US Air Force F-16 Auto GCAS saves lives and airframes. A similar system could work in commercial aircraft.
By Don Witt
ATP. Learjet series, Airbus A320,
Boeing 737, Boeing 757/767
The aviation community still searches for a solution to the deadly problem of loss of control inflight (LOC-I). In civilian aviation, LOC-I continues to result in more fatalities than any other accident category. Many factors open the door to LOC-I.
It might be vertigo or loss of orientation, as in the Airbus A320 dive to the sea off Sochi in 2006; it could also be flight control malfunctions like the past rudder handovers in Boeing 737s at COS (Colorado Springs CO) and PIT (Pittsburgh PA), or the more recent Boeing 737 MAX accidents.
There are many causes of civil LOC-I fatal accidents, but, in nearly all cases, the flightcrew members are conscious and fighting for control, or grasping for the situational awareness needed for survival. On the other hand, military fighter pilots in recent years have most frequently died due to loss of consciousness when the pilot experiences G-LOC – loss of consciousness due to sustained very high G forces.
These pilots literally die in their sleep. Fortunately, G-LOC will never be a cause of airline or bizjet accidents, because such aircraft cannot generate or sustain enough G to put their pilots to sleep. However, modern jet fighters are capable of sustaining G forces that are right at human physical limits, and many hours in training, not to mention actual combat, are spent in just that regime.
What is common to both civilian and military fighter jet accidents is an aircraft effectively out of control plunging into the ground. The good news is that the military, specifically Lockheed Martin, NASA, and the Air Force Research Laboratory (AFRL), have found a solution for their side of the street, and just maybe some day it will work on the civilian side too, providing automatic recovery from loss of control safely before ground contact.
G-LOC – a silent killer
Even in World War II, piston-engine fighters could sustain enough G to bring a pilot to “gray out” or “black out.” Some Spitfires had a bar above the rudder pedals so the pilot could move his feet up, raising his legs and helping him keep enough blood flowing vertically up to the brain and eyes in hard turning fights.
For the same reason, modern F-16s have reclined ejection seats. In the Vietnam era, front-line fighters could generate upwards of 9 Gs momentarily at higher speeds, but they could not sustain it. An F-4, however, could sustain a steady 6 Gs, but that was usually in a descent.
The main problem for a pilot at 6 Gs was that, if he turned around to see if an opponent was behind and tracking him, his head would fall against the canopy and he could only return it forward with a lot of difficulty. With the F-16 came the ability to sustain more than 9 Gs in a turn.
Unfortunately, at this level of sustained G force, loss of consciousness can come suddenly and without warning. In an F-4, tunnel vision and loss of vision at 6 Gs were clear warnings that loss of conscious¬ness was next, but sometimes those warnings are not perceived in time, or even at all, at 9 Gs in an F-16.
Suddenly, the pilot is just gone. Worse yet, he may be gone for a considerable time. That could be 10 or even 20 seconds, which may not sound like much time, but at 600 kts it’s plenty of time to reach the ground. In fact, 75% of F-16 crashes have been due to G-LOC.
What to do? A long period of development by Lockheed, NASA, and AFRL led to an amazingly successful technical solution to the problem – Automatic Ground Collision Avoidance System (Auto GCAS), a computer program constantly running constantly during flight.
It projects the aircraft’s current trajectory and “looks” at a precise detailed map of the terrain (Digital Terrain Elevation Data [DTED]) to compute a potential crash. Obviously, Auto GCAS doesn’t know if a pilot is conscious or not, but if the flightpath is headed at the cold hard ground, it will wait until the last possible moment (so as not to interrupt something the pilot is actually trying to do) and then roll the aircraft right side up and pull hard until the flightpath is safe again.
Taking it to the limit
Perhaps the most difficult aspect when developing Auto GCAS was refining the program so it wouldn’t unnecessarily interrupt something like a low-altitude strafing pass by being overly “cautious.” In fact, one of the saves Auto GCAS achieved in combat was during a relatively low but steep strafing pass when the pilot was apparently target fixated.
I can relate to such an event because I was abruptly yanked out of a strafing pass, not by a computer, but by my back seater. At the moment, I had lost all contact with reality. Fortunately, my “guy in the back” put 9.5 Gs on the meter in his pull up, and we very narrowly missed the targeted truck and the ground beyond.
Although most F-16 pilots do not have the luxury of a back seater, now they have Auto GCAS. The Air National Guard 162nd Wing, based at Morris ANGB in Tucson AZ, does a great deal of F-16 training. In fact, the F-16 Auto GCAS save video found on YouTube, declassified by the USAF, occurred in its training program.
If Auto GCAS was viewed skeptically by pilots at first, after several saves like this it is now accepted enthusiastically by most, as 7 F-16s and 8 pilots have been saved so far. An aspect of Auto GCAS termed Pilot Activated Recovery System (PARS) can be initiated by the pilot when he/she has lost spatial orientation and literally doesn’t know any more which way is up.
Think of delivering ordnance in a steep dive on a pitch black night, a dive that starts with a roll to inverted, and you might understand how that could happen! PARS is a separate button in the F-16 cockpit, and the pilot must let go of either the throttle or the sidestick to activate it.
PARS initiates an Auto GCAS recovery, a rapid roll to level, and a 5G pull up. A PARS Auto GCAS function could have avoided the fatal 2006 crash of a Sochi-bound Airbus A320. And since almost all civilian LOC-I accidents occur with fully conscious pilots at the controls, PARS could eliminate the leading cause of civilian air accidents, namely LOC-I.
Will we ever see an Auto GCAS system in commercial jets? I hope so. USAF technicians are considering it for the branch’s large aircraft, tankers, transports, and heavy bombers. So, why not install a similar system in airliners and bizjets with fly-by-wire (FBW) technology?
In the case of LOC-I accidents, civilian pilots collide with the terrain because they can’t help it, and CFIT accidents happen because they don’t know the ground is there. Auto GCAS could prevent either event because it does not care why an aircraft is hurtling toward terrain – it just acts.
Sadly, current civilian Enhanced Ground Proximity Warning Systems (EGPWS) do not automatically recover an aircraft from flight into terrain. In fact, the guidance in an EGPWS manual is not even very specific about how the pilots should effect such a recovery.
“Almost” was not good enough
EGPWS supplement for one jet I train states that the “action required” in response to a “TERRAIN, TERRAIN, PULL UP” warning should be “immediately apply engine power, establish a positive climb attitude, and climb at the maximum practical rate until warnings cease.”
What exactly do “apply engine power” and “climb at the maximum practical rate” mean? Unless a bizjet pilot has experimented in his aircraft or in a level C or D simulator, he may have no idea.
I know from such experiments that a pilot can pitch up a Learjet from a speed as low as 200 kts on an approach to a pitch attitude of 45º nose up while applying full throttle, and climb at least 4000 ft from where he started before loss of speed and increasing angle of attack require a significant reduction in pitch and climb rate. But do you know what your specific aircraft can do?
If a bizjet pilot receives an EGPWS warning on a dark and stormy night, he/she may then climb below the optimum or available climb rate because he/she doesn’t know what is available and, even more important, doesn’t know what is required and how to get it.
Commercial jets vary widely in their ability to outclimb steep terrain. The American Airlines Boeing 757 accident in Cali, Colombia in 1995 was the penultimate reason we have EGPWS today. It is of interest to note that the crew pitched up very aggressively once they received warning from their old look-down-only GPWS equipment.
They almost made it! During investigation, the fact that the aircraft’s spoilers did not auto-retract with full throttle was a major bone of contention. The Air Line Pilots Association said this made the difference, but all other parties investigating the accident argued that it did not and said it was entirely the crew’s fault.
Surprised? That 757 crew actually pulled so hard they were in the shaker twice, but it was too late. A modern Enhanced GPWS or TAWS system will usually annunciate a “Caution Terrain” 60 seconds prior to a potential impact. In many situations, this is a comfortable time period in which to escape.
However, it can be shortened dramatically during a turn because EGPWS projects the current flight path and cannot anticipate the turn. In other words, a pilot flying (unknowingly) parallel to a high ridge could turn abruptly into the ridge and receive a very short warning from EGPWS.
Escaping this situation could quickly become very difficult – if not impossible. An Auto GCAS, on the other hand, would not let that happen because it would roll wings level and pull up hard as soon as the system saw that escape was about to become impossible.
If Auto GCAS were to be developed for large aircraft like transports, heavy bombers, or civilian airliners and bizjets, commanded recoveries would always be issued much earlier than they are in a fighter jet because of the lower available roll rates, G limits, and climb rates of such aircraft. Also, there is no need to press any attack to the last seconds in civilian aircraft.
Climb, or turn, or both?
Auto GCAS for civilian and heavy military aircraft might eventually include not only vertical pull ups but horizontal or oblique turns to maximize escape performance, such as presently provided for in the US Navy’s F-18 Terrain Awareness and Warning System (TAWS).
US Navy F-18s are equipped with TAWS, loosely analogous to civilian jet TAWS. Navy TAWS does compute optimal roll/turn directions (oblique recovery [ORT]), as well as pull ups (vertical recovery [VRT]). The Navy’s TAWS is simply a warning system with no automatic control inputs, but it does issue aural commands, such as “ROLL RIGHT/LEFT!” and/or “PULL UP!”
Simultaneously, the F-18 HUD shows a direction arrow. The biggest difference between Navy and civilian TAWS is that, like USAF Auto GCAS, it only issues the warning at the last possible moment, because so many missions require flight very close to and/or directly at terrain.
On the other hand, the priority for civilian TAWS is to provide early warning (60 seconds) with lots of time to recover.
Much room for improvement in civilian world
Remember that LOC-I is the leading cause of fatal accidents in civilian flying, followed by CFIT.
It has been argued that FBW can prevent LOC-I accidents with hard limits to aircraft attitude, angle of attack (AoA), and load factor. This, of course, does not address blundering into terrain. Airbus, with its family of A320, A330, A340, and A380 FBW aircraft, was the 1st manufacturer to explore that possibility, but it has not exactly panned out.
The Sochi accident is one example, and the Air France Flight 447 (A330) crash in the Atlantic is another. In fact, Sochi showed that an A320 can be flown into the sea without exceeding any control law limit and without any system failure. It’s also the case that the Airbus Flight Control Computers, ELACs and SECs, prohibit extreme flight attitudes, but only in normal law.
When various instrument and FCC failures drive the system into alternate law, all protections are lost – except load factor. This was the situation Air France Flight 447 was in, with no AoA protection, when the crew lost control. If further failures drive an Airbus airliner into direct law, absolutely all protections are lost.
One could ask what good are protections that disappear when things go wrong. In the case of the F-16 Auto GCAS, certain electronic failures will cause Auto GCAS to cease operating. Perhaps some level fail down in such complex systems is inevitable. Auto GCAS is not, of course, designed to prevent loss of control due to high AoA.
Such protections are already part of the F-16’s original flight control laws. However, Auto GCAS is now an operational reality, proving itself by saving lives and airframes in the US military, so civilian manufacturers and regulators need to sit up and take notice.
Don Witt was a USAF F-4 pilot and holds a DFC. He is a retired United 767 and A320 captain and former safety manager for a large corporate flight department. He is presently a Learjet instructor and has been a long-time aerobatic instructor.