A Near Catastrophe: Within Feet Of Becoming The Worst Air Disaster
This article appears in the December issue of Business & Commercial Aviation with the title “A Near Catastrophe.
Just before midnight on July 7, 2017, an Air Canada AirbusA320 came within a few seconds of landing atop a line of four airliners waiting on a parallel taxiway to take off from Runway 28R at San Francisco International Airport(KSFO). Were it not for alerts from two of the waiting crews and instantaneous corrective action, the resulting carnage would likely have been massive and the human suffering incalculable.
The incident occurred in clear weather. Crews in the airplanes sitting on Taxiway C — a United Boeing 787, a Philippine Airlines Airbus A340, another United 787 and a United Boeing 737 — could see a stream of inbound aircraft at least 15 mi. long. The waiting crews were impatient. Departure delays were running at least 30 min. because Runway 28L was closed for construction, thus arrivals and departures were sharing 28R.
Air Canada Flight 759 from Toronto with a crew of five and 135 passengers was on a 1-mi. final completing the FMS Bridge Visual Approach to 28R (see the approach plate). The Airbus had been cleared to land on 28R, but something just didn’t look right to the crews of the first two airplanes waiting on the taxiway. The Airbus seemed to be heading right at them.
The captain of the first airplane in the taxiway queue (UAL Flight 1), thumbed his mic and said, “Where is that guy going?” The crew of Philippine Airlines (PAL Flight 115) saw what was happening and selected their lights to TAKEOFF mode thus lighting the taxiway before them along with the empennage of UAL 1.
The Air Canada Airbus descended to 100 ft. AGL and roared over the first United 787. At that point the tower controller realized what was happening and ordered the Airbus to go missed, but by then the Airbus crew had realized their mistake and begun a go-around. Still, the Air Canada aircraft continued to descend to a minimum altitude of about 60 ft. AGL as it overflew the second airplane on the taxiway, clearing the A340’s tail by about 20 ft. before it started to climb.
No one was hurt, no metal was bent, but the system had come close to total failure, putting hundreds of people at risk.
The NTSB studied the near disaster for more than a year before ultimately determining that its probable cause “. . . was the flight crew’s misidentification of Taxiway C as the intended landing runway, which resulted from the crewmembers’ lack of awareness of the parallel runway closure due to their ineffective review of NOTAM information before the flight and during the approach briefing.”
The safety board also determined that contributing to the incident were:
(1) The flight crew’s failure to tune the ILS 28R frequency for backup lateral guidance, expectation bias, fatigue due to circadian disruption and length of continued wakefulness, and breakdowns in CRM.
(2) Air Canada’s ineffective presentation of approach procedure and NOTAM information.
The Sequence
The Air Canada pilots reported for duty in Toronto at about 1930 EDT (1630 PDT). They would be late departing Toronto because their airplane was delayed inbound. They discussed the expected weather en route and reviewed the 27-page flight release, which contained pertinent information including NOTAM information for KSFO that stated Runway 28L would be closed from 2300 that night to 0800 the next morning.
During post-incident interviews, the pilots provided different accounts regarding their awareness of the runway closure. The captain stated (one week after the incident) that he saw the Runway 28L closure NOTAM. The first officer stated that he did a “quick scan” of the NOTAMs but could not recall whether he had seen the Runway 28L closure NOTAM, nor could he remember if he and the captain had discussed the closure. The first officer said he realized, after the incident flight landed, that Runway 28L had been closed.
One month after the incident, the captain stated that he and the first officer had discussed the Runway 28L closure while at Toronto, but that they did not place much emphasis on that information because their flight was scheduled to land before the runway would be closed. Actually, said the safety board, this wouldn’t have been the case because the flight was originally scheduled to land at SFO at 2303, 3 min. after Runway 28L was scheduled to shut down.
The Airbus departed Toronto at 2158 EDT (1858 PDT), 30 min. later than scheduled. The 20,000-hr. captain was the pilot flying (PF), and the 10,000-hr. first officer was the pilot monitoring (PM). The crew engaged the autopilot after takeoff and it remained engaged until just before the final approach to KSFO. The flight was uneventful except for an encounter with an area of thunderstorms about midway through. The pilots told the safety board they started to feel tired just after they navigated through the thunderstorms about 0045 EDT.
The taxiway overflight occurred at about 2356 PDT, which was 0256 EDT, according to the flight crew’s normal body clock time — a time when they normally would have been asleep and a time that approximates the start of the human circadian low period (in this case, 0300 to 0500 EDT). At the time of the approach incident, the captain had been awake for more than 19 hr., and the first officer had been awake for more than 12 hr.
Before top of descent (TOD), the first officer obtained ATIS information Quebec via ACARS and printed the information. It indicated that Quiet Bridge Visual Approach was in use landing on Runway 28R, and that that Runways 28L/10R would be closed after 2300. Information Quebec also stated that the Runway 28L approach lighting system and the Runway 28L/10R centerline lights were out of service. The pilots recalled reviewing the ATIS information but could not recall whether they saw the information about the Runway 28L closure. The captain briefed Air Canada’s FMS Bridge Visual Approach procedure to SFO Runway 28R.
As part of his monitoring duties, the first officer would have used the multifunction control and display unit (MCDU) to program required settings, but he failed to enter the 28R ILS frequency into the radio/navigation page. He said later he “must have missed” the page and was unsure how that could have happened. Also, the captain failed to verify that the ILS frequency had been entered, and neither flight crewmember noticed that the ILS frequency was not shown on the primary flight displays (PFDs). That approach procedure was the only one in Air Canada’s Airbus A320 database that required manual tuning for a navigational aid.
As part of the approach briefing, Air Canada’s procedures required the flight crew to discuss any threats associated with the approach. The captain stated they discussed as threats the nighttime landing, the traffic and the busy airspace, and that it “it was getting late” and the pilots would need to “keep an eye on each other.” The first officer stated that the threats were the mountainous terrain, the nighttime conditions and both flight crewmembers’ alertness. The captain and the first officer could not recall whether they discussed the Runway 28L closure as a threat.
At 2324, the crew began their descent from FL 360. At 2330:42, the flight crew checked in with the Northern California Terminal Radar Approach Control (NCT) on the DYAMD 3 (RNAV) STAR to SFO. At that time, the airplane was descending from an altitude of 27,000 ft. MSL.
The controller issued instructions to join the FMS Bridge Visual Approach to Runway 28R after reaching the final waypoint on the STAR. FDR data showed that the airplane descended through an altitude of about 14,500 ft. MSL at 2336:30.
At 2346:08, the controller instructed Air Canada 759 to turn right direct to the TRDOW waypoint and join the FMS Bridge Visual Approach to Runway 28R, and the flight crew acknowledged this instruction.
At 2346:19, the controller asked the crewmembers if they had the airport or bridges in sight; the pilots replied that the bridges were in sight.
At 2346:30, the controller cleared the airplane for the approach and, at 2350:48, instructed the flight crew to contact the tower.
At 2351:07, the flight crew contacted the KSFO tower and advised that the airplane was on the FMS Bridge Visual Approach to Runway 28R. Four seconds later, the tower controller issued a landing clearance for Runway 28R. The flight crew acknowledged the clearance at 2351:18. FDR data showed that the landing gear was selected to the down position at 2352:46.
Air Canada’s FMS Bridge Visual Approach procedure to Runway 28R states that pilots of Airbus A319/A320/A321 airplanes were to do the following: “at or before F101D [the final waypoint on the approach], disengage autopilot and continue as per Visual Approaches [standard operating procedures].” FDR data showed that the autopilot was disconnected at 2353:28 when the airplane was at 1,300 ft. and that the flight directors were disengaged at 2354:02 when the airplane was at 1,200 ft. The flight passed F101D at 2354:28, when it was at 1,100 ft, and the captain made the required 14-deg. right turn to align the airplane with Runway 28R — but instead aligned the airplane with Taxiway C.
During the approach, the first officer was looking inside the cockpit setting up the missed approach. Additionally, the captain asked the first officer to set the heading bug to the runway heading. The first officer said he had difficulty finding the heading information on the approach chart, so he had to reference the airport chart, thus extending his head-down time.
Between the time the airplane passed F101D (at an altitude of about 1,100 ft.) and the time that the airplane had descended to an altitude of 600 ft., the captain saw lights across what he thought was the Runway 28R surface and asked the first officer to find out whether the runway was clear.
At 2355:45, the flight crew radioed: “Just want to confirm, this is Air Canada seven five nine, we see some lights on the runway there, across the runway. Can you confirm we’re cleared to land?” The airplane was passing through an altitude of 300 ft.
Just before the controller received this query, he had visually scanned 28R. In response to Air Canada’s request, he checked the radar display and the airport surface surveillance capability (ASSC) display and then rescanned Runway 28R.
At 2355:52, 1 sec. after the flight crew completed its transmission, the controller replied, “Air Canada seven five nine, confirmed cleared to land runway two eight right. There’s no one on runway two eight right but you.” About that time, the airplane was descending through 200 ft. and was 2,300 ft. (0.38 nm) from the seawall that protected the airfield from San Francisco Bay.
At 2355:58, the flight crew acknowledged the transmission; about that time, the airplane was at 150 ft. AGL and 500 ft. (0.08 nm) from the seawall. One second later, the UAL 1 captain said on tower frequency, “Where is that guy going?”
At 2356:03 (after Air Canada 759 crossed the seawall), the Airbus overflew UAL 1 at an altitude of 100 ft.; about the same time, the UAL 1 captain stated, over the tower frequency, “He’s on the taxiway.” The flight crew from the second airplane on Taxiway C, Philippine Airlines Flight 115, turned on its landing gear and nose lights, illuminating a portion of the taxiway and the UAL 1 airplane.
At that moment (2356:05), the Air Canada captain believed “things were not adding up . . . it didn’t look good. He initiated a go-around just as the first officer called for a go-around. Neither crewmember had seen the airplanes they were overlying.
The airplane continued descending, reaching a minimum altitude of about 60 ft. at 2356:07 as the airplane overflew PAL 115. One second later, once the engines and elevators had fully transitioned to their go-around position, the Airbus began to climb.
At 2356:09, the controller instructed the Air Canada crew to go around. The flight crew acknowledged this instruction 2 sec. later as the airplane overflew the third airplane on the taxiway, UAL 863, at an altitude of 200 ft. The Airbus then overflew the fourth airplane on the taxiway at an altitude of 250 ft.
During the 3 sec. between the time that the pilots initiated the go-around and the airplane began climbing, Air Canada 759 had flown about 700 ft. (0.12 nm) from the location over the taxiway where the go-around was initiated.
At 2356:12, the controller advised the Air Canada 759 flight crew, “it looks like you were lined up for [Taxiway] Charlie,” and instructed them to climb and enter a downwind for a second approach. While on the downwind to 28R, the first officer asked the captain if they should set the ILS frequency, and the captain agreed. The second approach to 28R was uneventful.
During a post-incident interview, the captain said he thought that he saw runway lights for Runway 28L and believed that Runway 28R was Runway 28L and that Taxiway C was Runway 28R. The first officer reported that he thought that he saw runway edge lights, but also thought “something was not right” even after the tower controller confirmed that the runway was clear. He called for a go-around because he could not resolve what he was seeing.
Tough to See
The airplane that preceded the incident airplane into KSFO by 4 min. was Delta Flight 521, a Boeing 737 that landed without incident on Runway 28R. Both DAL 521 pilots told the NTSB that they questioned whether their airplane was lined up for Runway 28R after visually acquiring the runway environment. The Delta captain said that he could see lights (but no airplanes) on Taxiway C and that they gave the impression that the surface could have been a runway.
The Delta first officer reported seeing a set of lights to the right of Runway 28R but that he “could not register” what those lights were. He also reported that there were “really bright” white lights on the left side of Runway 28R (similar to the type used during construction), but both he and the captain knew that Runway 28L was closed.
The Delta pilots were able to determine that their airplane was lined up for Runway 28R after cross-checking the lateral navigation (LNAV) guidance. The captain stated that, without lateral guidance, he could understand how the Runway 28R and Taxiway C surfaces could have been confused because the lights observed on the taxiway were in a straight line and could have been perceived as a centerline. The Delta pilots confirmed that their airplane was lined up correctly when they visually acquired the painted “28R” marking on the paved surface of the runway; they estimated that their airplane was at an altitude of 300 ft. at that time.
The Delta 521 captain told the Safety Board, “had the runway [28L] sequenced flashing lights been on, it would have defined the landing runway, or had we flown the ILS [approach] we would have had precision course guidance that would have eliminated the illusion that we were not lined up on Runway 28R.” The Delta first officer stated, “the PF stayed on the LNAV guidance all the way to the runway, which mitigated the confusion we experienced from the lighting and non-normal airport configuration at SFO that night.” The Delta flight called the tower about 40 to 50 min. after the Air Canada incident and suggested that, to assist pilots with runway identification, flight crews should “fly ILS approaches to RWY 28R” or the tower should “turn on the lights for RWY 28L.”
Safety Board Analysis
What follows are highlights from the Safety Board’s analysis.
The Air Canada pilots stated the Taxiway C surface resembled a runway. Although multiple cues were available to the flight crew to distinguish Runway 28R from Taxiway C (such as the green centerline lights and flashing yellow guard lights on the taxiway), sufficient cues also existed to confirm the crew’s expectation that the airplane was aligned with the intended landing runway. These included the general outline of airplane lights in a straight line on Taxiway C and the presence of runway and approach lights on Runway 28R which would also have been present on Runway 28L when open.
As a result, once the airplane was aligned with what the pilots thought was the correct landing surface, “they were likely not strongly considering contradictory information. The cues available to the flight crew to indicate that the airplane was aligned with a taxiway did not overcome the crew’s belief, as a result of expectation bias, that the taxiway was the intended landing runway.” (See “Expectation Bias and New Avionics” sidebar.)
CVR information was not available for this incident because the data were overwritten before senior Air Canada officials became aware of the severity of this incident. Without CVR information, the NTSB could not determine whether distraction, workload and/or other factors contributed to the crew’s missteps.
From a regulatory viewpoint, the NTSB found no issues with the flight crew qualifications, flight crew medical conditions, airplane mechanical conditions or airport lighting. Everything met appropriate Canadian and U.S. requirements.
Failure to understand the significance of the runway closure NOTAM was an important factor. No evidence indicated that the crewmembers reconsidered its importance as the airplane approached KSFO. The ATIS information included a NOTAM indicating that Runway 28L was closed, but neither flight crewmember recalled seeing this information.
Air Canada SOPs also stated that descent preparation should be completed before TOD. The pilot monitoring (first officer) was to use the MCDU to reference the radio/navigation page and set navigational aids into the FMC and then check that the ILS identifier shown on the PFDs was correct. The pilot flying (the captain) was to review the approach programming in the MCDU and complete an approach briefing, which included verifying that the primary approach aid (ILS) identifier and frequency were properly set. This didn’t happen.
Air Canada’s FMS Bridge Visual Approach chart consisted of two pages. The first page showed the approach procedure and included the ILS frequency for Runway 28R in the plan view. The second page of the approach chart was in text format and indicated that Airbus A319/A320/A321 pilots should tune the ILS for Runway 28R, which would provide flight crews with backup lateral guidance (via the localizer aligned with the runway heading) during the approach. This lateral guidance would supplement the visual approach procedures.
The first officer told investigators he missed the step in the procedure to manually tune the ILS frequency when he set up the approach in the FMC. The FMS Bridge Visual Approach was the only approach in the company’s Airbus A320 database that required manual tuning of an ILS frequency. This might have contributed to the first officer’s failure to input the frequency. However, the first officer’s error should have been caught by the captain as part of his verification of the approach setup during the approach briefing.
Accordingly, “The NTSB concludes that the first officer did not comply with Air Canada’s procedures to tune the ILS frequency for the visual approach, and the captain did not comply with company procedures to verify the ILS frequency and identifier for the approach, so the crewmembers could not take advantage of the ILS’s lateral guidance capability to help ensure proper surface alignment.”
The captain flew the FMS Bridge Visual Approach to Runway 28R with the autopilot engaged until just before F101D. After the airplane reached F101D and the autopilot was disconnected, the first officer began setting the altitude and heading for a missed approach, which diverted his attention from monitoring the approach as the captain aligned the airplane with Taxiway C.
The NTSB said it “recognizes that the first officer set the missed approach altitude and heading at an appropriate time (given his perception that the airplane was being flown in the open descent mode). However, his attention was further diverted from monitoring the approach when the captain requested that the first officer set the runway heading.”
If the first officer had been monitoring the approach at this point, he might have realized, among other things, that the ILS frequency and identifier and the Runway 28R extended centerline were not depicted on his PFD. Thus, the Safety Board said, it “concludes that the first officer’s focus on tasks inside the cockpit after the airplane passed the final waypoint reduced his opportunity to effectively monitor the approach and recognize that the airplane was not aligned with the intended landing runway.”
The airplane performance study showed that Air Canada 759 continued the approach and flew over the first airplane on Taxiway C at an altitude of 100 ft., and that the flight crew initiated a go-around when their aircraft was at an altitude of 89 ft. The airplane flew over the second airplane on Taxiway C at an altitude of 60 ft. before the Airbus began climbing, which resulted in only 10-20 ft. of vertical separation between the airplanes. Noting that, the Safety Board said it “concludes that the flight-crew-initiated, low-altitude go-around over the taxiway prevented a collision between the Air Canada airplane and one or more airplanes on the taxiway.”
The controller recalled that, when Air Canada 759 was about one-tenth mile on short final, the airplane looked “extremely strange” regarding its location relative to Runway 28R, Taxiway C and the airplanes along the taxiway. When the UAL 1 captain radioed, “Where is that guy going?” at 2355:59, the controller expressed confusion regarding who had made the transmission. (The UAL 1 captain did not identify himself during the transmission.) At that point, the controller, who had just checked Runway 28R twice, was likely trying to process what he was seeing and hearing. The controller stated, during a post-incident interview, that the transmission seemed “out of context.”
The controller had no reason to think that Air Canada 759 was lined up with Taxiway C before he observed the airplane looking “extremely strange,” said the Safety Board. The Air Canada flight crew had reported that the airplane was on approach to Runway 28R, and the ASSC display had previously predicted that the airplane would be landing on Runway 28R. Also, the controller had not previously seen an airplane align with Taxiway C. Further, the distance and angle (parallax) of the tower cab relative to the approach end of Runway 28R and Taxiway C would have made it difficult for the controller to visually recognize that Air Canada 759 was aligned with the taxiway instead of the runway, especially at night and with the lights from the construction on Runway 28L and airport vehicle movements.
When the UAL 1 captain stated, 4 sec. after his first transmission, “He’s on the taxiway,” the controller might have realized what had happened. Because the Air Canada pilots had already begun the go-around maneuver (at 2356:05), the airplane was climbing at the time of the controller’s go-around instruction (2356:09). In its review, the Safety Board said it “concludes that the controller responded appropriately once he became aware of the potential conflict. A factor that precluded the controller from determining sooner that a potential conflict existed was the ASSC system’s lack of capability to detect a taxiway landing and provide an alert.”
CRM Breakdown
Air Canada’s CRM manual addresses, among other subjects, situational awareness, workload management, active monitoring, and threat and error management. Several crew actions and inactions during the incident flight demonstrated breakdowns in CRM, said the safety board, many of which were manifested as noncompliance with Air Canada’s SOPs. These actions and inactions
included:
included:
- The pilots’ ineffective review of NOTAMs in the flight release.
- The pilots’ failure to identify the Runway 28L closure information within the ATIS information.
- The pilots’ failure to conduct a complete approach briefing.
- The first officer’s failure to manually tune the ILS frequency and the captain’s failure to verify the tuning of the ILS frequency.
- The first officer’s failure to express concern about the perceived use of the open descent mode.
- The captain’s request, at the final waypoint (F101D), for the first officer to set the runway heading, which took the first officer by surprise and prolonged his head-down time while the airplane was aligned with the taxiway.
The captain’s and the first officer’s CRM skills were highly rated by other company pilots, said the Safety Board. Their errors did not appear to be consistent with their performance during other flights or with the CRM training they received. “Possible explanations for the breakdowns in CRM during the incident flight,” said the Board, “include fatigue and the high workload associated with the approach.”
Nevertheless, the Safety Board concluded “that errors that the flight crewmembers made, including their false assumption that Runway 28L was open, inadequate preparations for the approach, and delayed recognition that the airplane was not lined up with Runway 28R, reflected breakdowns in CRM and led to minimal safety margins as the airplane overflew Taxiway C.”
Safety Issues
The NTSB identified the following safety issues during this incident
investigation:
investigation:
- The need for more effective presentation of flight operations information to optimize pilot review and retention of relevant information. Although the NOTAM about the Runway 28L closure appeared to the pilots in several formats, the information just didn’t sink in. The safety board said, “Multiple events in NASA’s Aviation Safety Reporting System database showed that this issue has affected other pilots, indicating that all pilots could benefit from the improved display of flight operations information.”
- The Board sees a need for airplanes landing at primary airports within Class B and Class C airspace to be equipped with a system that alerts pilots when an airplane is not aligned with a runway surface. (See sidebar.)
- The Board also sees a need for modifications to airport surface detection equipment (ASDE) systems (ASDE-3, ASDE-X) and ASSC to detect potential taxiway landings and provide alerts to air traffic controllers. The FAA is experimenting with systems to detect misaligned airplanes.
- There is a need to more effectively signal a runway closure to pilots when at least one parallel runway remains in use. A runway closure marker with a lighted flashing white “X” appeared at the approach and departure ends of Runway 28L when it was closed. The marker was not designed to capture the attention of a flight crew on approach to a different runway. Increased conspicuity of runway closure markers could help prevent runway misidentification.
- For Air Canada — a recommendation to adjust crew rest regulations and to standardize FMS auto-tuning capability. The Board also said that Air Canada’s safety concept of threat recognition and mitigation is good fundamentally. It urges crews to discuss potential threats — as this crew did. They knew they were tired and operating in a high-traffic, dynamic environment. But apparently, they hadn’t recognized the closed runway threat.
Former Secretary of Defense and one-time U.S. Navy pilot Donald Rumsfeld famously said: “There are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns — the ones we don’t know we don’t know.” In the case of Air Canada Flight 759 at KSFO, it’s what the crew didn’t know it didn’t know that could have been massively tragic.
Ingen kommentarer:
Legg inn en kommentar
Merk: Bare medlemmer av denne bloggen kan legge inn en kommentar.