat familiar with Embraer airplanes to assist Captain Lepore, and Paladino presented an excellent choice. The two pilots met for the first time during Legacy 600 simulator training at Flight Safety International, shortly before the planned delivery of the actual airplane.
On August 30, 2006, both Lepore and Paladino passed their Legacy 600 check rides and were approved to fly the new jet. Almost one month later, on September 25, the pair traveled to Brazil and arrived that same day at the airport in São José dos Campos, a city of some 700,000 inhabitants located between São Paulo and Rio de Janeiro. São José dos Campos (or just “São José”) has hosted the headquarters of aircraft manufacturer Embraer ever since the company’s founding in 1969, and the city’s airport is attached to Embraer’s main production facility, which assembles numerous passenger and private jets, including the Legacy 600. When they arrived, Embraer engineers were putting finishing touches on ExcelAire’s new aircraft, including some last minute fixes to the paint and cabin lighting. Two ExcelAire executives, including a Vice President, were also present, as well as New York Times columnist Joe Sharkey, who was covering the delivery of the airplane for a freelance piece in Business Jet Traveler.
Over the next several days, Lepore, Paladino, and several Embraer test pilots teamed up to complete a series of acceptance tests, during which they verified that the airplane was performing according to both Embraer’s and ExcelAire’s specifications. The tests went smoothly, and provided valuable experience for the pilots, who had only flown a real Legacy once for about an hour before coming to Brazil. By the time the tests were complete, Captain Lepore had accumulated 3.5 hours on the aircraft, although none were actually required in order to operate the upcoming delivery flight. Unlike commercial flights, which operate under Part 121 of the Federal Aviation Regulations, the so-called “ferry flight” was scheduled under part 91, or general and private aviation, in which the only requirement in terms of pilot experience was that they possess a Legacy 600 type rating.
According to Embraer employees who were present, the original plan was to finish the acceptance flights on Thursday, September 28; hold a special delivery ceremony on Friday, September 29; and depart with the airplane on Saturday, September 30. However, this schedule was at some point moved up, so that the departure would take place on the same day as the ceremony. For their part, the pilots would later claim that this had always been the plan.
The plan for the flight back to the United States was to fly to Manaus, in the heart of the Amazon, on September 29, stay overnight, and then continue to Fort Lauderdale, Florida in the morning. But a flight through controlled airspace can’t be performed on a whim — a detailed flight plan first needed to be submitted to Brazilian air traffic control authorities, containing the planned route, planned altitudes, departure and arrival times, aircraft information, and more. Normally, the flight plan is drafted by the airline, or by the pilots themselves using third party software. In this case, however, the pilots had apparently requested that the Embraer Flight Support Manager draft the flight plan, which he did, using the Universal software program. On September 29 the flight plan was completed and forwarded to the Area Control Center, or ACC, in Brasilia, which was responsible for the airspace over São José. The plan was also sent to the printer in order to provide the pilots with a paper copy.
Meanwhile, at 11:00 that morning, the Embraer and ExcelAire personnel involved in the sale gathered at the hangar containing the airplane in order to perform the delivery ceremony. Champagne was popped, congratulations were exchanged, and the plane was given its new US registration number N600XL (“November Six Hundred X-ray Lima”). Then, as the plane was towed out to the ramp to be fueled for the journey, the ceremony attendees sat down for a celebratory lunch. Jan Paul Paladino was said to be in attendance, while Joseph Lepore went out to the aircraft to prepare for the flight, completing the walkaround checks and other required pre-flight activities. The scheduled departure time was 14:00, apparently because the ExcelAire Vice President wanted to overfly the Amazon rainforest during the day, and there wasn’t much time to get ready.
Meanwhile, second-in-command Paladino left the celebratory lunch with an Embraer engineer, and went to the office of the Embraer Delivery Manager in order to familiarize himself with the Legacy’s new weight and balance software, which he had installed on a laptop. This activity apparently continued until shortly before the departure, and Embraer employees alleged that they had to repeatedly ask him to come to the aircraft because the passengers wanted to depart. At some point during this period, the flight plan finally finished printing, and someone went out to give it to Captain Lepore, who began entering its contents into the plane’s flight management system, or FMS. Paladino was not present for at least part of the process, and the pilots didn’t have time to discuss the flight plan before departing. In fact, the flight plan arrived less than 30 minutes before N600XL actually departed, and by most accounts it got there earlier than Paladino did.
After various delays, the pilots and support staff managed to get everything in order, and N600XL started its engines in preparation to taxi. In total, there were seven people on board, including the two pilots, two Embraer employees, two ExcelAire executives, and the journalist, Joe Sharkey.
According to the flight plan, they were to fly on a heading of 006˚, slightly east of due north, along the UW2 airway from São José to Brasilia, at 37,000 feet, or Flight Level (FL) 370. Upon crossing the Brasilia VOR radio beacon, they were to make a left turn to 336˚, or north-northwest, onto the UZ6 airway from Brasilia to Manaus, and descend to 36,000 feet (FL360). While on the UZ6 airway, they were to ascend to 38,000 feet (FL380) while crossing a waypoint called TERES, and then maintain this altitude until the descent into Manaus. These altitudes had been chosen by the computer program based on the forecast wind in those areas, while respecting the international standard that planes flying east shall maintain odd flight levels (such as FL370), and planes flying west shall maintain even flight levels (such as FL360). However, Captain Lepore had only programmed the route into the FMS, without entering the altitudes, because of the limited time available, and because the actual altitudes assigned by air traffic control are often different from those in the flight plan, so programming them in advance is not always an especially wise use of time.
After giving N600XL clearance to taxi to the runway, the São José ground controller called the Brasilia ACC to ask for the jet’s route clearance. The route clearance is pretty much what it says on the wrapper — it’s a description of the route which the plane will fly after takeoff, as authorized by air traffic control. In Brazil, route clearances were devised at the ACC based on the forwarded flight plan, and then passed on to local controllers at the flight’s aerodrome of departure. And so, after hearing back from Brasilia, the São José ground controller said, “November Six Hundred X-ray Lima, ATC clearance to Eduardo Gomes, Flight Level three seven zero, direct Poços de Caldas, squawk transponder code four five seven four, after takeoff perform Oren departure.”
This clearance may or may not have violated procedural requirements — that matter was later subject to debate — but it was certainly incomplete and potentially misleading. The controller mentioned Eduardo Gomes, the airport in Manaus, and mentioned Flight Level 370, but did not mention any other altitudes or a point at which the flight must leave FL370. According to standard phraseology, that meant that the flight was, technically, cleared all the way to Manaus at FL370, although this was not the controller’s intention. The rest of the clearance consisted of departure procedures and transponder settings, which played no direct role in the events which followed. The significance of the words “clearance to Eduardo Gomes, Flight Level three seven zero” cannot however be overstated. Indeed, the pilots themselves would later confirm that from that moment, they believed that they had been cleared at FL370 all the way to their destination, with no en route changes. Although this clearance differed from the flight plan, that didn’t strike the pilots as unusual. Nor were they struck by the fact that FL370, an odd flight level, was non-standard for the northwest-bound UZ6 airway after passing Brasilia, because if there was no conflicting traffic, controllers could give flights whatever altitudes they wanted. In fact, the convention of odd and even flight levels, while observed more often than not in day-to-day operations, was only mandatory in uncontrolled airspace, usually over the ocean.
Therefore, before either pilot had even had a chance to discuss the flight plan altitudes, any preconceptions were overridden by the justified belief that they were cleared to Manaus at FL370.
At 14:52 local time, N600XL departed São José dos Campos, climbed to 37,000 feet, and joined the UW2 airway to Brasilia. After leaving the immediate vicinity of São José, the local controllers there handed the flight over to the Brasilia ACC, which was responsible for upper level traffic in central Brazil. This airspace was subdivided into 14 sectors; N600XL initially contacted sector 1, followed by sector 4, then sector 5. So far, everything seemed normal.
The cockpit voice recording from N600XL began at 15:33, about 40 minutes after takeoff, as the flight cruised at 37,000 feet south of Brasilia. At that moment, Paladino could be heard calling air traffic control: “November Six Hundred X-ray Lima, level, Flight Level three seven zero,” he reported.
“Roger, squawk ident, radar surveillance, radar contact,” the controller replied, asking the crew to press the “ident” button on their transponder in order to highlight the aircraft on his radar screen.
Every transport aircraft is equipped with a transponder which broadcasts information about the flight, including its identity, altitude, speed, and a four-digit “squawk code” which helps controllers determine which aircraft they’re talking to. Per the instructions given by the São José controller, N600XL was “squawking” 4574, and by pressing the “ident” button on their transponder controls, the pilots could highlight that code on the controller’s radar screen without having to actually change it.
But the pilots were having trouble understanding the controller’s heavily accented English, which was also distorted by an unpleasant echo. “They just said radar contact,” Lepore concluded, picking out what he could.
“Roger, radar contact,” Paladino said to the controller. Turning to Lepore, he added, “I’ve no idea what the hell he said.” He never realized that he was supposed to squawk ident.
With few immediate duties, the pilots had already turned their attention to the laptop and the new weight and balance software that it contained. Except for the brief interruption to speak to air traffic control, the pilots almost continuously discussed the use of the software in order to calculate the details of their fuel burn and landing and takeoff performance in Manaus — which, it should be noted, is normally done before the flight leaves the ground.
Overall, however, the atmosphere on the flight deck seemed relaxed. Passengers came and went from the cockpit, greetings were exchanged, and the pilots provided commentary on the new airplane, mostly without substance (“She’s flyin’ real nice.”) Someone brought drinks to the cockpit, and the pilots joked to a passenger about their difficulties communicating with air traffic control. Other than that, they mostly discussed the software, both on the plane and on the laptop, while unintelligible ATC transmissions bounced back and forth in the background. “[I’m] still working out the kinks on how to work this FMS,” Lepore added, as he tried to find his way through the maze of pages in the flight management computer. A couple minutes passed while they tried to find the time remaining to destination. Eventually Paladino pointed out that they were 100 miles from Brasilia, “the capital,” and that after that they would “angle a little bit left, and…”
“There we go,” Lepore interrupted.
“There we go, it’s a straight shot, should be no problem hopefully,” Paladino concluded.
At 15:44 the pilots apparently discovered a notice to airmen, or NOTAM, buried in the flight documentation, which stated that part of the runway in Manaus would be closed for construction.
“Just to let you know, on landing you might have to…” Paladino started to point out.
“…Jam on the brakes,” Lepore finished for him. “It’s a tiny runway?”
“Now it is, yeah, with the construction,” said Paladino.
The best way to find out how much of a landing margin they would have was to use the software on the laptop, which would take time due to its unfamiliar interface. Minutes passed, fiddling with tabs and menus and entry fields.
Meanwhile in the Area Control Center in Brasilia, N600XL was being monitored by the controller responsible for sectors 5 and 6, which had been combined into one position. N600XL was still fairly deep inside sector 5, which contained the Brasilia VOR beacon, but for whatever reason this controller decided that he wanted to hand the flight over to the next sector several minutes early. Traffic was heavy, but not unusually so; perhaps he just wanted to reduce his workload. And so he called the flight and said, “November Six Zero Zero X-ray Lima, Brasilia.”
“Go ahead,” Paladino replied.
“Switch frequency one two five zero five, sir,” he said, his voice distorted by the same uncomfortable echo.
“Decimal one — I’m sorry, one two five decimal zero five, good day, Six Hundred X-ray Lima,” said Paladino.
The frequency 125.05 was the main frequency assigned to sector 9, not sector 7, into which they were actually flying. However, sectors 7, 8, and 9 had been combined into a single position, where the controller on duty — 38-year-old air force Sergeant Jomarcelo Fernandes dos Santos — was monitoring the frequencies for all three sectors simultaneously. It was therefore possible to call him on the frequency for sector 9, but since N600XL was not planning to fly through this sector, the choice of this frequency was questionable, especially since the flight was heading into the vast, northern sector 7, where the frequency 125.05 was not supported by ground infrastructure. If he had instead given the crew the proper sector 7 frequency of 135.9, then things might have gone very differently.
In the cockpit, Lepore dutifully entered the frequency 125.05 using his radio management unit, or RMU.
In the Brasilia ACC, the controller for sector 5–6 verbally handed over the aircraft to Sergeant dos Santos in sectors 7–9. Dos Santos observed that the flight was at FL370, exactly where it was supposed to be.
On the new frequency, Paladino announced, “Brasilia, November Six Hundred X-ray Lima, level Flight Level three seven zero, good afternoon.”
“November Six Zero Zero X-ray Lima, squawk ident, radar surveillance,” said dos Santos.
“Roger,” Paladino replied. Then, realizing he had failed to “squawk ident” earlier, he said, “Oh fuck, I forgot to do that.”
“ID is there,” said Lepore, pointing to the radio management unit.
Paladino pressed the ident button, and N600XL flashed on dos Santos’s radar screen. “I think I did it, yeah,” he said.
The time was 15:51. Although more than an hour remained until disaster, this would be N600XL’s last communication with air traffic control.
◊◊◊
After that, the pilots’ attention turned back to the fuel and landing calculations. Their discussion continued for some time. Meanwhile, just before 15:58, amid the ongoing conversation, N600XL passed over the Brasilia VOR, and in accordance with the flight plan Lepore had programmed into the FMS, the autopilot made a left turn to a heading of 336˚, taking up the UZ6 airway to Manaus. Neither pilot made any comment about the maneuver.
At that moment at the Brasilia ACC, a serious misunderstanding occurred — one which was enabled by the design of the radar system at the facility.
Air traffic control radar normally consists of two separate levels: primary radar, which tracks airborne objects by bouncing radio waves off of them; and secondary radar, which communicates with an aircraft’s transponder in order to acquire more detailed information about an aircraft’s position and identity. During normal operation, the physical location of the aircraft, as derived by both types of radar, is shown using a + sign inside of a circle, called a target. Information from the secondary radar is then displayed as a data block attached to the target. This data block includes the aircraft callsign (in this case, N600XL), its current flight level, its authorized flight level, its speed (in tens of knots), the current sector, the squawk code, and a couple of other parameters. Most important for this story, however, are the current and authorized flight levels. These flight levels were displayed with the current flight level on the left, followed by an = sign, and then the authorized flight level on the right. The = sign did not indicate that the current and authorized flight levels were actually equal; it only meant that altitude information was being received from the airplane’s transponder. Therefore, as N600XL cruised at 37,000 feet toward the Brasilia VOR, the altitude section of its data block would have read “370=370.”
However, the system in use in Brazil had a unique quirk which set it apart from the rest of the world. Specifically, the cleared flight level block could change to indicate a requested flight level, based on the filed flight plan, if the controller did not manually enter a new cleared altitude. Because no one had changed N600XL’s clearance, the cleared flight level remained at 370, until the flight crossed the Brasilia VOR. At that point, the flight plan stated that the flight would descend to FL360, and so the cleared flight level block automatically became the requested flight level block, and changed to “360” without the flight having actually been cleared to this level. And there was no indication that would tell the controller which type of flight level information — cleared or requested — he was actually looking at.
Therefore, the flight level block for N600XL now read “370=360.” This was intended to remind the controller of the need to order a descent. But instead, an insidious misunderstanding occurred: the sector 7–9 controller, Sergeant dos Santos, thought that N600XL had already been cleared to this new altitude.
There is no certain consensus as to why he thought this. However, it is worth noting that when a flight level change is required within a particular sector, it is the responsibility of the controller operating that sector to order the change. Because the Brasilia VOR was in sector 5, the sector 5–6 controller would normally have ordered the flight to descend, with a clearance such as, “November Six Hundred X-ray Lima, descend Flight Level three six zero after crossing Bravo Romeo Sierra.” However, in the event, he relinquished control of N600XL while it was still 12 minutes away from the Brasilia VOR, which was unusually early. As a result, he never ordered N600XL to descend, apparently figuring that the next controller would handle it. However, when the next controller, Sergeant dos Santos, saw “360” appear in what he assumed was the cleared flight level block, he believed that the sector 5–6 controller must have already cleared it to descend upon passing the VOR, because that was what he had come to expect based on years of routine operations.
Unfortunately, his assumption was incorrect. No one had told N600XL to descend, and so it turned left onto the UZ6 airway at flight level 370. Now it was traveling northwest-bound at an odd flight level, which was non-standard. But the pilots, believing that they had been cleared all the way to Manaus at FL370, and hearing no call from ATC to change altitude, saw nothing unusual about the situation. As far as they knew, they were following the orders given to them by ATC — and technically, they were.
Given time, dos Santos might eventually have noticed that N600XL was still at FL370, at which point he would surely have ordered the flight to descend. But instead, the fickle hand of fate intervened, in a coincidence so improbable that it almost defied rational explanation. For at 16:02, just four minutes after N600XL crossed the Brasilia VOR, its transponder mysteriously stopped broadcasting.
Considerable effort, much of it fruitless, would later be aimed at the question of how and why the Legacy’s transponder turned off. Some of the theories will be examined later in this article. But regardless of what happened, from that moment, Brasilia ACC stopped receiving altitude information from the Legacy — and nobody noticed, neither on the plane, nor on the ground.
When the transponder switched off, the altitude field in the data block changed from “370=360” to “370Z360,” with the letter “Z” indicating a loss of transponder data, and the circle disappeared from around the target, leaving only the + sign. The actual altitude field remained, but it was no longer derived from the aircraft itself, but rather from primary radar. Primary radar does not normally track an object’s altitude, but Brazilian air traffic control centers, which were run by the military, had been equipped with air defense radar that was considerably more capable. This so-called “3D radar” included an altitude sweep which could roughly determine a target’s altitude as well as its range, albeit with reduced accuracy, especially over long distances. This 3D radar was not authorized for use in controlling aircraft; in fact, it was intended for air defense purposes only. Nevertheless, it automatically kicked in when secondary radar contact was lost, without explicitly warning the controller that the “actual flight level” block was no longer reliable.
Consequently, a couple minutes after the loss of N600XL’s transponder, the 3D radar-derived altitude began to fluctuate as the plane flew farther away from the antenna. It briefly remained near FL370, then coincidentally decreased to FL360, before oscillating up and down over a considerable altitude range as the signal grew progressively weaker. However, the brief indication of FL360 was apparently enough to convince dos Santos that N600XL had in fact already descended, and that it was flying at a standard altitude for its direction and airway. By all means, he should have noticed the letter Z and the fluctuating altitude, but it seems he never did.
Meanwhile on board N600XL, a number of indications appeared concerning the transponder. On the displays of the radio management units, or RMUs, which are used to control the plane’s radio equipment, the word “STANDBY” appeared in the line indicating the transponder status. The transponder’s standby mode is normally only used on the ground after the flight is over; in fact, the after landing checklist instructs the pilot to switch the transponder to standby after leaving the runway. In this mode the transponder is functional, but is not broadcasting — essentially, it’s turned off.
But the most significant consequence of switching the transponder to standby was its knock-on effect on another critical piece of equipment: the Traffic Collision Avoidance System, or TCAS. This mandatory system interrogates the transponders of nearby aircraft, and determines the closure rate of those aircraft in order to detect potential traffic conflicts. If a conflict is detected, the system will automatically sound an alarm and suggest evasive maneuvers to the crews of both aircraft, allowing them to avert a collision. However, a two-way connection is essential. Let’s call the two aircraft “A” and “B.” If aircraft A’s transponder is off, the system cannot send out signals to interrogate the transponder of aircraft B, nor can aircraft B interrogate the transponder of aircraft A. As a result, aircraft A becomes invisible to aircraft B’s Traffic Collision Avoidance System, and aircraft B is invisible to aircraft A’s TCAS as well.
Therefore, if the transponder turns off, TCAS also becomes inoperative. On N600XL, this caused a white message reading “TCAS OFF” to appear on both pilots’ primary flight displays, near the artificial horizon. Simultaneously, an amber blinking light appeared in the “ATC/TCAS” box on both RMUs. However, there was no aural warning, and the pilots, apparently distracted by their efforts to understand the fuel and performance management software, didn’t notice.
◊◊◊
Meanwhile, several hundred kilometers to the north in Manaus, a Boeing 737–800 operating Gol Transportes Aéreos flight 1907 to Brasilia was climbing toward its cruising altitude of 37,000 feet. After taking on 148 passengers and six crew at Eduardo Gomes International Airport in Manaus, the flight took off at 15:35 under the command of 44-year-old Captain Decio Chaves Jr., an experienced pilot with 15,500 flying hours. His first officer was 29-year-old Thiago Jordão Cruso, who was less experienced but had been flying the 737 for several years. The plane itself was almost brand new: it had been delivered to low-cost carrier Gol less than a month earlier, and this was its 162nd flight.
The filed flight plan for Gol flight 1907 indicated a cruising altitude of 41,000 feet, but for operational reasons the pilots requested 37,000 feet instead, which was granted. Some 20 minutes later, the flight reached this altitude and leveled off, heading south through the airspace of the Amazon ACC. They had no reason to suspect that they were already on a collision course with N600XL, and would in fact remain so for the next hour.
◊◊◊
On board N600XL, there was similarly no indication that anything was wrong. At 16:13 the pilots finished their calculations and put away the laptop, and the conversation turned to idle banter. “We can do the landing today, we just have to get on it,” Lepore said with a chuckle. “Nothing like banging the first flight of the friggin airplane.”
“They make it so difficult, you couldn’t get a nice long runway, you know?” said Paladino. “You get stuck in a fucking place in the middle of the Amazon, unknown…” he paused, glancing out the window. “Ah, it’s beautiful. Doesn’t look so Amazonish,” he added.
“Nah, it doesn’t either,” said Lepore. In fact, the Amazon that once sprawled over this part of central Brazil had long since been cut down.
In the background, back-and-forth transmissions from ATC and other aircraft continued, in Portuguese. But none of the calls were for them.
Meanwhile in the control center, it was time for a shift change. Sergeant dos Santos gave up his seat at console 8, from which he was controlling sectors 7–9, and handed it over to his relief, 27-year-old Sergeant Lucivando Tibúrcio de Alencar. Briefing de Alencar on the situation, dos Santos mentioned that N600XL was in sector 7 at Flight Level 360, although it was not. He made no mention of the fact that its transponder had failed. Nor did de Alencar immediately attempt to call N600XL. And unbeknownst to him, his last opportunity to do so was rapidly slipping away.
Because the sector 5–6 controller had told N600XL to contact the sector 7–9 controller using the frequency for sector 9, and no one had instructed them to switch to the correct frequency for sector 7, N600XL was now nearing the edge of the radio coverage area. Sector 9 was by now quite far to the south, and there were no repeaters for the sector 9 frequency 125.05 in sector 7. As a result, at approximately 16:24, N600XL flew out of range of 125.05. Transmissions from other airplanes in between its location and the Brasilia ACC could still be heard, but the replies from ATC were no longer being picked up. Probably because the transmissions were in Portuguese, the pilots were unable to detect the discrepancy.
About two minutes later, at 16:26 — eight minutes into his shift — Sergeant de Alencar finally noticed that N600XL had lost its transponder. He had been told it was at the proper altitude, but just to be sure, he tried calling, “November Six Zero Zero X-ray Lima?” Yet there was no reply.
Moments later, at 16:27, he said, “November Six Zero Zero X-ray Lima, contact one three five decimal nine,” providing the proper frequency for sector 7. Again, his transmission was met with silence.
On board N600XL, occasional idle conversation continued. Paladino started messing with a digital camera: “How do I get video on this thing?” he asked.
“Press the video button,” Lepore suggested.
At 16:30, N600XL began to pass out of the primary radar range of Brasilia ACC. For a moment, its target disappeared from the controller’s screen entirely. De Alencar continued trying to call the flight: “November Six Hundred X-ray Lima?” he said. After a pause, he repeated, “November Six Hundred X-ray Lima, Brasilia?”
At this point, de Alencar was faced with a critical situation: he had a plane which had disappeared from radar and was not responding to ATC communications. By law, he should have called his supervisor and initiated the procedures for a loss of radio and radar contact. But for whatever reason, he did not.
At 16:32, primary radar began picking up N600XL again, but without the transponder, the radar was unable to correlate the target with a particular aircraft. Instead of a normal data block, there was only a target, an estimated speed, and a 3D radar altitude, with no information about its identity. As this occurred, de Alencar tried calling N600XL two more times, still with no response. And then, inexplicably, he gave up.
On the Legacy, the pilots’ chit-chat was slowly invaded by longer and longer periods of silence. Whatever they were doing, it must not have been examining their displays, because still nobody had noticed that the transponder was in standby mode and the TCAS was off.
At 16:36, N600XL passed over the TERES waypoint, where the flight plan said they should climb to FL380. The pilots made no comment, and the controller made no further attempts to contact the flight, at least not yet.
At 16:38, N600XL disappeared from primary radar again, still without eliciting any reaction from Sergeant de Alencar. On board, Paladino snapped some photos using his digital camera, telling Lepore to “say cheese” in a fake Italian accent.
A little less than two minutes later, Captain Lepore yawned, then said, “I’m gonna take a whiz… your wheel.” Paladino assumed control, and Lepore went to the bathroom. Silence fell in the cockpit, except for the background chatter of other airplanes calling Brasilia. But after a few minutes, these also ceased as the Legacy flew farther and farther from sector 9. For a time, the cockpit voice recorder captured only the lonely white noise of the engines, except for a brief interjection as Paladino muttered, “…Fuck did I put my glasses?”
However, at 16:48, the extended silence finally started to make Paladino uneasy. It had been 57 minutes since he last spoke to air traffic control, and the lack of any background communications suggested, in his mind, that they were flying into the next sector without having been properly handed over. And so he keyed his mic and said, “Brasilia… November Six Zero Zero X-ray Lima?” But there was no reply. Eleven more times he repeated his query, between 16:48 and 16:53, without success.
Although his first three calls were on 125.05, he quickly concluded that this frequency wasn’t working, so he began referring to his Jeppesen area chart, which listed five valid frequencies for Brasilia’s sector 7. Next he tried twice on 123.3, but this frequency had not been selected at console 8 where de Alencar was working. He then tried on 128.0, but the repeater for this frequency in sector 7 hadn’t been hooked up to the Brasilia ACC. Moving on, he tried 133.05, but like 123.3, this frequency hadn’t been selected at console 8. The fourth frequency was 134.7, which he tried at least three times, but this was simply an error on the Jeppesen chart — 134.7 was not and never had been a valid frequency for this sector. That brought Paladino to the fifth and final listed frequency, which was 135.9. At 16:53, he switched to this frequency, and by coincidence it was at that very moment that de Alencar decided to make one last attempt to call N600XL.
At the Brasilia ACC, de Alencar had observed that it was almost time to hand off N600XL to the Amazon ACC, operating from Manaus. His assistant called the Amazon ACC and informed the controller there that N600XL was level at FL360, the last altitude he had been told. He neglected to mention that the aircraft had lost its transponder and wasn’t responding to radio communications.
Meanwhile, using all six frequencies selected at console 8, including 135.9, de Alencar transmitted, “November Six Hundred X-ray Lima, Brasilia in blind, contact Amazonico center one two three decimal three two, if unable, one two six decimal four five, November Six Hundred X-ray Lima.”
By some stroke of luck, 135.9 was the frequency Paladino had selected at that moment, and the transmission came through over the Legacy’s cockpit speakers. It did not, however, come through loud and clear: the transmission was marred by static and uncomfortable pauses as the controller dredged his limited English vocabulary. Still, for a moment, a glimmering pathway could be seen, leading to a re-establishment of communication, a clarification of altitude, and the prevention of the now-imminent disaster. But in a final twist, Paladino couldn’t catch the full frequency due to the static. “Ah, just trying to reach you,” he said, “what was the first frequency for November Six Hundred X-ray Lima — one two three decimal, I didn’t get the last two…”
But someone else had already keyed their mic to call the sector, overriding his transmission, and there was no reply.
At the Amazon ACC, the controller spotted a primary radar target which appeared to be N600XL, and he confirmed the handoff with the Brasilia sector 7–9 assistant. Moments later, N600XL dropped off radar again, but this didn’t alarm him — he had been told that the radar station in that part of his sector was inoperative. He had no idea that it had already been fixed, and he was actually dealing with a rogue aircraft. As a result, he made no attempt to call it.
Meanwhile, Paladino tried again to contact ATC: “Sorry, say frequency one more time for November Six Zero Zero X-ray Lima?” But he got nothing. Thinking he might have heard the controller say “126.15,” he switched to that frequency and repeated, “Brasilia [sic], November Six Zero Zero X-ray Lima?” But this frequency wasn’t real. He tried once more on 126.45, which was a valid frequency for the Amazon ACC, but again, his calls were hidden by overlapping transmissions from other aircraft.
At that moment, Lepore finally returned from the bathroom after 16 minutes out of the cockpit. He apologized for spending so much time away, but didn’t explain what had taken him so long — he would later claim that he had to fix something in the lavatory. In any case, Paladino immediately informed him that “we’ve got some radio problems here.” He then added, “[Unintelligible] controller forgot us, so I started going through a bunch of frequencies, and I just — as I flipped over, he was calling us to say to transmit on the frequency, to call him on the next frequency, but I couldn’t — I didn’t get the last two, alright? And he’s not responding back to me, so I’m trying to get him on the radio right now. But as for the frequency [unintelligible] to switch over, I got one two three, something. And then he gave me an alternate one, one two six — either point four five, or one five, but I can’t reach anybody on those. I tried one five, didn’t work, maybe four five…”
The sound of a squelch was heard as he switched to another frequency. He called again, “Brasilia, November Six Hundred X-ray Lima?” Still nothing.
Dead ahead and closing fast was Gol flight 1907, cruising at 37,000 feet along the same airway in the opposite direction. Viewed end-on, it was impossible to see, even though by now a collision was just moments away. At this point, TCAS would normally have issued a resolution advisory, urging both crews to take evasive action, but it was turned off.
Paladino called one more time: “Brasilia, November Six Hundred X-ray Lima?”
And then, seemingly out of nowhere, the planes collided.
◊◊◊
On board Gol flight 1907, Captain Chaves and First Officer Cruso had no idea that a business jet was heading straight for them. The cockpit atmosphere was relaxed, as the pilots discussed topics ranging from celebrities to automobiles. Captain Chaves had a digital camera and was showing photographs to his first officer. “[Unintelligible] knows about cars better than us,” he said. “Do you want to see the car?” He leaned over to show Cruso a picture on the camera’s LCD screen. And then, without warning, all hell broke loose.
Level at 37,000 feet, the two planes collided head-on at precisely 16:56 and 54 seconds. In the blink of an eye, the Legacy’s 1.6-meter-tall vertical winglet sliced like a knife clean through the 737’s left wing, splitting it nearly in half. Simultaneously, the 737’s left winglet clipped the Legacy’s horizontal stabilizer, neatly cleaving away a fairing and part of the elevator. The collision was over before anyone even realized what had happened.
From the moment of impact, Gol flight 1907 was instantly and irreversibly crippled. The outboard half of the 737’s left wing, including the entire left aileron, folded up and ripped away, causing a catastrophic lift imbalance that sent the plane into an immediate and violent spiral dive. Within one second, someone let out a pained shout, the autopilot disconnected with a cavalry charge alarm, and an automated voice began calling out, “BANK ANGLE! BANK ANGLE!” as the plane turned rapidly inverted. Amid a cacophony of terrifying bangs and roars, with numerous alarms blaring, First officer Cruso exclaimed, “What’s happened!?”
“I don’t know!” Captain Chaves replied, trying desperately to pull the plane out of its spiral — but his controls seemed to have no effect.
The shuddering and roaring increased in volume, almost drowning out the pilots’ increasingly strained exhortations. Under the horrific creaking noises and screeching alarms, First Officer Cruso could be heard shouting, “Oh my god!”
“Calma, calma, calma!” Captain Chaves said, urging his First Officer to stay calm. The autopilot disconnect warning and bank angle warnings were suddenly joined by the rapid-fire clicking of the overspeed warning as the plane exceeded its maximum speed. Immense G-forces stretched the fuselage to its limits as the aircraft spiraled toward the ground like a piece of debris being sucked down a drain.
“Oh shit!” Cruso shouted.
“BANK ANGLE! BANK ANGLE!”
“Calma, calma!” Chaves repeated.
“BANK ANGLE! BANK ANGLE!”
Captain Chaves lowered the landing gear in a desperate attempt to slow their dive, but his efforts were useless. Indescribable noises filled the cockpit as the airframe began to break apart under the strain, huge chunks of the wings and tail tearing away in its wake. The cockpit voice recorder captured the First Officer screaming, followed by a rising roar and one last “BANK ANGLE!” warning, until, with the deafening sound of rending metal, the aircraft disintegrated, and the recording ceased. Seconds later, the shattered pieces of Gol flight 1907 slammed into the impenetrable canopy of the Amazon rainforest, instantly killing all 154 people on board.
◊◊◊
On board the Legacy, some of the passengers thought they saw a fleeting shadow, followed by a loud snap as the jet’s winglet was ripped away. The plane veered hard to the left and the autopilot disconnected, as an automated voice called out, “AUTOPILOT!” followed by a continuous chime.
“What the hell was that?” Lepore exclaimed.
“Just fly the airplane dude,” Paladino urged. “Just fly the airplane!”
Although the damage had caused excessive drag on the left side, the winglet’s main purpose was to improve efficiency, not to keep the plane airborne, so Captain Lepore was able to regain control within seconds.
“AUTOPILOT! AUTOPILOT!” said the automated voice.
“We don’t have explosive decompression,” Paladino said, taking stock of the situation. “You gonna fly it dude? You want me to fly it?”
Lepore seemed to be in shock, maybe even panic. To Paladino, it was clear that his ability to take command of the situation was in doubt.
“What, we got fucking hit…” Lepore said.
“I don’t know dude, just let me fly it,” said Paladino. “Declare an emergency.”
Captain Lepore dialed in the emergency frequency, 121.5, in order to make a distress call.
“Whatever the fuck that was…” Paladino said. “We have to get down.” A distant voice chimed in from the passenger cabin, and then he added, “Where the fuck did he come from?” To the passengers he shouted, “Alright, we’re going down, declaring an emergency, sit down!”
On 121.5, also known as “Guard,” Lepore said, his voice shaky, “Brasilia, Brasilia, November Six Hundred X-ray Lima?” There was no response, so he tried again: “Brasilia, Brasilia, November Six Zero Zero X-ray Lima, emergency!” He had no idea that he was in a dead zone, where repeaters for the universal distress frequency 121.5 had not been connected to the Brasilia or Amazon ACCs.
Meanwhile, Paladino had found the nearest airport indicated on their charts: a military airfield, known as Cachimbo Airport or SBCC, which served a large air force training and testing facility deep in the rainforest some 230 kilometers from their position. As best he could, he started making preparations to land there. As he did so, he again said, “Where the fuck did he come from? Did we hit somebody? Did you see that, did you see something?”
“I thought I saw… I looked up…” Lepore started to say, but he never finished his thought.
Suddenly, as Paladino was trying to dial in the frequency for SBCC, something caught his eye, and he exclaimed, “Dude, is the TCAS on?”
“Yes, the TCAS is off,” Lepore replied.
There was a ten second pause, and then Paladino said, “Just keep an eye on the traffic. I’ll do that, I’ll do that, I got that.” At that moment the flight data recorder captured one of the pilots, presumably Paladino, opening the transponder page on the RMU. Moments later, N600XL’s transponder started broadcasting again, appearing on controllers’ radar screens in both the Brasilia and Amazon ACCs.
“So much for TCAS,” Paladino said. After that, neither pilot mentioned TCAS or the transponder again.
Over the next several minutes, the pilots managed to make contact with a Polar Air cargo plane on 121.5, which relayed news of their emergency to the Amazon ACC. The pilots then set their transponder to squawk 7700, the universal emergency code, and programmed their FMS to show them the way to SBCC. At some point, Paladino took control. All the while, they speculated about what had happened: “We were on course, level altitude, I don’t know what the fuck we just hit,” said Paladino, sounding exasperated.
One of the pilots asked the passengers to report on the damage, and someone replied that they had lost a winglet. They could also clearly see that the damage extended to the wing itself, where several rivets had popped and the spar was partially exposed. No one knew exactly how long it had left. “Do we have a wingtip?” Paladino asked.
“No,” someone called back.
“That’s the drag I’m feeling right now,” Paladino speculated.
All the way down, the pilots kept it under control. They found that the plane was hard to control at low speeds, so they decided to make a high-speed landing with limited flaps and hope the runway was long enough. Eventually the airport itself came into view, and the Polar Air pilots managed to give them the frequency for the Amazon ACC, which in turn gave them the frequency for the Cachimbo control tower. Careful to avoid overstressing the damaged left wing, the pilots made a wide turn to line up with the runway, put the gear down, and came in fast over the threshold, as terrain warnings blared in the background.
A minute from landing, Lepore said, “We hit something man, we hit another airplane.”
“I never saw it, dude,” said Paladino.
Moments later, at 17:22, N600XL touched down on the runway, applied the brakes, and rolled to a stop, upright and in one piece. A cheer went up in the cabin — they had made it.
“Fuckin — we’re alive!” Paladino shouted. “Fuck you!”
◊◊◊
From the moment of landing, the pilots and passengers continued to speculate about what they had hit. Was it a military plane? Some kind of falling debris? Nobody had seen it. “If we hit another airplane, there’s another airplane out there in trouble,” Lepore said. Later, Paladino speculated that the controller had been trying to contact him to get them to descend out of the mystery plane’s path, correctly pointing out that he had never been given any other altitude. “They forgot about us,” he said, summing up his theory.
“I’m worried about the — if we hit another airplane…” Lepore added.
“A condor?” a passenger speculated.
“At 37,000 feet?” said Paladino. “It was a hard hit though, whatever it was.”
The pilots taxied to the parking area, shut down the engines, and disembarked along with the passengers. From there, they were escorted into the military base, where they explained that they had been involved in a collision.
Two hours passed, as the passengers and crew waited around, unsure what would happen next. They had no idea that at Brasilia ACC, Sergeant de Alencar had noticed the absence of Gol flight 1907, which was supposed to have called him by now. As calls to the 737 went unanswered, he contacted his supervisor, and the situation escalated up the chain of command. Search and rescue teams were launched toward the airliner’s last known position. It was then that they heard a disturbing report: N600XL had landed at Cachimbo after having been apparently involved in a mid-air collision. It was immediately obvious what had happened.
Minutes later, Lepore was given a phone with the regional ATC commander on the line. The commander asked where the collision occurred, at what altitude, and finally, whether the TCAS was turned on.
“No,” Lepore replied.
“Not… hello?” said the commander.
“No, it wasn’t.”
“No TCAS?”
“TCAS was off…” Lepore said, then suddenly added: “TCAS was on.”
“Okay, was on, but no signal was reported?” the commander asked.
“No, no, we didn’t get any warning, no,” said Lepore.
The question of why Lepore suddenly changed his answer would haunt the case for years to come. Was he lying about the status of their TCAS? Had someone told him to lie? The cockpit voice recording would later suggest that they knew TCAS was off — a fact which the pilots still deny to this day.
◊◊◊
The following morning, search crews spotted the scattered wreckage of Gol flight 1907 deep in the rainforest in the Kayapo indigenous territory. Teams of rescuers rappelled down to the center fuselage section, which lay inverted amid the flattened trees, its extended landing gear pointing skyward in a testament to the pilots’ last, desperate attempt to regain control. It was obvious that there were no survivors.
At Cachimbo airbase, the pilots were told that a 737 had gone down in the Amazon. It was the plane with which they had collided. It was a devastating blow — everyone present was distraught. “If anybody should have gone down, it should have been us,” Captain Lepore is said to have lamented. How had their tiny business jet landed safely while an airliner full of people crashed with the loss of all hands?
Answering that question, and many others, would fall to Brazil’s military-controlled Aeronautical Accidents Investigation and Prevention Center, known by its Portuguese acronym CENIPA. Their investigation would come to a number of key conclusions about the complex sequence of events which led to the crash, but would also stir controversy with its analysis of the actions of two key players: Joseph Lepore and Jan Paul Paladino.
In CENIPA’s view, the most critical errors were made by the air traffic controllers — not one of them, but several, one after the other. In total, they identified 18 errors of procedure and judgment by ATC personnel, committed by nine different people. First, the ground controller in São José gave N600XL a poorly worded clearance which effectively authorized the pilots to fly all the way to Manaus at 37,000 feet, even though this would route it against oncoming traffic after passing Brasilia. Next, the sector 5–6 controller handed the flight over to the sector 7–9 controller unreasonably early and without first ordering the plane to descend to the proper altitude for an aircraft traveling northwest on the UZ6 airway into sector 7. He also gave it the wrong frequency, for sector 9 rather than sector 7, which would later cause the plane to fly out of radio range.
Then the sector 7–9 controller, Sergeant dos Santos, incorrectly assumed that N600XL had already been cleared down to FL360 after he misinterpreted the cleared/requested altitude field in the Legacy’s data block, then failed to verify that the plane was complying, even though its actual altitude continued to show “FL370” for several more minutes. He then failed to notice that N600XL had lost its transponder, failed to call the airplane to verify its altitude despite having no direct confirmation that it was descending, and told his replacement that it was at FL360 without having confirmed whether this was true.
His replacement, Sergeant de Alencar, exacerbated the situation by failing to apply the loss of radar/radio contact procedures after he noticed that N600XL had lost its transponder and was not responding to radio calls. This was especially important because the plane was operating under the provisions of Reduced Vertical Separation Minima, or RVSM, which allows planes equipped with modern navigation technology to fly at altitudes 1,000 feet apart along the same airway. Without this equipment, which includes the transponder, planes at high altitudes must be separated by at least 2,000 feet vertically. Therefore, when de Alencar failed to contact N600XL to verify its altitude, he should have coordinated with the Amazon ACC to ensure that oncoming traffic was at least 2,000 feet above or below N600XL’s presumed flight level, but this was not done. In fact, even though N600XL was not responding to radio calls and was appearing only intermittently on primary radar, he ignored the flight for 19 minutes before finally attempting a blind radio call containing frequencies on which to contact the Amazon ACC.
If Paladino had heard this transmission correctly, he might have managed to contact Amazon ACC to report his altitude, at which point the controller might have realized the conflict with Gol 1907 in time to order N600XL out of its way. It would have been tight, but there was time. In the event, however, the transmission lacked sufficient clarity, and Paladino made several calls on the wrong frequency. Those few calls he made on the correct frequency were tragically stepped on by other aircraft, including one which was heard in the Gol cockpit — although the 737 pilots had no idea of its significance. Amazon ACC, for its part, made no attempt to contact N600XL, even though it was for all intents and purposes a rogue aircraft — certainly an error of judgment.
At that point, the collision became inevitable, as there was no way for either crew to see each other. With a combined closing speed of 1,600 kilometers per hour, the planes came up on each other so quickly there was no time to spot the other coming, and in fact no one on either plane ever saw the other.
As for why the controllers made these mistakes, some of which were quite egregious, we can only speculate. Due to threats of prosecution, none of the controllers agreed to be interviewed by CENIPA, and their side of the story has not been told. CENIPA did note, however, that controllers in Brazil’s military-operated air traffic control network were underpaid, overworked, and afflicted by stress which degraded their performance. Furthermore, training had lapsed due to a lack of staff to provide it, and five out of six controllers who spoke to N600XL had failed their most recent English proficiency exams. On top of this, they had to deal with faulty equipment, bad infrastructure, and constant failures, some of which contributed to the accident — for example, if repeaters for the sector 7 frequencies had been properly hooked up to the ACC, and if frequent radar outages had not lulled controllers into the belief that a loss of radar contact was normal, then perhaps things would have ended differently.
That was the story of how the two planes ended up on a collision course, but even so, both planes were equipped with the latest traffic collision avoidance systems, which should have kicked in to avert the disaster. From the data, however, it was plainly apparent that TCAS failed to provide a warning to either crew because the Legacy’s transponder was off. Why this happened became a subject of considerable debate.
One theory was that the equipment failed in some way. Investigators ran extensive tests on every element of the transponder and TCAS systems, and even tried pressing random buttons in rapid succession in an attempt to induce a failure, but everything checked out — no flaws were found.
Another theory was that the pilots turned it off deliberately. This theory gained considerable traction in the media after radar records of the flight appeared to show N600XL climbing and diving wildly in the hour before the crash. Lepore and Paladino were pilloried in the Brazilian press, accused of turning off their transponder in order to hide the fact that they were “stunting,” testing the limits of their brand new, high performance jet. CENIPA, however, quickly refuted this — the Legacy’s flight data recorder showed it never left 37,000 feet, nor did the cockpit voice recorder provide any evidence that the pilots purposefully deactivated the transponder. This theory was therefore discarded.
Yet another possibility was that one of the pilots, probably Captain Lepore, had accidentally deactivated the transponder with his foot while using the footrest improperly. The Legacy 600 was equipped with pilot footrests just below the instrument panel, inches away from the radio management units which controlled the transponder. In theory, if a pilot were to place their foot outside the protected foot guard enclosing the footrests, their toes would be in close proximity to the buttons on the RMU.
There were some problems with this theory, however. For one, switching off the transponder required pressing not just one button, but two: first, they would have to press the line selector button for the line containing the transponder status, and then press the same button again within 20 seconds, which would switch the transponder to the previous active mode, which would have been standby because that was what was used while on the ground. Investigators were skeptical that a pilot could accidentally hit the button twice within 20 seconds, and their skepticism only grew after an ergonomics test suggested that reaching the RMU buttons required unnatural leg and foot movements. In tests, investigators were only able to reach the buttons by intentionally twisting their feet in an uncomfortable manner. Furthermore, the pilots denied ever using the footrests during the flight. As a result, CENIPA ruled out this theory as well.
Separately, investigators with the United States NTSB and FAA also tested this theory, and were much more hesitant to discard it. In their view, with the seat positioned just right, it would be logical and comfortable for a pilot to place their foot outside the foot guard in close proximity to the RMU buttons. As a result of this finding, the FAA issued a new rule strengthening design requirements intended to keep pilots’ feet away from the cockpit controls.
Ultimately, CENIPA preferred a different theory: that Captain Lepore had accidentally shut off the transponder while trying to familiarize himself with the cockpit systems. At the moment the transponder switched to standby, the pilots had just concluded 1 minute and 44 seconds of silence with a brief exchange concerning their fuel levels. One of the functions of the RMU display was as a backup to the main flight display, in that both can present a number of different pages containing various parameters, such as fuel status, engine performance, and TCAS information. If Lepore tried to navigate to the fuel page using the RMU, then pressed the wrong buttons while navigating back to the home page, he might have inadvertently turned off the transponder. As evidence for the theory, CENIPA cited Lepore’s inexperience on the Legacy 600, and indeed the cockpit voice recording showed he was still familiarizing himself with many aircraft systems. For their part, both pilots denied that they turned off the transponder intentionally or unintentionally.
CENIPA did not ding the pilots for accidentally turning off the transponder, but they did criticize them for failing to notice. In total there were six directly visible indications that the transponder and TCAS were off — eight if the pilots had selected the TCAS page on their main flight displays — but they somehow never saw any of them. Although the “STANDBY” and “TCAS OFF” messages were not very eye-catching, investigators felt that given the time available — about 54 minutes — they should have eventually spotted them if they were regularly scanning their instruments. In this regard, CENIPA accused the pilots of displaying poor airmanship and crew resource management by allowing themselves to become distracted by lower priority issues and off-topic conversations without ensuring that someone was monitoring the instruments at all times. Nevertheless, they recommended that in the future, the deactivation of the transponder should be accompanied by an aural warning.
CENIPA investigators also pointed out that the pilots allowed themselves to fly for an unusually long time at a non-standard altitude without attempting to contact air traffic control. Indeed, neither pilot touched the radio between 15:51 and 16:48, a period of 57 minutes. This extraordinary silence ate up time which could have been spent clarifying their cleared altitude and ensuring that they were on the correct radio frequency. However, this fault also applied to the air traffic controllers, who did not attempt to contact N600XL at any point between 15:51 and 16:26, by which time it was already out of radio range on 125.05.
In its final report, CENIPA also argued that the pilots were not sufficiently prepared for the flight, and that this lack of preparation contributed to the accident. In their view, the rushed departure, on the same day as the delivery ceremony, left the pilots with insufficient time to review the flight plan and brief the expected route. Had they studied the plan more carefully, they might have been hesitant to accept the notion that they were cleared all the way to Manaus at 37,000 feet. Furthermore, the pilots spent a large portion of the flight, including the period during which the flight plan called for a descent, working with the laptop to try to calculate their landing and takeoff margins for Manaus. This is normally done before the flight, but was being handled in the air. And on top of that, the pilots had not yet familiarized themselves with all of the Legacy’s systems, as evidenced by their comments regarding the performance software, FMS, and radio equipment. Collectively, these issues created distractions which, in CENIPA’s view, led to the pilots’ failure to notice that their situation was becoming increasingly abnormal.
Investigators from the US National Transportation Safety Board, who participated in the investigation on behalf of Boeing and ExcelAire, agreed with the basic facts but challenged CENIPA’s interpretation of the role of the Legacy pilots. In the NTSB’s view, it was true that the pilots missed opportunities to possibly prevent the accident, but they did not actually violate any rules, which means that according to proper investigative practice their actions could not have been considered a contributing factor. The NTSB pointed out that the pilots fully complied with all ATC instructions, and although some of those instructions were questionable, there was no requirement or even necessarily any expectation that they would challenge them. And while the failure to notice that the transponder was inactive did play a role, the NTSB did not believe that this had anything to do with the pilots’ level of preparation, and cited a lack of evidence for CENIPA’s assertion that insufficient systems knowledge led to the inactivation of the transponder in the first place. In conclusion, the NTSB wrote, the main cause of the disaster was the failure of the ATC services to do their almost sole job, which is to prevent airplanes from colliding. Contributing to this failure were several head-scratching features of the ATC equipment, including the “cleared flight level” field which could switch to “requested flight level” without warning, and the automatic deferral to 3D radar, which was unapproved for ATC use, in the event of a failure of the secondary radar. To this, they added that CENIPA did not thoroughly analyze the systemic factors that led to the series of grave mistakes in the Brasilia ACC, noting that so many errors spread across so many people could only be indicative of cultural rot at a high level within the organization.
Others were a little more direct in their criticism of the final report: the industry periodical Aviation Week noted that CENIPA and the ACC were both run by the Brazilian military, and that a lack of political independence limited the investigators’ willingness to look into systemic problems within the army.
◊◊◊
As the investigation got underway, a parallel series of criminal cases was also initiated, against the wishes of the safety investigators. Prosecutors charged several air traffic controllers including Jomarcelo dos Santos and Lucivando de Alencar with various crimes including endangering an aircraft, which was roughly equivalent to negligent manslaughter. Although the passengers on board N600XL were allowed to go home, Joseph Lepore and Jan Paul Paladino had their passports confiscated and were confined to a hotel in Rio de Janeiro, despite not having been charged with a crime. In December, a court ruled that there was no legal basis for their detention in the absence of charges, and the pair were allowed to return to the United States — although police attempted to stop them by issuing a hastily-written charge of “endangering an aircraft” for failing to notice that their transponder was off. Nevertheless, they were able to fly home to New York, and they never returned to Brazil. Both pilots were later convicted in absentia, and several of the controllers were handed prison sentences as well.
Safety experts lamented the prosecutions as not only unjust, but counterproductive. In fact, the criminalization of the accident greatly interfered with the investigation, as lawyers for the parties involved advised their clients not to speak to CENIPA due to a lack of assurance that their words would not be used against them in court. Consequently, CENIPA was unable to interview most of the air traffic controllers, and the Legacy pilots agreed to speak only to the NTSB, which then forwarded the interview transcripts to CENIPA. This was a perfect illustration of why prosecuting aviation professionals who make mistakes can lead to missed opportunities to improve safety — in fact, if the controllers had felt comfortable talking to CENIPA, then the real reasons for Brazil’s crumbling air traffic control network might have been revealed sooner.
Instead, nothing immediately changed, and these deficiencies soon spiraled into a full-blown national crisis. Incensed by the prosecution of their colleagues and their superiors’ lack of interest in improving safety, the military controllers initiated a work slowdown, causing massive delays throughout the network. When this failed to move Brazilian authorities, some of the controllers began to strike, which was met with accusations of mutiny. Under pressure, Brazil’s president Lula promised to demilitarize the air traffic control network and set up a civilian system. But Brazil’s history of military coups loomed large, and in the end Lula balked, backing down on his word. Instead, the army cracked down, and 98 controllers were either fired, sued, or jailed for participating in the slowdowns and strikes. Of course, this did nothing to correct the situation, which only continued to escalate until the majority of flights in Brazil were suffering from delays of over an hour, sometimes much more. Even after TAM Airlines flight 3054 crashed in São Paulo in July 2007, killing 199 people, the political will to fix Brazil’s aviation infrastructure was nowhere to be found. The crisis was only resolved with considerable time and effort, as slow improvements were made, until eventually some of the basic deficiencies in terms of infrastructure and funding were rectified. Nevertheless, Brazil’s air traffic control network is still run by the military to this day, leading to continued concerns about accountability.
◊◊◊
Following the accident, N600XL sat on the apron at Cachimbo airbase for over four years, until it was repaired, reregistered, and flown back to the United States in November 2010. A couple years later, it was sold to a company in Mexico, which has owned it ever since. As of 2019, it was still listed in the company’s fleet, and appears to be still in service.
As for Gol flight 1907, much of the wreckage is still at the crash site, slowly being reclaimed by the jungle into which it fell. The 737’s thunderous passing made a mark not only on the remote indigenous community where it came down, but also on Brazil as a whole, traumatizing a nation and creating a cycle of bad blood and recrimination which never saw a satisfying conclusion. And to think that so much suffering would have been avoided if one of the aircraft had been a mere two meters higher or lower!
The nature of the collision highlights a potential dark side in the incredible advancements which have been made in modern navigational technology. In a morbid sort of way, the disaster was a marvel of engineering — beginning hundreds of kilometers apart, two aircraft, both on autopilot, were able to adhere so closely to an imaginary airway at such a precise barometric altitude that they plowed directly into one another, like two speeding bullets meeting in midair. Forty or fifty years ago, such a collision would have been highly improbable, simply because lateral and vertical navigation equipment lacked the required accuracy. Perhaps 99 times out of 100, the two planes would have sailed past each other at 100 or 200 meters’ distance, unaware of the other’s presence. Of course, there are fewer midair collisions today than there were then, for a variety of reasons. But the collision over the Amazon remains striking in its precision. Indeed, Gol flight 1907 and N600XL were the only planes for dozens if not hundreds of miles in any direction, and yet they collided, because amid all that empty sky, they insisted on occupying the same space at the same time. Today, this issue is increasingly mitigated through the use of strategic offsets, in which planes purposefully fly some distance to one side of an established airway in order to reduce the chances of exactly this sort of accident. Still, the story continues to haunt us, because it reminds us that sometimes, the improbable still happens, no matter how many barriers we erect against it. The collision could have been prevented in a hundred different ways, and yet fate intervened, over and over, until no more protections remained. The odds that controllers would put two planes on a collision course, radio contact would be lost, and TCAS would fail, all at the same time, were infinitesimally small. And yet it still happened, leaving us amid the ashes of tragedy, always wondering why.
_______________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
(NEW!) Follow me on Twitter
Visit r/admiralcloudberg to read and discuss over 230 similar articles
