Lost in Procedures
Air Canada 624 at Halifax
March 29, 2015
The TSB report1 is right on many issues, but it touches the prime cause of the accident only obliquely. This was to be expected. Sergeant Friday’s, “Just the facts, ma’am”, is also the mantra for accident investigators. They have to discover and report. An opinion on the ‘why’ of the accident is bound to have a component of speculation. But for pilots trying to stay alive, the ‘why’ is everything. In this piece we will take a hard look at the facts. We will also find a few misconceptions.
The primary cause of this accident was that a non-precision approach was attempted in limited vertical visibility. The crew, the airline, and the regulator shared the mistaken belief that Flight Path Angle was as good as a glideslope. With FPA engaged, the airplane did exactly what it was designed to do. It steered the aircraft to fly a constant descent angle. That descent angle, however, was unrelated to any specific point on the ground. It was not a glideslope. A glideslope is available only with an ILS or an RNAV approach using WAAS GPS. Runway 05 at CYHZ does not have an ILS. Air Canada’s A320’s are not equipped with WAAS GPS.
From one perspective Air Canada 624’s approach and landing were spectacular and successful. The aircraft caught the arrestor cable (the wires 40 feet above the perimeter road) and came to rest at the nominal touchdown point on the runway. There was no fire, and nobody died.
Independence from Heading and Barometric Altimetry
With the doppler radar on the DC-8 and later with INS and IRS, and eventually with GPS, magnetic heading began to decline in importance. Today, with the right equipment, an ILS or LPV approach can be hand-flown using track steering. Heading is used to hold an intercept vector, and then not used again until the pilot goes eyes out. Even then, it’s just to know where to look.
In a similar way, if there is a glideslope barometric altimetry becomes less important. On the glideslope, (especially on an LPV where there are no false slopes) the altimeter is cross-checked at the FAF, and used to define 100 above and decision on a CAT I ILS. Even if a pilot mis-sets the altimeter by 1000 feet (perhaps still a possibility in the CYGR accident), if that pilot stays on the slope he will hit the runway.
These HDG/TRK and Baro ALT/Glideslope examples are analogous ways in which developments in technology (INS/IRS, WAAS GPS) have changed how precision approaches can be performed. They are recent changes (WAAS GPS arrived in 2006), and they are still generally not well understood in the business.
There is more to WAAS GPS than being able to provide a glideslope. The technology not only provides accuracy on the order of one meter spherical error, it also calculates the probability that it can maintain the required accuracy while you do the approach. The last prediction is done 30 seconds before the FAF. If the satellite data aren’t going to meet the standard, the glideslope and localizer scales disappear. There is an error message: Approach Unavailable.
Cold Temperature Correction
Cold air is dense. Because earth’s atmosphere is held to the planet by gravity, it does not behave exactly as Boyle’s and Charles’ Laws would predict, because, in effect, there is no container. So the thickness of the atmosphere at the poles in winter can be more or less half of what it is at the equator.
Barometric altimeters sense pressure, not density. The pressure at any point in the atmosphere depends on the weight of a column of air above that point. So, for example, at a FAF crossing altitude of 2000 feet (ISA1), if the temperature is less than ISA the altimeter will read more than 2000 feet. Why? Because there is now more of the atmosphere beneath the airplane and less above.
Because we live in a cold country, Canadian aviators have always been careful about applying Cold Temperature Corrections.
Vertical visibility is what we used to call ‘obscuration’. Remember W0X0F? Now, with METARS, that would look like:
METAR CYMX 031100Z 25004KT 0SM R24/0400FT/N FG VV000 2/2 A2959
The weather at the time of the accident was:
METAR CYHZ 290200Z 35019G27KT 1/4SM R14/2600FT/N +SN VV002 M06/M06 A2962 RMK SN8 /S05/ SLP036=
Even at first glance this Halifax weather looks challenging. But consider this image:
It is a slide from one of my IFR seminars, called Survival. The airplane is at minimums on an ILS approach. The approach lights and the runway threshold lights are in sight, so the pilot is legal to land according to the CAP GEN.
But flying visually in this situation is not safe. As many of you taught me when I was an apprentice, this is a classic duck-under situation. There is not enough visual information to judge descent angle. A safe landing can be accomplished only by flying the glideslope down to the flare.
The scene from the accident cockpit would have been similar to the above slide. Although there are PAPI lights on runway 05, at MDA they were not yet visible1. There was no glideslope to follow, and the airplane was on autopilot with FPA engaged.
There is more. With obscuration the instinct is to duck-under in order to see further down the runway. But runway 05 at CYHZ presents the pilot with two additional duck-under temptations – the ‘black hole’, where there are no other lights before the runway, and the runway upslope, which changes the visual perspective of the runway (or the runway lights you can see).
A Brief History of Non-Precision Approaches
Most of us – and here I am grouping myself with my fellow retired pilots – used some version of “drive and dive”. We would smooth it out, of course, calculating our arrival at MDA to be some seconds before arrival at the MAP. If necessary, we could be level at MDA long enough to assess the visual environment – and here I mean the video, not the snapshot. The airplane was stabilized in level flight at MDA, and we could look up long enough to get that video and decide whether it was safe to continue.
Next the charts began to include tables of vertical speed vs. groundspeed. This formalized how we had been smoothing out the descent. Later the tables (like the one above) were descent angle vs. DME distance from a fix. Now we had an along track reference. And for a time Transport insisted that while it was OK to sag below a Decision Altitude on an ILS, if you went one foot below MDA on a non-precision approach, you would flunk the ride. Accordingly, our SOP’s at the time called for us to add 50 feet to all MDA’s.
There was a good reason for this. If you are on a glideslope, you can fly right down to the ground without hitting anything other than the runway. If you venture below the MDA plane without adequate visual reference, you might hit something else first.
As in all good things, there is a downside. In – and here I am including the aviation industry – our determination to ensure all pilots erred on the side of safety, we forgot an important point about Minimum Descent Altitude: if the pilot is not sure yet whether he can see enough, he has to fly level at MDA long enough to decide. Indeed, that profile is depicted on the above chart. Pilots need stay eyes out long enough to see the movie or the video. If they have only a snapshot like the one on the “Eyes Out?” slide above, without a glideslope they have to do a missed approach.
Two more points are worth noting in the vertical profile pictured above. First, the VDA arrives at MDA 0.7 nm before the MAP, which is the threshold. Then it is level until the MAP. If you fly to the MAP at MDA you will then be above the VDA, the VASIS if you can see them, and the normal Threshold Crossing Height. You are using up runway.
The second point is that if you want to stay on the VDA your MDA has become an “instantaneous decision” point – effectively, a DA. You don’t have a video. You just have a snapshot. And sagging below MDA is not a good idea.
In respect of an aircraft on an approach to a runway, (Required Visual Reference) means that portion of the approach area of the runway or those visual aids that, when viewed by the pilot of the aircraft, enable the pilot to make an assessment of the aircraft position and rate of change of position, in order to continue the approach and complete a landing.1 (My emphasis)
The weather was marginal for the LOC Rwy 05 approach at Halifax. The crew of the accident flight were hopeful of improvement and shortened their alternate from Montreal Dorval to Moncton, adding an hour or so to the hold time available. As the flight neared a normal top of descent point, dispatch contacted them with the latest weather and forecasts, and advised that a company flight had landed in Halifax in the last half-hour, after having missed the first approach because of poor visibility.
Fifteen minutes later, at 0211Z, the crew received the 0200 METAR for Halifax:
METAR CYHZ 290200Z 35019G27KT 1/4SM R14/2600FT/N +SN VV002 M06/M06 A2962 RMK SN8 /S05/ SLP036=
At 0229Z the flight entered a hold at FL290. The pilots planned the descent and the approach meticulously, as per Air Canada SOP’s. They planned to use LOC for lateral guidance and FPA (Flight Path Angle) for vertical guidance. They would use managed speed and to use the autopilot to fly the aircraft. The FCU altitude would be set to 3000 feet, the missed approach altitude. They completed briefings for the approach and go-around, and did the In-Range Check.
At 0300Z there was a shift change in the tower. During the next 15 minutes the crew received several weather reports. The visibility improved from 1/8 mile to 1/4 mile, and then to 1/2 mile. At 0316Z they received a special weather report:
SPECI CYHZ 290313Z 35020G26KT 1/2SM R14/3500V4500FT/N SN DRSN VV003 M06/M07 A2963 RMK SN8 SLP040=
Almost immediately thereafter, they received a clearance direct to OKDAS and down to 4000 feet, followed by clearance for the LOC 05 approach. At 0323Z they discussed light settings with the tower, requesting strength 5. The tower replied that the lights were on strength 4, but would be set to 5 for their approach. As a result of procedural confusion in the tower, the lights remained on strength 4.
By then the flight was level at 3400 feet and configuring for the approach. Three minutes later, at 0326Z, they had intercepted the final approach course and descended to 2200 indicated. Then at 2.7 nm from the FAF, Flight Path Angle was selected at angle 0.0°. The crew began the countdown. At 0.3 nm,
they dialled the FPA to -3.5°.
The descent began at 0.2nm from the FAF, which they crossed at 2170 indicated.
At 03:29:27Z the automated call Four Hundred sounded. Almost immediately thereafter the flight descended below MDA (813 indicated), still on autopilot and descending at 700-800 fpm. The aircraft was 1.2 nm from the threshold.
This Primary Flight Display (TSB Report Fig. 2) is a simulation of the accident aircraft at MDA. The bird is down and to the right, showing the descent angle and the track. The track (053°) can be seen on the compass rose at the bottom (the small green diamond on top of the magenta track dagger). The heading is 046°. The FMA at the top shows the vertical mode as Flight Path Angle -3.5°. The right wing is slightly low.
At 03:29:47Z (20 seconds after the Four Hundred call), “the landing lights were selected ON, followed in very quick succession by the PF disconnecting the autopilot, an automated call of 100, an automated call of 50, and the PM instructing to pull up.”1 The aircraft was 30 feet above the threshold elevation. “AC624 then severed the electrical power line that ran perpendicular to the runway, causing a utility power outage at the airport terminal.”
The crew had applied a cold temperature correction, changing the Split Crow (FAF) crossing altitude from 2000 feet to 2200 feet, and the MDA from 740 to 813. Using the CAP GEN from Nav Canada, I get 2200 and 800. Using the difference in height from the crew’s numbers (1387 feet) and the distance between Split Crow and the runway (4.6 nm) less the VDA position at MDA from the chart (0.7 nm from the threshold) I get sin α (Descent Angle) as 0.058531. Arcsin (inverse sin) 0.058531 = 3.35549705 degrees. The Jeppesen chart says 3.08° and the CAP chart says 3.04°. The crew used 3.5°. This was derived from Air Canada’s Airbus A320 Quick Reference Handbook, modified in 2011 to reflect two years of discussion between Transport Canada and Air Canada.
Difference in Indicated Altitude
AC A320 QRH
It turns out we have been talking apples and oranges all along. Airbus Flight Path Angle calculates and holds a Flight Path Vector with information from inertial sources – the IRS. Overlaying the barometric altimetry problem of the squishing of a cold section of the atmosphere is simply not relevant.
My point here is that all this is ridiculously complicated. And it might have worked if the crew had followed the approach as published by either Jeppesen or Nav Canada, which have tables relating altitude to distance from IHZ. (NavCanada calls such tables SCDA, for Stabilized Constant Descent Angle.) I have found no reference to the crew tuning 109.1 (IHZ) and monitoring distance versus altitude.
I have done further calculations to see where the selected -3.5° FPA would take them from the FAF crossing altitude. It is almost exactly where they wound up.
A Short History of an SOP
In 2009 Transport Canada did some tests which showed that FPA was not doing exactly what they thought it should do. With the idea that perhaps cold temperatures were causing the problem, they began discussions with Air Canada with a view to finding a way to “correct” the FPA. Airbus became involved, and in April 2010 Airbus issued a temporary revision to the Flight Crew Operating Manual.1
“Although this revision, which introduced an FPA correction chart for cold weather operation, provided additional guidance, it did not take into account Air Canada’s procedure for rounding up the correction altitudes. Therefore, Air Canada decided to develop its own procedures for adjusting the FPA when cold temperature corrections had been applied to the FAF altitude. This method was accepted by TC, and, in early 2011, Air Canada’s Airbus A320 Quick Reference Handbook was revised to include the FPA and chart of approach altitude corrections for cold temperatures. The chart was designed to identify the applicable altitude correction (in 100-foot increments) to be added to the FAF and the degree correction to be added to the FPA based on the approach altitude height above the aerodrome and the temperature in degrees Celsius. The Quick Reference Handbook also includes a chart for the cold temperature corrections for the MDA. The investigation determined that the FPA calculated by the flight crew was in accordance with the Quick Reference Handbook.”1
The urge to err on the side of safety has taken a wrong turn. Calculating an FPA from cold temperature corrected altitudes infers a greater loss of altitude between the FAF and the MDA, hence a steeper descent angle. But the FPA is an inertial vector, and the required vector is between the true (ISA) altitudes on the chart. It does not change with temperature.
We know that since this SOP was introduced in 2011, other airlines have discovered independently that FPA was not working as they expected. Queries to Airbus have met with obfuscation. Industry sources confirm that the 2010 Temporary Revision has been deleted, and all engineering and technical data concerning Flight Path Angle has been removed from the Airbus FCOM.
The Transportation Safety Board details 41 findings (sections 3.1-3.3). Every one is worth thinking about as we move forward.
Where can the crew be faulted? It would hardly be just to fault them for meticulously following SOP’s. Or even for trusting the automation, when their airline was urging them to do so1. But they are responsible professionally for shortening their alternate to Moncton and attempting a non-precision approach in marginal conditions, and for leaving the autopilot engaged below MDA.
Once again, reliance on automation we do not understand has ended in the loss of a perfectly good airplane.
My purpose here is to seek a correct understanding of our trade. It is to question assumptions and received wisdom, and to help today’s young pilots do their job. That job is to survive, and in so doing ensure the survival of those sitting behind them.
I invite you all to read the TSB Report and come to your own findings, and to let me know what you think.
June 5, 2017
The following are thoughts (after publication) about what a correct SOP for this approach (and other non-precision approaches with DME-defined SCDA) would look like. The changes are listed in order of importance:
After leaving the Final Approach Fix (FAF) altitude, select Minimum Descent Altitude (MDA) on the Flight Control Unit (FCU, see image below) to provide a hard floor for the autopilot.
The Pilot Not Flying (PNF) must select his NAV receiver to the DME reference on the approach chart, (In the case of the accident flight, this would have been to 109.1 mhz, IHZ) and call out the desired crossing altitudes.
For Flight Path Angle (FPA), use the VDA or SCDA specified on the approach chart. Do not “correct” the FPA for temperature.
Select the desired FPA as recommended by Airbus: at 0.3 nm from the FAF, dial the desired
FPA and Pull to select. This allows the autopilot to execute a smooth pushover as designed.
Let’s look at what effect these changes might have:
Re-running the approach with the new SOP, the First Officer selects his NAV receiver to 109.1, and listens to the identification – IHZ. He has the approach plate in his hand, and prepares to call the altitude for each DME reference on the table. (Perhaps he has even corrected each of those altitudes for the -6°C. temperature) .
The Captain has briefed that they will use the descent angle from the chart – 3.08, rounded up to 3.1 (the FCU only accepts 0.1 increments). They will correct altitudes for temperature, but not the descent angle. Once the autopilot has captured 2000 feet true altitude (2200 indicated), they will dial the FCU altitude to 813 (the 740 MDA corrected for temperature). The autopilot is now programmed to follow the path depicted on the chart above, capturing a true altitude of 740 and then flying level. Notice how this level-off should occur at 2.4 DME – 0.7 miles from the runway threshold. (The accident aircraft descended through MDA at 1.2 miles from the threshold.)
As they approach the FAF (Split Crow at 6.3 DME), the First Officer counts down the distance. As he calls 6.6 DME, the Captain dials -3.1° into the FCU and pulls the knob. The autopilot begins a smooth pushover and leaves 2200 indicated altitude very close to 6.3 DME. The autopilot then follows the slope on the chart quite precisely, even though it is tethered to nothing except the moment the Captain pulled the knob on the FCU. The accuracy would be borne out by his listening to the First Officer call out the corrected altitudes for each DME reference on the chart – 6.0, 5.0, and 4.0 DME.
As they approach 3.0 DME they prepare for the 100 above call, and one of them may take a peek outside. At 100 above the Captain, as Pilot Flying, watches the Flight Mode Annunciator (the band of data at the top of the Primary Flight Display (on page 6). He watches to make sure the FMA -3.1 changes to ALT*, telling him that the 813 (indicated) MDA is being captured. The aircraft will now be flying level at MDA and tracking the localizer, allowing both pilots to look out and get – the video, not the snapshot. And since they are 0.7 miles from the runway and not 1.2 miles back, they will see more lights than the accident pilots did, including the PAPI (Precision Approach Path Indicator), and be able to disconnect the autopilot and fly down to the runway.
But all this should be history, not actual airline practice. Today’s technology can provide a precision approach to every runway the airlines use. But the technology is new enough that most airline aircraft pre-date it. And updating avionics costs money.
Throughout its history, runway 05 at Halifax has been the runway in use during snowstorms with north gales. As the TSB Report says, NavCanada studied the runway and decided installing an ILS was not worth the investment.
Note that there are precision approaches available for this runway, and that they cost NavCanada essentially nothing. But they require WAAS GPS, so it is the aircraft operator who pays.
In the end, though, money is not the whole problem. What the TSB Report brings out (albeit subtly) is that no one at Air Canada or Transport Canada really knew what they were doing. They understood neither the principle of inertial navigation nor how precision approaches are surveyed and flown using WAAS GPS. They did not understand the essential limitations of a non-precision approach.
Who should have known? The pilots, of course. If they were serious about their trade they would question SOP’s and regulations in the interest of survival. Flight Operations management, of course. It is their job to see that the airline is operated safely. Transport Canada and NavCanada, of course. At least in hindsight it is obvious their job is not policing or politicking, but the advancement of aviation safety. But the buck doesn’t stop there. The airline executives holding the purse strings may not be experts in aviation technology, but they have held such knowledge cheap.
June 19, 2017
1TSA Report, section 1.18.9
1TSB Report, section 1.18.3
1Airbus Industrie, Temporary Revision (TR FCOM 3 294-1), Flight Crew Operating Manual, Standard Operating Procedures, Non-Precision Approaches (April 2010).
1TSB Report, section 1.1
1Source: TSB Report, section 1.18.4
1TSB Report section 126.96.36.199&3
1International Standard Atmosphere
1 A15H0002, Released 18 May 2017