Correcting deviations as early as possible during instrument approach procedures — within a comprehensive strategy that helps flight crews to consistently accomplish stabilized approaches in large commercial jets — offers significant potential to avert predominant types of air transport accidents, according to results of French research begun in 2011.
André Vernay, human risks program manager, Direction Générale de l’Aviation Civile (DGAC) of France, in November explained threat concepts and solutions derived from the DGAC’s ongoing analysis of noncompliant approaches (or NCAs), during Flight Safety Foundation’s 67th annual International Air Safety Summit in Abu Dhabi, United Arab Emirates.
A DGAC-appointed research team inside the directorate’s Safety Management Coordination Office coined this term as a research construct during preliminary reviews of 13 accidents and major incidents — drawn from a 35-year period — after common causal factors sparked concerns. The events were assessed against the flight rules, regulatory policy statements and requirements that all of France’s airline pilots study during training.
Vernay said that the approaches analyzed during the research represented an identified risk that required joint safety actions. “An NCA can lead to loss of control–in flight, controlled flight into terrain, runway excursions or non-stabilized approaches, for example,” he said. “We had cases of aircraft stabilized at 200 ft — it’s not acceptable. The crews had to go around per standard operating procedure [SOP], but then the decision was made to ‘fight.’ A compliant approach is to land safely; that’s all it is.”
He explained the team’s definition of noncompliant approach using a diagram of the period in a typical instrument approach (Figure 1) that begins at the last segment preceding the aircraft’s turn onto the final approach course and continues to a designated point, defined by the operator’s SOPs and stabilized-approach criteria, by which the flight crew must decide explicitly if the approach is stabilized or non-stabilized.
The team’s model depicts a compliant approach as a green safe sector, and states that any of the following deviations creates a noncompliant approach: an interception angle to the final approach course greater than 45 degrees (or 30 degrees if parallel active approaches are being conducted); an intermediate leg providing less than 30 seconds for the flight crew to prepare the aircraft for landing (or less than a 2.0-nm [3.7-km] distance on a global navigation satellite system–based, nonprecision approach) before descent from the final approach course interception altitude at the final approach point; a glideslope interception from above; or operating with a non-adapted speed on final (i.e., greater than 180 kt at the final approach point).
Among influences on this model were six safety-reference documents currently used in the national aviation system. “An approach is a shared maneuver between airport facilities, controllers, crews, designers and manufacturers,” Vernay said. “Everything is written. There’s nothing new, nothing to rebuild, nothing to reinvent, so the compliant approach is something costless and already safely built.”
Since 2009, the risk portfolio of the French state safety program has emphasized these risks, which also are a part of the European Action Plan for the Prevention of Runway Excursions published by Eurocontrol, a team partner. Section 4 of the IATA Safety Report 2013 by the International Air Transport Association also provided relevant data and analysis derived from fatal approach accidents involving flight crews’ lateral, vertical and speed deviations. Operators’ deficiencies in safety management were cited by IATA as a factor when inadequate SOPs for the flight crew also were identified by accident investigations. Crew noncompliance with SOPs also was considered (see “EGPWS Data Show Benefits of Multiple Technologies for Premature-Descent Alerts”).
Relevant decision-making interactions between other stakeholders and flight crews conducting an approach and landing were studied during the team’s analysis using a tool designed and developed by Vernay called the decision and action wheel (DAW). “There is not only one decision-making process, there are three in the approach,” Vernay said, adding that the expectation of the authorities is clear: “If you’re outside of the procedure, you will go around.”
He labeled the decision-making processes as the expected process involving factors fixed and documented by the authority that become part of the pilot’s knowledge base; the required process involving factors influenced by the procedures and trajectory developed by an organization to, for example, remain clear of obstacles in the environment; and the personal process involving decisions using the individual pilot’s risk criteria and based on experience, the emotion of the pilot and/or responses to conditions being encountered.
“The operator will fix in the SOP the elements or the point where they want the crew to abort, to renounce a continued approach, and to proceed on a go-around,” he said. As a pilot, personal decision making is “linked to my experience in the aircraft, to my knowledge, to my confidence, to my fatigue, to my vigilance,” he added.
Vernay applied the DAW to identify points in time during the sequences of actual accidents at which the flight crew’s behavior differed from what would be expected, for example, by the instrument procedure’s designer, or from conformity to the airline’s SOPs, or from how typical pilots would conduct the approach in the same situation. “So the criteria that we found in the regulations and the approach procedures can be strong signals prior to conducting the non-stabilized approach or reaching the stabilization point,” he said. “If nothing is in place to be checked on final, and the final goal is to pass the stabilization door [i.e., gate], then threats to safety can happen before the stabilization point.”
He cited as an example one of the 13 events studied by the team, the fatal crash on Feb. 25, 2009, of Turkish Airlines Flight TK1951, a Boeing 737-800, during its approach to Runway 18R at Amsterdam Schiphol Airport (ASW, 6/10). Vernay’s plan-view diagram of the accident approach sequence showed deviation from the published procedure for joining the final approach course, requiring the flight crew to intercept the glideslope from a point far above the designed interception altitude. His profile-view diagram showed the point at which the operator’s SOP required the flight crew to check their adherence to stabilized approach criteria and where the accident crew struggled to recover the stabilization elements before that point.
“They didn’t manage that. They didn’t succeed,” he said. “But I can tell you that when we worked on the investigation reports, we understood that from the beginning of the descent until the crash, the crew was more than busy trying to come back to the elements. According to the investigation report, no pilot fully monitored the flight path and aircraft speed.”
To put the accident flight crew’s decisions and actions into the broader context of noncompliant approaches, however, Vernay cited one investigation board finding in the Schiphol accident that, before this crash, 50 percent of approaches to Schiphol Runway 18R had involved turns onto the final approach course beyond the turning point that readily enables flight crews to conduct a stabilized approach. “So it wasn’t a single case. It was a habit. It was something that was accepted by everybody. Nobody complained. Nobody said anything to the controllers during months and months. No feedback had ever mentioned that this operational mode led to a higher risk,” he said, based on the Dutch report’s analysis.
Insights such as these led the DGAC to collaborate on a further phase of analysis of noncompliant approaches with air traffic control (ATC) and operators at many French airports. For example, at Paris–Charles de Gaulle (CDG) Airport, a new software plug-in to the automated separation minima infringement–
detection tool devised by controllers generated a daily record of approaches that fit the noncompliant approach criteria.
“Over two years now, the record there has shown 4,000 noncompliant approaches a month and dozens of cases of glideslope interception from above,” Vernay said. The research team recognized that the controllers at participating airports face inherent difficulties in simultaneously balancing at least four objectives: maximizing traffic capacity by efficient use of airspace; mitigating noncompliant approaches; preventing overshoots during localizer course arrivals to parallel runways; and preventing infringements of the minimum separation standards of 3 nm and 1,000 ft.
During these discussions, the DGAC team also asked participating controllers, “What is the gain if you keep an aircraft at 180 kt until 5.0 nm [9.3 km] instead of asking for 160 kt at 6.0 nm [11.1 km] or 150 kt at 5.0 nm [9.3 km], for example? Anything?” Vernay recalled. “They didn’t have an answer because they didn’t have to look at the gain or the loss of time. It’s something like 25 seconds — 25 seconds to risk a non-stabilized approach.”
However, when controllers reviewed their data and realized the level of risk created by vectoring aircraft using noncompliant interception angles, they responded, “We must do better.” They then took responsibility for a solution, Vernay said. At CDG, for example, they digitally overlaid chevron-shaped interception marks on ATC displays (Figure 2) to help controllers guide any aircraft according to the standard-trajectory procedure.
Another solution involving ATC and operator collaboration stemmed from one meeting in which DGAC listened as operators discussed unaddressed problems. “We were surprised that some operators with advanced aircraft said, ‘If I’m closer to the runway threshold than 8 nm [15 km] at 180 kt, I have big problems,’” he said. A current DGAC safety bulletin — containing information confirmed by manufacturers such as Airbus — advises controllers that no ATC instruction requiring airspeed of 180 kt or greater should be issued while the aircraft is less than 8 nm from the runway threshold.
New areas of the DGAC’s research include mitigating the influence of tail winds on noncompliant approaches, enhancing pilot reports of tail wind–risk factors during arrival, determining which subcategories of noncompliant approaches represent the highest risk, and addressing discrepancies in aviation safety professionals’ interpretations of the ATC phrase wind calm.
EGPWS Data Show Benefits of Multiple Technologies for Premature-Descent Alerts
Equipping flight decks — to the extent feasible — with the most advanced flight crew awareness and alerting technologies will play a critical part in reducing what one study calls the “continuing trend of landing short/premature descent incidents” 18 years after the aviation industry embraced the original technology credited with reducing controlled flight into terrain (CFIT).
Yasuo Ishihara, technical fellow, Honeywell Aerospace Advanced Technology, says his ongoing analyses of premature-descent incidents, by tapping into the company’s proprietary data, leave no room for complacency by any operator or pilot. The scope of research includes commercial air transport passenger and cargo jets; regional jets and turboprops; and business jets.
“Premature descent is not an event that happens in particular parts of the world. This actually happens throughout the world,” Ishihara said. “It doesn’t matter who you are, where you are, what you fly, when you fly — the risk is very high.”
Optimizing the Enhanced Ground Proximity Warning System (EGPWS) or other terrain awareness and warning system (TAWS) — while adopting newly certified awareness/alerting technologies and appropriate flight crew training — are as essential as ever to safe operations, he said. Ishihara discussed the findings and recommendations in November at Flight Safety Foundation’s 67th annual International Air Safety Summit in Abu Dhabi, United Arab Emirates.
Two of the advanced technologies especially relevant to reducing these risks, he said, are flight path markers on synthetic vision displays that visually project during the approach where the aircraft will contact the ground; and indications on the altitude range arc of a vertical situation display.
By late 2014, Honeywell Aerospace had collected EGPWS recordings1 from approximately 24 million departures involving operators worldwide, yielding 176 premature-descent events. “While it is true that the number of CFIT fatalities and the number of CFIT accidents are coming down, they’re not zero quite yet,” he said. “In about 80 percent of those events, the aircraft was descending on a close-to-3-degree approach path and at a very reasonable vertical speed right before an alert was issued.”
Overlaying aircraft trajectories from the older accident data onto those of recent incident data (Figure 1) — with all destination-runway elevations normalized to 0 ft for the graphic comparison — showed distinct similarities, whether the flight ended in a crash or the flight crew recovered from the premature descent.
In each cluster of the graphed flight paths, with the accidents shown as red traces and the incidents shown as blue traces, the lowest point reached by each EGPWS-equipped aircraft typically was about 3.0 to 4.0 nm [5.6 to 7.4 km] from the landing runway threshold. Ishihara said, “This large cluster of flight paths occurring inside of 4 nm for the incidents is the very same as what used to happen and lead to actual CFIT accidents.”
Because of contractual constraints, Honeywell Aerospace cannot determine solely from its EGPWS-recorded data some valuable details (i.e., the exact date, time, aircraft registration number or other flight-identifying information, or precisely what triggered the EGPWS terrain alerts or warnings). He cited some examples.
In one daytime, low-visibility incident in 2006, the glideslope of the Runway 33 instrument landing system (ILS) at Birmingham, United Kingdom, was out of service when the flight crew of an Airbus A310 selected the localizer distance-measuring equipment (DME) approach. “The way that they selected the approach in the FMS [flight management system] auto-tuned a VOR [very high frequency omnidirectional range] DME station 5.8 nm [10.7 km] from the airport, not co-located to the field — in other words, to the DME as read on the approach chart,” he said.
“The pilots discussed when the descent point should be. Unfortunately, they ended up beginning the descent prematurely and the aircraft was let down to almost where the VOR
DME was — 6.0 nm [11.1 km] short. The aircraft reached about 164 ft above ground level during the recovery maneuver. This particular aircraft did not have EGPWS or TAWS installed, but the crew did receive an ‘excessive sink rate’ alert during the descent, and that was a cue for the flight crew to initiate a go-around.”
In another daytime, low-cloud incident in 2007, the Runway 16 ILS glideslope at Melbourne, Australia, was out of service when the flight crew of a Boeing 777 opted to conduct the nondirectional beacon (NDB) approach to the runway. “The crew could not find the [NDB] procedure in the FMS databases. They manually entered waypoints in the FMS and decided and planned to fly a continuous-descent approach to the runway using VNAV [vertical-navigation autopilot] mode. However, the descent from 4,000 ft was delayed, and that led to the aircraft being well above the 3-degree programmed glide path,” he said.
“So the flight crew attempted to regain the 3-degree path using flight level change autopilot mode, and they had the MDA [minimum descent altitude] entered in the MCP [mode control panel] window. However, during the descent, the vertical speed was increasing and exceeded more than 1,500 fpm, resulting in a premature descent. They got to the MDA roughly 5.0 nm [9.3 km] too soon, coming down well under the minimum segment safe altitude.”
In some other events, flight crews attempted to regain the 3-degree flight path inside the final approach fix — or otherwise to correct an unstabilized, nonprecision approach with a descent rate as high as 1,800 fpm — causing descent below the airspace segment’s minimum safe altitude or step-down altitude, and triggering EGPWS alerts. In other cases, the path flown was parallel to the correct flight path but would have led to a landing short of the runway.
A number of operators of commercial air transport passenger and cargo jets; regional jets and turboprops; and business jets described to Ishihara risk factors for premature descent that their pilots had experienced, such as the absence of charted intermediate waypoints inside the final approach fix in many FMS databases, resulting in the absence of these waypoints on navigation displays to aid flight crews in monitoring airplane height-vs.-distance/position during this segment of an approach.
Another risk factor involves discrepancies between a visual glide path indicator — i.e., precision approach path indicator or visual approach slope indicator — and the area navigation data for the vertical navigation path angle, resulting in a too-low indication while actually on the correct glide path. Another risk is altimeter error involving circumstances such as inadvertent mis-setting of the instrument, or disregard of local pressure differences or an unusually low temperature. “In general, if you have an altimeter mis-set or an altimeter error of any kind, 100 ft of altimeter error on a 3-degree approach path can lead you to land short roughly 0.3 nm [0.6 km] from the runway threshold,” he said.
Although Ishihara focused on correctly updating and optimizing EGPWS, the principles have counterparts for other TAWS devices. “To get the most out of your EGPWS, you must have the latest software version along with the latest geospatial databases and [global positioning system (GPS)]–accurate aircraft position and geometric altitude data coming into the EGPWS,” Ishihara said. “You have to provide the GPS data all the way into the EGPWS [i.e., not just to the FMS] and sometimes using the most advanced GPS capabilities such as geometric altitude may require activation of the GPS signal via EGPWS program pins.”
- Each EGPWS unit contains a memory system that records a subset all aircraft parameters whenever the device issues a caution alert or warning alert. The system records parameters from 20 seconds before the alert to 10 seconds after the alert.