Editor's Note

Safety: Belt and Suspenders Required for Safety

By David Evans | January 1, 2004
Send Feedback

Presented with an opportunity to strike a blow for redundancy, federal officials took a pass. The decision discomfits many pilots, who perceive a reduced margin of safety. The case involves the final rule published Oct. 27, in which the Federal Aviation Administration laid out its program for domestic reduced vertical separation minimum (DRVSM) flights. The ruling halves the 2,000-foot vertical separation currently applied to flight levels between 29,000 and 41,000 feet. For example, the ruling inserts a new flight level at 30,000 feet between the traditional 29,000- and 31,000-foot flight levels. DRVSM allows six new flight levels, bringing to 13 the number of aerial highways on which aircraft can be routed between 29,000 to 41,000 feet. This enhances capacity, for sure, while providing controllers with some additional flexibility in routing aircraft around bad weather. The new order in domestic skies takes effect Jan. 20, 2005. Thus, from that date forward, the 1,000-foot vertical separation heretofore applied to lower altitudes will be extended upward.

With less vertical space between aircraft, traffic alert collision avoidance system (TCAS) technology assumes a greater importance in assuring the margin of safety.

Here is where a lawyer’s eye for fine distinctions comes in handy. Consider the wording of the introduction to the FAA’s final ruling:

"The RVSM program allows the use of 1,000-foot vertical separation at certain altitudes between aircraft that meet stringent altimeter and autopilot performance requirements. This rule also requires any aircraft that is equipped with traffic alert collision avoidance system, version II (TCAS II) and flown in RVSM airspace to incorporate a version of TCAS II software that is compatible with RVSM operations. The FAA is taking this action to assist aircraft operators to save fuel and time, to enhance air traffic control flexibility, and to enhance airspace capacity."

More specifically, the TCAS II must be version 7.0, not version 6.04. Not to get too technical here, but it may be useful to briefly review the three versions of TCAS. TCAS I is the basic system; it provides proximity warnings known as traffic advisories (TAs). It does not provide recommended vertical escape maneuvers, known as resolution advisories (RAs). TCAS II, 6.04, provides TAs and RAs, but generates too many RAs with decreased aircraft vertical spacing under RVSM. TCAS II, version 7.0, reduces the number of unnecessary RAs. Basically, it does a better job of discriminating between intruding and threat aircraft. Version 7.0 contains software logic that recognizes the difference between an RVSM-equipped aircraft and a non-RVSM-equipped aircraft, thereby cutting down on false alerts.

What FAA is saying is that if one’s aircraft is equipped with TCAS II, it must be version 7.0 in order to fly in DRVSM airspace. Here’s the distinction: if an aircraft is not equipped with TCAS II, no matter–it’s not required.

One has to read all the way to page 50 of the final rule to discover that the FAA "does not concur" that TCAS II, version 7.0, should be a requirement for operation in RVSM airspace.

This escape clause has pilots unions spun up. They believe, for safety’s sake, that TCAS II, version 7.0, should be a no-exceptions precondition for flying in DRVSM airspace. Capt. Mike Leone, chairman of the National Air Safety Committee for the Allied Pilots Association, the union of American Airlines pilots, says flatly that DRVSM without a TCAS requirement is eroding the margin of safety. "The 40-page ruling can show all the graphs and compare the United States to Europe and oceanic airspace to domestic airspace until the cows come home. But at the end of the day, the pilots flying in that DRVSM airspace would all agree that making TCAS mandatory increases safety. Anything short of that lowers the safety bar."

"A 10-year old can do the safety analysis," Leone says. "We’re lowering the safety bar by flying with just a 1,000-foot vertical separation above 29,000 feet. The reason we had the 2,000-foot separation was for safety," he says. Leone explains that altimeter errors can increase with altitude and aircraft performance and stability margins are reduced. It was for these reasons that the 1,000-foot separation at lower altitudes was doubled for flights above 29,000 feet. TCAS is needed, Leone argues, "to offset the lowered safety bar."

"It should be a go/no-go item, especially in a non-radar environment, where you’re on your own," he says. Leone cites flights from Miami to San Juan, Puerto Rico, as an example. In that situation, two aircraft on a collision course without TCAS would be like blind men stumbling into one another. If one aircraft had TCAS, it would at least be alerted to take evasive action, he maintains.

Three concerns are addressed here. Because of its contentiousness, TCAS heads the list.

The Coalition of Airline Pilots Associations (CAPA) says the July 2002 midair collision at 35,000 feet of a Tu-154 and a B757 freighter near Euberlingen, Germany, highlights the hazard of having only some aircraft equipped with TCAS in RVSM airspace. "Both aircraft were TCAS-equipped, but one aircraft elected to follow ATC instructions [to descend] rather than respond to the TCAS warning [to climb], while the other aircraft initiated a maneuver to respond to a TCAS warning [also descending]," CAPA points out.

"The result was exactly what would have happened if only one aircraft had had TCAS," the CAPA comment argues.

FAA disagrees that the midair cited by CAPA made the case for mandatory TCAS. "It appears that this scenario would have occurred as it did under the conventional vertical separation rules that were applied prior to European RVSM implementation," the agency counters.

Second, FAA maintains that since RVSM was implemented for the North Atlantic region in March 1997, approximately 10 million flights have flown safely and that body of experience will be applied to the safe implementation of the domestic U.S. program.

Leone disputes the FAA assurance, saying that in oceanic operations virtually all planes "are going in the same direction." The amount of "beak to beak" traffic (flights closing in the opposite direction at 1,000 mph) is negligible.

The pilots unions maintain that the proverbial cart is preceding the horse, as the final DRVSM rule has been issued before completion of a comprehensive safety analysis. Indeed, sources say the final safety analysis is slated for publication in June 2004.

Steve Entis, DRVSM representative for the National Air Traffic Controllers Association, says various computer simulations of DRVSM have been conducted during the 2001-2003 period at the FAA’s Technical Center. "In every case, controller workload, complexity and the potential for error were reduced," he says. "Overall, I’d say that’s a safety enhancement."

The pilots’ unions remain skeptical, maintaining that computer simulations bereft of the effects of convective weather and equipment glitches–such as transponders broadcasting incorrect altitudes on which TCAS depends–do not make the conclusive case for safety.

Nonetheless, DRVSM is coming. It represents efficiency virtues whose time has come.

The case for requiring TCAS II, version 7.0, comes from FAA’s oft-touted "belt and suspenders" approach to safety. Yes, for RVSM all airplanes must be equipped with two independent altitude-measuring systems, transponders broadcasting the aircraft’s altitude, altitude deviation alerts, autopilots with barometric hold, and other RVSM-related avionics. These are the constituents of the "belt." TCAS represents the "suspenders." Most airplanes will have TCAS II because this important safety technology is spreading. But version 7.0 is not required to operate in DRVSM. Making it a required item, and requiring that it be functional for flight in DRVSM airspace, would provide another level of safety. Right now, FAA allows that since an aircraft can be dispatched into DRVSM airspace with an inoperative TCAS, it would be inconsistent to require installation of a piece of equipment that need not be functioning for dispatch.

One could turn the argument around and mandate a functioning TCAS II, version 7.0, for flight in DRVSM airspace. Until the belt breaks, suspenders aren’t needed to keep one’s pants up. But TCAS II, version 7.0, is the last buttress against potentially deadly embarrassment.

Receive the latest avionics news right to your inbox