This paper will examine the human factors errors that the EGPWS has helped to minimize as well as the human factors involved with designing and maintaining the new technology.[1]
According to the Flight Safety Foundation, a leading organization dedicated to lowering the risks in aviation, the four most pressing aviation safety issues are Controlled Flight into Terrain (CFIT), Approach and Landing, Loss of Control and Human Factors. Of these four, the top priority for the Flight Safety Foundation is reducing accidents as a result of Controlled Flight into Terrain.
The FAA defines CFIT as occurring “when an airworthy aircraft is flown, under the control of a qualified pilot, into terrain (water or obstacles) with inadequate awareness on the part of the pilot of the impending collision.”[2] CFIT accidents are responsible for more than half of all commercial aviation fatalities during the past 10 years.[3] In General Aviation, CFIT accidents account for seventeen percent of all accidents.[4]
A CFIT accident is the accident category most clearly attributable to human error. In considering the definition, there is a qualified pilot flying a perfectly flyable airplane yet the flight ends in an accident. The definition includes assigning the blame as inadequate awareness on the part of the pilot, in other words, human error. These types of accidents occur either because the pilot is laterally displaced from the intended position or the pilot is lower than intended, sometimes both.
Most aviation accidents can be traced back to a human error but CFIT accidents are particularly troubling due to the percentage of fatalities as a result of the accident. The goal of prevention lies in giving the qualified pilot more resources to increase awareness and to prevent the CFIT accident. There are two ways to begin to decrease the risk of CFIT accidents. Either the qualified pilot receives more training or the qualified pilot is given better technological resources in the cockpit. Ideally, the qualified pilot will have both.
To eliminate as much human error as possible, technologies have been developed to assist the pilot. There are a variety of systems available for all areas of aviation but the technology of the Enhanced Ground Proximity Warning System is considered to be the most useful advance to date. Flying Magazine has called it “one of the most important safety advances in decades.”[5] EGPWS is prohibitively expensive for use in General Aviation so this paper will focus on the description and use of the EGPWS technology in the commercial airline industry.
What was needed in the cockpit was a system that would monitor the flight path and provide a warning to the pilots if impact with terrain was imminent before any unusual flight maneuvers would have to be employed. Prior warning systems were interfaced with the radio altimeter, which had limitations. The older systems would keep track of the airplane’s height via the radio altimeter settings and then give an aural alarm if a downward trend was detected. It would only give indications based on correct altimeter settings and did not have the ability to “look ahead” of the airplane to detect possible terrain collisions. The EGPWS was a major improvement for the simple fact that it would utilize a terrain map database via Global Positioning Systems to provide the pilots with a more reliable source of data. It would give a visual and an aural warning for terrain warnings. The warnings sound approximately 60 seconds before terrain impact giving ample time for the pilot to make corrections. The older Terrain Warning Systems would give only 15-30 seconds warning before terrain impact.
The early EGPWS interfaced only with the Flight Management System on the aircraft. This interface worked well within the contiguous United States and Europe but in the more remote areas of the world such as Africa the EGPWS data had to rely on possibly outdated terrain data in the FMS. The original intent of Honeywell’s EGPWS was to have the system download independent GPS input and provide accurate terrain display no matter how old the FMS data might be.
The Austrian writer, Karl Kraus said, “The development of technology will leave only one problem: the infirmity of human nature.”[6] With all new technological advances, it would be a useless application if it were not an intuitive tool for the pilots for whom it may save. Before working on the technical aspect of the hardware, the engineers recognized that abiding by the FAA recommendation to consider the human factors in presenting a new function in the already familiar cockpit would be a solid course of action.
The FAA understands that before the engineers devise new technologies they should first consider the human factors framework in which this new technology will be used. To that end, the FAA published a report in 1996 which in part states, “Recommendation Processes-1: The FAA should task an aviation industry working group to produce a set of guiding principles for designers to use as a recommended practice in designing and integrating human-centered flight deck automation.” And “Recommendation SA-3: The FAA should encourage the aviation industry to develop and implement new concepts to provide better terrain awareness.”[7]
The older terrain warning systems had a set of functions that are now considered standard. They include warnings for Rising Terrain, Excessive Descent Rate, Descent After Takeoff, Terrain Clearance, Descent Below Glideslope, Alltitude Callouts, Smart
500 foot Callout, Excessive Bank Angle Warning and Tail Strike Warning.
The enhanced features of the Enhanced Ground Proximity Warning System that earned the system it’s accolades are as follows: Enroute Terrain Display – PEAKS, A Detailed Terrain Database, Obstacle Database, All publicly Known Airports, Look Ahead Algorithms, Terrain Alerting, Pop-up feature, Geometric Altitude and Envelop Modulation.
Enroute Terrain Display-Peaks
Flying is a visual activity so care in considering how to display the information is of high priority. One display issue is what colors should be used for terrain awareness. One universal standard color scheme would be followed in the use of Red, Yellow and Green. Red is an urgent warning for the crew to take action, Yellow signifies that the crew should be aware of the terrain, Green symbolizes that the crew is in the clear and no action would be necessary. The color palate is used in the same manner as it is used in the outside world. For example, consider a traffic stoplight, Red is the color used to denote a definitive Stop signal, Yellow provides a caution warning and Green is an all clear. Utilizing aspects from other areas of life to match how to respond to various display indications in the cockpit will decrease the possibilities of negative transfer. Negative transfer is defined as “the interference of previous learning in the process of learning something new, such as switching from an old manual typewriter to a computer keyboard.”[8]
“The EGPWS terrain display utilizes five colors; red for terrain well above the aircraft, yellow for terrain slightly above and below the aircraft, green for terrain well below the aircraft, cyan for significant bodies of water and black for no threatening terrain.”[9]
During daylight hours the colors are more brightly displayed in order to be more visible to the flight crew. As slight a difference this may sound, the brightness factor could be critical. In an aircraft I recently started flying, I had thought that my Distance Measuring Equipment (DME) was INOP and I had chosen a different instrument approach than I had intended or even preferred. Later that evening, during dusk, I noticed that the DME was operating once again. It occurred to me that the DME was working all day but did not have a bright enough display to be seen during daylight hours. Fortunately, I did not have to rely on that cockpit instrument in order to safely complete the flight.
The PEAKS function will give highest and lowest terrain in feet of sea level numerically displayed on the side of the main map display. This allows for yet another level of increased awareness of the surrounding terrain. The flight crew not only has the pictorial view of the terrain but it is reinforced by a graphical/numeric indication for a quick reference. The numeric display is color coded to correspond to the color coding on the terrain display. The number corresponding to the highest peak and lowest peak in the area will be displayed in whatever color it is represented on the display.
Detailed Terrain Database/Obstacle Database/All Publicly Known Airports
With Interfacing the Terrain display with a Global Positioning System the EGPWS is able to provide the flight crew with a more accurate terrain display than previous models used.
Look Ahead Algorithms
The display would not only need to show appropriate colors but also give correct terrain information in a timely manner. A major improvement that was needed to assist the flight crew was a longer lead time in order to respond to aural and visual warnings of impending terrain impact. Earlier systems would give a 15-20 second warning but often this was not enough time. Flight crews, when faced with a system that in the past has “cried wolf” and alerted the crew of impending terrain impact but was actually a false warning created an “accident waiting to happen” scenario. When a crew is given 15-20 seconds to respond to a terrain avoidance warning but takes time to discern whether or not it’s a true or false warning the hesitation to pull-up may put the flight in danger. One case to consider is the USAF 737-200 that crashed into a hillside while flying an NDB approach into Dubrovnik, Croatia carrying U.S. Secretary of Commerce, Ron Brown. The flight was off course, to the left of the inbound course of the approach, and installed on the airplane was an early model terrain avoidance system. The investigators could not confirm if the system was operational. If operational, the flight crew would have received a terrain warning 20 seconds before the impact. In this case, that was not enough time to execute the pull-up and avoid the accident.[10] The engineers on the EGPWS project were charged with the responsibility to increase the visual and aural warning to occur with enough lead time for the flight crew to respond. The EGPWS will provide warning indications 60 seconds before terrain impact. Considering that the flight crew might not be expecting this warning, the 60 second lead time gives adequate warning for the flight crew to react and respond.
A global terrain database with 100% coverage is resident within the EGPWS. By using the input latitude, longitude, altitude as well as flight path angle, turn rate and ground speed, the EGPWS can place the aircraft position within the terrain data and “look ahead” to potential conflicts with terrain. This eliminates the problem of abruptly rising terrain and gives greatly enhanced warning times for most CFIT situations. Software algorithms look down, based on flight path angle and nearest runway; ahead, based on aircraft ground speed; aside, based on roll angle; and up, by about 6 degrees.
Terrain Alerting
If any terrain is “seen” in the database by the algorithms, annunciators are illuminated and the voice “Caution Terrain” or “Terrain Terrain Pull Up” is given. The algorithms are designed to provide about 60 seconds advance alert to conflict with terrain. The first aural warning of “Caution Terrain” is in a more quiet or low tone so that it may be easily distinguished from the louder and more urgent callout of “Terrain! Terrain! Pull Up!”[11]
Pop-up Feature
Another enhanced feature of the EGPWS is the ability to have the display map “pop-up” or be overlaid on the cockpit’s weather radar system so that the flight crew may have a more integrated picture of weather and terrain. Putting the two systems together with the Pop-Up feature may help eliminate errors when a flight crew member must look at two different displays in order to interpret the flight condition in relationship to terrain and weather.
Geometric Altitude
As mentioned previously, many of the CFIT accidents in prior years could be attributable to altimeter miss-sets. The EGPWS uses a geometric altitude that blends improved pressure altitude calculations, GPS altitude, radio altimeter, and terrain and runway information to eliminate the reliance on human data input. This feature alone may go a long way to reduce the number of CFIT accidents each year. One statistic claims that 25% of all CFIT accidents are attributable to miss-set altimeters.[12]
Envelop Modulation
One feature of the EGPWS is the capability to customize the alert system at certain geographical locations in order to reduce nuisance warnings and provide extra alert time if necessary.
Maintenance
In considering human factors in relationship to the maintenance of the EGPWS, automating the tasks of updating and maintenance is a prime concern of the design team. Automation should be incorporated to make a task simple to perform to achieve a more correct output. The role of human interaction should not be so difficult or tedious as to prohibit or discourage the task to be performed. The person responsible for ensuring the EGPWS is up to date and operating correctly should be able to accomplish these tasks effectively through automation.
Access to correct and updated databases is critical to flight safety. The EGPWS Terrain Database requires updates to remain the most useful to the flight crews but regulations are not in place to require such updates. Even though not required to do so, Honeywell makes available three updates per year which they provide at no additional cost knowing that easy access to the information will help the flight crews stay informed on critical flight data. The EGPWS operators are able to sign up for an email notification that a new database download is available. The database is available through the internet and takes only 30 minutes to complete once downloaded onto a card that interfaces with the EGPWS system.[13]
Honeywell makes available to EGPWS operators many tools to assess whether or not the EGPWS unit is working correctly. On their website the company has available a step-by-step self test guide as well as a real-time assessment of why a false terrain warning may have been activated.
With Human Factor considerations in mind the engineers worked to create a product that interfaced well between Humans and Technology. Unfortunately, it is impossible to prepare for all situations. There was one interesting problem that arose as a result of a disconnect between what the engineers designed and how avionic technicians interpreted the technological indication. An article in Avionics News stated the problem this way, “The biggest mistake technicians make when troubleshooting the EGPWS is using illumination of any cockpit failure annunciators (GPWS INOP, TERR INOP, W/S INOP) as a reason for removal.”[14]
Taking the statement on its face value, how could one fault the technicians for removing critical equipment that appeared to be indicating a failure. The Avionics News article goes on to explain the failure signal indicates a lack or failure of the required input signal and not a failure of the EGPWS unit itself. The technicians would remove the EGPWS unit and send the unit back to Honeywell for the company to test. Honeywell had so many returns of equipment in which no problems were found that they have begun to charge customers for returns of units for which no self test was performed prior to sending the units to Honeywell.
This disconnect issue was that on a different part of the display panel another indication would be illuminated to verify that the computer is fine. So if there is an INOP indication the technicians should have tried to troubleshoot via a self test procedure detailed in the manual rather than remove the equipment itself. The technicians did not make the connection between the two displays. The FAA suggests that when designing error messages the engineers should incorporate multilevel message. “The system shall provide more than one level of error messages, with successive levels providing increasingly detailed levels of explanation.”[15] If the failure indication utilized a more multilevel approach to error messages perhaps the technicians would have been able to more easily understand the failure indication thus not wasting company time in removing operable equipment.
No where in the article was it suggested that the engineers may have prevented this misunderstanding, that was quite prevalent, by considering Human Factors in the design of this failure of signal input indication.
The company does make available to EGPWS operators many tools to assess whether or not the EGPWS unit is working correctly. On their website the company has available a step-by-step self test guide as well as a real-time assessment of why false terrain warnings may have been activated which makes flight testing unnecessary. This is major cost cutting measure in terms of fuel for the operators of the EGPWS.[16]
The success of EGPWS can be measured by the number of CFIT accidents that have been prevented. To date, EGPWS has been responsible for saving 27 different aircraft from CFIT accidents.[17] One of the prohibitive factors in getting this cutting-edge technology in all aircraft is the expense. There has already been some forward movement by the US Presidential Commission on air safety to mandate that all commercial air-carriers include the EGPWS system on all their aircraft. This federal push comes from the success of a 1994 mandate in which the FAA mandated the installation of GPWS into regional turbine aircraft with 10 or more passenger seats. Since the 1994 mandate not one aircraft from that fleet of about 1600 aircraft has suffered a CFIT accident in the USA. It is unclear how a mandate to install this technology would impact the economics of the airline industry but it would be a giant step toward the goal for a zero accident rate for commercial air-carriers.
[1] EGPWS Review (2004, February) Flying magazine
[2] Federal Aviation Administration Advisory Circular (Publication No.61-134) General Aviation Controlled Flight Into Terrain Awareness (2003, April 1)
[3] Flight Safety Foundation Priorities. (2001-2004) Page 2 Retrieved from
http://www.flightsafety.org/
[4] Federal Aviation Administration Advisory Circular (Publication No.61-134) General Aviation Controlled Flight Into Terrain Awareness, (2003, April 1)
[5] EGPWS Review (2004 February) Flying magazine
[6] Karl Kraus (1874–1936), Austrian writer. Trans. by Harry Zohn, originally published in Beim Wortgenommen (1955). Half-Truths and One-and-a-Half Truths, University of Chicago Press (1990).
[7] Federal Aviation Administration Human Factors Team Report on: The Interfaces Between Flightcrews and Modern Flight Deck Systems”,(1996, June 18)
[8] The American Heritage Dictionary of the English Language, Fourth Edition, 2000
[9] Getting the Job Done-Part 1, Avionic News, March 2004
[10] Honeywell document 3.3;(2002, January 21) accessed from
http://www51.honeywell.com/aero/Products-Services/Avionics-Electronics/EGPWS-Home.html?c=21
[11] EGPWS Saves Lives (2004) [electronic version] Retrieved from
http://www.egpws.com/general_information/broxhures/EGPWS_Saves_Lives.pdf
[12] EGPWS Saves Lives (2004) [electronic version] Retrieved from
http://www.egpws.com/general_information/broxhures/EGPWS_Saves_Lives.pdf
[13] Honeywell document (2004, January) accessed from
http://www51.honeywell.com/aero/Products-Services/Avionics-Electronics/EGPWS-Home.html?c=21
[14] Getting the Job Done-Part 2, Avionic News, May 2004
[15] Federal Aviation Administration Human Factors Team Report, Human and Computers Interface, Error Messages, (1996, June 18)
[16] Honeywell document (2004, January) accessed from
http://www51.honeywell.com/aero/Products-Services/Avionics-Electronics/EGPWS-Home.html?c=21
[17] Honeywell document (2004, January) accessed from
http://www51.honeywell.com/aero/Products-Services/Avionics-Electronics/EGPWS-Home.html?c=21