ATC and TCAS

 

 

 

 

Lessons Expensively Learnt

 

 

 

 

 

 

 

 

 

 

 


The German Midair – Lessons to be Learned

By now most of us have seen the press and industry accounts of the tragic midair collision between a DHL 757F and a Bashkirian Airlines Tupolev 154 over southern Germany, killing all 71 aboard both aircraft. Like many accidents, it resulted after a chain of events, any link of which, if broken, would have prevented the accident. And the scenario leading up to the collision was eerily similar to an event in the skies over Japan in January of 2001.

 
The latest RA I had was this situation where normally an aircraft was descending to level 110 and the other one (not on my freq) cleared to climb to FL100. The trouble was that the pilot (an American) was climbing to 10 000 feet on the QNH, which was pretty high that day:1028. And as this plane had been on another frequency I had absolutely no way to know or even have a clue of what was happening, so when I heard this "TCas Climb" I was surprised, maybe shocked ...but happy afterwards that the pilot followed his TCAS RA.

We have to remind ourselves that TCAS is not meant to provide separation (the way controllers see it, (like 3NM or 1000 ft) but to prevent collision. The Uberlingen collision has taught us that: whether you're pilot or a controller, don't ever argue with TCAS!

The problem of TCAS awareness for controllers is linked to the very short term action of a TCAS RA, which doesn't really leave enough time for the pilot to advise ATC of the RA in a timely manner. In fact, when a pilot hears a resolution, he is only 30 seconds away from collision, so definitely his first priority is to take action and unfortunately not to advise ATC. That's where, as someone has already said, a special and automatic squawk could be useful but then, still it would depend on the speed of the ATC radar sweep and range-scale.

One last thing, to those who have read the report from Uberlingen, one thing noticed is the that the Tupolev crew numbers five . Can you imagine the complexity of CRM between five ? It might have played a minor role in this - but it also emphasizes the responsibility of the Commander.

As of this writing, this much is known:

- Both aircraft were operating at the same Flight Level (FL360) in European RSVM airspace (1000’ vertical separation). Both aircraft were equipped appropriately for participation in Europe’s RSVM airspace ( CADC’s, servoed altimeters, etc., and TCAS (version 7.0 – see sidebar)).

- Both aircraft had been handed off to “Skyguide”, the Swiss ATC agency controlling southern Germany.

- Just prior to entering Skyguide's airspace, the “conflict resolution” software function of the enroute radar was turned off for routine maintenance. Existing Skyguide regulations call for two controllers to be monitoring airspace under these circumstances, and increased

Many RAs (probably much more than 50% of them) are "nuisance advisories" and occur when ATC have provided the correct separation. In an en-route environment, this may merely be an minor annoyance, because it's quite unlikely that there'll be anything else in your way. In a terminal environment however, a nuisance RA can quickly put an aircraft in much more danger than it was in before TCAS intervened.

The ENIGMA

 lateral separation. One of the two controllers on duty was on break during the accident sequence.

- Parts of the main telephone system at Skyguide were also down for maintenance at the time of the accident sequence.

- The one controller on duty was working an enroute sector and an approach sector at the time of the accident. There were problems related to the phone system in contacting the tower of the approach sector.

- An adjoining sector (Karlsruhe ATCC) was warned of the impending loss of separation by its conflict alert system. When it observed no action being taken, they attempted, with no avail, to contact Skyguide (phone problems).

- Both aircraft received RA’s (TCAS Resolution Advisory) as designed – The Russian aircraft was instructed by TCAS to Climb, the DHL to descend. The DHL aircraft started its descent and transmitted so to ATC. Almost simultaneous with the initial TCAS issued RA to climb, the Russian aircraft was instructed by ATC to descend. There was a repeated ATC instruction, and the Russian aircraft descended to comply with the ATC instruction, overriding the TCAS RA command to climb (however, the latest information showed the Russian aircraft climbing 100 feet prior to the descent – possibly indicting that the aircraft initially responded to the RA, and then chose to descend on ATC command)..

- Unfortunately, the lateral geometry was perfect for the collision (more on this later).

Break any of the events in that chain, and the accident would have not occurred. Or, had the lessons of the Japanese extremely near miss the previous year been widely disseminated and trained for, this event may not have occurred.

The Japanese Near Miss


On January 31, 2001, JAL Flight 907, a Boeing 747, had departed Tokyo-Haneda with a destination of Naha. JAL Flight 958, a DC-10, was en route from Pusan to Tokyo-Narita. A trainee controller cleared flight 907 to climb to FL390. Two minutes later, JAL958 reported at FL370. 

Both flights were on an intersecting course near the Yaizu NDB (near Suruga Bay). The controller noticed the imminent conflict, but instead of ordering Flight 958 (DC-10) to descend, he mistakenly ordered Flight 907 (747) to descend. Immediately after this instruction, the crew of the flight 907 (747) were given a aural TCAS Resolution Advisory to climb in order to avoid a collision. At the same time, the crew of Flight 958 (DC-10) were given an aural TCAS advisory to descend. The captain of flight 907 (747) followed the instruction of the air traffic controller to descend instead of his TCAS RA to climb. A collision was averted when the pilot of the 747 put his aircraft into a steep descent (fortunately there was visual contact with other aircraft). The 747 missed the DC-10 by 105 to 165 meters in lateral distance, and 20 to 60 meters in altitude difference. About 100 crew and passengers aboard the 747 sustained injuries due the emergency maneuver.

What makes it worse is that the JAL incident occurred in Jan 01, with the Japanese authorities drawing the attention of ICAO to the incident and asking for guidance. ICAO responded guess when, August 02, one month after Ueberlingen.

Yet another Missed Opportunity to break the causal chain



PROBABLE CAUSE: The Aircraft and Railway Accident Investigation Commission concluded that the air traffic controllers error and the pilots decision to follow air traffic control instructions instead of the TCAS Resolution Advisory (RA) were the two main causes.


Lessons to be learned

The major lesson to be learned from these events is:
:
ALWAYS FOLLOW THE INSTRUCTIONS ISSUED IN A TCAS RESOLUTION ADVISORY (RA)

If your TCAS issues a RA, Air Traffic Control has already failed. At this point, the TCAS system is infinitely more valuable than ATC’s instructions. Most enroute radars have update rates between 6 and 10 seconds – the information your TCAS is providing is much more timely and, by design, training, and regulation, takes precedence over ATC commands.

Both the Russians and the Japanese, in their respective accident/incident, believed that ATC commands had priority over TCAS commands and were apparently trained accordingly. My guess it that this will be a favorite training scenario with many airlines around the world in the very near future.


THE ONLY WARNING THAT HAS PRIORITY OVER A TCAS RA IS A GPWS/EGPWS WARNING.

According to Honeywell, for TCAS to do its job properly and insure separation, an RA must be complied with within 5.0 seconds and a G loading (+/-) .25 G’s. If an RA command is reversed (version 7.0), compliance requires a response within 2.5 seconds and a G loading of (+/-) .35 G’s . The autopilot should be turned off to accomplish an RA maneuver.

Some other considerations when using TCAS:

- Today’s avionics suites provide such precise lateral navigation, that in some ways it may contribute to the possibility of a near miss/midair with

On a number of occasions I've seen serious incidents caused by TCAS when aircraft started off properly separated. Example: DC-10 was cleared to 4000 ft and pilot announced "TCAS, descending". The only traffic within several miles of that aeroplane was one climbing to 3000 ft underneath. TCAS, not knowing that the outbound was going to stop at 3000 ft and the inbound at 4000 ft had decided that the best action was to get the DC10 down fast - the wrong decision because what was a 100% safe situation developed into a loss of separation.

I have also experienced TCAS RAs causing loss of separation in holding patterns - where an inbound a/c joining a hold is descending rapidly... and also with outbound a/c climbing up rapidly under a holding pattern. Until there is data exchange between the ground and the TCAS such incidents will continue.

TCAS is a most useful tool which has undoubtedly saved lives, but please don't ever in your wildest dreams believe that every RA is caused by an ATC (or aircrew) foul up.

But Nothing is ever (or always) so clearcut

 lack of vertical separation. Some routes/procedures may allow for offsets.

- Always communicate as soon as possible to ATC that you are climbing/descending in response to a Resolution Advisory. Future plans are for Mode S/ADSB transmission to ATC of an RA and it’s command, but for now, ATC has no idea why you are climbing/descending in response to a TCAS command.

- Do not try to use TCAS for lateral separation maneuvers. TCAS was designed
for vertical separation maneuvers only. Limits on current generation TCAS
antennae’s and processors allow for approximate azimuth information (may be
up to 30 degree error in azimuth at close ranges).

- While TCAS version 7.0 eliminates many of the false warnings associated with earlier versions, it is still recommended, particularly in 1000’ separation RSVM airspace, to have a reduced rate of climb/descent for the last 1000 feet of one’s climb/descent to assigned altitude, to prevent a possible overshoot and possible issuance of a RA (version 7.0 adds a slight time delay to avoid false warnings).

- Unfortunately, our current TCAS installations (747,757/767, most 727’s) have limited
range display capabilities. While the software is looking out to the maximum range of TCAS design, the crews cannot see a conflict developing as they could on a longer range display. The 757/767 fleet is due to be upgraded shortly with a longer range display.



- The first response to a “traffic, traffic” TCAS TA (Traffic Advisory) warning should be an attempt to visually identify the other aircraft. Keep in mind that azimuth information displayed on your TCAS display may be up to 30 degrees off.

- As reported in a previous article on runway incursions, there is a documented TCAS “save” by using TCAS information in a way not intended by the original designers. After the runway collision in Linate, Italy between a Cessna Citation and an SAS MD-87 in low visibility, the tower controller, unaware of the collision on the runway, issued a takeoff clearance to a Lufthansa jet. The Lufthansa crew did not observe the just departed SAS aircraft on its TCAS, and queried the controller as to its whereabouts. It subsequently refused takeoff clearance, almost certainly saving another collision (wreckage was on the runway).

As always, the Aircraft Operating Manual is the primary source for operating procedures for the TCAS unit and procedures installed on your aircraft. Currently, the procedures outlined in the 757/767 A.O.M. are:

TA’s – PF observes TCAS display and begins visual search. PNF calls out range, bearing and altitude of the intruder and joins visual search.

RA’s – PF clears airspace when conducting avoidance maneuver and alters vertical speed to move VSI needle out of the red and into the green “fly to” zone. PNF continues visual search, monitors intruder position on TCAS and verifies that PF is correctly following the RA. PF expeditiously returns to assigned flight path when clear of conflict (note: to prevent additional TA/RA from not being at assigned altitude).

A Relevant ARINC Link (pdf) (TCAS Industry Alert Bulletin - August 12, 2002)

from this link (by Shore Guy)

 

From an ATC point of view, the situation in which the controller found himself that night was a total management failure. Alone with a degraded radar system, main telephone out of service, wrongly programmed back up telephone, unscheduled inbound to a normally closed airfield at night forcing him to open a separate position with a different frequency , leaving him 2 frequencies and 2 radar pictures to monitor on 2 positions several meters apart. Short term conflict alert disabled, etc…
 

He spotted the conflict late, issued an "expedite descent" clearance to the TU154 ( as it was anyway coordinated lower with adjacent centre) and when he saw the Mode C of the TU154 winding down , he considered the problem solved. What he did not know is that the 757 had already started his descent as the radar return rate on that degraded mode was very slow. The 757 FO was PNF ( doing the R/T) and had left the cockpit leaving the Capt alone at the time of the RA, so he did not warn ATC immediately. When F/O came back 23 seconds later, he informed ATC using a wrong call sign, but irrelevant since the transmission was blocked by the A320 inbound to FH on the other frequency. (the controller later admitted he did not hear the 757 call ).
There you go.
Without knowing that any of the aircraft was following an RA , the ATC clearance issued was a solution that should have solved the conflict in the mind of the controller.
But even If both pilots had reported they were following an RA, the controller would have said nothing as ATC is supposed to stop issuing instructions (and be responsible for anti collision) after that point .
Without ATC , no collision. without TCAS no collision, if they would have been IMC , probably no collision.
Small things , errors, or small deviations from procedures, insignificant if taken in isolation ,are causing a tragedy when put in a certain sequence. Mixing automated systems with humans decisions is not and never will be a good choice.

Are we so sure this will never happen again ? I doubt it.

TCAS is far from being perfect and will contribute mathematically to more collisions. ( I recall hearing from MITRE Corp in the US, the owners of the software, something like for every 30 collisions it saves, TCAS will cause one ).

BFU Factual Report link         Dealing with Risk in Air Traffic Control (and Other Safety Fables)  link

two prior links ONE TWO