Initially unnoticed by the flightcrew or air traffic control (ATC), an El Al B747–412 (4X–ELS), with 455 persons on board, slipped well below the ILS glideslope (G/S), while on finals to Heathrow on Jan. 10, 2006. An alert controller saw that the aircraft was unusually low on the glide path as it passed 1,600 feet and instructed the crew to climb, simultaneously reassuring them that the glideslope was serviceable. The G/S was calling for a progressively greater rate of descent–and the autopilot was complying. It was later calculated that this had peaked at 1,800 feet/minute–almost triple what it should be. Eventually, the G/S failure flag and an engine indication and crew alerting system (EICAS) message, "No Autoland," appeared, just before ATC expressed concern. The aircraft had reached a minimum altitude of 1,200 feet at 8 nm from touchdown after smoothly capturing the G/S at 4,000 feet.
On receiving ATC’s call, the pilot disconnected the autopilot, climbed slightly and on receiving what he perceived as "reasonable" indications, reengaged the autopilot. The remainder of the ILS was uneventful. During taxi–in the crew mentioned to ATC that "the glideslope had fluctuated." ATC responded that no other preceding or subsequent aircraft had reported problems. If the aircraft had continued, about 18 seconds prior to impact the ground proximity warning system would have expressed a synthetic alert of "sink–rate" followed 9 seconds later by an exhortation to "pull up!" The incident was logged by ATC as a "level bust" and the crew failed to complete an incident report, but recorded an entry in their log. The UK Aviation Accident Investigation Board (AAIB) found out about it some weeks later and called for the ILS 27R error logs. They indicated normal operation. El Al was asked to investigate further and the aircraft’s central maintenance computer was interrogated. Fault codes were cross–checked against the fault isolation manual. They disclosed an ILS "beam error." This assumes that the ILS ground equipment is faulty and states that no action is required by maintenance. Fault subcodes indicated that the error had been detected by both left and right ILS receivers, tending to confirm that it wasn’t an aircraft system error. For these faults to be recorded, the G/S must be captured prior to an error occurring on the ground. With the autopilot engaged and the flight director (FD) on, the FD bars should bias out of view and an amber line be superimposed on the G/S display together with an EICAS caution–not ignore the error.
Technical log entries for 4X–ELS disclosed unrelated occurrences of "No Land 3" messages on other flights. The cure applied on each occasion was to swap around the flight control computers, but it could not be determined whether this fault was related to the ILS 27R G/S error. The AAIB was not aware of any similar incidents and concluded that the G/S error was due to an unidentified intermittent internal fault (cell–phone?) or "external to the aircraft but experienced only by 4X–ELS" (a veiled reference to illegal directed RF interference by a third party?). However it all serves to recall another previously unknown, deadly ILS G/S glitch discovered in July 2000. An Air New Zealand 767 was 10 seconds from hitting the sea off Samoa after its ILS tried to land 8.8 km (4.7 nm) from Faleolo Airport. The pilot pulled up 400 feet from the ocean after noticing lights from a neighboring island. The 767 was actually below G/S for the entire approach, however, the ILS had indicated to the pilots that they were on G/S and would touch down on the runway. This erroneous indication occurred irrespective of where the aircraft was in the signal reception area. The Faleolo ILS G/S transmitter had been inadvertently left in a test mode with the unserviceable transmitter selected and radiating invalid G/S guidance. It was a very important lesson on how an ILS can subtly "fail." Although ILS has been in use for more than 40 years, this problem had remained undiscovered. The incident helped uncover a glitch that can be linked to about 40 other accidents.
In a 1997 Korean Air 747–300 accident that killed 228 when the jet crashed into hills near Guam, the U.S. National Transportation Safety Board concluded that the pilot had failed to recall that the Agana ILS was "NOTAM’d" out of service. Pilots had come to believe that if there was no warning, then the system was working. That’s not necessarily so.
Esoteric avionics malfunctions aren’t always on board. However, the troubleshooting avionics logician says that, on first principles, when swapping around redundant kit, eliminate "fault preservation" by swapping between two or more aircraft. Then look elsewhere … and change the antennas.
John Sampson is the editor of Air Safety Week.