Altitude Bust 15May98

Altitude Bust: Flight Deck and ATC Views

15th May 1998

A Conference Presented by the Human Factors Group of the Royal Aeronautical Society

Papers and Materials on Altitude Deviation
Level Bust Incidents, Case Studies and Training Tools:

Contents

1.    Presentations

Human Errors that Contribute to Altitude Deviations – Capt. D. Simmons
US Airways Altitude Awareness Programme: the Flight Crew’s Solution to an Age Old Safety Problem – Capt. Donald H. McClure, ALPA Air Safety Coordinator

2.    Incident/Accident Reports

• KAL Flight 801 CFIT – NTSB Accident Report
• Garuda Flight GA152 CFIT – CVR transcript

See texts below.

3.    Papers and Comments

See texts below.

• Level Busts and the ATC System
• Level Busts Outline
• Level Bust Considerations for Controllers and Pilots
• ATC Radar – When It’s Not Watching

4.    Conference Programme

Conference Programme

5.    Acknowledgements
The Human Factors Group committee would like to thank thank the many people who have actively supported the development of the resource book from which these selections are taken, including our sponsors, Mechtronix Inc. and CAA SRG; the conference speakers themselves; and the following:
Terje Lovoy, Terje Lovoy Instructional Systems Design
Telthusveien 11, N-4300 Sandnes, Norway.  Ph:+4751666976,  Fax +47 51666449.  E-mail lovoy@online.no

Steve Sharp, CAA SRG
Capt. George Robertson, Britannia
Capt. Andrew Bodiam, Monarch

6.    Copyright
The papers and reports included here are not intended for sale or redistribution and the inclusion of material does not in any way affect its copyright or ownership. The Royal Aeronautical Society Human Factors Group makes this booklet available as a safety resource for the aviation industry and is not responsible for errors in editing or for the contents of individual articles or papers.

7.    Incident/Accident Reports

Public Hearing – KAL Flight 801

Opening Statement of Gregory A. Feith, Investigator-In-Charge

Accident Notification
On August 6, 1997, about 0142 Guam Local Time, a Korean registered Boeing 747-300, operated by Korean Air Company, Ltd., as Korean Air flight 801, crashed about 3 nautical miles southwest of the Guam International Airport in Agana, Guam, while executing the Instrument Landing System (ILS) approach to runway 6 left.

The Safety Board was notified of the accident on August 5, about 1200 noon eastern daylight time. I was assigned as the Investigator-in-Charge, and the Go-Team assembled at Andrews Air Force Base (AFB) in Maryland, and departed later that evening via a United States Air Force C-141 transport airplane to Fairchild AFB in Washington. The trip to Guam was subsequently completed on a KC-135R, and the team arrived in Guam about 0830 Guam time, on August 7. The Board Member on duty at the time of the accident was George Black and he accompanied the team to Guam.

The investigative team consisted of various specialists from the Safety Board’s headquarters, the South Central Regional and Southwest Regional Offices. The specialty areas were: Aircraft Operations, Human Performance, Structures, Systems, Powerplants, Maintenance Records, Air Traffic Control, Survival Factors, Aircraft Performance, Meteorology, and Search/Fire/Rescue. Specialists were also assigned to conduct the readout of the flight data recorder (DFDR) and transcribe the cockpit voice recorder (CVR) in the Safety Board’s laboratory in Washington, D.C. The initial CVR transcript was produced in English by the group members. However, the CVR group reconvened and produced a more detailed transcript in both English and Korean languages.

The following organizations were given party status and provided technical assistance to the Safety Board: the Federal Aviation Administration, Korean Air Company, Inc., Boeing Airplane Company, Pratt & Whitney Engines, the National Air Traffic Controllers Association, the United States Navy, and emergency response personnel from Guam.

In addition, Mr. Ham of the Korean Civil Aviation Bureau (KCAB) was designated as the Accredited Representative and leader of the Korean delegation in accordance with the provisions of Annex 13 to the Convention on International Civil Aviation. Annex 13 dictates the procedures for cooperation during the investigation of international aviation accidents.

Further, two Air Safety Investigators from the Australian Bureau of Air Safety Investigations (BASI) participated in the investigation as technical observers.

History of Flight
Korean Air flight 801 was a regularly scheduled passenger flight that departed Kimpo Airport, in Seoul Korea, at 2153. The flight proceeded uneventfully en route to Guam. An audio examination of the CVR revealed that the captain was the “flying pilot” and the First Officer (F/O) was performing the radio communications and non-flying pilot duties at the time of the accident.

At 0103, the first officer contacted the Guam Air Traffic Control Center and Radar Approach Control (CERAP) and stated that they were at flight level (FL) 410 (41,000 feet) and over MIXSS intersection, which is located about 240 nautical miles northwest of the Nimitz VOR.

About 0111:51, the CVR recorded the captain briefing the other flightcrew members about the approach to Guam. The captain stated, in part, “I will give you short briefing…since the visibility is six [miles] when we are in the visual approach, as I said bcfore, set the VOR on number two and maintain the VOR for the TOD [top of descent]… in case of go-around, since it is VFR, while staying visual and turning to the right… request a radar vector…since the localizer glideslope is out, MDA [minimum descent altitude] is five hundred sixty feet and HAT [height above touchdown] is three hundred four feet…”

At 0122, the Guam CERAP controller informed flight 801 that the automatic terminal information scrvice (ATIS) report was “uniform” and the current altimeter setting was “29.86.” The first officer acknowledged the transmission and said, “checking uniform,” however, he did not acknowledge the altimeter setting.

At 0124, flight 801 began deviating around cumulonimbus clouds that were scattered along their route of flight. About 6 minutes later, the first officer reported to the Guam CERAP they were clear of the weather and requested radar vectors to runway 6 left.

At 1031, the CERAP controller provided radar vectors to flight 801 and approximately 7 minutes later the controller transmitted, “Korean Air eight zero one, turn left heading zero nine zero, join the localizer.” The first officer acknowledged the transmission.

At 0139, the CERAP controller transmitted,” Korean Air eight zero one…cleared for thc ILS runway six left .. glideslope unusable.” The first officer responded, Korean eight zero one roger .. cleared ILS runway six left,” however, he did not acknowledge that the glideslope was unusable.

Shortly after being cleared for the ILS approach, the CVR recorded the flight engineer say, “is the glideslope working…” to which the captain responded “…yes, yes, it’s working.” At 0139:58, the CVR recorded an unidentified flightcrew member say, “check the glideslope if working,” followed by “why is it working.” The first officer rcsponded, “not useable.” About 23 seconds later thc CVR recorded an unidentified flightcrew member say, ” glideslope is incorrect.”

At 0140:33, the first officer stated, “approaching fourteen hundred.” The captain responded, “since today’s glideslope condition is not good, we need to maintain one thousand four hundred forty. Please set it.” Approximately 20 seconds later the sound of the altitude alert was recorded on the CVR.

At 0141:14, the controller cleared flight 801 to land on runway six left. The first officer acknowledged the clearance and the crew began to reconfigure the airplane for landing. About 0141:42, the CVR recorded the ground proximity warning system announcing “one thousand [feet]; and the captain saying, “no flags, gear, flaps.” About 4 seconds later the captain said, “isn’t glideslope working.” However, there was no acknowledgement of this statement recorded on the CVR. The crew continued to complete the landing checklist items and at 1542:15 the CVR recorded the GPWS announcing “minimums” followed by “sink rate.” This announcement was followed shortly thereafter by the first officer saying “sink rate okay,” and the flight engineer announcing “two hundred [feet].”

At 0142:19, the first officer said “let’s make missed approach,” and the flight engineer said “not in sight, missed approach.” These two comments were followed immediately thereafter by both the first officer and the flight engineer saying “go-around.” Approximately 1 second later the CVR recorded the sound of the auto-pilot disconnect and the altitude announcements by the GPWS. The sounds of the airplane impacting the ground were recorded by the CVR at 0142:25

The published approach procedure for the ILS to runway 6 Left with the glideslope inoperative depicts a series of “step down” altitudes that the pilot is required to maintain during the execution of the approach. The step down altitudes ensure sufficient obstruction/terrain clearance. The lowest altitude for the first segment is 2,000 feet until 1.6 nautical miles from the VOR; this is followed by a step down to 1,440 feet until the VOR. Upon crossing the VOR, the pilot can descend to 560 feet, which is the minimum descent attitude or MDA. Once the pilot descends to the MDA, he/she must have visual contact with the airport environment/runway to continue the descent. If visual contact with the airport does not occur within 2.8 miles of crossing the VOR, or visual contact cannot be maintained, the pilot must execute a missed approach.

According to data recorded by the DFDR, flight 801 began to descend from 2,600 feet when the airplane was about 5 miles from the VOR, or 8.5 miles from the airport. The DFDR and radar data indicate that flight 801 descended at a rate of approximately 950 feet per minute and continued at this rate through the intermediate altitudes of 2,000 and 1,440 feet. The airplane struck rising mountain terrain about one tenth of mile west of the VOR.

Mr. Chairman, in an effort to present a clear picture of the accident related events, I would like to present a video that depicts both the flight track and the flight path of flight 801 as it approached Guam. The video will run approximately 10 minutes and you will see a split-screen view showing the plan and profile views.

QuickTime animation of last 64 seconds of flight
[5M] is available on NTSB web site]

Text summary of video

Flight 801, while in U.S. airspace, was being operated under 14 Code of Federal Regulations (CFR) Part 129. Of the two pilots, one flight engineer, one purser, 19 flight attendants (including 6 deadheading flight attendants) and 231 passengers that were aboard at the time of the accident, 225 received fatal injuries. Further, of the 25 passengers and 4 flight attendants that survived the accident with minor to serious injuries, 2 passengers and one deadheading flight attendant succumbed to their injuries in the 30 day period following the accident.

The Investigation
The following are a brief synopsis of some of the facts revealed thus far:

The captain had been a pilot in the Korean Air Force prior to his employment with Korean Air in November 1987. During his tenure with the airline, he flew the Boeing 727 and the Boeing 747, and had accumulatcd 8,932 hours of total flight time; 3,192 hours in the Boeing 747 and 1,718 hours as a 747 captain. According to company records, the captain had operated a Boeing 727 into Guam for approximately one year in 1993. His last video familiarization training and line experience into Guam occurred on July 4,1997, and was conducted in thc Boeing 747 during night-VFR conditions.

The first officer was also a pilot in the Korean Air Force prior to his employment in January 1994 with Korean Air. He had accumulated 4,066 hours of total flight time, with 1,560 hours as a first officer and in the 747. The first officer received familiarization training for operations into Guam on July 8′ 1997, and had previous operating experience in the Boeing 747 in 1995.

The flight engineer was a navigator in the Korean Air Force prior to his employment with Korean Air, May 1979. He had flown as engineer on the Boeing 727, Airbus A-300, and Boeing 747, and had had accumulated approximately 13,000 hours of total flight time, of which over 11,000 was as a civilian flight engineer.

One issue developed during the investigation evolved from the operational status of the glideslope portion of the ILS approach. On August 6, the glideslope portion of the ILS was out-of service and only the localizer was available for lateral guidance to the runway. However, the CVR recorded statements by various flightcrew members questioning the operational status of the glideslope, thus, the Safety Board became concerned about the possibility of “spurious” radio signals and the influence that these radio signal may have had on the aircraft navigation Systems. We will have a witness testify about this issue later in the hearing.

The investigation team also examined the weather conditions at the time of the accident and found that the reported conditions were: wind from 090 degrees at 6 knots; the visibility was 7 miles in rainshowers; there were scattered clouds at 1,600 feet, a broken layer of clouds at 2,500 feet and an overcast layer at 5,000 feet. However, examination of weather data, doppler radar images, other weather satellite information, and witness statements, indicated there was a rain shower event occurring along the final approach path when flight 801 was executing the approach. Based on these data, this weather event produced heavy rain, gusting wind conditions and reduced visibility.

The en route and approach radar positions at Guam are typically performed by one controller using two independcnt radar systems. Both systems are equipped with a minimum safe altitude warning (MSAW) system that is designed to alert the controller both aurally and visually when an aircraft, in a predetermined geographic area, is below or predicted to be below a specified safe altitude. The investigation revealed that the MSAW system at Guam was not operating as designed or intended at the time of the accident. Detailed information about the MSAW system and its operation, both at Guam and nationwide, will be addressed by several witnesses testifying later today.

The Safety Board found during the investigation that the post-accident emergency response to the accident site was delayed several minutes because the air traffic controller was not immediately aware that flight 801 had crashed off the airport. In addition, the emergency response vehicles were delayed in arriving on-scene because access to the accident site was initially stopped by a fenced gate that encircled the property where the accident occurred; response was further hampered by a narrow paved road that was blocked by a broken pipeline that had been struck by the airplane and disable parked vehicles that congested the access road and prevented fire trucks from maneuvering close to the wreckage. Several witnesses will testify regarding these issues later in this public hearing.</P>
<P>In addition, the Safety Board will also be examining several other issues, including flightcrew training, crew resource management or CRM, and instrument approach procedures and charting.

Post-Accident Investigative Activities

Although the Safety Board’s investigation team completed the on-site wreckage examination August 28, 1997; several other investigative activities have either been completed or on-going. These activities involved examination and tear down of various electronic components, an aircraft performance study and video simulation, follow-up demonstrations of the FAA’s MSAW system, and the detection of “spurious” radio signals in the vicinity of Guam International Airport.

The latter issue regarding the spurious signals led the Safety Board to convene a meeting at Boeing Aircraft Company to discuss spurious radio signals and discuss the effect that these unwanted radio signals may have on aircraft navigation systems. A witness from the FAA will testify during the hearing to discuss this issue.

In addition to the investigative activities, a meeting was convened in Guam in January 1998, and was attended by all of the parties. The purpose of the meeting was to review the progress of the investigation, review the draft group chairman factual reports, and determine future work items. Since this meeting, all of the parties and the KCAB have reviewed the factual reports and their comments have been either addressed or incorporated in the respective reports.

The issues stated by the Chairman in his opening remarks, and those described briefly in this statement, will be addressed by the witnesses that were selected based on their expertise, experience or extensive knowledge of the relevant subjects or issues. Their testimony will provide additional factual information which the Safety Board will use in its analysis of the accident and its determination of the probable cause.

Before I conclude my statement, I would like to take a moment to publicly thank Mr. Ham and the Korean delegation for their continuing support and active participation in this investigation; the Safety Board’s investigative staff who continually go above and beyond the call of duty to complete the investigative activities in a timely manner under very difficult and stressful conditions, the U.S. Air Force and Navy for their cooperation and logistical support, and finally, the officials and citizens of Guam for their support and generous hospitality while the team was on-scene.

Garuda Flight GA152 Jacarta CFIT (Unofficial Transcript)

26.09.97 (13.34h) Airbus A.300B4-220 PK-GAI (214) Garuda Indonesia Airways

• occupants : 12 crew + 222 passengers = 234.
• fatalities: 12 crew + 222 passengers = 234.
• location: Medan; 32km (Indonesia)
• nature: Scheduled Passengerphase: Initial Approach
• flight:  GA152 Jakarta – Medan-Polonia

The aircraft crashed in a wooded area, broke up and burst into flames. The wreckage covered a 150x75m area near the village of Pancur Batu, which is located at 900-1000m amsl. The accident happened 30kms short of Medan Airport. The region is affected by smog from forest fires; visibility was reported to be 600-800m.
Legenda:
MNA241 = Merpati Flight 241 (approaching);
BOU683 = Bouraq Flight 683 (departing);
GIA152 = Garuda Flight 152 (approaching)
Transcript:
GIA 152:  Medan Approach, GIA152 passing 150.
MEDAN:  GIA 152 radar contact 43 miles. Descent to 3000ft for Runway 05, reduce speed to 220.
GIA 152: Descend 3000for Runway 05. Reduce speed to 220 kts., GIA 152.
GIA 152: Approach, GIA 152, request reason to reduce speed above 10000 to 220kts.
MEDAN: OK Sir, your traffic departure sir, now start engine, release traffic departure at or before 27.
GIA 152: 152 like to maintain 210 kts… 250kts, and below 10000.
MEDAN: OK, it’s approved.
MNA 241: MNA 241 passing 10000.
MEDAN: MNA 241, your position now 11 miles on W-11. Contact 1212. Happy landing.
MNA 241: Selamat siang. Terima kasih. (Good afternoon. Thank you)
MEDAN: Any time.
GIA 152: GIA 152; 3000
MEDAN: GIA 152, maintain 3000ft for a while. Maintain heading Medan VOR. Traffic now still taxi Runway 23.
GIA 152: Maintain 3000.
MEDAN: Merpati 152, you turn left heading 240 vectoring for intercept ILS Runway 05 from right side. Traffic now rolling.
MEDAN: GIA 152 do you read?
GIA 152: GIA 152, say again?
MEDAN: Turn left heading a …… 240, 235. Now vectoring for intercept ILS Runway 05.
GIA 152: Roger, heading 235. GIA 152.
GIA 152: GIA 152 heading 235. Confirm we cleared from a ….. mountainous area?
MEDAN: Affirm sir! Continue turn left on heading 215.
GIA 152: On heading 215, GIA.
BOU 683: Good afternoon, approach. BOU 683 departed left turn
MEDAN: BOU 683 continue turn left on heading 120 initial 2000ft.
— line missing in transcript —
MEDAN: GIA 152, turn right heading 046, report established on localizer.
GIA 152: Turn right heading 040, GIA 152, check established.
MEDAN: Turning right sir.
GIA 152: Roger, 152.
MEDAN: 152, confirm you’re making turning left now?
GIA 152: We are turning right now.
MEDAN: 152 OK, you continue turning left now.
GIA 152: A …… confirm turning left? We are starting turning right now.
MEDAN: OK …… OK.
MEDAN: GIA 152 continue turn right heading 015.
GIA 152: Aaaaaa. Allahu-Akbar.
8.    Papers and Comments

Level Busts and the ATC System

Steve Sharp, Inspector of ATC, ATSSD, Safety Regulation Group, UK CAA

Level Busts have probably been with us ever since somebody fitted an altimeter to an aeroplane and tried to stop it (the aeroplane that is) going up and down too much. Nowadays, with high performance aeroplanes carrying large numbers of goods and people over ever more densely populated towns and cities, in an ever busier air traffic environment, the necessity of understanding and adhering to ATC vertical clearances has never been more important.

Much has been written about level busts, but most of the articles I have seen mainly focus on cockpit procedures, autopilot malfunctions and suchlike. This article, however, concentrates on the Air Traffic System, explains how ATC separation is achieved in a radar environment, points out some of the pitfalls of the system and shows why level busts deserve high priority treatment.

The Air Traffic Controller’s sifting process which results in the resolution of conflictions between aircraft firstly relies upon the “reading” of a flight progress board to initially determine if there might be a confliction. Secondly radar is used to refine results and identify which flights require separation by controller intervention using radar techniques. Radar, I am sure, needs no explanation, but a ‘Flight Progress Board’ probably does. Controllers have a note of traffic details printed on flight progress strips which are displayed in moveable holders mounted on the flight progress boards. These boards allow for the strips to be arranged so that aircraft which follow the same, or crossing, routes can be assessed by the controllers, to see whether or not they are separated. This sifting of the available data goes through a number of stages.

The first level of sifting is based upon the idea that flights which are displayed on the flight progress board as flying at vertically separated levels are not in confliction. It follows, therefore that those flights which are at the same level may be in confliction. This first level of sifting results in flights being categorised as “not in confliction” and “might be in confliction“.

The second stage is to decide, again using the flight progress board, which of those flights now categorised as “might be in confliction” are not in confliction. The separation used for this is based on time, supplemented by the controller’s experience and understanding of the particular airspace and traffic situation geometry. This second level of sifting results in more flights being categorised as “not in confliction” and a lesser number being pigeon-holed as “might be in confliction“.

The third stage moves the focus away from the flight progress board to the radar display. Those flights which remain in the category “might be in confliction” are assessed to decide whether tactical intervention may be required. This stage sorts the flights into “not in confliction” and “in confliction”. This time, though, the decision is based on ‘eye-balling’ the situation to decide whether the tracks being flown by flights at the same level are such that intervention by the controller is needed or not.

The fourth stage of the process is tactical intervention to resolve the confliction. This takes the form of the controller instructing the pilot to change level, direction or speed, or any combination of the three.

Looking over this process, it becomes clear that there could be problems with the flights categorised as “not in confliction”. This is because the controller’s (or controllers’) attention will rightly focus upon those flights categorised as “might be in confliction” or “in confliction”, and will be less taken up with monitoring those flights which are understood by the controller to be “not in confliction”. To put it plainly, the controller will believe that these flights are not problematic so they may, to some extent, be ignored. It is worth pointing out that this sifting process is not a formal one, rather it goes on inside the controller’s head and the situation is constantly reviewed and up-dated along with the ever changing traffic patterns.

So, what does this mean in terms of Level Busts? First of all, when a controller assesses that a flight is not in confliction with any other, less time will be spent in monitoring its progress. That is not to say that the flight will not be watched, it will, but to a lesser extent than those flights requiring intervention. It follows that the greater the number of flights assessed as “in confliction”, then the less time is spent in monitoring the rest. This means that the controller is relying, even more than normal, on the pilot flying the aircraft in accordance with the vertical clearance. Additionally, controllers are less likely to spot a level bust early since their concentration will be elsewhere.

Simple arithmetic tells us that with 1,000 ft separation being used, a modern business jet climbing at 6,000 ft/ min will take only ten seconds to change a situation from one where separation is assured, to one where a collision is happening. Even with lower rates of climb and descent the amount of time available for the controller to notice, take in the situation and react is minimal. When you further consider that the controller’s radar display is being updated at, typically, once every 6 seconds the seriousness of the situation can be seen even more clearly.

However, the danger of a collision between the level busting aeroplane and another is only part of the picture. In a busy traffic environment the controller(s) will have prioritised tasks and be constantly reviewing these. When a level bust happens, it means that these priorities have to be instantly changed, in exactly the same way as they would in the event of a full blown emergency situation. The extent of this re-appraisal will depend on the general situation at the time, and whether or not the level bust has caused a separation loss. Even if no separation loss has occurred, there will be some increase in workload and, possibly, some dis-orientation of the controller(s) involved. This could well be a contributory factor in an another incident.

The problems associated with this process are an integral part of our ATC system, and are likely to remain so as long as the ATC system stays predicated on a level allocation foundation, with people, Air Traffic Controllers, playing such a central role. For all the computerisation and technological advances of recent years, their main impact on the Air Traffic Control System has been to provide controllers with better quality information, and some late stage warnings of critical separation loss (short term conflict alert systems), and to similarly provide pilots with late-stage warning of impending collision (TCAS). Ultimately reliance is placed upon the personal skill of the controller to understand the traffic situation, sift out the real conflictions and solve them.

It is important to realise that this sifting process works the vast majority of the time. The rub is that if it fails the results could be catastrophic. So where do we go from here? In the longer term systems will undoubtedly be developed which reduce the reliance on people, and so reduce the likelihood of human error. In the short term, however, the only viable way forward is through greater understanding of the ATC system by pilots and controllers alike, so that the people involved at the sharp end of aviation are better able to minimise the risks inherent to their jobs.
Level Busts – Outline

Richard Profit, CAA SRG Aerodrome and Air Traffic Standards
Aircraft not maintaining the heights assigned by Air Traffic Control is a growing problem worldwide. Richard Profit, Head of the Aerodrome and Air Traffic Standards Division within the CAA’s Safety Regulation Group, outlines the situation and what is being done about it.

Commercial aviation in the United Kingdom enjoys a deserved world-wide reputation for the highest standards of safety and efficiency. Over the past 20 – 30 years aircraft design, technical developments, fail safe systems, built in redundancy and automatic checking routines have steadily reduced the number of aircraft and air traffic service system failures to the extent that reliability has never been better. The end result is that flying has become much safer than it was 30 years ago in terms of accident rates (accidents per million hours flown).

However, the number of commercial passenger aircraft hours flown is steadily increasing each year. This means that even if the current low accident rates are maintained, there is likely to be a greater total number of accidents each year – simply because the total number of flights is increasing steadily year on year. Although the risk does not change as far as the individual passenger is concerned, there could be a perception that flying is becoming more dangerous and every effort needs to be made to reduce the current accident rate if public confidence is to be maintained at a high level.

Some accidents still occur that are due to ‘systems’ or ‘technology’ failures, but less frequently than in the past. However, as the technical factors in aviation accidents are slowly overcome, to achieve a reduction in accident rates it is necessary to focus on the main group of other contributory and causal factors – the human factor elements. These are associated with the people who work in the air transport business – the pilots, air traffic controllers, maintenance personnel, design teams and the managers of all of these groups, together with the many other people who work to ensure that the general public can fly safely.

Human Factors, as significant players in accidents and incidents, are never more pertinent than in the area of “Level busts”. This phrase has come to be the accepted parlance to describe those occasions when an aircraft has failed, by 300ft or more, to maintain the height allocated to it by Air Traffic Control.

In 1995 the Safety Regulation Group noted that there were “235 level violations recorded in UK airspace in 1994. Of these, 22 were aircraft proximity hazards involving a serious loss of separation of which 5 were assessed as having had an actual risk of collision”. Although some of these incidents had solely technical causes, two categories stood out as the most significant factors. These were pilot/systems interface problems and pilot/air traffic controller interface problems – Human Factor problems. The former category included errors in altimeter and/or autopilot setting procedures together with other errors involving the monitoring of flight deck displays. The second revolved around communications difficulties between controllers and pilots, including misunderstandings, incorrect readbacks missed by controllers, clearances being taken by the wrong flight and suspect cockpit resource management.

Since that review of the 1994 occurrences, the increase in reported incidents caused such concern that the CAA’s Safety Regulation Group formed a Level Busts Working Group to target the problem more effectively. That group is leading efforts to reverse the trend and reduce the number of level busts. So far, representatives from British Airways, British Midland, British Regional Airlines and air traffic controllers have worked alongside Safety Regulation Group, National Air Traffic Services and Department of Airspace Policy personnel in an effort to tackle the level bust hazard. This initiative is already bearing fruit in that procedures are being reviewed and changed, air traffic controllers have been briefed, articles (such as this) aimed at raising awareness have been published and the causes of the problem are being better defined.

The problem
Imagine an aircraft climbing to its pre-assigned level (height). For any one of a number of reasons the aircraft overshoots that level and infringes the next one up. Rather like the tired driver drifting across the centre of a quiet road, the chances are that no harm will be done if there is no other traffic around and no-one will be any the wiser, other than the driver concerned. Similarly with a level bust, if there was no actual risk of collision and the pilots and controllers concerned decided not to file a report, those involved will be the only ones to learn the lessons. The trouble is that the consequences of a collision between two aircraft exceed by far the consequences of a collision between two cars.

How such an incident is viewed by those involved can have a significant effect on whether or not it ever gets reported. If a level bust involves only one aircraft, then it can reasonably be argued that there was no risk of collision. With this mind set we are unlikely to hear about any level busts which did not involve at least a loss of air traffic control separation, since the pilots and controllers involved see it as something to ‘put down to experience’, after all there was no actual risk, was there? There is anecdotal and statistical evidence to suggest that many level busts go unreported for this sort of reason, or perhaps because the effect of reporting a level bust may well be some form of investigation with a consequent threat to the career prospects of those investigated. Unfortunately, if no reports are filed then the rest of the aviation community are unable to learn from that experience too.

If, however, all level bust incidents can be perceived as being potential collisions, there should be a greater likelihood that more reports will be filed thus providing more information on the causal factors; after all, the mechanism which causes a level bust is exactly the same whether the result is a miss or a collision. If pilots and controllers can be given more confidence that incidents will be investigated by both the regulator and their employers with the sole aim of preventing a recurrence, then more reporting will be encouraged. This is not to say that where personal competence is in doubt the situation should be ignored, rather the people involved should expect training to resolve the problem rather than disciplinary action. After all, to discipline rather than re-train is no more cost effective than replacing an expensive component when all that is needed is a repair job. It is, perhaps, in this area that managers can have significant influence on the safe operation of their company aircraft or the air traffic service they are providing.

Why is there a problem?
Even within the aviation community there are many misunderstandings of the nature of air traffic control, perhaps especially in a radar environment. Through reading press reports it is easy to believe that air traffic controllers, using sophisticated computer technology, monitor all flights at all times. This quite simply is not so. Even in airspace where all flights are known to the air traffic system, those aircraft whose flight paths are categorised as not in confliction with any other are watched less closely than others.

This is because controllers rely on the fact that flights have been allocated particular levels so that they can devote more attention elsewhere. After all, if a pilot has been instructed to stop a descent at 10,000ft, and has acknowledged that instruction, it is reasonable for the controller to believe that the instruction will be carried out. This reliance, or trust, that instructions will be followed is a central tenet of the current air traffic control environment and without it controllers could handle very few aircraft. There are, in many cases, ‘safety net’ systems to reduce the risk of collisions if an aircraft overshoots the allocated level and comes into conflict with another. The Short Term Conflict Alert System gives ‘late stage’ warnings of critical separation loss to controllers, and the Traffic Alert And Collision Avoidance System provides pilots with advice on manoeuvres needed to avoid close encounters. They do not, however, remove the reliance of the controller on pilots following verbal instructions passed by radio.

One area where controllers must rely upon flights rigidly adhering to their assigned level is in holding stacks. Flights, stacked one above the other, fly around radio beacons at 1,000ft intervals while waiting for clearance to start an approach to an airport in busy periods or when, for instance, poor weather precludes landing. In this circumstance controllers are unable to monitor aircraft on radar because the radar equipment is unable to distinguish one aircraft from another as they pass over and around each other while waiting their turn. The controllers have no alternative but to rely on their instructions being followed since any radar data from the holding flights is unreliable. Indeed, controllers are trained not to use radar in these circumstances. To exacerbate matters, the controllers’ Short Term Conflict Alert System is least effective in the holding situation.

It can be seen, therefore, that the communication of climb and descent instructions between controllers and pilots is a safety critical area. In the longer term digital data link technology may well improve the situation. Until then verbal communication together with the manual input of vertical clearance instructions into flight management systems, or the manual flying of aircraft in accordance with air traffic control instructions remain the only options along with the potential for human error.

The way forward
Level busts must be seen in context. In 1996, for example, there were only 8.3 level busts per 100,000 movements. It is important to emphasise that the current air traffic control system does work very safely indeed – it is equally important to minimise all recognised risk areas, not just because of high probabilities of failure, but because the consequences of that failure can be catastrophic. Thus there is no room for complacency.

The Level Busts Working Group has set in motion a series of initiatives to deal with these problems. Some of the factors which contribute to level busts are already known, but further information and analysis is needed to identify the most effective remedial action. Over the next two years an awareness campaign will be mounted in tandem with a data gathering and analysis exercise to alert pilots and controllers to known pitfalls, and to develop effective strategies to minimise the risks of an accident. These efforts will take some time to bear fruit. In the meantime, if employers of both pilots and controllers engender a blame-free atmosphere which encourages honest reporting of incidents both within and external to their own organisations, then the resulting sharing of information will enable earlier identification of long term solutions and , most importantly, raise pilot and controller awareness of this human factor problem and reduce the potential for a catastrophic accident.

Level Busts – Considerations for Controllers and Pilots

P Tring and D Coxon, Principal Inspectors of Air Traffic Services

In these days of high traffic volumes, maintaining the intense vigilance required to guard against level busts can be very stressful for the controllers involved. It is, however, important to maintain a sense of perspective. During 1996 there were 172 level busts reported in the UK – a small number given the millions of flights within UK airspace.

There is no room for complacency though. The overall trend is a gradual rise in level bust incidents as traffic increases but, even if we maintain the same percentage of level busts per flights operated, the increasing number of incidents may be unacceptable. Therefore, we must reduce the number of level busts. There is also no room for finger pointing. Level busts can stem from any number of causes and in all phases of flight. It is not for pilots or controllers to blame each other; instead they should work together to reduce and, if possible, eliminate level busts.

This article aims to give an insight into some of the techniques being adopted by controllers as “best practice” to try and reduce level busts. As a pilot reading this you will hopefully understand why controllers operate in particular ways, and therefore increase your own awareness of the situation. As a controller meeting these ideas for the first time you will perhaps discover some techniques to enhance your controlling. Some of them may seem blindingly obvious but it does no harm to remind ourselves of what good technique is: sadly, all too often it is found to be lacking when incidents are investigated.

Firstly, communication! Since controllers and pilots communicate verbally, it is vital both parties understand what is being said. Sometimes, for perhaps one or both parties, English is NOT the first language. If we do both speak English then avoid going ” native ” and using colloquialisms that are often more likely to be misunderstood, and do nothing to help third parties using the same frequency maintain some degree of situational awareness. So let us ALL use clear unambiguous STANDARD PHRASEOLOGY.

If somebody is having trouble understanding, then treat them with more care. Be alert for strangers to your airport or airspace, alert colleagues and adjacent units to the potential problem. If you work at an airfield why not try and make contact with new operators, perhaps via the handling agent, to describe ATC procedures in use and highlight possible difficulties? As a pilot why not visit air traffic to discuss your operations and learn how the local airspace is managed?

Continuing on the theme of communication, controllers should avoid multiple messages and be aware of the pilots’ circumstances. Imagine yourself with a B747 strapped to your posterior having been up all night, perhaps having crossed three times zones before staring into a blinding sunrise and, to cap it all, a controller tells you to descend to this level, by this DME distance, fly that heading and this speed and by the way there will be a forty minute hold for landing! There are just too many numbers, just too much opportunity for confusion, it is just too easy get figures mixed up and have an aircraft descend to your heading! Split instructions into two or more transmissions with instructions paired unambiguously and, having heard a correct readback, allow the pilots enough time to implement those instructions before passing more.

“Traffic information”, or is it “information on traffic”? Experience has shown that reference to the level of conflicting traffic, often given in response to a request from an aircraft for further climb or descent clearance, can be mis-interpreted and result in the aircraft continuing to the level of the conflicting traffic. Many controllers now often respond to requests for further climb or descent with, “Roger, maintain flight level, traffic …………….., a thousand above or, a thousand below”, as appropriate. This information is not strictly, “traffic information”, as described in the Manual of Air Traffic Services, but “information on traffic”. There are plans to amend the manual so that this difference is recognised and reflected in standard phraseology.

Remaining with the theme of requests for further climb or descent clearance, the only response to such a request should be “Roger, maintain flight level/ altitude (<I>actual cleared level</I>), (with information on traffic if appropriate) or a further climb or descent clearance. NOT some slick sounding reply like, “Coming soon, further in 5 miles inbound company traffic crossing etc., etc.”! Such verbosity uses up valuable R/T time and can create further opportunities for mis-understanding.

Controllers within LATCC Area Control, and elsewhere, often find themselves, having given initial climb clearance, asking pilots for their requested cruising level. The opportunities for mis-interpreting what is a question and what is a clearance are easy to appreciate. Good practice is that following the question the controller should acknowledge the level requested and then RESTATE the current cleared level.

Example

• Controller – “Big Jet 101 climb FL 280, what is your requested cruising level”
• Pilot – “Roger, Big Jet 101 cleared FL 280 and we are requesting flight level 350”
• Controller – “Roger Big Jet 101, maintain FL 280 on reaching”

It may sound really obvious, but you might be surprised how often the result of similar exchanges has been the aircraft continuing climb to the requested level, sometimes even with English speaking crews!

Some controllers often omit repeating the level when it is given by a pilot establishing first contact. The potential for an incident if the controller should mis-hear or make a mistake when acknowledging the level was illustrated in the Aircraft Proximity Reports Airprox (C) Vol. 12, report 24/96. Some pilots from states where a non-standard form of ICAO phraseology is used can interpret the expression, for example “maintain FL310” as clearance to climb or descend to that level if not already maintaining it.

Pilots may have noticed that controllers often now come back and confirm the cleared level and give “information on traffic” as the cleared level is approached. This has developed in response to the activation of the Short Term Conflict Alert (STCA) available on some radar displays. The controller will, if workload allows, reiterate the cleared level if the radar indicates that no horizontal separation will exist between aircraft, i.e. only vertical separation, a situation where failure to maintain the cleared level could become immediately critical.

The opportunity for level and heading instructions to become transposed has long been appreciated. A technique being used to help reduce this is to try and use, if the tactical and airspace situation allows, headings that end in increments of “5” degrees. Another is to use the word “degrees” at the end of a heading instruction. These are most effective in airspace where headings and levels are in a similar banding. There are sectors, for example, where the most commonly used levels are FLs 100, 110 and 120 and the most common headings are from 090 degrees to 120 degrees. The potential for confusion is obvious!

We are all now familiar with reference to FL 100 as “flight level one hundred”, but a habit has developed of using the word, “hundred”, when referring to flight level two-zero-zero and when referring to the heading, one zero zero degrees. Remember that the aim is to make, “one hundred”, unique so that it stood out and could not be missed. Using it in other circumstances defeats that object.

There have been cases of aircraft, after flying a standard instrument departure (SID), climbing above the highest SID altitude directly to their requested cruise level without ATC clearance. The aim is to change the UK Air Pilot (AIP) requiring pilots to state their cleared level or altitude on first contact with departure radar. If this information is not given then the controller is responsible for confirming the level. In the case of those UK airports with “stepped” SIDs, then the controller must confirm that the aircraft is/or will follow the correct profile. Due to an embargo at present on changes to the UK AIP, because of a major re-write, this change will initially appear as an Aeronautical Information Circular (AIC).

If as a pilot or controller you should be unlucky and be involved in a level bust incident what should you do? Firstly, whether you are a pilot or controller, make the situation safe, then make other parties involved aware that reporting action will be taken even if only one aircraft is involved. Do not become embroiled in discussion and argument over responsibility on the frequency! Such un-professional action is a distraction from primary tasks and could lead to another unrelated incident. Safeguard the evidence for those reports and then get back to concentrating on your job. If you feel discussion would be of benefit then arrange quickly to make contact later. R/T and radar recordings will normally provide all the information required to investigate the incident. We in the Safety Regulation Group rely on your full, prompt and honest reports to identify causal factors and thus improve air safety for everyone’s sake.

We hope the preceding has been of interest to you and that it will set you thinking about your own technique whether pilot or controller. The best way to beat level busts is to increase our awareness of the problem, educate ourselves about best technique, and then maintain our professional discipline to make sure we always do things the best way. If this all encourages you do that then it has been worthwhile, and if it stops even one level bust it will have been even more worthwhile, because that could be a tragedy averted

Finally, for pilots, if you have any doubt whatsoever about an ATC clearance then seek confirmation. That does not mean repeating the clearance in a quizzical, questioning tone. Such subtle intonation cannot be guaranteed to be recognised by controllers, especially if they are busy. The sure method is to clearly state, “CONFIRM that was for (callsign)”, or “SAY AGAIN  our cleared (flight level/ altitude/height)”. For controllers, listen to those readbacks! If in doubt, RESTATE the clearance and AS for clear confirmation. Do not use readback time for getting on with the next task, Remember, failure to spot an incorrect readback was cited as the biggest single cause of controller derived level busts during 1994!

GOOD PRACTICE TO AVOID LEVEL BUSTS

• Increase vigilance, particularly in TMAs and where traffic density may be high
• If in doubt, confirm on the RT, not with your colleague

PILOTS

• Seek confirmation from ATC if in any doubt about a clearance
• Follow SOPs for vertical clearances in their entirety – they are your first ‘defence’ against busting a cleared level.

CONTROLLERS

• Handle unfamiliar operators with care.
• Use clear and unambiguous standard phraseology
• Avoid multiple instructions
• Pay particular reference to readbacks
• Awareness – contact operators via handling agent/airline operations
• Restate cleared level when asking requested level
• Restate cleared level – if no horizontal separation
• Avoid reference to level if giving “information on traffic”
• Consider using heading instructions that end in “5”
• Confirm cleared SID level or altitude at departure
• Alert colleagues to potential problems

ATC Radar – When It’s Not Watching You

Steve Sharp, CAA SRG

Level Busts, unauthorised deviations from ATC cleared level, are facts of aviation life. As the numbers of flights have grown so have the number of level busts although the occurrence rate has remained reasonably steady. Concern over the increasing number of incidents is growing and the CAA’s Safety Regulation Group is conducting an awareness campaign to highlight this issue.

Preliminary analysis indicates that some aircrew may harbour misconceptions about ATC capabilities which could contribute to a lessening of vigilance on the flight deck. Issues discussed here relate to the use of radar and are especially relevant to the holding situation.

On November 12th 1996, at around 1638, an MD81 en-route from Aarhus in Denmark entered the Lambourne (LAM) holding pattern prior to making an approach to land at London’s Heathrow Airport. Two minutes later a Boeing 737-400 from Amsterdam, also bound for Heathrow, called on the same frequency and was also instructed to hold at LAM. The MD81 was instructed to descend to FL140 and subsequently reported at that level. The Boeing 737 was then instructed to descend to FL150, and this instruction was correctly read back by the crew. 1,000ft vertical separation is the minimum permitted in this airspace.

Nevertheless, by 1644 vertical separation had reduced to 100ft and the two aircraft had closed to around 750 metres horizontally. The Boeing 737 had descended at a rate of about 1,000ft per minute, and at its lowest, had descended to 14,052 ft (1013mb). The controllers concerned, having taken appropriate action to ensure that the aircraft were vertically separated, were no longer specifically required to constantly monitor the two aircraft and were devoting their attention to other flights. Their attention was drawn to the incident when an automatic system, the ‘Short Term Conflict Alert’ (STCA), activated to indicate that there was a possible imminent loss of separation requiring immediate attention.

No one is entirely sure why the correctly read back cleared level was not set on the Boeing’s flight deck. However, when the Boeing 737 pilot read back the correct descent clearance to the Air Traffic Controller, the other pilot was not in the communication loop. Instead, he had been briefing the passengers over the aircraft’s passenger address system. Thus an essential safeguard, a second pilot to check that the vertical clearance was correctly understood and implemented, was missing from the system. One conclusion that can be drawn is that the timing of passenger announcements and other non-essential tasks which remove a crew member from the R/T communications loop can be critical to flight safety.

Following their investigation, the AAIB recommended that the airline concerned review its Standard Operating Procedures in the light of this incident. ‘Human factors’ such as this have been implicated in many aviation incidents. It is likely that, as technology becomes more reliable in itself, such factors will become more visible in the future, not so much because they are on the increase, but because incidents due to other factors will be fewer.

This incident, though, raises questions about the relationship between Air Traffic Control and the Flight Deck Crew, and what Flight Deck Crews might reasonably expect from the Air Traffic Controllers responsible for their aircraft’s separation from others; after all, these flights were in controlled airspace and ATC should have been watching all the time, shouldn’t they?

Actually, Air Traffic Controllers cannot monitor all flights at all times, and they do not attempt to do so. Rather, they mentally sort flights into groups – groups of aircraft which require frequent attention and groups which do not. In the case of the MD81 and Boeing 737 at LAM, these aircraft were in the ‘do not require frequent attention’ group. That is because, as far as the controllers were concerned, the immediate problem of separating these two aircraft had been sorted out ‘procedurally’ – by the aircraft being assigned vertically separated levels, and the pilots correctly reading back the appropriate instructions. For the controllers this communication and confirmation process is a matter of ingrained normal operation and has greater significance in the holding situation since controllers are trained not to rely on SSR information when aircraft are in close proximity laterally, as is the case when aircraft are stacked in a holding pattern.

This is not to say that controllers will never use SSR to check on holding aircraft, they will and do. Instead it is a recognition that the radar systems in use are unable to reliably present controllers with consistently accurate data when aircraft are close together horizontally. In fact, on occasions, the data blocks containing aircraft identity and altitude information can transfer from aircraft symbol to aircraft symbol on the radar screen, even when the aircraft concerned are correctly vertically separated (or indeed are many thousands of feet apart vertically). So, what looks to the controller to be one aircraft’s data are actually those of another, or are completely corrupted. This corruption of information may even lead to spurious activation of the STCA facility. (STCA is not a TCAS for controllers in that it does not give ‘advisories’ to resolve a situation: the controller must take a few seconds to assimilate the situation, perhaps by querying the pilots’ actions via R/T, before being in a position to act – by which time it may be too late to prevent an erosion of separation. It is worth noting that neither aircraft in this incident was equipped with TCAS.)

So where does this lead us? In holding patterns, perhaps more than anywhere else, the ATC separation system relies on the accurate communication of vertical clearances between all those involved in safely managing a flight. The process of safely changing the level flown by an aircraft is a complex one where the pilots flying the aircraft and the controllers managing the flight can be considered to be part of the same team exchanging information with opportunities for error every time information is passed on. Sometimes, as in the incident discussed earlier, that error is a human one which exposes a weakness in procedures designed to provide “fail-safes” on the flight deck, or between the flight deck and the ATC unit, or within an ATC unit alone. These mistakes can happen at any stage in a flight, but in a holding situation the safety net of ATC radar is much less effective, resulting in a less secure environment should a vertical clearance be misunderstood.