Critical six feet

Despite a benign ATIS report of visibility 10 kilometers with a ceiling of 1,500 feet broken, the aircraft flew in instrument conditions of heavy rain and moderate turbulence for the entire approach to minimums. In a chilling combination of nonstandard circumstances exacerbated by a critical human error, the aircraft flew the entire approach 280 feet lower than the crew believed. Unbeknownst to the pilots, during the execution of the missed, the aircraft descended to within 6 feet of the ground, narrowly missing contact with a road and field outside the airport perimeter.

This incident is of special interest, as it shines a light on a latent threat present in a less-common type of instrument approach, a threat not properly appreciated by many pilots. The approach in question is an RNAV (GPS) (FAA terminology)/RNP (ICAO terminology for the same approach) approach flown with vertical guidance provided by barometric vertical navigation (baro-VNAV). Typically flown to LNAV/VNAV minimums presented as a decision altitude (DA), rather than as a minimum descent altitude (MDA), these baro-VNAV approaches look like and are flown as an ILS or an RNAV (GPS)/RNP approach utilizing satellite-based augmentation systems (SBAS) flown to LPV minimums.

---

‘SBAS? WAAS? Where do I have to worry about this?’
Space-based augmentation systems (SBAS) use ground reference sites to determine corrections to the raw GPS signal an aircraft should apply. Because of minute-to-minute variations in the atmosphere, a GPS signal on Monday will be slightly “off” in a different way than it will be on Tuesday. The Wide Area Augmentation System (WAAS) is just one of the several SBAS is use. WAAS provides augmentation for aircraft flying as far north as northern Alaska, and as far south as nearly the southern edge of Mexico. Flying east into the Caribbean, however, WAAS coverage fades out around Puerto Rico. For this reason, the RNAV (GPS) Runway 10 in San Juan (facing page) may not be flown using WAAS vertical navigation (note 1 on the approach chart). Vertical guidance must be provided by baro-VNAV on final. —NS

What’s baro-VNAV?

The flight decks of modern turbine aircraft use baro-VNAV guidance during final approach to DA when SBAS is not available. Whether because of loss of signal because of jamming or a temporary satellite outage, or because the aircraft is flying outside the geographical area covered by SBAS systems (SBAS satellites are geostationary, meaning they do not move with respect to a point on the Earth’s surface), the flight deck can “fail down” to baro-VNAV guidance if SBAS is lost, or plan to use baro-VNAV when the approach is loaded if determined to be outside SBAS reception.

A critical difference exists between a baro-VNAV approach and an ILS or SBAS-aided RNAV (GPS)/RNP approach—the source of the vertical guidance displayed during the approach. While all three approaches utilize a vertical deviation indicator (VDI) that can be coupled to an autopilot, each is using a different source of raw information converted into the graphic VDI display.

For the familiar ILS approach, the source of the VDI information is, of course, the glideslope: a radio signal broadcast from an antenna located to the side of the touchdown zone. The VDI displays the aircraft’s location above or below the center of the glideslope signal. For an SBAS-aided approach (for example, using the wide area augmentation system [WAAS] found in North America) to LPV minimums, the VDI displays the aircraft’s GPS-altitude deviation from the computed glide path. While an ILS and SBAS-aided approach use different sources to drive the VDI, neither is dependent on the aircraft’s altimeter system for computing and displaying VDI information.

Here is where the baro-VNAV approach critically differs. On final, the VDI is displaying the difference between the aircraft’s current barometric altitude (as shown on the altimeter) and the ideal center of the calculated glide path. The difference is small but critical—any error in altimetry will result in the aircraft showing a centered VDI when, in fact, the aircraft is not on the center of the desired glidepath. In the case of NSZ 4311, on initial contact with the approach controller the crew received instruction to descend below the transition level of 70 and was given an incorrect altimeter setting of 1011 hPA. The actual altimeter setting, which was correctly indicated on the current ATIS, was 1001 hPA; the difference of 10 hPA (roughly the same as 0.3 inches of mercury) caused the aircraft to be a constant 280 feet lower than indicated on the altimeters.

Worse, while flying the final approach with a centered VDI the aircraft was also 280 feet lower than the actual center of the glidepath. As the published minimums were 360 feet above the touchdown zone elevation (TDZE), upon reaching the indicated DA, the aircraft was actually at 80 feet agl. A slightly delayed reaction from the crew, combined with normal altitude loss during the transition to a go-around, resulted in the additional 74 feet of altitude loss that left the aircraft only 6 feet from ground contact.

The event chain

As is the case with many events that culminate in an accident or incident, this near miss was the result of multiple factors lining up in a way that allowed the danger to build. The aircraft was flying a baro-VNAV approach only because the ILS was out of service and the airplane was not equipped for SBAS approaches. Runway 27R has a very bright and extensive approach lighting system necessitated by its Category III ILS capability, but the lights were turned off because of the relatively good weather officially reported by the ATIS. An automated altitude alert was triggered at the tower controller’s station as the aircraft passed through 200 feet agl while 1.5 nautical miles from the runway, but the controller did not relay the message to the crew for nine seconds, during which the aircraft descended another 80 feet.

Finally, and of no small significance to pilots who consider it an infallible guard against the type of controlled flight into terrain accident NSZ Flight 4311 nearly became, the aircraft’s terrain avoidance and warning system (TAWS) never alerted the crew that they were about to strike the ground nearly a mile from the runway threshold. While the French Bureau of Enquiry and Analysis for Civil Aviation Safety (BEA) is still investigating the behavior of the TAWS system as it conducts the investigation into NSZ 4311, it is an intended feature of TAWS systems that they become increasingly less sensitive to terrain proximity as an airport is approached. Were this not the case, nuisance TAWS alerts would be common during approaches, leading to a desensitization of flight crews to the alerts—a problem of its own.

Indeed, three years prior to NSZ 4311, the United Kingdom’s Civil Aviation Authority (CAA) published the eerily prescient safety notice SN-2019/001, entitled “Risk of Controlled Flight into Terrain during 3D BARO-VNAV and 2D approaches.” The notice, published to “draw attention to the risk of Controlled Flight into Terrain (CFIT) when flying instrument approach operations with the pressure altimeter sub-scale set to an incorrect pressure setting,” observes that “Terrain Awareness Warning System (TAWS) may not provide a ground proximity warning (i.e. ‘pull up’ alert) close to an aerodrome when the aircraft is in the landing configuration.” The diagram below perfectly foreshadowed the actual flight path and near-impact point of NSZ 4311.

Better SOPs needed

Analysis of accidents, incidents, and near misses is of little value without actionable takeaways. The first line of defense against a similar future event crossing from near miss into outright accident is an increase in pilot awareness of the extent to which baro-VNAV approaches are subject to a single point of failure. While the pilots of NSZ Flight 4311 stated they conducted altitude-distance checks on final, these checks would have been of no assistance, as the incorrect altimeter setting would have similarly affected this double check. Thus, the single error of an incorrect altimeter setting rendered the normal defenses of the crew unproductive.

This fact seems to have been under-emphasized even in Airbus’ written procedures. The BEA noted: “The flight crew operational documentation regarding a RNP approach with LNAV/VNAV minima mentions the risks of the cockpit altimeters having different settings, but it does not specifically mention the risk of having the same incorrect QNH setting on both altimeters. In addition, there is no dedicated item concerning a specific cross-check of the QNH with another source of information such as the ATIS or METAR, or confirmation of the QNH with ATC.”

This last note speaks to a critical operating practice pilots flying a baro-VNAV approach must make standard. Recognizing that the success of the approach is contingent upon a valid altimeter setting, redundancy should be introduced into setting QNH. Merely hearing and confirming a spoken QNH from a controller is clearly inadequate, as it was the proximate cause of the NSZ Flight 4311 near miss. Rather, receipt and cross check of two independently received altimeter settings should be considered mandatory—the QNH read to the crew by ATC directly compared to a previously received ATIS, or to a METAR received over satellite weather, ADS-B, or datalink.

Further, it should be noted that the aircraft’s radar altimeter—if it is equipped with one—is a last line of defense against this type of event. Approaching minimums, the pilot monitoring should cross check the indicated radar altitude against the anticipated height above touchdown zone elevation. While some variance is acceptable because of uneven terrain or buildings on short final, a difference of hundreds of feet between radar altitude and expected height would be cause for an immediate go-around. These mitigating steps should be briefed by the pilots during the approach briefing, calling attention to the unique hazards present in this relatively uncommon approach.