Reducing the controlled flight into terrain risk by human error management

REDUCING THE CONTROLLED FLIGHTINTO TERRAIN RISK

BY

HUMAN ERROR MANAGEMENT

Frank C. Dijkgraaf

Delfl University of Technology, Faculty ofAerospace Engineering, P.O. Box5058, 2600 GB, The Netherlands

Abstract In the iight of the tatest airline scheduled airline traffic growth forccasts, significant improvements will have to be introduced to maintain the public's confidence in the safety of air travel. So-called "Controlled Flight Into Terrain", in which airworthy aircraft are inadvertently flown into the terrain (or water) with little or no awareness by the pilots, cause the major part of airline passenger and crew fatalities today. This paper catégorises the causes leading to this specific type of aircraft accident and suggests improvements in the area of cockpit man-machine-interface and waming system improvements capable of reducing the CHI-rate in future.

Keywords. Controlled flight into terrain, Human error management, Ground proximity warning Systems, Synthetic/Enhanced terrain displays.

1. I N T R O D U C T I O N

A i r travel is generally accepted as a safe means o f transportation. A c c o r d i n g to the latest traffic growth forecasts however, the c i v i l aviation safety record, i n terms o f yearly passenger fatalities or aircraft hull-Iosses, could deteriorate. U n t i l the year 2003, the International C i v i l A v i a t i o n Organisation ( I C A O ) assumes a moderate 5 % long-term traffic growth for w o r l d scheduled passenger traffic. A s the averaged annual passenger fätalities a n d fatal accident rates i n the 1984 trough 1993 period d i d not change substantially, extrapolation, based o n the trend i n traffic growth a n d accident statistics over this period o f time, presents reasons to be concerned about the future flight safety record. A c c o r d i n g to this extrapolation, I C A O (Corrie, [4]) expects the number o f passenger fatalities to increase w i t h 7 4 % to 1,200 per year, and the number o f fatal accidents to increase w i t h 7 7 % to 4 0 per year by the year 2003. I n order to maintain the public's confidence i n the safety o f a i r travel, significant safety improvements w i l l have to be introduced.

So-called " C o n t r o l l e d F l i g h t Into T e r r a i n " ( C F I T ) accidents remain the number one cause o f passenger a n d crew member fatalities today. T h i s paper catégorises the causes leading to this specific type o f aircraft accident and suggests improvements i n the

area o f cockpit man-machine-interface a n d w a r n i n g system improvements capable o f reducing the C F T T -rate i n future.

2. C O N T R O L L E D F L I G H T I N T O T E R R A I N Definition and statistics

A d o p t i n g the définition as compiled b y the F l i g h t Safety Foundation's C F T T task force, a controlled flight into terrain o r C F I T accident occurs w h e n " a n airworthy aircraft is inadvertently flown into the terrain (or water) w i t h little o r n o awareness by the pilots". Since the advent o f the jet transport i n 1958, w e l l over 9000 lives have been lost i n C F I T accidents world-wide. A l t h o u g h reduced i n number by the implementation o f the ground p r o x i m i t y w a r n i n g system ( G P W S ) , C F T T accidents continue to occur. G P W S is a terrain w a r n i n g system that alerts the crew whenever their aircraft's terrain clearance becomes endangered. Recent data

(1988-1993 period) show that, i n world-wide airline opérations, 5 4 % o f a l l passenger a n d crew fatalities were a resuit o f controlled flight into terrain. These fatalities were caused by 2 8 CFTTs out o f a total number o f 76 fatal accidents (figure 1). T h e number o f C F T T accidents per m i l l i o n flights b y région is depicted i n figure 2.

13% 31% I • Tak&off I Croise I • Approsch I I Landing 50%

nunb* d Uri acodMts

figure 1, World-wide airline fatalities, classified

by type of accident (1988-1993), source: figure 3, CFIT Accidents by Flightphase, Source: Boeing, in Hughes, [7]. Corrie [4]

NORTH AMERICA

figure 2, CFIT Accident Hull Losses per Million Flights by Region (1959-1992 data), Source: Boeing Commercial Airplane Group in: Weener [10].

O v e r the period 19591992, the number o f h u l l -losses due to controlled flight into terrain i n Europe was five times higher than that i n the N o r t h A m e r i c a région. T h i s might be a resuit o f earlier implementation o f G P W S i n the U S A a n d the availability o f a terrain-warning S y s t e m for A i r

Traffic Controllers, the M i n i m u m Safe Altitude W a r t u n g System ( M S A W S ) . M S A W S is a software package for use at Automated Radar T e r m i n a l System ( A R T S ) A i r Traffic C o n t r o l facilities. T h e M S A W S provides the a i r t r a f f i c Controller

automatically w i t h aurai warnings when aircraft under his or her control penetrate the safety altitude for the région they are A y i n g i n . T h e M S A W S program started i n 1977 but still only 5 0 % o f the project has been completed i n the U n i t e d States. 6 3 % o f a l l C F T T accidents occurred d u r i n g the initial approach or final approach and l a n d i n g flightphase figure 3. T h e relatively h i g h (67) average number o f casualties per C F I T accident can be explained by the h i g h airspeed averaged i n C F I T accidents (220 knots, 407 km/h).

Human error

"Expérience indicates that most CFTT accidents can be related to poor visibility, navigation error, instrument reading error,

Visual

that

T h e essence o f this quotation b y Peter Penny, published i n the I C A O B U L L E T I N o f M a r c h 1975, still holds for présent day aviation opérations. It is important however to stress that the causes for aircraft accidents cannot be attributed to one action only. E v e n w h e n a crew-error directly caused a n accident, there usually are several other events w h i c h preceded it, a n d also attributed. A c c o r d i n g to Professor James Reason (Reason, [9]), aircraft accidents occur as a resuit o f complex interactions between many causal factors. T h e causal factors may be categorised into three groups: active failures cotnmitted by those operating at the "sharp e n d " ,

w h i c h are necessary but insufficient causes for aircraft accidents, l o c a l triggering factors such as

weather conditions, and latent organisational f a i l u r e s . T h e total séquence o f events leading to Reason's organisational accident is depicted i n figure 4.

Orgonitafion Task/Environment Individualt Defencw

figure 4, The Elements of an Organisational Accident. (Redrawn from Reason [9])

T h i s paper, however, would l i k e to focus o n the human-error side o f the C F I T problem. I n Reason's diagram this w o u l d concern the "Individuals" and "Defences" sections.

CFIT causal conditions

T h e factors that contribute to C F I T accidents may be categorised into two groups, identified by two " C F T T causal conditions". T h e first condition focuses o n the aircraft's flightpath:

The aircrafl 's flight path will cause it to collide with terrain or water.

T h e second condition concentrâtes o n the crew's terrain awareness:

The crew hos no awareness conceming the flightpath condition, or develops this

awareness too late to avoid collision. O n l y when both o f these conditions have been satisfîed, a C F I T accident w i l l occur. I n order to construct a fail-proof C F T T protection, however, both o f these problem areas w i l l have to be addressed. A c c o r d i n g to this classification, two classes o f C F T T prevention stratégies may be distinguished: those w h i c h prevent aircraft from A y i n g a flightpath towards terrain a n d those w h i c h make i t obvious to the crew that they are A y i n g towards terrain. First we have to widerstand under what circumstances a n d due to w h i c h error-chains any o f these conditions may occur. F r o m accident and incident reports, a number o f causes for the two conditions mentioned above c a n be extracted.

3. A S S E S S I N G T H E L I N K S I N T H E C F T T A C C I D E N T C H A I N

Flightpath Condition

A s most flightpath déviations leading to C F T T accidents have occurred o n the extended centreline o f the destination runway (Bateman, [3]), flightpath déviations i n the vertical plane seem to pose a greater threat than lateral déviations. I n the July ' 8 8 through July '93 period, 13 out o f 25 C F I T commercial jet aircraft huíl losses occurred while executing n o n - p r e c i s i o n1, step-down, approach procedures. W h e n observing the flight path profiles o f these accidents it appears that i n several cases the crew failed to level off after performing an altitude step (Bateman, [2]). The increased workload induced by performing a large number o f step-down

i.e. Approaches without using precision approach and landing guidance Systems like the Instrument L a n d i n g System (ILS). Non-precision approaches do not offer vertical approach path guidance.

altitude changes i n a short period o f time, as required by some approach profiles, m a y cause the crew to lose track o f their position o n the profile. In September 1992 a n A i r b u s A - 3 0 0 crashed o n approach for Kathmandu's T r i b h u v a n International airport (figure 5). T h e step-down approach for this airport comprises no less than 8 altitude steps along a 16 nautical miles l o n g approach path.

KATHMAHOU, NEPAL ^ TMMUVAHMl u > . SBUÎAAPPKOACH iUftVOROMEItwyln f' • M * t t U K1M • a mi 1 u «* 1 U » » 1 u 1 1*1 *M l i j f tfrmiM ^mhtîSSa<ÎA»tÊAO*m<nKn " » l a i t i O i i i i •MBiHiLPgy^-\ mm Nu» ; l l N t o n a * M t .

figureS, Instrument Approach Plate for Kathmandu's Tribhuvan "Sierra" Approach. source:[8J.

Undetected descents, resuiting f r o m erroneous autoflight mode sélection have also been a factor i n several incidents and accidents.

Misinterpretation o f a departure procedure is illustrated b y the 1989 accident w i t h a B o e i n g 737-200. T h e aircraft crashed into a mountain i n T a i w a n after misinterpreting the Standard Instrument Departure (SID) chart. T h e S I D for the flown departure called for a right t u r n after take of, instead the cr»w flew a left turn and, after being discovered by the copilot, corrected to the right too late.

Premature descent clearances or late heading changes, issued by air traffic control, may also resuit i n flights towards terrain, a n d may r e m a i n undetected by the crew. A l t h o u g h m o n i t o r i n g the terrain séparation o f aircraft is not a primary responsibiïity o f a i r traffic controllers, accident a n d incident reports not seldom cite the crew's confidence i n terrain-free vectors issued b y A T C personnel. It may w e l l be that the h i g h workload during the approach fiightphase makes it tempting

for the crew to trust controllers rather than to check any issued A T C vector for terrain before accepting it. H i g h confidence i n terrain-free vectors o n the part o f the crew reduces the redundancy, a n d thus the safety, o f the aviation system.

A s the altimeters used i n aviation are barometric, c o m m o n approach procedures require the crew to enter the local barometric pressure for the destination airport before commencing the approach. T h e approach controller o f the destination airport provides the crew w i t h current air-pressure data b y radio communication. Several C F I T accidents are k n o w n to have occurred due to altimeter setting errors. Pilots have entered erroneous digits causing altitude indications w i t h errors o f more than 1000 feet (30S meters)! Misunderstanding o f the correct data during the radio contact w i t h A T C is also k n o w n to have been a factor i n several accidents.

A v i a t i o n is h i g h l y dependent o n human-to-human voice communication. T h i s is also a leading source o f error i n the system, a n d one that is difficult to combat. C o m m u n i c a t i o n i n aviation operations can be divided into intra-cockpit a n d extra-cockpit or radio communication. Intra-crew communications provide the o n l y way for captain, first officer, and flight engineer ( i n three-crew cockpits) o f w o r k i n g as a team, they include requests b y the pilot flying for specific action by the pilot not flying, and acknowledgements to these requests. T y p i c a l extra-cockpit communications are requests to a n d from air traffic control, a n d confirmation o f reception o f the message (readback). R a d i o communication between a i r traffic control a n d crew provides clearance, weather, a n d traffic information that is not available by other means. T w o examples of error i n communication:

E n route from C o l o m b i a to Seatüe, the crew o f a M e t r o III aircraft received this descent clearance:

"Nectar one six nine three Metro, you are cleared to cross Hobart at 8,000, Seattle at or above 4,000. Maintain 4,000. No delay expected. Contact Seattle Approach Control over Hobart for further clearance, over"

T h e captain, w h o was experienced o n the route replied:

"Roger, this is uh nine three Metro is cleared to... uh... Hobart... to cross there 4,000 or above, the range station at 4,000, and we report to you at uh Hobart, over"

C o n t r o l replied: "Negative. Report Hobart to Seattle Approach Control", thus correcting the last

and least important o f the two mistakes i n the

repeat-back. T h e aircraft descended to 4,000 feet a n d crashed into a mountain.

A B o e i n g 747 approaching Nairobi i n the middle o f the night was cleared by the controller to "seven

zero zero zero" feet. T h e first officer repeated back

"five zero zero zero". T h e controller s h o u l d have corrected the mistake, but it was allowed to continue. Fortunately the captain saw the ground through intermittent cloud a n d carried out a n overshoot.

I n general, errors made i n communication arise from non-standard or ambiguous phraseology, lack o f communication between crew members or mishearing words w i t h similar pronunciation.

L a c k o f information exchange between crew members has also led to several accidents i n the history o f aviation. Cockpit voice recorders ( C V R s ) , taping the last seconds before the accident often show the pilot's c h i l l i n g inability to say the words that might save them.

Terrain Awareness Condition

T h e primary factor leading to the loss o f the crew's terrain situational awareness is o f course the outside visibility. N o flight towards terrain w i l l remain undetected for long d u r i n g operation i n daylight V i s u a l Meteorological Conditions ( V M C ) . U n d e r Instrument Meteorological Conditions ( I M C ) pilots have to determine their position by relating their current position and flightpath vector w i t h the approach plate's2 terrain information. T h i s process involves mental conversion o f the north-up oriented approach plates towards a track-up "mental terrain picture". U n d e r high workload situations this may involve too m u c h time to be correctiy performed, mental terrain pictures constructed p r i o r to the initial approach may fade during the relatively h i g h number o f actions needed to complete this flight-phase. T h e C V R s o f crashed aircraft often expose expressions o f uncertainty by crew-members concerning the whereabouts o f the surrounding terrain.

W h e n flying under V i s u a l F l i g h t Rules ( V F R ) i n deteriorating weather conditions, pilots may have the tendency to try and maintain visual contact w i t h the ground, instead o f cancelling V F R and continuing under an Instrument R i g h t Rules (IFR) flight plan. Several accidents have been attributed to

2 Instrument Approach Plates are paper maps that contain a l l information for successfully performing an approach to one specific airport runway.

this phenomenon, most o f w h i c h occurred to aircraft o f s m a l l régional operators, whose pilots were used to fly under V F R d u r i n g almost a i l flights. A n example:

I n December 1991 a Beechjet B e 400 collided w i t h a mountain summit near R o m e , Georgia, U S , shortly after take-off. T h e aircraft was told to b y A T C to "remain VFR because we have traffic four and flve right now south-east of Rome". T h e crew h a d trouble m a i n t a i n i n g V F R i n the fog, but d i d not i n f o r m the controller. T h e cockpit voice recorder installed i n the aircraft indicated that the pilots recogniscd that the aircraft w a s close to obscured terrain. A t 9.39:39 (nine minutes past h a l f ten a n d 39 seconds) the Captain t o l d the First Officer: "We 're gonna have to get away from that mountain down there pretty soon", a n d at 9.39:52: "You're getting close. You're gonna (have to) go to the righf T h e First Officer answered that he could not "see over there". T h e captain then stated that i f they maintained their present course, they c o u l d r u n into a n airplane o n approach to R o m e a n d pointed out there was a mountain i n one direction a n d a n antenna i n another that w o u l d be hidden b y fog. A t 9.40:07 the captain directed the first officer to fly "back to the righf a n d the first officer stated " / can 't see over there that's why I wanted to go the other way". T h e C V R recording stopped at 9.40:55. T h e accident report stated that the probable cause o f the accident was:

"the captain 's décision to initiate visual flight into an area of known mountainous terrain and low ceilings and the failure of the flight crew to maintain awareness of their proximity to the terrain".

4. G R O U N D P R O X I M T T Y W A R N I N G S Y S T E M S

T o alert the crew whenever their loss o f terrain-awarenéss has developed into a hazardous situation, the ground p r o x i m i t y w a r n i n g S y s t e m ( G P W S ) has been developed. Development o f G P W S started i n 1967, when i t was recognised that the radio a l t i m e t e r3, a requirement for the Category II " A U Weather L a n d i n g " instrument package, d i d not encompass the m a x i m u m alerting for exposure to collision w i t h the ground under a l l type o f flying conditions. T h e G P W S concept was u n i q u e i n a number o f respects. It was the first w a r n i n g S y s t e m

i n gênerai use to combine information o f a number o f hitherto unrelated aircraft sensors to produce a single w a r n i n g output. It was also the first cockpit w a r n i n g System to use a synthesised h u m a n voice to provide the primary w a r n i n g to the crew. T h e ground proximity w a r n i n g S y s t e m computer unit accepts inputs o f radio altitude, barometric altitude rate, I L S glide slope déviation and l a n d i n g gear a n d flap discrètes, w h i c h i t manipulâtes mathematically to détermine the onset o f terrain proximity. A u d i b l e warnings o r alerts are operator specified synthesised voice commands such as " W H O O P W H O O P , P U L L U P ! " o r " T E R R A I N ! T E R R A I N ! " . R e d " P U L L U P " , " G N D P R O X " and/or " B E L O W G / S " lights, flashing i n the glareshield, f o r m the v i s u a l output o f the G P W S . T h e G P W S functions o n l y when the radio altitude is less than 2,500 feet above ground level. Power to the system is controlled o n l y b y a circuit breaker, pilot inputs are not required a n d , when the aircraft i s flown i n n o r m a l profiles, the G P W S w a r n i n g should never be heard.

M o d e r n ground proximity w a r n i n g Systems offer four warnings for a (predicted) dangerous situation w i t h respect to the terrain: modes 1 (excessive rate o f descent), mode 2 (excessive terrain closure rate), mode 3 (altitude loss following take ofî), mode 4 (insufficiënt terrain clearance). Another two w a r n i n g modes include a w a r n i n g for excessive déviation below the glideslope o f a n I L S approach (mode 5) and for a descent below a m i n i m u m radio altitude selected b y the crew (mode 6). A l t h o u g h its introduction has signfficanUy reduced the C F I T rate, incident a n d accident reports, indicate that G P W S is not capable o f p r o v i d i n g a fail-proof safety-net against C F I T . M o r e than h a l f o f the aircraft lost i n CFTT accidents d u r i n g the July ' 8 8 -July '93 period had been equipped w i t h G P W S (figure 6).

peorammem»

CcmmtiüÊtjmmrtm

CFlraccdwts

Jdy 188810 July 1Wi

3 T h e radio altimeter uses continuous o r pulsed radar signais to measure the distance to terrain directly below the aircraft.

figure 6, GPWS effectivity, Large commercial Jet Aircraft, 25 CFIT accidents, July 1988-Julyl993 (redrawnfrom Bateman [3])

T h e g r o u n d p r o x i m i t y w a r n i n g S y s t e m has b e e n d e s i g n e d a s a C F T T s a f e t y n e t a n d t h e r e f o r e s h o u l d c o m p l y w i t h t w o c h a r a c t e r i s t i c r e q u i r e m e n t s . F i r s t o f a l l t h e S y s t e m s h o u l d n o t i n t e r v e n e u n t i l n o r m a l

procedures a n d crew vigilance have failed to assure a safe terrain clearance. Secondly, when safety is l i k e l y to be endangered, the system should be capable o f alerting the crew under a l l circumstances. Present G P W S models are k n o w n to be subject to both primary and secondary error: there are circumstances under w h i c h the system issues unnecessary warnings, as w e l l as situations i n w h i c h the system does not alert the crew for a potentially dangerous situation w i t h respect to terrain. These two areas do not include a i l deficiencies o f current G P W S equipment however. Accidents have occurred i n w h i c h the G P W S d i d issue terrain warnings, but too late for the crew to complete a successful recovery. Simulated G P W S w a r n i n g time prior to projected impact has been depicted i n figure 7.

0 5 10 15 20 25 30 35 40 45 M*rao* Tvrnán Stop« Ar>>« (dcg)

figure

7,

warning

impact.

computer Simulation

with "GPWS SIM" (Dijkgraaf [6]). F o r the flightpath o f a n aircraft A y i n g horizontally towards a single mountain w i t h a constant slope angle the G P W S w a r n i n g t i m e was measured. W h e n the aircraft was configured for l a n d i n g (landing gear d o w n and locked, landing flaps selected) w a r n i n g times d i d not exceed 5 seconds i n advance o f a possible impact!

I n other cases a timely G P W S w a r n i n g was issued, but the crew responded too late (or even not at all). T h e most severe limitation o f the G P W S however, is its inability to guarantee a safe recovery from any warning. In other words: even when a procedural evasive manoeuvre w i l l b e initiated immediately after the first w a r n i n g , G P W S does not guarantee sufficiënt terrain clearance throughout the recovery flight path. D u e to the lack o f a "forward l o o k i n g " sensor input, present ground proximity w a r n i n g systems have to determine terrain hazard by extrapolating the slope angle o f the terrain directly below the aircraft. Warnings w i l l then be issued some time prior to a projected collision w i t h an extrapolated mountain slope. It is this technique, i n use since the introduction o f G P W S i n the late

1960s, mat lies at the basis o f most o f the G P W S drawbacks. Whenever terrain steepness increases along the trajectory the aircraft is A y i n g , the system

w i l l alert the crew relatively late, o n the other h a n d when the aircraft flies at a safe altitude over sheer cliffs, the system w i l l issue unwanted alerts.

5. M A N A G I N G T H E E R R O R S L E A D I N G T O C F I T

H a v i n g summarised the numerous human-error related causal factors w h i c h f o r m the C F I T chain-of-events, a n d having observed that the ground p r o x i m i t y w a r n i n g system is not a fail-proof C F I T safety-net, what c a n be done do to reduce the CFTT-rate i n fiíture?

I n b i s report "Intervention Strategies for the Management o f H u m a n E r r o r " (Wiener [11]), E a r l W i e n e r o f the University o f M i a m i hands several lines o f defence against h u m a n error. I n h i s terms, "error management" must be distinguished f r o m "error reduction" or " e l i m i n a t i o n " . " M a n a g e m e n t " i n this sense means that one strives to b u i l d into systems and operator methods by w h i c h one c a n either elimínate o r reduce h u m a n error, o r i f this is not possible, to m i n i m i s e its consequences. A c c o r d i n g to Wiener:

"The Human remains a vital component in complex systems found in aviation and elsewhere because he/she possesses remarkable perceptual capabilities, among them the ability to detect subtle deviations from normal. This capability should be assigned to the front end of the lines of defence against human error. Human error is the prtce we pay for the flexibility of the human brain. It is a price that must be minimised by effective

intervention strategies and lines of defence." C o n c l u d i n g his report Wiener presents 5 levéis at w h i c h technology a n d humans may combine to manage rather than necessarily prevent error. These Unes global o f defence are:

1. Prevent the error i n the first place, or make it as unlikely as possible. T h i s is done by training, procedures, management, a n d quality assurance. 2. I f a n error is introduced into the system, make i t

as conspicuous as possible through display design and traditional h u m a n factors ("error-evident displays").

3. I f the first two methods fail to block o r remove

the error, design the system, probably through software, to trap the error a n d prevent i t f r o m affecting the system. T h i s level o f defence may or may not require further developments o f artificial intelligence.

4. Provide sophisticated w a r n i n g a n d alerting systems.

5. M a k e certain that there is a recovery path from any error.

Returning to the controlled flight into terrain problem, W i e n e r ' s global Unes o f defence (see also figure 8) indícate several shortœmings w i t h respect to C F I T avoidance i n the present aviation system.

CHT

figure 8, Lines of defence against CFIT.

T h e first defence Une (training, management etc.) i s currenüy being promoted b y the I C A O a n d the F l i g h t Safety Foundatíon's C F I T T a s k Forcé i n the f o r m o f C F I T awareness programmes a n d G P W S training aids. It i s o f extreme importance that pilots learn to understand C F T T "traps" a n d learn to perform a successful recovcry f r o m any G P W S warning. "Error-evident" displays, the second Une o f defence W i e n e r proposed, m a y be introduced i n the form o f some sort o f terrain display that could improve the crew's terrain awareness. Such a display could increase the probability o f detection by the crew o f a inadvertent flight towards terrain. It may also take over the c r e w ' s task o f mental conversión o f the north-up oriented paper approach plates towards a track-up oriented picture. T h e error-evident display does not have the intelligence to detect errors.

: TRKI 030 IM

6.9 NM V

figure 9, Example of terrain élévation information on navigation display. In that cases it is not UJcely thèse pilots -would ignore the terrain display.

It is merely a display S y s t e m , a n d the management o f h u m a n error ultimately dépends o n human inteUigence to detect the error. A s stated earlier i n this paper, i n many C F T T accidents f r o m the past, pilots expressed their doubts concerning the position o f h i g h terrain relative to the aircraft. A n example o f terrain display depicted o n the aircraft's navigation display i s presented i n figure 9. T h e terrain data required for terrain displays c o u l d be "synthetic", i n the f o r m o f a terrain élévation database stored i n a computer's memory, o r obtained v i a various "enhanced-vision" sensors that depict real terrain. U s i n g a terrain élévation database w o u l d require a reliable a n d accurate navigation system to a l i g n the synthetic terrain and the real w o r l d , but might weU be more cost-effective than installing expensive infra red sensors, millimeter-wave radar a n d low-light-level televisión equipment. Enhanced v i s i o n equipment i s not dépendent o f navigation accuracy a n d does not h o l d the dangers hidden i n database-errors, but is hindered b y weather-conditions. C o m b i n i n g the two Systems, enhancing real sensor data w i t h synthetic terrain information could be a solution but w i l l get even more expensive.

Future ground proximity w a r n i n g Systems should assure the success o f procédural escape manœuvres, elirninate unwanted warnings a n d no-warning situations and improve crew response to warnings. I n order to achieve these requirements, the use o f a coarse digital terrain élévation database i s expected to offer the best cost/performance ratio. B y u s i n g terrain élévation data, aircraft performance a n d pilot response time as G P W S input, i t should be possible to continuously compute escape fUghtpaths, both i n the vertical a n d horizontal plane. Postponing terrain warnings until the last o f these flightpaths intersects a safety m a r g i n above terrain, w i l l considerately reduce the number o f unwanted warnings while assuring a recovery f r o m every warning. B y using approach récognition logic, the w a r n i n g system should be able to distinguish between stabilised approaches towards a n airport

and stabilised approaches towards terrain. Besides these system improvements, it w i l l still be necessary to assure timely a n d efficient crew response to terrain warnings. T o achieve this, the terrain preview capability as used for the ground proximity w a r n i n g computer should also be offered to the crew by means o f a terrain display. It i s assumed that the preview capability offered by this display w i l l cause the crew to discover developing terrain hazards long before the G P W S warning is issued and, i n case the G P W S still catches the crew b y surprise, reduces pilot response time b y indicating the position o f the

terrain causing the alert. M S A W S software for air traffic control o r enhanced v i s i o n equipment could i n that case be used as an independent monitor.

6. C O N C L U S I O N S

Rather than to try a n d eliminate human error as a controlled flight into terrain cause, efforts should be directed towards human error management, thus avoiding the error where possible w h i l e reducing the severity o f the conséquences o f any unavoidable errors. Well-designed procedures, man-machine-interfaces, training programmes a n d CFTT awareness programmes should avoid h u m a n error where possible. I n addition, pilots should be provided real-time terrain information to make flightpath déviations towards terrain obvious. A c t i n g as a final Une o f defence, improved terrain-w a r n i n g Systems should incorporate "forterrain-ward l o o k i n g " capability and take into account the pilot's inherent response delay to unexpected warnings, thus oflèring a fail-proof controlled flight into terrain safety net.

7. L I S T O F A B B R E V I A T I O N S A T C A i r Traffic Control C F I T Controlled F l i g h t Into T e r r a i n G P W S G r o u n d P r o x i m i t y W a r n i n g System I C A O International C i v i l A v i a t i o n Organisation I F R Instrument F l i g h t Rules I L S Instrument L a n d i n g System

I M C Instrument Meteorological Conditions M S A W S M i n i m u m Safe A l t i t u d e W a r n i n g

System

V F R V i s u a l F l i g h t Rules

V M C V i s u a l Meteorological Conditions

8. LITERATURE

1. B a t e m a n , C D . , Past, Present and Future Efforts to Reduce Controlled Flight into Terrain (CFIT)

Accidents, Proceedings o f F h g h t Safety

Foundation's 43rd International A i r Safety Seminar, Rome, 1990.

2. B a t e m a n , C D . , Flight Into Terrain and the Ground Proximity Warning System, E n g i n e e r i n g report 070-4251, Sundstrand D a t a C o n t r o l , Inc., February 1991

3. B a t e m a n , C D . , International CFIT Task Force Data and Dissémination Group, paper presented at the 46th International F S F A i r Safety Seminar, K u a l a L u m p u r , M a l a y s i a , 1993.

4. C o r r i e , S.J., Programme to address CFIT problems includes plan to improve GPWS

provisions, i n : I C A O Journal, November 1993. 5. C o r r i e , S.J., Potential growth in air travel

demands renewed effort to improve safety

record, i n : I C A O Journal, December 1994. 6. Dijkgraaf, F . C . , Controlled Flight Into Terrain,

causes, solutions, future research, G r a d u a t i o n Report, Delft University o f Technology, Faculty o f Aerospace Engineering, Delft, T h e Netherlands, 1994.

7. H u g h e s , D . , Safety Group Highlights CFIT Risk For Regionals, i n : A v i a t i o n Week & Space

Technology, M a y 9 , 1 9 9 4 .

8. M c C a r t h y , P., A Taie ofTwo Cities, i n : I F A L P A Quarterly Review, December 1993.

9. Reason, J . , Identifying the Latent Causes of Aircraft Accidents Before and After the Event,

i n : Proceedings o f the International Society o f A i r Safety Investigators 22nd A n n u a l Seminar, Canberra, Australia, November 4 - 7 , 1 9 9 1 .

10. Weener, E . F . , Presentation for LATA Safety Subcommittee (SA FAQ M o n t r e a l Canada,

August 1993.

11. W i e n e r , E . F . , Intervention Methods for the Management of Human Error, N A S A Contractor Report 4547, N A S A Arnes Research Center, August 1993.