Abstract: Controlled flight into terrain (CFIT) remains the greatest cause of fatalities in commercial air transportation. What is it, and what is being done to reduce its incidence? In the era of the lowest-ever aviation fatality rates, eliminating CFIT altogether poses a new challenge.
On Wednesday 6 August, just before 2 o'clock in the morning
when it was dark and rainy,
Korean Airlines flight KE801 from Seoul to Guam crashed into terrain
on approach to Won Pat International airport in Agana, Guam.
George Black of the National Transportation Safety Board said shortly
after the accident that
`it has all the earmarks of controlled flight into terrain'
What is controlled flight into terrain (CFIT), and what is
being done about it?
Controlled Flight Into Terrain (CFIT)
Back to Contents
Controlled flight into terrain (CFIT) is an important accident classification. It means crudely that the airplane was flying normally, when the sky is suddenly full of rocks. The worrying part is that rocks don't move - the airplane simply shouldn't have been there, and to get there it was flown there. So one can sense the reasoning behind Black's further comment that CFIT is `usually an error on someone's part' (Jor-08).
One `classic' definition of a CFIT accident is
A CFIT accident is one in which an otherwise-serviceable aircraft, under control of the crew, is flown (unintentionally) into terrain, obstacles or water, with no prior awareness on the part of the crew of the impending collision.and another, used in the recent Dutch National Aerospace Lab study, is
(Wie77), quoted in (KhRo96).
A CFIT accident is one in which an aircraft, under control of the crew, is flown (unintentionally) into terrain, obstacles or water with no prior awareness on the part of the crew of the impending collision.The difference lies in omission of the phrase `otherwise-serviceable'.
The B757 Cali accident (CRI-Cali) was an example of CFIT; in contrast, the B757 Puerto Plata accident two months later was an example of uncontrolled flight into the ocean, in this case an uncontrolled descent (CRI-PuertoPlata) . One accident classification scheme includes
CFIT is a major source of accidents, and it is the subject of major industry and government efforts to reduce them (Sco96). It causes more deaths than any other kind of commercial air-transport accident (Lea94), claiming the lives of 2,200 people between 1988 and 1995 (FI-AIA97, p10) in 37 accidents. (Phi-AW). In addition, 60% of the commercial airline crashes worldwide attributable to CFIT involve aircraft performing non-precision approaches (Phi-AW).
Over the last decade [before November 1996], for commercial jet operators worldwide, there have been an average of four CFIT crashes a year, causing between 400 and 500 fatalities, according to AlliedSignal Aerospace's CFIT expert, Don Bateman, who adds that the number for all turbine-powered aircraft is closer to 90 a year.The Flight Safety Foundation organised a CFIT Task Force in 1993, which reported its findings at the FSF annual seminar on November 1, 1994 in Lisboa (Lisbon), Portugal (Lea94). `Similar ... teams were successful in cutting midair collisions and wind-shear-related losses dramatically over the last 10-15 years.' (Sco96). CFIT accidents are mostly the result of human error (cf. Black's comments above, from (Jor-08)). Boeing has developed a training aid, the CFIT Education and Training Aid, to help eliminate CFIT accidents which is being distributed by the Flight Safety Foundation to non-Boeing operators as one part of the `final phase' of the FSF Task Force actions (Pro97.1) (Lea96).
Let me elaborate on the connection between CFIT and human error. Since instrument flight procedures (under which almost all airline flying is performed) are specifically designed to keep aircraft in airspace well away from terrain or other obstacles, a CFIT accident necessarily implies that
How may one lose situational awareness?
The CFIT Task Force convened by the Flight Safety Foundation reported in November 1994 that CFIT accidents could be halved, if to-airport descent and approach procedures were flown using Global Positioning System information rather than the current approved non-precision navigation information (Lea94). Earl Weener, Boeing's chief of systems engineering, reported that most CFIT accidents happen on VOR/DME or NDB letdowns. The majority of fatal errors involved deviation below glideslope, a vertical navigation error, rather than a lateral navigation error, with most impacts occurring within 200ft of the terrain top. The task force made 11 recommendations intended to reduce CFIT accidents by 50 per cent worldwide in the 5 years from November 1994.
ICAO said it noted the recommendations for incorporation in its international standards. The recommendations were:
Of these recommendations, the following have been implemented:
We have seen a few reasons how CFIT may occurs. Now let's look briefly at reasons for thinking that CFIT may have occurred, how the suspicion of CFIT may arise during an accident investigation. Because accident final reports, like mathematical theorems, rarely give insight into how the facts were determined, let us visit the example of the early press reports of the accident to KE801. The major reasons for considering that CFIT occurred must be that
The first two items convey that the wreckage pattern and the track of the aircraft over the ground are judged to be consistent with a relatively shallow impact angle. One would expect an aircraft whose control has been lost to have impacted at a greater angle, and therefore to have broken up in a different pattern to aircraft who impact more shallowly. The first two pieces of evidence alone would therefore suggest to investigators looking at them that the aircraft impacted under control. But they do not by themselves constitute proof, for example the state of the wreckage might just be coincidence.
For example, if there is prior mechanical or structural failure, the aircraft becomes no longer airworthy and pilots will usually lose some or all control. Or maybe control had been lost for other reasons, and then the pilots regained control just a little too late to avoid hitting the ground (the tracks of the wheels in a sodden field left by the L-1011 that encountered a microburst and crashed at Dallas-Fort Worth in the 1980s were only a few inches deep, leading one to wonder whether, had the aircraft had a foot more altitude, the outcome might have been different; the A330 accident in Toulouse involved an upset, deliberately let develop by the test pilot, who recovered the aircraft, but too late to arrest the descent completely (CRI-Toulouse)).
To look for evidence counting against the latter possibility, one looks at the flight data recorder (FDR) and the cockpit voice recorder (CVR). The FDR will give indications of the track of the aircraft (recorded altitude, etc) and likely show evidence of upset if there is one; the CVR will record whatever pilot reaction there was. In the case of a loss-of-control, there usually appears some recognisable pilot reaction (a series of comments in an urgent tone of voice) and maybe aural warning signals from the aircraft systems themselves. When all appears `normal', that indicates that nothing happened to cause the pilots to react unusually. So the latter two of the four pieces of evidence, if they exist as at Agana, are quite significant information.
But one should remember that evidence alone does not constitute proof. Proof involves logical inference from known facts. One model of how accident investigations proceed is that one collects facts and matches them against potential explanations of what happened, these explanations being generated from experience. Some of those explanations will be ruled out by being inconsistent with some of the facts. One must gather many basic facts first to limit the number of potential explanations to be considered, and afterwards one focusses on determining the truth or falsity of assertions which will decide between remaining explanations. This process does not guarantee that the actually correct explanation is found, because
There may also be hidden but decisive information. For example, after many months, the Cali investigators found an intact Flight Management Computer (FMC) on site. Its non-volatile memory was read in the U.S. and the reason for the decisive left turn was discovered, as well as further reasons why the crew did not regain proper situational awareness. The discovery illuminated a weakness in FMC database standards and design, as well as refocusing discussion on some FMC designed-in behavior. Had the FMC not been discovered, a major part of the Cali explanation would simply have gone unremarked. Investigators had known that the pilots had made an unremarked 90-sec left turn, but they hadn't known why until the FMC memory was read and interpreted (CRI-Cali). So it can be very hard or impossible to tell if your explanation is complete - if there's more information that would help explain a fact, or whether the fact just is. That situation arises often in investigations with particularly sparse or unreliable information, such as in the KE007 shootdown in September 1983, of which there is yet no completely satisfactory published account, despite two ICAO reports a decade apart.
The experience is that
CFIT accidents have been often associated with loss of situational
awareness (either horizontal or vertical or both - some degree of lack of
understanding of where one is, or where the safe airspace is) and this
has often been attributable to human error, usually piloting error, of
some sort, as noted in Black's comment quoted above
See for example also
a discussion of some incidents.
Thus determining whether an accident is likely to be CFIT leads one to
construct potential explanations by asking further questions about the
situational awareness of the pilots, for example, and trying to determine
corroborating information - or its lack.
Possible Approaches to Eliminating CFIT
Back to Contents
There are basically three approaches to avoiding CFIT.
"Develop a controlled flight into terrain training program that includes realistic simulator exercises comparable to the successful windshear and rejected takeoff training programs and make training in such a program mandatory for all pilots operating under 14 CFR Part 121 [Federal Aviation Regulations, Part 121. Certification and Operations: Domestic, Flag and Supplemental Air Carriers and Commercial Operators of Large Aircraft] (Class II, Priority Action) (A-96-95)"
(CRI-Cali, NTSB Recommendations).
`Nonprecision approaches should be outlawed for use by large, transport-category aircraft" [... because they] "cannot replicate the precision guidance" provided by instrument landing systems (ILS) and conventional barometric altimeters "are not accurate enough" to ensure a high degree of safety regarding obstacle clearance during the descent phase' (Phi-NPA) Roberts maintains a WWW site devoted to instrument procedures and charting (Wally-TERPS).
Which of these approaches - or which combination - is most likely to
work best? All have disadvantages: training specifically against
CFIT takes training time away from other priorities; avoidance of
NPAs shuts off many smaller and medium-size airports from air transport
services; high-tech doesn't always work right, is hard to debug in real-time
when it fails, and leads to `deskilling' and dependence of pilots through
habitual use, which engenders problems when it is not there. The discussion
is worthy, and ongoing. Attention is being focused strongly on the
high-tech, so let's consider it next.
Ground Proximity Warning Systems
Back to Contents
The original versions of GPWS were not as effective as hoped:
Both GPWS and TCAS [Traffic Collision Alert and Avoidance System] have produced variable numbers of false and nuisance alarms, particularly early in their periods of line service. Although ground proximity warning systems have been greatly improved since they were mandated [in the U.S.] in 1976, they still give rise to nuisance warnings. In the case of one large international carrier, 247 or 339 GPWS warnings during a recent 12-month period were false or nuisance alarms (73%). [...]
The problem of false/nuisance warnings is not trivial. If a substantial fraction of the warnings received are evaluated by pilots in hindsight as false or unnecessary, they will not trust these systems, even if some of these warnings are correct and could save the aircraft. Pilots' (or controllers') perceptions (whether correct or not) about the inaccuracy of warning systems will always shape their behavior toward trying to verify whether the warnings are correct - yet delays in responding to appropriate or true warnings may negate their effectiveness. Airlines have mandated full responses to GPWS warnings, but have had to backtrack on these procedures in the face of numerous nuisance warnings at specific locations. [...]
The great danger of an inadequate response to a true GPWS warning has motivated nearly all air carriers to require a full procedural response unless it is obvous to the crew that no danger of controlled flight into terrain exists [...] Cases continue to crop up, however, in which an inadequate crew response failed to avoid the terrain that motivated the warning. (Bil97)
Apparently it turns out that Nimitz Hill, the site of the UNZ VOR on the approach to Agana's Runway 6L as well as the site of the KE801 crash, is one of those `specific locations' mentioned by Billings:
"Airline crews flying to that runway routinely get warnings from their aircraft's ground proximity wasnint system as they pass the UNZ VORTAC. That beacon, which is used for the final fix for the approach, sits atop Nimitz HillThe GPWS warnings were discernible on the CVR tape:
Some airlines instruct their crews to expect the ground-proximity warning and to ignore it, double-checking their clearance of terrain with their aircraft's radio altimeters. The Korean Air 747 had a recent-model ground proximity warning system that provided altitude callouts to the crew before the accident."
The CVR tape includes automated-voice callouts of 1,000ft, 500ft and 100ft from the aircraft's AlliedSignal Mark 7 ground-proximity warning system, and callouts from that system of "sink rate, sink rate" and "minimums, minimums".
Had the GPWS not been late-model, it might not have given a warning at all: concerning enhanced GPWS (EGPWS) that " unlike conventional GPWS, sensing is not automatically disabled when the aircraft is in the landing configuration [..]" (Pro97.2). This implies that `conventional' GPWS is disabled when the aircraft is in the landing configuration, as KE801 was when it impacted. However, having the late-model GPWS unfortunately didn't help in this case.
How much time does one have from onset of warning to impact? In the Cali accident, about 12 seconds, two seconds of which were reaction time (CRI-Cali, Final Report, and NTSB Recommendations). "According to AlliedSignal [the makers of EGPWS] statistics, from mid-1988 to mid-1993 about 40° of CFIT accident of conventional GPWS-equipped jet transports involved a late warning or improper pilot response. Another 16° received no warning at all; most of these were land-short accidents." (Pro97.2). The Cali accident involved improper pilot response (CRI-Cali, Final Report, and NTSB Recommendations). Other estimates of overall response time include 15 seconds (Lea96). and 10 seconds (FI-26.3.97).
The NTSB Recommendations on the Cali accident urged the FAA to
"Examine the effectiveness of the enhanced ground proximity warning equipment and, if found effective, require all transport-category aircraft to be equipped with enhanced ground proximity warning equipment that provides pilots with an early warning of terrain (Class II, Priority Action) (A-96-101)."The FAA Human Factors Team had already concluded that
(CRI-Cali, NTSB Recommendations)
Recommendation SA-3: The FAA should encourage the aviation industry to develop and implement concepts to provide better terrain awareness.
Discussion of Recommendation SA-3:
Continued vulnerabilities to controlled-flight-into-terrain accidents demonstrate the need for further improvement in this area. The objective of this recommendation is to encourage timely development of better defences against this class of accidents. New approaches are needed to supplement or replace the current ground proximity warning systems, such that earlier indications and warnings of potential collisions with terrain and provided and nuisance warnings are eliminated.
A potential approach currently being proposed uses terrain databases in conjunction with accurate position information (e.g., from the global navigation satellite system), prediction algorithms for the airplane's future flight path, graphical terrain depiction on an electronic display, and suitable flightcrew alerting. The HF team supports this approach, but candidate proposals should be carefully evaluated to ensure proper integration with other flight deck systems and displays, and that human performance issues and other potential hazards (e.g., errors in terrain databases) are satisfactorily addressed.
"The EGPWS works by comparing a digital database of the world's terrain with the aircraft's location and altitude, to generate a map-like [and color-coded] display of surrounding terrain." (Lea96). It provides a 60 second warning, much longer than `conventional' GPWS (Lea96) (FI-26.3.97) (Pro97.2). American Airlines, the victim of the Cali crash, ordered about 700 EGPWS units from AlliedSignal (the sole manufacturer) in mid-1996. The unit is sized and wired to fit into existing GPWS avionics slots, and "no new sensors or extensive wiring changes are required" (Pro97.2), and they cost about 55,000 U.S. Dollars each.
Safety benefits of EGPWS include the elimination of several GPWS safety loopholes. In particular, EGPWS should stop the late detection of extremely precipitous terrain and "land-short" and "approach to no-airport" accidents, [Frank] Daly [AlliedSignal vice president for flight safety avionics] said. For added margin, the look-ahead algorithms scan 30 deg. to either side of the aircraft to allow for turns. [...]Besides American, United evaluated EGPWS on 12 of its Airbus A320 fleet (Pro97.2) and ordered more than 400 of the devices (Pro97.2) (FI-26.3.97); Alaska Airlines plans to equip all 25 of its Boeing B737-400 aircraft with EGPWS by the end of 1997 (Pro97.2); and other airlines such as Delta and British Airways are also evaluating it. AlliedSignal won a major award for its development of the system (see again Section`Enhanced Ground Proximity Warning').
By comparing projected ground track to airport locations listed in the data base, EGPWS typically would give a 20-ssec. warning in a land-short scenario, Daly said.
Called "envelope modification", [a particular] technique [included in EGPWS] also prevents false warnings during approaches to airports such as Hong Kong's Kai Tak or due to terrain peculiarities [...].
The FAA has been evaluating EGPWS pursuant to the NTSB Recommendation A-96-101 quoted above. The FAA may may issue a Notice of Proposed Rulemaking sometime soon to mandate the use of EGPWS on all civil, turbine-powered aircraft with six or more passenger seats (Phi-AW).
For its development of EGPWS, AlliedSignal Aerospace, Commercial Systems Division, won the Flight International Aerospace Industry Award in the Air Transport category in 1997 for its development of EGPWS. The citation is worth quoting in full:
Aviation safety experts had long targeted controlled flight into terrain (CFIT) as the leading cause of aircraft accidents. Between 1988 and 1995 alone CFIT accidents claimed the lives of 2,200 passengers - close to half of all fatalities. To help provide a solution, AlliedSignal began pioneering work on ground-proximity warning systems (GPWS) during the 1970s. Such technology has already proved its worth. Since being made compulsory on board jet-powered passenger airliners by the FAA in the early 1980s and later made a standard by the International Civil Aviation Organisation (ICAO), the number of CFIT accidents has visibly slowed. Accidents had averaged 22 a year, but that number dropped to ten in the decade which followed the arrival of the GPWS.
AlliedSignal has now followed on with development of [a] new enhanced GPWS system which aims to cit CFIT accidents still further. The EGPWS, which won US certification in 1996, intergrates the latest advances in navigation and terrain-database technology, together with the traditional benefits of GPWS.
By doing this, the new system provides a full 60s advanced warning of hazardous terrain. A conventional GPWS may give pilots as little as 10s to take avoiding action. The system is also the first to allow pilots to select a visual display of hazardous terrain below and ahead of the aircraft - crucial in poor visibility or darkness.
The Awards judges [Air Marshall Sir Roger Austin, Professor Rigas Doganis, Tony Broderick, Peter Lok] believe that the EGPWS represents an important step towards cutting accident rates. Systems have already been ordered by Alaska Airlines, American Airlines and United Airlines, while the recent US Presidential Commission on air safety recommended that EGPWD should be installed in all commercial and military passenger aircraft.
CFIT accidents are still unfortunately all too common. I have discussed a few common causes of CFIT accidents, and looked at what features of an accident can lead to a suspicion of CFIT. I have looked at approaches to eliminating it, and discussed the technical approaches GPWS and EPGWS. Here's to a CFIT-free future!
An altimeter is an instrument used to measure altitude. A traditional altimeter is a barometer that, instead of showing air pressure, indicates altitude. The indicator functions by adjusting the needle indicator to show deviation from a `baseline pressure setting', which is set by the pilots. The value of the baseline pressure setting appears in the so-called `Kollsman window' of the altimeter, and is indicated in either inches of mercury, or hectoPascals, or sometimes both. This baseline pressure is calculated at the airport of landing, in principle as follows. The airport has an altimeter at a known elevation, say 297ft. The altimeter is adjusted until it reads 297ft, and the reading in the Kollsman window becomes the `altimeter setting' for the airport at that time. This `altimeter setting' is broadcast on the Automated Terminal Information Service at U.S. airports (updated each hour), and the up-to-date setting is also usually given to approaching aircraft by the Tower controller on initial contact.
The discussion over so-called area navigation or RNAV (2-dimensional, over the earth's surface) and adding an altitude component to make Vertical area navigation or VNAV.
Lou Selk notes that standards and requirements for VNAV avionics have existed at least since FAA Advisory Circular 90-45, first issued in August, 1969. Appendix D states:
Adding a third dimension of vertical guidance to the two dimensional RNAV system can achieve significant operational advantages....In some cases, the computed glide path can make it possible to safely eliminate obstacles from consideration.Selk says
(FAA Advisory Circular 90-45A, dated 2/21/75)
Boeing certified systems conforming to AC 90-45 on a 727 in 1975, a 707 in 1976 and finally a 747 in 1979. All of these aircraft had a VNAV function in the RNAV computer which could be coupled to the flight director and autopilot as described in the FAA AIM under /E and /F equipment designators. The FMCS in the B-757/767 conforms to the same circular and the system has been standard on every 757/767 built. All B-737's since the -300 have had FMC's standard fit. The 747-400 and 777 have FMC's standard. So does every Airbus series with the exception of the early A-300's. In a study performed by Lufthansa and the DFS last year, they determined that 75% the aircraft operating into Frankfurt were FMS equipped. This equipment has been certified to fly VNAV for more than 20 years.
If the VNAV capability of such Flight Management Systems is used, as recommended by the CFIT Task Force [see Section The CFIT Task Force Reports above, and (Lea94)], step down procedures can be eliminated and additional obstacle clearance will be provided for a majority of the airliners flying today.
The missing element [of this system] at this time is the development of the corresponding approach procedures. Some parts of the world still don't recognize the concept of RNAV approaches, including some in the European Community, whereas the corresponding avionics equipment is certified and flying today.
(CRI-Cali): Peter B. Ladkin, Computer-Related Incidents with Commercial Aircraft: The American Airlines B757 Accident in Cali, available at http://www.rvs.uni-bielefeld.de. RVS Group, Technische Fakultät, Universität Bielefeld. Back
(CRI-PuertoPlata): Peter B. Ladkin, Computer-Related Incidents with Commercial Aircraft: The Birgen Air B757 Accident Near Puerto Plata, available at http://www.rvs.uni-bielefeld.de. RVS Group, Technische Fakultät, Universität Bielefeld. Back
(CRI-Toulouse): Peter B. Ladkin, Computer-Related Incidents with Commercial Aircraft: The A330 Flight-Test Accident in Toulouse, available at http://www.rvs.uni-bielefeld.de. RVS Group, Technische Fakultät, Universität Bielefeld. Back
(FAA-HF): U.S. Department of Transportation, Federal Aviation Administration Human Factors Team, The Interfaces Between Flightcrews and Modern Flight Deck Systems, Author, June 18, 1996 Available through http://www.faa.gov/. A short synopsis of the report's major features may be found in (Lea96.2). Back
(Joh94): Richard Johnson, Going by the Book [air accidents], in Peter G. Neumann, ed., The Risks Digest 16(8), 18 May 1994, ACM Committee on Computers and Public Policy. At http://catless.ncl.ac.uk/Risks/16.08.html#subj4. Back
(KhRo96): R. Khatwa and A. L. C. Roelen, An Analysis of Controlled-flight-into-terrain Accidents of Commercial Operators, 1988 Through 1994, Flight Safety Digest 15(4/5), April-May 1996. Available at http://www.flightsafety.org/FSD1996.html. Back
(PoLo81): R. F. Porter and J. P. Loomis, An investigation of reports of controlled flight toward terrain, NASA Contractor Report 166230, Mountain View, CA: Aviation Safety Reporting System Office, 1981 Back
(TERPS): U.S. Department of Transportation, Federal Aviation Administration, United States Standard for Terminal Instrument Procedures (TERPS), 8260.3B, July 1976, U.S. Government Printing Office. Ordering information and on-line order forms are available from http://www.terps.com/gpo, a subpage on Wally Roberts's site Wally's TERPS Page, http://www.terps.com. Back