The risk of incorrect altimeter settings

Voiceover 0:17

Welcome to the CAA Safety Files podcast.

Nathan Lovett 0:30

Hello and welcome to the CAA Safety Files from the UK Civil Aviation Authority. I'm Nathan Lovett from the CAA communications team. And this is where we look at occurrence, incident or accident reports that have been published throughout the different areas of the UK aviation industry. Each episode will focus on a different report. We talk about what can be learned from it, and also hear from experts who cover the relevant safety guidance. In May '22, an Airbus A 320, approaching Paris Charles de Gaulle Airport was given an incorrect altimeter pressure setting, which caused the barometric altimeters on board to show that the aircraft was nearly 300 feet higher above the ground than it actually was. So the aircraft was almost 300 feet below the glide path for the entirety of the final approach. This could have resulted in the aircraft crashing into the ground before reaching the runway. In aviation terms, this would have been a controlled flight into terrain short of the runway threshold. The crew were unaware of the problem and didn't see the runway because of bad weather. They carried out what they believed was a normal go around and never realized that they came within six feet of hitting the ground. In this episode, we'll be speaking with aviation experts here at the UK CAA and an air traffic controller at NATS to get their perspectives on what happened, the risks involved and the safety guidance in this area. We're going to start by speaking with the CAA's Head of Flight Operations, Glenn Bradley. Glenn, this safety risk has been around for quite a while. Can you tell us more about it?

Glenn Bradley 1:55

Absolutely. As you are aware, there's been a risk with altimetry errors on various approaches over the years. And this was highlighted recently by an event in Paris with a not a UK operator. The CAA issued a safety notice about this back in '19 so we've been aware of the issue for a while and we've been discussing it with our operators throughout the period. But because of the incident that happened, we felt we ought to do some more education work around this. And so we've done a video to highlight the issues. And also, obviously, this podcast to reinforce the work that's done with the safety notice. As you're aware the risk is having the incorrect altimeter setting for an approach. So setting the wrong QNH. And normally, this tends to be it's a human factors issue. So it tends to be you know, factors of 10. So one-zero-zero-one to one-zero-one-zero, or a nine-eight-zero to nine-nine-zero and various combinations like that. So unfortunately, it tends to be a factor of about ten hectopascals out, which means about three hundred feet, which is fairly significant, because that's kind of you're in the range of the height above the ground at decision height at that kind of point. So it is a significant error. This has been an issue ever since we've been flying approaches. So it's the same applies to VOR approaches NDB approaches, where there's no direct vertical guidance, it's telling you exactly where you are above the ground. For RNP approaches that use Baro VNAV guidance, it relies on the aircraft computing a vertical path based on the barometric input. If that's incorrect, obviously, all the indications of the aircraft look correct. But unfortunately, it means you can be following the correct path, depending on the direction of the error.

Nathan Lovett 3:27

Now the CAA published a safety notice about this risk in '19. Captain Alex Rattray flies with a commercial airline and is also a flight operations and training inspector at the CAA. Alex, please, can you tell us why that safety notice was issued?

Alex Rattray 3:40

Well, it was interesting, its very difficult to put a particular time on it but I was thinking about how the ground proximity warning system you know, the system gives you pull up when you get too close to the ground in a configuration you shouldn't be in certainly anytime you get too close to the ground. I started to think about it and I realized there was a certain set of circumstances where it wouldn't offer that protection. And two things really came to mind. The first thing was that actually, it's always been a problem because we've always flown non precision approaches, especially back in the day. So in other words, when you're in the landing configuration on a non precision approach, it was almost never going to give you a pull up warning if you were going to, if you like be too short of the runway and have a trajectory that's too short to the runway. So that was the first thing and that's historically been going for really forever, really for decades. That's always been a problem. And so I thought about that. But then of course with the advent of instrument landing systems, which give 3D guidance that meant that that risk in very large measure went away because you weren't just following a descent path based on the barometric information you were following an ILS which is actually electronic glide slope and localizer. In other words, you had tracking all the way down to the runway both laterally and vertically. And what was good about that as well was if you were to come off that for any reason, particularly up or down, you would then if you went below, you would actually say glide slope. So there was that added protection, not only was it much more precise, then it got more and more precise, the closer you are to the runway, but if you went below it, you actually got the word said glide slope, and you'd get a warning as well. So that was good and more and more ILS's have come around throughout the world over time. The issue that concerned me was I realized that increasingly RNP approaches were being used, which was a wonderful thing, because it meant you could get instrument approaches to different runways that didn't have the expensive ILS equipment. So it was it was really good. However, what really concerned me and prompted me to write the notice was I realized that actually, that safety issue opened up again with these approaches in that there wasn't any glide slope type enunciation to the crew. And in fact, worse still there'd be nothing at all, you'd go into the ground, you could go fly into the ground, if you had the wrong pressure setting, and there'd be no pull up. So I was particularly concerned about technology, really, because the problem with these approaches is that you could be in this dangerous situation with everything looking perfect. And there were some issues with regard. You know, it would make people think, Well, okay, if I check altitude for range, that's going to be okay. But actually, that doesn't help either. So I realized that I thought, well, actually, the risk is now going up, because there's this RNP Baro VNAV capability now that's being used more and more, but actually, it has the same old risks from thirty, forty years ago. So it opened up that problem, and there wasn't any kind of, you know, glide slope, and unfortunately, no pull up either. So in a way, it was a kind of accident waiting to happen.

Nathan Lovett 6:33

Thanks, Alex. And coming back to you, Glenn, as Head of Flight Operations, what is the CAA's role in managing this particular risk?

Glenn Bradley 6:38

It's a very good question. So as the regulator, our role in this is to have a kind of umbrella view over the industry and understand what the risks and what the issues of various entities and organizations are, that we oversee, and pull that together and then provide, we have a risk safety risk management system within the regulator. And this defines kind of what we do around the various risks that we oversee, we have various tools available. Our role is to help the industry manage the risk, this might entail a rulemaking task. So we create new regulations, which is a kind of a very large stick to provide the output that we require and to get the right outcomes. Another can be down to education and awareness, you know, like doing a podcast or a video just so it becomes more real and its understanding what our input is to the best effect, to help the industry to be able to manage the risk best, rather than us dictating to them. Because obviously, everything can be slightly different. And operators manage things slightly differently.

Nathan Lovett 7:34

Alex with your experience as a Flight Operations and Training Inspector, what work is being done to improve flight crew performance in this area.

Alex Rattray 7:41

That's really important, because technical solutions are always a great thing to have. But whilst there are some in place, and we await, hopefully further improvements in those things, the first thing like anything in life really, it doesn't matter if it's flying or anything else, if you know, there's a problem to be solved, is actually realizing there's a problem, realizing what the outcomes of the risks of that problem are, and then finding ways to trap and mitigate it, which you can do. And the key to that is threat and error management. So that's what we're really trying to improve and make sure the sort of discussions we'd like to, if you'd like influence are cruise saying, right, we're flying one of these approaches, what are the risks? Well, the risk with any approach, frankly, is controlled flight into terrain but particularly on these approaches, because not only would a QNH setting that's wrong, make that more likely, but actually, you won't even get a pull up warning as well. So it's a really important thing to recognize, trap and mitigate, which it can be done quite safely. But it only happens if you know about the problem.

Nathan Lovett 8:34

We're going to bring in Tim Watkins now who is a Lead Flight Test Engineer here at the CAA and has a background in the certification of aircraft and avionics systems. Tim, are you aware of any other potential misleading sources of information that could be presented to flight crew in the event of a missed set QNH?

Tim Watkins 8:51

That's an excellent question. And the answer, unfortunately, is yes, there are sources of information that if you misset the QNH can look very convincing, but actually can lead the crew astray. So the most compelling is actually the primary flight display. If your aircraft is capable of doing what's called a VNAV approach, so it's using the barometric altimeter, and distance from the runway to give you vertical guidance. So like a effectively like a glide path to follow. Then, with a misset QNH, that VNAV guidance will look perfectly normal. And if you follow it, it could fly you straight into the ground. It will look correct even though the QNH is misset. That's a real issue. You know, the guidance that you rely on looks very compelling. It looks correct, even though it isn't if you misset the QNH. The second problem you have is some aircraft on the altitude tape on the primary flight display they will put a marker which shows where the runway elevation is. So take for example Paris Charles de Gaulle, which was where the incident on the A320 was and we flew that scenario in the simulator, the runway elevation there for runway two seven, right is three hundred and ninety two feet above sea level. So, what we found on the 787 is the aircraft takes that height on the selected approach, and it puts a marker on the altitude tape to show the pilot, that this is where the ground is. So it draws an amber line with diagonal cross hatching beneath it, which is quite a strong indication it says this is where the ground is. So you can see on the altitude tape, almost a visual estimation of where the aircraft is compared to the ground. The problem is if the QNH has been misset, then it will look on the altitude tape that the ground is where you expect it to be relative to where you think you are in the sky. But the reality is you could be much much closer to the ground. So to give an example, in the 787 for one of the approaches we switched off the motion, and then deliberately let the simulator continue to follow the flight guidance all the way to the ground. And the point at which the simulator froze the ground impact point, the barometric altitude tape showed six hundred and ninety feet and the radar altimeters showed zero. Therefore, the barometric altimeter was still showing three hundred feet above the ground. So this is the problem. Your barometric altitude indications all are showing you everything's fine. But the radar altimeter is saying no, it's game over.

Nathan Lovett: 11:26

Now we're going to look at this from an air traffic controllers perspective. Kim Giles is a controller with NATS, the UK's leading provider of air traffic control services. Kim, in your experience, what are the most likely QNH read back errors?

Kim Giles (NATS): 11:39

So from personal experience, I found that twos and threes are the most likely ones to be read back incorrectly or heard incorrectly. If it's nine-nine-two, nine-nine-three, that's when I find I'm more likely to have to query with the crew either because it sounds to me like they said two when I've said three or vice versa, that's the most likely one to be queried by the crew is if it's got a two or three.

Nathan Lovett: 12:04

How do ATC systems ensure that the correct unit is displayed to the controller and passed to the pilot?

Kim Giles (NATS): 12:10

So in TC, we have a system called NSIS, which is the New Swanwick Information System. It's a screen that sits off to the side of us and it displays a wealth of information both about the airport, so for example, the wind, the current weather, the latest ATIS information as well as the departures that we'll have for the approach controllers. On there is the QNH. If the QNH changes, it flashes. And it also has an asterix to indicate that it's a new QNH. We also have a system called ExCDS, which is for our electronic flight display. And where the QNH is shown, if it changes, it will highlight yellow to indicate that we need to pass it to the flight crews. And then we're supposed to only acknowledge this task driver as it's called once we've passed that QNH to the crews.

Nathan Lovett: 13:00

Human error was the biggest factor at play at Charles de Gaulle, where the wrong reading was read out to the pilots and in turn, he called it back wrong, and it wasn't picked up. Is this something that you've seen in your own career?

Kim Giles (NATS): 13:11

Yes, I've done it. I've given when I intended to give a turn right, I've given a turn left, the crew have read back the left turn. So that is the risk that if you give, if you give something you weren't intending to and they've read back exactly what you've said, you're not necessarily going to notice it, it's not going to jump out at you because the two things have matched. So I'm aware that it can happen. It's happened to me. And then the important thing is to fix it. You know, don't start blaming anyone on the RT, don't start scolding them. Just fix it. Keep that calm demeanor, that ability to change your plan quickly and correctly and accurately. And just be aware that we are human. We can make mistakes, pilots can make mistakes. And the most important thing is how you respond to that.

Nathan Lovett: 14:04

Thanks Kim. You work at NATS which has developed a barometric pressure setting advisory tool. Please can you tell us about that?

Kim Giles (NATS): 14:11

So we refer to that as the BAT, which is B-A-T. And what that is, is it highlights to us if there's a discrepancy between the QNH as it is and the QNH as selected by the flight crew. And what it will do is it will start flashing yellow to draw our attention to it and to indicate to us that we need to confirm with the flight crew that they're flying on the right barometric pressure setting.

Nathan Lovett: 14:35

Thanks, Kim, and returning to you, Glenn in your role as the CAA's Head of Flight Operations. Do you see any weaknesses in the current aviation system as far as this risk is concerned?

Glenn Bradley: 14:44

There's a few different levels to this. So I mean, obviously with any kind of aviation risk, there's different aspects to it. The first one tends to be the people in the loop. So it's the people in the system. So from that perspective, the weakness there is crews not managing risks effectively by not understanding the risks that they're facing. So if you take it granularly, they'll follow the company's standard operating procedures but the procedures are written to provide a barrier, but they don't give you any specific focus at a particular point about what the risk is. So for example with an RNP approach flown with Baro VNAV guidance, the risk is obviously the incorrect altimeter setting, which means you'd have an incorrect vertical glide path, with limited protections in place on the aircraft to tell you that something has gone wrong. Therefore, if the crews know that that is one of the greatest risks with this approach, they will approach it through their threat and error management in an appropriate manner, making sure that they get the correct QNH, they've set the correct QNH and they've crosschecked it in the aircraft, knowing that that is probably one of the greater risks of this type of approach. The second part to it is around the procedures that they're following. And this is important that operators provide procedures that are appropriate for their type of operation for their aircraft, but also to help manage the risks that their SMS are flagging up. And it's very easy to write lots of procedures and put more and more layers on there. But actually, when, when it comes to writing procedures, they need to be easy to be able to achieve, they need to be able to address the threat that they're designed to trap. And also they need to be difficult to circumvent, i.e. it is easier to do the procedure than it is to do something else such that crews will, even if they don't recognize the threat if they do the company procedures correctly, the threat will be mitigated. Finally, the other weakness in the system, especially with this event, with some procedures, approaches, for example, in ILS, there's various protections provided by the EGPWS, which is enhanced ground proximity warning system. Obviously, when you're trying to land on a runway, there has to be a limit to what those protections can be provided. And without a vertical guidance in the system, the system won't tell you, EGPWS won't tell you that you got too close to the ground, because you're following the incorrect glide path. Now there is work going on in this space to provide better technological solutions. But at the moment, there is a limitation on that. And I think people understanding that it doesn't provide everything. Also in that of course, most aircraft, virtually all aircraft now will have a radio altimeter, a radio altimeter call out whilst it's not necessarily part of the procedure, if that comes in an appropriate time, it could act as a trigger for people to understand that something is going on. Now its a difficult one, because it isn't something that's monitored regularly on these sort of approaches. So it's a bit of an ask, but if something strange happens, the radio altimeter call out, especially higher up in the approach, then it should, you know create that kind of think's bubble. But that is the right hand side of the bowtie, something has had to go wrong from that point of view and the focus is on and what we're trying to get across is we need to get as much in place upstream as possible. So people start the approach with the correct QNH and the procedures in place that its correct and it's checked, such that the approach can commence safely.

And Alex with your experience, both as a captain and as a flight training inspector, what do you think can be done to enhance flight safety?

Alex Rattray: 18:02

I think the way they can do that is in large measure is communications and training. So what I would suggest is that as a first stage that operators know about the Safety Notice and what's in it, and then you know, listening to say this podcast, and also watching the video we've done as well. And then I would say making sure that threat and error management is optimized, such that when flying these approaches, really key threat and error management is demonstrated by the crew. And again, if they do that properly, and realize there is a threat of flying into ground without a pull up warning, I know it sounds awful but actually if you know that and why it's the case you can completely mitigate that and trap that. The problem is if you don't know the problem exists, and that that's why I always feared this may very well result in a hull loss somewhere in the world at some point, simply because, and if it happens, it'll be because the crew don't know the error exists. And again, one of the key things to that is crew believing that on a Baro VNAV approach checking altitude for range will detect a vertical error and it doesn't.

Nathan Lovett: 19:01

Thanks to Glenn Bradley, Alex Rattray and Tim Watkins at the UK CAA and to Kim Giles at NATS for speaking with us. The CAA has published a Safety Notice and a short video about this risk and you can find links to both of those in the episode notes. There's also a link to more information about the A320 incident at Paris Charles de Gaulle. That's it for this episode. But as always, if you have any feedback or suggestions on areas that you'd like us to cover in future episodes, you can contact us at safetyfilespodcast@caa.co.uk Thanks for listening.

Voiceover: 19:34

Thanks for listening. This is the CAA Safety Files