GOL Flight 1907: what its investigation teaches about human error and safety barriers

Why study this case twenty years later?

The collision happened on 29 September 2006 and marked twenty years on 29 September 2026. GOL's Boeing 737-8EH PR-GTD, operating flight GLO 1907, met an Embraer Legacy 600 N600XL in an airway over Brazil. The Legacy landed in an emergency; all 154 people on the Boeing died. Respect for them calls for a study free of spectacle and simplistic blame.

CENIPA's Final Report A-022/CENIPA/2008 examines technical, operational, human and organisational factors. Its lasting lesson for occupational safety is methodological: collect evidence, reconstruct decisions and interfaces, test defences, and ask why a deviation was neither detected nor recovered. A one-line verdict about inattention cannot do that work.

CENIPA final report in the NTSB's official docket →

What happened: a concise timeline

PR-GTD was travelling from Manaus via Brasília to Rio de Janeiro with six crew and 148 passengers. N600XL was on a ferry flight from São José dos Campos towards Fort Lauderdale, via Manaus, with two crew and five passengers. At 19:56 UTC they were flying in opposite directions along airway UZ6 when they collided near NABOL at FL370, nominally 37,000 feet.

The Legacy remained controllable and landed at Campo de Provas Brigadeiro Veloso in Pará; its seven occupants were uninjured. PR-GTD lost part of its left wing, became uncontrollable and broke up in flight. All aboard died. CENIPA did not consider weather a contributing factor.

What a safety investigation is for

Brazil's Aeronautical Accident Investigation and Prevention Center (CENIPA) is part of SIPAER, the national accident investigation and prevention system. The report expressly states its preventive purpose: it does not rank degrees of blame or produce evidence to determine civil or criminal liability. ICAO Annex 13 frames aviation investigation around prevention.

Brazilian Law 12,970 of 8 May 2014 later made the preventive objective and the independence of SIPAER investigations explicit in the Aeronautics Code. Chronology alone does not prove that this accident caused that law. Technical, administrative, civil and criminal processes have different questions and can coexist.

Brazil's Law 12,970/2014 →

James Reason is in CENIPA's analysis

CENIPA explicitly says that its psychological analysis used James Reason's organisational accident model. Active failures are actions or omissions close to the operation with an immediate adverse effect. Latent conditions arise in earlier decisions and processes and may remain hidden until they combine with a particular task.

The report separates local work conditions, including tasks and technological or social environment, from organisational influences such as resources, processes and climate. The familiar ‘Swiss cheese’ analogy is useful only if each opening is traced to a real mechanism: an ambiguous clearance, a weak indication, missing context in a handoff, or oversight that did not recover the deviation.

The investigation identified no active failures by PR-GTD's crew or latent failures in that operator's system in this analysis. For N600XL, it recorded inadequate preparation and planning, no pre-departure briefing, an unintentional transponder mode change, failure to notice the condition, and delayed recognition of lost communication. It also examined factors in air traffic control and its organisational setting.

Transponder and TCAS: different functions with a shared dependency

A transponder replies to secondary surveillance radar and, depending on mode, provides identity and altitude. TCAS belongs to the airborne ACAS family and operates independently of ground air traffic control (ATC). It detects transponder-equipped aircraft and can issue traffic advisories (TA); suitable ACAS II versions also issue vertical resolution advisories (RA). Independent of ground ATC does not mean independent of another aircraft's transponder signal.

CENIPA documented a period when N600XL stopped transmitting altitude and its TCAS was inoperative. The crews received no TCAS warning of their convergence. Extensive tests did not find a component fault or design or integration defect in the Legacy systems. Investigators rejected intentional switch-off. They classified the mode change as unintentional, while the precise physical action remained a matter of hypotheses. Saying that the hardware ‘failed’ or that a pilot deliberately turned it off goes beyond the evidence.

FAA explanation of ACAS/TCAS →

Communication, separation and situational awareness

Separation depends on coherent clearances, appropriate levels, surveillance, sector handoffs and two-way communication. CENIPA examined an incomplete clearance, loss of altitude information, indications not noticed, a handoff without the full picture of lost contact, and frequency problems. These are distinct mechanisms, but they met in an operation that needed a recovery path.

Situational awareness is perceiving the state of an operation, understanding its meaning and anticipating what follows. It is not a moral label for an individual. Displays, alarms, task sharing, workload, procedures, training and supervision all shape the information a team can actually use.

Why ‘human error’ is not a sufficient conclusion

Human error may provisionally name an action; it does not explain why it occurred or why other defences did not contain it. If a warning is too subtle, a clearance ambiguous or a handoff omits a known anomaly, the investigation must reach interface design, routines, preparation, oversight and recovery capacity.

Our editorial graphic groups six conceptual layers: planning and briefing; ATC separation and monitoring; transponder and altitude data; communication and handoffs; airborne TCAS indications; detection, supervision and recovery. CENIPA did not claim that all failed in the same way. Some degraded, were unavailable, went unnoticed or could not recover the divergence. The graphic is neither an official CENIPA diagram nor a substitute for its chronology.

What the safety recommendations tell us

CENIPA's recommendations move from diagnosis to training, standards, interfaces and surveillance. These seven representative selections are recommendations issued in the report, not a claim that every measure had been completed by 2026.

Recommendations in the CENIPA report →

• RSV 261/A/06: reinforce prescribed ATC clearance procedures.
• RSV 262/A/06: ensure controllers' English proficiency and the means to achieve it.
• RSV 263/A/06: comply with handoff procedures between units and sectors.
• RSV 100/A/07: develop quality management in ATC services.
• RSV 108/A/07 and 122/A/07: configure and cover the 121.500 MHz emergency frequency.
• RSV 118/A/07: automatically record breaches of separation minima and generate preventive reports.
• RSV 202/A/08: monitor adherence between cleared and actual flight levels and alert discrepancies.

What workplaces can use from this case

For a fall from height, machine intervention or loss of containment, first protect people and preserve evidence. Reconstruct a timeline from logs, interviews, physical conditions and stated gaps. Separate observation from hypothesis, then compare each planned barrier with what was available and effective in the real work.

Examine immediate actions alongside earlier design, staffing, maintenance, alarm, permit, shift handoff, deadline and oversight decisions. Ask why the system failed to detect or recover a deviation. Corrective actions need a mechanism, owner, deadline and field test of effectiveness. A generic refresher course alone rarely repairs a missing engineering barrier.

Aviation rules do not become construction or factory rules. The transferable practice is evidence before conclusion, context before blame and verification after an intervention.

Eight questions for any investigation

Use these prompts in interviews and technical review; tie each answer to evidence or mark it as an open question.

• What should have happened?
• What actually happened?
• Which evidence supports the timeline?
• Which barrier should prevent, detect or limit the event?
• Was it present, available and understood?
• Which conditions made the deviation more likely?
• Why did the system fail to recover it?
• How will we prove the corrective action reduced risk?

Prevention and accountability have different purposes

CENIPA's report is a preventive technical document, not a judicial verdict. Administrative, civil and criminal inquiries have other questions and evidentiary rules. Respecting those distinctions protects learning without preventing other lawful processes.

Brazil's 2014 law makes SIPAER's independence explicit. For occupational safety, the practical lesson is to protect evidence quality and avoid replacing barrier analysis with a premature personal conclusion.

The durable lesson

Safe systems do not assume perfect people. They make important indications visible, tolerate foreseeable deviations, detect dangerous change and create a chance to recover before defences lose effectiveness together. Investigations need to reach the conditions that shaped work, not stop at its final action.

Twenty years later, studying GLO 1907 respectfully means turning a demanding report into better questions and verifiable measures. The memory of the 154 people on board deserves prevention without spectacle.