Cessna 208 flaws?

Automation’s Unintended Consequences

At 0150 on Aug. 6, 1997, Korean Airlines Flight 801 slammed into a hill 3.5 nm short of Runway 06L at Agana, Guam. The crash, which occurred while the crew was conducting a nonprecision localizer DME approach in darkness and rain, claimed 229 lives. Several causal factors played a role in this accident, including distraction caused by a false glideslope indication, flight crew fatigue, poor visibility and late completion of the checklist, but the most damning finding of all was that there had been no minimum safe altitude warning (MSAW) alert provided to the controllers or crew because the software had been deliberately altered to prevent "nuisance alerts."

 

 
At the resulting NTSB hearings, the FAA Air Traffic Service was strongly chastised for the failure to provide MSAW coverage as a final backup that would have likely prevented this accident. An investigation of other airports in the United States discovered six more sites where the MSAW had been disabled. MSAW capabilities were subsequently reinstated at all those sites, including Agana.

At 0335 on Dec. 17, 2002, it was déjà vu all over again. Philippine Airlines Flight 110, an Airbus 330 bound for Agana in clouds and darkness, snapped off two power lines connected to 35-foot-high poles during a go-around following a GPWS "Terrain, Terrain" alert. The impact point on the power lines was located very near the KAL 801 crash site. The glideslope and DME were out of service and PAL 110 was conducting a localizer approach to Runway 06L.

This time the MSAW was operational and provided an aural and flashing MSAW alert for the controllers from 0334:25 until 0335:45 when the aircraft began its missed approach. However, neither the approach nor tower controller provided any warning to the crew. It was only because the GPWS sensed a high closure rate with Nimitz Hill, approximately 500 feet above airport elevation, and because the captain executed an aggressive pull-up that the approach resulted in an incident rather than another tragedy. The second approach was successful, and after landing the aircraft took on passengers and returned to Manila. Landing gear and aft cargo door damage was reportedly discovered after arrival back in the Philippines.

Before the crash of Air China Flight 129 in Busan, Korea (see "Circling Traps," B/CA, September 2002, page 90), there was reportedly an MSAW alert displayed to the military controller that was not relayed to the civil ATC controller or the crew.

An Egypt Air B-737 crashed on May 6, 2002, near Tunis during an approach to Runway 11. The aircraft impacted the crest of a 700-foot hill and rotated 150 degrees from the approach course. Algeria is listed as a country that has and uses MSAW capabilities, but there were no reports of a warning given to this crew that the velocity vector that existed prior to the crash would take them into terrain four miles short of the runway.

There have been at least eight ASRS reports of aircraft going well below proper glidepath during visual approaches to Tucson’s Runway 11 on clear, dark nights. This is a classic "black hole approach." Most of the errant flights were saved by EGPWS alerts, but not one crew was advised by Tucson controllers that their aircraft was on a velocity vector that could take them into the mountains northwest of the field.

Some safety-conscious airlines have made it a crew requirement to maintain IFR coverage at night until 3 nm on final at Tucson. This keeps the ATC controller in the loop, requires that MSAW protection is provided, and prevents inadvertent landings at Davis Monthan AFB. There are other airports with similar hazards where this is a good SOP.

Dissecting MSAW

MSAW can be provided if ATC is equipped with an Automated Radar Terminal System and a three-dimensional grid map stored in the computer. The complete package is called ARTS III. It works with aircraft altitude reporting from Mode C transponders and uses a terrain-monitoring program activated in the computer. It looks at aircraft altitude, trajectory and rate of change toward the highest point in grids 2 nm per side for 4-square-mile blocks of airspace out to a 60 nm radius. It will warn if the present velocity vector will take the aircraft less than 300 feet above the highest altitude in the block within the next 30 seconds.

The second feature of MSAW is approach path monitoring. It looks at a box, 1 nm either side of the approach path from 5 nm into 2 nm for a velocity vector that predicts the aircraft may go below minimum descent altitude by 100 to 200 feet if the descent is not arrested.

Thus, MSAW provides approach controllers and tower operators with a timely warning if aircraft terrain clearance is threatened. It is fairly easy to implement on many of the world’s existing approach control radars.

MSAW has shortcomings. It generates nuisance alerts if it is not programmed correctly. Coverage ends at 2 nm from the runway because of the system’s inability to provide timely warnings from altitudes below 600 feet while descending. It has a slow update rate of six seconds due to an antenna sweep rate of 10 rpm. In addition, warnings are required only under IFR, so no warnings will be provided after the pilot has accepted a visual approach unless the pilot asks for MSAW monitoring.

It’s important to note that many controllers do not want the responsibility for providing aircraft terrain clearance, especially in those countries where the civil aviation regulations state that it is the pilot’s responsibility. It is, and always has been, the pilot’s responsibility to provide terrain clearance, but since controlled flight into terrain (CFIT) is still one of the biggest killers in aviation, it is obvious that we pilots can use some help.

But why are controllers reluctant to use MSAW since doing so can prevent accidents? This question kept nagging at me when I was doing research for an international aviation safety presentation hosted in Athens in December 2003 by the Greek equivalent of the U.S. NTSB and attended by Hellenic CAA, Air Traffic Services, and military and civil aviation operators. At the end of my research I concluded that controllers eschewed MSAW because changes in aircraft performance and procedures have had some far-reaching unintended consequences. In today’s aviation environment we are all interdependent and a change in any one entity will cause ripples affecting all of the others. I surmised that a seemingly minor change in instrument flight procedures had a major impact on MSAW effectiveness as well as on other areas yet to be discussed.

When I began flying in 1960 there was a requirement to limit rate of climb or descent to 1,000 fpm or less for the last 1,000 feet of altitude before level-off. That’s what was taught and published in the Airmen’s Information Manual until about 1984. Around that time, there were a large number of altitude busts and widespread industry concern about possible midair collisions if the trend continued.

Also about that time aircraft fitted with second-generation automation had flight directors and autopilots capable of making smooth level-offs from rates of climb or descent of up to 4,000 fpm. They accomplished this by beginning a rotation designed to level off at the preselected altitude without loading the aircraft beyond +/-0.2 g’s from the g-loads in steady state conditions. But the busts continued.

One of the worst altitude bust offenders during that period was the MD-80. The reason? The autopilot might have started its calculations for the level-off, and by reaching up to change vertical speed to 1,000 fpm for the last 1,000 feet, the pilot would unwittingly wipe out the altitude capture feature. Loss of ALT CAP would go unnoticed many times by the crew and their aircraft would fly through the selected level-off altitude.

The avionics and airframe manufacturers said the rule requiring the vertical speed reduction for the last 1,000 feet was to blame and was really appropriate only to Jurassic jets such as the B-727, which must be flown to the assigned altitude and leveled before ALT HOLD is selected by a separate switch.

At that point the 1,000-fpm rule was eliminated, but the rate of altitude busts changed little as far as I could see. (As a side note, I did a study of one carrier’s automation policies in 1995-1996 when it flew slightly over one million flights. It turned out the airline’s B-727s had the lowest rate of errors, while five other aircraft types, all equipped with second-generation automation, experienced altitude and course deviation errors at a rate 40- to 106-percent greater than the old Boeing trijet.)

Coincidentally during 1984-1986, runway arrival and departure capacity at some U.S. air carrier airports was being sorely taxed by the growth of hub systems that launched and recovered "banks of flights" at about the same time to allow for maximum passenger connections. For hubs to succeed, ATC must get maximum utilization out of the runways. Thus was created the "slam-dunk" approach. And one of the unintended consequences of that action was to compromise the value of the MSAW. Why?

Many slam-dunk approaches triggered warnings because the MSAW sensed velocity vectors that would surely take the rapidly descending aircraft into the ground even though their flight directors and autopilots could make the necessary level-off easily and safely. When, reacting to the MSAW, the approach controllers warned the descending aircraft, the pilots often became indignant. Controllers soon regarded MSAW with suspicion since it continued to sound "false or nuisance" warnings on "normal" approaches.

Another unintended consequence of the cancellation of the 1,000-fpm restriction is an alarming number of "loss of altitude separation" incidents registered by TCAS. When an aircraft makes a rapid descent or climb to an assigned altitude 1,000 feet above or below another aircraft, it can sometimes trigger a TCAS resolution advisory (RA) for both aircraft. Occasionally this starts a domino effect with even more aircraft being instructed to leave their assigned altitudes, thereby creating a collision threat.

This problem could be eliminated by restoring the old instrument procedure requiring altitude changes at 1,000 fpm or less when within 1,000 feet of the assigned altitude. I think the best place to implement the change is in the autopilot/flight director protocols instead of in the TCAS.

Recent TCAS RA changes designed to mitigate this domino effect command the pilot to "Monitor Vertical Speed." This command has not been well understood in several instances and has exacerbated the problem. It would be best to prevent the RA from being required in the first place.

The domino effect of aircraft popping up and down is also a consequence of the increased accuracy of our navigation systems. When I was a tower operator and approach controller for the U.S. Air Force from 1956 to 1959, an ATC system error did not have the serious potential for a midair collision as it does today. Back then the relatively broad tolerances in navigating by VORs and NDBs meant two airplanes could be at the same altitude heading in opposite directions on the same airway and not even see each other. Even if both aircraft were on track and headed directly toward each other, the altimeter tolerance was such that they might miss by a couple of hundred feet. Not anymore!

Aircraft today navigate by GPS and inertial reference systems so accurate that they are essentially flying on wires lined up vertically 1,000 feet apart. A situation such as I described above would result in a nose-to-nose collision if TCAS were not available. To counter this possibility, several pilots I know offset 1 nm right of the cleared route while flying in Africa and Latin America.

Another unintended consequence of TCAS precision is a practice that I observe more and more while conducting airline safety audits. ATC calls out traffic at 2 o’clock and 4 miles. Rather than look out the window, both pilots look at the TCAS display until one announces, "Yeah, there he is." At that point the two go back to what they were doing, scanning the TCAS display until the target blip has passed.

Keep in mind that machinery breaks, but the rules are not suspended as a result. An inoperative transponder was a factor in a recent midair in Florida, and yet both crews were responsible for maintaining a visual lookout and maneuvering to avoid collisions in mixed IFR/VFR traffic areas. A TCAS onboard does not relieve the crew of that responsibility, it just makes it easier.

Don’t get me wrong, I love TCAS, GPS, FMCs and all the automation that goes with them. They have made flying more precise and safer. But change always presents the possibility of being blindsided by an unintended consequence. Sharing the knowledge of some of these effects is a way to prevent them from negatively affecting you. Fly safe! B/CA

Reprinted from the May 2004 issue of Business & Commercial Aviation magazine