A Brief History of Everything Wireless Blog: Autoland gone wrong

Autoland gone wrong

2019-01-31 [Petri]

As I explain in my book, the application of radio waves is behind a major part of our current aviation safety record: thanks to VOR, ILS and GPS technologies, the planes can safely stay en route and land in zero visibility.

Experiencing the sudden transition of first being surrounded by thick, featureless gray fog and then seeing the end of a runway emerge right in front of you is one of the great thrills that come when you add an Instrument Rating to your Private Pilot's License.

Not only does it teach you to literally blindly trust your instruments, but the mathematics behind the navigation thoroughly also prove that we live on a globe, not on a flat Earth.

CAT III ILS supports autoland-feature that comes as a standard on all modern commercial jets, and most of us who fly frequently have probably been on a plane that performed an autoland, even if the weather was not demanding it, as the systems have to be tested frequently.

But in November 2011, the Singapore Airlines 777 autoland failed at Munich airport, and the plane skid dangerously off the runway. There were no casualties, but the event raised questions over the safety of this automated landing feature.

Now the final investigation report is out, and the culprit has been found:

Human error.

But how was that possible with an automated, computerized system, with inbuilt triple redundancy?

As the plane was landing, the weather was foggy and the Munich airport was in CAT I status, which is the "best visibility" CAT mode. Despite of the less-than-demanding weather, the captain of the 777 decided to use autoland. The crucial error was that he failed to inform the air traffic controllers about his decision.

Unaware of the fact that the incoming 777 was performing an autoland, the departing traffic continued according to normal CAT I procedures, and a regional jet was cleared for takeoff just prior to the arrival of the 777.

While the regional jet entered the runway, it momentarily ended up blocking the ILS transmission signal, and the autoland logic of the 777 assumed that the plane had veered off the designated glide path.

As a result, the 777 wheels eventually touched down in a banked state, forcing the pilots to try to initiate a go-around, but this mode had already been disabled by the autopilot as the wheels were detected to be on the ground.

After a brief moment of confusion, the pilot in command switched off the autopilot and gained manual control, but as the skid marks in the picture show, the plane first ended up off the left side of the runway, until finally coming to a stop on the grass to the right of the runway.

The procedure for CAT III autoland operation requires that all critical movements around the ILS antennas need to be halted in order to avoid just the kind of situation that caused this incident: ILS is based on radio waves, and the highly positional signal requires a continuous line-of-sight path between the transmitting antenna and the approaching airplane.

Therefore, the automation worked as expected, but it was responding to incorrect signal during the critical phase of the landing. And due to the size of the regional jet maneuvering at the airport, all three parallel receivers on the 777 saw the same kind of ILS signal misalignment. As a result, no system error warning was generated, which would have automatically switched the autopilot to a go-around mode.

The interruption was also so brief that the safeguarding ILS receivers at the vicinity of Munich airport did not have enough time to flag an error to the air traffic controllers.

As usual, a mishap is a sequence of events that all have to happen in right sequence and at the right time, and the altitude of the approaching 777 was just at the "sweet spot" for this brief signal interruption to have potentially severe consequences. The fact that no major accident resulted in from this was due to sheer luck in the end: slightly softer ground or steeper touchdown angle could have caused a wing to break and fuel tanks to rupture, with catastrophic results.

Although the use of radio waves is the key how millions of airline passengers reach their destinations safely daily, they can only work if the designated procedures are followed. The human factor beat the automation this time, like in so many other accidents, including the one described in Chapter 12 of my book.

Permalink: https://bhoew.com/blog/en/61

Show latest Earlier entries