SUBJECT - ERRORS IN TRAFFIC ALERT AND COLLISION AVOIDANCE
SYSTEMS
SAFETY DEFICIENCY
The traffic alert and collision avoidance system (TCAS) used in
modern aircraft is an excellent and well-proven defence against
mid-air collisions. However, under certain circumstances, some
specific identified design deficiencies, system errors and
equipment failures have increased the risk of a mid-air
collision.
FACTUAL INFORMATION
Occurrence Summary
The Boeing 747 (B747) was maintaining flight level (FL) 350 when
the crew received a TCAS alert warning of conflicting traffic
crossing their track at an altitude 400 ft below. They were able to
contact the other aircraft, which was a US-registered Douglas DC8
maintaining FL330 in accordance with air traffic control
instructions. Both crews were able to maintain their respective
levels and no evasive action was required.
When the DC8 departed Auckland, air traffic control verified that
the secondary surveillance radar altitude readout had correlated
with the altitude reported by the crew. However, as the aircraft
approached Honolulu, air traffic control noted a 1,500 ft
difference between the altitude reported by the crew and that
showing on the radar display. The aircraft transponder was
transmitting an erroneous altitude; however, the crew had no
flightdeck display to enable them to check what altitude
information the transponder was emitting. The equipment failure had
occurred between departing radar coverage at Auckland and the point
at which the B747 crew received the TCAS alert.
Initial maintenance action by the company indicated that a faulty
transponder encoder was the problem. However, an investigation in
the USA subsequently revealed that the central air data computer
had been providing faulty inputs to the aircraft's two
transponders. The central air data computer provides information
relating to atmospheric conditions to the aircraft's instruments,
pressurisation and other systems. The central air data computer
fault had affected the pressurisation system and transponders,
without being evident on any of the aircraft's instruments.
Related Occurrence
British Airways is conducting an investigation of the following
incident. The occurrence summary and the preamble to each
recommendation are based on the contents of British Airways'
preliminary investigation report. The recommendations are quoted
directly from that report.
On 28 June 1999, a British Airways Boeing 747-400 passed an
opposite direction Boeing 747-200 with no vertical separation and
200 m lateral separation. At the time, the crews of both aircraft
were responding to TCAS resolution advisories.
The B747-200 was cruising at FL315 in Chinese airspace when the
TCAS reportedly issued a climb resolution advisory for an intruder
shown 400 ft below. The crew followed the TCAS climb commands until
the two aircraft crossed altitudes. The B747-400 was cruising at
FL335 when the crew observed traffic on the TCAS 1,900 ft below.
The B747-400 TCAS then issued a descend resolution advisory, with
the other aircraft shown 400 ft below and climbing, approximately
10 seconds before the aircraft passed. The separation was estimated
from the B747-400 co-pilot's visual acquisition of the aircraft
through the side windows of the flight deck.
British Airways Analysis and Recommendations
At this stage, the investigation has established that the B747-200
transponder probably replied to the B747-400 TCAS with incorrect
altitude values. It also provided incorrect altitude to the TCAS
fitted on board the B747-200. The subject B747-200 aircraft used a
"Gillham" interface between the air data computer and the
transponder, and a simple fault on this interface could have
generated the altitude shift of 2,400 ft that is suspected to have
led to the occurrence. Also, the Gillham altitude data is not used
by any other equipment in the aircraft, and any erroneous altitude
data would therefore not have been evident to the crew. The TCAS
equipment is normally protected against such a Gillham altitude
shift by comparing two sources of altitude data. If the altitudes
differ by more than 500 ft, the system shuts down. Although the
B747-200 aircraft should have had this protection, further
investigation identified a malfunctioning connector to the Number 1
transponder and consequently an explanation for the failure of the
altitude comparison function in the aircraft. Without specific
investigation, the failure was not apparent to the crew or to
maintenance personnel. Potentially, there are large numbers of
aircraft worldwide operating with such an equipment
configuration.
Preliminary information indicated that the failure of the attitude
comparison function in the transponder system of the B747-200
aircraft, combined with the failure of the Gillham coded altitude
interface between that aircraft's air data computer and the
transponder resulted in the incident under investigation.
This incident placed both the aircraft involved and all on board at
very high risk. The loss of separation between the two aircraft was
caused by the overall failure of TCAS coordination between the two
aircraft. Ultimately, it was only the 200 m lateral separation that
prevented a mid-air collision, and this separation was not provided
by TCAS avoidance manoeuvres. More importantly, the TCAS
coordination between the aircraft exacerbated the seriousness of
the breakdown of separation. Ensuring that safety actions are
implemented to prevent further recurrence is therefore
imperative.
The investigation team identified a number of safety deficiencies
and subsequently issued several recommendations. In the interests
of air safety, these preliminary recommendations should be given
full consideration as soon as possible by all parties
involved.
Gillham Altitude Comparison Function
Analysis of the Gillham altitude comparison function of the
transponder and its activation has identified a number of concerns
with the design and implementation of this function. The altitude
comparison function of the transponder is an optional feature. As
such, the transponder does not recognise if altitude comparison is
active. Without automatic recognition of a failure of the altitude
comparison feature, a functional test is required to ensure that
the function is active.
Primary Recommendation: "An Airworthiness Directive should be
issued to require an immediate functional check of the altitude
comparison function in all TCAS equipped aircraft using Gillham
altitude sources."
Primary Recommendation: "Regular checks should be put in place on
all aircraft using Gillham altitude data to ensure continued
correct operation of transponder altitude replies and altitude
comparison."
If, for the purposes of TCAS, an aircraft is fitted with a Mode S
transponder that uses a Gillham altitude source, the investigation
team considers that the use of two Gillham sources and an altitude
comparison function is essential. Currently, if the comparison
function is inactive, the transponder will continue to operate.
Modifications could be made to transponders so that the unit
automatically carries out the altitude comparison function when
using Gillham altitude data. Also, the unit should indicate if the
altitude comparison function is inactive.
Primary Recommendation: "Consideration should be given to a
modification to Mode S transponders that causes them to
automatically compare Gillham altitude data or to report a failure
when Gillham altitude sources are selected and the altitude
comparison function is not activated."
Gillham Altitude Data
The Gillham altitude output of an air data computer was originally
provided as the altitude reporting source on the aircraft and is
not generally provided to any instruments in use by the flight
crew. Originally, transponders only received altitude data via a
Gillham interface. However, modern transponders provide four
different interfaces to obtain altitude data from the aircraft.
When TCAS is installed in an aircraft, a transponder system upgrade
may allow the use of a different altitude interface. A significant
number of TCAS installations have continued to use Gillham altitude
interfaces to the transponders despite the availability of
potentially better alternative interfaces. Also, the use of an
altitude source to the transponder that is also used by instruments
on the flight deck provides an opportunity for any discrepancies to
be noticed by the crew.
Primary Recommendation: "No further installations of TCAS and Mode
S should be certified using Gillham altitude sources where a more
robust and widely used source is available in the aircraft."
TCAS
The TCAS on both aircraft appeared to function in the way that was
expected, based on the erroneous altitude data from the B747-200
transponder. Notwithstanding this, a number of observations were
made during the investigation regarding how TCAS displays
information and how it handles an altitude shift. It is therefore
appropriate to make recommendations for further evaluation of the
TCAS design in the light of this incident.
TCAS Logic
The TCAS logic appeared to have acted as expected in response to
the erroneous altitude data, but a number of questions were raised
regarding how the two TCAS units handled the altitude shift. The
primary areas for consideration are:
1. the way the B747-400 TCAS initially ignored the erroneous
altitude data from the B747-200 aircraft, while the B747-200 TCAS
continued to use this data;
2. the way the two TCAS units probably coordinated the manoeuvres
such that the B747-400 TCAS issued a descend resolution advisory,
despite the actual location of the B747-200 aircraft, and
3. the way the two TCAS units probably coordinated the manoeuvres
despite the B747-400 TCAS assessing that there was no conflict
between the aircraft.
Recommendation: "Consideration should be given to changes in the
TCAS logic that handle such altitude jump scenarios better."
TCAS Aural Annunciations
The flight data captured from the B747-400 aircraft indicated that
a "crossing descend" resolution advisory was sent to the TCAS
display followed by an "increase descent" resolution advisory. The
captain of the aircraft believed that the aural alert issued was
"descend now". Although it cannot be confirmed what aural alerts
were actually issued, it does raise the question as to the
effectiveness of such alerts and the crew's instinctive reactions
to them. This would not be the first incident where crews believed
they heard a command other than that supposedly issued.
Recommendation: "Evaluation should be made, in the light of this
and other incidents, of the effectiveness of the TCAS aural
annunciations used."
TCAS Traffic Display
Investigation of the incident has raised a number of concerns
regarding the information provided to the crew via the TCAS traffic
display. First, the B747-200 TCAS "thought" that its own altitude
was FL339, although the crew were completely unaware of this
information. It may therefore be appropriate to provide some
indication of the aircraft's own altitude on the TCAS display,
particularly where the transponder altitude source is not one used
in the flight deck. Had such a display been available in this
incident, the crew may have been able to crosscheck the transponder
altitude with the altitude displayed on other instruments.
Recommendation: "Consideration should be given to providing an
indication of own aircraft altitude on the TCAS display in certain
types of installation."
Second, the range of the B747-200 aircraft's TCAS display was
limited to either 6 NM or 12 NM. As a result, the B747-200 crew
would have first been made aware of the B747-400 aircraft,
apparently 400 ft below them, as the traffic advisory sounded when
the aircraft were only about 10 NM apart. Had a traffic display of
greater range been provided, there may have been time for the
B747-200 crew to confirm that there was actually no aircraft 400 ft
below them, and potentially to switch altitude sources to eliminate
the failure.
Recommendation: "Encouragement should be given to ensure that
future TCAS installations provide greater ranges to aid crew
situational awareness."
Third, the aircraft shown on the TCAS displays were not displayed
with their flight identification (call sign). This display,
particularly when combined with the increased range, would have
helped enable the B747-200 crew to identify the error in their TCAS
indications and commands.
Recommendation: "Efforts should be made to ensure that transponders
automatically report the aircraft Identity in the Mode S reply
[and] that future TCAS installations provide the ability to display
this Flight Identity on the TCAS traffic display."
Fourth, it is believed that the B747-400 TCAS displayed the
B747-200 aircraft as 1,900 ft below, even though the altitude
replies from the B747-200 transponder were not at that altitude.
Although the TCAS unit was aware that the display was based on a
coasted altitude, the crew would not have been. Although there is
obviously a risk of providing unnecessary information to the crew,
it may be appropriate (perhaps by using a different symbol) to
identify on the TCAS display, aircraft providing erroneous data
that is being ignored or smoothed.
Recommendation: "Consideration should be given to providing an
indication on the TCAS of intruders whose data is suspect."
Finally, had the TCAS display indicated that their aircraft was in
a coordinated manoeuvre, the B747-400 crew might have been aware of
the manoeuvring of the B747-200 aircraft prior to the altitude data
becoming good. This could be done in future with the use of a
different intruder symbol, although again the risk of
over-complicating the information to the crew needs very careful
human factors consideration. Combined with the indication of
suspect intruder replies, such information could have been
beneficial in this incident. Such an indication might also help to
increase the crew's awareness of the need to follow a crossing
resolution advisory where following the TCAS commands in both
aircraft is critical to ensuring separation is provided.
Recommendation: "Consideration should be given to providing an
indication on the TCAS display of an aircraft that is in a
co-ordinated TCAS manoeuvre with own aircraft."
Airborne TCAS Event Recording
The availability of more detailed TCAS data from this incident from
the digital flight data recorder would have helped the
investigation and improved its explanation of the events that
occurred. Many recent TCAS units provide this facility but it is
not yet widely implemented.
Primary Recommendation: "Encouragement should be given to the
implementation of detailed TCAS event recording within and external
to the TCAS computer."
Ground-based Transponder Altitude Monitoring
The risks associated with Gillham altitude shifts and the use of
the data in TCAS have been known since the introduction of the
system. Because TCAS uses the same altitude data and replies as
those used in ground-based air traffic surveillance systems, it was
considered that the air traffic controller would detect any
discrepancies when the aircraft was under radar coverage. Assuming
that all aircraft operate in radar coverage for at least some of
the time, significant failures should be identified. This
investigation has identified several flaws in this argument:
1. the radar interrogation rate is likely to be between 6 and 10
seconds, where TCAS's is every second;
2. modern radar networks carry out smoothing of the data and, like
TCAS, would potentially ignore and coast when poor altitude data is
received, and
3. a momentary altitude shift is likely to be overlooked by a
controller but may not be by TCAS.
It would therefore be appropriate to look at the implementation of
systems in a ground radar environment that could capture any
erroneous altitude replies received and identify aircraft that are
providing them. This would enable constant monitoring of
transponder replies from all aircraft in coverage, regardless of
state of origin or operator, and would also enable aircraft that
used Gillham without TCAS or an altitude comparison function to be
checked for correct data. Implementation could be either on a real
time basis, providing information to the controller regarding
inaccurate altitude data, or on a longer term basis, with data
being provided back to the operator or registered state to enable
rectification action to be carried out.
Primary Recommendation: "Consideration should be given to the use
of ground based altitude reporting monitoring systems to identify
aircraft with erroneous altitude outputs."
Operational Aspects
The investigation determined that the final separation between the
two aircraft was not provided by a TCAS-based manoeuvre. TCAS II
only provides vertical avoidance manoeuvres (climb and descend
commands) and therefore separation can only be generated in the
vertical direction (altitude). In this event, the separation
between the two aircraft was assessed by the co-pilot of the
B747-400 aircraft seeing the fuselage of the B747-200 aircraft
through the captain's side windows of the flight deck. This
demonstrates that only lateral separation occurred, which could not
have been generated by the avoidance manoeuvres issued by the TCAS
units in the two aircraft. The separation that existed was
therefore only provided by the two aircraft not being exactly on
the same reciprocal track. As aircraft navigation systems become
more accurate, particularly with the use of Global Positioning
Systems (GPSs), aircraft will more accurately follow the track to
which they are assigned.
With TCAS only able to provide separation in the vertical sense or,
perhaps more importantly in this case, decrease separation in the
vertical sense, it would seem appropriate to provide additional
lateral separation. Had the aircraft in this incident each being
flying 1 NM right of track, the ensuing separation (assuming the
events would still have occurred) would have been 2 NM. Offset
tracks such as this are operated in some airspace where air traffic
control may not be as effective as desired but this incident was
not caused by ineffective air traffic control. Specific details
relating to the use of offset tracks, such as the direction of
offset (e.g. left or right), would need to be consistent and agreed
to by industry.
Primary Recommendation: "Consideration should be given to the
further use of offset tracks, particularly in areas of no radar
coverage."
Bureau of Air Safety Investigation Conclusion
As the aviation industry continues to maximise airspace
utilisation, using procedures such as Reduced Vertical Separation
Minima and the use of GPS tracking to reduce lateral separation
minimas, the accuracy and reliability of TCAS equipment is becoming
increasingly vital. The Bureau of Air Safety Investigation strongly
supports the British Airways recommendations outlined above, and
believes that a number should be implemented as quickly as
possible. Recommendations that are considered a high priority have
been categorised as primary recommendations in the above
text.
