38TH ANNUAL CONFERENCE, Santiago, Chile, 15-19 March 1999WP No. 88Investigate Minimum Safe Altitude Warning Systems (MSAW) |
Introduction
Over the last few years, IFATCA’s Committee B has examined several technical systems that have been developed and implemented to enhance the overall safety of the air transport system. Those alerting systems studied by the Federation were all, more or less, closely related to ATC, or at least had a significant impact on ATC/ATM. The task of ACAS/TCAS or STCA (Short-Term Conflict Alert) is to warn controllers and/or pilots about the imminent danger of a mid-air collision or a possible infringement of the relevant ATC separation standard.
CFIT (Controlled Flight Into Terrain) is nowadays one, if not the major factor, of aircraft losses in modern civil aviation. These days, crashing a perfectly serviceable aircraft causes more loss of life than any other single type of aviation accident. According to recently published data, over 9000 lives have been lost by CFIT accidents since the beginning of commercial flight operations.
Whereas the safety record for large, scheduled carrier operations is in general quite good, lately some high profile accidents have drawn public attention to this type of accident:
20-12-95: Crash of a Boeing B-757 of American Airlines in Cali, Colombia.
05-08-97: Crash of a Korean Boeing B-747 at the island of Guam (MSAW involved).
April 98: Crash of a Boeing B-727 of TAME (Ecuador) flying for Air France in Bogota (Colombia).
The figure for smaller aircraft operations, mainly GA aircraft, flying into regional airports is much worse and needs drastic improvement as quickly as possible.
Since 1992, ICAO, through its CFIT awareness program, has been focusing on CFIT accidents and studying how to significantly reduce these accidents, or at least lower the accident rate. Initial results have been quite encouraging: due to technical progress (e.g. EGPWS) and increased awareness the number of CFIT occurrences has reduced from 7, in 1992, to only 2 occurrences in 1997 (with reference to large aircraft operations). Nevertheless, as these disastrous accidents mentioned above demonstrate, it is premature to declare this type of accident a thing of the past and additional means to avoid them must be studied.
It is therefore more than appropriate that IFATCA, a Federation where the promotion of safety is one of its primary goals, actively supports the international effort of reducing terrain-related accidents. In particular, by examining how ATC could provide timely warning to aircrews when terrain or obstacle clearance is lost, or about to be lost. The aim of this WP is to analyse the problem of CFIT accidents from the ATC perspective and to propose solutions of how Air Traffic Control can help warn pilots, as a last ditch safety net, before such disaster occurs. It has to be studied whether IFATCA should propose policy on this subject and thus support and promote the worldwide implementation of such systems as a safety net against CFIT accidents.
Discussion
The terrain separation of an aircraft in flight is achieved by several layers of safety and nowadays is still essentially a “manual” process. The first layer of safety is commonly called PROCEDURE. Pilots, flying under IFR and under their own navigation use SID and STAR charts, National AIP’s, route charts and other commercial navigation charts, which depict the minimum flight altitudes or minimum levels applicable. They are called LUF (Lowest Usable FL), MOCA (Minimum Obstacle Clearance Altitude) or the MFA (Minimum Flight Altitude) and guarantee that a flight in a certain portion of airspace or along a defined route maintains the required vertical distance from terrain or high ground. Whereas this is normally quite a safe system, it is not uncommon for aircraft to be operating off-track due to ATC intervention (e.g. radar vectoring or direct routings), weather avoidance, poor climb performance or even navigational errors. It is a well proven fact that lack of situational awareness is one, if not the main factor, for CFIT-type accidents.
Regarding situational awareness and knowledge of the minimum flight altitude applicable, radar controllers certainly have a net advantage compared to aircrews. ATCO’s have a full situational awareness at all times and complete knowledge of the MFA applicable (also knowledge of the MFA along the projected track) and therefore are able to guide aircraft safely from A to B without any risk of infringing the MFA. Due to the high workload involved, especially with high traffic densities and coupled with all the other tasks ATCO’s have to perform (separation, co-ordination and transfer of control), the responsibility for providing terrain clearance is only transferred to ATC in very special cases (e.g. radar vectoring, radar approach). The rest of the time, when aircraft are under their own navigation, ATCO’s perform this task “as far as practicable” but not as an explicit duty or with any legal obligation to do so.
Workload is certainly the main obstacle against ATC performing MFA surveillance continuously and systematically. Especially when taking into account that the process of comparing the Mode C readout on the radar (digital) to the minimum sector altitude of the aircraft’s position depicted on the radar (analogue) requires a high mental workload. This is particularly true in regions where high terrain and obstacles are situated around a busy airport: in order to permit safe and efficient ATC and aircraft operations, many different minimum safe altitude sectors must be calculated and established. It is more than evident that a controller team handling more than half a dozen flights flying at low levels in a mountainous area can no longer perform the task of terrain clearance “manually”, without neglecting the prime tasks and objectives of ATC. Automatic devices are required to process this data , to assist and warn the controller team, if required.
The second layer of safety involves AIRBORNE WARNING SYSTEMS installed in the cockpit that warn pilots of an imminent loss of terrain clearance: GPWS (Ground Proximity Warning System). Recently, a more sophisticated system, called EGPWS (Enhanced Ground Proximity Warning Systems) , was brought into commercial service that increases the warning time and reduces the false alert rate. Both systems provide an automatic backup and safety device that is a kind of last ditch alarm to aircrews that their aircraft is about to be flown into terrain.
More sophisticated systems are currently being tested, in particular technology using GPS and other satellite navigation elements. Systems such as NESS (being tested by Lufthansa) provide a type of situational awareness via FMS and MFA warnings to aircrews at all times. However, such systems are far from ready to be used on a large scale in commercial operations in the near future.
Therefore, it must be said that even today, at the end of the 20th century, particularly in less developed regions (no radar coverage), the only two systems available to aircrews to avoid a CFIT accident in IMC are PROCEDURE and AIRBORNE WARNING SYSTEMS. Whereas these airborne systems have saved many lives and aircraft, it must nevertheless be said that the ‘look ahead’ time of GPWS is often too short, especially when aircraft are approaching sharply rising terrain. The escape manoeuvre, even if executed timely and correctly , is often not able to save the aircraft and lives on board. Furthermore, once the aircraft is in landing configuration, i.e. with full flaps and gear down, GPWS is locked and no longer issues alarms.
The newly developed EGPWS provides a much better ‘look ahead’ time and therefore provides the aircrew a longer reaction time to bring the aircraft back to a safe altitude. However, it must be recognised that an escape manoeuvre, following a GPWS or EGPWS alert, is always a high risk operation where the aircraft and aircrew must perform to the limit of the aircraft’s flight envelope, without any guarantee of success.
Almost all SSR systems used in civil ATC have MFA or MRA (Minimum Radar Altitudes) values depicted on radar maps, normally presented as different segments or sectors on the radar screen. By comparing the Mode C level readout of an aircraft with the MFA/MRA applicable for the altitude sector where the aircraft is currently operating, ATCO’s are able to guarantee that aircraft on radar vectors are flying at or above the altitude or FL that provides terrain clearance according to ICAO’s PANS-OPS rules. An aircraft descending towards its destination airport obviously has a greater risk of terrain clearance infringement the lower it descends. Taking into account that at peak periods, at busy airports, most flights are being radar vectored (hence ATC is responsible for ensuring terrain clearance), it is very important that any infringement of the MFA/MRA is detected automatically for immediate correction. This introduces the third level of safety, GROUND WARNING SYSTEMS, which are linked directly to ATC.
Without doubt, the most common GROUND WARNING SYSTEM is MSAW (Minimum Safe Altitude Warning). MSAW is a software programme linked to the radar data processing system that continuously and automatically compares the Mode C readout of all aircraft that meet the MSAW criteria (e.g. only IFR flights, but no Y or Z flights or VFR flights) operating in a defined zone (MSAW zone). The system alerts controllers, either acoustically or optically, or both, if a Mode C level indication is detected below a pre-determined altitude. This altitude is normally 400 or 500 feet below the MFA or MRA applicable, to avoid false and frequent alerts. An MSAW alert is transmitted immediately to an aircrew for altitude correction, with the advantage that controllers can offer enhanced information with regard to an escape route or suggest a heading toward lower terrain.
When developing and introducing MSAW systems the following issues should be studied with involvement of controllers representation:
- The presentation of alert messages to the display of the controller: visual and/or aural;
- In order to avoid a large number of false MSAW alerts, ATCOs of MSAW equipped units must be able to deactivate certain SSR tracks and suppress MSAW alarms for aircraft with incorrect mode C read out and aircraft that are performing procedures such as a leaving or joining of an IFR flight plan, or executing visual approaches or visual climbs with full reference to terrain;
- Test function, which is very important in order to ascertain that at all times, the MSAW feature is operational. Each software change should be tested;
- Special attention must be given to zones around airports in the final approach and initial climb out sectors where fine-tuning is necessary in order to determine an acceptable solution between real alerts and a high number of false alerts. MSAW should be customised to each airport;
- Important to involve controller representatives during developing, testing, tuning, implementing, training and introducing MSAW systems in ATC units;
- Controllers must have guidelines and standards (eg standard R/T phraseology) on how and when to use MSAW systems.
Conclusions
Although technology has advanced significantly (with regard to airborne equipment) and the number of CFIT type accidents has reduced significantly during the last 5 years, this type of accident still remains the main cause of aircraft losses in commercial aviation and has cost roughly 9000 lives since commercial flight operations commenced.
Aircrews have only two techniques in order to ascertain that they are operating with sufficient terrain separation when under their own navigation in IMC: Procedure (charts, maps, SID’s and STAR’s and other commercial route charts) and Airborne Warning systems, such as GPWS, that normally issue an alarm shortly before impact, which has often proved too late to avoid disaster.
In the future, more sophisticated airborne warning systems such as NESS or other satellite-based systems, mostly coupled with the FMS, could provide a kind of real-time situational awareness to aircrews that could include MFA and other indications of the minimum safe altitude applicable at their position. At this stage, widespread commercial use is not yet foreseen and is only likely to happen at a much later date.
ATC has continuous situational awareness and is therefore aware whether all aircraft under positive control are at or above the appropriate minimum safe altitude. However, the responsibility for providing terrain clearance at all times cannot be transferred from aircrew to air traffic control : adding further duties to controllers in a system with an already high ATC workload and ever increasing traffic numbers may detract from primary controller tasks (separation, radar vectoring or transfer of control co-ordination).
However, ATC can provide a very useful and efficient ground-based safety net , a type of last ditch safety buffer, to avoid CFIT type accidents. Through a worldwide implementation of automatic altitude warning systems such as MSAW (that has already proved its usefulness in numerous cases) , ATC could provide additional safety to commercial flight operations by systematically warning aircrews when an MSAW alert is generated.
MSAW provides a very efficient and useful back up to warn ATC, in a timely and systematic manner, of any terrain infringement of aircraft under its control in order to issue warning to aircrews of a possible CFIT accident.
Although MSAW technology has been available for some time now, it is intriguing to note that it has not been implemented on a much larger scale, especially considering that the system is relatively simple and installed at comparatively low cost. Many units or countries have installed MSAW as a result of an inquiry following a CFIT accident: it is disturbing to see that it takes losses of life to give the necessary impetus to install such safety equipment, when implementation of MSAW could have prevented the accident occurring.
At the 8th APANPIRG meeting it was advised that the MSAW system is well proven and it is recorded that the system has provided alerts in a number of potentially hazardous situations and has enabled eliminations of the hazard by appropriate actions of the controller and the flight crew. The meeting was further advised that although many ATC radars throughout the world have been provided with the basic MSAW capability, this has not been fully exploited. Their conclusion (8/12) was that in view of the safety benefits of the MSAW system, States of the Asia/Pacific Region implement the system as soon as possible.
It should be studied whether MSAW systems should be declared an integral part of any modern ATC system, similar to ACAS/TCAS. In developing SARP’s for MSAW, ICAO could help to accelerate the worldwide implementation and recognition of MSAW as a safety net against CFIT accidents.
All IFATCA MA’s are invited to intervene at national level to convince their management and national ATS Authorities, MSAW is a useful and efficient tool that benefits safety and that needs to be implemented as soon as possible. All IFATCA representatives should encourage at all international meetings and conferences, the widespread and systematic implementation of MSAW.
It is recommended that:
MSAW, as a last-ditch ground-based warning system, must be fully implemented without delay, with the necessary operational requirements and appropriate ATC procedures and training on a worldwide basis, in order to significantly reduce the number of CFIT accidents.
Last Update: September 28, 2020