Radio Altimeters and GPWS in Preventing CFIT Accidents

Introduction: Aviation Safety and the Role of Technology

Air travel is one of the safest means of traveling from one location to another in the world. Without air traffic, the business world would come to a screeching halt. Although businesses can transfer large amounts of digital communications data — eliminating much of the demand for mail and fax transmissions that characterized commerce just a decade ago — they still cannot transfer products, personnel, and other physical goods through electronic signals over the internet. Travel still relies on airliners and cargo aircraft that fill the skies around the world and around the clock. Experts agree that global commercial air traffic will grow at an average rate of 5% per year over the next 20 years, meaning that traffic will double within 15 years and nearly triple by the end of the following decade (Interavia, 1999).

The air travel industry is built on principles that have established and maintained its safety record. One of these principles is that of multiple redundant systems. Once an airliner is in the air, the forces of physics and gravity control its flight path. If a mistake occurs or a system fails, gravity and inertia cannot be paused while the problem is resolved. Each airplane is therefore built with multiple control redundancies to prepare for any possible failure.

A second principle, which can work in tension with the first, is that the pilot and crew are always in final control of the aircraft (Luccio, 2001). If systems malfunction, the pilot can override them. If conditions warrant, individual controls can be switched off to maintain aircraft control. Neither pilots nor airlines want an accident caused by a failed automated system that locked out the crew and produced a disaster attributed to a "technical malfunction."

During the past four decades, the aviation industry has recognized that the combination of equipment and personnel needs to be actively managed. The following overview tracks the growing body of knowledge that has accumulated regarding air safety.

1960s: Accidents were attributed to individual pilot error, mainly a lack of basic flying skills. Safety efforts focused on selecting candidates with appropriate psychomotor skills and proficiency-oriented handling training. Manufacturers focused on designing more reliable aircraft.

1970s: Accidents were attributed to individual pilot error, mainly a lack of technical proficiency. Safety efforts focused on psychomotor and cognitive skill selection and increased use of flight simulators. Manufacturers focused on designing more reliable, easier-to-fly aircraft, with built-in redundancy, fail-safe concepts, and greater automation assistance.

1980s: Accidents were attributed to cockpit crew errors, mainly team synergy failures and poor management of cockpit resources. Safety efforts introduced crew resource management (CRM) training. Manufacturers focused on reducing pilot workload, advancing fly-by-wire stability, expanding auto-flight capabilities, and providing error protections such as GPWS.

1990s: Every accident was reconceived as a failure of organization. Front-line operator behavior was understood to be strongly determined by systemic forces — selection, training, procedures, culture, working conditions, and organizational structures. Human error was not seen as failure per se, but as an intrinsic component of cognitive processes. Safety efforts evolved into fourth- and fifth-generation CRM training, emphasizing situation awareness, error management strategies, and metacognition. Manufacturers provided situation awareness augmentation tools, decision aids, and automatic protections such as EGPWS (adapted from Amalberti and Sarter, 2000).

For these reasons, any discussion of overcoming specific safety and technical problems in aviation must combine an analysis of technology and human interaction with it. While capable of operating aircraft in roughly 80% of situations and through 80% of a typical flight, technology cannot replace the human judgment required for the remaining 20%. Until artificial intelligence can fully replicate a pilot's capabilities, human judgment — and therefore human error — will always be part of the flight equation.

With these factors in mind, this paper investigates the use of radio altimeters as part of ground proximity warning systems (GPWS) and how these devices can help avoid controlled flight into terrain (CFIT) incidents and approach-and-landing accidents (ALA). The radio altimeter is an integral component of the GPWS. While barometric altimeters determine altitude above sea level and are affected by changing weather patterns, radio altimeters measure an aircraft's height above the ground and are particularly useful in determining actual flight paths during approach and landing events when visibility is diminished.

First-generation GPWS technology looks straight down, using the aircraft's radio altimeter to provide warning of threatening terrain. Against gently rising terrain, this provides better-than-nothing advance warning. However, as one pilot described its limitation, GPWS would remain silent in an aircraft flying across level ground and straight toward a vertical cliff. Fewer than 5% of the world's commercial aircraft fleet lacks GPWS; yet it is precisely these unequipped aircraft that are involved in nearly 50% of CFIT accidents (flightsafety.org.au).

Literature Review: Controlled Flight into Terrain

Controlled flight into terrain (CFIT) is one of the most pressing safety problems in commercial aviation. Since the beginning of commercial jet transport, over 9,000 people have died worldwide as a result of CFIT. CFIT is responsible for more than half of all commercial aviation fatalities, making it one of the international aviation community's most critical safety challenges (flightsafety.org.au).

When an aircraft is landing, the physics of the aircraft change dynamically and instantaneously throughout the procedure. In many cases, if the aircraft's safety is threatened, the crew is warned too late to make corrective changes and avoid a crash. Less frequently, an aircraft can wander off course during turbulent weather and fly into elevated terrain — though this represents a minority of CFIT occurrences.

The following actual incident and accident summaries illustrate some typical CFIT scenarios:

At night in instrument meteorological conditions (IMC), a pilot misread the NAV-DME due to fatigue, read the DME on the wrong navigation radio, descended too early on a back-course LOC approach, and penetrated prohibited airspace after flying seven hours and being on duty for ten hours. A low-altitude alert issued by the approach controller prevented an accident.

In another case, a pilot likely lost situational awareness and inadvertently flew the aircraft into an ice surface during controlled flight, due to the combined effects of a lack of external visual references and weak instrument flying skills.

In a third incident, a pilot continued flight in adverse weather conditions and likely lacked the visual references necessary to avoid a steep mountain slope. Contributing factors included over-reliance on GPS while attempting to maintain visual meteorological conditions.

The November 24, 2001, fatal crash of a Crossair regional jet underscores the urgency for action. It was a classic "dark and stormy night" when the Avro RJ-100 jet was approaching Zurich International Airport after a one-hour flight from Berlin. The time was approximately 10:00 p.m., weather conditions included light snow, visibility was two miles (3.2 km), with scattered clouds at 600 feet (183 meters) above ground — significantly below the minimum descent altitude of 974 feet (300 meters) for the non-precision approach to Zurich's Runway 28. Preliminary findings from the Swiss accident investigation bureau indicated that the aircraft was too low by approximately 1,000 feet (305 meters) three to four minutes before the crash. At 10:06 p.m., the radar altimeter, set to alarm at 300 feet (91 meters), sounded its warning. At that point, the aircraft was approximately 600 feet (182 meters) too low, given the minimum safe altitude of 974 feet.

There were only seconds for the Crossair crew to react when trees appeared out of the darkness. Just moments before impact, the captain called for a go-around. It was too late. A surviving passenger reported that the approach had been smooth and that he initially thought the aircraft had landed hard on the runway, not crashed into a forest. Of the 33 passengers and crew on board, 24 were killed, including both pilots (Evans, 2002).

Advancements in GPWS Systems

First-generation GPWS technology looked straight down, using the aircraft's radio altimeter to provide warning of threatening terrain. Against gently rising terrain, its warning served as effective advance notice of dangerous conditions. However, the system would remain silent in an aircraft flying across level ground and directly toward a vertical cliff. Regarding the Crossair incident described above, the GPWS was functional throughout the flight, but when an aircraft is in the landing configuration the system will not warn of insufficient terrain clearance because it expects the aircraft to be close to the ground.

"This is the Achilles heel for GPWS," said Don Bateman, chief engineer for flight safety systems at Honeywell International Inc., one of the leading suppliers of terrain awareness warning systems (TAWS) (Evans, 2002).

The radio altimeter as currently configured within a GPWS is only partially reliable. When an aircraft is descending, the lift dynamics are diminishing, leaving the aircraft subject to the physics of gravity and inertia. Even with warning of rising terrain ahead, if the warning is not received early enough, the pilot may not have sufficient time to deploy flaps, increase engine thrust, and pitch the nose upward to avoid a collision. The first-generation GPWS was fundamentally limited by the capabilities of the radio altimeter, which looks down at the ground and slightly forward of the aircraft, using radio waves to determine height above terrain.

For this reason, the GPWS is being replaced by the Enhanced Ground Proximity Warning System (EGPWS), developed by Honeywell. The enhanced version combines a traditional radio altimeter warning system with a computer-based digital terrain database and GPS. The radio altimeter continues to scan the ground and the immediate airspace ahead of the aircraft, while the combined system allows the EGPWS to look farther forward than the radio altimeter alone can project.

The EGPWS helps keep pilots aware of the aircraft's position relative to terrain. It uses data from GPS and other navigational aids, along with air data sensors, to determine the aircraft's position both longitudinally and vertically. It then adds that information to data from the terrain and runway database to generate a display showing terrain elevations around the aircraft.

Early GPWS devices simply viewed terrain directly below the aircraft, providing at best a 30-second alert prior to possible impact. EGPWS look-ahead algorithms can predict possible terrain incursions up to two minutes in advance. The EGPWS provides both horizontal and vertical look-ahead capability. With horizontal look-ahead, the system can "see" at least a quarter mile on each side of the aircraft, meaning that if the aircraft enters a banked turn, the EGPWS can anticipate the turn and warn against possible CFIT — in addition to the advisory callout issued when the bank angle is too steep.

Crew members receive both an aural alert and a visual warning through a multicolor display. Green indicates terrain safely below the aircraft. Yellow represents a cautionary alert 60 seconds prior to the predicted time of impact, accompanied by a "caution terrain" aural message. Red indicates terrain that the aircraft could impact within 30 seconds, accompanied by an aural "terrain, terrain, pull up" warning. Older GPWS units, which EGPWS replaces, provided an average of only 10 to 15 seconds of advance warning — and sometimes shorter warnings or none at all.

Depending on the phase of flight, EGPWS operates in seven distinct modes:

Mode 1 warns the crew of excessive descent rates — for example, due to a navigation error during descent to approach. The system also gives a warning if a sink rate of 1,000 feet per minute is exceeded on final approach.

Mode 2 works as a predictive mode based on the terrain database described above.

Mode 3 activates if the aircraft enters an inadvertent descent after takeoff or a missed approach. The mode is automatically deactivated once the aircraft reaches a safe altitude.

Mode 4 warns if the aircraft violates a minimum terrain clearance during climbout, cruise, or descent and approach. This mode is intended to catch situations in which Modes 1 and 2 cannot provide timely warning because the aircraft is already flying close to terrain.

Mode 5 warns of excessive deviations from glide path during an ILS approach. The mode activates when the crew selects an ILS frequency and lowers the landing gear.

Mode 6 warns of excessive bank angles, with sensitivity increasing as altitude decreases — for example, warning at 40 degrees of bank at 150 feet altitude and at 10 degrees of bank at 30 feet altitude.

Mode 7 causes the EGPWS to function as a windshear alerting system (adapted from Hess, 1999).

Honeywell reports that more than 100 airlines operate with EGPWS and that approximately 5,000 aircraft have flown more than 30 million hours with the system on board. However, this represents only a fraction of EGPWS's potential market. Honeywell is also targeting a general aviation market of more than 100,000 aircraft, representing 520 different types ranging from single-engine piston aircraft to twin turboprops (Jensen, 2000).

References

Amalberti, R., & Sarter, N. (2000). Cognitive engineering in the aviation domain. Lawrence Erlbaum Associates.

A3XX family: Airbus Industrie developing higher capacity air transport plane with input from airlines. (1999, March 1). Interavia Business & Technology.

Controlled flight into terrain: Korean Flight 801. (2000, May/June). Flight Safety Digest. Flight Safety Foundation.

Evans, D. (2002, February 1). Safety in avionics: Slaying the CFIT monster. Aviation Today. Retrieved November 14, 2003, from

General aviation accidents, 1983–1994: Identification of factors related to controlled-flight-into-terrain (CFIT) accidents. (2002). Retrieved November 14, 2003, from The Volpe Center. http://www.volpe.dot.gov/opsad/gacsum.html

Hess, C. (1999, January). The enhanced ground proximity warning system. Retrieved November 14, 2003, from Flug Revue. http://www.flug-revue.rotor.com/FRheft/FRH9901/FR9901m.htm

Goold, I. (2001, June). Researchers study trends in approach-and-landing mishaps. Retrieved November 14, 2003, from Aviation International News.

Hutchinson, S., Wickens, C., & Williams, H. (1996). A comparison of methods for promoting geographic knowledge in simulated aircraft navigation. Human Factors, 38.

Jensen, D. (2000, November). EGPWS: Look what it can do now. Retrieved November 14, 2003, from Aviation Today. http://www.aviationtoday.com/cgi/av/show_mag.cgi?pub=av&mon=1100&file=coverstory.htm

Luccio, M. (2001, October 1). GPS and aviation safety. GPS World.

Unraveling the mystery of general aviation controlled flight into terrain accidents using HFACS. (2002). Retrieved November 14, 2003, from Institute of Aviation. http://www.aviation.uiuc.edu/new/html/ARL/conference/shappellwiegavpsy01.pdf