This autopilot feature flies the aircraft down to a safer altitude, reducing the risk of occupant injury due to depressurization.
By Marty Rollinger
ATP. Challenger 600 & 604,
Falcon 2000 EASy and McDonnell Douglas F/A-18
Captain Blu Nailbed is flying a regular trip with his familiar copilot U Foria. Out of Orlando, they are taking the Maus family to a Wisconsin cheese festival. On level-off at FL390, a cabin altitude warning presents itself.
Following the 1st step of their aircraft emergency procedures, the crew put on their oxygen masks and commence further troubleshooting. Is bleed air coming in normally? Is an outflow valve stuck open? The passenger oxygen masks deploy automatically, which confirms that the cabin pressure has reached an abnormal level.
At this point in the story, our masked aviators become hypoxic and incapacitated because the gas they are breathing is, in reality, only compressed ambient air, which is incapable of preventing hypoxia at high altitude.
Unbeknown to our crew or their highly competent maintenance department, the last time their oxygen bottle was serviced, it was filled with compressed air only, not life-sustaining pure oxygen. Luckily for this crew, the aircraft was equipped with a “magic” system which activated and automatically flew the aircraft down to denser air, where the crew regained consciousness and reclaimed control of the aircraft.
Unbelievable story? Oxygen bottle filling errors are a documented hazard. The National Transportation Safety Board (NTSB) accident database lists a 1997 fatal accident that resulted from an oxygen bottle mistakenly filled with ambient air. The crew of a Cessna 337 used oxygen mask procedures appropriately, but they still lost consciousness, and a fatal crash ensued.
A highly publicized business jet hypoxia accident involving a Learjet 35 claimed the life of pro golfer Payne Stewart plus 3 other passengers and the crew on Oct 25, 1999. After being cleared to climb to FL390, the professional crew failed to respond to radio calls and level off.
The plane crashed more than 3 hours later in South Dakota. Max altitude reached was 48,900 ft. Once the engines were starved of fuel, the plane slowed and then rolled out of control to its crash site in little more than 2 minutes.
NTSB could not rule out the possibility that the oxygen bottle contained air instead of oxygen.
According to NTSB, “The probable cause of this accident was incapacitation of the flightcrew members as a result of their failure to receive supplemental oxygen following a loss of cabin pressurization, for undetermined reasons.” This Learjet 35 needed, but did not have, a magic system to automatically fly the aircraft down to thicker air.
On Aug 14, 2005, a Boeing 737 crashed in Greece, killing all 121 passengers and crew. According to the accident report, the crew incorrectly diagnosed a cabin altitude warning as a takeoff configuration warning until succumbing to hypoxia. The plane flew on autopilot (AP) at 34,000 ft until fuel starvation occurred. They, too, needed a magic system to rescue them.
Automatic descent equipment
In reality, an automatic system to fly an aircraft down to thicker air is not magic at all. It exists today and is in widespread use on business jets. Called Automatic Emergency Descent Mode (AEDM), Automatic Descent Mode (ADM), or Emergency Descent Mode (EDM) by various manufacturers, the system debuted in 1997 on the Gulfstream V.
The “magic” system is an AP feature which safely flies the aircraft from physiologically impairing altitudes to altitudes where both life and consciousness can be maintained, thus mitigating the risk of occupant injury due to depressurization.
On Dassault Falcon aircraft, ADM activates when sensed cabin altitude climbs above 15,000 ft while the aircraft is at, or above, 30,000 ft pressure altitude. Normal cabin altitude at cruise flight levels is less than 7000 ft. Falcon ADM assumes the pilots have become unconscious.
Once activated, it turns on the autothrottles – if they were not already on – and retards the engines to idle thrust. AP then varies the descent attitude to maintain MMO/VMO until reaching 15,000 ft, where the aircraft will level off and decelerate to 250 kts. This maneuver allows the flightcrew to regain consciousness and assume control of the aircraft.
While descending, the aircraft will automatically use half bank to turn left 90 degrees and then hold this new heading. The 90 degree heading change serves to alert air traffic controllers that there is something unusual about the aircraft that needs their attention, as well as serving as a way to get the descending aircraft off a particular airway or oceanic track.
If the pilots are receiving sufficient oxygen through their masks to remain conscious, they can disengage ADM with a push of the AP quick-disconnect on the yoke, or deselect AP on the guidance panel. ADM is available on all EASy Falcon models.
Gulfstream’s AEDM system works as described above, except that the aircraft must be flying above 40,000 ft for AEDM to trigger. According to Heidi Fedak, Gulfstream’s director of corporate communications and media relations, “[Gulfstream] introduced AEDM on the GV in 1997 because its max altitude was 51,000 ft, requiring us to develop a method of addressing rapid depressurization.”
All in-production Gulfstream models are equipped. The G500, G600 and G700 all go a step further than earlier AEDM implementations in that the airbrakes will open when AEDM activates.
Textron and Embraer
ADM is standard on Textron’s Cessna Citation Sovereign+, Latitude, and Longitude, and it’s an option on the Caravan and Grand Caravan, says Christina Walser, communications specialist at Cessna Citation Business Jets.
Textron aircraft that are not outfitted with autothrottles are equipped with EDM, which is similar to ADM but lacks the ability to automatically reduce engine power. Current production aircraft that feature standard EDM include Cessna Citation M2, CJ3+, CJ4, and XLS+.
Embraer delivers its Phenom 100EV/300E, Legacy 450/500, and Praetor 500/600 business jets with ADM as standard equipment.
Garmin’s take on ADM is part of the company’s Autonomí suite of autonomous flight solutions, and is called EDM. Autonomí, pronounced as “autonomy,” is an overarching term that encompasses layers of safety. EDM is built into Garmin’s integrated flightdecks – those containing both Garmin avionics and Garmin AP – and it’s typically standard in pressurized turboprops and jets.
Interestingly, the non-pressurized Cirrus SR20/SR22 light singles also have EDM. In non-pressurized cockpits, the Garmin avionics monitor pilot consciousness. If no avionics interactions are sensed for a set time, the avionics will prompt the pilot. If this prompt goes unacknowledged, EDM will activate and the aircraft will head down to thicker air.
According to Bill Stone, Garmin’s senior manager of aviation business development, the company’s work on EDM and its new Emergency Autoland mode predates Payne Stewart’s accident, but that tragedy solidified the need for autonomous flight solutions.
What ADM won’t do
As with any airplane system, it is important to understand its limitations as well as the capabilities. Most ADM systems will not engage while the aircraft is being hand flown. With a few exceptions, ADM will not automatically deploy airbrakes, nor change the transponder code to 7700, nor transmit Mayday on either the radio frequency or data link.
The system will not change altimeter setting as the aircraft descends through transition level, nor will it keep the aircraft from impacting terrain that happens to poke above the designed level-off altitude.
Does ADM work?
A few years ago, ADM was installed on my company’s aircraft. The owner asked, “How do we know it works as described?” So we set out to satisfy the owner’s question. We read the literature and trained with ADM in the simulator. In the sim, ADM worked as advertised, of course. How to functionally check the system? How do owners know that they are getting what they paid for?
We created a functional test plan that would be conducted off Florida’s gulf coast on an empty leg. The plan was to depressurize the cabin by depressing the DUMP push-button, but Falcon 2000LX only allows dump to cabin altitude of 14,500 ft.
To raise the cabin further, to the 15,000-ft trigger threshold, we would need to shut off all incoming pressurization air. We would follow the Falcon maintenance procedure for the inflight check of cabin sealing, which instructs the operator to turn off all incoming air, and then monitor cabin altitude.
We planned to turn off the cabin oxygen system to prevent passenger oxygen mask deployment and have the pilots wear oxygen masks to eliminate the risk of hypoxia.
Airspace coordination was a challenge because there was no way to instantly trigger ADM to function, and because of the rapid descent and 90-degree turn. We worked with Miami Center for a southbound track through Gulf of Mexico Warning Areas that were not in active use by the military. We coordinated a clearance to descend and turn at pilot’s discretion (since there is no clearance for “descend at airplane’s discretion”).
The cabin leak rate on the Falcon was amazingly slow. With all flow into the cabin turned off, the cabin altitude took over 2 minutes to rise from 14,500 ft to the trigger altitude of 15,000 ft. When ADM activated, the pilots saw amber flashing ADM indications in both the vertical and horizontal flight mode annunciator windows as expected.
ADM is much more benign than the emergency descent practiced in the simulator for 2 reasons. First, the airbrakes do not deploy automatically, thus the descent rate is similar to an everyday descent. Second, the turn is done gracefully at half bank. ADM worked as expected, giving the owner confidence in the newly-installed software.
Prior to ADM installation we would routinely hand fly the aircraft to cruise altitude to maintain hand flying proficiency. With ADM protection only available when AP is engaged, we changed our standard operating procedure to engage AP by 30,000 ft to gain full ADM protection.
Gulfstream’s Heidi Fedak reports that Gulfstream is aware of 2 AEDM activations in its 22 years of operational service. Do you have knowledge of any saves? If so, consider reporting the event to your aircraft manufacturer, NASA, or FAA.
If your oxygen system was inadvertently filled with pressurized air, how would you know until it was too late? Normal preflight tests only check for flow of gas, not gas chemistry. A simple and inexpensive pulse oximeter device could help.
While breathing normal cockpit air at cruise altitude, the pilot can self-administer a pulse oximeter reading, and then breathe 100% oxygen through the oxygen mask for 60–90 seconds before taking a second pulse oximeter reading. Breathing 100% oxygen, the pilot will see a noticeable increase in pulse oximeter reading (likely to 100% blood oxygen saturation).
Marty Rollinger has over 35 years of flight experience in 68 different aircraft. A career US Marine Corps pilot, he was a Liethen-Tittle Award graduate of USAF Test Pilot School. He is director of flight ops for a Midwestern operator and a member of the Falcon Operator Advisory Board.