Terrain warning driven by same faulty positional data
The case of an airliner on approach that missed trees on a ridgeline by a scant 55 feet underscores the hazard of drawing all positional information from a common source. The near accident emphasizes the need for the terrain warning system to have its own, independent means of determining the airplane’s position in the sky to provide aircrews with timely warning of impending doom.
The incident involved a British Mediterranean Airways A320 with 68 passengers and seven crew aboard on a night flight from London via Alexandria, Egypt, to its final destination at Addis Ababa, Ethiopia. The March 31 incident was mentioned briefly earlier this year in a flight operations bulletin issued by the UK’s Civil Aviation Authority (see ASW, Aug. 4).
Just as separate load paths are key to structural safety, independent sources of positional information may be key to navigational safety. Although the enhanced ground position warning system (EGPWS) on the incident aircraft is not intended for use in navigation, its alerting function nonetheless depends on accurate information of the airplane’s position in the air relative to the ground. In this case, belated warning was provided to the pilots only because the EGPWS “thought” the airplane was going in short.
The case is still under investigation by the UK’s Air Accidents Investigation Branch (AAIB) with assistance from manufacturer Airbus and Ethiopian aviation authorities.
However, carrier officials who traveled to Addis Ababa shortly after the event believe they have a sufficiently refined picture to reconstruct what occurred.
“It was an accident that only just didn’t happen,” said Capt. Robin Berry, safety manager for British Mediterranean.
It was near the end of a long day for the two pilots as the aircraft approached Addis Ababa about 2:00 a.m. local time. The aircraft, delivered new in 1994, was fitted with a standard flight management system (FMS) utilizing a combination of ground-based radio navigation aids (NAVAIDS) updated by its inertial reference system during flight segments between widely spaced ground navaids. The aircraft also was fitted with EGPWS in 1998. Neither system, however, was capable of determining the airplane’s position via the satellite-based global positioning system (GPS).
The local weather report indicated broken clouds and rain. The rain, as it turned out, would play a surprising role in the events that unfolded.
The first approach
Landing was planned for Addis Ababa’s Runway 25L utilizing the airport’s VOR (VHF omnidirectional radio range) signal. The crew lost the signal about 1,200 feet above aerodrome level (AAL) and discontinued the approach. What the pilots didn’t realize was that they’d missed a ridge north of the airport by some 600 feet.
As they held over the airport and checked out their systems, the tower controller advised that the VOR was functioning properly.
In truth, it wasn’t.
The second approach
The crew attempted a second approach. The FMS display showed them on course. The terrain displayed by their EGPWS showed them in the same location, easily clearing a ridgeline to the north of the airport. As one commentator familiar with the situation said of the instrument displays, “Everything’s lovely, come on down!”
Yet they were off course, a good three miles north of the final approach and headed to the ridgeline they’d unwittingly flown over during the aborted first approach. This time, they were coming much closer.
The only indication of anything amiss was the NDB (nondirectional beacon) pointers actually telling the crew they were off course. But a thunderstorm to the south of the airport gave them a “credible” reason for the apparent anomalous behavior of the NDB equipment, and to discount the false information on the map display. These hints aside, there was no indication of anything amiss until the pilots received the 1,000-ft. callout from the radio altimeter a good seven miles from their intended touchdown point – much too early in the descent. The 1,000-ft. callout was followed shortly by the radio altimeter’s 400-ft. alert. Again, much too early, and the two alerts, one following the other in unusually short order, prompted the pilots to start questioning the navigation displays in front of them.
They elected to abort the descent and divert to their planned alternate airfield at Djibouti.
At about this same time, the EGPWS sounded the alert, “Too Low Terrain”. Not because it was accurately comparing the airplane’s position to the ground below (which it wasn’t), but because the designers of EGPWS had built a terrain-clearance “floor” into the system extending a few miles out on both sides of the runway (see ASW, Aug. 30, 1999). With the airplane descending toward this artificial floor, the EGPWS alerted to prevent what it perceived as an imminent landing short of the runway. There’s a lesson on behalf of built-in safety buffers – they can help in unintended ways.
The EGPWS sounded as the airplane was just 110 feet above the ground, and the airplane roared over the ridgeline, clearing it by some 55 feet. In terms of controlled flight into terrain (CFIT) accidents, this near-CFIT was about as close as one can get without impacting.
Since it was at night, in rain, no one aboard knew the closeness of their brush with disaster.
The crew returned to Addis Ababa from Djibouti the next day and made an uneventful landing under visual flight rules.
Because of the missed approaches during the rainy night before, the pilots filed an incident report with their company. They also reported the apparent VOR failure to air traffic control (ATC) at Addis Ababa upon their return the next day, when they noticed the error in the VOR signal because of the visual reference. It was disregarded by ATC because they had no alert from the VOR that the monitor had failed, which they did not know at that stage. The VOR monitor had failed for the same reason as the VOR – water ingress. The VOR and the monitor electronics were housed in the same unit. Berry added, “Bear in mind that this was a random failure that only existed for a few hours after heavy rain. Most of the other operators go in during the day when it had all dried out and there was no problem.”
An investigation is launched
The carrier also has a flight operations quality assurance (FOQA) program. As Berry said, “We always look at go-arounds.” The data was pulled from the quick access recorder (QAR), and at that point it was evident that something had gone very wrong, and that mere feet and fractions of a second separated this near-CFIT from an approach that could have ended with smashed aluminum and shivered bodies littering the ridgeline.
In addition to notifying the authorities (CAA, AAIB), Berry said “we started a full company investigation, sending the QAR readout to Airbus and the EGPWS flash memory to Honeywell [manufacturer of the EGPWS].”
There is nothing like good data, and from multiple sources, to reconstruct situations like this. For example, the pilots said they’d turned left, as required, onto the 193� radial, as called for during a missed approach on the chart. The data from the FMS indicated that the crew initially had turned right, then left, which disagreed with the aircraft track and ground speed readout. On the second approach, the pilots could not agree exactly on what warning they had heard from the EGPWS. Berry recounted that after the incident he had been on a company flight to Beirut on another matter. On that flight, the passenger sitting next to him related that he had been on the incident airplane and asked Berry, “What does ‘Too Low Terrain’ mean?” So there was Berry’s confirmation of the EGPWS’ aural warning (the 30-min. cockpit voice recording having been taped over).
On both approaches, the airplane was well north of the specified path on the airport approach plate. How did the airplane get nearly three miles off track with “correct” cockpit indications?
Ethiopian authorities examined the VOR transmitter. They found evidence of rainwater seepage into the interior parts of the VOR antenna. Virtually every time it rained, the leakage was causing random deviations off the correct VOR bearing. On the night of the incident, the signal may have been as much as 30� off.
A short time before the incident, the antenna had been removed for the purpose of taking accurate measurements to install new equipment. According to the Ethiopian’s interim report, “The same sealant material used to seal off the opening that let in rain water also failed again and led to a similar incident.”
The VOR was the only ground navaid within 400 miles that the flight management guidance computer (FMGC) on the aircraft could use to update its inertial reference system (IRS) position. The FMGC will produce an interpolated position based on the IRS and radio position. As Berry explained, because the FMGC position shift was equal to the erroneous shift in the VOR signal, all cockpit indications looked sensible – both the VOR “raw data” and the FMGC showed the airplane “on track” during the inbound leg of the approach.
Why didn’t the EGPWS alert earlier, before it was at the artificial terrain floor? Since it receives its position from the FMGC, the EGPWS display also showed the aircraft on the seemingly correct inbound track to the runway. No terrain hazard was presented, no alert sounded until the last moment, when the artificial terrain floor was activated.
As Berry explained, “The EGPWS was actually reinforcing the wrong picture.”
It took this flight to a distant destination, across 400 miles without a ground navaid update, for the latent hazard to be revealed.
An embedded potential for dual error
Berry said the incident raises a serious question: “Is EGPWS without the independent location provided by GPS a valid option, especially for remote area operations?”
Regulators certified the EGPWS, he added, without requiring GPS, thereby embedding the potential for a common position error in both the FMS and the EGPWS. As far as Berry is concerned, an independent location provided to EGPWS could and should be fitted to the terrain warning system. The electronic card and other components can be installed overnight, providing an effective fix.
The Addis Ababa incident also showed the virtue of FOQA in a new way. “We now freeze and collect a lot more data,” Berry said.
Human factors issues are involved also. “On both approaches, the ‘raw’ data matched the FMS data, providing the pilots with a powerful mental picture of being in the right place on the right track,” Berry said. Or, more simply, the faulty information from the VOR was causing the FMS position shift, and that shift matched the VOR error. As Berry confessed, “The type and degree of error in the ground aid information was outside the experience of the crew and, indeed, outside the experience of nearly everyone I have spoken to since this incident.”
“The captain viewed the NDB pointers twice during each approach, and they indicated ‘off track’ to the right in conflict with the VOR and FMS data,” Berry said. “But there was a thunderstorm off to the left, so it was easy to discount the ADF indications and stick with the strong mental picture.”
The early 1,000-ft radio altimeter callout raised the first overt suspicion that the crew had lost situational awareness. The 400-ft. radio callout confirmed it, and was the cue for the go-around.
Basic lessons emerging from this case include:
- For the man: if things don’t seem right, they probably aren’t. The premature altitude callout was the tip-off. Trust your instruments, up to the point of contrary indications.
- For the machine: it’s preferable to drive positional warning systems like EGPWS from independent, stand-alone source data like GPS. The single positional source to two “independent” systems came within a hairsbreadth of fooling two pilots.
- For the regulators: this case seems to constitute a watershed event as far as failure modes and effects analysis (FMEA), and its role in the design and certification of avionics systems.
Meanwhile, changes have occurred both at Addis Ababa and within British Mediterranean. The ground situation at the airport has improved dramatically with a new VOR having been installed along with full instrument landing systems on both runways. This upgrade process was in train at the time of the incident. “We got caught during a transition period,” Berry said.
As for the airline, Berry said the GPS engine was fitted to the incident aircraft’s EGPWS about two months ago. The story is far from complete, and the AAIB investigation continues. “There is still a lot that we do not understand about the mechanics of this incident. The failure process is still taxing much more informed minds than mine,” Berry said. “We think we know the underlying cause, but not why it had such a disastrous effect on the navigation and other protective systems on the aircraft.” >> Berry, e- mail [email protected] <<