Jump to Content

Recommendation issued to: Civil Aviation Safety Authority

Recommendation details
Output No: R19990156
Date issued: 09 September 1999
Safety action status:
Background:


SUBJECT - ERRORS IN TRAFFIC ALERT AND COLLISION AVOIDANCE SYSTEMS


SAFETY DEFICIENCY

The traffic alert and collision avoidance system (TCAS) used in modern aircraft is an excellent and well-proven defence against mid-air collisions. However, under certain circumstances, some specific identified design deficiencies, system errors and equipment failures have increased the risk of a mid-air collision.


FACTUAL INFORMATION

Occurrence Summary

The Boeing 747 (B747) was maintaining flight level (FL) 350 when the crew received a TCAS alert warning of conflicting traffic crossing their track at an altitude 400 ft below. They were able to contact the other aircraft, which was a US-registered Douglas DC8 maintaining FL330 in accordance with air traffic control instructions. Both crews were able to maintain their respective levels and no evasive action was required.

When the DC8 departed Auckland, air traffic control verified that the secondary surveillance radar altitude readout had correlated with the altitude reported by the crew. However, as the aircraft approached Honolulu, air traffic control noted a 1,500 ft difference between the altitude reported by the crew and that showing on the radar display. The aircraft transponder was transmitting an erroneous altitude; however, the crew had no flightdeck display to enable them to check what altitude information the transponder was emitting. The equipment failure had occurred between departing radar coverage at Auckland and the point at which the B747 crew received the TCAS alert.

Initial maintenance action by the company indicated that a faulty transponder encoder was the problem. However, an investigation in the USA subsequently revealed that the central air data computer had been providing faulty inputs to the aircraft's two transponders. The central air data computer provides information relating to atmospheric conditions to the aircraft's instruments, pressurisation and other systems. The central air data computer fault had affected the pressurisation system and transponders, without being evident on any of the aircraft's instruments.


Related Occurrence

British Airways is conducting an investigation of the following incident. The occurrence summary and the preamble to each recommendation are based on the contents of British Airways' preliminary investigation report. The recommendations are quoted directly from that report.

On 28 June 1999, a British Airways Boeing 747-400 passed an opposite direction Boeing 747-200 with no vertical separation and 200 m lateral separation. At the time, the crews of both aircraft were responding to TCAS resolution advisories.

The B747-200 was cruising at FL315 in Chinese airspace when the TCAS reportedly issued a climb resolution advisory for an intruder shown 400 ft below. The crew followed the TCAS climb commands until the two aircraft crossed altitudes. The B747-400 was cruising at FL335 when the crew observed traffic on the TCAS 1,900 ft below. The B747-400 TCAS then issued a descend resolution advisory, with the other aircraft shown 400 ft below and climbing, approximately 10 seconds before the aircraft passed. The separation was estimated from the B747-400 co-pilot's visual acquisition of the aircraft through the side windows of the flight deck.


British Airways Analysis and Recommendations

At this stage, the investigation has established that the B747-200 transponder probably replied to the B747-400 TCAS with incorrect altitude values. It also provided incorrect altitude to the TCAS fitted on board the B747-200. The subject B747-200 aircraft used a "Gillham" interface between the air data computer and the transponder, and a simple fault on this interface could have generated the altitude shift of 2,400 ft that is suspected to have led to the occurrence. Also, the Gillham altitude data is not used by any other equipment in the aircraft, and any erroneous altitude data would therefore not have been evident to the crew. The TCAS equipment is normally protected against such a Gillham altitude shift by comparing two sources of altitude data. If the altitudes differ by more than 500 ft, the system shuts down. Although the B747-200 aircraft should have had this protection, further investigation identified a malfunctioning connector to the Number 1 transponder and consequently an explanation for the failure of the altitude comparison function in the aircraft. Without specific investigation, the failure was not apparent to the crew or to maintenance personnel. Potentially, there are large numbers of aircraft worldwide operating with such an equipment configuration.

Preliminary information indicated that the failure of the attitude comparison function in the transponder system of the B747-200 aircraft, combined with the failure of the Gillham coded altitude interface between that aircraft's air data computer and the transponder resulted in the incident under investigation.

This incident placed both the aircraft involved and all on board at very high risk. The loss of separation between the two aircraft was caused by the overall failure of TCAS coordination between the two aircraft. Ultimately, it was only the 200 m lateral separation that prevented a mid-air collision, and this separation was not provided by TCAS avoidance manoeuvres. More importantly, the TCAS coordination between the aircraft exacerbated the seriousness of the breakdown of separation. Ensuring that safety actions are implemented to prevent further recurrence is therefore imperative.

The investigation team identified a number of safety deficiencies and subsequently issued several recommendations. In the interests of air safety, these preliminary recommendations should be given full consideration as soon as possible by all parties involved.

Gillham Altitude Comparison Function

Analysis of the Gillham altitude comparison function of the transponder and its activation has identified a number of concerns with the design and implementation of this function. The altitude comparison function of the transponder is an optional feature. As such, the transponder does not recognise if altitude comparison is active. Without automatic recognition of a failure of the altitude comparison feature, a functional test is required to ensure that the function is active.

Primary Recommendation: "An Airworthiness Directive should be issued to require an immediate functional check of the altitude comparison function in all TCAS equipped aircraft using Gillham altitude sources."

Primary Recommendation: "Regular checks should be put in place on all aircraft using Gillham altitude data to ensure continued correct operation of transponder altitude replies and altitude comparison."


If, for the purposes of TCAS, an aircraft is fitted with a Mode S transponder that uses a Gillham altitude source, the investigation team considers that the use of two Gillham sources and an altitude comparison function is essential. Currently, if the comparison function is inactive, the transponder will continue to operate. Modifications could be made to transponders so that the unit automatically carries out the altitude comparison function when using Gillham altitude data. Also, the unit should indicate if the altitude comparison function is inactive.

Primary Recommendation: "Consideration should be given to a modification to Mode S transponders that causes them to automatically compare Gillham altitude data or to report a failure when Gillham altitude sources are selected and the altitude comparison function is not activated."


Gillham Altitude Data

The Gillham altitude output of an air data computer was originally provided as the altitude reporting source on the aircraft and is not generally provided to any instruments in use by the flight crew. Originally, transponders only received altitude data via a Gillham interface. However, modern transponders provide four different interfaces to obtain altitude data from the aircraft. When TCAS is installed in an aircraft, a transponder system upgrade may allow the use of a different altitude interface. A significant number of TCAS installations have continued to use Gillham altitude interfaces to the transponders despite the availability of potentially better alternative interfaces. Also, the use of an altitude source to the transponder that is also used by instruments on the flight deck provides an opportunity for any discrepancies to be noticed by the crew.

Primary Recommendation: "No further installations of TCAS and Mode S should be certified using Gillham altitude sources where a more robust and widely used source is available in the aircraft."


TCAS

The TCAS on both aircraft appeared to function in the way that was expected, based on the erroneous altitude data from the B747-200 transponder. Notwithstanding this, a number of observations were made during the investigation regarding how TCAS displays information and how it handles an altitude shift. It is therefore appropriate to make recommendations for further evaluation of the TCAS design in the light of this incident.

TCAS Logic

The TCAS logic appeared to have acted as expected in response to the erroneous altitude data, but a number of questions were raised regarding how the two TCAS units handled the altitude shift. The primary areas for consideration are:

1. the way the B747-400 TCAS initially ignored the erroneous altitude data from the B747-200 aircraft, while the B747-200 TCAS continued to use this data;
2. the way the two TCAS units probably coordinated the manoeuvres such that the B747-400 TCAS issued a descend resolution advisory, despite the actual location of the B747-200 aircraft, and
3. the way the two TCAS units probably coordinated the manoeuvres despite the B747-400 TCAS assessing that there was no conflict between the aircraft.

Recommendation: "Consideration should be given to changes in the TCAS logic that handle such altitude jump scenarios better."


TCAS Aural Annunciations

The flight data captured from the B747-400 aircraft indicated that a "crossing descend" resolution advisory was sent to the TCAS display followed by an "increase descent" resolution advisory. The captain of the aircraft believed that the aural alert issued was "descend now". Although it cannot be confirmed what aural alerts were actually issued, it does raise the question as to the effectiveness of such alerts and the crew's instinctive reactions to them. This would not be the first incident where crews believed they heard a command other than that supposedly issued.

Recommendation: "Evaluation should be made, in the light of this and other incidents, of the effectiveness of the TCAS aural annunciations used."


TCAS Traffic Display

Investigation of the incident has raised a number of concerns regarding the information provided to the crew via the TCAS traffic display. First, the B747-200 TCAS "thought" that its own altitude was FL339, although the crew were completely unaware of this information. It may therefore be appropriate to provide some indication of the aircraft's own altitude on the TCAS display, particularly where the transponder altitude source is not one used in the flight deck. Had such a display been available in this incident, the crew may have been able to crosscheck the transponder altitude with the altitude displayed on other instruments.

Recommendation: "Consideration should be given to providing an indication of own aircraft altitude on the TCAS display in certain types of installation."


Second, the range of the B747-200 aircraft's TCAS display was limited to either 6 NM or 12 NM. As a result, the B747-200 crew would have first been made aware of the B747-400 aircraft, apparently 400 ft below them, as the traffic advisory sounded when the aircraft were only about 10 NM apart. Had a traffic display of greater range been provided, there may have been time for the B747-200 crew to confirm that there was actually no aircraft 400 ft below them, and potentially to switch altitude sources to eliminate the failure.

Recommendation: "Encouragement should be given to ensure that future TCAS installations provide greater ranges to aid crew situational awareness."


Third, the aircraft shown on the TCAS displays were not displayed with their flight identification (call sign). This display, particularly when combined with the increased range, would have helped enable the B747-200 crew to identify the error in their TCAS indications and commands.

Recommendation: "Efforts should be made to ensure that transponders automatically report the aircraft Identity in the Mode S reply [and] that future TCAS installations provide the ability to display this Flight Identity on the TCAS traffic display."


Fourth, it is believed that the B747-400 TCAS displayed the B747-200 aircraft as 1,900 ft below, even though the altitude replies from the B747-200 transponder were not at that altitude. Although the TCAS unit was aware that the display was based on a coasted altitude, the crew would not have been. Although there is obviously a risk of providing unnecessary information to the crew, it may be appropriate (perhaps by using a different symbol) to identify on the TCAS display, aircraft providing erroneous data that is being ignored or smoothed.

Recommendation: "Consideration should be given to providing an indication on the TCAS of intruders whose data is suspect."


Finally, had the TCAS display indicated that their aircraft was in a coordinated manoeuvre, the B747-400 crew might have been aware of the manoeuvring of the B747-200 aircraft prior to the altitude data becoming good. This could be done in future with the use of a different intruder symbol, although again the risk of over-complicating the information to the crew needs very careful human factors consideration. Combined with the indication of suspect intruder replies, such information could have been beneficial in this incident. Such an indication might also help to increase the crew's awareness of the need to follow a crossing resolution advisory where following the TCAS commands in both aircraft is critical to ensuring separation is provided.

Recommendation: "Consideration should be given to providing an indication on the TCAS display of an aircraft that is in a co-ordinated TCAS manoeuvre with own aircraft."



Airborne TCAS Event Recording

The availability of more detailed TCAS data from this incident from the digital flight data recorder would have helped the investigation and improved its explanation of the events that occurred. Many recent TCAS units provide this facility but it is not yet widely implemented.

Primary Recommendation: "Encouragement should be given to the implementation of detailed TCAS event recording within and external to the TCAS computer."


Ground-based Transponder Altitude Monitoring

The risks associated with Gillham altitude shifts and the use of the data in TCAS have been known since the introduction of the system. Because TCAS uses the same altitude data and replies as those used in ground-based air traffic surveillance systems, it was considered that the air traffic controller would detect any discrepancies when the aircraft was under radar coverage. Assuming that all aircraft operate in radar coverage for at least some of the time, significant failures should be identified. This investigation has identified several flaws in this argument:

1. the radar interrogation rate is likely to be between 6 and 10 seconds, where TCAS's is every second;
2. modern radar networks carry out smoothing of the data and, like TCAS, would potentially ignore and coast when poor altitude data is received, and
3. a momentary altitude shift is likely to be overlooked by a controller but may not be by TCAS.

It would therefore be appropriate to look at the implementation of systems in a ground radar environment that could capture any erroneous altitude replies received and identify aircraft that are providing them. This would enable constant monitoring of transponder replies from all aircraft in coverage, regardless of state of origin or operator, and would also enable aircraft that used Gillham without TCAS or an altitude comparison function to be checked for correct data. Implementation could be either on a real time basis, providing information to the controller regarding inaccurate altitude data, or on a longer term basis, with data being provided back to the operator or registered state to enable rectification action to be carried out.

Primary Recommendation: "Consideration should be given to the use of ground based altitude reporting monitoring systems to identify aircraft with erroneous altitude outputs."


Operational Aspects

The investigation determined that the final separation between the two aircraft was not provided by a TCAS-based manoeuvre. TCAS II only provides vertical avoidance manoeuvres (climb and descend commands) and therefore separation can only be generated in the vertical direction (altitude). In this event, the separation between the two aircraft was assessed by the co-pilot of the B747-400 aircraft seeing the fuselage of the B747-200 aircraft through the captain's side windows of the flight deck. This demonstrates that only lateral separation occurred, which could not have been generated by the avoidance manoeuvres issued by the TCAS units in the two aircraft. The separation that existed was therefore only provided by the two aircraft not being exactly on the same reciprocal track. As aircraft navigation systems become more accurate, particularly with the use of Global Positioning Systems (GPSs), aircraft will more accurately follow the track to which they are assigned.

With TCAS only able to provide separation in the vertical sense or, perhaps more importantly in this case, decrease separation in the vertical sense, it would seem appropriate to provide additional lateral separation. Had the aircraft in this incident each being flying 1 NM right of track, the ensuing separation (assuming the events would still have occurred) would have been 2 NM. Offset tracks such as this are operated in some airspace where air traffic control may not be as effective as desired but this incident was not caused by ineffective air traffic control. Specific details relating to the use of offset tracks, such as the direction of offset (e.g. left or right), would need to be consistent and agreed to by industry.

Primary Recommendation: "Consideration should be given to the further use of offset tracks, particularly in areas of no radar coverage."


Bureau of Air Safety Investigation Conclusion

As the aviation industry continues to maximise airspace utilisation, using procedures such as Reduced Vertical Separation Minima and the use of GPS tracking to reduce lateral separation minimas, the accuracy and reliability of TCAS equipment is becoming increasingly vital. The Bureau of Air Safety Investigation strongly supports the British Airways recommendations outlined above, and believes that a number should be implemented as quickly as possible. Recommendations that are considered a high priority have been categorised as primary recommendations in the above text.

Output text

The Bureau of Air Safety Investigation recommends that the Civil Aviation Safety Authority note the safety deficiencies identified by British Airways in this document and take appropriate action as a matter of the highest priority.

As a result of the investigations into these occurrences, the Bureau simultaneously issues recommendations R19990159 to the Civil Aviation Safety Authority, R19990157 to airline operators in the Asia-Pacific region and R19990158 to Airservices Australia:

"19990159

The Bureau of Air Safety Investigation recommends that the Civil Aviation Safety Authority require operators of TCAS equipped aircraft using Gillham altitude sources to conduct a functional check of the TCAS altitude comparison function, and

19990157

The Bureau of Air Safety Investigation recommends that airline operators in the Asia-Pacific region note the safety deficiencies identified by British Airways in this document and take appropriate action as a matter of the highest priority, and

19990158

The Bureau of Air Safety Investigation recommends that Airservices Australia note the safety deficiencies identified by British Airways in this document and take appropriate action as a matter of the highest priority."

Initial response
Date issued: 06 January 2000
Response from: Civil Aviation Safety Authority
Action status: Closed - Accepted
Response text:

I refer to your letter of 9th September 1999 in reference to the above ASR. As you will be aware, the safety incidents which triggered the BASI recommendation have been the subject of extensive discussion in international forums, in which CASA has participated. In particular, discussion relating to Gillham encoding of altitude information to aircraft transponders took place at the recent ICAO SICASP working group meetings hosted by CASA on the Gold Coast, in which [an investigator] of BASI participated.

There are a number of factual errors in the accompanying occurrence text to BASI ASR R19990156 which I wish to point out to you.

First, the subject heading "Errors in Traffic Alert and Collision Avoidance Systems" is misleading, since the failures were not in the B747 TCAS equipment (which functioned exactly in accordance with its performance specifications) but rather, in the erroneous information transmitted by the DC8's transponders and used by the TCAS to determine the status of the threat.

Second, the ASR text indicates that an investigation in the USA subsequently revealed that the central air data computer (CADC) had been providing faulty inputs to the aircraft's two transponders. CASA is not aware of BASI's source of information, but the reports that we have received from the Director of Airline Safety, Emery Worldwide (the operator of the DC8) and the FAA TCAS Program Manager indicate that the cause of the problem is still unknown. The report from Emery states that although the inbound ATC - aircraft altitudes checks showed a discrepancy, subsequent maintenance checks could find no anomalies on the CADC or the transponders. The FAA TCAS Program Manager advised both CASA and BASI on, 4th December 1999 that they were still unable to determine the cause of the anomaly, but noted that not all testers are capable of spotting a short or long pulse width problem coming from the transponders.

Third, the incident between the Qantas B747 and the Emery DC8 occurred on 26th January 1998 and the BASI ASR also reports an incident which occurred eighteen months later between a British Airways 747-400 and an opposite direction B747-200 on 28th June 1999, which is described as a "Related Occurrence". This appears to be an assumption which may or may not be correct. In the British Airways incident, the cause was clearly established as a dual failure of both the altitude comparison function in the transponder system of the B747-200, together with a failure of the Gillham coded altitude interface between that aircraft's CADC and the transponder. As previously indicated, the cause of the anomaly in the Emery DC8 transponder is still not known. It may or may not have been a fault due to the Gillham encoding interface.

I am advised that very few Australian aircraft use Gillham encoding, and those that do are fitted with dual comparison functions or other means of cross-checking transponder accuracy. Nevertheless, CASA agrees with the recommendations of BASI ASR 19990159 and on 13 October 1999 Airworthiness Directive AD/RAD/66 was issued which required all operators to check the accuracy of Mode S transponders utilizing Gillham encoding. A supplementary Airworthiness Directive, ADIRAD/68, will become effective on 22 December 1999. This AD has been issued as a result of FAA AD 99123122, relating to Mode C transponder accuracy checks.

 
Share this page Comment
Last update 01 April 2011