CAA Occurrence Report 00-2518

AIRCRAFT SERIOUS INCIDENT REPORT OCCURRENCE NUMBER 00/2518 B767-319ER ZK-NCJ
NZ 60 ERRONEOUS GLIDESLOPE CAPTURE, AUTOCOUPLED APPROACH, AND GO-AROUND

FALEOLO AIRPORT, SAMOA 29 JULY 2000
CAA Occurrence No. 00/2518
Intentionally blank
Page 2 of 203
CAA of NZ
31 August 2002
TABLE OF CONTENTS
ABBREVIATIONS AND DEFINITIONS.................................................................... 10 INTRODUCTION ...................................................................................................... 13 SYNOPSIS ............................................................................................................... 14 1. 1.1 FACTUAL INFORMATION .............................................................................. 17 History of the Flight................................................................................................. 17
Preflight / Takeoff / Cruise ............................................................................................................. 17 Descent Into Faleolo....................................................................................................................... 19 ILS Approach ................................................................................................................................. 19 Go Around ...................................................................................................................................... 20 Pilot Flying: ...............................................................................................................................20 Pilot Not Flying: ........................................................................................................................21 Supplementary Pilot:..................................................................................................................21 Missed Approach............................................................................................................................ 22 Post Flight....................................................................................................................................... 23 Post Incident ................................................................................................................................... 23 Incident Location............................................................................................................................ 23 1.1.1 1.1.2 1.1.3 1.1.4 1.1.4.1 1.1.4.2 1.1.4.3 1.1.5 1.1.6 1.1.7 1.1.8
1.2 1.3 1.4 1.5

1.5.1 1.5.2 1.5.3
Injuries to Persons ................................................................................................... 23 Damage to Aircraft .................................................................................................. 24 Other Damage .......................................................................................................... 24 Personnel Information ............................................................................................. 24
Experience and Duty History (PF) ................................................................................................. 24 Experience and Duty History (PNF)............................................................................................... 25 Experience and Duty History (SP) ................................................................................................. 26
1.6
Aircraft Information................................................................................................ 27
Aircraft Weight and Balance .......................................................................................................... 28 Flap Placard Speeds (VFE)............................................................................................................. 28 Configuration During an Autocoupled ILS Approach.................................................................... 29 B767 Low Drag Approach (Air New Zealand Procedure) ............................................................. 30 B767 Delayed Flap Approach (FCTM) .....................................................................................30 Flight Deck Panel Layout ............................................................................................................... 31 Flight Instrument Panels ................................................................................................................. 31 B767 Electronic Flight Instrumentation Displays........................................................................... 32 EFI Symbol Generator ...............................................................................................................32 Electronic Attitude Director Indicator .......................................................................................32 Electronic Horizontal Situation Indicator ..................................................................................33 Radio Distance Magnetic Indicator............................................................................................35 Standby Attitude Indicator .........................................................................................................35
1.6.1 1.6.2 1.6.3 1.6.4 1.6.4.1 1.6.5 1.6.6 1.6.7 1.6.7.1 1.6.7.2 1.6.7.3 1.6.7.4 1.6.7.5
31 August 2002
CAA of NZ
Page 3 of 203

1.6.8 VHF Navigation ............................................................................................................................. 36 1.6.8.1 ILS .............................................................................................................................................36 1.6.8.2 VOR...........................................................................................................................................36 1.6.8.3 DME Systems ............................................................................................................................37 1.6.9 B767 Flight Management System .................................................................................................. 38 1.6.9.1 Flight Management Computer ...................................................................................................38 1.6.10 B767 Autoflight System ................................................................................................................. 38 1.6.10.1 Autopilot Flight Director System...............................................................................................39 1.6.10.2 Autoland Status Annunciator .....................................................................................................41 1.6.11 Autopilot System Crosscheck......................................................................................................... 41 1.6.12 B767 Flight Instrument and Autoflight System Failure Displays................................................... 42 1.6.13 B767 EFIS Configuration During an ILS Approach ...................................................................... 43 1.6.14 Instrument Landing System............................................................................................................ 44 1.6.14.1 ILS-700A Receiver ....................................................................................................................44 1.6.15 Auto Flight Pitch Control Modes ................................................................................................... 46 1.6.16 B767 FMC Arrival ......................................................................................................................... 47 1.6.16.1 VNAV Vertical Path Deviation Indicator ..................................................................................48 1.6.17 B767 Autopilot Coupled Approach (Autoland).............................................................................. 50 1.6.18 Ground Proximity Warning System ............................................................................................... 51
1.7 1.8
Meteorological Information .................................................................................... 52 Aids to Navigation.................................................................................................... 52
1.8.1 NOTAMs........................................................................................................................................ 52 1.8.2 Faleolo STAR................................................................................................................................. 53 1.8.3 ILS Approach Runway 08 .............................................................................................................. 54 1.8.4 ILS Ground Facility........................................................................................................................ 55 1.8.5 ILS Identification............................................................................................................................ 57 1.8.6 Null Reference Glideslope Beam Characteristics........................................................................... 57 1.8.7 CSB Transmission .......................................................................................................................... 58 1.8.8 SBO Transmission.......................................................................................................................... 58 1.8.9 Difference in Depth of Modulation (DDM) ................................................................................... 58 1.8.10 Equipment (Field) Monitoring........................................................................................................ 59 1.8.10.1 RF Monitoring ...........................................................................................................................59 1.8.10.2 ModSum Monitoring .................................................................................................................59 1.8.10.3 Width Monitoring ......................................................................................................................59 1.8.10.4 Course Monitoring .....................................................................................................................59 1.8.11 Status Monitors / Tower Displays .................................................................................................. 60 1.8.12 ATS Facility Requirements ............................................................................................................ 61 1.8.13 ILS Specification ............................................................................................................................ 62 1.8.13.1 ILS Operating and Maintenance Instructions.............................................................................64 1.8.13.2 Deviations From ILS Specifications ..........................................................................................66 1.8.13.3 Limitations on Certificate Holder ..............................................................................................67 1.8.13.4 ILS Integrity and Continuity of Service.....................................................................................67 1.8.14 Classification of ILS Installations .................................................................................................. 69 1.8.15 Equipment Status at Faleolo ........................................................................................................... 69 1.8.16 Ergonomics of the equipment at Faleolo ........................................................................................ 70
1.9 1.10 1.11

1.11.1 1.11.2
Communications....................................................................................................... 70 Aerodrome Information .......................................................................................... 71 Flight Recorders ....................................................................................................... 74

Flight Data Recorder ...................................................................................................................... 74 Cockpit Voice Recorder ................................................................................................................. 77
1.12
Wreckage and Impact Information........................................................................ 77
Page 4 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.13

1.13.1 1.13.2 1.13.3
Medical and Pathological Information .................................................................. 77

Medical Certificates........................................................................................................................ 77 Fatigue ............................................................................................................................................ 77 Other Relevant Physiological Information ..................................................................................... 77
1.14 1.15 1.16
Fire............................................................................................................................. 78 Survival Aspects ....................................................................................................... 78 Tests and Research................................................................................................... 78
1.16.1 Proving Flight One ......................................................................................................................... 78 1.16.1.1 First Approach Flap 1, 200 KIAS ...........................................................................................79 1.16.1.2 Second Approach Flap 20 165 KIAS......................................................................................80 1.16.1.3 Third Approach Flaps Up 240 KIAS ......................................................................................81 1.16.1.4 Fourth Approach Flap 5 180 KIAS.........................................................................................82 1.16.1.5 Fifth Approach Flap 20 160 KIAS..........................................................................................83 1.16.2 Proving Flight Two......................................................................................................................... 85 1.16.2.1 First Approach Flap 1, 220 KIAS, Fly Down DDM (0.007) ..................................................86 1.16.2.2 Second Approach Flap 1, 220 KIAS, Fly Down DDM (0.0016) ............................................87 1.16.2.3 Third Approach Flap 1, 220 KIAS, Fly Up DDM (-0.0016) ..................................................88 1.16.2.4 Fourth Approach Flap 1, 220 KIAS, Fly Up DDM (Auckland normal DDM) ....................89 1.16.2.5 Fifth Approach Flap 1, 220 KIAS, Localizer and Glideslope CSB Only ...............................90 1.16.2.6 Sixth Approach Flap 1, 220 KIAS, Localizer CSB Only........................................................91 1.16.2.7 Seventh Approach Flap 1, 220 KIAS, Normal Glideslope and Localizer Transmission ........92 1.16.2.8 Eighth Approach Flap 1, 220 KIAS, Normal Glideslope and Localizer Transmission ..........93 1.16.3 Simulator Detail.............................................................................................................................. 93
1.17
1.17.1 1.17.2 1.17.3 1.17.4
Organisational and Management Information ..................................................... 94

Airline Management System .......................................................................................................... 94 Air New Zealand Safety Programme.............................................................................................. 94 Incident Reporting Policy............................................................................................................... 95 Samoa Airport Authority ................................................................................................................ 96
1.18
Additional Information............................................................................................ 97
1.18.1 Air New Zealand Pilot Selection and Training............................................................................... 97 1.18.2 Crew Resource Management Programme ...................................................................................... 97 1.18.3 Operational Documentation............................................................................................................ 98 1.18.3.1 B767 Operations Manuals..........................................................................................................98 1.18.3.2 Standard Operating Procedures..................................................................................................99 1.18.3.3 B767 Flight Crew Training Manual.........................................................................................109 1.18.3.4 Route Guide .............................................................................................................................109 1.18.4 Airfield Categorisation ................................................................................................................. 110 1.18.5 Approach Plates............................................................................................................................ 111 1.18.5.1 Jeppesen Sanderson STAR and Approach Plate for Runway 08 at Faleolo ............................111 1.18.6 Crew Personal Preparation ........................................................................................................... 112
31 August 2002
CAA of NZ
Page 5 of 203
2. 2.1 2.2
ANALYSIS ..................................................................................................... 113 Introduction............................................................................................................ 113 Operational Factors ............................................................................................... 113

Preflight / Takeoff / Cruise .......................................................................................................... 113 Descent Into Faleolo..................................................................................................................... 114 ILS Approach ............................................................................................................................... 115 Go Around .................................................................................................................................... 118 Missed Approach.......................................................................................................................... 119 Post Flight..................................................................................................................................... 119 Approach Aid Hierarchy .............................................................................................................. 120 Glideslope Altitude Check............................................................................................................ 120 Possible Glideslope Intercept Scenarios ....................................................................................... 125
2.2.1 2.2.2 2.2.3 2.2.4 2.2.5 2.2.6 2.2.7 2.2.8 2.2.9
2.3
Aircraft Systems ..................................................................................................... 128

Instrumentation and On-board ILS Equipment............................................................................ 128 Autoflight System......................................................................................................................... 130 Use of the VNAV Path Vertical Deviation Indicator ................................................................... 131 Ground Proximity Warning System ............................................................................................. 132 Enhanced Ground Proximity Warning System (EGPWS) .......................................................133
2.3.1 2.3.2 2.3.3 2.3.4 2.3.4.1
2.4
2.4.1 2.4.2
NOTAMS ................................................................................................................ 134

NOTAM Distribution and Receipt ............................................................................................... 135 NOTAM Terminology.................................................................................................................. 135
2.5
2.5.1 2.5.2 2.5.3
ILS Design and Maintenance ................................................................................ 136

ILS Required Components ........................................................................................................... 136 ILS Identification.......................................................................................................................... 137 Inadvertent Radiation of Erroneous Glideslope Signals ............................................................... 138
2.6 2.7
2.7.1 2.7.2 2.7.3 2.7.4
Approach Plates ..................................................................................................... 139 Standard Operating Procedures........................................................................... 140

Flight Deck Management ............................................................................................................. 140 Supplementary Pilot Duties and Responsibilities ......................................................................... 140 Automation Philosophy ................................................................................................................ 140 FMC Arrival ................................................................................................................................. 140
2.8
2.8.1 2.8.2
Proving Flights ....................................................................................................... 141

Proving Flight One ....................................................................................................................... 141 Proving Flight Two....................................................................................................................... 142
2.9
Organisational Factors .......................................................................................... 142

Pilot Training................................................................................................................................ 142 Safety System ............................................................................................................................... 143 Incident Reporting ...................................................................................................................143 Flight Operations Quality Assurance Data ..............................................................................144 Documentation:- Operations Manuals .......................................................................................... 144 Airport Categorisation .................................................................................................................. 145 Analysis Summary........................................................................................................................ 146
2.9.1 2.9.2 2.9.2.1 2.9.2.2 2.9.3 2.9.4 2.9.5
Page 6 of 203
CAA of NZ
31 August 2002
3.
3.1 3.2 3.3 3.4
FINDINGS ...................................................................................................... 151

Crew ............................................................................................................................................. 151 Aircraft ......................................................................................................................................... 151 Ground equipment ........................................................................................................................ 152 Event............................................................................................................................................. 153
4.
4.1 4.2 4.3 4.4
RECOMMENDATIONS.................................................................................. 155
Boeing .......................................................................................................................................... 155 Ministry of Transport of Samoa ................................................................................................... 156 Samoa Airport Authority .............................................................................................................. 156 International Civil Aviation Organization (ICAO)...................................................................... 157
5.
5.1 5.2 5.3
SAFETY ACTIONS TAKEN OR AGREED .................................................... 163

Air New Zealand .......................................................................................................................... 163 International Civil Aviation Organization (ICAO)...................................................................... 163 Civil Aviation Authority of New Zealand .................................................................................... 164
APPENDIX 1 .......................................................................................................... 167

ICAO State Letter AN 7/5-01/52 ................................................................................................................... 167 Attachment A - Amendment 22 to Annex 6 Part II...................................................................................... 170 Attachment B - Amendment 27 to Annex 6 Part I ....................................................................................... 172
APPENDIX 2 .......................................................................................................... 177

Federal Aviation Authority (FAA) of the USA Glideslope Evaluation Report.............................................. 177
APPENDIX 3 .......................................................................................................... 191

Comments and Submissions by interested parties Air New Zealand ............................................................................................................................................ 191 Boeing ............................................................................................................................................................ 191 National Transportation Safety Board (NTSB) of the USA........................................................................... 192 Federal Aviation Administration (FAA) of the USA ..................................................................................... 193 Ministry of Transport of Samoa ..................................................................................................................... 193 Airways Corporation of New Zealand (ILS Ground equipment technical advisor) ....................................... 193
APPENDIX 4 .......................................................................................................... 195

Pilot Flying Feedback and Subsequent Analysis Using the CLEAR Model ............................................... 195
APPENDIX 5 .......................................................................................................... 201

The Context of Decision Making in NZ 60 and Systemic Failures in Relation to ILS Glideslope Transmission Systems.............................................................................. 201 Systemic Failures ........................................................................................................................................... 202
REPORT APPROVAL AND RELEASE ................................................................. 203
31 August 2002
CAA of NZ
Page 7 of 203
Intentionally blank
Page 8 of 203
CAA of NZ
31 August 2002
Table of Illustrations
Configuration During an Autocoupled ILS Approach .......................................................................................... 29 Air New Zealand Low Drag Approach Profile ..................................................................................................... 30 Flight Deck Panel Layout and Numbering ........................................................................................................... 31 Captain's and First Officer's Instrument Panels ................................................................................................... 31 Electronic Attitude Director Indicator.................................................................................................................. 32 Electronic Horizontal Situation Indicator - MAP Mode Display.......................................................................... 33 Electronic Horizontal Situation Indicator EXP ILS Mode.................................................................................... 34 EHSI Control Panel .............................................................................................................................................. 34 Radio Distance Magnetic Indicator ...................................................................................................................... 35 Standby Attitude Indicator .................................................................................................................................... 35 ILS Control Panel ................................................................................................................................................. 36 VOR/DME Control Panel ..................................................................................................................................... 36 Audio Selector Panel............................................................................................................................................. 37 Autopilot Flight Director System Schematic......................................................................................................... 39 Mode Control Panel.............................................................................................................................................. 40 EHSI Flight Mode Annunciations ......................................................................................................................... 40 Autoland Status Annunciator ................................................................................................................................ 41 EFIS Failure Displays .......................................................................................................................................... 42 EHSI VNAV Path Vertical Pointer........................................................................................................................ 48 FMC CDU Progress Page 2 ................................................................................................................................. 49 Jeppesen Sanderson STAR Chart - Faleolo International Arrivals ...................................................................... 53 Jeppesen Sanderson Chart - VOR DME ILS DME Runway 08 Faleolo ............................................................... 54 Schematic of glide path equipment ....................................................................................................................... 56 Glide path transmitter and monitor antennas ....................................................................................................... 56 ILS Glide Path Null Reference Antenna Vertical Radiation Pattern .................................................................... 58 Tower Remote Control and Indicator Panel (Typical).......................................................................................... 60 Tower Remote Status Indicator Panel at Faleolo ................................................................................................. 60 ILS remote control at FaleoloSituated at the base of the tower ........................................................................ 61 Glide Path monitors and control panel in the GP equipment shelter on the field at Faleolo ............................... 64 Close up of control panel ...................................................................................................................................... 65 Close up of one monitor panel .............................................................................................................................. 65 Map of Samoa ....................................................................................................................................................... 71 Jeppesen Sanderson Airport Chart - Faleolo ....................................................................................................... 72 View of Faleolo International Airport Looking West............................................................................................ 73 NZ 60 Profile - First Approach Apia .................................................................................................................... 75 Flight Path of NZ 60 ............................................................................................................................................. 76 Proving Flight One Profile One......................................................................................................................... 79 Proving Flight One Profile Two ........................................................................................................................ 80 Proving Flight One Profile Three ...................................................................................................................... 81 Proving Flight One Profile Four ....................................................................................................................... 82 Proving Flight One Profile Five ........................................................................................................................ 83 Proving Flight Two Profile One ........................................................................................................................ 86 Proving Flight Two Profile Two ........................................................................................................................ 87 Proving Flight Two Profile Three...................................................................................................................... 88 Proving Flight Two Profile Four ....................................................................................................................... 89 Proving Flight Two Profile Five ........................................................................................................................ 90 Proving Flight Two Profile Six .......................................................................................................................... 91 Proving Flight Two Profile Seven...................................................................................................................... 92 Proving Flight Two Profile Eight ...................................................................................................................... 93 Evolution of Transport Aircraft Automation (ICAO Circular 234-AN/142) ....................................................... 130 NZ 60 Profile Depicting Computed EGPWS Warning Altitude .......................................................................... 133
31 August 2002
CAA of NZ
Page 9 of 203
Abbreviations and Definitions

AFIS Analogue Flight Instrument System (generic term used by Air New Zealand to differentiate between classic and glass flight decks) Autopilot Flight Director System Above Ground Level Autopilot Autoflight System Approach Mode Aviation Quality Database Aeronautical Radio Incorporated Autoland Status Annunciator Autothrottle Air Traffic Control Civil Aviation Authority of New Zealand Captain Category Crew Resource Management Control Display Unit Controlled Flight Into Terrain Carrier plus Side Bands Cockpit Voice Recorder Difference in Depth of Modulation Distance Measuring Equipment Electronic Attitude Indicator Electronic Flight Instrument Electronic Flight Instrument System Enhanced Ground Proximity Warning System Electronic Horizontal Situation Indicator Estimated Time of Arrival Estimated Time of Departure Faleolo VOR Final Approach Fix Final Approach Point Flight Control Computer Flight Crew Training Manual Flight Director Flight Data Recorder Flight Management Computer Flight Management Computer System First Officer Flight Operations Quality Assurance Ground Proximity Warning System Glide path (Normally used when reference is made to the ground transmitter) Glideslope (Normally used when reference is made to the aircraft instrumentation, receiver, or crew procedures) HF Hz ILS ILS DME ILS/DME IRS ISA ISD KIAS LNAV LOC LOSA MAC MCP METAR MLS MTBF MTBO NOTAM NZCAR OM PA PF PIC PNF QRH RA RDMI RNAV ROC ROD SA SAI SBO S/O SOP SP STAR STD TAWS TOC TOD VNAV Volmet Human Factors Hertz Instrument Landing System ILS DME only ILS plus ILS DME Inertial Reference System International Standard Atmosphere Inflight Service Director Knots Indicated Airspeed FMC Lateral Navigation mode Localizer Line Orientated Safety Audit Mean Aerodynamic Chord Mode Control Panel Aviation Routine Weather Report Microwave Landing System Mean Time Between Failures Mean Time Between Outages Notice to Airmen New Zealand Civil Aviation Rule Outer Marker Pressure Altitude Pilot Flying Pilot in Command Pilot Not Flying Quick Reference Handbook Radio Altitude Radio Distance Magnetic Indicator Area Navigation Rate of Climb Rate of Descent Situational Awareness Standby Attitude Indicator Side Band Only Second Officer Standard Operating Procedure Supplementary Pilot (extra type-rated crew member rostered for duty) Standard Arrival Scheduled Time of Departure Terrain Awareness Warning System Top of Climb Top of Descent FMC Vertical Navigation mode Routine broadcast containing, as appropriate, current aerodrome weather reports, aerodrome forecasts and SIGMET messages for aircraft in flight VHF Omni-Range VOR DME only VOR plus VOR DME MCP Vertical Speed mode
AFDS AGL A/P APP AQD ARINC ASA A/T ATC CAANZ Capt Cat CRM CDU CFIT CSB CVR DDM DME EADI EFI EFIS EGPWS EHSI ETA ETD FA FAF FAP FCC FCTM FD FDR FMC FMCS F/O FOQA GPWS GP G/S
VOR VOR DME VOR/DME V/S
Page 10 of 203
CAA of NZ
31 August 2002
Aircraft Incident Report

Occurrence Number - Air New Zealand 00/2518
Aircraft type, serial number and registration: Number and type of engines: Year of manufacture: Date and time of occurrence: Location: B767-319ER, s/n 26915, ZK-NCJ Two - CF6-80C2B6 1995 29 July 2000, 0950 hours UTC (approximate) Approximately 10 nm West of runway 08 Faleolo FAP Latitude: FAP Longitude: Type of flight: Persons on board: S13 49.7' W172 08.8'
Regular Scheduled International Air Transport Operation Flight Crew: 3 Cabin Crew: 8 Passengers: 165 Crew: Passengers: Nil Air Transport Pilot Licence (Aeroplane) 49 years 15,067.0 hours, 4,290.4 on type Mr. Michael A. Carrelli MRAeS Nil Nil
Injuries: Nature of damage: Pilot-in-commands licence Pilot-in-commands age Pilot-in-commands total flying experience: Investigator in Charge
31 August 2002
CAA of NZ
Page 11 of 203
Intentionally blank
Page 12 of 203
CAA of NZ
31 August 2002
Introduction
The majority of this investigation has been carried out by Air New Zealand in accordance with the New Zealand Civil Aviation Rule Part 12, which requires the Operator to investigate its own incidents. Air New Zealand has kept the CAA in the loop through out the duration of the investigation, with each party assisting the other where necessary. The crew and the ground technician were very co-operative in assisting the investigation and instrumental in developing a clear picture of events. The CAA conducted an on site investigation in Samoa with the assistance of the Samoa Airport Authority and the Airways Corporation of New Zealand, to explore the ramifications of the equipment failure and subsequent actions by the technician. The Transport Accident Investigation Commission declined to investigate this event. This investigation has been conducted with particular reference to the general principles contained in ICAO Circular 240-AN/144, Human Factors Digest No 7 Investigation of Human Factors in Accidents and Incidents, and ICAO Circular 247-AN/148, Human Factors Digest No 10 Human Factors, Management and Organisation. The common elements in air safety occurrences are considered to be: Latent conditions arising mainly in the managerial sphere. Latent conditions are present in the system long before the event and are most likely bred by decision-makers, regulators, designers and other people and organisations far removed from the event; Local factors, including such things as environmental conditions, equipment deficiencies and inadequate procedures; Active failures having a direct adverse effect; and Inadequate or absent defences and consequent failures to identify and protect against technical and human failures arising from the three previous elements.
While acknowledging the role that operational personnel play in the incidents, the analysis looks for deficiencies that can be eliminated and system defences that can be strengthened. In general terms, there are three levels of action that may be taken when mitigating hazards: Level 1 - eliminate the hazard. These are the safest decisions but may not be the most efficient. Level 2 - accept the hazard and adjust the system to tolerate human error and reduce the possibility of an occurrence. Level 3 - accept that the hazard can neither be eliminated nor controlled and train operational personnel to be aware of the potential hazard.
Third level actions should not be taken in preference to first or second level actions, since it is impossible to anticipate all future kinds of human error. The system should be designed to tolerate the entire range of normal human behaviour; that is, it must be error tolerant.
31 August 2002
CAA of NZ
Page 13 of 203
Synopsis
Early on the morning of Sunday 30th July 2000 the Air New Zealand Duty Line Manager was notified of a suspected false glideslope capture experienced by Air New Zealand flight NZ 60 during approach to Faleolo International Airport, Apia, Western Samoa. NZ 60 had been cleared to Faleolo via a FALE arrival for an ILS runway 08. The approach was planned to be an autocoupled ILS, using a low drag approach profile. During descent the aircraft was established on the 15 nm arc as per the STAR procedure. Approaching the localizer course at 2800 ft LOC was armed, and the autoflight system subsequently captured the localizer inbound course. During the turn on to the localizer the aircraft was decelerated and configured to Flap 1. APP was armed after localizer capture and the autoflight system captured the glideslope shortly after. The crew reported a rapid energy increase, with speed increasing to near the flap 5 limit speed. To assist with energy control, while continuing to configure the aircraft for landing, the crew used speedbrakes and landing gear. The flight instrumentation glideslope deviation indicators displayed on glideslope throughout the approach. Shortly after landing flap selection the PF (Pilot Flying) noted an anomaly in DME versus altitude. Around the same time the PNF (Pilot Not Flying), while trying to establish visual contact with the airfield and runway, became aware that visual cues did not correspond with what was expected. The SP (Supplementary Pilot) also became aware of an anomaly in aircraft position at approximately the same time as the two other crew members. A go-around was commanded, initially climbing straight ahead followed by a climbing left turn, to pick up the 340o radial FA VOR to rejoin the 12 nm arc for a subsequent approach. This second approach was flown with careful attention to distance and altitude, using the published DME recommended altitudes as per the LOC (GS out) table on the approach plate for glidepath management. The glideslope deviation indicator also indicated on glideslope throughout the second approach. The glideslope indications were ignored and the approach continued to a successful landing. After reviewing their fitness for duty following the event, the crew elected to continue the tour of duty and return to Auckland. An autocoupled approach back into Auckland, closely monitored by the FMC profile, was normal. The Flight Data Recorder was removed from the aircraft, and Air Traffic Control at Faleolo was requested to issue a NOTAM stating that the glideslope was unserviceable. Subsequent analysis of the FDR information established that the aircraft had descended on a glide path of approximately 3.5 to a point approximately 5 miles short of the runway with normal localizer and glideslope indications displayed on the flight instrumentation. It was later established that the ILS glideslope transmitter had inadvertently been left in control (monitor) bypass mode, with the unserviceable transmitter selected. In the bypass mode, the glide path transmitter executive monitor was unable to shut down the faulty transmitter or to transfer to the serviceable transmitter. The result was the radiation of invalid glideslope information consisting solely of the carrier plus side bands (CSB) signal component. The side bands only (SBO) signal component was missing from the glideslope transmission.
Page 14 of 203 CAA of NZ 31 August 2002
CAA Occurrence No. 00/2518 Two proving flights were subsequently conducted at Auckland using runway 05, to document the effects on the aircraft.
The distinction between a false glideslope and an erroneous glideslope must be appreciated: A false glideslope is a recognised phenomenon and is a normal by-product of the ILS transmission. A false glideslope provides a distinct, but incorrect, path to the origin of the glideslope. An erroneous glideslope, however, does not provide a defined path. Whilst continuously indicating to the crew that the aircraft is on slope irrespective of its position in space, with no warning flags visible, very little or no guidance is being given to the aircraft. A crew using an erroneous glideslope is utilizing a system that has an error present, for example; a glideslope transmission that has a component of the signal missing or the components being radiated in the incorrect phase relationship. An erroneous transmission may occur intentionally during maintenance or testing, or inadvertently due to maintenance error.
Consider the case of an ILS with marker beacons only. The ICAO recommended position of the outer marker is 3.9 nm from the threshold of the runway. Without a DME associated with the ILS there may be no other accurate yet simple way to check distance versus height before the outer marker. If terrain had been a factor during this event and a marker type ILS was in use, the first available checkpoint may have been too late to prevent a CFIT event.
NOTE: The localizer is also capable of radiating both false and erroneous transmissions.
There does not appear to be a general awareness, throughout the industry, regarding the phenomenon of erroneous transmissions. It is essential that crews, air traffic controllers and navigation aid maintenance technicians are educated regarding this trap. It is also essential to understand the significance of the tower remote status indicator to the system and be aware that at some facilities certain selections of the transmitters and monitors during maintenance may not give indications to the air traffic controllers.
Whilst reading this report, bear in mind the following important points: The ability of navigation aids, in particular the ILS, to display apparently valid indications with no associated warnings to the flight crew The human factors implications for flight crew regarding the lack of an ident on the glideslope signal. That is, a valid ILS ident and absence of warning flags does not guarantee that the glideslope signal is correct. Consider that a localizer approach relies on the same ident and indications (usually minus the glideslope indication) as that used for a full ILS approach. During a localizer approach however, it is possible that a glideslope indication may be presented to the crew
31 August 2002
CAA of NZ
Page 15 of 203
CAA Occurrence No. 00/2518 The Air Traffic Controllers clearing an aircraft to use a navigation aid for approach, landing or takeoff must be the primary notification point for any abnormalities. A technical centre may only be the secondary point of notification The importance of designing and installing the remote status indicator warnings in the tower or approach control centre in such a way that a warning is given any time the control (monitor) bypass switch is activated by the maintenance personnel The importance of clear and concise communication between the flight crew, air traffic controller and the ground navigation aid maintenance personnel The need to clearly understand and adhere to the standards and intent of ICAO Annex 10 Volume 1 (Radio Navigation Aids).
Page 16 of 203
CAA of NZ
31 August 2002
1. Factual Information
1.1 History of the Flight
At 0618 UTC (1818 NZST) on Saturday 29th July, ZK-NCJ departed Auckland for Faleolo, Western Samoa (NSFA). The flight was scheduled to arrive at Faleolo at 1000 UTC (2300 local). The aircraft, a B767-319ER, was being operated by Air New Zealand Limited as Flight NZ 60 with a scheduled departure time of 0615 UTC, on a regular scheduled air transport flight. The duty assigned to the crew members was to operate NZAA - NSFA, with a four hour layover scheduled for Faleolo, then return NSFA NZAA as flight NZ 61, with a scheduled arrival time back at Auckland of 1755 UTC. The duty required 3 pilots for the flight deck crew complement due to it being a 14 hr 10 minute hour tour of duty, 3 hours 10 minutes in excess of a 2 pilot crew tour of duty.
1.1.1 Preflight / Takeoff / Cruise All assigned flight crew were at Flight Dispatch prior to the standard report time (STD minus one hour). The SP arrived earlier than the other two crew members. Once all crew were assembled the flight was planned and considered. The SP read the NOTAMs and highlighted the relevant ones. The flight was planned to tanker fuel and to land at close to maximum landing weight. Planned alternate was Rarotonga (NCRG). Crew duties were discussed and agreed, with the Captain assuming PF duties northbound and the SP to be PF southbound. The following NOTAMs affecting Faleolo were issued to the crew of NZ 60:
A0034/00 ILS/GP RWY 08 OPR WO SDBY TRANS A0036/00 WDI THR RWY 08 UNLIT A0038/00 DAILY 1800-0600 EXCEPT SUN (LCL) WORKS TO EXTEND THE EXISTING RUNWAY AND APRON TO THE EAST, WILL COMMENCE IN JUNE AND ARE SCHEDULED FOR COMPLETION DURING OCTOBER 2000. IT IS ANTICIPATED THAT SCHEDULED FLIGHTS WILL NOT BE AFFECTED BY THIS PHASE OF THE WORKS. HOWEVER NON-SCHEDULED FLIGHTS WILL BE ACCOMODATED IF A 12 HRS PN IS GIVEN. FOR EMERGENCY CASES, A MINIMUM OF 3HRS PN IS ESSENTIAL. A0044/00 DAILY 1800-0600 EXCEPT SUN LCL WIP IN EXTENDING THE TURNING NODE BY RWY 08 THRESHOLD. PILOTS ARE ADVISED TO EXERCISE CAUTION WHEN TURNING FOR T/OFF RWY 08. PERSONNEL AND EQUIPMENT TO VACATE FOR JET OPERATIONS. FOR LIGHT AIRCRAFT OPS: THRESHOLD RWY 08 DISPLACED BY 1000M
31 August 2002
CAA of NZ
Page 17 of 203

A0068/00 FREQ 113.9MHZ IDENT FA VOR OPR, BUT CAUTION ADZD DUE TO UNMONITORED STATUS A0070/00 APPROACH LIGHTING SYSTEM RWY 26 U/S DUE RWY EXTENSION WORKS A0083/00 REF NOTAM A0038/00. APRON EXTENSION WORKS TO THE EAST IN PROGRESS AND MARKED BY ORANGE MARKERS. EXER CTN WHEN TAXING FOR GATE 3 A0086/00 DME ASSOCIATED WITH ILS RWY 08 OPS BUT CTN CTN [sic] ADVISED DUE UNMONITORED STATUS A0092/00 ILS GP RWY 08 OPS BUT CTN ADZD DUE OPERATING IN AN UNMONITORED STATUS.
The unmonitored aids and their significance to the flight were discussed amongst the crew and with the flight dispatcher. The crew reported to the investigation that they did not consider they were under any time pressure prior to departure. NZ 60 was off blocks at 0618 UTC for an ETA at Faleolo of 1000 UTC. Rest arrangements were mutually agreed at TOC, 1st rest allocated to the PNF, the PF allocated 2nd rest, and the SP the 3rd rest. All crew had a meal during the flight. An update on destination and alternate weather was obtained from the Volmet during the cruise. As the destination weather was good, it was not noted on the Radio Log. The PNF and SP reviewed the Route Guide during cruise while the PF was at rest. The PF started organising the descent and approach after returning from rest. He pre-briefed himself for the VOR/DME approach to provide a back up to the ILS, due to the unmonitored and promulgated state of the ILS. He noted the different missed approach procedures between the VOR/DME and the ILS approaches and discussed the VOR DME glideslope/altitude relationship (FA DME x 300 minus 500ft). He briefed the approach with the PNF about 20 minutes prior to TOD, including selecting the 15 nm arc from FALE. The STAR plate depicts both a 12 nm and 15 nm arc for a FALE arrival. The 15 nm arc is preferred for category C and D aircraft. The SP returned to the flight deck 5 minutes prior to top of descent. The PF formally briefed him on the arrival, including the 15 nm arc and ILS 08 procedures. There was a discussion between the two regarding the height restriction on the arc. All three flight crew were on the flight deck for the descent and arrival into Faleolo.
NOTE: The crew planned for, briefed and were subsequently cleared for an ILS approach. The ILS was conducted as an autocoupled approach.
Page 18 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.1.2 Descent Into Faleolo The aircraft was cleared for a FALE arrival. A DME/DME update of the FMCs was achieved, using Faleolo (FA) VOR DME and Pago Pago (TUT) VOR DME, and an Arrival Integrity check completed as per Air New Zealand SOP. The aircraft joined the 15 nm arc at 240 KIAS. The SP stated to the investigation that he would have personally preferred the aircraft to be at 210 KIAS joining the arc, but he did not communicate this to the other crew members. The PF noted he saw the Southern coastline of Upolu Island on radar during the approach to the arc and that lights were visible on the Southern coast at this time. Faleolo lies on the Northern side of Upolu Island. The aircraft travelled through the arc to about 14 nm then regained the 15 nm arc. The SP queried this and received confirmation that the plan was for the 15 nm arc and not the 12 nm arc. The PNF and SP, in response to a question from the PF, confirmed the descent altitudes on the arc. The PF noted that the aircraft was within 300 ft of the VNAV profile from about halfway round the arc. The PF used a 1:60 calculation to determine distance to run on the arc and approach, which he verbalised with the crew. The aircraft was slowed to 220 KIAS at about 3500 ft while on the arc. Due to the unmonitored state of the navigation aids, the PF requested the SP to continuously monitor the ILS identification (ident) during the approach. The SP individually identified the ILS on each on-board receiver and then selected all three receivers, which he continued to monitor throughout the approach, except for a brief period while the aircraft was on the arc. The SP acknowledged that this procedure is not prescribed in company manuals, but felt it was warranted due to the promulgated state of the navigation aids. The PF also identified the ILS/DME while the aircraft was on the arc. The SP communicated with the company ground staff at Faleolo while the aircraft was on the arc, to advise an ETA of approximately 5 minutes. He deselected the ILS idents to accomplish this task and then re-selected the ILS idents. While the aircraft was on the arc, the PF was managing the aircraft path solely with reference to the on-board systems (heads down). It was a clear dark night, with no moon to assist with external vision.
1.1.3 ILS Approach Approaching the localizer, the PNF saw the runway lights. The SP did not sight the runway, due to his seating position. The PF used LNAV to turn the aircraft on to the inbound course and configured the aircraft to Flap 1 during the turn inbound. LOC was armed as it was observed to become active. The SP confirmed that the localizer was showing full-scale deflection prior to LOC arm. V/S was selected at this time to reduce the ROD, as the PF felt the aircraft was slightly low. A small amount of power was also added and LOC arming was confirmed. The PF reported that he was planning to intercept the glideslope at 2500 ft, 180 KIAS, Flap 5. The PF remained heads down at localizer capture. The PF commented to the investigation that everything seemed normal. Both the PNF and SP reported the glideslope deviation indicator as appearing 1 2 dots high after localizer capture.
31 August 2002
CAA of NZ
Page 19 of 203
CAA Occurrence No. 00/2518 APP was armed and the autoflight system almost immediately captured the glideslope. The PF reset the MCP altitude to missed approach altitude and confirmed the setting with the PNF. The PF stated that at this point (glideslope capture) he was uncomfortable with the G/S capture occurring while the aircraft was at 220 KIAS and Flap 1, when he had planned to have the aircraft at 180 KIAS, Flap 5. Individually the crew was surprised at the speed and rate of G/S capture. All crew reported that all ILS indications on the flight deck were normal. The PF stated that his primary concern was now to ensure the aircraft energy was brought under control to meet SOP Low Drag Approach requirements of landing gear selected down prior to 1500 ft AGL and landing flap selected prior to 1000 ft AGL. He used speedbrake to assist with Flap 5 extension and commanded that the gear be extended to help control the speed. At this stage he reported that he felt the high entry speed to the glideslope and the high aircraft weight, combined with a slight tailwind, were the likely reasons for the energy problems. There was no dissension from the PNF and SP regarding the use of speedbrake to control airspeed while configuring the aircraft. The PNF and SP agreed that they felt that the management of the flight path was appropriate. There was no questioning of the PFs requests for configuration changes and no hesitation in acting to the requests. The crew commented that the tonal inflexions of the calls and responses indicated there was no dissension as to what was occurring on the flight deck at this time. The PF requested confirmation of the Flap 25 limit speed, which the PNF and SP immediately provided to him. At about 1500 ft, with Flap 25 set, the PF felt that the aircraft was under control. The SP stated that he was happy once the gear was down, and with Flap 25 at 1500 ft he confirmed that the localizer and G/S were centred. All three crew agree that there had been no adjustments to the aircraft or flight path from ILS capture to 1500 ft, except for requests from the PF for configuration changes. Flap 30 was requested before 1000 ft and the Before Landing checks completed by approximately 900 ft.
NOTE: The aircraft annunciated LAND 3 at 1500 ft. This was not noted by the crew; however, the crew was not planning an autoland therefore there was no requirement to observe the Autoland Status Annunciator for this approach.
1.1.4 Go Around 1.1.4.1 Pilot Flying:
The PF reported that he looked up on completion of the Landing Checks and saw a mish-mash of lights but did not see the airfield runway lights. He considered that the possible reason for not sighting the runway was due to patches of cloud between the aircraft and the airfield. He looked back at the instrument panel. He recollects an 8 on one of the displays, and also recalls seeing a 6 on the FA DME but was unclear as to whether this was before or after the go-around was initiated. The other crew members report the PF saying something like the DME doesnt make sense. The PF reported being confused by the anomalies he was experiencing but he was aware that he had lost situational awareness arising from the conflicting information presented
CAA Occurrence No. 00/2518 by the correct localizer and G/S presentations and the inappropriate DME distance. The PF made the decision to go-around as a result of this conflict. When executing the go-around he reported that he made a conscious decision to disconnect the autopilot and fly the aircraft on the standby flight instruments, as he no longer trusted the information presented by the FMC, the EADI and the EHSI. He deliberately climbed initially straight ahead to mimic a GPWS escape manoeuvre; his priority being to ensure a maximum rate of climb away from whatever terrain was in the vicinity.
1.1.4.2
Pilot Not Flying:
The PNF reported that about this time he could not see the runway, but could see some lights. He expected to see the runway having already sighted it during the turn onto the localizer. He looked back inside the flight deck and checked the localizer and glideslope indications and saw that they were correct (centred with no flags). He looked outside again and saw terrain close to the right hand side of the aircraft and in the correct position (if the aircraft was on the localizer) but much higher than it should be. He made a comment at this time, reported by the SP as s*** those lights are close. He then looked back at the instrument panel and the radio altimeter going through 700-600 ft caught his eye. He called go around and moved his left hand to advance the thrust levers. He reported that the PF was already advancing the thrust levers.
1.1.4.3
Supplementary Pilot:
The SP reported that he looked up after the Before Landing Checklist was complete, expecting to sight the strobes (REILS) but only saw the dim glow of two red lights on the nose. He stated that he was confused by what he saw. He looked back inside to the DME, saw an 8 and did a distance height check which gave him 1900 ft (300 x FA DME minus 500 ft for on slope) but the aircraft was at 900 ft. He reported that he realised there was an error present but could not identify what it was. He did another DME check at 7 DME and calculated 1600 ft but saw that the aircraft was at about 700 ft. About this time the PNFs statement regarding the proximity of the lights prompted him to look out the PNFs side window, he also saw lights beside the aircraft. He looked back inside the aircraft and saw the radio altimeter at 700-600 ft and called go around. He reported that he saw the PNFs hand come up behind the thrust levers, which the PF were already advancing.
31 August 2002
CAA of NZ
Page 21 of 203
CAA Occurrence No. 00/2518 1.1.5 Missed Approach The PF manually flew the initial missed approach using the standby instruments. The PNF saw the runway and airport appear in front of and below the aircraft as it climbed and was able to see the aircraft was clear of terrain. The SP was unable to see outside because of his seating position and the attitude of the aircraft during climb. The PNF prompted for flap retraction once the aircraft was above 1000 ft. The PNF stated that he was happy with the delay in reconfiguring the aircraft during the initial climb-out, as he was assured of terrain clearance. The PNF stated that he felt that the problem was with the G/S and not with the aircraft. He advised Faleolo tower that the aircraft was going around due to a false glideslope capture. He also recalls the tower calling and asking, What is your position? just as the aircraft was commencing the go-around. He set the heading bug to guide the PF onto the outbound track of the missed approach and then onto the Northern 12 nm arc, as per the charted missed approach instructions. He reported that his primary concern was to restore the PFs trust in the integrity of the aircraft automation and ensure that they were not distracted from managing the aircraft. The SP made a PA to the passengers as the aircraft approached the level-off altitude of 4000 ft, advising them of: failure of the instrument landing system at Faleolo, and that the aircraft is climbing to 4000 ft and will make another approach. The SP reported that the ISD came up to the flight deck shortly after the PA announcement, while the aircraft was manoeuvring for the second approach, and sat in the fourth seat behind the Captain. The SP acknowledged the instrument landing system failure with the ISD and also confirmed with the ISD that the cabin crew and passengers were all comfortable with the missed approach. The PNF and SP provided guidance and support to the PF while he flew the aircraft around the northern arc for another approach, encouraging him to concentrate on using the autopilot with heading and altitude hold to manage the aircraft for the next approach. The PNF recalls thinking that he wanted the PF to engage the autopilot earlier than he actually did. The PF commented that the inputs from the PNF during the positioning for the second approach were very valuable in helping him to focus on the management of the aircraft. The correct altitude and distance for the northern arc were questioned and clarified. During the missed approach the crew agreed to fly the second approach using the published DME recommended altitudes for glidepath management. The SP requested the PNF to select an ILS mode on his EHSI, to enable him to monitor the ILS DME rather than the VOR DME. As the aircraft turned inbound on the localizer an erroneous glideslope indication was seen, which was ignored. The strobes and runway lights were visible throughout the second approach. The aircraft landed uneventfully.
Page 22 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.1.6 Post Flight The flight crew debriefed the incident after landing, prepared an Operations Occurrence Report (OOR), advised the tower that a facility malfunction report would be raised and suggested that a NOTAM be issued removing the ILS from service immediately. A facsimile (fax) was sent to Air New Zealand Network Logistics advising them of the occurrence. The Service Engineer was briefed regarding the incident and he subsequently inspected the aircraft for any possible on-board electronic problems. The flight crew consulted amongst themselves whether they were fit to continue the duty and mutually agreed to operate the aircraft back to New Zealand. The cabin crew were asleep when the flight crew went to brief them, approximately an hour after landing. As the ISD had been briefed in flight and subsequently on the ground, the flight crew did not feel it was warranted to disturb the cabin crew for a further briefing. The aircraft operated back to New Zealand without incident. Upon arrival the Flight Operations Line Branch Duty Line Manager was called regarding the incident. The Duty Manager arranged for the FDR to be removed from the aircraft and also requested a NOTAM be issued by Samoan ATC to remove the ILS for runway 08 Faleolo from service.
1.1.7 Post Incident During discussion between the crew of NZ 60, Line Operations Management and Standards and Training Management, a period of stand-down and refresher training to ensure the crew's level of confidence had not been eroded was agreed prior to the crew being available for rostered duties. Each crew member successfully completed the agreed package.
1.1.8 Incident Location The incident occurred during an autocoupled ILS approach to runway 08 Faleolo at night at approximately 0950 hours UTC. The final approach point latitude is S13 49.7', longitude W172 08.8'. Commencement altitude was approximately 2700 feet.
1.2
Injuries to Persons
Injuries Fatal Serious Minor/None Crew 0 0 0 Passengers 0 0 0 Other 0 0
31 August 2002
CAA of NZ
Page 23 of 203
1.3
Damage to Aircraft
No damage occurred to the aircraft.
1.4
Other Damage
There was no damage to other property or objects.
1.5
Personnel Information
1.5.1 Experience and Duty History (PF) The aircraft Captain, aged 49, was the PF for the outbound sector (NZAA-NSFA). Air New Zealand employed the PF during 1978, after he had been with the Royal New Zealand Air Force for seven years. His early equipment and category movements were typical of a pilot with his seniority, having commenced as a First Officer on the F27 (Fokker Friendship). Normal movement from the F27 to the B737-200 followed, then an F27 command was attained in 1985. Following this were periods as a First Officer on the B767 and B747-200, prior to promotion to B767 Captain in 1994. The Captain holds an ATPL with a B767 type rating. His licence medical was last renewed on the 5th November 1999. His last B767 Instrument Rating check was on the 18th April 2000 and last recurrent training Crew Resource Management (CRM) refresher course was on the 12th April 2000.
Flight Total hours On type (B767) Previous 7 days: Previous 30 days: Previous 60 days: 15,067.0 4,290.4 0.0 65.9 122.7
Duty --0.0 103.5 177.9
His previous duty prior to commencing this tour of duty was a Christchurch-BrisbaneChristchurch tour of duty, then travelling as a passenger back to Auckland on the 22nd July 2000.
Page 24 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.5.2 Experience and Duty History (PNF) The PNF, aged 37 years, gained his initial experience in New Zealand general aviation and with several South Pacific airlines prior to joining Air New Zealand in 1989 as a B747-400 Second Officer. Due to the delay into service of the B747-400, he had a brief spell as a B737-200 First Officer prior to returning to the B747-400 in 1991 as a Second Officer. He was promoted to First Officer on the B767 during 1995. He holds an ATPL with a B767 type rating; his licence medical was last renewed on the 21st August 1999. His last B767 Instrument Rating was on the 18th April 2000 and last recurrent training CRM refresher course was on 20th July 2000.
Flight Total hours On type (B767) Previous 7 days: Previous 30 days: Previous 60 days: 8,779.0 3,595.0 27.7 27.7 93.6
Duty --43.0 51.0 141.2
His previous duty prior to this tour of duty was an Auckland Sydney - Auckland flight on the 28th July, duty finishing at 1730 NZDT, giving a scheduled 23 hr 45 minute rest period prior to commencing NZ 60/61.
31 August 2002
CAA of NZ
Page 25 of 203
CAA Occurrence No. 00/2518 1.5.3 Experience and Duty History (SP) The SP, aged 43 years, holds an ATPL, with the licence medical renewed on 3rd March 2000. He joined the Royal New Zealand Navy in 1980, having previously gained his CPL(A). He completed a Royal New Zealand Air Force Wings course in 1981 and flew rotary aircraft with the Royal Navy and Royal New Zealand Navy from 1982 1988. He then spent a year as a General Aviation flight instructor prior to joining Air New Zealand in 1990 as a B737-200 First Officer. Following redundancy in January 1991 he spent four years flying B737-200 and B737-400 aircraft for a South Pacific operator, prior to rejoining Air New Zealand in October 1994 as a B747-400 Second Officer. He was promoted to B767 First Officer in 1999. A B767 Instrument Rating was issued 24th July 1999 during his B767 type-rating course and a CRM module was also completed on the 2nd August 1999 during that type-rating course. An Instrument Rating renewal check had been planned for the 8th of August 2000 and was subsequently completed successfully on that date.
Flight Total hours On type (B767) Previous 7 days: Previous 30 days: Previous 60 days: 8,318.6 699.1 14.8 53.1 101.6
Duty --23.2 114.6 243.3
His previous duty prior to this tour of duty was an Auckland-Melbourne-Auckland flight on the 25th July 2000.
Page 26 of 203
CAA of NZ
31 August 2002
1.6
Aircraft Information
ZK-NCJ is a Boeing B767-319ER; a CF6-80C2-B6 powered aircraft, delivered new to Air New Zealand on 21st April 1995. The aircraft is certified for night IFR operations. The autoland system performance was demonstrated during type certification, using United States type II and type III ILS ground facilities. Under Air New Zealands Air Operator Certificate Operations Specifications (Ops Specs), the aircraft is authorised for Cat II ILS operations to a decision height of 100 feet and RVR 350m/1200 ft, provided the operating crew are trained, authorised and operate in accordance with the exposition and approved precision approach procedures manual. The crew was trained and conversant with this requirement. The avionics systems generally conform to ARINC 700 series equipment characteristics. Relevant systems communicate via an ARINC 429 Digital Information Transfer System. The Flight Management System consists of three integrated autopilot-flight director channels suitable for use as a fail passive and fail operational system for automatic landing with rollout steering, or singly for climb, cruise, descent or approach. The aircraft maintenance history was researched; no defects were noted that might have contributed to the occurrence. Following the occurrence the aircraft was carefully monitored; no discrepancy was noted that corresponded with the event at Faleolo. Assessment of the FDR data revealed that, during the arrival, the ILS glideslope receiver information changed from no valid data to an on glideslope value at 5240 feet pressure altitude and at approximately 40o of arc to the South of the localizer front course. The ILS glideslope receiver information remained at an on glideslope value throughout this approach and until abeam the runway threshold on the missed approach, where the glideslope receiver information value changed back to no valid data. As the aircraft flew around the northerly 12 mile arc for a second approach, the FDR again recorded an on glideslope value at a point approximately 40o of arc from the localizer front course. While the possibility of interference from an on-board or external source was not ruled out the directional nature of the transmissions recorded by the FDR led to a hypothesis that, for some unknown reason, the ILS at Faleolo was transmitting an on glideslope signal regardless of the aircrafts position in space. Discussions with technicians from the Airways Corporation New Zealand established that such a scenario was possible. Subsequently a proving flight at Auckland was arranged to prove the hypothesis. Prior to the scheduled proving flight information was received from the Samoan Authorities advising that, on the night in question, the ILS ground navigation aid had been left transmitting with no SBO amplifier. In this configuration and regardless of the aircrafts position relative to the correct ILS glideslope, the ILS glideslope receiver will receive an on glideslope value. This proved the hypothesis. Notwithstanding this confirmation from the Samoan Authorities two proving flights were subsequently flown to fully document, explore, and understand this phenomena.
31 August 2002
CAA of NZ
Page 27 of 203
CAA Occurrence No. 00/2518 1.6.1 Aircraft Weight and Balance The loadsheet for NZ 60 reflected a Zero Fuel Weight of 119105 kgs, plus 39300 kgs of Jet A1 fuel at dispatch. A 300 kgs taxi fuel allowance gave a takeoff weight of 158105 kgs, at 27.4% MAC. The planned trip fuel was 19000 kgs, for a planned landing weight of 139105 kgs. Certified maximum weights and centre of gravity at planned takeoff weight are: Maximum Taxi Weight Maximum Brakes Release Weight Maximum Landing Weight Maximum Zero Fuel Weight 187,330 kgs 186,880 kgs 145,150 kgs 130,650 kgs 8.3% MAC to 37% MAC
Allowable C of G Range at planned takeoff weight
Aircraft weight and balance was not a factor during this occurrence.
1.6.2 Flap Placard Speeds (VFE) Flap placard speeds are: Flap 1 Flap 5 250 KIAS 230 KIAS
Flap 15 210 KIAS Flap 20 210 KIAS Flap 25 180 KIAS Flap 30 170 KIAS Flap 30 is the normal landing flap position; flap 25 is an alternative landing flap position. VREF 30 for the approach and landing at 140,000 kgs was 143 KIAS.
Page 28 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.6.3 Configuration During an Autocoupled ILS Approach On runways not approved for autoland or practice approach and autoland the normal Air New Zealand procedure is to fly an autocoupled approach and disconnect the autopilot at approximately 1000ft, but generally not later than 300 ft, then continue the approach and touchdown flying manually leaving the autothrottles engaged for speed protection. Autothrottles are disengaged by 30 ft AGL.
Configuration During an Autocoupled ILS Approach
31 August 2002
CAA of NZ
Page 29 of 203
CAA Occurrence No. 00/2518 1.6.4 B767 Low Drag Approach (Air New Zealand Procedure) The B767 Low Drag Approach complies with the Air New Zealand SOP requirements of Flap 20, gear selected down by 1500 ft AGL, landing flap selected by 1000 ft AGL.
Air New Zealand Low Drag Approach Profile
1.6.4.1
B767 Delayed Flap Approach (FCTM)
The Boeing Flight Crew Training Manual states:

The final flap selection may be delayed to conserve fuel if the approach is not being conducted in icing or other adverse conditions. Intercept the glideslope with flaps 20 at VREF30 + 20 kts. The thrust required to descend on the glideslope may be near idle. Approaching 1000 ft agl, select gear down and landing flaps, allow the speed to bleed off to the final approach speed and then adjust thrust to maintain it. Complete the Landing checklist. The approach should be stabilized by 500 ft agl.
Page 30 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.6.5 Flight Deck Panel Layout
Flight Deck Panel Layout and Numbering
1.6.6 Flight Instrument Panels
Captain's and First Officer's Instrument Panels
31 August 2002
CAA of NZ
Page 31 of 203
CAA Occurrence No. 00/2518 1.6.7 B767 Electronic Flight Instrumentation Displays The electronic flight instrument system consists of three symbol generators, two control panels, two Electronic Attitude Direction Indicators and two Electronic Horizontal Situation Indicators. The instruments depend on the FMC for flight progress and map background data and the IRS for attitude and heading data. 1.6.7.1 EFI Symbol Generator
The central part of the EFI is the symbol generator, which receives input from various avionics systems, processes the data and generates the outputs for the EADI and EHSI. Various failures may be presented on each EADI and EHSI. When information is not reliable, or radio signals are not received, the respective display is removed from the EADI or EHSI. If aircraft equipment fails an appropriate failure flag is displayed. EADI and EHSI control panels enable control of symbology, modes, ranges and brightness for the respective EADI and EHSI displays.
1.6.7.2
Electronic Attitude Director Indicator
The EADI presents conventional attitude indications, flight director commands and localizer and glideslope deviation. Flight Mode displays (AFDS operating modes), height alert, ground speed, radio altitude, decision height, pitch limit and TCAS RA are also displayed. ILS deviation monitoring alerts the crew of ILS deviations during an approach. Below 500 ft AGL with APP selected on the MCP, if more than 1 dot deviation from glideslope for one second, or more than 1/5 dot localizer deviation for one second occurs, the respective glideslope or localizer scales change colour from white to amber and the appropriate pointer flashes. This alert will cease when localizer and/or glideslope parameters return within normal limits. Glideslope alert is inhibited below 100 ft AGL.
Radio Altitude Dial
Fast/Slow Indicator and Scale
Glideslope Pointer and Deviation Scale
Localizer Pointer and Deviation Scale
Electronic Attitude Director Indicator
Page 32 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.6.7.3 Electronic Horizontal Situation Indicator
The EHSI presents a selectable, dynamic colour display of flight progress and plan view orientation. Available display modes are MAP, PLAN, ILS and VOR. The respective IRS supplies heading information. The EHSI compass rose is automatically referenced to magnetic North when between 73oN and 60oS and to true North when above those latitudes. Track information is supplied by the FMC; except when this information is unreliable the IRS will automatically supply it. The MAP mode presents information against a moving map background. Displayed information includes track, heading, routes, curved trend vector, range to altitude, wind, distance, estimated time of arrival and selected navigation data points programmed into the FMC. MAP mode is the Boeing recommended mode of display for most phases of flight. An FMC generated vertical profile deviation indicator is displayed on the EHSI during descent and is available in MAP mode only until Approach is selected. The scale indicates a 400 ft deviation from FMC vertical profile.
Current Track
Distance to Active Waypoint Heading Pointer
ETA at Active Waypoint Selected Heading Bug
Weather Radar Returns
Active LNAV Route
VNAV Path Vertical Pointer and Deviation Scale Wind Direction and Speed Position Trend Vector
Aircraft Symbol
Electronic Horizontal Situation Indicator - MAP Mode Display
31 August 2002
CAA of NZ
Page 33 of 203
CAA Occurrence No. 00/2518 The EXP (expanded) VOR and EXP (expanded) ILS modes present an expanded compass rose with heading orientation. Selected range, wind information, TCAS information and system source annunciation is provided with conventional VOR/ILS navigation information. A conventional full compass rose VOR and ILS mode is also available.
ILS DME
Course Deviation Indicator and Scale
Glideslope Deviation Indicator and Scale
ILS Frequency
Electronic Horizontal Situation Indicator EXP ILS Mode
EHSI Mode Selector EXP/FULL VOR Displays VOR navigation information Selects manual VOR and DME tuning on the VOR/DME panel (automatic tuning inhibited) EXP/FULL ILS Displays ILS navigation information Selects manual VOR and DME tuning on the VOR/DME panel (automatic tuning inhibited)
MAP Displays a dynamic map Allows selection of manual or automatic VOR and DME tuning on the VOR/DME panel Allows remote manual VOR and DME tuning on the FMC PROGRESS page PLAN Displays static FMC map in True-Northup orientation Displays heading information in headingup form Allows selection of manual or automatic VOR and DME tuning on the VOR/DME page Activates the MAP CTR STEP prompt on the FMC LEGS page for stepping through the displayed route
EHSI Control Panel
Page 34 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.6.7.4 Radio Distance Magnetic Indicator
The RDMI displays magnetic heading between 73oN and 60oS, VOR or ADF bearing, and VOR DME or ILS DME. The left DME indicator displays distance to the left VOR tuned station, except when ILS is selected on the left EHSI control panel and the right window displays the distance to the right tuned VOR station except when ILS is selected on the right HSI control panel. When ILS is selected on the respective EHSI control panel the left window will display distance to the left ILS tuned station and the right window will display distance to the right ILS tuned station.
Radio Distance Magnetic Indicator
1.6.7.5
Standby Attitude Indicator
A self-contained Standby Attitude Indicator that incorporates a selectable ILS display is installed on the centre main instrument (P1-3) panel. The ILS display is not inhibited during approach and will display glideslope deviation within the glideslope signal reception area. ILS information is provided from the centre ILS receiver.
Standby Attitude Indicator

31 August 2002 CAA of NZ Page 35 of 203
CAA Occurrence No. 00/2518 1.6.8 1.6.8.1 ILS VHF Navigation
Three ILS receivers are installed and controlled by a single ILS control panel located on the aft electronic (P8) panel. The panel tunes all three ILS receivers simultaneously. The EADIs display localizer and glideslope deviation. The Standby Attitude Indicator can also display localizer and glideslope deviation. If an EHSI is in an ILS mode the ILS control panel also tunes the associated ILS DME and the related EHSI displays localizer and glideslope deviation along with the selected course.
ILS Control Panel
1.6.8.2
VOR
Two VOR receivers and control panels are installed. The VOR/DME control heads are situated on the glareshield (P55) panel. The VOR/DME panel is used to tune the related VOR/DME when the associated EHSI mode selector is in the VOR position. The VOR and DME are automatically tuned by the FMC when the related EHSI mode selector is in MAP or PLAN and the VOR/DME panel is in AUTO. The VOR bearing can be displayed on the RDMI. The EHSI displays the selected course and course deviation when selected to VOR mode. They have a manual/auto selection function and a tuneable frequency selector that is only operable when manual is switched.
VOR/DME Switch
VOR/DME Control Panel
Page 36 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.6.8.3 DME Systems
Two DME systems are installed. Each can be automatically tuned by the FMC or manually tuned by the VOR or ILS control panel in conjunction with the EHSI control panel. DME distance can be displayed on the RDMI or EHSI. When the EHSI mode selector is in the MAP or PLAN mode, the related FMC automatically tunes the associated DME. The RDMI will display whichever DME the VOR/DME controller has selected in either auto or manual. When the EHSI mode selector is in the VOR or ILS position, the related panel tunes the DME. ILS DME can only be displayed on the RDMI and EHSI by selecting the EHSI mode selector to one of the ILS Modes (Full or Expanded ILS). When the related EHSI mode selector is in any position other than an ILS mode, DME audio is heard by using the VOR receiver control on an Audio Selector Panel. In the ILS position, DME audio is heard by using the ILS receiver control on the Audio Selector Panel.
VOR/ILS Selector
Receiver Control (Volume)
Audio Selector Panel
31 August 2002
CAA of NZ
Page 37 of 203
CAA Occurrence No. 00/2518 1.6.9 B767 Flight Management System The FMS is an integration of sub-systems that aid the pilot in managing the aircraft lateral (LNAV) and vertical (VNAV) flight path. The sub-systems are designed to allow the pilot to select the level of automation desired during all phases of flight and reduce workload by eliminating the need for many routine tasks and computations. The primary flight deck controls are the AFDS MCP, two Control Display Units (CDU) and two EHSI control panels. The primary displays are the CDU and EHSI.
1.6.9.1
Flight Management Computer
Honeywell manufactures the Flight Management Computer, part number 4052500-962. The FMC combines the flight plan information entered by the pilot, information received from supporting systems and information stored in the FMC database. From this information the FMC calculates present position along with pitch, roll and thrust commands required to fly an optimum flight profile. The FMCs send commands to the autopilot, autothrottle and flight director and map information to the EHSI. The FMC plus CDU meet regulatory requirements for an Area Navigation System when used with radio updating. In this configuration and in conjunction with the map display of the EHSI, the FMC and CDU may be used for en-route and terminal area navigation and RNAV approaches, and as a supplement to primary navigation means when conducting other types of non-precision approaches. In a dual FMC, dual CDU configuration and in conjunction with two or three IRS, the systems are approved for use as a sole means of navigation in areas without radio coverage. Aircraft certification requires one EHSI to be selected to VOR when flying a VOR approach. There is no similar certification requirement to select ILS on an EHSI if flying an ILS approach.
1.6.10 B767 Autoflight System The autoflight system consists of the Autopilot Flight Director System (AFDS) and the Autothrottle system (A/T). Control of the AFDS is accomplished through the Mode Control Panel (MCP).
Page 38 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.6.10.1 Autopilot Flight Director System The AFDS is a triple system consisting of three individual Flight Control Computers and a single Mode Control Panel. The MCP provides co-ordinated control of autopilot, flight director, altitude alert and autothrottle functions.
Autopilot Flight Director System Schematic
31 August 2002
CAA of NZ
Page 39 of 203
CAA Occurrence No. 00/2518 1.6.10.1.1 Flight Control Computers Rockwell Collins manufactures the Flight Control Computer, FCC part number 6228757-104. Three FCCs (left, centre and right) send control signals to their respective autopilot control servos, which operate the flight controls through three separate hydraulic systems. The autopilot controls the ailerons and elevator and adds rudder only during a multi-autopilot approach. Nose wheel steering is also added during rollout from an autoland. During an ILS approach with all three autopilots engaged, the three FCCs are powered from separate electrical sources. Autopilot engagement requires at least two operable FCCs, commands from which are compared to prevent one FCC from commanding an autopilot hardover. The FCCs also provide inputs for AFDS operating mode displays and flight director commands on the EADI. FCC sensitivity for glideslope deviation is to 0.0005 DDM.
1.6.10.1.2 Mode Control Panel and Flight Mode Annunciation Display The MCP is located on the instrument panel glareshield (P55). A light bar on the lower half of each mode selector switch illuminates to indicate that the mode has been requested. Mode engagement is indicated by flight mode displays on the EADIs.
IAS/Mach Window Autopilot Engage Switches
Altitude Window
Captains Flight Director Switch
Approach Mode Controls
First Officers Flight Director Switch
Mode Control Panel
Autothrottle Status Autothrottle Mode (Green) AFDS Pitch Modes (Armed - White) AFDS Pitch Modes (Active Green)
AFDS (Active-Green) AFDS Roll Modes (Armed White) AFDS Roll Modes (Active Green)
EHSI Flight Mode Annunciations
Page 40 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.6.10.2 Autoland Status Annunciator An Autoland Status Annunciator on each pilots panel provides autopilot status information for Cat II and Cat III approaches with automatic landing and rollout. During autoland operations, the FCC detects ILS system anomalies. LAND 2 or LAND 3 annunciations do not necessarily mean the localizer and glideslope signals are being received. If the ILS station fails, or goes off the air, the aircraft continues on an inertial track. An amber line is drawn through the affected EADI mode annunciation (LOC or G/S) and the affected flight director commands are removed from view. The AUTOPILOT and master caution lights illuminate and the caution beeper will sound. The ASA annunciation may or may not change. The ASA system does not monitor the status of all ground and airborne equipment required for Cat II and Cat III operations, it is primarily an autopilot and autopilot support system monitor.
LAND 3, LAND 2 (Green) Window
NO AUTOLAND, NO LAND 3 (Amber) Window
Autoland Status Annunciator
1.6.11 Autopilot System Crosscheck The B767 FCTM advises

Flight Directors provide commands and do not show the airplanes position relative to localizer or glideslope. Relative position is provided by the localizer and glideslope indicators and should be used to evaluate the quality of the approach.
31 August 2002
CAA of NZ
Page 41 of 203
CAA Occurrence No. 00/2518 1.6.12 B767 Flight Instrument and Autoflight System Failure Displays Various failures may be displayed on each EADI or EHSI. When information is not reliable, or radio signals are not received, the display is removed. Numeric indications are replaced with dashes. If aircraft equipment fails, a failure flag is displayed.
EADI EHSI
EFIS Failure Displays
The Boeing FCTM 4.3 states:

The course and glideslope signals are only reliable when their flags are not displayed, localizer and glideslope pointers are in view and ILS identifier is received.
An amber box displayed on the EADI in place of the glideslope deviation scale indicates an internal glideslope receiver system failure. If a valid G/S signal is not available the glideslope deviation indicator will not be displayed, however the G/S scale will display on the instrument. An amber line is drawn through the AFDS pitch mode symbol if a flight mode fault is detected. The autopilot will remain engaged in an attitude-stabilising mode. The primary indicator for an autoland ILS approach is the Crew Alerting System (EICAS) and Autoland Status Annunciator (ASA). The B767 FCTM pg. 4.16 states:
Faults leading to non-normal operations can be divided into two categories: Those occurring above alert height Those occurring at or below alert height
Within these categories many non-normal situations or scenarios are possible. The cockpit is designed so that a quick analysis and decision can be made for virtually all non-normal or fault situations using the crew alerting system and Autoland Status Annunciator (ASA). If the flight crew become aware of the airplane equipment requirements for the approach, the following can be used for any non-normal indication:
Page 42 of 203
CAA of NZ
31 August 2002

Prior To Alert Height Immediately after recognizing the fault from the Crew Alerting System, instrument flags or engine indications, check the Autoland Status Annunciator (ASA). If no change, and the equipment is not required for the approach or can be switched, (e.g. flight instrument symbol generator) continue the approach. If the ASA has changed, or the instrument is required for the approach, adjust to the appropriate higher minimums or go-around. Below Alert Height For any EICAS alert, continue the approach to an automatic landing and rollout unless NO AUTOLAND is displayed on the ASA. The pilot should not intervene unless it is clearly evident that pilot action is required. A thorough fault analysis was included as part of the CAT IIIB certification. Below 200 ft agl a safe landing and rollout can be made with any probable failure conditions. Alert messages, lights and aurals may occur. If an amber or red light illuminates, with the associated aural sound, do not disconnect the autopilot switch below alert height unless the autoflight system is not controlling the flight path. If the fault affects the autothrottle or autobrakes, take over manually. Accomplish the procedures for system faults after rollout is complete and manual control is resumed. If the autopilot is unintentionally disengaged below alert height, the landing may be completed if the required visual conditions exist. Be alert for the mistrim conditions that may exist on some airplanes, because with multiple autopilots engaged, three units of up trim may be introduced to prevent a hard landing if a flare fault occurs. If a go-around is initiated with the autopilot disconnected, press the GA switch on the thrust levers to activate the flight directors in the GA mode.
1.6.13 B767 EFIS Configuration During an ILS Approach When flying an ILS/DME approach using a DME that is frequency paired with the ILS, it is necessary on the B767 to select an ILS display mode on the EHSI to display (and identify) the ILS DME. Air New Zealand follows the Boeing recommended practice of using the MAP display to the extent permissible. Air New Zealand training and expectation is that crews will select expanded ILS as required to carry out glideslope/altimeter checks. With regard to the practice of EHSI mode selection, other than the SOP requirement to have raw data tuned, identified and displayed, there is no: Operations manual procedure to describe how the flight instumentation should be set up for this specific case, Training specification prescribing a training requirement to cover this particular situation, Specific checking requirement documented.
31 August 2002
CAA of NZ
Page 43 of 203
CAA Occurrence No. 00/2518 1.6.14 Instrument Landing System Three ILS receivers are installed, controlled by a single control panel located on the aft electronic control (P8) panel. Rockwell Collins manufactures the aircraft ILS-700A receiver, part number 822-0282-102. The ILS receivers comply with the requirements of ICAO Annex 10 policy for FM broadcast interference. The left ILS receiver from ZK-NCJ was changed on 26th October 1999, due to the glideslope and localizer deviation pointers failing to display on the Captains EADI/EHSI (Maintenance Log NCJ1032763). There were no other recent Maintenance Log entries, with respect to the ILS system, prior to the Faleolo incident. The left ILS receiver was removed after the Faleolo incident and the maintenance stored fault data was analysed. No anomalies relevant to the investigation were noted.
1.6.14.1 ILS-700A Receiver The ILS-700A receiver is a microprocessor-controlled system. The glideslope signal is detected, filtered, amplified and applied to identical processors. The primary processor and monitor processor determines deviation data separately but identically. Digital filters separate the 90 Hz and 150 Hz tones and compare magnitudes. The difference is used to generate deviation words from each processor. The outputs from the two processors must be identical. Resolution of glideslope deviation from the ILS receiver is approximately 0.0002 DDM. The ARINC 429 glideslope deviation data output to aircraft systems has four defined states. These are Data Normal (NML), No Computed Data (NCD), Functional Test Data (FT) and Failure Warning (FW). No Computed Data (NCD) will be output for a loss of glideslope modulation or reduction to 52% modulation level, a loss of signal presence, or insufficient signal level. This is indicated on the EADI by removal of the glideslope pointer. A Failure Warning is generated for an internal loss of receiver synthesiser lock. Automatic self-test monitoring (by software) of the glideslope receiver is carried out internally. A detected fault with the pre-processor, primary processor, or monitor processor will cause a failure warning output. For example, if the monitor processor DDM output exceeds the primary processor by 0.009 DDM a failure warning will occur. This is an ILS receiver failure and is indicated by an amber G/S box appearing on the EADI in place of the glideslope scale. The glideslope signal is radiated to produce effectively two intersecting lobes, one above the other. The upper lobe is predominately modulated with 90 Hz, and the lower lobe is predominately modulated with 150 Hz. If the aircraft is on glideslope, the glideslope receiver will effectively be receiving the CSB signal only, at nominally a zero DDM value. The glideslope receiver only monitors the carrier (CSB) signal to validate normal data output (NML state).
Page 44 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 Any deviation of the aircraft above or below the glidepath will cause the glideslope receiver to sense either a larger 90 Hz or a larger 150 Hz modulation respectively, caused by the presence of SBO 90 Hz and 150 Hz modulations phasing with CSB 90 Hz and 150 Hz modulation. This will result in a change in ILS receiver DDM output to command fly up or fly down as required. The SBO component of the glideslope transmission signal provides the vertical guidance (width) information down the required glideslope. Removal of the SBO signal from the transmitted glideslope signal leaves the balanced CSB signal with an equal 40% modulation of the 90 and 150 Hz tones that is indistinguishable from an on path (zero DDM) signal. This would be interpreted by the airborne receiver as a glidepath with infinite width. Shifting the phase relationship between the SBO and CSB signals may have a similar effect. ICAO Annex 10 Attachment C 2.3 (Malfunctioning Alarm in Airborne Equipment) states:
2.3.1 Ideally, a receiver alarm system such as a visual mechanical flag should warn a pilot of any unacceptable malfunctioning conditions which might arise within either the ground or airborne equipments. The extent to which such an ideal is specified below. 2.3.2 The alarm system is actuated by the sum of the two modulation depths and therefore the removal of the ILS course modulation components from the radiated carrier should result in the actuation of the alarm. 2.3.3 The alarm system should indicate to the pilot and to any other airborne system, which may be utilizing the localizer and glide path data, the existence of any of the following conditions: a) b) The absence of any RF signal as well as the absence of simultaneous 90 Hz and 150 Hz modulation; The percentage modulation of either the 90 Hz or 150 Hz signal reduction to zero with the other maintained at its normal 20 percent and 40 percent modulation respectively for the localizer and glide path;
Note. - It is expected that the localizer alarm will occur when either the 90 Hz or 150 Hz modulation is reduced to 10 percent with the other maintained at its normal 20 percent. It is expected that the glide path alarm occur when either the 90 Hz or 150 Hz modulation is reduced to 20 percent with the other maintained at its normal 40 percent. c) The receiver off-course indication 50 percent or less of that specified when setting the receiver audio gain adjustment
2.3.3.1 The alarm indication should be easily discernible and visible under all normal flight deck conditions. If a flag is used, it should be as large as practicable commensurate with the display.
31 August 2002
CAA of NZ
Page 45 of 203
CAA Occurrence No. 00/2518 1.6.15 Auto Flight Pitch Control Modes Autopilot pitch axis control signals are generated from the pitch control laws defined in the software architecture of the FCC. The control laws allow aircraft guidance, stabilisation and command augmentation. The principal outputs of the control law functions are commands to the aircraft control surfaces and to the Flight Director display. The control laws include sensor processing to achieve the flight trajectory appropriate to the selected mode. The B767 FCC has four independent pitch control sections that can initiate Flight Director command signals: Vert Speed VNAV Speed Vertical Position (Vertical Speed) (Vertical Navigation) (Takeoff, Flight Level Change, Go Around) (Altitude Hold, Altitude Select, Glideslope, Flare)
External sensors provide data to these sections and depending on selected autopilot mode will determine the section used for developing the controlling pitch signal to the elevator. Signal processing computations within the control laws of the FCC are divided into two types, outer loop (aircraft monitoring) and attitude or inner loop (aircraft control). The outer loop computations use sensors appropriate to the operating mode to command attitude changes to accomplish aircraft control to develop a desired pitch for the aircraft. The inner loop compares desired attitude with actual attitude and uses any error along with rate to develop a command for the control surface.
Page 46 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.6.16 B767 FMC Arrival The FMC Navigation database flight plan contains the published arrival information. For Faleolo the following navigation database programmed waypoints are used: STAR: FALE D189Q D189O D200O D257O CF08 APPROACH: CF08 heading 077o, 5.5 nautical miles to waypoint FF08 CF08 is the navigation database final approach course fix FF08 heading 077o, 5.8 nautical miles to waypoint RW08 FF08 is the navigation database final approach fix RW08 the threshold of runway 08. A 2.99o flight path angle is drawn from waypoint RW08 back along the approach track. This flight path angle intercepts the track at 2500 ft, the altitude of the inbound track from CF08 to FF08. Waypoints for the published go-around are also contained in the navigation database. Of interest are the waypoints on the inbound course toward the localizer: CF08, FF08 and RW08. Waypoint CF08 is located 2 miles closer to the runway than waypoint D257O; that is, CF08 is nominally 13nm FA on the 257 radial. Waypoint FF08 is located 5.5 miles toward the airfield from CF08, that is, nominally at 7.5 nm FA or approximately 6 nm IAP, some 1.5 nautical miles past the ILS FAP. Waypoint RW08 is 5.8 miles from FF08 and is located at the threshold of runway 08. Provided the aircraft is in LNAV and VNAV modes and an FMC arrival is programmed, the aircraft will track to the airfield via the FMC programmed waypoints. The FMC arrival for Faleolo when approaching from the South for runway 08 contains the FALE arrival, an approach transition approximating the FA 15 nm arc, and an FMC approach. The aircraft will track from FALE via the FA 189o radial, commence a turn on to the FA 15 nm arc at 17 FA, then track an approximate arc using 3 bearing/distance waypoints, to intercept a 077o track inbound to runway 08. The FMC database waypoints will then track the aircraft via FMC navigation database waypoint CF08, (navigation database final approach course fix), at an altitude of 2500 ft until it intercepts the minus 2.99o flight path angle to waypoint RW08, at which point the aircraft will descend. The descent profile transitions through FF08 (navigation database final approach fix). If the FMC profile is monitored, glideslope capture should occur approximately 1.5 miles prior to waypoint FF08. Un-named fixes along a DME Arc, e.g.: D189 represents the FA VOR 189 radial Q = 17 nm, O = 15 nm (A = 1 nm, B = 2 nm etc.)
31 August 2002
CAA of NZ
Page 47 of 203
CAA Occurrence No. 00/2518 When cleared for the approach, LOC is selected to enable localizer capture. Once established on the localizer, selection of APP on the MCP will arm glideslope operation. The aircraft will then track the localizer toward waypoint FF08 under FMC vertical profile guidance until the glideslope capture point, where the aircraft will transition from FMC pitch mode guidance to G/S CAP mode
NOTE: The Air New Zealand MCP setting procedure provides autoflight system minimum altitude protection, to which the aircraft will descend, but will not continue further descent. MCP altitude is set to minimum descent altitude (in this case FAP altitude). This basic altitude protection will remain unless: Vert Speed mode is deliberately selected to continue further descent, or The glideslope is intercepted and captured, or Manual flight mode is selected.
1.6.16.1 VNAV Vertical Path Deviation Indicator The FMC generated VNAV path vertical pointer and deviation scale is presented on the EHSI in MAP mode and is available during an FMC descent, but is retracted from view once the glideslope pitch mode engages.
VNAV Path deviation scale and vertical pointer
EHSI VNAV Path Vertical Pointer
Page 48 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 VNAV path deviation information is available on the FMC CDU progress page 2 throughout all phases of flight.
VNAV Path vertical track error
FMC CDU Progress Page 2 Target altitude for the VNAV path is dependent upon the computed distance from the runway waypoint, which, in turn, is dependent upon FMC navigation accuracy. If FMC navigation accuracy were statistically 0.3nm for 95%, the associated path accuracy would be approximately 96 feet from an ideal 3o glidepath. As the aircraft approaches the runway, a significant glide slope (angular) deviation may be displayed as a small FMC vertical (rectilinear) deviation. Temperature effect on the accuracy of the barometric corrected altitude must also be considered. If the ambient temperature is an ISA minus deviation, measured pressure altitude will be higher than actual aircraft altitude, if the ambient temperature is an ISA plus deviation, the opposite will be true. This effect on accuracy will diminish as the aircraft approaches the airport elevation.
31 August 2002
CAA of NZ
Page 49 of 203
CAA Occurrence No. 00/2518 1.6.17 B767 Autopilot Coupled Approach (Autoland) At Faleolo the left autopilot was in command. Prior to arming APP, the AFDS was selected to Vert Speed mode, which remains active in the G/S ARM mode. Glideslope capture is inhibited until the localizer is captured and the difference between ground track and runway track is less than 80o. While the FCC is in the G/S ARM mode pitch control law in the FCC computes distance from glideslope intercept point using a variety of sensor data, including glideslope deviation, runway heading, radio altitude, vertical, along track and cross track acceleration, ground speed, inertial attitude, pitch attitude, pitch rate and stabiliser position. The pitch control law assumes a 3o glideslope to compute a 0.05g capture manoeuvre based on the relative vertical speed between the aircraft and the assumed 3o glideslope. The capture point is variable to ensure a 0.05g capture of the glideslope beam except that, if the glideslope error is less than 80 ft, G/S CAP will occur without satisfying this criteria. Transition from G/S ARM to G/S CAP will happen with glideslope activity present, that is, the output from the ILS receiver must be normal and at a computed DDM value dependent on closure rate with the glideslope. Once the glideslope is captured FCC control laws will manage the flight path vertical profile to maintain the DDM at zero. FCC glideslope control law does not limit the angle at which the aircraft will descend on a glideslope. Land 2 or 3 will engage at 1500 ft radio altitude provided that at least two outer loop sensor sources are available. Transition from VNAV path to G/S capture uses similar logic to the transition from Vert Speed to G/S capture. There is no software reasonableness check between the FMC computed approach profile and the FCC approach mode.
Page 50 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.6.18 Ground Proximity Warning System Allied Signal Aerospace (Honeywell) manufactures the GPWS, part number 965-0648008. The GPWS provides the following alerts if thresholds are exceeded: Mode 1 Excessive descent rate Mode 1 is independent of aircraft configuration and will provide a repeated aural alert of SINK RATE if the first envelope is entered and a repeated aural warning of WHOOP WHOOP PULL UP if the second envelope is penetrated. Mode 2A Excessive terrain closure rate with flaps not in landing position Mode 2B - Excessive terrain closure rate with flaps in landing position Entering the Mode 2B envelope with the flaps in the landing position will cause the repeated aural alert TERRAIN to sound. The height of the Mode 2B envelope floor varies between 200 ft and 600 ft, dependent upon barometric descent rate. Mode 3 Altitude loss after takeoff or go-around On approach, in the landing configuration, Mode 3 arms when the aircraft descends below 245 ft RA and becomes active if either gear or flap is retracted. Mode 4A Unsafe terrain clearance with landing gear not down and flaps not in landing position Mode 4B Unsafe terrain clearance with landing gear down and gear or flaps not in landing position Mode 5 Below glideslope deviation Mode 5 is armed below 1000 ft RA, when the left glideslope receiver is receiving a valid signal and the landing gear is down. If the aircraft descends more than 1.3 dots below the ILS glideslope, an aural alert GLIDESLOPE will sound. Mode 6 Altitude advisories Automated Radio Altitude callouts occur at 100, 50, 30, 20 and 10 ft RA, regardless of aircraft configuration. Mode 7 Windshear EGPWS is fitted to B767 aircraft ZK-NCN and ZK-NCO and is included in the detail specification for newly manufactured aircraft that are introduced into Air New Zealand service. A business case had been raised prior to the incident to request retrofit of EGPWS to the existing fleet.
31 August 2002
CAA of NZ
Page 51 of 203
1.7
Meteorological Information
The TAF at Faleolo valid for the arrival period of NZ 60 was 070/10kt 9999 SCT020 SCT040. The 0900 UTC METAR was 110/05kts 40km FEW024 24/18 1015. The METAR for 1000 UTC was 110/08kts 30km FEW020 24/18 1015. It was a clear night, with no moon. The Air New Zealand Route Guide contains a caution that reported conditions are often inaccurate, especially visibility and cloud base.
1.8
Aids to Navigation
The aids to navigation at Faleolo consist of a Category I facility ILS and ILS DME for runway 08, a VOR, VOR DME, and an NDB. All the navigation aids are located within the airfield environs. Airfield lighting consists of a Short Approach Light System (SALS), High Intensity Runway Edge Lights (HIRL), Runway End Identifier Lights (REIL) and a Precision Approach Path Indicator (PAPI) set at 3o. There is no Radar approach facility. With the exception of the Wind Direction Indicator on the threshold of runway 08 being unlit, no other navigation aids were promulgated as inoperative for the time of arrival.
1.8.1 NOTAMs NOTAMs for Faleolo are raised by Faleolo ATC then forwarded to Nadi, Fiji via AFTN. Nadi is responsible for collation and distribution of NOTAMs raised in the South Pacific. Christchurch NOTAM office is the agency in New Zealand that receives and distributes South Pacific NOTAMs to New Zealand operators. The Air New Zealand Flight Dispatch office rang Faleolo several days after this occurrence to compare the list of active NOTAMs on file at Faleolo with the current NOTAMs that Air New Zealand was in receipt of from the Aeronautical Information Service office at Christchurch. The list of active NOTAMs held by Faleolo was at variance with the current Faleolo NOTAMs held on file at Christchurch. ICAO Annex 15 Aeronautical Information Services, Chapter 5.2.2 requires that:
Each NOTAM shall be as brief as possible and so compiled that its meaning is clear without reference to another document.
NZCAR Part 175.251 (d) repeats that requirement.
Page 52 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.8.2 Faleolo STAR Arriving from the South, NZ 60 was cleared for a FALE arrival. The aircraft positioned around the 15 mile arc (preferred for cat C and D aircraft) for an ILS runway 08.
Jeppesen Sanderson STAR Chart - Faleolo International Arrivals
31 August 2002
CAA of NZ
Page 53 of 203
CAA Occurrence No. 00/2518 1.8.3 ILS Approach Runway 08 The ILS approach to runway 08 transmits on frequency 109.9, identifier IAP, inbound course 077o. The aircraft must be established on the localizer within 16 DME FA VOR, not below the minimum altitude of 2500 ft. The FAP is at 7.5 DME IAP mandatory altitude of 2500 ft. The approach plate contains a note to autocouple to the ILS only when established inbound. Decision Altitude (DA) for the ILS is 358 ft. Airport elevation is 58 ft. The missed approach instruction is for a climbing left turn outbound on the FA VOR 340o radial to return to the VOR at 4000 ft or join the 12 DME arc FA at 2500 ft.
Jeppesen Sanderson Chart - VOR DME ILS DME Runway 08 Faleolo
Page 54 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.8.4 ILS Ground Facility The ILS transmission system installed at Faleolo consists of a localizer transmission system, a glideslope transmission system and a co-located ILS DME. The glideslope transmission facility utilises a Toshiba TW1530C model. The glideslope transmission system consists of a main transmitter, a standby transmitter, associated power supplies, field monitoring system and a tower status indication system. The glideslope system uses a null reference glideslope antenna for transmission.
NOTE: Only Category I ILS installations are discussed here. The design criteria and operating requirements for Category II and Category III installations are generally more stringent than for a Category I installation.
The ILS glideslope ground transmitting equipment is monitored at two points. Automatic monitoring (field monitoring) at the glideslope transmitter and antennae checks both output power and accuracy of the ILS glideslope to ensure that the characteristics of the installation stay within the permitted tolerances. Any fault detected by the field monitoring system should result in the defective transmitter being shut off and then the standby transmitter being activated. If the standby transmitter is also faulty then it will also be shut down. The total period of radiation outside the specified tolerances shall be as short as practicable, consistent with the need for avoiding interruptions (such as those caused by aircraft flying over the antenna). A Category I ILS glide path facility out of tolerance transmission shall not exceed 6 seconds under any circumstances. An additional monitoring facility is installed in the tower and consists of an indicator panel and associated audio alarm that indicates the operating condition of the equipment. This remote control and indicator provides the Air Traffic Controller with an indication of the operating status of the equipment within the ILS installation. It will provide a visual and audible alert if the installation ceases transmission. Annex 10 also requires the monitor and alarm circuits to be designed to be fail-safe to ensure the navigation guidance and identification is removed and a warning provided at the designated remote control points in the event of a failure of the monitor system itself.
31 August 2002
CAA of NZ
Page 55 of 203
Transmitter 1
Local Glide Path Control
Transmitter 2
Monitor 1
Monitor 2 Remote Status indicator
From Localizer
Remote Control
T o w e r
Schematic of glide path equipment
Monitor
DME Antenna
Transmitter Antennae
Prepared surface
Glide path transmitter and monitor antennas

CAA Occurrence No. 00/2518 1.8.5 ILS Identification The ILS system only transmits identification signals on the localizer and the marker beacons or ILS DME. There is no identification transmitted with the glide path signal.
1.8.6 Null Reference Glideslope Beam Characteristics Glideslope antennae typically use one of two methods to form the path in space; the image glideslope system and the non-image glideslope system. Image glideslope systems rely on the signal reflected from the ground in front of the glide path facility to combine with the direct signal in space so forming a signal that varies in space with the vertical angle from the glide path. A non-image system is generally used when the terrain in front of the antenna system is irregular or absent, a non-image system does not rely on terrain to as great an extent to form the path in space. A null reference antenna as installed at Faleolo utilises the image glideslope system. A standard null reference glidepath signal requires the use of two co-located ground based antennae: The upper antenna radiates a double sideband suppressed carrier signal (SBO) with equal amplitude 90Hz and 150 Hz sidebands. The 150 Hz signal is in phase with the 150 Hz CSB signal and the 90 Hz signal is in anti-phase with the 90 Hz CSB signal. The lower antenna radiates a carrier signal modulated with equal amplitude in phase 90 Hz and 150 Hz signals, the CSB signal. In space the direct and ground reflected (image) components of this signal combine to produce a signal which is strongest at the elevation of the glidepath and which reduces in strength to a null at 0o and 6o. The modulation stays the same everywhere in space.
Glide path angle is determined by the height of the upper antenna. To ensure the displacement sensitivity (change in DDM with vertical angle) is symmetrical above and below the glide path the upper and lower antennae must have a 2:1 height ratio. The CSB signal should have balanced 150Hz and 90Hz signals to give the correct glide path angle. Unbalancing the signals will raise or lower the glide path angle, if the 150 Hz signal is greater than the 90Hz signal, the glide path angle will increase and if the 150 Hz signal is less than the 90 Hz signal , the glide path angle will decrease.
31 August 2002
CAA of NZ
Page 57 of 203
ILS Glide Path Null Reference Antenna Vertical Radiation Pattern
1.8.7 CSB Transmission The total modulation of the CSB is nominally 80%, composed of equal amounts of 90 Hz and 150 Hz modulation of 40% each. This equality is in effect an on path or zero DDM signal. A tolerance of 2.5% is the acceptable limit as per ICAO Annex 10 Volume 1 Radio Navigation Aids. 1.8.8 SBO Transmission SBO is Side Bands Only, that is, it is a composite signal of 90 Hz + 150 Hz, with carrier which was in phase with the CSB signal removed from the signal by a cancellation method. The 150 Hz signal is radiated in phase with the CSB 150 Hz signal, the 90 Hz signal is radiated in anti-phase with the 90 Hz CSB signal. The resultant SBO signal is transmitted from the upper antenna to add and subtract with the radiated CSB signal. This action modifies the CSB signal to give a 90 Hz larger than 150 Hz signal above slope, and a 150 Hz larger than 90 Hz below the slope. These are often referred to as fly down and fly up signals respectively. 1.8.9 Difference in Depth of Modulation (DDM) DDM is in effect algebraically one minus the other or the modulation difference between the combined (CSB and SBO) 150 Hz and 90 Hz signals. For example: if at the same point in space the 150 Hz signal = 45%, then the 90 Hz signal = 35%, because summed they must equal 80% and the difference between the two is 10%, or a DDM of 0.100. A value of 0.091 DDM equates to a 1 dot deviation on the B767 glideslope deviation indicator. An aircraft on glideslope will sense equally modulated 150 Hz and 90 HZ signals; i.e. zero DDM, that is, the same value as the CSB only signal. If the SBO signal is not being radiated with the CSB signal, the aircraft receiver will interpret this zero DDM value as an on glideslope signal anywhere within the CSB radiated area.
Page 58 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.8.10 Equipment (Field) Monitoring Generally dual monitors installed at the equipment are used to monitor the ILS glidepath transmitter: RF power ModSum width (the change in DDM with change in vertical angle from the path) course (on path)
1.8.10.1 RF Monitoring RF monitoring ensures the signal strength is sufficient to allow satisfactory operation of the aircraft installation. For a glide path system that uses a single frequency system the power output must not reduce below 50% of normal. If the RF signal strength is below tolerance an equipment changeover or shutdown will result. On the aircraft, providing the received signal strength is within the ILS receiver sensitivity (minus 99DBm), the receiver will process the signal. If the signal strength is less than the receiver sensitivity the deviation pointers will not be displayed on the EADI. 1.8.10.2 ModSum Monitoring ModSum is the algebraic addition of the 150 and 90 Hz components of the CSB signal. ModSum for a glideslope is 80% AM (nominal) of the carrier. If the ModSum is out of tolerance an equipment changeover or shutdown will result. The aircraft ILS receiver also monitors the ModSum (80%) AM component of the glideslope signal, that is, if the aircraft is in the signal area and receiving a strong enough signal the ILS receiver will interpret this as a valid signal. If the transmitter does not shut down due to an out of tolerance ModSum value (below 52% of normal), the ILS700 Receiver will change glideslope data output to NCD (No Computed Data) and the glideslope deviation pointer will not be displayed. 1.8.10.3 Width Monitoring Width monitoring will cause glide path transmission to cease if the glide path sector width alters more than 0.1125 o around a nominal width of 0.36 o from the glidepath angle. If the transmission does not cease the aircraft ILS receiver is incapable of distinguishing this fault and it may only be noticeable because the aircraft will react with greater or reduced sensitivity during the approach. 1.8.10.4 Course Monitoring Course monitoring will cause the glide path transmission to cease if the glide path angle shifts by more than 7% of the published angle. If the transmission does not shut down, the aircraft ILS receiver will not distinguish this fault and will continue to track the out of tolerance path.
CAA Occurrence No. 00/2518 1.8.11 Status Monitors / Tower Displays A tower monitor, as it is often referred to, is specified in ICAO Annex 10 as a remote control and indicator and indicates the operational status of the respective navigation aid to the controller. The remote indicator is usually simple, e.g. a green light for a normally operating system and a red light for a failed system. To reset the ILS system (in the case of Auckland) the tower staff selects the other runway and then reselects the ILS to the desired runway. Once the equipment is transmitting, the equipment (field) monitors are the sole arbiters of determining whether the equipment should remain transmitting. In the Faleolo tower only the status of the ILS is displayed and no selections are possible other than to silence the audible alarm. At the base of the Faleolo tower is the ILS remote control. This panel is the communication point for the LLZ and GP. It shows the transmitters selected, remotely (at this panel) or local (at the LLZ or GP hut on the field), any maintenance or executive alarms, transmitter transfer or shut downs, and if the equipment is in control bypass, i.e. the executive monitor is NOT in control.
Failed System
Operating System
Tower Remote Control and Indicator Panel (Typical)
Tower Remote Status Indicator Panel at Faleolo

ILS remote control at FaleoloSituated at the base of the tower
1.8.12 ATS Facility Requirements NZCAR Part 172.57 (b) (Facility Requirements) states:
An applicant for an aerodrome control service, or an aerodrome flight information service, shall establish procedures to ensure that any aerodrome control tower or aerodrome flight information office, including any mobile tower or office, listed in the applicants exposition, is -.. (5) provided with the following minimum equipment: (xi) status monitors for approach and landing aids and any road or rail signalling equipment affecting the use of a runway; and (xv) an audible alerting alarm.
Approach control offices under Part 172.57 (c) (x) also require:
. an ILS/MLS status monitor at the approach control or approach control radar operating position for the aerodrome concerned.
31 August 2002
CAA of NZ
Page 61 of 203
CAA Occurrence No. 00/2518 NZCAR Part 172.57(d) states:

The applicant shall establish procedures to ensure that the aeronautical telecommunications equipment required by paragraphs (b) and (c) are operated in accordance with the requirements of part 171.
NZCAR Part 172.151 (continued Compliance) requires:

Each holder of an air traffic certificate shall (4) continue to meet the standards and comply with the requirements of Subpart B prescribed for certification under this part
1.8.13 ILS Specification ICAO Annex 10 Volume 1 Chapter 3.1.2 specifies the components required for an ILS as:
3.1.2.1 The ILS shall comprise the following basic components: a) VHF localizer equipment, associated monitor system, remote control and indicator equipment; b) UHF glide path equipment, associated monitor system, remote control and indicator equipment; c) VHF marker beacons, associated monitor system, remote control and indicator equipment; except as provided in 3.1.7.6.6.
3.1.2.1.1 Facility Performance Categories I, II and III ILS shall provide indications at designated remote control points of the operational status of all ILS ground system components. NOTE 1:- It is intended that the air traffic services unit involved in the control of the aircraft on the final approach be one of the designated control points receiving, without delay, information on the operational status of the ILS as derived from the monitors.
Annex 10 Volume 1 Chapter 3.1.7.6.6 allows for a suitably located DME, together with associated monitor system and remote control and indicator as an acceptable alternative to part or all of the marker beacon components of the ILS. When a DME is used, the distance information must be operationally equivalent to that furnished by marker beacons. If DME is used as an alternative for the middle marker, the DME must be frequency paired with the ILS localizer. To further amplify on the requirement for the remote control and indicator equipment ICAO Annex 10 Volume 1 (Radio Navigation Aids) chapter 2.8.1 states:
Aerodrome control towers and units providing approach control service shall be provided without delay with information on the operational status of radio navigation aids essential for approach, landing and take-off at the aerodromes with which they are concerned.
Page 62 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 NZCAR Part 171 Aeronautical Telecommunication Service Organisations certification states:
171.53 (a) Facility Requirements Each applicant for the grant of a telecommunication service certificate shall establish procedures to ensure that (1) each facility listed in their exposition (i) (ii) is designed, installed and commissioned to meet the applicable operational specification; and conforms with the applicable system characteristics and specification standards prescribed in Volume 1 of Annex 10..
and:
(4) each radio navigation aid listed in their exposition is provided with a monitoring system that will remove the facility from operational service and transmit a warning to an appropriate control point upon detection of any of the following conditions: (i) (ii) (iii) (5) navigation information outside the prescribed tolerance for the facility failure of the identification signal failure of the monitoring system
information on the operational status of any radio navigation aids listed in the applicants exposition that are essential for the approach, landing and take-off at an aerodrome, is provided without delay (i) (ii) to the aerodrome control tower if that aerodrome has one; and to the air traffic control unit providing an approach control service for that aerodrome if such a service is being provided.
CAANZ Advisory Circular AC 171-1 further amplifies these requirements. AC 171.53 states:
The procedures required under this rule are to ensure that any of the facilities listed in the certificate holders exposition meet the applicable operational requirements for the facility. The performance of the facility must conform with the applicable system characteristics and specification standards prescribed in Annex 10 and with any other applicable requirement prescribed in rule 171.53.
and:
Each facility is required to conform with the applicable system characteristics and specification standards prescribed in Annex 10 Aeronautical Telecommunications. The paragraphs in Annex 10 that contain shall statements are to be read as requirements to be compiled with for the particular facility unless specifically stated otherwise in rules 171.53 (a)(2) and (3).
Rule 171.53 (a)(2) and (3) refer to NDB and DME facilities.
31 August 2002
CAA of NZ
Page 63 of 203
CAA Occurrence No. 00/2518 1.8.13.1 ILS Operating and Maintenance Instructions Manufacturers generally provide switching sequences and functions to override equipment monitoring during maintenance. This enables out of tolerance information to be transmitted and allows parameter adjustment during ground repair, maintenance and flight calibration. To prevent nuisance alarms to the tower during maintenance procedures, status alarms and indicators also need to be capable of being deactivated. Airfields are required to have a comprehensive training and certification process for ground navigation radio aid technicians, and adequate procedures in place to ensure no incorrect parameter is accidentally transmitted.
Glide Path monitors and control panel in the GP equipment shelter on the field at Faleolo
Page 64 of 203
CAA of NZ
31 August 2002
Close up of control panel
Close up of one monitor panel
31 August 2002
CAA of NZ
Page 65 of 203
CAA Occurrence No. 00/2518 NZ Civil Aviation Rule Part 171.61 states:
Each applicant for the grant of a telecommunications service certificate shall establish a procedure to ensure that no facility listed in their exposition is placed into operational service unless(i) (ii) the person placing the facility into operational service is authorized and is assessed as competent under the procedures required by 171.51 (b) and the appropriate checks have been carried out to verify the performance of the facility
NZCAR 171.107 states:

Each holder of a telecommunications certificate shall provide, for the use and guidance of their personnel, operating and maintenance instructions for each facility listed in their exposition. The instruction shall be controlled by the document control procedures required by 171.57 and shall set out the requirements for operating and maintaining each facility. The instruction shall include a list of (4) the mandatory check procedures for placing the facility into operational service
Advisory Circular to Rule 171 - AC 171.69 carries the following statement:

In the case of navigation aid facilities the potential to provide erroneous information would include the following circumstances: The executive monitor not being in control at the facility (monitor switched to bypass mode).
1.8.13.2 Deviations From ILS Specifications NZCAR Part 171 does not allow for deviations from the rule except as documented in Rule 171.109. NZCAR 171.109 states:
(a) Subject to compliance with 171.113 (a), the holder of a telecommunications service certificate may deviate from any requirement to this part to meet an emergency situation if there is a need to take immediate action for the protection of life or property involving carriage by air A certificate holder who deviates from a requirement of this part under paragraph (a) shall provide a written report to the Director as soon as practicable, but in the event not later than 14 days after the emergency. The report shall cover the nature, extent and duration of the deviation.
(b)
AC 171.109 further amplifies this:

There may be occasions when a certificate holder can assist during an aircraft emergency by operating a facility that does not comply with the requirements of Part 171. Rule 171.109 allows such deviation from the normal requirements, provided the person operating the facility can be satisfied that there is no reason to suspect the integrity of the information provided by the facility. The emergency must require immediate action to be taken for the protection of life or property involving carriage by air. A report on the deviation must be forwarded to the Director within 14 days. The operation of a navigation aid that does not have the required monitor system in operation could be a deviation under 171.109 provided the operation was to assist an aircraft in distress.
Page 66 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.8.13.3 Limitations on Certificate Holder NZCAR 171.113 states:
(a) The holder of a telecommunication service shall not operate a facility (except for site test purposes controlled by the procedures required by 171.53(b) if there is a cause to suspect the integrity of the information being provided by the facility.
and:
(c) Except where a deviation under 171.109 is required or a site test is carried out, under procedures required by 171.53 (b), a certificate holder shall not operate a facility unless (3) (4) the performance of the facility meets the applicable facility requirements in 171.53(a); and any integrity monitoring system for the facility is fully functional
171.53 (b) refers to the operation of a temporary facility.
1.8.13.4 ILS Integrity and Continuity of Service There are a number of parts relating to integrity and operational use of the ILS in the guidance material in Attachment C to Annex 10. Part 2.8 covers Integrity and continuity of service- ILS ground equipment
NOTE: Attachment C material is for guidance only and is not considered to be part of the standards and recommended practices contained in Annex 10 Volume 1.
In part 2.8.1.2 it states:

It is generally accepted, irrespective of the operational objective, that the average rate of a fatal accident during landing, due to failures or shortcomings in the whole system, comprising the ground equipment, the aircraft and the pilot, should not exceed 1 x 10-7. This criterion is frequently referred to as the global risk factor.
And in part 2.8.1.3, it states,

In the case of Category I operations, responsibility for assuring that the above objective is not exceeded is vested more or less completely in the pilot. and integrity is needed to ensure that an aircraft on approach will have a low probability of receiving false guidance; continuity of service is needed to ensure that an aircraft in the final stages of approach will have a low probability of being deprived of a guidance signal.
Integrity and continuity of service assume the equipment is operating in its design state, i.e. that the equipment monitor is functioning correctly and that a signal that is outside specified tolerances is removed and the remote indicator and alarm at the ATS facility is operating.
31 August 2002
CAA of NZ
Page 67 of 203
CAA Occurrence No. 00/2518 Part 2.8.2.4 states:

The highest order of protection is required against the risk of undetected failures in the monitoring and associated control systems.
Part 2.13 covers The use of Facility Performance Category I- ILS for automatic approaches and landings in visibility conditions permitting visual monitoring of the operation by the pilot. In 2.13.1 it states:
Facility Performance Category I ILS installations of suitable quality can be used, in combination with aircraft flight control systems of types not relying solely on the guidance information derived from the ILS sensors, for automatic approaches and automatic landings in visibility conditions permitting visual monitoring of the operation by the pilot.
Part 2.14.2 (1) states:

Level 2 is the performance objective for ILS equipment used to support low visibility operations when ILS guidance for position information in the landing phase is supplemented by visual cues. This level is a recommended objective for equipment supporting Category I operations.
1.8.13.4.1 Risk Tree Analysis to Determine Integrity and Continuity of Service (ICAO Annex 10 Attachment A) ICAO Annex 10 Volume 1 Attachment A incorporates a generic risk tree model that determines the probability of aircraft loss due to non-aircraft guidance system failure as Pa = 3 x 10-9. The statistical analysis used assumes no equipment design errors and assumes the equipment is operating in its design state, i.e. it does not recognise the probability of maintenance human error.
1.8.13.4.2 Integrity Integrity is defined in Annex 10, part 3.1.1 Definitions:

That quality which relates to the trust which can be placed in the correctness of the information supplied by the facility. The level of integrity of the localizer or the glidepath is expressed in terms of the probability of not radiating false guidance signals.
In part 3.1.5.8.2 the level of integrity is given as,

Recommendation. - The probability of not radiating false guidance signals should not be less than 1 1.0 x 10-7 in any one landing for Facility Performance Category I glide paths.
This is a recommendation therefore it is not a mandatory requirement. Attachment C, part 2.1.2.3, links integrity, the classification system and operational use,
In order to fully exploit the potential benefits of modern aircraft automatic flight control systems there is a related need for a method of describing ground based ILS more completely
Page 68 of 203
CAA of NZ
31 August 2002

than can be achieved by reference solely to the Facility Performance Category. This is achieved by the ILS classification system using the 3 designated characters. It provides a description of those performance aspects which are required to be known from an operations viewpoint in order to decide the operational applications which a specific ILS could support.
And in part 2.8.2.6,

It is expected that the equipment MTBF (mean time between failures) is confirmed by evaluation in an operational environment to take account of the impact of operational factors, i.e. airport environment, inclement weather conditions, power availability, quality and frequency of maintenance.
1.8.14 Classification of ILS Installations ICAO Annex 10 Attachment C 2.14 provides for a classification system that may be used in conjunction with the facility performance category (I, II or III) to provide a more comprehensive method of describing an ILS. The level of integrity or continuity of service is described from 1 to 4: Level 1 describes a category I facility for which continuity of service is not demonstrated or is less than that required for level 2. A level 2 category I facility must have an integrity level of 1 10-7 in any one landing and a continuity of service of 1 4 x 10-6 in any period of 15 seconds and have an MTBO (mean time between outages) greater than 1000 hours. Levels 3 and 4 describe the required objective for Category II and III installations.
For currently installed systems, in the event that the level 2 integrity value is not available or cannot be readily calculated, Annex 10 suggests that it is necessary to at least perform a detailed analysis of the integrity to assure proper monitor fail safe operation.
1.8.15 Equipment Status at Faleolo The glideslope transmitter had been operating without a standby transmitter from the end of May 2000, as the standby system (transmitter one) had a fault with the SBO power amplifier. While excavating a ditch on the eastern side of runway 26 during the airfield improvement works programme, the airfield works contractor accidentally cut the ILS localizer power supply and communications cable. This resulted in the glidepath and localizer being withdrawn from service. The Tower Remote Status Indicator was also rendered unserviceable. Following repairs, the localizer was restored to service, however the glidepath remained unserviceable due to the data link card being damaged when the cable was severed. It was also discovered that the width monitor detector was faulty. Once the width monitor faults were isolated and repaired the system was checked and placed back into service, however, the tower remote status indicator was still inoperative.
31 August 2002
CAA of NZ
Page 69 of 203
CAA Occurrence No. 00/2518 When the glidepath was restored to service the equipment was inadvertently left in the control bypass mode, with the faulty transmitter (transmitter one) selected as the operating transmitter. Without the executive monitor being in control, and no glideslope status indication in the tower, there was no means for the tower to be aware that there was a fault on the glideslope transmitter. Investigation has shown that the tower remote status indicator system design is such that the air traffic controller will not have any indication whenever either or both the localiser or glidepath are selected to control bypass (monitor bypass).
1.8.16 Ergonomics of the equipment at Faleolo The tower remote status indicator in the tower at the controllers position has very dim lights, which are exceedingly difficult to see in daylight. There is no brilliance control for these lights. The audible alarm will sound any time a red light appears on the tower remote status indicator i.e. if a transfer or shut down takes place. The alarm is silenced by switching it off permanently by means of a toggle switch. As long as there is a red light on the panel and the switch is cycled to on, the alarm will sound constantly. This forces the air traffic controller to leave it in the off position until such time as the fault has been rectified by maintenance. If any further change of state takes place, the controllers attention will not be drawn to the fact audibly. The controller has no ability to shut down the ILS, or reset it. The glidepath and localiser cannot be selected independently either. The controller has NO indication if the equipment is left in control bypass (monitor bypass). This is not in compliance with the ICAO annex, CAA of New Zealand Rules or Ministry of Transport of Samoa Civil Aviation Regulations, which require the air traffic controller to be advised any time the executive monitor is not in control.
1.9
Communications
Samoa is located in the Pago Pago TMA (Samoa Sector), which extends from 3000 ft to FL 245. NADI Oceanic is responsible for the airspace above FL 245. Descent clearance for Faleolo is available from Pago Approach on VHF 126.9 during Pagos hours of watch. Outside Pagos hours of watch descent clearance for Faleolo is available from NADI on HF, or from Faleolo on VHF 118.5 if within VHF range. The Faleolo CTR commences at FALE and traffic information is available from Faleolo Approach on VHF 118.5. Faleolo Tower operates VHF frequency 118.1. There were no reported communications issues.
Page 70 of 203
CAA of NZ
31 August 2002
1.10 Aerodrome Information

Samoa is a group of 16 islands in the South Pacific. The two main islands are Upolu and Savai'i. Upolu is approximately 33 miles long by 13 miles wide with the highest point being Mount Fito at 3650 ft. Savai'i, 12 miles to the Northwest, has terrain rising to 6200 ft. Faleolo International airport is situated on the coast on the Northwest side of Upolu Island, approximately 17nm West of Apia. A mountain range to the South of the airport runs EastWest, the length of the island. A mountain 3.5 miles to the Southeast of the field rises to 2350 ft, the highest point of 3650 ft is 14 miles from the airfield. Terrain on either side of the approach rises to over 550 feet on the small island of Apolima to the north of the approach path, and over 450 feet on the island of Manono to the south of the approach path. Approaches into Faleolo are typical of many into Pacific airports, being over water and prone to the black hole effect at night.
Airport Location
Map of Samoa The runway, orientated 08-26, is 2700 metres long, 45 metres wide and has no parallel taxiway. Runway 08 has a turning bay abeam the threshold that is quite restrictive for widebody aircraft, and has no taxi guidelines. Runway 26 is accessed directly from the apron via a stub taxiway. The control tower is located to the South of the parking apron. There is a 150 metre stopway past the threshold of runway 08 and a 300 metre stopway past the threshold runway 26. Runway 08 has a marked downhill slope, from the threshold to about the halfway point it descends 49 ft. During approach to land this gives a visual illusion of the runway appearing to be longer than it actually is.
Jeppesen Sanderson Airport Chart - Faleolo The Samoa Airport Authority maintains the airfield and facilities. A comprehensive programme of improvements including runway and apron extension and resealing, construction of a new taxiway for runway 26 and enlargement of the turning node for runway 08 commenced at the beginning of June 2000 and was scheduled for completion in October 2000.
Page 72 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 The Samoan Director of Civil Aviation, under the Samoan Ministry of Transport, has regulatory authority for Faleolo Airport. The Samoan Civil Aviation Regulations 1998 came into force on the 1st of January 1999. Paragraph 3 of these Regulations adopted the Civil Aviation Rules of New Zealand. Samoan Civil Aviation Regulations (1998) state: Subject to paragraph 2, the Civil Aviation rules of New Zealand in force at the commencement date and subsequent amendments thereto shall be adopted as Regulations under the Act.
Manono Island
Apolima Island
Threshold Runway 08
Threshold Runway 26
View of Faleolo International Airport Looking West
31 August 2002
CAA of NZ
Page 73 of 203
1.11 Flight Recorders

1.11.1 Flight Data Recorder The Flight Data Recorder is a Solid State Allied Signal Aerospace (Honeywell) unit, part number 980-4120DXUS. Teledyne manufactures the Flight Data Acquisition Unit, part number 2227000-24B1, which supplies a 64 word per second data frame to the FDR. FDR data verified the crews report, the only discrepancy being the altitude at which the missed approach commenced. The aircrafts position at this point was approximately 5 nm short of the runway. Analysis of the FDR information revealed the following:
NOTE: Unless stated, all altitudes quoted are FDR Pressure Altitude values. Times quoted are as recorded by the FDR.
Data captured during descent and initial approach prior to localizer intercept showed no anomalies, except, at time 09:47:14, glide slope deviation showed at approximately 40o arc inbound toward the localizer that glideslope DDM value changed from a no valid data value, to an on glideslope value within 1 data frame (1 second). The normal indication expected should show DDM deviation slowly increasing or decreasing in value toward zero DDM, dependent upon position relative to glideslope, as the aircraft travels toward the glideslope. At time 09:49:51 FCC glideslope capture occurred 1 dot to the left of the localizer at 2690 ft, 220 KIAS, with approximately 700 fpm ROD. At this position the aircraft is approximately 1000 ft below the projected glideslope. Approximately 5 seconds after glideslope capture, the ROD increased to 1000 1100 fpm, and speed remained between 218 and 220 KIAS. Speedbrakes were extended from 2100 ft down to 1700 ft. The aircraft was configured at flap 20, gear down at 1350 ft. Landing flap was selected at 1000 ft. Throughout this portion of the descent ROD remained relatively constant at around 1100 fpm although ground speed was decreasing at a relatively constant rate from 215 knots at glideslope capture to 140 knots at the autopilot disconnect point. At time 09:52:00, the autopilot was disconnected at 420 ft PA (478 ft RA) with the ROD at 1100 fpm. The autothrottle remained engaged. Immediately after autopilot disconnect, N1s accelerated from 43%, through 50% 3 seconds later (ROD 896 fpm), reaching 100% (ROC 376 fpm) 7 seconds after autopilot disconnect. Minimum height during the go-around was 340 ft PA (384 ft RA). This was at approximately 5 miles from the threshold of runway 08. Gear was retracted at 360 ft PA (400 ft RA) ROC 1040 fpm. At the lowest point of the profile, the flight data recorder also recorded a loss of localizer signal for approximately 5 seconds. The aircraft climbed straight ahead to 2500 ft, then altered to a heading approximately 5o left of the inbound track, continuing to climb to 3500 ft, to a point approximately abeam the runway 08 threshold. The turn rate then increased to intercept the 340o FA VOR radial after which the aircraft then proceeded to join the 12 nm arc from the North for a second approach on runway 08.
Page 74 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 Throughout the approach, (from approximately 40o of arc South of the localizer) and go-around, the glideslope DDM showed an on glideslope value until the aircraft was abeam the runway. The glideslope DDM value then changed to no valid data within 1 data frame, but showed several spikes of an on glideslope value over the subsequent 30 seconds. During the second approach, positioning around the 12 nm arc from the North, the glideslope DDM value again changed from no valid data to an on glideslope value within 1 data frame, at around 40o of arc from the localizer and remained at an on glideslope value during the remainder of the approach and through the landing roll.
NOTE: This is consistent with the signal radiated from the glideslope antenna. The signal is a maximum in the direction of the approach falling to almost zero abeam the glideslope facility with a much-reduced signal behind the glideslope facility. It also falls off with distance from the glideslope facility. Beyond a sector of about plus or minus 40o at 15 miles the radio signal would be too low to activate the glideslope receiver. A typical facility will have a beam width of 30o to 60o. The ICAO requirement ( 8o) is much less.
The aircraft touched down off the second approach at time 10:06:00. From initial localizer capture to touchdown elapsed time was 16 minutes 19 seconds. Analysis of the profile for the first approach revealed a subtle steepening of the approach angle from approximately 3.3o, at glideslope capture, to 4.3o prior to the commencement of the missed approach. This would account for the steady rate-ofdescent despite the reducing ground speed.
3500
LLZ CAPTURE (225/672 FPM) FLAP 1 (220/704 FPM)
3000
2500
G/S CAPTURE (218/ 1072 FPM) 14 DME FA (approximate) (12.5 IAP DME) VHF TRANSMISSION
PLANNED PROFILE F5 FLAP 5 (213/1152 FPM) G/S CAPTURE LOW DRAG APPROACH
ALTITUDE (FEET)
2000
SPOILERS VHF
FLAP 15 GEAR DOWN (200/1104 FPM) GEAR LOCKED DOWN (187/1008 FPM) FLAP 20 FLAP 25 (169/1024 FPM) FLAP 30 (155/1040)
IAP G/S
1500
1000
CALCULATED 3.5 TERRAIN 0.5nm LEFT
7.3 DME FA (approximate) (5.8 IAP DME)
LAND 3 500
580'
0 1 6 11 16 21 26 31 36 41 46 51 56 61 66 71 76 81 86 91 96 101 106 111 116 121

TIME (SECONDS)
AUTOPILOT DISCONNECT - 7.5 NM (142/1152 FPM)
VHF GEAR UP
126
131
136
141
146
151
156
161
166
171
176
181
NZ 60 Profile - First Approach Apia

NOTE: Distances shown on the above profile are approximate. The FDR fitted to ZK-NCJ does not record DME. Distances were computed using IRS longitudinal information adjusted for latitude and corrected for the residual error.
31 August 2002
CAA of NZ
Page 75 of 203
186
Flight Path of NZ 60
Page 76 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.11.2 Cockpit Voice Recorder The Cockpit Voice Recorder data was not preserved. SOP requires the CVR circuit breaker to be pulled for a serious incident. The crew interpreted the event according to Company occurrence reporting instructions as an incident and their subsequent actions were taken in accordance with those instructions. As required by Company procedures they raised an Operations Occurrence Report. They also filed a Facility Malfunction report with Faleolo tower and requested a NOTAM be raised. On return to Auckland the Captain also followed up the initial notification by contacting the Company Duty Line Manager.
1.12 Wreckage and Impact Information

Nil.
1.13 Medical and Pathological Information

1.13.1 Medical Certificates All three pilots hold a valid class 1 medical certificate.
1.13.2 Fatigue Air New Zealand, through the Flight Crew Fatigue Reporting process and Fatigue Management Programme, maintains a database of all reported fatigue events. A review of this database shows that there are no recorded fatigue reports with respect to the AKL APW sector around the time of day at which this incident occurred. A review of the achieved roster patterns, including duty and flight hours for all flight crew members preceding the date of the incident and the day of the incident, indicates that: Sufficient rest periods had been provided to ensure that the flight crew were well rested. The type of duties performed by all three flight crew members for the 8 days preceding this incident preclude circadian disruption as being a contributory cause.
A member of the Company Flight Crew Fatigue Study Group conducted a post-incident interview with the flight crew. Subsequent to the interview the Flight Crew Fatigue Study Group determined that fatigue was not contributory to this incident.
1.13.3 Other Relevant Physiological Information The crew reported no significant personal, domestic or other individual concerns that may have had an impact on this incident.
31 August 2002
CAA of NZ
Page 77 of 203
1.14 Fire
There was no fire associated with this incident.
1.15 Survival Aspects

Not applicable.
1.16 Tests and Research

1.16.1 Proving Flight One On 16th August 2000, the ILS for runway 05 at Auckland was notified as being removed from service via NOTAM and ATIS, and Airways Corporation technicians disabled the glideslope SBO transmission, leaving only CSB transmission radiating with a DDM value of approximately 0.0016. The purpose of the proving flight was to: replicate and capture the flight deck glideslope indications as reported at Faleolo. observe the effects of an autocoupled approach with the ILS glideslope radiating CSB only. identify possible defences that may be valid for a similar condition.
Boeing 767-319 ZK-NCL flew five approaches in various configurations. During each approach as the aircraft established inbound, the glideslope indication materialised on the EADI indicating on glideslope and throughout the approach remained indicating on glideslope, regardless of position relative to the true glideslope. Glideslope capture consistently occurred very shortly after APP was armed.
Page 78 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.16.1.1 First Approach Flap 1, 200 KIAS The first profile was flown to replicate the aircraft entry speed and configuration as at Faleolo. The aircraft was positioned around an arc from the South to intercept the localizer for runway 05. At glideslope capture the aircraft was at 2800 ft altitude and at 9.3 DME, with a ROD of 600 fpm. The transition to glideslope capture occurred from the Vertical Speed mode with the left autopilot engaged in CMD. From glideslope capture the aircraft assumed a ROD of 1000 fpm which decreased throughout the profile to a point 7.8 track miles after glideslope capture where the aircraft was at 1480 ft altitude and in level flight.
3500
10 DME
3000
F1
2500
1020 FPM
ALTITUDE (FEET)
G/S CAPTURE
F5
TRUE GLIDESLOPE
2000
GEAR F20
1500
3 DME
1000
500
0 101 106 111 116 121 126 131 136 141 146 151 156 161 166 171 176 181
TIME (SECONDS)
0 .0 1
0 .00 5
DDM VALUE
-0 .0 0 5
-0 .0 1
-0 .0 1 5
-0 .0 2
T IM E (S E C O N D S )
Proving Flight One Profile One
31 August 2002
CAA of NZ
Page 79 of 203
186
11
16
21
26
31
36
41
46
51
56
61
66
71
76
81
86
91
96
CAA Occurrence No. 00/2518 1.16.1.2 Second Approach Flap 20 165 KIAS The second profile was made to attempt to ascertain the influence of flap configuration on aircraft pitch attitude and trim and to capture the glideslope sector from the Northern side of the localizer. Off an arc from the North, the aircraft was positioned to intercept the glideslope at 2500 ft, 12 DME, flap 20 at 165 KIAS. Glideslope capture transitioned from the Vertical Speed mode with an entry ROD of 500 fpm. Immediately after glideslope capture the ROD increased to 700 fpm. During the descent the ROD slowly decreased. Glideslope capture occurred some 1000 ft below the actual glideslope. The aircraft remained on a below glideslope profile, and LAND 3 was annunciated on the Autoland Status Annunciator panel at 1500 ft RA. The aircraft descended on a shallow profile, losing approximately 1100 ft in 5.5 track miles.
3000
x
2500
G/S CAPTURE
720 FPM
GLIDESLOPE
10 DME 9 DME
ALTITUDE (FEET)
2000
7 DME 1500
1000
LAND 3
500
0 1 5 9 13 17 21 25 29 33 37 41 45 49 53 57 61 65 69 73 77 81 85 89 93 97 101 105 109 113 117 121 125 129
TIME (SECONDS)
Proving Flight One Profile Two
Page 80 of 203
CAA of NZ
31 August 2002
133
CAA Occurrence No. 00/2518 1.16.1.3 Third Approach Flaps Up 240 KIAS For the third approach the aircraft was positioned to intercept the glideslope from the altitude capture mode to ascertain whether the aircraft would pitch down at the glideslope capture point. The aircraft was positioned at the glideslope capture point at flap up, 240 KIAS. At glideslope capture the ROD was 200 fpm in a level-off manoeuvre. After glideslope capture the aircraft slowly drifted down initially then commenced a gentle climb.
3000
2500
2000
ALTITUDE (FEET)
1500
1000
500
0 1 4 7 10 13 16 19 22 25 28 31 34 37 40 43 46 49 52 55 58 61 64 67 70 73 76 79 82 85 88 91
TIME (SECONDS)
Proving Flight One Profile Three
31 August 2002
CAA of NZ
Page 81 of 203
94
CAA Occurrence No. 00/2518 1.16.1.4 Fourth Approach Flap 5 180 KIAS For the fourth approach the aircraft was positioned above the true glideslope in the Vertical Speed mode and with a ROD of 1500 fpm selected. At the glideslope capture point the ROD decreased to 1200 fpm. During descent the ROD slowly bled back to 1000 fpm until the go around point.
5000 4500 4000 3500
ALTITUDE (FEET)
3000 2500 2000 1500 1000 500 0 1 6 11 16 21 26 31 36 41 46 51 56 61 66 71 76 81 86 91 96 101 106 111 116 121 126 131 136 141 146 151 156 161 166 171 176
TIME (SECONDS)
Proving Flight One Profile Four
Page 82 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.16.1.5 Fifth Approach Flap 20 160 KIAS For the fifth approach the DDM value was varied from the ground to establish whether the residual DDM value could affect the aircraft flight path. Transition to glideslope capture occurred from Altitude Hold mode. Glideslope capture occurred with the aircraft in level flight at 160 knots and with the flaps at 20. Subsequent to glideslope capture there was no change in flap position and little change in airspeed or thrust setting. It was noted that varying the DDM value would vary the aircraft profile.
2600
2500
2400
ALTITUDE (FEET)
2300
2200
2100
2000
1900 1 5 9 13 17 21 25 29 33 37 41 45 49 53 57 61 65 69 73 77 81 85 89 93 97 101 105 109 113 117 121 125 129 133 137 141 145
TIME (SECONDS)
0.06
0.05
0.04
0.03
0.02
DDM VALE
0.01
-0.01
-0.02
-0.03
-0.04
TIME (SECONDS)
Proving Flight One Profile Five
31 August 2002
CAA of NZ
149
Page 83 of 203
CAA Occurrence No. 00/2518 From the data obtained from proving flight one, the following points were established: The aircraft captured and recorded an erroneous glide path with flight deck indications very similar to the Faleolo incident. What was not replicated was the profile flown at Faleolo, analysis of which, using ROD versus ground speed, had revealed a subtle increase of the approach angle from approximately 3.3o, at glideslope capture, to 4.3o prior to the commencement of the missed approach. The median descent profile was approximately 3.5o from the point of glide slope capture through to the missed approach point.
On the proving flight, at G/S capture, the aircraft commenced the majority of descents with a profile of approximately 3o that subsequently flattened out and in some cases, commenced a climb while still indicating on glideslope. The initial suspicion was that these profiles were a result of trim changes as the aircraft was reconfigured. The FDR data from the proving flight was subsequently re-analysed and a discrepancy in the polarity of the DDM values was noted. At Faleolo a consistent positive value (fly down) was recorded. At AKL, a negative DDM (fly up) value was noted. Whilst the DDM values recorded are small, they are greater than the sensitivity values of the ILS receiver and FCC. It was noted from the two flights that there was a strong similarity in the DDM values, both small and averaging approximately 0.0016 DDM. While the FDR from ZK-NCJ records a very static set of values from Faleolo, the FDR from ZK-NCL shows a more random spread of values. It is not known whether this is a function of the different Flight Data Recorders used, or a function of the transmission patterns of a Toshiba glide path system versus a Phillips installation. Two different aircraft were used on two different ILS installations while this may be significant, it is considered unlikely. Further analysis of the data from profile five indicated that the unbalanced value of the CSB DDM value (positive versus negative) was the most likely cause of the profiles differing from that recorded at Faleolo. To validate this supposition a second proving flight was scheduled.
Page 84 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.16.2 Proving Flight Two A second proving flight was carried out at Auckland on the 25th August 2000, for the following purposes: To validate, or otherwise, the positive/negative DDM hypothesis. To replicate the Faleolo profile. To determine the time taken to configure the aircraft for landing on a similar profile to that encountered at Faleolo. To capture the cockpit indications of normal glideslope indications on the arc and inbound, to identify potential defences for detecting an erroneous glideslope signal. To investigate the manner in which the aircraft captures the glideslope. To establish whether the localizer may generate a similar erroneous path.
The second proving flight was carried out using ZK-NCL, the same aircraft as used for the first proving flight. A total of eight approaches were flown with the aircraft landing from the final run. Various scenarios were specified using fly down and fly up values, and a similar study was carried out with the localizer transmitting CSB only. All profiles were pre-planned and commenced with the aircraft configured with Flap 1 and 220 knots indicated airspeed to replicate the Faleolo incident.
31 August 2002
CAA of NZ
Page 85 of 203
CAA Occurrence No. 00/2518 1.16.2.1 First Approach Flap 1, 220 KIAS, Fly Down DDM (0.007) The automatics captured the glideslope as expected. In apparent response to the fly down signal, the aircraft continuously pitched down on a steepening approach that commenced at approximately 3.5o and reached 8.5o toward the end. ROD increased throughout the approach from 1200 fpm to 3000 fpm. Despite the deployment of speedbrakes and extension of landing gear, the aircraft could not be slowed and configured for landing.
6000
5000
4000
G/S CAPTURE
ALTITUDE (FEET)
3000
2000
1000
0 1 5 9 13 17 21 25 29 33 37 41 45 49 53 57 61 65 69 73 77 81 85 89 93 97 101 105 109 113 117
TIME (SECONDS)
Proving Flight Two Profile One
Page 86 of 203
CAA of NZ
31 August 2002
121
CAA Occurrence No. 00/2518 1.16.2.2 Second Approach Flap 1, 220 KIAS, Fly Down DDM (0.0016) Having verified the hypothesis with respect to the plus and minus DDM values, this profile was expected to closely replicate the profile encountered by the crew at Faleolo. This was achieved with a reasonably constant ROD of 1200 fpm. Speedbrakes were deployed and landing gear extended early to slow the aircraft, with landing configuration being reached some 2700 ft after glideslope capture. Analysis of the glideslope angle revealed an angle of 3o at glideslope capture increasing to over 6.5o at the bottom. The steeper angle of this approach was most likely attributable to the fly down signal being slightly greater than that encountered at Faleolo.
5000
4500
4000
3500
ALTITUDE (FEET)
3000
2500
2000
1500
1000
500
0 1 5 9 13 17 21 25 29 33 37 41 45 49 53 57 61 65 69 73 77 81 85 89 93 97 101 105 109 113 117 121 125 129
TIME (SECONDS)
Proving Flight Two Profile Two
31 August 2002
CAA of NZ
Page 87 of 203
133
CAA Occurrence No. 00/2518 1.16.2.3 Third Approach Flap 1, 220 KIAS, Fly Up DDM (-0.0016) As experienced on proving flight one, the aircraft commenced an approach and gently flattened out. The aircraft descended some 1600 ft before reaching straight and level flight, subsequently climbing away as the landing configuration was reached.
4600
4400
4200
ALTITUDE (FEET)
4000
3800
3600
3400 1 4 7 10 13 16 19 22 25 28 31 34 37 40 43 46 49 52 55 58 61 64 67 70 73 76 79 82 85 88 91 94 97 100 103 106
TIME (SECONDS)
Proving Flight Two Profile Three
Page 88 of 203
CAA of NZ
31 August 2002
109
CAA Occurrence No. 00/2518 1.16.2.4 Fourth Approach Flap 1, 220 KIAS, Fly Up DDM (Auckland normal DDM) The Auckland runway 05 ILS glideslope CSB signal is biased with a fly up DDM of approximately 0.0016 to trim the cumulative signal and generate the required glideslope angle. As expected, the approach flattened and the aircraft subsequently flew away. In this case, only 250 ft of altitude was lost prior to the aircraft climbing.
4650 4600 4550 4500
ALTITUDE (FEET)
4450 4400 4350 4300 4250 4200 4150 1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39 41 43 45 47 49 51
TIME (SECONDS)
Proving Flight Two Profile Four
31 August 2002
CAA of NZ
Page 89 of 203
53
CAA Occurrence No. 00/2518 1.16.2.5 Fifth Approach Flap 1, 220 KIAS, Localizer and Glideslope CSB Only It was understood that there is no technical reason why the localizer cannot transmit the same erroneous path. To test this hypothesis, the glideslope CSB signal was returned to a fly down DDM, and the localizer left transmitting a CSB only. From an intercept heading of 080o and with an on-track indication, the APP mode was armed, resulting in an instantaneous G/S and localizer capture. The aircraft turned left to 043o then turned right on to a heading of 053o and finally stabilised on a heading of 058o. There was an initial suspicion that there was some logic related to the selected front course of 051o, and a second profile was flown to better understand this. Of interest on this first localizer profile was the recording again of a steepening vertical profile.
90
80
70
60
HEADING
50
40
30
20
10
0 1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39 41 43 45 47 49 51 53 55 57 59 61 63 65 67 69 71 73 75
TIME (SECONDS)
4800
4600
4400
ALTITUDE (FEET)
4200
4000
3800
3600 1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39 41 43 45 47 49 51 53 55 57 59 61 63 65 67 69 71 73 75
TIME (SECONDS)
Proving Flight Two Profile Five
Page 90 of 203
CAA of NZ
31 August 2002
77
77
CAA Occurrence No. 00/2518 1.16.2.6 Sixth Approach Flap 1, 220 KIAS, Localizer CSB Only On the second localizer profile, the localizer was armed and captured from a heading of 016o. A right turn onto a heading of 042o followed, with a subsequent left turn onto 021o, stabilising on 020o with a very slight bias towards further small turns to the left. With an on-track indication on the EADI, the aircraft flew through the centreline of Runway 05 towards the rising terrain to the Northwest of the airfield.
45
40
35
30
HEADING
25
20
15
LOC CAPTURE
10
0 1 6 11 16 21 26 31 36 41 46 51 56 61 66 71 76 81 86 91 96 101 106 111 116 121 126 131 136 141 146 151 156 161
TIME (SECONDS)
Proving Flight Two Profile Six
31 August 2002
CAA of NZ
Page 91 of 203
166
CAA Occurrence No. 00/2518 1.16.2.7 Seventh Approach Flap 1, 220 KIAS, Normal Glideslope and Localizer Transmission Profile 7 was flown with the ILS restored to normal operation. The aircraft positioned around the northern arc to observe normal indications. As the aircraft travelled around the arc toward the localizer the Standby Attitude Indicators glideslope deviation indicator moved erratically as it caught the false slopes off other lobes. This was unlike the steady on glideslope indication noted around the arc on the previous proving flight. As anticipated, no glideslope information appeared on the EADI until the track was within 90o of the selected front course. Once the EADI glideslope deviation indication was displayed, normal movement of the glideslope deviation indicator was observed as the aircraft approached the glideslope from below.
3000
2500
2000
ALTITUDE (FEET)
1500
1000
500
TIME (SECONDS)
Proving Flight Two Profile Seven
Page 92 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.16.2.8 Eighth Approach Flap 1, 220 KIAS, Normal Glideslope and Localizer Transmission
A DDM value of 0.01 DDM was noted at glideslope capture.
3000
2500
2000
ALTITUDE (FEET)
1500
1000
500
0 1 7 13 19 25 31 37 43 49 55 61 67 73 79 85 91 97 103 109 115 121 127 133 139 145 151 157 163 169 175 181 187 193 199 205 211 217 223
TIME (SECONDS)
Proving Flight Two Profile Eight
1.16.3 Simulator Detail To establish the time and altitude it would take a crew to configure the aircraft for landing under similar circumstances as at Faleolo, two approach profiles were flown in the simulator using the Vertical Speed mode to control the ROD at 1100 fpm. Entry to glideslope capture was at Flap 1 220 KIAS. The time taken to configure the aircraft and the workload of the crew were consistent with the data obtained from the Faleolo flight and from the results obtained from proving flight two.
31 August 2002
CAA of NZ
Page 93 of 203
229
1.17 Organisational and Management Information

1.17.1 Airline Management System The Airline Management System is documented in the following manuals: Airline Management System Manual Flight Operations Management Manual Airline General Procedures Quality Branch Procedures Manual Line Branch Procedures Manual Responsibilities within the management system are clearly defined and delegated. Air New Zealand obtained its Airline Operators Certificate under NZCAR Part 121 on the 8th June 2000 after a series of entry audits by CAANZ Inspectors.
1.17.2 Air New Zealand Safety Programme NZCAR 119.79:

The internal quality assurance system shall include (1) (2) a safety policy and safety policy procedures, including the procedure for occurrence investigations conducted in accordance with Part 12; and a procedure to ensure quality indicators, including defect and incident reports, and personnel and customer feedback, are monitored to identify existing problems or potential causes of problems within the system; and a procedure for corrective action to ensure existing problems that have been identified within the system are corrected; and a procedure for preventive action to ensure that potential causes of problems that have been identified within the system are remedied; and an internal audit programme to audit the applicants organisation for conformity with the procedures in its exposition and achievement of the goals set in its safety policy; and management review procedures that may, where appropriate, include the use of statistical analysis, to ensure the continuing suitability and effectiveness of the internal quality assurance system in satisfying the requirements of this part.
(3) (4) (5) (6)
The Safety Programme consists of audits, including Line Orientated Safety Audits (LOSA), and incident reporting and customer feedback from personnel. Audits ensure conformance with published procedures. Incidents are investigated internally and seek deficient or inadequate procedures. The safety programme is monitored by measurement of specified indicators. Regular managerial review of incidents and preventive and corrective actions monitors the effectiveness of the system. Because of the compatibility with the CAANZ reporting system, but also for the emphasis on human factors and cause analysis, Aviation Quality Database (AQD) is the safety/quality management software tool used by Air New Zealand to assist in safety management.
CAA Occurrence No. 00/2518 The need to ensure that the organisational culture encouraged free and open reporting was identified during the introduction of AQD. To ensure the correct climate was created, Flight Operations formally adopted a widely accepted programme that defines a just culture. It is important to note that the basic precepts of just culture are accepted by CAANZ. Operations policies are aimed at reducing the likelihood of error, trapping errors before they have an operational effect, mitigating the consequences of errors when they do occur and are reliant on the feedback obtained from the Occurrence Reporting System. Current Air New Zealand Human Resource Policies and Procedures do not formally recognise human fallibility, nor do they have a non-punitive policy with regard to normal error.
1.17.3 Incident Reporting Policy NZCAR Part 12 requires reporting and investigation of incidents as defined by Part 12 and amplified by AC12-1 Mandatory Occurrence Notification and Information and AC12-2 Incident Investigation. Air New Zealand complies with this requirement with AQD. Aviation Quality Database is the means by which data is captured, reported to CAANZ, investigated and analysed. Incident reports are provided by staff feedback. Flight Data is captured on a routine basis for Engineering purposes only. The Air New Zealand Group incident reporting policy is documented in the Airline Management System Manual.
31 August 2002
CAA of NZ
Page 95 of 203
CAA Occurrence No. 00/2518 1.17.4 Samoa Airport Authority During investigation at Faleolo Airport it was established that the ILS equipment was 14 years old. Whilst kept in the best possible condition under the circumstances by the technician, it was becoming more difficult to obtain spares due to the age of the equipment. In addition, the Uninterrupted Power Supply had deteriorated to such a degree that the batteries were unable to back up the ILS in the event of a complete power failure. It was also discovered that some of the test equipment was inadequate for full maintenance of the ILS and that some of the equipment calibration dates had expired. This was explained by the remoteness of the island and the lack of outside assistance with technical matters. Previously, a maintenance contract had been in place with Airways New Zealand. The contract had included calibration of instruments, competency checking of technicians, the handling of jobs beyond their capability and calibration flights. At the time of the investigation, the contract with Airways New Zealand had expired. Calibration flights were being carried out by the FAA, and then only when the aircraft visited American Samoa. The technician was qualified to carry out routine maintenance of the ILS but not in depth maintenance. He had an assistant who was qualified to a lower level and needed to work under supervision. Due to this he was unable to take more than 21 working days leave during September 1997, in the period November 1994 to February 2001. No other leave period exceeded 5 working days during this 6 year period. When leave was granted it was normally taken on the island and was often interrupted by call outs, due to the fact that the junior technician was not qualified to handle the jobs on his own.
Page 96 of 203
CAA of NZ
31 August 2002
1.18 Additional Information

1.18.1 Air New Zealand Pilot Selection and Training Air New Zealand does not train ab initio pilots but relies upon suitably qualified candidates from external sources to fulfil recruiting requirements. Successful candidates undergo a Pilot Introductory Programme (PIP) course prior to a type-rating course. Type-rating training assumes the trainee has multi-engine jet turbine powered aircraft operating experience and is familiar with basic jet aircraft systems and pilot techniques common to jet aircraft.
1.18.2 Crew Resource Management Programme Air New Zealands CRM policy is defined as follows:
CRM comprises all the knowledge, skills, and roles used to most effectively direct, control and coordinate all available resources towards safe and efficient operations. CRM is a safeguard against human error and is a useful tool to minimise the effect of error on aircraft operations. Air New Zealand accepts that honest human error is inevitable, it does not accept any notion of carelessness or negligence. CRM does not attempt to replace any of Air New Zealands high technical standards, nor can it be used to circumvent any standard operating procedures or legal requirements. The correct implementation of CRM practices by Flight and Cabin crews provides one of the most effective strategies for airline safety.
Air New Zealands CRM training programme consists of an introductory module during the Pilot Induction Programme (PIP) course, followed by a 3-day live-in course within the first nine months of joining. This course and upgrade (S/O to F/O and F/O to Command) courses are a targeted programme utilising actual crew error data from the Line Orientated Safety Audit (1998). CRM modules are also taught during Recurrent and Emergency Procedures training and are integral to recurrent training simulator details. CRM skills and practices are also evaluated during annual route checks and all recurrent training simulator details. Air New Zealands fundamental premise for CRM training is error management. The core skills taught to manage errors are leadership, vigilance, planning, contingency preparation, tasks prioritisation, speaking up, asking questions and briefings. Sub-sets of Air New Zealands leadership training are regulating information flow, coordinating crew activities, motivating crew members and decision-making.
31 August 2002
CAA of NZ
Page 97 of 203
CAA Occurrence No. 00/2518 1.18.3 Operational Documentation 1.18.3.1 B767 Operations Manuals The aircraft Operations Manual is structured in 3 volumes, with a Quick Reference Handbook supplementing the OM Volume 1. Operations Manual Volume 1 contains Fleet Differences and B767 specific Normal and Supplementary Normal procedures. Standard Operating Procedures are also contained within the Operations Manual Volume One cover. Operations Manual Volume 2 contains B767 general and aircraft systems information, covering controls and indicators, and system description. Operations Manual Volume 3 deals with most aspects of B767 aircraft performance. The purpose of Operations Manuals is to: Provide the necessary operating limitations, procedures, performance and systems information for the flight crew to safely and efficiently operate the B767 aircraft during all anticipated airline operations. Serve as a comprehensive reference for use during conversion training on the B767 aircraft. Serve as a review guide for use in recurrent training and proficiency checks. Provide the necessary operational data from the FAA approved Aircraft Flight Manual (AFM) to ensure that legal requirements are satisfied. Establish standard procedures and practices to enhance operational philosophy and policy.
The Operations Manuals are written under the assumption that the user has multiturbine-engine aircraft experience and is familiar with basic jet aircraft systems and pilot techniques common to aircraft of this type. The Operations Manuals do not contain information that is considered to be prerequisite to B767 type training. The B767 Operations Manual Volumes 1 and 2 utilise a Boeing produced Operations Manual as the base document to produce an Air New Zealand customised Manual suite containing Air New Zealand specific procedures and information in addition to information provided by Boeing. Boeing amendments to the base document are evaluated and incorporated into the Air New Zealand manual suite during the amendment process. Boeing has recently changed manual size from American Letter to A5, a standard that Air New Zealand is now in the process of adopting. Due to the changeover between manuals, some information contained in previous Boeing amendments has not yet been incorporated.
Page 98 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.18.3.2 Standard Operating Procedures Air New Zealand Standard Operating Procedures (SOPs) are Company approved procedures for use by all fleets. The chapters are issued independently of, but are contained in and structured similarly to the Aircraft Operations Manual Volume 1. SOPs are issued to all crew. The Standard Operating Procedures committee is responsible for developing SOPs to: Define an operating policy and establish standard procedures and practices across the fleets to enhance operational philosophy. Provide information for the flight crew to enable a standard, safe and efficient operation of all company aircraft.
The following SOP were considered to be relevant to this occurrence: 1.18.3.2.1 Flight Deck Management (1.1.1)
The proper execution of any flight demands constant situation awareness, frequent cross checking, and sharing of information. Each flight crew member is expected to communicate any significant operational development immediately. This should be accomplished in a positive but respectful manner. In the interests of flight safety, at all times the primary role of the flight crew is to operate the aircraft and manage the flight. Extraneous activities, which detract from these tasks, should be discouraged. In high traffic density airspace, particularly below 10,000 ft AGL, all crew members should have a full situational awareness. Paperwork and non-operational conversation should be kept to a minimum. No crew member shall perform any duty during a critical phase of flight* except those duties required for the safe operation of the aircraft. Flight crew are responsible for bringing to the attention of the PIC, anything significant with which they disagree or that causes them concern. Correct decisions are dependent upon accurate definition of the occurrence. It is incumbent upon all crew to ensure that the occurrence is clearly defined and, whenever possible, agreed upon before arriving at and acting on decisions. This requirement encourages crew participation so all crew members will be aware of the factors that could affect subsequent decisions. The responsibility for "initiation, continuation, diversion or termination of a flight" is vested in the PIC. * Civil Aviation Regulations define critical phase of flight as: for flight crew members, all operations involving pushback, taxi, takeoff, approach and landing, and all other air operations conducted below 10,000 ft, except in cruise flight
31 August 2002
CAA of NZ
Page 99 of 203
CAA Occurrence No. 00/2518 1.18.3.2.2 PF & PNF (including Supplementary Pilot) Duties (1.1.4)
Allocation of PF and PNF duties is at the discretion of the Captain. The Captain must be cognisant of the responsibility to ensure all crew members are kept within the crew loop, and that subordinate crew are given maximum opportunity to further their experience in decision-making through command practice. The PIC retains full authority for all actions directed and performed throughout the flight. The following restrictions apply: 1. 2. The PF and PNF must occupy their allocated seats prior to the reading of the Before Start Checklist (Cockpit Preparation Checklist - B767). When the F/O is PF, the Captain performs the duties under PNF from the completion of the After Start Checklist (B732 & B733 from start of the take-off roll to the end of landing roll only). The third pilot (Capt, F/O or S/O) may carry out either the Captains or the F/Os preflight duties, prior to the reading of the Before Start Checklist (Cockpit Preparation B767). The S/O may occupy either pilots seat, as PF or PNF, above either: or transition level/altitude, whichever is the higher. 5. The Capt is to be PF when: or In-Flight Emergency Normally the PIC will fly the aircraft; however, this does not prevent the PIC, using best Crew Resource Management practices, from nominating another pilot in the crew to fly the aircraft. Responsibilities of Supplementary Crew Whilst our aircraft were designed for two-pilot operation, because of sector lengths, supplementary crew will sometimes be carried. Supplementary crew may be of any rank, and when carried, their responsibilities are: 1. 2. 3. 4. To participate in briefings, and actively monitor the flight path of the aircraft and actions of the PF and PNF. Maintain an operational awareness and lookout. Bring to the attention of the operating crew any abnormalities or departure from SOPs and previously briefed intentions. Duties as delegated by the PIC. (Examples: preflight checks, operation of ACARS, carrying out takeoff calculations, radio work and paperwork). After shutdown (and not before); assist, as delegated, with post flight paperwork and ACARS operation. On approach & landing when the cloud base is reported below 300ft and/or the visibility less than 1200m. On takeoff the reported visibility is less than 800m, 10,000 ft,
3.
4.
Supplementary crew duties are to be specified by the PIC and care must be taken to ensure that all aspects of the operation are covered. As an example, a supplementary pilot will be used at the busy time of pre-departure, but responsibility for various checks must be clearly defined by the PIC e.g. circuit breaker and overhead maintenance panels, external walk-around, radio checks etc.
Page 100 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.18.3.2.3 Briefings Policy (1.1.10)

The briefings will normally be given by the PF, but the PIC may, with discretion, elect to carry out any or all of the briefings. Although briefings are primarily a Captain's responsibility, other crew members may add significantly to planning, and identification of problem areas. An effective briefing is operationally thorough, interesting, and addresses co-ordination, planning, and identifies any problems. Open communications should be encouraged. Briefings for Takeoff, Cruise (international operations only), crew changeover, and Descent Approach are mandatory and detailed in the appropriate phase-of-flight section. The suggested headings are given for guidance and crew members should consider these and add others as they think necessary. Coverage should be kept brief and to the point. Those crew members required to be on the flight deck for departure and arrival must be involved in the appropriate briefing.
1.18.3.2.4 Automation Philosophy (1.3.1)

Automation is the replacement of the human function, either manual or cognitive, with a machine function. The sole purpose of automation is to aid flight crew in doing their job. Flight crew are the most complex, capable and flexible components of the air transport system, and are best suited to determine the optimal use of resources in any given situation. They must be proficient in operating their aircraft in all levels of automation, and must have the skills needed to move from one level of automation to another. Automation must be used at the level most appropriate to enhance the priorities of Safety, Passenger Comfort, Public Relations, Schedule and Economy. Use of Automation The following guidelines will assist flight crew in determining and using the appropriate level of automation: The PIC shall specify Pilot Flying (PF) and Pilot Not Flying (PNF) duties and responsibilities with regard to automated systems use. Programming actions and changes to automation status should be verbal and acknowledged. Flight crew should consider that all automated systems are dumb, dutiful, and inflexible. Pilots must continually evaluate the automatics and what it is doing. Be prepared to make changes. Timely and efficient use of the appropriate level of automation will allow other matters requiring attention to be dealt with more effectively. Pilots should ensure that all operating crew members are aware of the current status as well as any changes made in the use of automated systems. Should a pilot feel uncomfortable with the level or use of automation, either more information is necessary or something is wrong. The pilot in this situation shall ask for additional information or propose an alternative plan. Flight crew should plan ahead, using the low workload periods of flight effectively, and avoid programming during departures and arrivals. Flight crew should disengage the automatics or change the level of automation in use when programming demands could create work overload. Flight crew shall recognise that work overload creates stress and reduces situational awareness. It is better to sacrifice the automation than situational awareness, especially at low altitude.
31 August 2002
CAA of NZ
Page 101 of 203

Automation occasionally fails. Periodically hand-fly the aircraft to maintain basic flying skills. Use of automated systems can possibly create conflict. Communication skills assume even greater importance under automation, where traditional forms of feedback are reduced. Remember, when using any level of automation, pilots always have the capability to: ask the other operating crew for help. revert to a lower level. disengage it. reactivate.
1.18.3.2.5 Autoflight System (EFIS) (1.3.4)

Autopilot Flight Director System (AFDS) Use of automatic modern equipment, produces a man-machine interface problem referred to as automatic complacency. It is important to be synchronized with automatic systems. Plan - program - confirm - monitor and correct if necessary. Proper monitoring of the AFDS modes is essential. Both pilots must monitor mode annunciations. Do not refer to the MCP for mode annunciation. Whenever possible, the FMS should be used and coupled to the autopilot and autothrottle. The AFDS shall be operated in such a way that optimum benefit is taken of its capabilities. Automatic Modes Engaged When the autopilot is in use, any MCP selections, that affect flight path, are made by the PF.
The PF will make and simultaneously call all changes so the PNF is aware and can confirm the change on the PNFs FMA.
Calls and/or confirmation of mode change and action should be postponed if they would interfere with radio communication or non-normal procedures.
Page 102 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.18.3.2.6 Terrain Avoidance (1.4.2)

To mitigate the risk of controlled flight into terrain (CFIT) the following shall apply: the aircraft is to be operated in accordance with SOP 2.6, Stable Approach, no checklist action is to be commenced below 400 ft above airfield elevation, all non precision approaches are to be flown using a continuous descent profile, circling approach is to be flown not lower than the State minima or 1000 ft above airfield elevation, except as specified in the Route Guide for specific airports, An instrument approach shall not be commenced, nor a landing approach continued below 1000 ft above airfield elevation, with any unresolved discrepancies or operational issues, all GPWS Cautions and Warnings shall be acted upon, in the event that a GPWS terrain closure "pull up" warning occurs, maximum available thrust should be applied and the aircraft rotated to achieve the best climb angle. This should be maintained until the aircraft is above minimum safe altitude and the warning ceases.
1.18.3.2.7 FMS and CDU Operation (1.4.6)

Flight Management System (FMS) and Control Display Unit (CDU) Operation Modifications to the lateral or vertical flight path, as requested by the PF, are actioned by the PNF when the aircraft is being flown manually. When an autopilot is engaged, the PF directs the change which either pilot may action. If CDU manipulation will affect the current aircraft flight path, the accuracy of the change must be confirmed from the CDU and HSI/ND prior to execution. The pilot carrying out the modification will call VERIFY, and the pilot confirming the modification will call EXECUTE. Manipulation of the CDU should be accomplished prior to high workload periods such as departure, arrival, or holding. During such periods, manipulation of autopilot modes such as heading select, flight level change, and the altitude/speed intervention features along with the HSI MAP, may be safer than making complex CDU changes. FMC modification should always be commensurate with workload. It must be done with the minimum of distraction to basic duties. Significant modifications should be avoided below 10,000 ft when such changes affect the monitoring of the aircraft flight path. CAUTION: At no stage must CDU manipulation be allowed to interfere with the safe and accurate operation of the aircraft.
1.18.3.2.8 Arrival Integrity Check (EFIS) (1.4.9)

The FMC will update rapidly when within radio update range of DME and or VOR signals. Confirm entry gateway position accuracy by referring to raw data when possible and adjust tracking as required. The course line on the HSI/ND may shift in several small increments as the update progresses. Raw data checks using a ground based aid must be completed when within range as per the departure procedure. If a significant error does exist take immediate corrective action to establish the aircraft on the correct inbound course. Prior to using FMC data for terminal area navigation confirm satisfactory updating has occurred.
31 August 2002
CAA of NZ
Page 103 of 203
CAA Occurrence No. 00/2518 1.18.3.2.9 Approach Integrity Check (EFIS) (1.4.9)
Prior to commencing an instrument approach: 1. 2. 3. Confirm approach aids are tuned, identified and displayed. Ground based aid transit during an approach is to be confirmed by raw data. "Standard Calls" are to be used. (Refer SOP section 2.1.)
1.18.3.2.10 MCP Usage (1.7.3)

The altitude select and alert system is to be used throughout the flight. Either pilot may set the altitude alerter/MCP. Any changes must be verified and verbally confirmed by the other pilot. (EFIS only) FMC constraints should be retained until the constraint no longer applies. However, on departure, low altitude VNAV constraints may be removed from the FMC and set on the MCP. Any VNAV constraints removed must be discussed during the departure briefing. Departure Set to clearance limit. Descent On receipt of clearance, set to clearance limit. Note: For DME arrivals or STAR, which incorporate a progressive descent, set to next step altitude or cleared altitude, whichever is higher. Instrument Approach Precision Approach Once established on the instrument approach, set to missed approach altitude. Non Precision Approach EFIS A/C: set to nearest 100 ft below MDA, thence at MDA to missed approach altitude. AFIS A/C: set missed approach altitude.
1.18.3.2.11 Flight Planning (2.1.1)

The PIC is responsible for ensuring that the flight plan is calculated in accordance with the Company fuel policy, performance data, and instructions, contained in the relevant portion of the Operations Manual. This responsibility will be the PIC's whether the flight planning is carried out by the flight crew, qualified ground personnel or by electronic data processing. The PIC is expected to normally select the most economical Company approved IFR route so as to achieve the greatest possible fuel economy. In addition, the PIC is responsible for ensuring that the accuracy of fuel and EET calculations is checked by rule of thumb, to ensure no gross or obvious errors exist. Particular attention is drawn to the possibility of errors occurring during the transmission of Flight Plans via teleprinter links, and extra care must be taken with the checking of all plans uplifted at outstations. The pilots, being the end users of all flight data, should ensure that any discrepancies or inconsistencies in documentation are recorded in an Operations Occurrence Report (OOR).
Page 104 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.18.3.2.12 Standard Calls (2.1.6)

The following matrix indicates the standard calls required during TAKEOFF, CLIMB, DESCENT, and FINAL APPROACH. The PNF will call, and the indications are to be confirmed by the PF. All altitude calls are referenced to the pressure altimeters except Cat 2 and 3 approach calls, which are referenced to the radio altimeters. STANDARD CALLS CONDITION/LOCATION CALL (PNF) 80 kts (Refer Note 1) 80 kts V1 (Refer Note 2) V1 VR Rotate Positive climb --------------Transition altitude Transition 1,000 ft below cleared altitude/level Transition level 10,000 ft 1000 ft above cleared altitude/level All applicable NDBs First positive inward movement of localiser bar First positive movement of glideslope bar Intermediate step altitude (non precision) OM/FAF 300 ft above MDA/DH 100 ft above MDA/DH MDA (non precision) DH/MAP Autopilot Disengaged 1000 to go Transition 10,000 ft 1000 to go .Beacon #. Localiser active Glideslope active - - - - ft until - - - fix Outer Marker / beacon feet (chart height) 300 above 100 above Minimum Decide Disengaged (PF)
TAKEOFF
CLIMB
DESCENT
APPROACH
RESPONSE (PF) Confirmed ----------------------------Gear Up Altimeters set 1013 Confirmed Altimeters set ______ (QNH) cross-checked Confirmed Confirmed Confirmed Confirmed Confirmed Confirmed Confirmed Confirmed Confirmed Maintaining / Landing Landing / Goround Confirmed (PNF)
A Visual call can be made to indicate that the approach is being continued visually. It may be made at any time prior to the Minimum Descent Altitude (MDA). Decision Altitude/Height (DA/H). Radio Altitude (RA) or Missed Approach Point (MAP). The PNF will reply with the existing rate of descent to indicate that the flight path is being continuously monitored. In these circumstances the 300 above, 100 above, minimum or decide calls are to be replaced with a 500ft AGL * call referenced to the radio altimeter. * 500 ft above field elevation on those aircraft not equipped with a radio altimeter.
ADVISORY CALLS:
These calls are not associated with specific points/altitudes during flight but are to be made when a parameter is exceeded and the aircraft is less than 500ft above airfield elevation. If no acknowledgement or corrective action is evident the call is to be repeated with increasing emphasis and the required corrective action is to be stated. The track call must be made at any time after the aircraft is established on the inbound track.
Circumstances
Descent rate Target airspeed Localiser Glideslope VASI PAPI Track error
Advisory Call
> 1000 f.p.m. Sink rate 5 knots Airspeed >half dot deviation Localiser > one dot deviation above or any below Glideslope > one light deviation VASI > one light deviation PAPI > 5o on non precision approach Track If there is a discrepancy of 10kts or greater, recheck. If the difference still exists, a rejected TO should be considered.
Note 1:
Note 2: V1 call must be completed by V1
31 August 2002
CAA of NZ
Page 105 of 203
CAA Occurrence No. 00/2518 1.18.3.2.13 Descent Approach Briefing Instrument Approach (2.5.1)
The Descent-Approach briefing should be completed prior to TOD but not later than transition level. Included in this briefing should be: A review of the destination A review of all Warnings and Cautions in the Route Guide Aerodrome page The detail of the briefing will vary, dependent upon how conversant the operating crew is with the airfield. The following items, as applicable, should be considered: 1. Flight path over heavily populated areas Noise abatement 2. Areas of high traffic density 3. Obstructions Safety heights, en route and airfield 4. Physical layout Runway length and orientation Parking bay suitability or limitations 5. Lighting Precision and approach lighting 6. Approach aids Frequency and ident of radio aids 7. Arrival procedures Airfield elevation, transition altitude Inbound course and marker crossing height Threshold crossing height and wheel height Go around procedure, aircraft/ATC 8. Holding and diversion 9. Approach procedure Precision/Non-precision Auto or manual (EFIS) ILS Breakout procedure 10. Prevailing meteorological conditions Approach and landing conditions 11. Landing minima 12. Reference to Chart Notams, Notams, Jeppesen, Route Guide and Company Route Briefing Bulletins that may affect the above 13. Aircraft Low drag approach Flap setting and bug speeds Auto brake settings FMC update Fuel remaining and fuel system configuration Inoperative equipment 14. After Landing Review taxiway layout Plan for minimum runway occupancy time: - Target the earliest suitable exit - Vacate the runway expeditiously.
Page 106 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.18.3.2.14 Glideslope Guidance (2.6.4)

Electronic glideslope guidance should be provided at destination airports on all runways regularly used by Company aircraft. However, where no glideslope guidance is available, the PIC should consider the aids available, the time of day or night, and the prevailing weather conditions, in assessing whether or not the aircraft can be safely operated to that airport. During an approach with no glideslope guidance, pilots must exercise care, particularly at night or when visibility is reduced, and should monitor DME, rate of descent and runway perspective, to ensure a standard 3 slope is maintained to the correct aiming point.
1.18.3.2.15 GPWS Glideslope Warning (2.6.4)

If a Below Glideslope warning occurs during an ILS approach, immediate action must be taken to regain the glideslope.
1.18.3.2.16 Stable Approach (2.6.4)

The aircraft shall be stable on approach by 500 ft AGL. An aircraft is stable on approach when it is:

In landing configuration At the selected approach speed (VTT) for the flap setting On the correct profile and at the appropriate rate of descent Aligned with the landing runway, except as required for Instrument Guidance System (IGS), Localiser Directional Aid (LDA), and Side-Step approaches Engines spooled up In trim
If not stable by 500 ft AGL, a go-around must be considered.
1.18.3.2.17 Low Drag Approach (2.6.5)

A Low Drag Approach should be considered if the following conditions apply:

No primary system malfunction No icing, low visibility, or other adverse conditions prevail Crosswind component less than 15 kts Adequate runway landing length for aircraft type
(Not B732), when flying a Low Drag Approach the Landing Gear must be selected down by 1500 ft AGL and Landing Flap selected by 1000 ft AGL.
31 August 2002
CAA of NZ
Page 107 of 203
CAA Occurrence No. 00/2518 1.18.3.2.18 Landing Off an Instrument Approach (2.6.5)
Precision Approach, PRA, ILS (except Cat IIIB)
The PF will commence an immediate go around off a precision approach at DA/DH unless the required visual reference of the approach area, or at least one of the following visual aids is, and continues to remain, visible: Approach Lights, Runway Threshold Markings, Threshold Lights, Runway End Identifier Lights, Touchdown Zone Lights or Markings. The required visual reference means that section of the visual aids, or of the approach area, which should have been in view for sufficient time for the pilot to have made an assessment of the aircraft position and rate of change of position in relation to the desired flight path. Decision altitude ensures compliance with the appropriate obstacle clearance criteria and where applicable includes a margin based on the operational considerations of ground/airborne equipment characteristics, aircraft performance, MET conditions, aerodrome characteristics, and altimetry.
1.18.3.2.19 Flight Recorders (3.1.6)

Flight Data Recorder The Flight Data Recorder (FDR) has a recording duration of 25 hours; hence its deactivation following a serious incident or accident is not necessary or critical as for the CVR. On completion of a flight for which a readout of the FDR is required, a Maintenance Log entry must be made to that effect and an Operations Occurrence Report (OOR) and incident signal sent.
Cockpit Voice Recorder The Cockpit Voice Recorder (CVR) has a recording duration of 30 minutes (120 minutes as installed). To preserve the recording of any serious incident occurring within the recording duration prior to landing, the crew should:

Deactivate the CVR by pulling the circuit breaker (identified by a blue cap) on completion of the parking checklist Make an entry in the Maintenance Log that the CVR breaker has been pulled. An Operations Occurrence Report (OOR) must also be completed and signalled.
Note: Except as provided above, CVR circuit breakers must remain in at all times.
With effect the 1st of July 2000, an aircraft operated under Rule Part 121.371 must have a CVR installed. Rule Part 121.89 requires each flight crew member shall ensure that:
(1) The cockpit voice recorder required by 121.371 is operated continuously from the start of the checklist commenced before engine start until the completion of the final checklist at the termination of the flight
The B767 MEL allows dispatch with the CVR inoperative provided the FDR operates normally and repairs are made within 3 flight days.
Page 108 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.18.3.3 B767 Flight Crew Training Manual Air New Zealand uses the Flight Crew Training manual as provided by Boeing. Air New Zealand has some minor technical and procedural operating differences to Boeing, e.g. the Boeing delayed flap approach versus the Air New Zealand low drag approach techniques. Air New Zealand procedures and techniques are taught during type rating courses. Air New Zealand Line crews use the Flight Crew Training Manual as a useful reference for techniques and information not contained in the Operations Manuals. The introductory section carries the following statement inserted by Air New Zealand:
The B767 Flight Crew Training Manual provides information and recommendations on manoeuvres and techniques. The manual is issued and amended by Boeing. It is issued to crew and is designed to provide background material during training. After completion of the type rating course it is retained on a voluntary basis. Crew must note that considerations not normally included in the aircraft Operations Manual, are contained in this document. The procedures and techniques are designed to supplement but not supersede, those in the aircraft Operations Manual; although there will be obvious conflict in certain places between the two manuals e.g. holding speeds, and standard calls. Such differences are not considered to seriously detract from the training and reference value of this manual. The Air New Zealand approved Operations Manual will always take precedence wherever any apparent conflict is found between these documents.
The Flight Crew Training Manual reflects the latest Boeing issue.
1.18.3.4 Route Guide The route guide contains airfield information to supplement the Jeppesen charts and provides a summary of each primary and alternate airfield, including seasonal weather, terrain, flight planning and ground handling information.
31 August 2002
CAA of NZ
Page 109 of 203
CAA Occurrence No. 00/2518 1.18.4 Airfield Categorisation Each area and airfield is categorised by the Company Airport Categorisation Group to identify training and qualification requirements for pilots. A comprehensive checklist is used during categorisation to assess the field, however although the Air Traffic Control standard is assessed, as are the actual aids to navigation, the quality of maintenance of those facilities is not. Faleolo is categorised as a B category airfield under the Air New Zealand airfield categorisation system. NZCAR 121.71 (f) (2) states:
Each aerodrome specified under paragraph (c), that it is to be used by an aeroplane that has a seating capacity of more than 30 passengers and is engaged on a regular air transport passenger service shall be an aerodrome that (2) for aerodromes outside New Zealand, is associated with a certificate issued by an ICAO contracting State and is of a standard equivalent to Part 139.
There is no similar Rule requirement for the Operator to ensure that the Airways Services conform to the equivalent Certificated Airways Services Rules. The Company Airfield Certification Group has categorised the airfield as a category B airfield, that is, the computer based training airport briefing package must be completed prior to entry. From the date of initial qualification, or last physical entry into or out of the airport as a crew member the qualification remains valid for 12 months in the case of a Captain, or 2 years for an F/O. All assigned flight crew had a current airfield qualification for Faleolo. The Flight Safety Foundation CFIT checklist is applied during airport categorisation.
Page 110 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 1.18.5 Approach Plates 1.18.5.1 Jeppesen Sanderson STAR and Approach Plate for Runway 08 at Faleolo Air New Zealand uses Jeppesen Sanderson published plates. It is noted that Jeppesen Sanderson generally reproduces information provided by National Authorities and that the accuracy of the information presented is the responsibility of those National Authorities. The STAR for Faleolo depicts two arc procedures for arrivals from tracks to the South of FA. The primary arc, based on FALE reporting point and depicted by a solid line, is a 15 nm arc. The secondary arc, depicted by a dashed line, is at 12 nm FA. The Approach Plate for the VOR DME ILS DME Rwy 08 has both VOR DME and ILS DME shown against the profile. The level segment, from within 16 FA DME to the FAP is referenced to the VOR DME. The Approach Plate only depicts the 12 nm FA arc but it is depicted as a solid line contrary to the dashed line depiction of the 12 nm arc on the STAR plate. The FAP is identified on the STAR as D9.0 FA, D7.5 IAP. From the FAP inbound, check heights are referenced to the ILS DME; there are no corresponding VOR DME check heights depicted. The FAP on the approach plate, in accordance with the Jeppesen Introductory section, is depicted on the plate by the glideslope intercept point of 2500 ft/7.5 nm IAP ILS DME.
NOTE: Jeppesen chart glossary (FAF) It is designated in the profile view of Jeppesen Terminal Charts by the Maltese Cross symbol for non-precision approaches and the glideslope / path intercept point on precision approaches. The glideslope / path symbol starts at the FAF. When ATC directs a lower than published glideslope / path intercept altitude, it is the resultant actual point of the glideslope / path intercept.
31 August 2002
CAA of NZ
Page 111 of 203
CAA Occurrence No. 00/2518 1.18.6 Crew Personal Preparation The PF reported that he maintains a personal database of duty parameters, airfield and airport information to supplement the information contained in the Route Guide. He had not flown this particular duty before, although was familiar with operating through Faleolo. He expressed a degree of caution about operating around the Southwest Pacific, due to a number of factors including; terrain, black hole effects, quality of services, maintenance, and weather. He also identified the political situation in Fiji (the third Fiji coup was in progress) as another consideration. The PNF did not express any concern about the duty. He had operated through Faleolo previously and stated that he knew what to expect. The SP reported that he keeps personal notes on the airfields operated to. He had been on type for 12 months and only operated through Faleolo once previously with Air New Zealand, on a daylight flight from Honolulu to Faleolo while undergoing route training. That flight arrived from the North and he recalls being briefed to expect a map shift and that, to ensure aircraft position, one should always overhead the VOR when arriving into Faleolo from the North. NZ 60 was the first flight he had operated into Faleolo from the South. He also expressed caution about this duty and operating to the islands in general. He had not flown the recurrent simulator detail based on Faleolo. He deliberately reported for duty early, to give himself time to review the Faleolo Route Briefing material, NOTAMs and flight plan.
Page 112 of 203
CAA of NZ
31 August 2002
2.
2.1
Analysis
Introduction
This analysis considers the principal areas where there were opportunities for the incident to be prevented: Operational Factors Aircraft Instrumentation and autoflight system design ILS Ground facility design and maintenance Organisational Factors
Only factual information that was considered to have a bearing on the incident has been included in the analysis.
2.2
Operational Factors
2.2.1 Preflight / Takeoff / Cruise This was an appropriately cautious crew, displaying a high level of awareness of the differences between operating to a major airport and operating to the Pacific Islands. The preflight preparation was thorough and not rushed. The crew was communicating well and functioning as a team before leaving Flight Dispatch. The crew environment ensured all crew members were able to express any questions or concerns. The workload allocated for each crew member was appropriate. With respect to the various NOTAMs on Apia, all available resources were used to assess and evaluate operational matters pertinent to the flight. The preflight and takeoff proceeded normally. During the cruise a minor fault with an automatic announcement tape was attended to with the assistance of Maintenance Watch and the onboard Air New Zealand Service Engineer. The crew were unaware of the presence of the Service Engineer onboard until informed by Maintenance Watch. Of note is the individual attention to a self-brief by the crew for the approach into Apia and the thorough and comprehensive descent and approach briefing given by the PF.
31 August 2002
CAA of NZ
Page 113 of 203
CAA Occurrence No. 00/2518 2.2.2 Descent Into Faleolo The PFs preparation for the descent and approach was thorough and exceeded SOP requirements. All the relevant crew were briefed for the descent and approach and the crew carried out the pre-briefed plan. The decision to fly 240KIAS on the DME arc was made on the expectation that a level segment would be flown prior to glideslope capture, ensuring the aircraft would be appropriately configured to fly the glideslope. This is a key decision in terms of the human factors analysis. There were no clues that would have led the crew to alter this plan. Throughout the initial and intermediate phases of the approach all crew remained vigilant with high situational awareness apparent. An open communication environment existed during descent as evidenced by the SPs challenge when the aircraft passed through the 15 nm arc. Contingency planning was similarly thorough. An FMC approach was programmed using the parameters for the ILS for runway 08. In addition the VOR panel was set up for the VOR/DME approach as an alternative in the event of an ILS failure. The VOR/DME approach was briefed and a copy of the approach plate was placed on the PFs navigation bag to his left. Asking the SP to monitor the three ILS idents to ensure correct functionality as they completed the approach further evidenced this thorough planning. These actions showed good error trapping behaviours. The investigation has identified that there is no documented requirement for the approach briefing to identify the anticipated point of glideslope capture and the means to verify the glideslope appears to be reasonable. During the approach a reasonableness check of the ILS precision approach tracks (localizer and glideslope) should be conducted using appropriate alternate means of verification, e.g., Marker beacon, NDB, ILS DME or VOR DME etc. The approach briefing should also include the requirement for a reference check of altitude in relation to the glideslope/DME, Marker beacon or NDB locator published altitude. This check should be used to confirm that the aircraft altitude at the reference point is within an acceptable tolerance with respect to the published approach chart information.
NOTE: The SOP Descent Approach Briefing includes the requirement to brief the inbound course and marker crossing height and Standard Calls require a call at the outer marker /FAF. The briefing/standard calls documentation should be expanded to cover the points in the preceding paragraphs.
There were no indicators to prompt the crew to use a standard approach profile; therefore it was a reasonable decision to accomplish a low drag approach, which SOP implies is the preferred profile, a low drag approach should be considered if the following conditions apply . The low drag approach profile exacerbated the problem in that it left the crew less time to analyse the unexpected capture, identify the erroneous capture and then act. A standard approach profile as opposed to a low drag approach would not have prevented the occurrence, however, a standard or a lower energy approach may have lessened the effect the early glideslope capture had on the event. The SOP Low Drag Approach procedure is at variance with the Boeing recommended procedure of F20 at glideslope intercept.
Page 114 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 2.2.3 ILS Approach The Approach Integrity Check (SOP) requires that approach aids are tuned, identified and displayed: The ILS DME was not displayed on either EHSI or RDMI during approach, although from the FAP the approach is based on ILS DME. Prior to the FAP, the approach is referenced to the VOR DME. The use of the VOR DME was pre-briefed. The display of ILS DME cannot be achieved by having the EHSI selected to the MAP mode. For an ILS approach Air New Zealand does not specify selection of the EHSI display mode but adheres to the Boeing advisory practice of having the EHSI selected to the MAP mode to the extent permissible. The ILS approach to runway 08 at Faleolo is constructed using an ILS DME in lieu of marker beacons; therefore at least one EHSI should be selected to display the ILS DME during the approach. The Approach Integrity check also requires that ground based aid transit during an approach is to be confirmed by raw data. Raw Data is not defined in Air New Zealand documentation and to date an authoritative definition for raw data has not been identified. There are various thoughts within the industry as to what is defined as being raw data. General opinion within Air New Zealand appears to consider raw data for an ILS approach to be localizer and glideslope deviation. The B767 FCTM supports this supposition pg. 4.11 Raw Data No Flight Director procedure only refers to glideslope and localizer deviation and pg. 4.18 Autopilot Performance Crosscheck stating: Relative position is provided by the localizer and glideslope indicators and should be used to evaluate the quality of the approach. This statement only holds true if the glideslope is radiating correctly. The approach cannot be legally flown if the marker beacons/DME are inoperative; therefore the information provided by those facilities must be displayed. The only opportunities the crew had to detect the erroneous signal were clues that the glideslope indication was not normal, and/or that the glideslope capture was not at the anticipated point. Because the EADI glideslope indication is inhibited until the aircraft is within 90 of front course, the crew did not have an opportunity to detect an abnormal glideslope indication until approximately 45 seconds prior to the autoflight system capturing the localizer. The Standby Attitude Indicator ILS display, which is not inhibited, was not selected. Air New Zealand B767 Normal Procedures do not require this action to be taken, and two trainers had previously pointed this out to the SP when he had selected it on previous B767 training flights. In contrast, Air New Zealand B737-300 trainers expect the Standby Attitude Indicator to be selected to ILS for approach. The rationale for this philosophy is not documented, however the procedure has been carried over from the original B737-300 type courses conducted by Boeing. The glideslope active standard call provided the first procedural opportunity to trap the erroneous glideslope indication. The aircraft captured the localizer approximately 13 nm from the threshold at an altitude of 2780 ft, some 1100 ft below the projected glideslope. For an ILS approach with the glideslope radiating normally at this point of the approach the glideslope deviation indicator will display a fly up indication. Both the PNF and SP reported the glideslope deviation indicator as appearing 1 2 dots high after localizer capture. Analysis of glideslope DDM values captured on the FDR does
CAA Occurrence No. 00/2518 not support this. The indication would have been displaying an on glideslope value from the time it appeared on the EADI, therefore the crew cannot have observed positive movement of the glideslope deviation indicator after localizer capture. It is possible that immediately prior to glideslope capture the crew saw what they expected to see. In the absence of the CVR information it is not known whether the glideslope active call was made. The remaining opportunity to detect the erroneous glideslope was the standard call required at the OM or FAF. The approach is constructed with a FAP*, which is the glideslope intercept point at 2500 ft/7.5 IAP. Because this particular approach is constructed with a level segment prior to glideslope intercept and the profile planned to utilise the level segment to decelerate and configure the aircraft, a DME distance/altitude check against glideslope capture would have provided an earlier resolution of the discrepancy between the erroneous glideslope capture and the true glideslope.
* NOTE: Pans Ops 21.4.4 states A descent fix may be located at the FAP. When so located it becomes the final approach fix linking the Minimum Obstacle Clearance in the preceding segment smoothly with the precision surfaces.
When the autoflight system captured the glideslope the flight crew were presented with a G/S capture indication on the EADI, an on slope glideslope deviation indication on the EADI and a valid ident from the aid. The crew may have been initially assured that the glideslope capture was correct due to confirmation bias arising from the expectation that they would be alerted to an incorrect capture by the various warning systems. Individually the crew were uneasy or surprised with the early glideslope capture, however that capture was in accordance with their training and conditioning. They were presented with a forced choice accept the capture as valid or accept an unresolved ambiguity (feeling of unease or surprise). As the aircraft was established on the localizer and therefore not terrain critical, the decision would inevitably be in favour of a good glideslope capture, as the crews mental model would be that they have time between completion of aircraft configuration and Decision Altitude (DA) to resolve the ambiguity. The unease or surprise generated by the early capture had, therefore, to be confirmed by an unambiguous indication before the crew could break the mental set of a valid capture. Given the crews mental model the valid precision glideslope indication on the flight deck could be expected to take precedence over other navigational information, in the absence of warnings, flags or EICAS messages. Given the awareness that the crew had of the state of the aids at Faleolo, a number of options would have been tested if there had been any discrepancy with the localizer and glideslope indicators. These options would have included an incorrect DME and an incorrect arc procedure. In addition the PNF had sighted the runway in approximately the correct position during the localizer capture. The resulting rule-based error1 misapplying the normally good rule that the localizer and glideslope warning systems will identify a problem with both the aircraft and ground station - provides a possible explanation as to why the crew were led to accept the glideslope capture as a valid parameter. The PF commented to the investigation that he had never experienced a failure of an ILS glideslope system prior to this event.
Reason, J. (1997) Managing the Risks of Organizational Accidents
Page 116 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 Accepting the glideslope capture as valid, the crew focused on controlling the aircraft energy. The profile was planned to intercept the glideslope at flap 5 and 180 KIAS. At glideslope capture the aircraft was at flap 1 and 218 KIAS. In addition to the workload of a standard low drag approach, the crew had to dissipate an extra 38 knots of airspeed and make additional flap configuration changes to achieve the SOP low drag approach requirement of having the aircraft configured and landing flap selected by 1000 ft AGL. Having mentally prioritised their primary task as being aircraft energy control and configuration, there was no verbal or non-verbal dissent or conflict regarding the methods used by the PF to manage the aircraft. The PNF and SP responded to his requests for configuration changes without hesitation. All three were therefore working to solve the energy problem, confident that the autopilot had captured a valid glideslope. A valid ident of the ILS and the absence of any warnings reinforced this mindset. The PNF has no recollection of advising Faleolo that the aircraft was established on the approach, and neither the PF nor SP has any recollection of this call being made. The PNF cannot recall the Before Landing Checks being called, however the PF and the SP recall the checklist having been completed. The FDR recorded two VHF transmissions of three seconds duration each, eight seconds apart at approximately 2000 ft during approach. The VHF transmission was on the radio that would normally be selected to tower (VHF 1) and was made during the period the aircraft was being configured through Flap 5. The next communication on VHF 1 was made at 500 ft during the go-around. It is reasonable to assume that the PNF communicated with Faleolo Tower but that recollection of this event was blocked by the focus on energy management and aircraft configuration. In addition, the aircraft annunciated Land Three at 1500 ft RA and again none of the crew recollects seeing the annunciation. This is further evidence that the crews attention was focused on the energy management task. Data from the proving flights and the simulator profiles show that even a crew that is prebriefed and anticipating the high glideslope entry speed becomes almost totally focused on the energy management and configuration task to successfully achieve the profile to the exclusion of awareness of other information and events. The PF also iterated that at glideslope capture he was mentally ahead of the aircraft, anticipating and planning next actions. This is normal crew behaviour, with the PF anticipating the next event and the monitoring crew keeping in sync with the aircraft. The PF is the person controlling the aircraft, the monitoring pilots ensuring everything is going to plan. There is a training lesson here for error trapping and also it raises the question whether this situation denies the PIC, if he is also the PF, the opportunity to maintain a strategic overview and to be the decision-maker in the strategic sense. At 900 ft, with the aircraft configured for landing and all associated tasks completed, the crew could now turn their attention to resolving the source of the unease or surprise experienced at glideslope capture.
31 August 2002
CAA of NZ
Page 117 of 203
CAA Occurrence No. 00/2518 2.2.4 Go Around Once the aircraft was configured for landing, each of the crew expected the runway to be just ahead, however all three were confused when they could not sight the runway. To the PF it may have been due to weather. The PNF had seen the runway clearly while still on the arc but now could not sight it in the expected position. The SP could see only two dim red lights.
NOTE: The most likely reason that the crew could not see the runway lights at the end of the landing checklist would be: The distance out from the runway threshold The low altitude of the aircraft The runway falls away from the threshold of runway 08 (58) to the threshold of runway 26 (9)
In addition there is rough vegetation between the coastline and the runway 08 threshold. Refer photograph View of Faleolo International Airport Looking West page73.
The PF cross-checked the DME and verbalised to the other crew that the information did not make sense. The PNF saw the lights close beside on the island and verbalised that information. The SP computed the DME/altitude equation and recognised the answer did not compare to the aircrafts actual altitude. The conflicting visual and DME clues versus the seemingly valid status of the autoflight system and glideslope indications created dissonance for each crew member. The crews mental model (that the aircraft was following a correct electronic localizer and glideslope) rapidly broke down in the presence of this ambiguity and the validity of the ILS glideslope was re-evaluated. The 300 above and 100 above decision height calls were not made, however at the point where these calls were required to be made, the crews focus was on trying to resolve the height/distance anomaly. CRM training requires all crew members to use appropriate assertion. CRM training also instils a philosophy of expecting an individual to be reasonably confident in their opinion before speaking up avoidance of the crying wolf syndrome. When each pilot experienced mental conflict of the aircrafts position versus the ILS indications, DME and the visual picture, they communicated their concern. At this stage each individuals internal model testing rapidly translated through inquiry to forceful assertion, which validated the PFs decision to go around. The PF now distrusted the information being presented to him and elected to go-around without the autopilot. The PNF and SP both saw the radio altimeter reading as validation of a gross error and simultaneously called go around, in conjunction with the PF commencing a precautionary go-around. The decision to go-around was unexpected and the actual time to initiate the manoeuvre was probably longer than might otherwise happen if it is expected, for example as at the missed approach point. The autopilot was disconnected at 420 ft PA, the first evidence of the go around decision. From the time the flap reached 30 at approximately 820 ft PA during the descent, it took the crew approximately 21 seconds and 400 feet of altitude to complete the checklist, resolve the anomaly and act.
CAA Occurrence No. 00/2518 At the lowest point of the profile, the flight data recorder also shows loss of localizer signal for 5-6 seconds. This is most likely due to a combination of terrain masking of the localizer signal and a reduction in localizer signal strength, due to a reduction in the vertical angle from the localizer site. 2.2.5 Missed Approach Realising that he had lost his situational awareness, the PF adopted a survival mode for the missed approach, relying on information from the standby flight instruments. He was ably supported by the PNF who could see the airfield and terrain on his side of the aircraft but allowed the aircraft to climb before prompting for reconfiguration. Both the PNF and SP supported the PF during the missed approach and helped to re-establish his confidence in the basic functions of the autopilot to help manage the aircraft and reduce workload. The PNF showed active leadership during this phase of the incident. Good CRM practices were evident during the missed approach. The crew communicated well, analysed the problem as a glideslope failure and prepared to land again without using the glideslope for guidance. Their tasks were evenly shared and they communicated appropriately with the Tower and the Cabin Crew and Passengers. The situational awareness of the flight deck crew was regained through competent communication and problem solving enabling them to safely return and land. 2.2.6 Post Flight Post flight the crew considered various options, completed the paperwork expected of them and questioned their own health and ability to operate the aircraft safely back to New Zealand. Despite the incident that they had just faced they were a cohesive and wellfunctioning crew. The flight crew briefed the ISD about the incident and their understanding of it. Due to the cabin crews apparent ease with regards the incident it is understandable why the flight crew elected not to disturb their rest for a post incident debrief, however it would be a prudent measure to ensure they are informed immediately after an event of this nature. Although the crew considered the incident to be serious, the Airline General Procedures manual Occurrence Reporting procedures define a go-around and a GPWS warning/terrain proximity as being an incident and not a serious incident. The crew therefore assessed there was no requirement to pull the CVR circuit breaker. If the CVR circuit breaker is pulled the MEL allows for dispatch with the CVR inoperative, however for this to occur a certifying engineer must release the aircraft to service under the MEL. The CVR installation is now a mandatory requirement under Rule Part 121.371. The requirement of Rule Part 121.89, that each flight crew member shall ensure that the CVR is operated continuously from the start of the checklist commenced before engine start until completion of the final checklist at the termination at the flight is at variance with the ability to dispatch the aircraft with the CVR inoperative under the provision of MEL 23-71-1. The FAA Master MEL also allows dispatch with the CVR inoperative provided repairs are made within 3 flight days. There is no company policy or procedure at present to cover CVR information preservation, retrieval, quarantine, storage and reading in the event the CVR circuit breaker is pulled to preserve data as required by the SOP Incident Follow-up Guide.
31 August 2002
CAA of NZ
Page 119 of 203
CAA Occurrence No. 00/2518 2.2.7 Approach Aid Hierarchy The confidence that may be placed in an approach aid (the hierarchy) is demonstrated by the minima that is allowed for different approach aids and reflects the level of trust or confidence in the degree of precision that the aid and on-board equipment allow in determining the aircrafts true location with respect to the runway. The minima for various approach options i.e. NDB, VOR, LOC, ILS/MLS get progressively lower as the aircrafts true position is more accurately defined by the respective approach aid. Crews subconsciously rate the navigation aids in the same hierarchy and accept the information provided by the respective aid with a similar level of trust.
NOTE: The dilemma crew face when determining position is that sooner or later they must accept (assume) some information as being valid, and have trust in the validity of that information. That is because they may not have enough information available to determine the accuracy of the signal from a ground radio navigation aid, to the degree required for the precise position fixing that is required for verification of an ILS approach. The assumption they must make will bias their perception and subsequent actions.
The ICAO Manual of All Weather Operations 2.1.6 states The accuracy of the airborne and ground based guidance and control systems generally determines the size of the area in which obstacles need to be considered and the more accurate the system, the smaller the area. As a general rule the smaller the area, the lesser the number of obstacles to be considered and this generally results in lower minima (i.e. lower DA/H or MDA/H). Where obstacles are not limiting, the minimum height to which an approach may be continued without external visual reference will be determined by the accuracy and reliability of the total system, and again the general rule is that the better the accuracy and reliability, the lower the minimum height element.
2.2.8 Glideslope Altitude Check One of the key determinations during the analysis was to establish what the requirements of the glideslope altitude check are and what the check is designed to do. The published glideslope check must have been designed to accomplish one of three possible things: (i) a glideslope check, or (ii) an altimeter check, or (iii) both a glideslope and an altimeter check. To support the hypothesis that it is a glideslope check: The Introduction Section of the Jeppesen states that all altitudes in the profile view of the approach chart are minimum altitudes above mean sea level unless otherwise stated. The charted check height is generally displayed as a figure with no over or underlining, therefore according to those instructions must be interpreted as a minimum altitude. Pans Ops Volume 1 Part III, Chapter 3.5.4.5 states The final approach area contains a fix or facility that permits verification of the glide path/MLS elevation angle/altimeter
CAA of NZ 31 August 2002
Page 120 of 203
CAA Occurrence No. 00/2518 relationship. The outer marker or equivalent DME fix is normally used for this purpose. Prior to crossing the fix, descent may be made on the glide path/MLS elevation angle to the published fix altitude/height. Although the previous two dot points imply the published check height is a minimum altitude, in practice this is not practicable and Pans Ops Volume 1 Part III Chapter 3.4.5.1 recognises that with the statement that descent below the fix crossing altitude/height should not be made prior to crossing the fix.
NOTE: Pans Ops also expects the pilot to fly the glideslope deviation indicator. This creates an apparent conflict of philosophy in the approach between using the glideslope indicator and the not below altitude. The latter technique, more akin to a non-precision approach, may not be totally compatible with the autoflight system approach mode and current philosophy of using the automatics when possible.
To support the hypothesis that the published heights are used to identify altimetry errors and to ensure minimum obstacle clearance is not infringed at DA and through the missed approach path: Pans Ops Volume II, Part III, Chapter 1.2, Procedure Construction states: The approach segments begin and end at designated fixes. However under some circumstances certain segments may begin at specified points where no fixes are available (or necessary), e.g. the final approach segment of a precision approach may originate at the point of intersection of the designated intermediate flight altitude/height with the nominal glidepath. The Final Approach Fix (FAF) definition in the Jeppesen Introduction section further amplifies this. The fix from which the final approach (IFR) to an airport is executed and which identifies the beginning of the final approach segment. It is designated in the profile view of Jeppesen Terminal charts by the Maltese Cross symbol for non-precision approaches and by the glide slope/path intercept points on precision approaches. The glide slope/path symbol starts at the FAF. When ATC directs a lower-than-published Glide Slope/Path Intercept Altitude, it is the resultant actual point of the glide slope/path intercept. (Underlining by report author). Pans Ops Volume 1, Part III, Chapter 3.5.4.5.2 states It is assumed that the aircraft altimeter reading on crossing the fix is correlated with the published altitude, allowing for altitude error and altimeter tolerances. The aircraft may be established on and using the glideslope well prior to the first available check height; prudence would suggest that if the integrity of the glideslope is in question then the glideslope should be verified for integrity prior to acceptance. The authors of Annex 10 were careful to ensure that all components of the ILS remain operative: 2.1.2.1 Non visual aids that do not conform: a) to the standards in Chapter 3, 3.1.2.1, 3.1.2.2 and 3.1.7.1 a) shall not be described by the term ILS.
NOTE: The required items are the localizer, glideslope and marker beacons/DME equipment, associated monitor equipment, remote control and indicators.
CAA Occurrence No. 00/2518 The pressure altimeters may still be subject to human error on the glideslope. Procedurally there is no means of detecting an erroneous QNH/QFE prior to a point where a precise fix can allow a comparison between the altimeter reading and a known altitude. The altimeter is verified for accuracy prior to takeoff, it is checked by checklist during descent that the correct QNH/QFE is set through transition level, and generally checked and cross-checked to ensure that both altimeters are reading within allowable tolerances. However, these checks will still not detect an incorrect setting of the QNH/QFE due to pilot error or incorrect information from the ground. This is important when operating to the lower DA allowed on a precision (Category I ILS) approach. When solving an equation a constant is required. In attempting to resolve an anomaly a crew that is unaware of the potential for the radiation of erroneous information will probably accept the glideslope as the constant, as all other information on-board is subject to some known error. To ensure absolute detection of an erroneous glideslope requires at least two checks on the glideslope. Some ILS approaches have only one check height published. Pans Ops Volume 1, Part III, Chapter 3.5.4.3 states . . . The ILS obstacle clearance surfaces assume that the pilot does not normally deviate from the (localizer) centreline more than half a scale deflection after being established on track. Thereafter the aircraft should adhere to the on-course, on-glide path position since more than half course sector deflection or more than half course fly-up deflection combined with other allowable system tolerances could place the aircraft in the vicinity of the edge or bottom of the protected airspace where loss of protection from obstacles can occur. Pans Ops Volume 2 Part III Chapter 7.1.1 states . . The missed approach procedure is assumed to be initiated not lower than the OCA/H in precision approach procedures or at a specified point in non-precision approach procedures not lower than the OCA/H. This is further amplified in Pans Ops Volume 2 Part III Chapter 21.4.5 (Specific Instrument Approach Procedures ILS Missed Approach Point) with the statement The missed approach point is defined by the intersection of the nominal glidepath and the decision altitude/height (DA/H). Therefore, for a Category I ILS, the land / go-around decision at the missed approach point (DA/H) must be made based on the information provided by the pressure altimeter. Although distance information in the form of a beacon or DME distance may be provided on the approach plate, when making the land / go around decision that information must therefore be supplementary to the information provided by the pressure altimeter. A glideslope check height is provided in the design of the approach, yet a similar check is not provided for localizer tracking. This investigation has established that a similar maintenance error can be introduced into the localizer. If validating the glideslope is so important to the approach why is the same philosophy not taken to validate the localizer? It can be argued that a localizer is a non-precision aid. However, in the context of an ILS approach the preciseness of the localizer is just as critical to the approach as the glideslope. Although a crew is more likely to detect an erroneous localizer, it must be argued that the original designers of the ILS approach system could not foresee the possibility of this type of systemic failure, therefore did not purposefully design checks to catch this potential error.
Page 122 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 Therefore if the intent of the published check height is to check the glideslope, that check must be a glideslope angular check of the actual angle versus the published (3 degree) angle. (Having already established that the check cannot be for the erroneous case, the signal must now provide a path to the origin.) However Pans Ops assumes that the aircraft altimeter reading on crossing the fix is correlated with the published altitude, allowing for altitude error and altimeter tolerances, i.e. the intent is for a precise comparison of altimeter reading versus published altitude. If the check then is an angular check of the glideslope, unless the glideslope is grossly in error any angular discrepancy will have a negligible effect on obstacle clearance during the approach, or actual aircraft altitude at DA. Therefore the safety impact is virtually nil. The published check height in this case would not have to be overly accurate, as all that would be required is a gross error check. The check in this case could be accomplished anywhere along the glideslope, preferably at the capture point. A rule of thumb comparison, such as a 3:1 check would be accurate enough for the purpose, and it would not be necessary to publish an exact height at a certain point (the fix, as referred to in Pans Ops Volume 1, Part III Chapter 3.5.4.5.2).
The same argument applies if the supposition is that the check is designed to detect a false glideslope capture as: once again, a rule of thumb comparison would suffice, and no similar check is published for the localizer.
If it is accepted that the check is an altimeter check, then the safety implications are quite different. Starting with the same mental model that the glideslope will take the aircraft to the signal origin, now if there is a discrepancy at the glideslope check height the conclusion must be that the altimeter is in error, as in this case we are accepting that the glideslope is extremely accurate and may be used to validate the altimeter setting against a known (charted) altitude (the fix). The ramification of an incorrectly set altimeter when operating to a decision point of 200 ft AGL may be significant. If the altimeter is set incorrectly due to human error, that error will be carried down the glideslope. There are two potential effects: The first is if the altimeter is indicating lower than true altitude at the glideslope check height. Then, when the aircraft reaches displayed DA it will be further up the glideslope (higher true altitude at displayed DA). If the ceiling is at minima the most likely result will be a missed approach, as the crew will not be visual at the displayed DA. The second case, however, is quite different. If the altimeter is indicating higher than true altitude at the glideslope check height, then, when the aircraft reaches displayed DA it will be further down the glideslope than indicated (lower true altitude at displayed DA). The safety implication now is that the aircraft will possibly infringe the obstacle clearance altitude on the go around, or worse.
The inevitable conclusion of this argument must be that the published check was designed purely as an altimetry check, and as such must continue to be used for that purpose. It is extremely important all crew are made aware of what they are doing at the published check height, also why an altitude tolerance for the check must be established.
CAA Occurrence No. 00/2518 The problem that Air New Zealand (and perhaps the system) now faces is that the perception on the line, biased by this event, may be that the check is a glideslope check. As such the danger to the system is that: the check may no longer be accomplished as an altimeter check, to catch the error it is designed to trap, and if an error is noted at the check height, the wrong assumption may be made as to what the actual error is. The subsequent action taken based on misperception, may be the incorrect one. For instance, if the crew assume the glideslope is providing incorrect information and decide to revert to a localizer approach, unless the pressure altimeter can be positively verified as being error free, minimum obstacle clearance may not be assured throughout the approach profile. Even this argument has had to make an assumption that in this case, the localizer or the DME is providing precise and correct information and is not the true cause of the anomaly.
Therefore it is suggested that Air New Zealand flight crew should be taught that the primary purpose of the check at the published check height is an altimeter check, however it does serve the secondary purpose of also providing one of the glideslope reasonableness checks this investigation suggests should also be carried out. The mindset now must be one of: this check is to check my altimeter, but if there is an unresolved discrepancy, it is possible the glideslope or some other information may be in error. If I cannot immediately make the determination that it is safe to continue, I must go around and then resolve the problem.
NOTE: Errors and tolerances that may account for discrepancies at the fix are listed below:
Glide path angle. ICAO tolerances allow for up to 7.5% of the published glide path angle. However tolerances are more typically kept to a tolerance of 1.5% (in New Zealand). This error diminishes the closer the aircraft gets to the transmitting antenna. DME distance/marker beacon error ICAO tolerances allow for up to 0.2 nm for the DME, which is typically achieved. This error will remain virtually constant over a short range as the aircraft gets closer to the transmitting antenna. The Outer Marker beacon tolerance may be up to 0.5nm. Barometric (pressure) altimeter error This error varies depending on aircraft type. Operations Manuals should be consulted for accurate figures. Temperature error Autocoupled capture off a level segment The FCC computes, based on input data, a variable point at which to start pitching the aircraft nose down so as to effect a smooth glide path capture. The manoeuvre may initiate well prior to the fix. The effect will be that, by the time the aircraft passes the fix, it has descended to below the published check height. Refer Paragraph 1.6.17.
NOTE: The barometric altimeter error issue only applies to a Category I approach. Category II and III approaches use the radio altimeter to provide the decision point, therefore the safety impact of a mis-set barometric altimeter is not as great. Radio altimeter height readings are not subject to human error in use.
Page 124 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 2.2.9 Possible Glideslope Intercept Scenarios There are three general scenarios that may occur during an autocoupled ILS approach with an erroneous glideslope: Scenario one is where the aircraft captures the glideslope prior to actual descent point and on a profile close to the expected 3. If the erroneous glideslope is not detected, terrain/obstacles may be a factor prior to the briefed decision point.
Scenario One
Scenario two is where the aircraft captures the glideslope slightly short of the true glideslope intercept point and flies a profile steeper than but close to the expected 3. The crew may not identify the discrepancy with a glideslope intercept distance/altitude check. The resultant profile will take the aircraft to a point short of the true decision point.
Scenario Two
31 August 2002
CAA of NZ
Page 125 of 203
CAA Occurrence No. 00/2518 Scenario three is where the aircraft captures the glideslope at the correct intercept point, but not on a true glidepath. The profile flown will not necessarily be a 3 glidepath and there is nothing to ensure the aircraft maintains the path. If the path is greater than 3, the aircraft will still fall short of true decision point.
Scenario Three
While the first scenario may be detected with a distance/altitude check at glideslope intercept provided that point is known, this statement does not hold true for the other two scenarios. Faced with a seemingly valid glideslope indication with no warnings present on the flight deck, the crew will inevitably accept the glideslope. On all the profiles the aircraft is not receiving glideslope guidance and therefore the flight path cannot be predicted. The possible glideslope intercept scenarios assume the profile is planned to intercept the glideslope at a defined point, for instance the FAF. In service, however, the glideslope intercept point is not so easily predicted and may change due to variables during descent and approach. It is possible that the glideslope will be intercepted at some point prior to the first charted check height, or perhaps inside the FAF. As is also the case when flying an approach using an ILS with no DME, or if the DME is located some distance from the glideslope transmitter, until a beacon or defined point is reached a crew may find it difficult to orientate themselves accurately along track with the precision required to determine if the glideslope is erroneous. Other methods must be used to ascertain an anomaly in this case. The aircraft will not detect the error and the crew may not detect the error, dependent upon where they are intercepting the glideslope. In the absence of on-board systems that provide a greater level of confidence to the crew than the ground aid information, the crews natural reaction will be to afford the ground aid information a higher level of trust. The crew decision will be biased toward the ground navigation aid as being correct provided it is tuned, identified with no flags and pointing or indicating correctly unless they detect a gross error or receive communication to warn them that the glideslope must not be used.
Page 126 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 Therefore, unless the crew has a positive and accurate orientation of position relative to glideslope, the charted glideslope check height cannot be considered as a reliable method of detecting an erroneous glideslope in all cases and is only guaranteed to provide protection against an error in the on-board equipment experience has taught us that incorrectly set altimeters are the most likely cause. A good glideslope will provide some protection against altimeter error, but until a reference point is reached the altimeter does not necessarily provide protection against an erroneous glideslope.
Glideslope Aircraft path
First published glideslope check height (FAP or marker)
Crew must be aware of the potential for maintenance error to cause a glideslope (or localizer) to radiate erroneous information with no on-board warning due to systemic failure. Therefore they must maintain a reasonableness check of the ILS and be prepared for a missed approach if they have an unresolved discrepancy by a defined point, but must also have confidence in the precision aspect of the approach. Maintenance error can also cause other navigation ground aids, for instance DME, to radiate erroneous information. It is also possible the on-board navigation system has been updated using the ground aid. Therefore, if the ground aid is in error, that error could be transferred to the on-board (FMC) systems.
31 August 2002
CAA of NZ
Page 127 of 203
2.3
2.3.1
Aircraft Systems
Instrumentation and On-board ILS Equipment The aircraft ILS receiver equipment conforms to the ideal of ICAO Annex 10 Volume 1 Attachment C. There is no design specification requirement for the aircraft equipment to detect the presence of the glideslope SBO signal. There is also no design specification requirement to detect that the SBO signal is in correct phase relationship with the CSB signal. The glideslope deviation indicator display on the EADI is inhibited until the aircraft is within 90o of the front course. This denies the crew an early opportunity to detect an erroneous glideslope. Detection is reliant on the crew being aware of the possibility of such a phenomena occurring and then observing an abnormal indication. During this event the display that initially could have provided them with that clue, the glideslope deviation indicator, was not available to them until they were approaching localizer capture. This is a period when the crews workload is starting to increase markedly with both internal and external tasks and to determine an indication is erroneous, without any other attendant warning, is to demand a high level of vigilance. The glideslope deviation indicator was reported by the PNF and SP as being 1-2 dots high initially and although it has been established that this indication did not occur, this demonstrates the fallibility of the human as a monitor. Under high workload a crew is likely to see what they expect to see rather that what is actually presented. For detection of an erroneous glideslope to be an effective trap the crew must have both pre-knowledge of the possibility of such an event occurring and the time to recognise an anomalous indication for what it is. The Standby Attitude Indicator ILS display is not inhibited and will display glideslope deviation once the glideslope receiver is receiving a valid signal. The use of this indicator may provide an early opportunity to detect an anomalous glideslope indication when the workload is lower.
With regard to the aircraft ILS system it is apparent from the design philosophy that crew may only be assured of receiving a warning of aircraft (onboard system) faults and that some erroneous states of the transmitting system will not be detected. The systems description and use detailed in the Operations and Flight Crew Training Manuals generally do not make this clear. When design logic is examined in context with flight crew situational awareness the inability of the aircraft to detect some ground navigation aid erroneous states becomes more critical, as this will most likely occur during an already high workload environment the approach and landing phase. For the aircraft system design philosophy to be effective the external inputs (ground-based signals) that are provided to the system must be 100% error-free.
Page 128 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 ICAO circular 238-AN/143 Human Factors Digest No 6 (Ergonomics), in considering the relationship between Liveware and Hardware (in the SHELL Model) states:
1.5 Liveware-Hardware. This interface is the one most commonly considered when speaking of human-machine systems: design of seats to fit the sitting characteristics of the human body, of displays to match the sensory and information processing characteristics of the user, of controls with proper movement, coding and location. The user may never be aware of an L-H deficiency, even where it finally leads to disaster, because the natural human characteristic of adapting to L-H mismatches will mask such a deficiency, but will not remove its existence. This constitutes a potential hazard to which designers should be alert. The following important principle must be reiterated: in the case of a failure, the user of a display should not be presented with unreliable information. The failure should be annunciated on the display itself, rather than on an indicator. It is very likely that, as long as the unreliable information is shown, sooner or later it will be used.
3.14
ICAO circular 216-AN/131 Human Factors Digest No 1 (Fundamental Human Factors Concepts) states:
3.3 Before a person can react to information, it must first be sensed; there is a potential for error here, because the sensory systems function only within a narrow range. Once information is sensed, it makes its way to the brain, where it is processed, and a conclusion is drawn about the nature and meaning of the message received. This interpretative activity is called perception and is a breeding ground for errors. Expectation, experience, attitude, motivation and arousal all have a definite influence on perception and are possible sources of errors. A display is any means of presenting information directly to the operator. Displays use the visual, aural or tactile senses. The transfer of information from a display to the brain requires that information is filtered, stored and processed, a requirement, which can cause problems. This is a major consideration in the design of flight deck displays. The information should be presented in such a way as to assist the processing task, not only under normal circumstances, but also when performance is affected by stress or fatigue. Three fundamental operational objectives apply to the design of warning, alerting and advisory systems: they should alert the crew and draw their attention, report the nature of the condition, and, when possible, guide them to the appropriate corrective action. System reliability is vital, since credibility will be lost if false warnings proliferate, as was the case with the first generation of ground proximity warning systems. In the event of a technical failure of the display system, the user should not be presented with unreliable information. Such information must be removed from sight or clearly flagged. For example, unreliable flight director command bars should disappear. Invalid guidance information which remained on display has been a factor in accidents.
3.35
3.37
31 August 2002
CAA of NZ
Page 129 of 203
CAA Occurrence No. 00/2518 2.3.2 Autoflight System The manufacturer has designed the autoflight system in accordance with the philosophy that the ground facility is designed, manufactured, installed and operated in accordance with Annex 10 specifications, i.e. it will radiate an error free signal or will shut down if a fault occurs. This is true provided maintenance error is not present. As an additional safeguard the ILS receiver also monitors transmission parameters that the ground aid itself monitors. The B767 does not validate the ILS to the same level as the crew; i.e. it does not require a valid identification signal. Once the autoflight system has captured what it perceives to be a valid signal it will accept that signal. If the aircraft receiver interprets the ILS signal as a valid on glideslope signal, the aircraft will capture the glideslope immediately and FCC glideslope law will not limit the descent angle if there is no steering information provided by the glidepath signal. The DDM value transmitted by the CSB transmission at Faleolo was greater than the resolution of the ILS receiver and FCC. In the absence of steering information provided by the SBO signal, the planned profile, the dynamics of the aircraft during configuration and the DDM value transmitted appear to dictate the path the aircraft will fly. The change in philosophy between the B767 autoflight system and earlier generations of aircraft automated control is significant. With earlier generation aircraft the pilot had to programme the aircraft if an autoland was required. The B767 autoflight system is designed to utilise an autocoupled approach and autoland as the standard method of approach and landing and the pilot must intervene if a manual approach and landing is required. This leads to increasing peripheralization of the pilot, with the machine making the decision that the pilot must countermand. This has the capability to lead to a possible deterioration in monitoring and situational awareness.
Evolution of Transport Aircraft Automation (ICAO Circular 234-AN/142)

CAA Occurrence No. 00/2518 2.3.3 Use of the VNAV Path Vertical Deviation Indicator To achieve any comparison between an ILS signal and the aircraft on-board navigation systems an FMC approach must be built. At Faleolo the crew accomplished this, but SOP does not require any check between the FMC vertical profile and the glideslope generated by the ground facility. The VNAV vertical path deviation indication on the EHSI is removed from view once the aircraft system has captured what is generally assumed to be a more accurate source of information. A fundamental assumption when gauging the difference in information between on-board computed systems and the ground aid is that aircraft navigation systems are subject to inaccuracy. However the physical position of the ground station will not change therefore, provided the signal is within acceptable tolerances, it will most likely be more accurate than most current on-board navigation systems. The VNAV path deviation indicator on the EHSI, while it is displayed, may provide a reasonableness check of vertical profile in relation to glideslope. Altimetry errors and FMC accuracy factors for VNAV path deviation data must be considered however. VNAV path deviation information is presented in numeric form on FMC progress page 2 during all phases of flight. VNAV Path information on the B767 can only be relied upon to provide crew situational awareness. As with the approach aid hierarchy there is a natural hierarchy that the crew subconsciously use when navigating en-route through to the terminal area. In this case the hierarchy will transfer from the on-board navigation systems (IRS/FMS) in cruise through to ground based area navigation systems such as VOR, DME, radar control etc. that will continually refine the mental plot that each pilot carries and rates according to the confidence that the aid engenders. The process, similar to an FMS update, applies to the mental picture created by the crew in determining position. Once the pilot acquires ILS information, mental transfer will be complete and absolute trust will be placed in the updated mental geographic position and on-board generated information will be accorded a lesser status. The increasing accuracy of current generation navigation systems, for instance GPS updated equipment, will cause a shift in this traditional hierarchy as crew become more exposed to the demonstrated accuracy and reliability of the on-board navigation systems.
31 August 2002
CAA of NZ
Page 131 of 203
CAA Occurrence No. 00/2518 2.3.4 Ground Proximity Warning System If the flight profile had continued unchecked a Mode 1 sink rate warning would probably have sounded at approximately 200 ft AGL. It is unlikely, unless the ROD increased to above 1400-1500 fpm, that a pull up warning would have sounded. A GPWS sink rate warning at 200 ft AGL may have been too late to allow recovery of the aircraft if there had been terrain in the flight path of the aircraft above the briefed DA/H, due to the incorrect position of the aircraft in the vertical plane in relation to along-track position. For a Mode 2B GPWS TERRAIN warning to occur, the aircraft would have required a terrain closure rate in excess of 2200 fpm. Mode 5 (Below Glideslope Deviation) would not have triggered, as the aircraft remained indicating on glideslope throughout the approach. The Air New Zealand selection of automated radio altitude callouts at 100, 50, 30, 20 and 10 ft RA, are to assist situational awareness during the landing phase of the approach. There are no automated radio altitude callouts to raise situational awareness of terrain during the approach; reliance being placed upon the crew to monitor terrain clearance. During this occurrence the crews attention was focused on configuring the aircraft and it is probable that, like the missed 300 and 100 ft above DH calls, a crew originated terrain awareness call would have been missed. An automated callout at a higher altitude may have served as a prompt to break that focus and helped them regain situational awareness with regard to position. An automated callout should be accompanied by a situational awareness related task, e.g. a profile reasonableness check. The Flight Safety Foundation recommends Radio Altimeter callouts at 2500ft, 1000ft and a smart 500ft callout, which recognises when a non-precision approach is being flown.
Page 132 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 2.3.4.1 Enhanced Ground Proximity Warning System (EGPWS)
Although not installed on ZK-NCJ the following chart traces the approach flight path of NZ 60 and indicates the altitude at which a current generation EGPWS would have provided a TERRAIN, TERRAIN PULL-UP warning.
3500
3000
2500 Altitude (ft-msl)
2000
1500 Alert off Altitude = 409 ft "Monitor Glideslope" 500 "Terrain-Terrain Pull-up" Altitude = 401 ft. Radio Alt. = 455 feet 4 5 6 7 8 9 10 11 12 13 14
1000
0
Distance to runway threshold (nm)
Aircraft Pressure Altitude
Normal Approach
Radio Altitude
Terrain Elevation
NZ 60 Profile Depicting Computed EGPWS Warning Altitude
EGPWS also has the ability to provide an adequate terrain warning from an erroneous approach. During an approach, the EGPWS Terrain Clearance Floor (TCF) function provides CFIT protection even when the aircraft is in the landing configuration. The EGPWS terrain database contains data on all hard surface runways in the world greater than or equal to 3500 feet in length. Attempts to land the aircraft away from the runway will result in EGPWS issuing a Terrain Alert Too Low Terrain. Air New Zealand have a programme to retrofit EGPWS to the current fleet, however due to the complexity of the installation and planning constraints, it will take up to three years to complete. An Enhanced Ground Proximity Warning System should only be viewed as a safety net; the ideal is for the crew to have sufficient situational awareness to prevent the aircraft being exposed to a potential CFIT situation.
31 August 2002
CAA of NZ
Page 133 of 203
2.4
NOTAMS
Three NOTAMs issued to the crew of NZ 60 referred to Faleolo navigation aids being unmonitored: A0068/00 FREQ 113.9MHZ IDENT FA VOR OPR, BUT CAUTION ADZD DUE TO UNMONITORED STATUS A0086/00 DME ASSOCIATED WITH ILS RWY 08 OPS BUT CTN CTN [sic] ADVISED DUE UNMONITORED STATUS A0092/00 ILS GP RWY 08 OPS BUT CTN ADVZD DUE OPERATING IN AN UNMONITORED STATUS. The ILS localizer or VOR DME was not promulgated as being unmonitored. In response to a question, each member of this crew stated that they believed unmonitored to mean that the aid was cleared for operation and safe to use, but was not monitored by the ATS controller in the tower. This was the intent of the NOTAMs, however the use of the terminology unmonitored in this sense is clearly incorrect and may lead to invalid assumptions. ICAO Annex 10 Volume 1 (2.8) and NZCARs 171 and 172 require that operational status information for any radio navigation aid that is essential for approach, landing and take-off must be provided, without delay, to the control tower and the Air Traffic Control unit providing an approach control service for that aerodrome. This means that any approach aid with an unserviceable tower monitor should be NOTAMed and withdrawn from service. The aircraft operator may not have the knowledge or expertise to determine the implications of a NOTAM stating an aid is unmonitored. A fourth NOTAM is also of significance: A0034/00 ILS/GP RWY 08 OPR WO SDBY TRANS When opinion was canvassed as to the meaning of this NOTAM, a majority of crew interpreted it as meaning the ILS glidepath was operating without a source of standby power, misreading the true state of the ILS glidepath equipment.
Page 134 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 2.4.1 NOTAM Distribution and Receipt Crew are reliant on NOTAMs or ATC communication to ensure unserviceable facilities are not used or procedures are modified to ensure safe operation. The distribution system for the Pacific does not guarantee that a crew will receive all the pertinent NOTAMs affecting a destination or alternate. Timeliness and accuracy of communication are essential to an operator particularly if the maintenance of a navigation aid, that may have an effect on planning and operational decisions, is planned during the intended hours of operation. The aircraft operator does not appear to be adequately served by such a distribution system.
2.4.2 NOTAM Terminology NOTAM terminology is another area that requires attention. A NOTAM by Annex 15 definition requires that it shall be as brief as possible and so compiled that its meaning is clear without reference to another document. A NOTAM stating an aid is unmonitored clearly does not comply with the intent of Annex 15. The aircraft operator could interpret this as either the field monitor being inoperative or the tower status indicator being inoperative. The need to interpret such a NOTAM leaves an avenue for error. Tower monitor is terminology that is in common use and as such recipients generally interpret the intent of the NOTAM. However the possibility of confusion between the tower monitor and the equipment monitor does arise.
31 August 2002
CAA of NZ
Page 135 of 203
2.5
ILS Design and Maintenance
2.5.1 ILS Required Components NZCARs are generic in that the requirements of Annex 10 are specified for all navigation aids. This investigation has focused solely on the use of the ILS and the glideslope in particular. The effect of operating other navigation equipment outside the specifications of Annex 10 is beyond the scope of this investigation. In addition, this investigation has only examined the glideslope null reference antenna system as installed at Faleolo. Different glideslope antenna systems have different radiating characteristics; some systems may be inherently safer than a null reference antenna system when radiating erroneous signals. It is not known whether the original authors of Annex 10 envisaged the possibility of systemic failure as at Faleolo, but they appear to have taken great care to ensure that the design of the equipment was such that it would not be able to radiate erroneous information provided it was designed and operated as per specifications. Annex 10 specifies the required components for an ILS as the localizer, glide path and marker beacons or DME. In addition each transmission shall have an associated monitor system and remote control and indicator. CAR 171 repeats that requirement; the only deviation being allowed is during an emergency. CAR 172 requires the control facility to have a status monitor installed in the tower and for the status monitor to be operated in accordance with the requirements of CAR 171. The status monitor referred to in the Rule and the remote control and indicator referred to in ICAO Annex 10 are the same piece of equipment with respect to the tower installation. This means that, under the current CAR environment, if the tower status monitor is inoperative the affected aid should not be offered for use. ILS equipment is designed to be self-monitoring and will shut down an out of tolerance transmission. If the other transmitter is not available the crew will be aware of the failed aid due to the on-board warning systems detecting the loss of transmission. The equipment monitor is also designed to be fail-safe and to shut the transmission down if the monitor fails. Once again the aircraft on-board systems will alert the crew to a failure of the navigation aid. Under normal service the tower monitor would not appear to have much significance other than to provide a controller with an awareness of navigation aid status and to provide an alert if there is a problem with the aid that needs attention. When maintenance human factors are introduced however, in the absence of a duplicate inspection when placing an aid back into service, the only quality assurance check for the system appears to be the tower monitor. It is the tower monitor that will inform the controller that the system is available for service with the equipment monitor in control. This will not provide an absolute guarantee of aid integrity. If, for example, maintenance on the monitor itself has been carried out there may be nothing to detect a mis-setting of the monitor tolerances, but it does assure the controller that the equipment has all the necessary components operating and the equipment monitor is in control.
NOTE: This investigation has assumed that all ILS equipment is designed and installed so that if the equipment monitor is not in control, the tower will be made aware by a change in or removal of status information. However in addition to Faleolo Airport, further investigation has ascertained that both the ILSs at Auckland International Airport and at least one at Christchurch International Airport do not advise the Tower or Approach controller that the equipment is in control (monitor) bypass. However a technical coordinator in Christchurch will get an indication if the equipment is in control (monitor) bypass.
Page 136 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 As the aircraft system cannot detect some erroneous states the absolute integrity of the ground aid is required to ensure fail-safe operation. For a category 1 ILS installation the responsibility for ensuring the global risk factor is not exceeded is vested in the pilot. However, in the absence of adequate warning on the flight deck, the only sure means of achieving this aim is by ensuring that the ground system is operating as per the specifications of ICAO Annex 10. If the aid has been withdrawn from service and maintenance is performed an absolute guarantee of aid integrity must be assured prior to placing the aid back into service. This does not appear to be possible under current practices and procedures due to the possibility of maintenance error. The proving flights at Auckland demonstrated the effect that a different DDM value can have on the profile. The proving flights did not conclusively establish that the profile differences were due solely to a change in DDM value. However, the conclusion is inescapable that the DDM does affect the profile flown. The CSB only signal at Faleolo had a slight fly down bias. The resultant profile path was close to the expected 3o flight path, making it difficult for the crew to detect an absence of glideslope steering information. The CSB DDM value can be used to trim the glideslope angle to counter affects of terrain and installation, therefore an effective safeguard of having all installations biased with a fly up CSB signal may not be technically feasible, however, an installation that will cause the profile to be radically different from what a crew is expecting should aid early detection of an erroneous glideslope. Knowledge of the type of installation may be of value for risk assessment of a destination.
2.5.2 ILS Identification Crews rely on the navigation aid ident and an absence of instrument flags to determine whether or not the aid is safe to use. For the approach into Faleolo the crew continuously monitored the ILS ident with the assumption that if any component of the aid failed, the ident would cease. In response to a question, all three crew agreed that the presence of a valid ident indicated the aid was operating and serviceable. The ILS is unique in that the ident is carried on the localizer only, however there are two approach options when using an ILS facility. That is, a precision ILS approach or a nonprecision localizer only approach, as it is accepted that a localizer may radiate without the glideslope, but the glideslope cannot radiate without the localizer. With reference to flight deck indications the only distinguishing feature between the two approaches is a glideslope warning flag, or in the case of the B767, absence of a glideslope pointer.
31 August 2002
CAA of NZ
Page 137 of 203
CAA Occurrence No. 00/2518 2.5.3 Inadvertent Radiation of Erroneous Glideslope Signals Faleolo reported that prior to this incident glideslope transmitter one was faulty and transmitter two was serviceable. When the glideslope transmission equipment was put back into service after repair necessitated by damage caused during the airfield works programme, the system was left in the control (monitor) bypass mode. Therefore the ability of the equipment monitor to switch off the faulty transmitter was negated. There cannot have been any adequate safety checks carried out by the technician prior to leaving the installation, to ensure the faulty transmitter was not the transmitter selected to service. With the tower monitor unserviceable, the controller was unable to determine the status of the glideslope; therefore this vital safety measure to detect maintenance error was unavailable. Systemic failure invalidates the crew justified mental set and the aircraft and ground equipment design criteria. Transmission of erroneous glideslope signals may arise two ways a maintenance error as per Faleolo, or during installation and maintenance as is likely during phasing checks when the steering information provided by the SBO signal may not be radiating correct information. In this case all the signal components will most likely be present. Maintenance error should be detected by adequate equipment checks when placing the aid back into service. Training and the provision of equipment safety check lists should prevent faulty equipment being put into service or equipment being left unmonitored. If maintenance checks fail to detect the error the controller should query the reason for the tower monitor being inoperative. Bypassing the equipment monitor will result in a change in the status information provided to the control tower that should result in the air traffic controller questioning the reason for an alarm. Although the tower status indicator does not provide an absolute guarantee that the equipment is not radiating out of tolerance information, it should provide a check that the equipment monitor is in control. An aircraft system that is critical to safety requires a duplicate inspection prior to release to service. An ILS and in particular an ILS glideslope, is just as essential to safety as aircraft systems. There is also a risk of a crew using equipment that is undergoing installation, maintenance or test. There are at least two situations when this may occur: a crew knowingly using equipment that still has an active NOTAM issued against it and on which maintenance is still being performed. Presented with an ident and no flags, the crew may make an invalid assumption as to the serviceability of the aid. This is not uncommon behaviour. a crew being unaware equipment is on test and subsequently using it. If they are not in receipt of a NOTAM or communication advising the glideslope is out of service, there may be nothing on the flight deck that will alert them to that fact and mis-understand the intent of a clearance, e.g. cleared for an ILS approach glideslope unusable. The intent of such a communication is for a localizer approach, however that point is not made absolutely clear to the crew. If the crew has not received clear communication advising that the glideslope is on test and not to be used for navigation, it is highly probable they will use the erroneous information in the absence of any flight deck warning due to the perception arising from a valid ILS ident being transmitted.
Page 138 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 The autoflight system accepting an erroneous signal will reinforce the decision to use the aid in the above two situations and the aircraft annunciating a valid autoland status during approach will increase the crews level of confidence in the autoflight system. If the ground aid is radiating erroneous information it is imperative that the crew are in no doubt as to the serviceability of the glideslope. From a safety systems perspective, if during maintenance the glideslope will be radiating erroneous information, the only way it can be assured the flight crew will not use the aid is to also remove the localizer ident or remove the localizer from service. ATC and ground navigation aid maintenance personnel interviewed during this investigation assumed the aircraft systems would be capable of detecting erroneous information and provide an alert to the crew. Experience has taught us that this is not necessarily true. ICAO Document 8071 Manual On Testing Of Radio Navigation Aids, Chapter 1.6 suggests:
Facility status can be identified as follows: a) Usable: Available for operational use. i) ii) Unrestricted: Providing safe, accurate signals-in-space conforming to established Standards within the coverage area of the facility. Limited or restricted: Providing signals-in-space not conforming to established Standards in all respects or in all sectors of the coverage area, but safe for use within the restrictions defined. The facility that may be unsafe should not be classified as limited or restricted under any circumstances.
b)
Unusable: Not available for operational use as providing (potentially) unsafe or erroneous signals or providing signals of an unknown quality.
Therefore until it is assured the facility is operating as designed, i.e. the equipment monitor is in control, the facility should be promulgated as Unusable. The Manual On Testing Of Radio Aids Chapter 1.8 Notification Of Change Of Status suggests:
1.8.1 Notification of a change of the facility status is to be done through appropriate Aeronautical Information Publications; differences from Standards are to be notified to ICAO and in a Notice to Airmen (NOTAM). Day-to-day changes in the status of facilities are to be promptly and efficiently advertised. A change in the status of a commissioned facility as a direct result of ground or flight inspection procedures, and resulting in a usable (unrestricted, limited, or restricted) or unusable designation, should be advertised immediately by air traffic control (ATC) personnel, and promptly by a NOTAM. A facility having an unusable status is normally removed from service and can operate only for test or troubleshooting purposes.
1.8.2
1.8.3
2.6
Approach Plates
The presentation of different sources of information as to distance from the airport, on both the STAR and Approach plates, provide the possibility for confusion and errors in rule-based decisions regarding the position of the aircraft in space.
31 August 2002
CAA of NZ
Page 139 of 203
2.7
Standard Operating Procedures
2.7.1 Flight Deck Management Flight Deck Management states: each flight crew member is expected to communicate any significant operational development immediately. Although individually the crew were uncomfortable with the early glide slope capture, there was no immediate warning/alert available to them to ascertain the reason for their discomfort except that they apparently had a shorter distance/time to the runway threshold than expected and would resolve the cause before becoming terrain critical. 2.7.2 Supplementary Pilot Duties and Responsibilities Whilst it is recognised that the aircraft is certified for two pilot operation, the Supplementary Pilot, when carried, has duties and responsibilities detailed in SOP 1.1.5:
To participate in briefings, and actively monitor the flightpath of the aircraft and actions of the PF and PNF. Maintain an operational awareness and lookout. Bring to the attention of the operating crew any abnormalities or departures from SOPs and previously briefed intentions.
The seating arrangement and resultant line of sight may not be adequate for the SP to fully discharge the duties as required by SOP. 2.7.3 Automation Philosophy The crew used the automation as trained. Until the point of glideslope capture there was no reason or clue to cause them to alter the level of automation in use. Once the PF had determined he could no longer trust the level of automation, the autopilot was disconnected. 2.7.4 FMC Arrival The primary purpose of modifying the arrival route is to achieve a most likely descent profile. Any ATC instruction that is at variance with the programmed arrival will invalidate the route. SOPs recognise the extra workload and associated problems reprogramming the FMC can create and recommend that: FMC modification should always be commensurate with workload. It must be done with the minimum of distraction to basic duties. Significant modifications should be avoided below 10,000 ft when such changes affect the monitoring of the aircraft flight path. SOP do not specifically prescribe the requirement for an FMC arrival to be built and it will not always be possible for crew to have an arrival programmed for the active runway, particularly if there is a late change to the runway in use. The attendant problems with crew distraction will create more risk than having an absolute requirement for the landing runway to be programmed into the FMC; however, the practice should be encouraged provided current SOPs are adhered to.
Page 140 of 203
CAA of NZ
31 August 2002
2.8
Proving Flights
From analysis of the FDR information from the Faleolo flight and the two proving flights at Auckland, it was noted that the aircraft descent path was not constant throughout the approach as it would be if the aircraft were receiving valid glideslope guidance. This is probably due to many factors, including configuration changes, however the DDM value of the glideslope CSB also appears to have an influence on the vertical profile. The DDM value transmitted by the glideslope CSB may contain a small fly up or fly down imbalance, which the aircraft receiver is capable of interpreting. On some individual installations, the CSB may be unbalanced to align the glideslope to counter effects of terrain, aerial siting and transmission characteristics. It was noted during the proving flights that the flight profile could be altered from the ground by varying DDM values transmitted by the ground facility. 2.8.1 Proving Flight One From the data obtained from proving flight one, the following points were established: The aircraft captured and recorded an erroneous glide path with flight deck indications identical to the Faleolo incident. At glideslope capture the aircraft commenced the majority of descents with a profile of approximately 3o. This angle of descent subsequently flattened out and in some cases commenced a climb while still indicating on glideslope. Noted from the two flights was a strong similarity in the DDM values, both small and averaging approximately 0.0016 DDM. While the FDR from ZK-NCJ records a very static set of values from Faleolo, the FDR from ZK-NCL shows a more random spread of values. It is not known whether this is a function of the different Flight Data Recorders used, or a function of the transmission patterns of a Toshiba glide path system versus a Phillips installation. Two different aircraft were used on two different ILS installations. This may be significant, but this is considered unlikely.
What was not replicated was the profile flown at Faleolo. Subsequent analysis, using ROD versus ground speed, revealed a subtle steepening of the approach angle from approximately 3.3o, at glideslope capture, to 4.3o prior to the commencement of the missed approach. The median descent profile was approximately 3.5o from the point of glide slope capture through to the missed approach point. The initial suspicion was that these proving flight profiles were a result of trim changes as the aircraft was reconfigured. The FDR data from proving flight one was subsequently re-analysed and a discrepancy in the polarity of the DDM values was noted. At Faleolo a consistent positive value (fly down) was recorded. At AKL, a negative DDM (fly up) value was noted. Whilst the DDM values recorded are small, they are greater than the sensitivity values of the ILS receiver and FCC.
31 August 2002
CAA of NZ
Page 141 of 203
CAA Occurrence No. 00/2518 2.8.2 Proving Flight Two The data captured by the second proving flight generated one profile very consistent with that flown by NZ 60 at Faleolo. The crew on proving flight two could not configure the aircraft within the time frame recorded from NZ 60. Whilst this was on a steeper angle, the aircraft was lighter with a crew expecting the problem. Within the area of transmission, if the transmitter is radiating CSB only, both the glideslope and localizer will generate on track and on glideslope indications on the flight deck. The resultant profile can be affected by the residual DDM value transmitted by the ground facility. While the more dramatic fly up and fly down approaches are most likely to get early attention, the insidious deviations as experienced by NZ 60 and the second proving flight with a glide path angle slightly steeper than normal, but not remarkably so, and a heading that is close, as opposed to one 30o off, may not be detected by the crew in a timely manner.
2.9
Organisational Factors
2.9.1 Pilot Training Air New Zealand does not have control over the training of pilots prior to induction and relies on the licensing system and experience gained through the military and other operators to ensure the inductee has the pre-requisite knowledge and skills that the company requires. The knowledge, skills and basic procedures necessary to attain the appropriate Licences are taught by organisations that may have different operational requirements to Air New Zealand. Research shows that the skill sets required in the current generation of airline pilots are quite different from those required in the past when analogue aircraft were the norm. There is a need to review the company Pilot Introductory Programme training package to ensure it serves these skill sets. The design philosophy of glass cockpits varies between types and manufacturers. The philosophy and related human factors is not taught during type rating courses. This is a potential weakness. The pilot needs to understand the underlying design philosophy to aid in understanding the use of the relevant equipment. The opportunity is presented to analyse the technical questions given to pilots during selection to identify general trends or weaknesses in knowledge, which may provide a tool to enable the PIP course to be altered to pick up on general deficiencies. Potential deficiencies at present appear to be in the areas of: An understanding of the current Rules environment, particularly in allied areas such as maintenance, air traffic, aeronautical telecommunications etc. Air New Zealand Safety System aims and requirements. Design philosophy particular to the aircraft type and the human factors associated with that philosophy.
Page 142 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 2.9.2 Safety System Reason (1997, Managing the Risks of Organisational Accidents) in What Fuels the Safety Engine? states: Three ingredients are vital for driving the safety engine, all of them the province of top management. These driving forces are: commitment, competence and cognisance the three Cs. Paired comparison studies examining pairs of companies matched in all respects except for safety performance - have shown that the two characteristics most likely to distinguish safe organisations from less safe ones are, firstly, top level commitment and, secondly, the possession of an adequate safety information system. Neither commitment nor competence will suffice unless the organisation has a correct awareness or cognisance of the dangers that threaten its operations. In addition to Professor James Reasons three Cs the investigation asserts two more should be added: Communication. This must be both two-way and effective, and Culture. Although Professor Reason includes culture in commitment this investigation asserts that culture is the province of the entire organisation and it is the responsibility of every person within the group to foster an effective safety culture.
2.9.2.1
Incident Reporting
At present the Group is reliant on reports from operational personnel to obtain information for safety analysis. Current Air New Zealand Human Resource policies and procedures do not formally recognise human fallibility. This is at variance with the Group Incident Reporting policy. To attain a consistent culture across the company this anomaly should be addressed.
31 August 2002
CAA of NZ
Page 143 of 203
CAA Occurrence No. 00/2518 2.9.2.2 Flight Operations Quality Assurance Data In their final report, the Flight Safety Foundation Approach and Landing Accident Reduction Task Force state: Conclusion No 7: Collection and analysis of in-flight parameters (e.g., flight operational assurance [FOQA] programs) identify performance trends that can be used to improve approach-and-landing safety. Air New Zealand does not collect Flight Operations Quality Assurance (FOQA) data for operational analysis on a routine basis. An event that may be significant to the safety system may be unnoticed or not recognised by the crew as being of import to the overall health of operations. It is generally accepted within the aviation industry that a FOQAtype programme may identify precursors to systemic or individual problems with technique or procedure, providing a tool that allows the system to intervene before rather than after an incident or accident.
2.9.3 Documentation:- Operations Manuals Although not specifically stated within the Operations Manual suite, when examining statements relating to the use of ILS facilities and associated onboard equipment, the protocols appear to assume the ground facility is either radiating in the design state or that the aircraft will detect a failure. Some of the statements may mislead a crew into misplaced confidence in the ability of the aircraft to provide a warning of all erroneous states. Due to Boeing receiving a previous report of a similar event, the Boeing B767 Operations Manual Volume 1 and Quick Reference Handbook ILS Approach flight pattern diagrams were updated to include a verification of the altitude crossing check at the outer marker or final approach fix. While this information had not been incorporated into the Air New Zealand operations manuals prior to the occurrence at Faleolo, the information was already incorporated into SOPs. During assessment of the Boeing amendment, Air New Zealand did not appreciate the true import of the change as no information was provided to indicate why the change was being made. If explanation is not provided for a change of information there is a risk that this type of information will not be accorded a high priority when being assessed for incorporation. The Flight Crew Training Manual contains information that is not found in the Volume 1 or 2. It is not compulsory for crew to retain the manual after type rating, however trainers and line crew do find useful reference information and techniques contained in the manual. After type rating training, most crew retain the manual for study purposes. Trainers have passed general comment that where differences in technique are noted between Air New Zealand and Boeing, individual confusion can occasionally arise. Although there is a rider in the front of the FCTM to cover the differences issue, conflict in published information is not ideal.
Page 144 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 2.9.4 Airport Categorisation Airports used by Air New Zealand are audited and categorised by the company Airfield Certification Unit to assess their suitability for operation. Although the navigation aids are assessed, the maintenance of the aids is not. The ICAO classification index would provide an operator with a benchmark in assessing the level of confidence that may be placed in the engineering reliability of the navigation aid but will not indicate how good the system supporting the facility is. The classification system does not appear to be widely used and would most likely need to be assigned and monitored by an independent body to have any real meaning. The Airport categorisation process presents the company with an opportunity to apply a similar philosophy to provide guidance to crew when assessing a destination or alternate.
31 August 2002
CAA of NZ
Page 145 of 203
CAA Occurrence No. 00/2518 2.9.5 Analysis Summary When reading this incident report it must be recognised that Air New Zealand Flight Operations accepts that humans err. This investigation does not seek to apportion blame; rather it attempts to identify means to prevent a similar recurrence. The crew statements to the investigation team have been corroborated with other data where possible and are consistent with analysis of the FDR. The crew was well briefed and prepared for the approach. They took measures to mitigate the effect the failure of an unmonitored aid would have on the approach, with the assumption that they would be alerted by the identification signal ceasing, the equipment monitor removing the aid from service and the aircraft displaying appropriate warnings. Until localizer capture crew situational awareness was high this was demonstrated by the SP questioning the flight profile deviation through the arc and the PF mentally monitoring the descent profile. The glideslope/height relationship using FA VOR DME had been included in the approach briefing, the intention to provide a rule of thumb means of verifying the approach profile. At glideslope capture a distance/altitude comparison by rule of thumb would have identified that there was a gross error in a navigational parameter: DME, altimetry or the unthinkable - the glideslope. This investigation has attempted to determine why the gross error was not detected. The crew involved in this incident are trained, very experienced and have been examined and checked repeatedly throughout their careers. Individually they have no record that would point to poor performance or raise concern. There is no evidence of automation complacency. This investigation has established that at least one member on the flight deck was carrying a mental plot of the profile, but at glideslope capture, that mental plot along with rule of thumb orientation was discarded. This raises the question of crew situational awareness in relation to the approach profile and terrain awareness. Despite the precautions taken by the crew in planning and executing the approach they still accepted the glideslope capture as valid. Individually, the crew were conscious that there was something amiss, however, they could not immediately determine the cause for their unease. Reinforced by instrumentation the crew subconsciously relegated the task of resolving the ambiguity for later attention, prior to becoming terrain critical. When the aircraft captured the glideslope the crew were presented with a situation that was outside their knowledge, experience or expectation. Any warning that the crew could reasonably expect to be displayed was not presented to them. The scenario was totally unexpected and untrained for. That the crew were able to unlock their mental set in the time they had available - approximately 15-20 seconds from the end of landing checklist to autopilot disconnect - is testimony to their functioning as a cohesive group. Whilst it is acknowledged the crew had an opportunity to detect the erroneous glideslope prior to making the go-around decision, it is the view of the investigation that a high proportion of line crews would have made the same decision at glideslope capture. Human error caused the incident but it must also be recognised that human factors prevented a more serious outcome. This investigation has determined that one glideslope check cannot be relied upon as an absolute error trap for a glideslope radiating erroneous information. It is still possible that the glideslope/altitude check could be carried out and an erroneous glideslope not be detected by
CAA Occurrence No. 00/2518 the crew. If we accept the check was designed to detect an invalid glideslope we demonstrate no confidence in the design and ability of the ground navigation aid equipment monitor to prevent erroneous information being radiated. This cannot be true. The accuracy and reliability of the ILS has been well demonstrated over many years and the associated high degree of confidence that pilots have in the system is the foundation upon which all-weather operations is built. Pilot mistrust in the approach aid will result in more missed approaches and non-precision approaches, creating attendant problems for Operators and Air Traffic Control. Alternative means should be instituted to ensure the crew verify the glideslope for reasonableness prior to acceptance / during approach. The glideslope check should be used for what it is designed; to validate altimetry and trap the potential error of mis-set or erroneous altimeters to ensure that, on a precision approach, the aircraft does not infringe Obstacle Clearance Altitude/Height at DA/H and through the missed approach path. This investigation has established that, if an anomaly with the altimeter check is noted, the crew may not be able to immediately identify where the problem lies. Prior to this incident an erroneous glideslope providing no warning to the crew was to Air New Zealand unthinkable. Although the glideslope transmitter at Faleolo was placed into service with no SBO amplifier and so was incapable of providing all the necessary signals, that fault should have caused the equipment monitor system to shut down the defective transmitter. Leaving the equipment monitor in a control (monitor) bypass mode negated that safety system. The occurrence still could have been prevented if the tower monitor had been designed and installed as per the intent of ICAO annex 10, and available to the controller. As maintenance had been carried out on the glideslope transmission equipment, in the absence of the tower remote control and indicator the ATC controller was totally reliant on the technician maintaining the ground equipment to carry out the task correctly. Due to the ILS system being designed to operate remotely the significance of the tower monitor becomes more apparent when the Rules and Annex 10 are viewed with the benefit of hindsight. Although the tower indicator does not guarantee absolute aid integrity, it does provide assurance that the aid is operating within the parameters set at the field monitor. Because the ground transmitter is designed to operate remotely and the aircraft system may not alert the crew to some faults, there may be occasions when the tower controller, or controller clearing the aircraft for an approach, is the only person that has information that indicates the equipment may not be safe to use. Analysis of the entire ILS system in light of this incident demonstrates that, for an ILS approach using a category 1 installation, to ensure fail-safe operation requires all components of the system to be operating as specified by ICAO Annex 10. If any component is missing, absolute integrity of the approach cannot be assured. Safe operation may be possible with some elements of the system inoperative, but for that to occur positive guidance is needed and good procedures need to be in place and adhered to. The system is so dependent upon all the component parts that once the human element is introduced the margin for error becomes very slender. ICAO Annex 10 vests the responsibility for ensuring the global risk factor for category 1 ILS is not exceeded more or less completely in the pilot. This can only be achieved if the equipment monitor is in control and the ground system is free from maintenance error.
31 August 2002
CAA of NZ
Page 147 of 203
CAA Occurrence No. 00/2518 Operation in compliance with NZCARs will ensure conformance with the ICAO Annex 10 specification and thus will guarantee the validity of the signal. Operation outside NZCARs allows equipment to be operated in non-conformance with the Annex 10 specification and invalidates fail-safe performance. This raises the question regarding the legality of transmitting erroneous navigation signals and offering for use an approach and landing aid that is transmitting erroneous navigation information, which a crew may unknowingly use for an approach. The aircraft operator has no control over the quality of maintenance provided by ground navigation aid maintenance staff; reliance is placed upon the relevant service provider and regulator to ensure that adequate procedures are in place to prevent similar occurrences. A duplicate inspection is required when aircraft critical systems are disturbed during aircraft maintenance, a lesson learnt by aircraft maintenance organisations to help mitigate human error. A navigation system used as an approach aid is just as critical to a successful operation as correctly functioning aircraft control systems; they both have the potential for the same outcome. Although the probability of the re-occurrence of a chain of events similar to that experienced at Faleolo is remote, there is a greater risk of crew using a glideslope that is radiating erroneous information during maintenance or test. In this case, all the components of the glideslope signal may be present; therefore an on-board detection system may not be practicable or possible. When formulating defences to trap systemic failures within the ground navigation aid system, they are two distinct cases; the first is maintenance error at the ground navigation aid, the second communication error and/or flight crew error. Positive communication is essential to the system. Receipt of a NOTAM is not guaranteed therefore a more reliable system is required, to ensure an unsuspecting crew do not use an ILS that is not safe for operational use. The aircraft operator is attempting to design procedures and techniques to trap errors originating from systems over which the operator has no direct control. Once the error chain is established total reliance may be placed on crew to detect an anomaly and take the appropriate action. Faced with information that they have been trained and conditioned to accept and trust, they may have to detect subtle clues and analyse the problem while confronted with compelling information that will probably over-ride the conflict. Even if the crew had carried out a DME/altitude check at glideslope capture and detected the erroneous glideslope at that point, the fact is the incident occurred when glideslope was allowed to transmit erroneous information in-service. The latent condition still exists within the ILS approach aid design and in-service practices and at times the system may be reliant on a single check to detect a hazardous erroneous state. This indicates the system is not error tolerant. While the aircraft and airborne equipment manufacturers have provided a warning system to detect on-board failures and some ground transmitter faults, a more holistic approach must be taken to support the pilot. During an ILS approach the aircraft and ground aid interact to provide a complete system and, from the operators perspective, this system cannot be viewed as anything less. It will always be the final responsibility of the crew to determine whether the navigational aid is providing reasonable information and whether it is safe to continue using that particular aid. When decisions must be made during an approach it is immaterial which equipment has failed or is providing invalid guidance, the pilot must have clear and unambiguous information in order to make the determination whether it is safe to continue. A
CAA Occurrence No. 00/2518 system or display that does not alert the user to unreliable information is contrary to recognised human factors / ergonomic principles. For the operator, the only defences available at present appears to be issuing instructions regarding the use of unmonitored equipment or equipment on test or maintenance, raising crew awareness, crew education regarding CFIT and seeking methods of raising crew situational awareness during the approach phase. These techniques will provide an overall benefit for all operations, however, until the true cause of the problem is rectified the operator remains at risk. GPWS cannot be relied upon to provide adequate warning during such an event, however EGPWS will provide a safety net for this type of incident. Air New Zealand, and the aviation industry as a whole, has been provided with a significant free lesson. This incident was caused by errors within the whole aviation industry. To achieve a solution requires co-operation and co-ordination between the relevant sectors: ground radio navigation aid systems and design, aircraft systems and design, ground navigation aid technician, ATC, operator, regulators and international industry forums. Aviation safety is a global system. An operator has duty of care to manage deficiencies within their own system, however, that operator is still vulnerable to external decisions and actions. Capt Daniel Maurino in Human Factors and Training Issues in CFIT Accidents and Incidents (ICAO Controlled Flight Into Terrain Education and Training Aid) argues: There are no factors inherently specific to CFIT occurrences. All the factors listed as contributing to CFIT occurrences (Slater 1993) are currently addressed by existing training curricula: navigational errors, non-compliance with approach or departure procedures, altimeter setting errors, misinterpretation of approach procedures, limitations of flight director/autopilot etc. All these factors are addressed either during ground school or simulator training. Those factors not covered by technical training are included in CRM training: maintenance/loss of situational awareness, deficient intra-cockpit interaction, flight crew communications etc. A dedicated training package would be a meagre contribution to reduce CFIT occurrences. The answer to CFIT occurrences lies in looking at them from a systems perspective, and act upon the latent failures which have slipped into the system, ready to combine with operational personnel active failures and further compounded by adverse environmental conditions, may combine to produce an accident (Reason, 1990). . . . When looking for solutions to CFIT occurrences it is imperative to think in collective rather than individual terms (Beaty 1991). It is nave to brand an entire professional body as being mainly responsible for aviation safety. It is equally impossible to anticipate the many disguises human error may adopt to bypass even the most cleverly designed safety devices. Lastly it is an unattainable goal to eliminate all system deficiencies leading to accidents. The solution rests in securing a maximum level of system safety fitness (Reason 1992) by working upon latent system failures which modern accident causation approaches syndicate as responsible for disasters in high technology systems.
31 August 2002
CAA of NZ
Page 149 of 203
Intentionally blank
Page 150 of 203
CAA of NZ
31 August 2002
3.
3.1 3.1.1 3.1.2 3.1.3 3.1.4 3.1.5 3.1.6
Findings
Crew The crew were appropriately licensed and current on the B767 aircraft type. Industrial issues, fatigue and personal stress were not factors. The crew were cohesive and had planned carefully for the duty. Open communication was encouraged. The aircraft was managed in accordance with company SOPs. When the aircraft captured the erroneous glideslope, the crew situational awareness was reduced due to increased task loading as a result of higher than planned aircraft speed and a lesser flap setting than what was planned, for the glideslope intercept.
3.2 3.2.1 3.2.2
Aircraft The aircraft was properly certificated and maintained in accordance with existing regulations. The aircraft captured an erroneous glideslope. Flight deck indications for the localiser and glideslope indicated on localizer and on glideslope, with no flags displayed. The autoflight system accepted the glide path. At 1500 feet the autoflight system went to AUTOLAND mode. While the FCC is in the G/S ARM mode, pitch control law in the FCC computes a 0.05g capture manoeuvre based on the relative vertical speed between the aircraft and the assumed 3o glideslope. The capture point is variable to ensure a 0.05g capture of the glideslope except that, if the glideslope error is less than 80 ft, G/S CAP will occur without satisfying these criteria. Once the glideslope is captured FCC control laws will manage the flight path vertical profile to maintain the DDM at zero. FCC glideslope control law does not limit the angle at which the aircraft will descend on a glideslope. The GPWS did not give any warning whilst the aircraft was configured for landing and indicating on glideslope. A Terrain Awareness and Warning System (TAWS) would have given a warning in this event whilst the aircraft was configured for landing. The aircraft ILS receiver equipment conforms to the ideal of ICAO Annex 10 Volume 1 Attachment C. There is no design specification requirement for the aircraft to detect the presence of the glideslope SBO signal. There is also no design specification to detect the SBO signal is in the correct phase relationship with the CSB signal.
3.2.3
3.2.4 3.2.5 3.2.6
31 August 2002
CAA of NZ
Page 151 of 203
CAA Occurrence No. 00/2518 3.2.7 3.2.8 The CSB [only] signal is sufficient to allow the glideslope deviation pointer to be displayed. The absence of the SBO signal from the transmitted glideslope signal leaves a balanced CSB [only] signal that may not be immediately identified by the crew as an invalid on slope signal. The CSB [only] signal is interpreted by the airborne ILS receiver as a glideslope with infinitely wide limits. The result may be the course deviation indicators remaining centered on the display with no warning apparent to the crew. Shifting the phase relationship between the CSB and SBO signals may have a similar effect.
3.3 3.3.1 3.3.2
Ground equipment The ILS system was operating without a functional Remote Tower Status Indicator. ILS ground transmitters as well as other ground navigation aids are capable of providing erroneous information that aircraft may accept, and may remain undetected by the crew. When the glide path was restored to service after maintenance, the equipment was inadvertently left in control (monitor) bypass mode, with the unserviceable transmitter selected. This resulted in the glide path transmitter executive monitor being unable to shut down the faulty transmitter or to transfer to the serviceable transmitter. Faleolo ATC does not get any indication at the controllers position that the localizer or glide path have been left in control bypass. This could result in faulty transmissions being radiated and the controller being unaware. This creates a single point of failure. The Samoa Airport Authority has no active maintenance contract with outside parties for calibration of instruments, competency checking of technicians, or for jobs beyond their capability. The Uninterrupted Power Supply batteries have deteriorated to such a degree that they are unable to back up the ILS during a complete power failure. The tower status indicator audio alarm sounds continuously only when a transfer or shut down occurs i.e. red lights appear on indicator panel. The Controller is able to silence the alarm indefinitely by activation of a toggle switch. The Tower Remote Status Indicator lights are very dim and cannot be seen in daylight. There is no brilliance control. The ILS equipment is 14 years old and spares acquisition is becoming a problem. The controller does not have the ability to shut down or reset the ILS if the necessity arises, but has to wait for the technician to arrive to do so.
3.3.3
3.3.4
3.3.5
3.3.6 3.3.7
3.3.8 3.3.9 3.3.10
Page 152 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 3.4 3.4.1 Event The issue of a NOTAM stating that the ILS is unmonitored is in contradiction of the equipment requirements, contained in Annex 10 specifications, and as required by New Zealand Civil Aviation Rules parts 171 and 172. NOTAM receipt by aircraft operators and pilots is not guaranteed. NOTAM terminology does not always reflect clearly what the technical personnel have requested to be stated in the NOTAM. Pilots unknowingly using an ILS transmitter, while the transmitter is on maintenance or test, may use erroneous information because there may be no flight deck warning. The erroneous glideslope indication was not detected by the pilots, prior to arming the APPROACH mode. The statements pertaining to navigation aid information reliability in Air New Zealands Aircraft Operations Manuals only refer to on-board equipment or ground equipment if there are no erroneous navigational signals being transmitted by the ground navigational aid. Air New Zealand has no documented requirement for the approach briefing to identify the anticipated point of glideslope capture, and the means to verify the glideslope (and localizer) appears to be reasonable. On the B767, having both EHSIs continuously selected to MAP display during an ILS/DME approach does not conform to the SOP Approach Aid Integrity check if the approach is constructed with a frequency paired DME. Air New Zealand has no documented administrative procedure to manage crews that have experienced an incident that could result in potential distress for the crew. Air New Zealand Human Resources Policy Manual does not reflect the company incident reporting policy and the just culture. Air New Zealand does not operate a FOQA program to collect and analyse flight data to identify errors and trends. Air New Zealands low drag approach procedure is at variance with the Boeing recommended profile of flap 20 at glideslope intercept. Air New Zealand has no procedure to cover CVR information capture, preservation, retrieval, quarantine, storage, reading and release to other parties. During Air New Zealand airport categorisation and audits, navigation aid conformance with ICAO Annex 10 specifications is not ascertained. There is a potential deficiency in the Air New Zealand introductory pilot training package regarding rules, safety systems, ground navigation aids, glass flight decks, human factors and situational awareness training.
3.4.2 3.4.3 3.4.4
3.4.5 3.4.6
3.4.7
3.4.8
3.4.9
3.4.10 3.4.11 3.4.12 3.4.13 3.4.14 3.4.15
31 August 2002
CAA of NZ
Page 153 of 203
CAA Occurrence No. 00/2518 3.4.16 Air New Zealand type rating training does not contain a formal human factors package pertaining to ergonomic factors associated with the specific aircraft type. The technician had only one period of annual leave of 21 working days during September 1997 in the period November 1994 to February 2001. No other leave period exceeded 5 working days. The technician does not have a fully trained and competent back up. The Samoa Airport Authority was in non-compliance with the Civil Aviation Rules of Samoa by offering the ILS for service when all the required components were not working. Most Air Traffic Controllers, Pilots and Ground Technicians interviewed during this investigation were unaware that certain erroneous transmissions would not be indicated on the aircraft.
3.4.17
3.4.18 3.4.19
3.4.20
Page 154 of 203
CAA of NZ
31 August 2002
4.
4.1 4.1.1
Recommendations
Boeing Boeing to consider modifying the glideslope indicator to become visible earlier than within 90 degrees of the front course. This will allow pilots, to observe an abnormal indication, of continuously on slope, when it should not be so.
Boeing feels the wide-angle glide path (GP) signal is not likely to provide much confirmation of reasonableness for the following reasons: In the area of 20 to 90 degrees from the runway heading, most GP systems exhibit several side lobes and nulls in azimuth. Consequently, the directivity of the GP antenna system will result in routine flag alarms, even for a healthy GP station. The unpredictable (and untested by flight inspection) nature of the signals at wide angles due to terrain and multi-path sources that are outside of the area controlled for purposes of generating GP signals. The proposed change would pose unnecessary problems and risks with the glideslope deviation due to back-course approach considerations. Pilots have been told to check the reasonableness of the localizer and glideslope before arming the modes. It is a deeply engrained check-localizer on the correct side and glideslope where you expect it to be. If we allow the display of this when more than 90 degrees out, then it will be confusing to the pilots because the localizer will display on the other side of the display than what you see when you are inbound.
Response:
4.1.2
Boeing consider reviewing the localizer and glideslope capture cues such that misleading capture indications cannot be presented to the crew, taking into account both autocoupled and manually flown approaches.
Boeing agrees that misleading capture indications should not be presented to the crew. Boeing designed the airplane ILS system such that the probability of presenting misleading indications is as low as reasonably possible. Unfortunately, there is no reasonable solution currently identified that would allow the receiver to identify ILS signals without SBO (side band only).
Response:
4.1.3
Boeing to amend all aircraft operating manuals to warn against the use of radio navigation aid facilities which are notified to be out of service even though its cockpit indications might appear to be normal. Also to add a warning that some erroneous transmissions from ground navigation aids will not be detected by the airborne receiver, or provide an instrument warning to the crew.
Boeing has modified its Operations Manuals (OM) and Flight Crew Training Manuals (FCTM). An example of the changes made to the 767 OM is for the Landing Procedure and ILS Approach. The localizer intercept heading instructions were added to these normal procedures before localizer capture. On page 4.12 of the FCTM the warning was revised from a caution. We also have further modifications proposed, to include additional procedural redundancy and more explicit warnings about the need for crosschecking cockpit indications, to guard against using navigation signals containing Hazardously Misleading Information (HMI). Once approved, these changes are scheduled to be included in each of these manuals by the third quarter of 2002.
Response:
31 August 2002
CAA of NZ
Page 155 of 203
CAA Occurrence No. 00/2518 4.1.4 Boeing to consider modifying the EHSI to allow display of frequency paired DME information when the EHSI is in the MAP mode during an ILS/ frequency paired DME approach.
Given that this information is already available in APP* mode, the benefits of implementing this seem small compared to the effort and cost involved, especially when the root of the problem is not addressed by this change. Refer to report paragraph 1.6.7.3 (Electronic Horizontal Situation Indicator). The equivalent EHSI display modes on ZK-NCJ (S/N 26915) are the ILS modes. On later versions of the B767, the EHSI mode selections were renamed from EXP ILS and FULL ILS to APP and CTR APP respectively.
Response:
Note:
4.1.5
Boeing to consider including flight safety information, when appropriate and available, in the revision transmittal letter, when advising operators of manual revisions.
Boeing identifies changes via a Revision Transmittal Letter that contains Revision Highlights whenever operations manuals are changed. Safety of flight items will be considered for special attention during revisions. Additionally, Boeing notified ICAO and the FAA regarding the Rio erroneous GP capture potential for future problems and the need to inform aircrews on a worldwide basis. Boeing has additionally committed to take this issue to numerous safety forums and support the safety video initiated by Air New Zealand.
Response:
4.2 4.2.1
Ministry of Transport of Samoa Ministry of Transport of Samoa to carry out a review of the Samoa Airport Authority procedures manual to ensure that it reflects that no navigational aid may be offered for service if all the components are not working, so as to be in compliance with the rules.
4.3 4.3.1 4.3.2
Samoa Airport Authority Samoa Airport Authority to ensure that staff do have appropriate annual leave granted. Samoa Airport Authority to develop a station operating checklist for use every time any personnel leave the localizer/glide path equipment shelter after maintenance of any kind including daily, weekly or any other routine checks. Samoa Airport Authority to modify the ILS equipment to annunciate to the controller that the equipment is in control (monitor) bypass. Samoa Airport Authority to fully train a competent back up to the senior technician, or alternatively to have access to another technician through a maintenance agreement. Samoa Airport Authority to obtain sufficient test equipment calibrated to recognised standards.
4.3.3 4.3.4
4.3.5
Page 156 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 4.3.6 4.3.7 4.3.8 4.3.9 Samoa Airport Authority to arrange competency and currency checks for all technicians. Samoa Airport Authority should review its maintenance contract obligations. Samoa Airport Authority to replace the Uninterrupted Power Supply batteries. Samoa Airport Authority to modify equipment so that an alarm sounds any time there is a change of state of the ILS. Alarm to be silenced by a switch, which is immediately rearmed for the next state of change. Samoa Airport Authority to modify the remote status indicator lights with a brilliance control so that they can easily be seen in daylight and dimmed at night. Samoa Airport Authority to consider their capital expenditure plan and the replacement of ageing equipment. Samoa Airport Authority to consider modifying the equipment so that the controller has the ability to shut down and reset the ILS from the tower if the need arises.
4.3.10
4.3.11 4.3.12
4.4
4.4.1 (a)
International Civil Aviation Organization (ICAO)

ICAO to request RTCA and EUROCAE to consider modifications to minimum operational performance standards (MOPs) that require the aircraft ILS receiver to warn the crew in the event of: a) the loss of SBO signal (localizer and glide path); or b) the signal in quadrature (localizer and glide path). Or alternatively, to promote a standard within the industry that requires the aircraft systems to carry out a verification check of the ILS signal prior to allowing the autoflight system to carry out an auto approach using the ILS signal for guidance. (b) ICAO to consider amendments to ILS SARPs and guidance material in Annex 10 if required as a consequence of modifications to MOPs for ILS receivers.
ICAO Standards and Recommended Practices (SARPs) for navigation aids including ILS, define signal-in-space characteristics and requirements for ground equipment necessary to achieve required performance particularly specified levels of accuracy, integrity and continuity-of-service. SARP requirements for avionics are limited to essential characteristics to ensure system interoperability leaving avionics design issued to industry standards such as Radio Technical Commission for Aeronautics (RTCA) minimum operational performance standards (MOPS) and European Organization for Civil Aviation Equipment (EUROCAE) specifications. Signal processing, monitoring and alert requirements are therefore defined in the industry standards, and any changes proposed to their standards have to be assessed by RTCA and EUROCAE. It appears, however, that the monitoring action you suggest for the ILS receiver may not be feasible without significant changes to system design or even not feasible at all due to the large numbers of equipment in use. Hence, an interim preventative measure is called for, such as awareness promotion of the risks and the need to implement
Response:
31 August 2002
CAA of NZ
Page 157 of 203

revised procedures. Issuance of State letter AN 7/5-01/52 1 is but one of such measures, whilst older generation aircraft and equipment remain in use. It is suggested that recommendation 4.4.1(a) be evaluated first by an Industry Standards organization: such as the RTCA Inc., and EUROCAE, for an assessment of the feasibility, scope and applicability, which could then be taken into account in assessing any possible course of action that may be open to ICAO.
4.4.2
ICAO to advise all Aviation Authorities to ensure their Rules reflect that no approach ground navigation aid will be offered for service if any component of the Transmitter, Executive Monitor or the Tower/Approach Controller Remote Status Indicator is not operational, to ensure that no erroneous signals are transmitted.
This aspect is addressed in the attached State letter AN 7/5-01/52 dated 11 May 20011.
Response:
4.4.3
To remove the potential for a single point of failure, ICAO to advise all Aviation Authorities to ensure that their Rules clearly reflect that any approach and landing ground navigation aid that has a control (monitor) bypass function: Has an immediate, and primary indication to the tower/approach controller, advising if the control (monitor) bypass switch has been activated, Has an immediate, and primary indication to the tower/approach controller advising of any other failure mode of the monitor or the equipment. This may be one and the same warning as above. May have secondary notification to a remote technical control centre.
Response:
This question is addressed in the attached State letter AN 7/5-01/52 1. Annex 10 Aeronautical Telecommunications, Volume I Radio Navigation Aids, paragraph 3.1.2.1.1 and associated Note 1 indicate that the air traffic services unit involved in the control of aircraft on the final approach be one of the designated control points receiving, without delay, information on the operational status of ILS as derived from the monitors. Although there are no provisions or guidance material specifying control point locations the intent of the requirement in paragraph 3.1.2.1.1 is clearly to ensure that any change of the ILS operational status be immediately made available to the air traffic services. Any failure of the system shall then be reported immediately, by the air traffic control (ATC) unit, [Procedures for Air Navigation Service - Air Traffic Management (Doc 4444) Chapter 4, paragraph 14 refers].
4.4.4
ICAO to advise all Aviation Authorities that any time an aircraft is cleared to use a ground navigation aid signal for approach, landing or takeoff it must be assured that signal is not on test or maintenance and is maintenance error free, and that Air Traffic Control must be an essential part of the communication system in that the controller must advise crew if the aid status alters during that approach, landing or takeoff. Note: The Tower/Approach Controller Remote Status
Indicator must be connected in such a way that it complies with recommendation 4.4.3
Refer Report Appendix 1 ICAO State Letter AN 7/5-01/52.
Page 158 of 203
CAA of NZ
31 August 2002

Response: This aspect is considered to have been covered in State letter AN 7/5-01/52, dated 11 May 1 2001 .
4.4.5
ICAO to advise all Aviation Authorities, to bring to the attention of all Pilots, Technicians and Air Traffic Controllers, the circumstances surrounding this event for educational purposes.
This matter is addressed in the attached State letter AN 7/5-01/52 dated 11 May 20011.
Response:
4.4.6
ICAO to continue to emphasize the need to fit Ground Proximity Warning Systems (GPWS) with a forward looking terrain avoidance function, terrain awareness and warning systems (TAWS) A or B as appropriate to the aeroplane and the operation, since it provides an effective defence against this type of occurrence.
You are aware that the incident, together with an earlier incident at Rio de Janeiro on 20 February 1999, brought to light a latent long-term problem with the ILS. Considerable work has taken place in the effort to find appropriate solutions, which will contribute to the prevention of further occurrences of the same type. This work has involved the Boeing Commercial Airplane Company, the United States Federal Aviation Administration (FAA) and ICAO. The involvement of ICAO is with the aid of the Testing of Radio Navaids Study Group (TRNSG) which is processing an amendment to the Manual on Testing of Radio Navigation Aids, Volume I Testing of Ground-based Radio Navigation Systems (Doc 8071). ICAO circulated State letter AN 7/5-01/52 dated 11 May 2001, to draw the attention of States and international organizations to the afore-mentioned problem, and in particular the potential to cause a controlled flight into terrain (CFIT) accident. The State letter covered the basic and additional measures that should be implemented to provide the necessary protection. You will note, that until amendment 27 becomes effective, Annex 6, Operation of Aircraft, Part I, International Commercial Air Transport, Aeroplanes, paragraph 6.15 provides for the equipment of aeroplanes with GPWS. The Standards in 6.15.5 and 6.15.6 specifically address turbine-engined aeroplanes maximum certificated take-off mass (MCTM) in excess of 15 000 kg or authorized to carry more than thirty passengers and the requirement to carry GPWS which has a predictive terrain hazard warning function. Standard 6.15.5 covers aeroplanes first issued with a certificate of airworthiness on or after 1 January 2001. Standard 6.15.6 addresses the retrofit requirement, by 1 January 2003, for aeroplanes brought into service prior to 1 January 2001. The current content of Annex 6, Part I, paragraph 6.15 is also provided2. The ICAO Council adopted amendment 27 to Annex 6, Part I, on 15 March 2002. This amendment, which becomes applicable on 28 November 2002, replaces the expression predictive terrain hazard warning function by forward looking terrain avoidance function. Standards to require provision of GPWS which has a forward looking terrain avoidance function in turbine-engined aeroplanes, MCTM in excess of 5700 kg or authorized to carry more than nine passengers, for new aeroplanes first certificated on or after 1 January 2004 and for the retrofit of earlier aeroplanes by 1 January 2007, in paragraphs 6.15.4 and 6.15.5, respectively. These proposed Standards are to replace the existing Recommended Practice addressed to these aeroplanes in 6.15.7. You will see that the existing requirements in Annex 6, Part I and those applicable on 28 November 2002, can only be satisfied by equipment equivalent to the Terrain Awareness and
Response:
1 2
Refer Report Appendix 1 ICAO State Letter AN 7/5-01/52. Refer Report Appendix 1 Attachment B Amendment 27 to Annex 6 Part 1.
31 August 2002
CAA of NZ
Page 159 of 203

Warning System (TAWS) Class A Standard as described in both the United States, FAA Technical Standard Order TSO-C151a dated 29 March 1999, and the European Joint Aviation Authority (JAA) JTSO-C151a dated 1 December 2001. You may also note that amendment 27 also includes a new Recommended Practice for turbineengined aeroplanes MCTM less than 5700 kg and authorized to carry more than five but not more than nine passengers (6.15.2) to be equipped with a ground proximity warning system which provides forward looking terrain avoidance function. The existing Recommended Practice in paragraph 6.15.2 is raised to a Standard in paragraph 6.15, requiring piston-engined aeroplanes, with a MCTM in excess of 5700 kg or authorized to carry more than nine passengers to be equipped with a ground proximity warning system which provides forward looking terrain avoidance function. These provisions allow the use of equipment to the TAWS Class B standard as described in the FAAs TSO-C151a and the JAAs JTSO-C151a. The content of Annex 6, Part I paragraph 6.15 is also provided2. Amendment 22 to Annex 6, Part II3, paragraph 6.9 for both Standards and Recommended Practices, introduces the use of TAWS Class B equipment in all general aviation operations in place of the existing requirement for TAWS Class A equipment. Further to amendments to the related provisions in Annex 6, Parts I and II, ICAO has been encouraging States and operators to update GPWS equipment to take advantage of advances in reliability, reduction in false warnings and the extension of warning times, since giving notice of the development of the ICAO programme for the prevention of CFIT in State letter AN 11/1.1.19-93/61, dated 16 June 1993. The recent 33rd Session of the ICAO Assembly in Resolution A33-16, reiterated the need for the implementation of the ICAO prevention of CFIT and approach and landing accident reduction (ALAR) programmes. This resolution emphasizes the intent of the earlier Assembly Resolutions A31-9 and A 32-15, which are still in force. In this context I would like to draw your attention to State letter AN 11/13-02/7, which deals with both Assembly Resolution A33-16 and implementation of the new Approach and Landing Accident Reduction (ALAR) Tool Kit which itself calls for the exploitation of current technology. I can assure you that ICAO will continue this process.
4.4.7
ICAO to facilitate a means to identify systemic failures, relevant to design, maintenance and in-service use of any ground navigation aids that may be used or associated with, take off, approach or landing, and identify mitigating strategies where necessary.
The original recommendation stated that: ICAO set up a panel to identify systemic failures relevant to design, maintenance and in service use of ground navigation aids and identify mitigating strategies where necessary. ICAO responded that the original recommendation was considered to be unduly prescriptive to means. ICAO also thought that the comments to 4.4.1 and 4.4.6 above were also relevant in this case. The recommendation was therefore changed to suggest that ICAO facilitate the process. This recommendation is aimed at the wider field, rather than that presently covered by RTCA and EUROCAE technical specifications. The intent is to identify potential systemic failures and consider the implications to the total system.
Authors note:
2 3
Refer Report Appendix 1 Attachment B Amendment 27 to Annex 6 Part 1. Refer Report Appendix 1 Attachment A Amendment 22 to Annex 6 Part I1.
Page 160 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 4.4.8 ICAO incorporate Human Factors principles into the risk tree analysis to determine integrity and continuity of service contained in ICAO Annex 10 Attachment A.
The inclusion of Human Factors principles, recommended in Annex 10, Volume I, Chapter 2, 2.10, would be expected to be applied in any application of the guidance material in Attachment A, to Annex 10, Volume I. It should be recognized however that this guidance material is focussed on the definition of continuity-of-service and the integrity objectives for ILS and MLS, and the only human factor involved is a pilot risk reduction. Incorporation of all human factors aspects in Attachment A goes far beyond the purpose of this guidance material and therefore is not supported. It is understood that States would continue to apply this guidance in conjunction with the relevant guidance material referred to in Section 2.10 of Chapter 2, Annex 10, Volume I. Refer also the FAA National Airspace System Operations Program report Evaluation of Glideslope Operations and Maintenance with Respect to Incidents of Near-Controlled Flight Into Terrain dated Nov 14 2000, by Douglas Findlay, FAA National Airspace System Policy Division4.
Response:
Note:
4.4.9
Response:
ICAO promote the use of the ILS Classification System as described in Attachment C to Annex 10.
The ILS Facility Performance Classification, which is defined in Annex 10, Volume I, Chapter 3 and expanded upon in Attachment C, is the subject of Standards in Chapter 3. These Standards establish the criteria for the facility performance categories. The facility performance categories are directly linked to the operational categories of precision approach and landing operations. Thus, any Category I, II or III ILS must satisfy the appropriate Facility Performance requirements in Annex 10, Volume I. Further, we do not see any additional means of promulgating the ILS classification other than its publication in Annex 10.
4.4.10
Response:
ICAO consider the merits of using the radio altimeter as the primary means of determining the decision point during a Category I approach.
Whilst appreciating your comments on the validity or reasonableness checks we do not support the use of the radio altimeter to establish the decision point in Category I operations. This aspect was examined in the earlier work of the CFIT Task Force and not pursued. The decision height provided in Category I approach procedures is referenced to the runway threshold and may bear no reasonable relation to the height above terrain in the approach area. It was not considered appropriate to provide an additional radio altimeter decision height for the location of the decision point in Category I operations. There are recommendations on the radio altimeter operating area. in Annex 14, Volume I, 3.7, but the area under consideration only extends 300 m before the threshold. The use of the radio altimeter as a situational awareness aid on the approach is covered in the ALAR Tool Kit, Briefing Note 3.1 Barometric Altimeter and Radio Altimeter. You should note that terrain awareness and warning systems (TAWS) which make use of the global navigation satellite system (GNSS), with the function referred to by one manufacturer as geometric altitude, provides significant opportunities to detect barometric altimeter errors, provided the flight crew is aware of, and trained in the use of this function.
Refer Report Appendix 2 FAA Glideslope Evaluation Report.
31 August 2002
CAA of NZ
Page 161 of 203
Intentionally blank
Page 162 of 203
CAA of NZ
31 August 2002
5.
5.1
Safety actions taken or agreed

Air New Zealand As per the provisions of NZCAR 12.59 (Investigation and Reporting), NZCAR 119.79 (Internal Quality Assurance) and AC 12-2 (Incident Investigation), Air New Zealand has raised corrective and preventive actions to address the issues raised by this report. In addition to actions aimed specifically at system improvement, the relevant activity is as follows: Issue of instructions regarding the use of unmonitored navigation aids for approach, landing and takeoff. Review and development of safety nets, including SOPs, to mitigate the potential single point failure associated with the ILS. Increasing flight crew knowledge and awareness regarding the ILS system and the implications of erroneous ILS signals during an ILS approach. Increasing flight crew knowledge and awareness regarding glideslope altimeter checks. Increasing flight crew knowledge and awareness regarding raw data and the ramifications of flight instrument selection. Introduction of automated terrain awareness calls.
Air New Zealand is also proactively seeking to raise awareness and concerns regarding erroneous ILS signals, throughout the industry. 5.2 5.2.1 International Civil Aviation Organization (ICAO) ICAO to examine current practices and procedures with regard to the maintenance of ground navigation aids in particular respect to: (a) (b) (c) Ensuring ATC receipt of notification of maintenance prior to undertaking that maintenance and recording on the ATIS if available. Ensuring positive ATC/flight crew communication if a navigation aid may be radiating erroneous information. If maintenance is planned on the ILS that has the potential to cause the radiation of erroneous information then both the localizer and the glideslope should be removed from service, or remove or change the ident (or an acceptable alternative practice). Instituting an acceptable quality assurance check that will at least verify the equipment monitor is in control and that tower remote status indicator is indicating correctly before releasing the navigation aid back to service.
(d)
Response:
ICAO has complied with this recommendation and made further additional recommendations in State Letter AN 7/5-01/521.
Refer Report Appendix 1 ICAO State Letter AN 7/5-01/52.
31 August 2002
CAA of NZ
Page 163 of 203

5.3
Civil Aviation Authority of New Zealand CAA of New Zealand to raise concerns with other Regulatory Authorities regarding erroneous ILS information.
The investigator in charge of this report has completed a global tour to advise Authorities in North America, Europe, Africa and Asia.
5.3.1
5.3.2
CAA of New Zealand is recommended to investigate the routing and distribution of NOTAMS.
Aeronautical services will be investigating.
5.3.3
CAA of New Zealand is recommended to investigate the clarity of wording used in NOTAMS.
Aeronautical services will be investigating.
5.3.4
CAA of New Zealand to consider amending rule 121.89 to allow an aircraft to dispatch with the CVR circuit breaker pulled to retain information after a serious incident, only for the purposes of flying to the next station where the data can be down loaded.
The Airline Group will consider a rule change if appropriate.
5.3.5
CAA of New Zealand to educate/advise approach and landing ground navigation aid operators that it is against the New Zealand Civil Aviation Rules to restore an aid to service with the tower /approach controller remote status indicator inoperative.
Aeronautical Services will advise and educate each specific certificate holder individually.
5.3.6
CAA of New Zealand to advise all operators of approach and landing ground navigation aids, that if the control (monitor) bypass is activated, a warning must be relayed to the Tower/Approach Controller without delay. CAA to follow up with audits and ensure all approach and landing ground navigation aids comply.
Aeronautical Services will advise all operators and carry out follow up audits.
Page 164 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 5.3.7 CAA of New Zealand to examine current practices and procedures with regard to the maintenance of ground navigation aids in particular respect to: (a) (b) (c) (d) Consideration of meteorological conditions under which planned maintenance should take place. Ensuring ATC receipt of notification of maintenance prior to undertaking that maintenance and recording on the ATIS if available. Ensuring positive ATC/flight crew communication if a navigation aid may be radiating erroneous information. If maintenance is planned on the ILS that has the potential to cause the radiation of erroneous information then both the localizer and the glide path should be removed from service, or remove or change the ident (or an acceptable alternative practice). Instituting an acceptable quality assurance check that will, before restoring the navigation aid back to service, at a minimum verify that the equipment monitor is in control and that tower remote status indicator is indicating correctly.
(e)
Aeronautical Services will investigate and liase with industry.
5.3.8
CAA of New Zealand to implement a program to ensure that all ATC and ground navigation aid technicians are advised that the aircraft will not always detect erroneous information.
Aeronautical Services will ensure that all personnel are advised through their respective companies.
5.3.9
CAA of New Zealand to publish this report on its website to assist in the wider distribution of knowledge.
Safety Education and Publishing will publish the final report on the CAA of New Zealand Website. www.caa.govt.nz
5.3.10
CAA of New Zealand to produce a Safety Education Video regarding what happened in this event and how to prevent such an event occurring again.
Safety Education and Publishing has assisted Air New Zealand to produce such a video. Additionally, CAA of New Zealand has endorsed the final product.
5.3.11
CAA of New Zealand to explore the possibility of an industry/regulator forum to enable all parties to better understand, and discharge their ICAO and regulatory responsibilities.
Aeronautical Services will investigate the feasibility of setting up the forum.
31 August 2002
CAA of NZ
Page 165 of 203
Intentionally blank
Page 166 of 203
CAA of NZ
31 August 2002
Appendix 1
ICAO State Letter AN 7/5-01/52 and Attachments
Tel.: +1 (514) 954-6712 Ref.: AN 7/5-01/52 11 May 2001
Subject: Incidents caused by operational use of ILS signals

radiated during testing and maintenance procedures
Action required: To note information and guidelines

provided hereunder, and take action as appropriate Sir/Madam, 1. I have the honour to draw your attention to a number of incidents which have occurred in recent years resulting from the operational use of instrument landing system (ILS) signals being radiated during ILS testing and maintenance procedures, specifically for phasing and modulation balance testing. Such signals may be perceived onboard aircraft as on-course and/or on-glide-path indications regardless of the actual position of an aircraft within the ILS coverage and with no flag or alarm indication in the cockpit. The use of ILS localizer and/or glide path signals for approach guidance during these testing and maintenance procedures can therefore result in false indications to the flight crew and has the potential to cause a controlled flight into terrain (CFIT) accident. 2. Standards in Annex 15 Aeronautical Information Services (Chapter 5, paragraph 5.1.1.1) and Annex 11 Air Traffic Services (Chapter 3, paragraph 3.7 and Chapter 4, paragraph 4.3.8), and guidance material in the Manual on Testing of Radio Navigation Aids (Doc 8071), Volume I (Fourth Edition, Chapter 1, paragraphs 1.6 and 1.8) provide for a notification of the ILS facility status in order to prevent the operational use of an unusable/unserviceable facility. There have been, however, occurrences when the facility status notification has not reached the flight crew or the air traffic control unit concerned, or this notification has not been complied with due to shortcomings in the notification procedures or human error.
31 August 2002
CAA of NZ
Page 167 of 203

3. In order to address the aforementioned issue through improvements to the current practices of testing and maintenance of ILS, an amendment to Doc 8071, Volume I, which was developed with the assistance of the Testing of Radio Navaids Study Group (TRNSG), is being processed. It draws particular attention to testing and maintenance procedures involving test signals that can result in false indications to the flight crew. It also emphasizes the need for coordination of these procedures with air traffic control (ATC) and for the timely promulgation and distribution of relevant information by a NOTAM before the procedures commence. 4. However, full prevention of the type of incidents in question involves a combination of measures, which would protect the system from single points of failure. May I therefore request you to invite the appropriate authority(ies) and/or organization(s) in your State, as well as operators under your jurisdiction, to review current practices and procedures as necessary to ensure that ILS will not be used for normal flight operations when test signals are being radiated or the executive monitoring function of the facility is inhibited for testing/maintenance purposes. 5. It is highly desirable to eliminate the possibility for any operational use to be made of the ILS guidance during the testing by administratively removing (e.g. by a NOTAM) the localizer and the glide path from service simultaneously. If this is not feasible for operational reasons, a deferral of testing should be considered. However, in case the localizer needs to remain in service while the glide path undergoes testing and the testing cannot be delayed, sufficient measures should be implemented to ensure that users are aware of the potential for false indications from the glide path facility. 6. In all circumstances, the basic protective measures should include as a minimum: a) NOTAM phraseology that is specific about the possibility of false indications to the flight crew from the radiated test signals and clearly prohibits their use (suggested NOTAM wording - RUNWAY XYZ ILS NOT AVBL DUE MAINTENANCE (or TESTING); DO NOT USE; FALSE INDICATIONS POSSIBLE);
b) confirmation by maintenance personnel that such a NOTAM has been issued by the Aeronautical Information Services before the testing procedures begin; c) prior to beginning the tests, suspension or alteration to an unusual tone/sequence of the transmission of the unique Morse Code facility identification on the localizer, if the localizer should radiate solely for testing purposes; and
d) a requirement that ATC advise, by automatic terminal information service (ATIS) and/or by a voice advisory, each pilot on an approach to the affected runway, emphasizing the possibility of false indications. 7. Additional protective measures may be appropriate, especially during phasing and modulation balance conditions for the localizer or the glide path (Doc 8071, Volume I, paragraphs 4.2.15, 4.2.37, 4.3.14, 4.3.39, 4.3.62 and 4.3.63 refer). Accordingly, when the phasing and modulation balance tests are being performed the following options may be exercised: a) when the tests are being performed on the localizer, remove the glide path from service by turning the signals off (to provide a glide path flag indication to the pilot); and
Page 168 of 203
CAA of NZ
31 August 2002

b) when the tests are being performed on the glide path, remove the localizer from service by turning the signals off (to provide a localizer flag indication to the pilot).
Note. If the b) option is exercised, the ATC voice advisories required in 6 d) above become redundant. 8. In addition, it is essential to ensure that protective measures (in addition to the coordination and promulgation process) are put in place to guard against single points of failure. One highly desirable measure is the installation of remote ILS status-indicating equipment such that it is visible to the air traffic controller issuing approach clearances. 9. It is imperative that all personnel directly engaged in the flight inspection, maintenance or installation of aeronautical navigation aids should be adequately qualified, trained, and experienced for their job functions. Accordingly, management systems should include written procedures for ensuring the continued competence of such personnel through regular assessment. Initial and recurrent training programmes for aeronautical navigation aid specialists should include a detailed explanation of maintenance procedures and their effect on the integrity of the radiated signal. 10. Finally, aircraft operating manuals should strictly prohibit the use of a radio navigation facility, which is notified to be out of service even though its cockpit indications might appear to be normal. The facility identification check by the flight crew is an essential means for achieving this purpose. 11. It would be appreciated if you also remind the national accident investigation authority of the need to report to ICAO, in accordance with Annex 13 Aircraft Accident and Incident Investigation, any serious incidents, particularly those which had the potential of developing into a CFIT accident. Accept, Sir/Madam, the assurances of my highest consideration.
31 August 2002
CAA of NZ
Page 169 of 203
CAA Occurrence No. 00/2518 Attachment A - Amendment 22 to Annex 6 Part II
AMENDMENT 22 TO ANNEX 6, PART II
NOTES ON THE PRESENTATION OF THE AMENDMENT TO ANNEX 6, PART II
The text of the amendment is arranged to show deleted text with a line through it and new text highlighted with grey shading, as shown below:
1. Text to be deleted is shown with a line through it.
text to be deleted
2. New text to be inserted is highlighted with grey shading.
new text to be inserted
3. Text to be deleted is shown with a line through it followed by the replacement text which is highlighted with grey shading.
new text to replace existing text
Page 170 of 203
CAA of NZ
31 August 2002

TEXT OF AMENDMENT 22 TO THE INTERNATIONAL STANDARDS AND RECOMMENDED PRACTICES OPERATION OF AIRCRAFT ANNEX 6 TO THE CONVENTION ON INTERNATIONAL CIVIL AVIATION PART II INTERNATIONAL GENERAL AVIATION AEROPLANES CHAPTER 6. AEROPLANE INSTRUMENTS AND EQUIPMENT 6.9 Aeroplanes required to be equipped with ground proximity warning systems (GPWS) 6.9.1 All turbine-engined aeroplanes of a maximum certificated take-off mass in excess of 5700 kg or authorized to carry more than nine passengers, for which the individual certificate of airworthiness is first issued on or after 1 January 2004, shall be equipped with a ground proximity warning system which has a forward looking terrain avoidance function. 6.9.2 From 1 January 2007, all turbine-engined aeroplanes of a maximum certificated takeoff mass in excess of 5700 kg or authorized to carry more than nine passengers, shall be equipped with a ground proximity warning system which has a forward looking terrain avoidance function. 6.9.3 Recommendation. All turbine-engined aeroplanes of a maximum certificated take-off mass of 5700 kg or less and authorized to carry more than five but not more than nine passengers should be equipped with a ground proximity warning system which has a forward looking terrain avoidance function. 6.9.24 Recommendation. All piston-engined aeroplanes of a maximum certificated take-off mass in excess of 5700 kg or authorized to carry more than nine passengers should be equipped with a ground proximity warning system which has a forward looking terrain avoidance function. 6.9.35 A ground proximity warning system shall provide automatically a timely and distinctive warning to the flight crew when the aeroplane is in potentially hazardous proximity to the earths surface. 6.9.46 A ground proximity warning system shall provide as a minimum, warnings of at least the following circumstances: 1) excessive descent rate; 2) excessive terrain closure rate; 32) excessive altitude loss after take-off or go-around; and 43) unsafe terrain clearance. while not in landing configuration; a) gear not locked down; b) flaps not in a landing position; and 5) excessive descent below the instrument glide path. 6.9.5 7 Recommendation. All turbine-engined aeroplanes of a maximum certificated takeoff mass in excess of 5700 kg or authorized to carry more than nine passengers, should be equipped with a ground proximity warning system which has a predictive terrain hazard warning forward looking terrain avoidance function. - END 31 August 2002 CAA of NZ Page 171 of 203
CAA Occurrence No. 00/2518 Attachment B - Amendment 27 to Annex 6 Part I
AMENDMENT 27 TO ANNEX 6, PART I
NOTES ON THE PRESENTATION OF THE AMENDMENT TO ANNEX 6, PART I
The text of the amendment is arranged to show deleted text with a line through it and new text highlighted with grey shading, as shown below:
1. 2. 3.
Text to be deleted is shown with a line through it. New text to be inserted is highlighted with grey shading. Text to be deleted is shown with a line through it followed by the replacement text which is highlighted with grey shading.
text to be deleted new text to be inserted new text to replace existing text
Page 172 of 203
CAA of NZ
31 August 2002
TEXT OF AMENDMENT 27 TO THE INTERNATIONAL STANDARDS AND RECOMMENDED PRACTICES OPERATION OF AIRCRAFT ANNEX 6 TO THE CONVENTION ON INTERNATIONAL CIVIL AVIATION PART I INTERNATIONAL COMMERCIAL AIR TRANSPORT AEROPLANES
CHAPTER 6. AEROPLANE INSTRUMENTS, EQUIPMENT AND FLIGHT DOCUMENTS 6.15 Aeroplanes required to be equipped with ground proximity warning systems (GPWS) 6.15.1 All turbine-engined aeroplanes of a maximum certificated take-off mass in excess of 5700 kg or authorized to carry more than nine passengers shall be equipped with a ground proximity warning system. (Editorial Note: Existing paragraphs 6.15.2, 6.15.3 and 6.15.4 relocated as 6.15.7, 6.15.8 and 6.15.9 respectively.) 6.15.52 All turbine-engined aeroplanes of a maximum certificated take-off mass in excess of 15 000 kg or authorized to carry more than 30 passengers, for which the individual certificate of airworthiness is first issued on or after 1 January 2001, shall be equipped with a ground proximity warning system which has a predictive terrain hazard warning forward looking terrain avoidance function. 6.15.63 From 1 January 2003, all turbine-engined aeroplanes of a maximum certificated take-off mass in excess of 15 000 kg or authorized to carry more than 30 passengers shall be equipped with a ground proximity warning system which has a predictive terrain hazard warning forward looking terrain avoidance function. 6.15.4 All turbine-engined aeroplanes of a maximum certificated take-off mass in excess of 5700 kg or authorized to carry more than nine passengers, for which the individual certificate of airworthiness is first issued on or after 1 January 2004, shall be equipped with a ground proximity warning system which has a forward looking terrain avoidance function. 6.15.5 From 1 January 2007, all turbine-engined aeroplanes of a maximum certificated takeoff mass in excess of 5700 kg or authorized to carry more than nine passengers, shall be equipped with a ground proximity warning system which has a forward looking terrain avoidance function. 6.15.6 Recommendation. All turbine-engined aeroplanes of a maximum certificated takeoff mass of 5700 kg or less and authorized to carry more than five but not more than nine passengers should be equipped with a ground proximity warning system which provides the warnings of 6.15.9 a) and c), warning of unsafe terrain clearance and a forward looking terrain avoidance function.
31 August 2002
CAA of NZ
Page 173 of 203

6.15.27 Recommendation. From 1 January 2007 Aall piston-engined aeroplanes of a maximum certificated take-off mass in excess of 5700 kg or authorized to carry more than nine passengers should shall be equipped with a ground proximity warning system which provides the warnings in 6.15.9 a) and c), warning of unsafe terrain clearance and a forward looking terrain avoidance function. 6.15.38 A ground proximity warning system shall provide automatically a timely and distinctive warning to the flight crew when the aeroplane is in potentially hazardous proximity to the earths surface. 6.15.49 A ground proximity warning system shall provide, as a minimum unless otherwise specified herein, warnings of the following circumstances: a) excessive descent rate; b) excessive terrain closure rate; c) excessive altitude loss after take-off or go-around; d) unsafe terrain clearance while not in landing configuration; 1) gear not locked down; 2) flaps not in a landing position; and e) excessive descent below the instrument glide path. 6.15.7 Recommendation. All turbine-engined aeroplanes of a maximum certificated takeoff mass in excess of 5700 kg or authorized to carry more than nine passengers should be equipped with a ground proximity warning system which has a predictive terrain hazard warning function.
CHAPTER 13. SECURITY*
13.1. Recommendation. International Standards and Recommended Practices set forth in this Chapter should be applied by all Contracting States also in case of domestic commercial operations (air services). 13.12 Security of the flight crew compartment 13.12.1 In all aeroplanes which are equipped with a flight crew compartment door, this door shall be capable of being locked, It shall be lockable from within the compartment only. and means shall be provided by which cabin crew can discreetly notify the flight crew in the event of suspicious activity or security breaches in the cabin. 13.2.2 From 1 November 2003, all passenger-carrying aeroplanes of a maximum certificated take-off mass in excess of 45 500 kg or with a passenger seating capacity greater than 60 shall be equipped with an approved flight crew compartment door that is designed to resist penetration by small arms fire and grenade shrapnel, and to resist forcible intrusions by unauthorized persons. This door shall be capable of being locked and unlocked from either pilots station.
Page 174 of 203
CAA of NZ
31 August 2002

13.2.3 In all aeroplanes which are equipped with a flight crew compartment door in accordance with paragraph 13.2.2: a) this door shall be closed and locked from the time all external doors are closed following embarkation until any such door is opened for disembarkation, except when necessary to permit access and egress by authorized persons; and b) means shall be provided for monitoring from either pilots station the entire door area outside the flight crew compartment to identify persons requesting entry and to detect suspicious behaviour or potential threat. 13.2.4 Recommendation. All passenger-carrying aeroplanes should be equipped with an approved flight crew compartment door, where practicable, that is designed to resist penetration by small arms fire and grenade shrapnel, and to resist forcible intrusions by unauthorized persons. This door should be capable of being locked and unlocked from either pilots station. 13.2.5 Recommendation. In all aeroplanes which are equipped with a flight crew compartment door in accordance with paragraph 13.2.4: a) the door should be closed and locked from the time all external doors are closed following embarkation until any such door is opened for disembarkation, except when necessary to permit access and egress by authorized persons; and b) means should be provided for monitoring from either pilots station the entire door area outside the flight crew compartment to identify persons requesting entry and to detect suspicious behaviour or potential threat.
13.23 Aeroplane search procedure checklist
An operator shall ensure that there is on board a checklist of the procedures to be followed in searching for a bomb in case of suspected sabotage and for inspecting aeroplanes for concealed weapons, explosives or other dangerous devices when a well-founded suspicion exists that the aeroplane may be the object of an act of unlawful interference. The checklist shall be supported by guidance on the appropriate course of action to be taken should a bomb or suspicious object be found and information on the least-risk bomb location specific to the aeroplane.
31 August 2002
CAA of NZ
Page 175 of 203

13.34 Training programmes
13.34.1 An operator shall establish and maintain an approved security training programme which enables ensures crew members to act in the most appropriate manner to minimize the consequences of acts of unlawful interference. As a minimum, this programme shall include the following elements: a) b) c) d) e) f) g) h) determination of the seriousness of any occurrence; crew communication and coordination; appropriate self-defense responses; use of non-lethal protective devices assigned to crew members whose use is authorized by the State of the Operator; understanding of behaviour of terrorists so as to facilitate the ability of crew members to cope with hijacker behaviour and passenger responses; live situational training exercises regarding various threat conditions; flight deck procedures to protect the aeroplane; and aeroplane search procedures and guidance on least-risk bomb locations where practicable.
(Editorial Note: Renumber subsequent paragraphs accordingly.)
END
Page 176 of 203
CAA of NZ
31 August 2002
Appendix 2
FAA Glideslope Evaluation Report
US Department of Transportation
Federal Aviation Administration National Airspace System Operations Program
Evaluation of Glideslope Operations and Maintenance With Respect to Incidents of Near-Controlled Flight into Terrain
By Douglas Findlay National Airspace System Policy Division Research reported in this publication was supported by the Federal Aviation Administration and the Boeing Company
Published November 14, 2000
31 August 2002
CAA of NZ
Page 177 of 203
Table of Contents
Scope ..................................................................................2 Authorization......................................................................2 Area Investigated................................................................2 Proceedings ........................................................................2 Conclusions ........................................................................3 Recommendations ..............................................................3 Appendix 1. Incident Report .............................................6 Appendix 2. FAA Letter to Boeing ...................................7 Appendix 3. Participants ...................................................8 Appendix 4. Options..........................................................9 Appendix 5. Fault Tree....................................................10 Appendix 6. ATS Maintenance Alert..............................11 Appendix 7. Definitions ..................................................12
Page 178 of 203
CAA of NZ
31 August 2002
Glideslope Evaluation Report Scope

This report addresses maintenance and operation of GS facilities that are used in the National Airspace System (NAS), and may have equal applicability in international airspace. The areas that may be affected include FAA maintenance manuals, coordination and notification procedures, maintenance logs, ground equipment modifications, aircrew procedures, avionics equipment modifications, and international agreements.
Authorization
This evaluation and report are authorized by the Associate Administrator for Air Traffic Services, Federal Aviation Administration, in a letter to the Vice President, Airplane Safety and Airworthiness, the Boeing Company. A copy of this letter is provided in Appendix 2.
Area Investigated
Description of Area The group evaluated reports of two incidents of near controlled flight into terrain. Part of this evaluation included flight data recordings that were conducted by an aircraft using a GS facility that was not radiating sideband energy. This resulted in a constant on-glide path indication to the cockpit, though it did not exactly duplicate the radiated signal of a GS facility that is radiating a signal in quadrature as is the case during phasing. The group also evaluated applicable publications that govern facility maintenance and aircraft operations. Overall Problems of Area In aircraft operation, a basic tenet of airmanship is for the pilots to trust their instruments. Given that a navigational facility is reported out of service, but provides normal indication in the cockpit, a high probability exists that a pilot will elect to use the navigational facility. In ground maintenance operations, certain activities require transmission of hazardously misleading information (HMI). Though steps are currently taken to notify air traffic and aircrew personnel of these activities, they provide no guarantee that this notification has been received or will be heeded.
Proceedings
Presentation. The participants described their respective background and experiences, and provided insight into the overall situation. Using their subject matter expertise, they shared documents, data, anecdotal experiences, and assumptions on the subject matter. A list of participants is provided in Appendix 3.
2
Glideslope Evaluation Report

Compilation. During the presentation, and throughout the proceedings, the participants used brainstorming techniques to compile a list of possible options that would be of benefit. Development. Options were organized into a spreadsheet with columns for advantages, disadvantages, and implementation considerations. Please refer to Appendix 4 for a complete listing of these options. Analysis. The group developed a fault tree to describe all elements that could lead to a CFIT. Using logic gates, they assigned probability values to all branches of the fault tree. The group then applied the options to their respective fault tree branches and determined their effects on the overall probability of CFIT. Some options had widespread and significant effect, whereas others had no effect other than in its specific fault tree branch. Refer to Appendix 5 for a diagram of the fault tree.
Conclusions
Certain changes can be implemented that will enhance the integrity of terminal flight operations. Though there have been no reported incidents of CFIT in the NAS, there are unanswered questions about the specific events, which led to the international incidences of near-CFIT. The possibility of a CFIT incident occurring in the future is a concern and the probability of such an event is uncertain. Given the two events to date, and the fact that calibration of the system produces a hazardously misleading GS signal, it appears improvement in GS system integrity is necessary.
Recommendations
Actions taken Operations Manual. The Boeing Company initiated a change to their operations manual. This change: requires aircrews to cross-check their altitude at the final approach fix (FAF). Though they consider this to be basic airmanship, they felt the added emphasis would enhance aircrew situation awareness. Refer to Appendix 4, Option I. Maintenance Alert. The Federal Aviation Administration issued a maintenance alert to Airway Facilities field maintenance organizations. A copy is provided in Appendix 6. This alert advises all Airway Transportation System Specialists of the critical nature of GS signal transmission during phasing procedures, and to
Page 180 of 203
CAA of NZ
31 August 2002

strictly follow all applicable maintenance procedures during maintenance activities. Refer to Appendix 4, Option 2. Consensus actions Localizer Shutdown. The work group recommends removing the localizer from service during any CJS maintenance procedure that involves radiating HMI. The main benefit is that aircrews will be reluctant to use a GS signal in the event of having neither a localizer indication nor an instrument landing system identification signal. This change will provide a significant risk reduction according to the fault tree analysis. Refer to Appendix 4, Option 3. NOTAM Language. The work group recommends rephrasing standard NOTAM phrasing to include a better description of OTS, and providing a clearer description of situations where a navigational aid is OTS but may appear to provide normal indications. Refer to Appendix 4, Option 4. ILS Monitor Panel. The work group recommends retaining the requirement for an ILS status panel in direct proximity to AT personnel. The absence of this panel would increase the probability of AT personnel being unaware of situations where the GS is in a maintenance mode of operation during OTS periods. Refer to Appendix 4, Option 5. NOTAM Confirmation The work group recommends requiring that the ATSS verifies and logs that a NOTAM has been properly issued prior to actually removing a GS from service for maintenance. This may be accomplished by monitoring the Automated Terminal Information System (ATIS) if available, or by other direct means, e.g., confirmation from airway facilities or air traffic personnel. The main benefit is that it guarantees that a NOTAM has actually been issued. This change will provide a significant risk reduction according to the fault tree analysis. Refer to Appendix 4, Option 6. Maintenance Handbooks. The group recommends adding emphasis to the critical nature of maintenance that induces HMI in applicable maintenance handbooks. The added emphasis should use text formatting in accordance with human factors guidelines for warnings, cautions, etc. Refer to Appendix 4, Option 7 Non-consensus actions On-Off Switching. The group expressed reservations regarding modifications, which would induce an on-off switching of the radiated signal. The purpose of this would be to make the signal appear too erratic to aircrews, and prevent avionics from accepting the GS signal. It is not known if this would be a technically feasible option for either ground personnel or avionics equipment. Refer to Appendix 4, Option 8.
31 August 2002
CAA of NZ
Page 181 of 203
Phasing Procedure and Facility Modification. The group split evenly between ground and flight crews regarding how the radiated signal could be modified during GS phasing. The ground facility experts support inducing a slight fly-up signal in the GS carrier, whereas the flight crew experts preferred inducing a hard fly-up signal. A slight fly-up signal would induce a below glide path signal which would prevent a CFIT. This would also, however, present an indication that might be interpreted by aircrews as a usable signal. This change would involve no hardware modifications and minor changes to maintenance procedures. A hard fly-up signal would provide aircrews with a more obvious erroneous signal, but it would also require modifications to hardware and significant changes in maintenance procedures. These changes have not been tested and may not be feasible. Refer to Appendix 4, Options 9, 10, and 11. Deferred actions Additional Personnel. The group provided a mild endorsement of requiring two airway transportation system specialists during phasing. The main advantages would be reduced time required to perform glideslope phasing and an additional person to verify proper procedures are being followed. This option may not be feasible in view of the additional cost and minor benefit derived. Refer to Appendix 4, Option 12. Avionics Modifications. The group expressed reservations regarding modifications to avionics equipment that would detect a GS signal in quadrature during phasing. It is not known if this option is feasible from both design and implementation standpoints. Refer to Appendix 4, Option 13. Other Actions NOTAM Issued Earlier. This option was not directly related to reducing the probability of CFIT, but the aircrew experts expressed strong support for this option. Extended flight times, especially those over water and across international airspace boundaries, show that a five-hour lead time for issuing NOTAMs will not always allow flight crews to have advanced notice of any OTS facilities. This option is included, however, since some of the recommended changes to publications can easily accommodate this change as well. Refer to Appendix 4, Option 14.
Page 182 of 203
CAA of NZ
31 August 2002
31 August 2002
CAA of NZ
Page 183 of 203
Page 184 of 203
CAA of NZ
31 August 2002
31 August 2002
CAA of NZ
Page 185 of 203
Page 186 of 203
CAA of NZ
31 August 2002
31 August 2002
CAA of NZ
Page 187 of 203
Page 188 of 203
CAA of NZ
31 August 2002
Glideslope Evaluation Report Appendix 7. Definitions

AF (Airway Facilities) An FAA organization that is responsible for ground maintenance of systems used for air traffic control. AT (Air Traffic) A term used to denote either the FAA organization responsible for operation of the air traffic control system, or air traffic controllers. CFIT (Controlled Flight Into Terrain) A condition where the flight crew has the aircraft under manual or automatic control and is unaware of a dangerous loss of altitude above ground level, culminating in an aircraft accident. CSB (Carrier plus Sideband) One type of radio frequency energy that includes the GS carrier frequency and its sidebands. It is normally transmitted into space where it combines with sideband only (SBO) energy to induce a glide path indication on aircraft instruments. FAF (Final Approach Fix) The point at which flight crews are at a known location and commencing an approach, often above an ILS marker beacon or other navigational aid on the extended runway centre line. Fly up A signal on navigational instruments, that indicates the aircraft is below glide path. GS (Glideslope) A facility that radiates modulated rf energy that provides vertical descent guidance to aircraft using instrument landing system approach procedures. HMI (Hazardously Misleading Information) A term referring to a radiated signal that is not providing accurate or safe indications. ILS (Instrument Landing System) Navigational aids that are used in concert to provide guidance for landing aircraft using instrument approach procedures. It includes a localizer for azimuth guidance, a GS for vertical guidance, and typically also includes marker beacons for distance reference, and a non-directional beacon for establishing an approach fix. MSAW (Minimum Safe Altitude Warning) A programmable ground system that alerts AT personnel if aircraft descend below predefined minimum altitude for a given location. NOTAM (Notice to Airmen) A message that is distributed in the NAS which includes information of particular importance to flight crews and air traffic personnel. OM (Outer Marker) A marker beacon used as part of an ILS that normally corresponds to the FAF. It is often collocated with a non directional beacon known as a compass locator. OTS (Out to Service) A condition where a ground facility is removed from operational service in the NAS. This does not necessarily mean that the facility has been physically shut down, but rather that its operational use is not permitted. Phasing. A maintenance procedure used at a GS facility to ensure the integrity of its radiated signals. During phasing, the radiated carrier and sideband signals are placed 90 degrees out of phase, a condition known as "quadrature." Quadrature A condition where GS CSB and SBO signals are placed 90 degrees out of radio frequency phase with each other.
12
31 August 2002
CAA of NZ
Page 189 of 203
Intentionally blank
Page 190 of 203
CAA of NZ
31 August 2002
Appendix 3
Comments and Submissions by interested parties Air New Zealand The Air New Zealand comments and submissions have been incorporated within the body of the report and the recommendations.
Boeing Boeing comments and submissions have been included in the recommendations plus the comment below: Boeing believes the report is well written, contains good detail and is extremely informative. Boeing finds it to be a valuable resource for communicating the subject topic. Boeing appreciates the time and energy expended in preparing the report, and the considerable thought put in to potential solutions to HMI incidents. Prior to 29 July 2000, Boeing had been working with the FAA and ICAO regarding nearcontrolled flight into terrain (NCFIT) incidents resulting from hazardously misleading information (HMI). The FAA and Boeing reviewed NCFIT incidents and the procedures normally used to mitigate the risk of ILS maintenance practices that result in radiating HMI. The result was FAA recommended changes to FAA, General Maintenance Handbook for Airways Facilities, Order 6000.15C, as well as amendments to FAA Maintenance Handbook for Instrument Landing Systems, Order 6750.49A. A draft version of these recommended changes is available from the FAA. Additionally, NOTAM wording will be developed, using ICAO guidelines, to enhance understanding and awareness of maintenanceinduced HMI.
Authors note: Other technical solutions were explored with Boeing during the course of the investigation. Technical proposals such as:
modifying the onboard avionics so as to change the aircraft behaviour after coupling to the glideslope and the localizer to ensure that a complete and valid signal is being received. modifications to the transmitted signal which would require ILS transmitter modification as well as the onboard avionics to cope with the new signal.
31 August 2002
CAA of NZ
Page 191 of 203
CAA Occurrence No. 00/2518 National Transportation Safety Board (NTSB) of the USA Note: These comments are from the Operational Factors Division (AS-30) and are not necessarily endorsed by the Board. 1. False glideslope indications are a fairly frequent occurrence. Pilot training and procedures require cross-checking and monitoring distance/altitude progress to preclude following a false glideslope indication.
2. The incident approach was an ILS DME approach, which required the use of DME as an integral part of the approach procedure. Page 115 states that The approach cannot be legally flown if the marker beacons/DME are inoperative; therefore the information provided by those facilities must be displayed. The flight crew did not utilize the DME information in conducting the approach. 3. There was an intent to intercept the glideslope at 2,500 feet, but no apparent mention of 7.5 DME as the appropriate intercept distance, nor were there periodic distance/altitude checks as conveniently depicted on the profile view of the approach plate. 4. There did not appear to be adequate crew coordinate between the PF, PNF, and the SP. No one appeared to be monitoring the flight progress, but rather appeared too focused on energy management and looking out the window for the airport. Normal crew coordination during an instrument approach requires crosschecking all appropriate navigational aids and indications. The SP made an attempt to reconcile altitude/distance, but disregarded them as erroneous. 5. The crew disregarded an uneasy and surprised sense that the glideslope had captured early, but did not confirm the altitude with the DME. Page 118 states: The PF cross-checked the DME and verbalized to the other crew that the information did not make sense. Yet he continued the approach. The SP computed the DME/altitude equation and recognized the answer did not compare to the aircrafts actual altitude yet he did not challenge the PF or the PNF. 6. Page 146. I disagree with the statement, Whilst it is acknowledged the crew had an opportunity to detect the erroneous glideslope prior to making the go-around decision, it is the view of the investigation that a high proportion of line crews would have made the same decision at glideslope capture. I believe that that only a very limited number of line crews would have disregarded DME vs. ALT at glideslope capture. 7. This incident approach appears to demonstrate a lack of proper preparation, inappropriate approach procedures, and a breakdown of crew coordination and crew resource management 8. Finding 3.1.5 If the aircraft was managed in accordance with company SOPs, there should be recommendations relevant to preparation and performance of ILS DME approaches.
Page 192 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 Federal Aviation Administration (FAA) of the USA The FAA has no comments on this report. However, refer to Appendix 2, FAA Glideslope Evaluation Report.
Ministry of Transport of Samoa The Ministry of Transport of Samoa has declined to comment.
Airways Corporation of New Zealand (ILS Ground equipment technical advisor) The Airways Corporation of New Zealand has noticed a number of items of recommendation in the report that if adopted by CAA of New Zealand, would be of concern to the company. One of these relates to the absoluteness of non-availability of a navigation service following unavailability of Tower monitoring. The other concern relates to an apparent non-recognition in the report of the regulatory relationship in the New Zealand environment of a 172 (Air Traffic Service Organisations) and a 171 (Aeronautical Telecommunication Service Organisations) certificate holder and their respective responsibilities. Some aspects of the report imply that some 171 responsibilities should be discharged by 172 certificate holders. It should not be overlooked that while Airways New Zealand happens to participate in the supply of services under both certificates it has no absolute right to continue to do so. There may be circumstances in future where Airways may not be involved in either and in fact where both services are delivered by different companies. Airways New Zealand has some concerns that the rules do not go far enough to ensure the respective responsibilities of 171 and 172 certificate holders are clearly outlined. In simple terms Airways New Zealand would like to see that the 171 certificate holder is clearly responsible for establishing the conditions under which an aid should be made available for use and that those conditions be made available to a 172 certificate holder. It should be equally clear that a 172 certificate holder is responsible for ensuring that the aid is not offered for use except under those conditions. Furthermore it should not be overlooked that a 171 certificate holder's services could be available at a location where there is no 172 service offered.
31 August 2002
CAA of NZ
Page 193 of 203
Intentionally blank
Page 194 of 203
CAA of NZ
31 August 2002
Appendix 4
Pilot Flying Feedback and Subsequent Analysis Using the CLEAR Model The PF provided the following recollection of the event shortly after the incident:
1. I built up the Flight Management computer to achieve an ILS at Apia on Rwy 08, the following parameters were inserted to give a profile of 140/110' at touchdown, 190/2000' at 6.0 ILS DME nm, (I planned a slightly higher speed because I anticipated losing speed in the turn onto the localizer) and left the speed parameter blank for the /2500' at 12 FA DME nm, thereby leaving the FMC to work out a TOD using the parameters I had programmed. The NOTAMs and Route Guide were checked; the other crew members had done the same. The F/O who was going to be in the seat for the arrival checked the FMC and verified it as I carried out a standard approach briefing for the ILS approach Rwy 08. He was aware of the aids and their NOTAM status. I briefed myself for a VOR/DME, and was planning on transferring to the VOR if any failure occurred. I expected those failures would present themselves in the form of FMA warnings/flags/or loss of identification at the Aid. I verbalised the VOR/DME profile and asked the third pilot to monitor the approach aids continuously, I had my approach plate open on the side shelf, he used the F/O's copy, he confirmed the arc size. All the flight deck crew were present and briefed before top of descent. The descent and flight around the arc were correctly flown except that the actual track took us inside the arc by nm. The ILS being identified whilst we were still on the arc. I stated aloud my mental calculations - distance around the arc, checked that the distance to run on FMC was about right. The FMC VNAV profile showed us to be within 300' of the profile throughout the arc to the localizer. While monitoring the LOC raw data I started the turn onto the localizer using the LNAV function with the speed bugged back to 220kts, with the altitude passing about 1000' above the mandatory 2500' all the while configuring the aircraft to Flap 1. During the turn on I reduced the descent rate with V/S, as I felt the energy was slightly low for G/S capture. The LOC was armed once it was established and subsequently captured it. The plan was to capture the MCP Altitude, set at 2500', slowing up to be at flap 5/180 kts at the G/S intercept. The G/S was armed after the LOC captured and captured shortly after. Once the G/S was captured, I moved the MCP altitude to the overshoot altitude of 4000'. However, the aircraft, which is supposed to have slowed up to F5/180 kts for the G/S, is instead doing 210-220 with F1 and not showing any signs of slowing up. I do believe that if the aircraft was not getting away on us, we would have spotted the DME discrepancy there. Automatic warnings of a malfunction were not present and we did not have time to pursue it further.
2.
3.
4.
5.
6.
7. 8. 9.
NOTE:
10. The sequence of events that occurred surprised me in view of what was planned and appeared to be occurring. I found it hard to understand how I could be so far out Midnight Blues? 11. I completed a quick check of the FMA for caution lines, boxes, EICAS for messages, A/P caution light, and no sound of aural warnings that the A/P ILS interface was amiss. There were no indications of transmitter or receiver failure. The third pilot was continuously listening to the ident, which was still going. Raw data on LOC and G/S checked out perfectly. 12. All my concentration was now focused on bringing the aircraft under control to meet SOPs. Urgent measures were used, speedbrake was deployed to control speed. I got F5 and F15 out with aid of speedbrake, gear selected at 1900'. I rationalised that the heavy aircraft and high entry speed to G/S was partly the cause of our predicament. F20 by 1500'. F25 on the way after confirming the flap limit speed. F30 before 1000'. Then completed the Before Landing checks.
31 August 2002
CAA of NZ
Page 195 of 203
13. I looked ahead to see lights, but was unable to see the runway lights. I knew the weather was reported as OK and considered that a poor weather report was a possibility, again, in the Islands. Was there a small patch of cloud on the G/S? 14. I checked the FA DME, which I had displayed along with the inbound course for the VOR ([FA x 3]500' for approximate G/S) Altitude Distance ratio was grossly in error and did another check, with the same result. 15. We definitely had a conflict of information but was the DME or the ILS in error? 16. I immediately voiced my concern as we descended between 700' and 650'. The 300' above (decision height) call had not been given, which the third pilot assured me, he was primed to give in case the PNF omitted to call it. I said something like DME is not right - think we had better G/A. Both non-flying pilots confirmed with visual cues, everybody called GO-AROUND at the same time. 17. The go-around was commenced. I was now very concerned about terrain that might be immediately in front of us and so left the gear and flaps down for a moment. I carried out the overshoot basically on the standby flight instruments and with the A/P disconnected, as I had just been grossly deceived and was not sure what information/equipment could be relied upon. 18. A second approach was carried out manually and I used DME/recommended altitudes comparisons for the approach. The ILS continued to give bad G/S information for a second time, which we ignored and ultimately made a successful approach and landing. 19. On reflection as soon as the Approach mode was armed, it captured prematurely. Initial trouble shooting by the crew did not reveal what the source of the problem was and of course no warnings from within the cockpit alerted us to poor ILS or A/P performance. This coupled with the task of immediately bringing a heavy A/C under control and correctly configuring it by 1500' and 1000' distracted us from noticing the DME/Glide Slope discrepancy.
Page 196 of 203
CAA of NZ
31 August 2002
CAA Occurrence No. 00/2518 Analysing the PFs report using the CLEAR1 model, 3 conflict points were identified and the decision making and resulting actions encapsulated and analysed. 1st conflict unexpected early glideslope capture (PFs report line 7 -11):
7. 8. 9. The G/S was armed after the LOC captured and captured shortly after. Once the G/S was captured, I moved the MCP altitude to the overshoot altitude of 4000'. However, the aircraft, which is supposed to have slowed up to F5/180 kts for the G/S, is instead doing 210-220 with F1 and not showing any signs of slowing up.
10. The sequence of events that occurred surprised me in view of what was planned and appeared to be occurring. I found it hard to understand how I could be so far out Midnight Blues? . 11. I completed a quick check of the FMA for caution lines, boxes, EICAS for messages, A/P caution light, and no sound of aural warnings that the A/P ILS interface was amiss. There were no indications of transmitter or receiver failure. The third pilot was continuously listening to the ident, which was still going. Raw data on LOC and G/S checked out perfectly.
How long do I have to CLEAR the problem?

C clarify: Do we have a problem? Yes - is the time immediate or short? L - look and listen for solutions: The ident is ok, no flags, ILS working. Circadian rhythm? (slow sums.) No demurring from the other crew. E evaluate: All indications are safe, the ILS is coupled, there are no associated warnings, established on the localizer therefore non-terrain critical. A act: Continue, solve energy problem. R - re-evaluate: As soon as possible, after fixing energy problem.
The first conflict point is a forced choice between accepting the glideslope capture as valid, or resolving the feeling of unease or surprise. If the glideslope capture is not accepted as valid, the consequence is that the SOP low drag approach requirements would not be met, therefore the most likely action required would be a go-around and second approach. The course of action based on the forced choice decision is to manage energy and be configured and stabilised by 1000 ft. Once the glideslope capture is accepted as valid, it is reasonable to conclude that there is a temporary acceptance of a possible distance error filed in prospective memory for later resolution.
C clarify (Do we have a problem? Of what nature and how long to solve?) L look and listen for solutions E evaluate A - act R re-evaluate CAA of NZ Page 197 of 203
31 August 2002
CAA Occurrence No. 00/2518 The crews mental model is that, provided there is a valid ILS identification signal with no warnings, the glideslope information is reliable, therefore the aircraft is on glideslope unexpectedly but the glideslope indication is valid. This is also when the first conflicting noise or disqualification is fed into the mental model (PF report 10 The sequence of events that occurred surprised me in view of what was planned and appeared to be occurring. I found it hard to understand how I could be so far out). 2nd conflict - Excess aircraft energy (PFs report 12):.
12. All my concentration was now focused on bringing the aircraft under control to meet SOPs. Urgent measures were used, speedbrake was deployed to control speed. I got F5 and F15 out with aid of speedbrake, gear selected at 1900'. I rationalised that the heavy aircraft and high entry speed to G/S was partly the cause of our predicament. F20 by 1500'. F25 on the way after confirming the flap limit speed. F30 before 1000'. Then completed the Before Landing checks.
C - clarify: Non-stable approach, time to clear before 1000 ft. L - look and listen E - evaluate: Yes continue to solve energy problem. A - act: Speedbrakes, flap and gear, and checklist. R - re-evaluate: Expect to be stable and configured, checks done by 1000 ft on coupled precision approach.
During resolution of the second conflict, task loading is competing with situational awareness. 3rd conflict no runway lights visible (PFs report 13 - 17):
13. I looked ahead to see lights, but was unable to see the runway lights. I knew the weather was reported as OK and considered that a poor weather report was a possibility, again, in the Islands. Was there a small patch of cloud on the G/S?. 14. I checked the FA DME, which I have displayed along with the inbound course for the VOR ([FA x 3]-500' for approximate G/S) Altitude Distance ratio was grossly in error and did another check, with the same result. 15. We definitely had a conflict of information but was the DME or the ILS in error? 16. I immediately voiced my concern as we descended between 700' and 650'. The 300' above (decision height) call had not been given, which the third pilot assured me, he was primed to give in case the PNF omitted to call it. I said something like DME is not right - think we had better G/A. Both non-flying pilots confirmed with visual cues, everybody called GO-AROUND at the same time. 17. The go-around was commenced. I was now very concerned about terrain that might be immediately in front of us and so left the gear and flaps down for a moment. I carried out the overshoot basically on the standby flight instruments and with the A/P disconnected, as I had just been grossly deceived and was not sure what information/equipment could be relied upon.
Page 198 of 203
CAA of NZ
31 August 2002

C - clarify: Stable, configured and visual on slope at 1000 ft, 900 ft lights visible but no runway lights in sight. Time to clear down to minimum altitude. L - look and listen for solutions: On localizer and glideslope, no flags. On localizer over water, no possibility of intervening terrain blocking runway lights. E - evaluate: Therefore, possibly a patch of cloud between aircraft and runway lights, black night, black hole effect. Continue further attempts to reassess DME/glideslope relationship. Tonal demurring apparent. Mental model may not be right, prudent to overshoot. A - act: GO-AROUND R - re-evaluate: Where is the terrain? What information can I trust?
The PF made the decision to initiate a precautionary go-around prior to the other two crew fully unlocking their mental set of a valid glideslope indication. The possible distance error stored in memory is retrieved by the PF during the unlocking of his mental model. The more powerful visual cues that the PNF and SP obtained provided the final impetus to unlock the PNFs and SPs valid glideslope mental model. During the second approach localizer and height distance relationship versus glideslope indication confirmed that the glideslope was radiating false information.
31 August 2002
CAA of NZ
Page 199 of 203
Intentionally blank
Page 200 of 203
CAA of NZ
31 August 2002
Appendix 5
The Context of Decision Making in NZ 60 and Systemic Failures in Relation to ILS Glideslope Transmission Systems
The historic hierarchical development of approach aids has resulted in the ILS providing a means of providing greater guidance accuracy that allows operation to a lower minima than was achievable with a non-precision approach aid. The proven accuracy of signal and equipment monitoring integrity allows an ILS glideslope to be legally used during approach to validate altimeter settings over marker beacons or equivalent. Design, installation and maintenance in accordance with ICAO Annex 10 standards, Industry specifications and New Zealand Civil Aviation Rules guarantees signal accuracy and dependability. In the case of the Faleolo incident the crew of NZ 60, having been properly trained and checked by the companys training organisation, was placed in a situation of cognitive forced choice1 to utilise a precision ILS glideslope that was transmitting a valid identification signal and was not displaying any instrument flags or warnings. A thorough descent and approach briefing including mitigating strategies against the navigation aids that were promulgated unmonitored, shaped and conditioned the crew's mental model for the approach and landing, or go-around and contingencies. The significance of the NOTAM unmonitored to the pilot would be that the ILS is cleared for operation but is not being monitored by the tower, therefore a failure will only be detected from the flight deck using the on-board safeguards of signal identification and an absence of warning flags. The expectation will be that, any time a signal on approach is received with the correct identification signals and with the expected flight instrument indications with no associated warnings, it will be a correctly calibrated and legally authorised signal unless some form of communication is received advising the equipment must not be used. During the initial approach, progress close to expected radials and profiles on the arc, visual sighting of the runway while still on the arc and a valid ILS identification signal with no flags reinforced the mental model of a safe profile, therefore to the crew the localizer intercept was validated. (PFs report 5 6)2. As the ILS had a valid identification signal with no flags displayed, this would indicate that the associated glideslope displaying no flags or warnings and displaying apparently valid glideslope steering information must also be valid. An apparent time / distance loss of approximately 1 minute or 4 6 nautical miles must have occurred, however, this would not affect localizer validation. Acceptance of the ILS protection devices will cause the forced choice to be made in favour of the precision ILS glideslope and disqualify mental position causing a revised situational awareness.
Fechner Psychophysics 1860 Fechners law sensation intensity is proportional to the logarithm of the stimulus intensity. Refer to forced choice (Woodworth & Schlosbergs Experimental Psychology 3rd Edition 1972 pg 19; Blackwell 1963; Jones 1956)
2
Refer Appendix 4 Pilot Flying Feedback and Subsequent Analysis Using the CLEAR Model.
31 August 2002
CAA of NZ
Page 201 of 203
CAA Occurrence No. 00/2518 Modern aircraft design philosophy is such that the aircraft autoflight system will use a signal received from an ILS for autoland as first choice and will require the pilot, if he wishes to override this choice, to manually intervene to prevent an autoland. This design philosophy will reinforce the crew forced choice decision of a valid glideslope capture. Whereas the crew will always require an ILS identification signal the B767 on-board equipment does not. This investigation is unaware of any other crew that has experienced a flyable ILS that was correctly identing and displaying no warnings yet was radiating erroneous information that caused conflict resolution on approach with altimetry at a marker or DME point, unless there was an error in altimeter setting or DME reading, or unless systemic failures allowed the radiation of erroneous information.
Systemic Failures For a category 1 dual installation with suitable power support, ICAO specifies six-second maximum delay for transfer of signal. The unit protection, detection and switching are achieved through an equipment monitor ensuring the transmission is within defined tolerances. If not, an automatic shutdown and shift to the alternative transmitter is achieved within 6 seconds. If the transmission is still not satisfactory then the whole unit will shut down, the navigation aid identification will cease and the aircraft glideslope deviation indicator will be withdrawn from view. The Tower Remote Status Indicator will also indicate a shutdown. The technician placing the equipment monitor switch in the control bypass mode inhibited the automatic shutdown function and invalidated the navigation aid identification signal and on-board glideslope deviation indication, because the glideslope deviation indication will display on receipt of a carrier wave (CSB) signal within design parameters, which in this case was still radiating. The Tower Remote Status Indicator was also inoperative thus removing the ability for the air traffic controller to determine the operating status of the navigation aid. Therefore a glideslope transmitter unit left in a control bypass mode with a fault present resulted in the aircraft positioning onto an approximately correct trajectory entry point. The crew then turned their attention to the acquisition and capture of the localizer and glideslope for a precision approach with apparently valid acceptance of a coupled approach on an erroneous glideslope. The proving flights conducted on runway 05 at Auckland demonstrated the ability of the aircraft to accept an erroneous glideslope and also localizer, neither of which were providing valid steering information to the aircraft. This demonstrates the requirement for educating crews, technicians and Air Traffic Control personnel about this trap. It also reveals the necessity for technicians to ensure that critical items are independently checked and signed off, the significance of the Tower Remote Status Indicator to the system, and demonstrates the importance of flight crew ensuring reasonableness of approach aid information and maintaining situational awareness during the approach.
Page 202 of 203
CAA of NZ
31 August 2002
Report Approval and Release

By the Civil Aviation Authority of New Zealand
[signed] Michael A. Carrelli Investigator in Charge
[signed] Richard White Manager Safety Investigation
[signed] John Jones Director Civil Aviation
[signed] Rodger Fisher Chairman
Released:
30 August 2002
Queries can be directed to Michael A. Carrelli at:
[email protected]
Report available online at
www.caa.govt.nz
31 August 2002
CAA of NZ
Page 203 of 203

CAA Occurrence Report 00-2518

Uploaded by

Copyright:

Available Formats

CAA Occurrence Report 00-2518

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CAA Occurrence Report 00-2518

Uploaded by

Copyright:

Available Formats

What was the incident that occurred?

What was the incident that occurred?

What were the experiences and duties of the pilots involved?

What were the experiences and duties of the pilots involved?

AIRCRAFT SERIOUS INCIDENT REPORT OCCURRENCE NUMBER 00/2518 B767-319ER ZK-NCJ

NZ 60 ERRONEOUS GLIDESLOPE CAPTURE, AUTOCOUPLED APPROACH, AND GO-AROUND

CAA Occurrence No. 00/2518

CAA Occurrence No. 00/2518

1.2 1.3 1.4 1.5

CAA Occurrence No. 00/2518

Meteorological Information .................................................................................... 52 Aids to Navigation.................................................................................................... 52

1.9 1.10 1.11

Wreckage and Impact Information........................................................................ 77

CAA Occurrence No. 00/2518 1.13

Medical and Pathological Information .................................................................. 77

1.14 1.15 1.16

Organisational and Management Information ..................................................... 94

CAA Occurrence No. 00/2518

2.2.1 2.2.2 2.2.3 2.2.4 2.2.5 2.2.6 2.2.7 2.2.8 2.2.9

Aircraft Systems ..................................................................................................... 128

2.3.1 2.3.2 2.3.3 2.3.4 2.3.4.1

NOTAMS ................................................................................................................ 134

ILS Design and Maintenance ................................................................................ 136

Approach Plates ..................................................................................................... 139 Standard Operating Procedures........................................................................... 140

Proving Flights ....................................................................................................... 141

Organisational Factors .......................................................................................... 142

2.9.1 2.9.2 2.9.2.1 2.9.2.2 2.9.3 2.9.4 2.9.5

CAA Occurrence No. 00/2518

FINDINGS ...................................................................................................... 151

SAFETY ACTIONS TAKEN OR AGREED .................................................... 163

APPENDIX 1 .......................................................................................................... 167

APPENDIX 2 .......................................................................................................... 177

APPENDIX 3 .......................................................................................................... 191

APPENDIX 4 .......................................................................................................... 195

APPENDIX 5 .......................................................................................................... 201

REPORT APPROVAL AND RELEASE ................................................................. 203

CAA Occurrence No. 00/2518

CAA Occurrence No. 00/2518

CAA Occurrence No. 00/2518

Abbreviations and Definitions

VOR VOR DME VOR/DME V/S

CAA Occurrence No. 00/2518

Aircraft Incident Report

CAA Occurrence No. 00/2518

CAA Occurrence No. 00/2518

CAA Occurrence No. 00/2518

CAA Occurrence No. 00/2518

CAA Occurrence No. 00/2518

1.1.4 Go Around 1.1.4.1 Pilot Flying:

Pilot Not Flying:

CAA Occurrence No. 00/2518

No damage occurred to the aircraft.

There was no damage to other property or objects.

Duty --0.0 103.5 177.9

Duty --43.0 51.0 141.2

Duty --23.2 114.6 243.3

CAA Occurrence No. 00/2518

Allowable C of G Range at planned takeoff weight

Configuration During an Autocoupled ILS Approach

Air New Zealand Low Drag Approach Profile