Navigating Aeronautical Safety–Part 3

My previous posting ended with an incident where the A320 “earned” a nickname from Airbus’s detractors, the Lumberjack:

I think of that video every time I read William Langewiesche’s annoying, insulting pronouncement:

In 1987, Airbus took the next step by introducing the first fly-by-wire airliner, the smallish A320, in which computers interpret the pilots’ stick inputs before moving the control surfaces on the wings and tail. Every Airbus since has been the same, and Boeing has followed suit in its own way.

These are generally known as “fourth generation” airplanes; they now constitute nearly half the global fleet. Since their introduction, the accident rate has plummeted to such a degree that some investigators at the National Transportation Safety Board have recently retired early for lack of activity in the field. There is simply no arguing with the success of the automation.

I’m certain some would argue the Lumberjack is not a fair representation of Airbus products. My response is terse—that’s too damn bad. Air France 296 was merely another example in the far-too-long list of controlled-flight-into-terrain (CFIT) accidents, the unfortunate tendency for airplanes to crash should they fly too close to ground that isn’t suitable for landing.

Cumulus Granitus

A professor once quipped “the most dangerous cloud in the sky is the Cumulus Granitus”…


…it’s the dark formation behind the fog. A common factor in every aviation accident is the aircraft eventually impacts the Earth, and earth will end the machine and its occupants in a hurry. Perhaps the greatest overriding goal in aviation safety is preventing any man-made object that flies from smacking into terrain or water that isn’t intended to be used as a runway.

Automation has been singularly unable to prevent CFIT accidents. Modern avionics for more than four decades has permitted airliners to fly routes with very precise accuracy…right into the sides of mountains. Air New Zealand Flight 901, a DC-10 performing a scheduled Antarctic sightseeing flight on 28 November 1979, plowed into Mt. Erebus:

Due to the inadequacies of 1970s civilian airborne radar (the widebody airliner’s unit could not be used for ground mapping) and a polar phenomenon that now is commonly referred to as sector whiteout, the crew of TE 901 could not detect the mountains despite the excellent visibility. For these reasons, the crew relied on the accuracy of the DC-10’s INS computers


At the time, DC10 jets were navigated by computerised inertial navigation systems that were so accurate that the plane could fly for thousands of kilometres on automatic pilot and be lined up with the runway at its destination with little input by the flight crew. (They did not, however, have the amazingly accurate global positioning satellite equipment of today – systems that probably make a repeat of the Erebus crash impossible.)

Before each flight, the crew programmed the computer with the latitude and longitude of a series of “waypoints” along the intended route, the details being supplied by the airline’s flight operations division.

The waypoints for the sightseeing flights took the jets down the centre of McMurdo Sound to a point west of the airfield near Scott Base. Most flights before TE901, however, were flown manually in the McMurdo area to give passengers the best views. That meant the pilot disconnected the navigation computer before following the programmed track down the sound.

Early on the morning of November 28, the final waypoint for the Antarctic flights was changed by Air New Zealand’s flight operations section from the middle of the sound to a beacon near the airfield. The effect of this change was to shift the flight path 43 kilometres to the east.

In the recriminations that followed, the airline claimed it had merely corrected an “error” and that the McMurdo route itself was a mistake. It said Captain Collins was at fault for disregarding the 16,000-foot safety height, which would have flown it safely over the summit of Mt Erebus.

However, nobody told the crew. It is clear from their comments preserved on the cockpit voice recorder that they believed at all times they were over the sound, not flying toward the mountain.

Peter Mulgrew was heard saying, “Taylor on the right”, a reference to the Taylor Valley, which would have been on their right if flying down the sound, and there were references to Mt Erebus being on the left.

Other flights had enjoyed cloudless, sunny days, but, as TE901 approached Ross Island, the area was covered in cloud. Captain Collins asked McMurdo for a radar letdown, then, when he saw a big gap in the clouds, got permission to descend through it under “visual flight rules”.

It was the diagram in the Chippindale report of this descent, in two large loops, that conveyed the mistaken impression of flying lost in circles, when the DC10 was in clear air at all times.

Once down to 2000 feet, Collins switched back to the computer track, believing it would take him swiftly down the sound to Scott Base. But, instead, he was flying over Lewis Bay, directly at Mt Erebus, which rose, hidden, into the cloud ceiling above the plane.

Both the Chippindale and Mahon reports said the whiteout effect would make it near-impossible for the crew to see the rising ground ahead, while the Mahon report said that the entrance to Lewis Bay looked like the entrance to McMurdo Sound.

Astonishingly, only one crew member had flown on such a flight before, flight engineer Gordon Brooks. He was the only person to voice any concern. Just 26 seconds before impact, he said: “I don’t like this.”

Captain Collins immediately decided to fly away. He was heard discussing with First Officer Cassin whether to turn left or right, when, suddenly, the ground proximity warning system shrieked its terrifying alarm: “Whoop- whoop! Pull up!”

But it was too late. Seconds later, TE901 disintegrated as it hit the slope.

“Whoop- whoop! Pull up!” is the standard phrase Ground Proximity Warning Systems (GPWS) shrieks just before impact (especially if the crew doesn’t understand what the English phrase means). Ground prox relies on radar altimeter (RA) readings to generate the warnings; which, considering RA usually only displays when a distance above the surface of 2,500 feet or less is detected, GPWS is borderline useless when encountering rising terrain:

Not that the uselessness of GPWS pre-1996 is common knowledge. The history of inadequacy and failure has been hidden from view:

GPWSGround Proximity Warning System – A system designed to alert pilots if their aircraft is in immediate danger of flying into the ground or an obstacle. The U.S. FAA defines GPWS as a type of terrain awareness warning system (TAWS). More advanced systems, introduced in 1996, are known as enhanced ground proximity warning system (EGPWS), although sometimes confusingly labeled with the TAWS term.

Sure, TAWS (not the fact that aviation is overrun with acronyms) is confusing. My guess is TAWS confuses pilots only because many airline pilots have never heard the term:

TAWSTerrain Awareness and Warning System – uses a digital terrain map, together with position information from a navigation system such as GPS, to predict whether the aircraft’s current flight path could put it in conflict with obstacles such as mountains or high towers, that would not be detected by GPWS (which uses the ground elevation directly beneath the aircraft).

I myself was unaware of the acronym until I began researching this piece; having been taught the above system is known exclusively as EGPWS…

EGPWS Enhanced Ground Proximity Warning System – Uses aircraft inputs such as position, attitude, air speed and glide slope, which along with internal terrain, obstacles, and airport databases predict a potential conflict between the aircraft’s flight path and terrain or an obstacle.

The EGPWS system monitors an aircraft’s height above ground as determined by a radar altimeter. The EGPWS system was combined with a worldwide digital terrain database and relies on Global Positioning System (GPS) technology. On-board computers compared its current location with a database of the earth’s terrain. The Terrain Display now gave pilots a visual orientation to high and low points nearby the aircraft. The EGPWS improves terrain awareness and warning times by introducing the Terrain Display and the Terrain Data Base Look Ahead protection.

The information is accurate, but it is disconcerting that MSPAero needs to use so many weasel words and advertising tricks that Madison Avenue must be collectively blushing:

Prior to the development of GPWS, large passenger aircraft were involved in 3.5 fatal CFIT accidents per year, falling to 2 per year in the mid-1970s. Since 1974, when the U.S. Federal Aviation Administration made it a requirement for large aircraft to carry such equipment, there has not been a single passenger fatality in a CFIT crash by a large jet in U.S. airspace.

Yes, because an American-built airliner slamming into an Antarctic mountain and another American-built airliner operated by a U.S.-flagged airline named American crashing into a Colombian ridge doesn’t count. This reminds me of the billion-dollar “capability upgrades” the Bradley Fighting Vehicle underwent on account of the Pentagon Wars.

After 1974, there were still some CFIT accidents which GPWS was unable to help prevent, due to the blind spot of those early GPWS systems. More advanced systems were developed. No aircraft fitted with a second-generation EGPWS has ever suffered a CFIT accident.

Well, until AirBlue 202:

12 seconds later, 40 seconds before impact, the autopilot mode finally changed from nav to selected heading mode, the aircraft was tracking 307 degrees at that point, the selected heading mode activated. As the shortest turn towards the selected heading 086 was to the right, the aircraft turned RIGHT towards the Margalla Hills.

From that point multiple “TERRAIN AHEAD PULL UP” EGPWS alerts sounded until impact.

The first officer begged twice in succession “Sir, turn left, pull up Sir! Sir, pull up!”

35 seconds before impact the throttle levers were brought into the MCT detent and the autothrust was disengaged, the selected altitude changed to 3700 feet, the aircraft still turned right. 6 seconds after the throttles were placed into the MCT detent they were moved to the CLB detent and autothrust was engaged in CLIMB mode, the selected altitude was reduced to 3100 feet.

The first officer begged another time “Sir, pull up, Sir!”

Note to first officers everywhere—if the captain ignores both your and multiple TAWS implorations to pull up, firewall the thrust and PULL THE GODDAMN NOSE UP YOURSELF. If the captain tries to override you after you pull up in response to a TAWS alert, punch him into unconsciousness or KILL HIM. It really can come down to either his life or the lives of 151 other people.


In my book, the term EGPWS should be forever eschewed in favor of TAWS. The latter acronym has none of the baggage associated with GPWS (the Islamabad accident I just mentioned is an example of nonexistent CRM, not navigational failure). A good way of thinking about aviation safety is pre-TAWS versus the TAWS era:

Almost all fatal accidents in the past few years involve second- or third-tier airlines in countries where safety performance has stagnated. Safety performance in those regions is likely to remain stagnant until global pressure – applied through agencies like the International Civil Aviation Organisation and IATA – to adopt operational and maintenance quality control measures, like safety management systems and safety audits, begins to be heeded.

The last operators to do this will be short-haul carriers in the least safe regions, because they are immune from external competitive pressures such as an alternative to an accident-prone carrier. Another form of pressure is the ban on airlines operating to nations that monitor the performance of foreign national aviation authorities and airlines. Indonesian airlines, for example, are banned from operating to Europe until the national aviation authority’s oversight standards meet ICAO minima.

The 20 December 1995 Cali, Columbia crash of American 965 really did mark the end to CFIT insanity:

Meanwhile, in countries where the terrain awareness and warning system (TAWS) is not compulsory in commercial transport aircraft, controlled flight into terrain accidents still happen. Figures prove that no TAWS-fitted aircraft has suffered a CFIT accident. The figures since 1997, when the first big commercial jets were being fitted with TAWS, reveal there were six CFIT accidents in that year. By 2007 only 5% of the world’s commercial jet fleet lacked TAWS, but among that small minority, according to the Flight Safety Foundation, two airlines suffered CFIT accidents.

Since the chances of CFIT accidents among non-TAWS jet airliners is about six times as high as the world average pre-TAWS, there will probably be CFIT accidents in 2009, even though they can be prevented.

If the trend shown by the FSF’s five-year moving average chart for the number of CFIT accidents continues, there will be two CFIT accidents in 2009. Recent statistics suggest there will be loss of control crashes this year, as that category has taken over as the biggest killer.

FlightGlobal’s report was released two days prior to the “Miracle on the Hudson,” over a year before AirBlue 202, so they get a pass. Considering the stall-induced crashes of CO 3407 and AF 447 (and the enraging behavior of the NTSB and BEA in their respective preserve-airline-credibility/blame-pilots-extravaganzas) also occurred during the course of 2009, FlightGlobal’s report seems prophetic in retrospect. So, what is TAWS?


It’s a terrain-depicting navigation display that integrates a system that tracks the aircraft’s position, airspeed, indicated altitude coupled with the traditional radar altimeter-based ground prox warnings. But the computer-generated “TERRAIN AHEAD” and “TERRAIN, PULL UP!” calls are nice-to-have features compared to the terrain display itself. It practically screams “situational awareness.”

Air New Zealand 901 would not have crashed had the DC-10 been equipped with TAWS:

Astonishingly, only one crew member had flown on such a flight before, flight engineer Gordon Brooks. He was the only person to voice any concern. Just 26 seconds before impact, he said: “I don’t like this.”

Captain Collins immediately decided to fly away. He was heard discussing with First Officer Cassin whether to turn left or right, when, suddenly, the ground proximity warning system shrieked its terrifying alarm: “Whoop- whoop! Pull up!”

But it was too late. Seconds later, TE901 disintegrated as it hit the slope.

Brooks would have been able to point at a red terrain depiction much earlier, and the escape route into McMurdo Sound to the right of Mt. Bird would be obvious to Collins and Cassin (Mt. Terror would have shown to the left of Mt. Erebus). Is there any question Tafuri and Williams would have similarly benefited had they had TAWS as their 757 descended into the mountains shrouded in the inky darkness near Cali?

Aviate, Navigate, Communicate

William Langewiesche tries to accomplish a herculean task—determine what caused AF 447 to crash, and what it means for aviation and the economy at large. He gets part of the way there, but then drops this paragraph:

First, you put the Clipper Skipper out to pasture, because he has the unilateral power to screw things up. You replace him with a teamwork concept—call it Crew Resource Management—that encourages checks and balances and requires pilots to take turns at flying. Now it takes two to screw things up. Next you automate the component systems so they require minimal human intervention, and you integrate them into a self-monitoring robotic whole. You throw in buckets of redundancy. You add flightmanagement computers into which flight paths can be programmed on the ground, and you link them to autopilots capable of handling the airplane from the takeoff through the rollout after landing. You design deeply considered minimalistic cockpits that encourage teamwork by their very nature, offer excellent ergonomics, and are built around displays that avoid showing extraneous information but provide alerts and status reports when the systems sense they are necessary. Finally, you add fly-by-wire control. At that point, after years of work and billions of dollars in development costs, you have arrived in the present time. As intended, the autonomy of pilots has been severely restricted, but the new airplanes deliver smoother, more accurate, and more efficient rides—and safer ones too.

Nope. Langewiesche writes like he is a pilot, perhaps he remembers Anchorage (ANC)—Aviate, Navigate, Communicate. Safety is also built on Anchorage, but in reverse. CRM finally solved the communication issues in the cockpit, and extended to the ends of the Earth the range of resources available to pilots. TAWS prevents pilots from inadvertently navigating into mountains, hills, buildings, power lines…pretty much anything that isn’t a runway. AC-120-109 finally acknowledges that stalls are a real threat to turbine-powered transport-category aircraft.

Unfortunately none of this addresses the most dangerous threat to an airliner aloft, fire


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s