Collision Course
The next time two planes collide in midair, it could be because the FAA shot down a privately developed collision avoidance system.
On March 13, 1982, a single-engine Yankee slammed into the tail section of an Air Force jet tanker in the air 30 miles west of Phoenix, Arizona. Both planes crashed in flames, killing all six of the people on board. It was the fifth midair collision of 1982.
And it was 23 years since a pair of midair collisions between a military aircraft and a civilian plane had led to the creation of the Federal Aviation Administration. In April 1958 an Air Force fighter smashed into a United Airlines DC-7 over Nevada, and a month later an Air National Guard jet trainer and a Capitol Airlines Viscount collided over Maryland, strengthening arguments for a single air traffic control (ATC) system rather than the split civil-military regime that had prevailed until that time. So in 1958 the FAA came into being.
Yet in the ensuing 23 years, the frequency of midair collisions has steadily increased—from 16 in 1958, 13 in 1959, to an average of 30 per year in the 1970s. And, according to a 29-month study by the National Aeronautics and Space Administration, there are more than 1,100 near-collisions each year—nearly two-thirds of them near airports. As the number of active aircraft doubles over the next nine years (the FAA's own projection), the threat of midair collisions will grow.
There is even worse news, however: a large percentage of those collisions could be prevented. In fact, an effective, inexpensive electronic "black box" that warns pilots when they are on a collision course has been available since 1976. According to former FAA official James Pope, it would have prevented the fiery collision between a Cessna 172 and a PSA 727 over San Diego, which killed 144 people on September 25, 1978. But the FAA, for bureaucratic and political reasons, has quashed this privately developed system. Instead, it has been and still is developing its own Threat-Alert Collision Avoidance System (TCAS) that stands to cost taxpayers and aviation users nearly $3 billion over the next decade. By contrast, the Honeywell Airborne Collision Avoidance System (ACAS) could have been in place by now—for about $500 million.
Is the FAA's hugely more expensive TCAS at least more effective than the system it squelched? Unfortunately, it is not. The FAA's system has so many flaws, in fact, that it calls into question the system's value at any price.
TCAS is designed to make use of an electronic identification device called a "transponder," already carried by three-fourths of all planes. The purpose of a transponder is to identify—uniquely—each particular plane on an air traffic controller's radar scope. Instead of showing up as just a blip, a transponder-equipped plane shows up as a blip with an ID number beside it. Ground stations periodically send out an interrogation signal, and the plane's transponder radios back its ID number. Military planes, airliners, and corporate jets have more-sophisticated transponders that also report the planes' altitude when interrogated.
The FAA's TCAS is a black box that would be added to planes. A TCAS-equipped plane would be able to detect other planes by interrogating their transponders. Under this system, however, 25 percent of all airplanes—those without transponders (see table above)—would be invisible to TCAS. And in the case of another 43 percent—those whose transponders don't report altitude—only their presence somewhere in the vicinity could be detected by TCAS. This is the first problem with the FAA's system.
There are also unresolved problems with TCAS becoming overloaded in areas with heavy air traffic, precisely the places where collision avoidance is most needed. And the sobering fact is, as reported by NASA, that 65 percent of midair near-collisions occur around airports. TCAS will also require an air-ground data link before it is fully operational, but this system, according to FAA Administrator J. Lynn Helms, won't be in place until the "mid- to late 1980s."
There are two versions of the FAA's system: TCAS-I, costing $2,500, for small airplanes; and TCAS-II, costing $50,000, for air carriers and corporate and military craft. A $3,500 "deluxe" version of TCAS-I is also planned.
TCAS-I isn't really a collision avoidance system. It is a proximity warning indicator that is sensitive only to transponder-equipped airplanes. It advises a pilot when another such airplane is in his vicinity but doesn't tell him where it is (unless the other plane is equipped with the costly TCAS-II). Nor can it give instructions for an evasive maneuver. So a pilot flying in the clouds, for example, can be warned that a collision is possible but have no means of avoiding it. If a threat airplane doesn't have an altitude-encoding transponder, an alarm will be sounded even if it is thousands of feet above or below the TCAS-I plane. TCAS-I also requires that a station interrogate non-TCAS airplanes, and many areas are out of range of ground stations. The capabilities of the versions of TCAS (as well as the privately developed ACAS) are laid out in the table on page 39.
Like its less-sophisticated version, TCAS-II requires that threat airplanes have transponders to be visible. If a threat airplane does not have an altitude encoder, TCAS-II gives range and bearing information only. So again, airplanes passing thousands of feet above or below would indicate a collision threat. If the threat airplane does have an altitude encoder, TCAS-II indicates range, bearing, and altitude and provides an uncoordinated evasive maneuver. Only if the threat airplane also has TCAS-II are evasive maneuvers of the two planes coordinated.
TCAS has other serious weaknesses. Most small planes with transponders have one, bottom-mounted, antenna, placed as it is so that ground interrogations won't be shielded by the airframe. FAA contractor Lincoln Laboratories estimates that in 4 percent of encounters, the transponder antennas on small planes would be shielded by the airframe from TCAS interrogating from above. Probably the simplest and cheapest way to add a top antenna would be to install another transponder—at a cost of $800–$1,500 per airplane.
TCAS is but the latest in a series of FAA collision avoidance proposals, the most recent previous to TCAS being the Beacon Collision Avoidance System (BCAS). Like TCAS, BCAS was transponder-based, but too many transponder interrogations were causing system overloads in heavy air traffic. Frequent false alarms resulted, and there was a danger that the overloads could disable the air traffic control (ATC) system for periods of time.
Apparently even the FAA realized, though, that a collision avoidance system that doesn't operate well in areas of heavy traffic isn't really a collision avoidance system. Accordingly, one of the changes proposed for TCAS is something called "sector interrogation." Instead of risking information overload by looking everywhere at once, TCAS-II is to search the sky by interrogating one sector (for example, 45 degrees) at a time, in rapid succession.
There are at present about 600 interrogating ground stations in the United States, and the system is close to saturation in some areas. When TCAS is operational, there will be additional thousands of prospective interrogators, TCAS-II has not been flight-tested, nor will it be tested in an environment with hundreds of other TCAS-equipped interrogators. Until TCAS has been fully flight-tested, the question of overload and false alarm remains an open one.
Due to TCAS-II's high price tag, most private planes will never be equipped with it. So we are faced with this odd scenario: 700,000-pound 747s, which aren't very maneuverable, making TCAS-generated evasive maneuvers to avoid colliding with small planes, which are highly maneuverable. One could as well envision a heavily loaded supertanker dodging about water skiers and fishing boats as it made its way through a crowded harbor.
Finally, TCAS, which is an attempt to rectify previous inadequacies in FAA-designed collision avoidance systems, is still in the design stage. If, contrary to previous performance, the FAA is able to maintain its timetable for TCAS, the first production models still won't be in cockpits until 1985. Production of the privately developed ACAS, which was already tested, could have started in 1976.
PROTECTING THE FAA
The FAA has laid a great deal of emphasis on requiring that any collision avoidance system be "compatible" with the FAA-run air traffic control system. What the agency means by this is that the air traffic controller has to be involved in everything. If it had its druthers, the FAA would place all decisionmaking on the ground, despite the fact that the semiconductor revolution makes possible miniature airborne computers of amazing complexity. As a compromise, the agency has insisted that any collision avoidance system include a data link between air and ground to keep the air traffic controller in the decisionmaking loop. At the same time, the FAA recognized the need to address the problem of overloading and false alarms. Experienced government watchers will have guessed that the solution of choice was to spend more money. In an effort both to solve false-alarm problems in high density areas and to provide an air-ground data link, the FAA planned a system called Discrete Address Beacon System/Automatic Traffic Advisory and Resolution Service (DABS/ATARS).
DABS enables automated messages to be sent via transponder to individual airplanes by virtue of their "discrete addresses" (ID numbers). ATARS is a ground-based computer system that determines whether an airplane represents a collision threat to another plane. If so, it sends an automated message via DABS, commanding an evasive maneuver to resolve the conflict, and informs the human controller of the problem and its solution. According to Rep. Robert K. Dornan (R–Calif.), who has introduced legislation prodding the FAA to end 20 years of waffling on the collision avoidance issue, the FAA had planned to spend between $500 million and $1.5 billion to implement DABS/ATARS.
If TCAS false-alarm problems are solved by sector interrogation, however, the conflict-resolution portion of ATARS will no longer be necessary. And in fact, Dr. Clyde Miller, chief of Separation Systems for the FAA, says that in December 1981 the FAA tabled plans for resolution service, and ATARS has been transformed into Automated Traffic Advisory Service (ATAS). DABS, in turn, has been redesignated Mode S. That same month, FAA Administrator Helms announced plans to construct 137 Mode S/ATAS sites in the United States, with completion in "mid- to late 1980s." Mode S will serve as the air-ground data link between TCAS-equipped airplanes and controllers. What the "advisory service" will do is unclear. It is certainly possible that ATAS will serve to keep ATARS alive, perhaps for revival to solve intractable TCAS overload problems.
Although cheaper than ATARS, ATAS is still far from inexpensive. With 137 sites costing an estimated $1.5 million each, the total bill will be $205.5 million—and the FAA could seek to build additional sites. Previous plans called for building nearly 300 ATARS sites.
And construction costs are only the beginning. Systems require maintenance and more controllers. More controllers require more supervisors, and so on. (It's especially ironic that the FAA remains committed to this ground-based system in the wake of the controllers' strike and the resulting shortage of trained controllers.)
Earlier versions of TCAS were criticized for relying too heavily on ground installations for collision protection. According to Helms, TCAS operates "without dependence on any ground equipment." This is only partially true. Only TCAS-II can operate independently of ground stations, and only about 12 percent of all airplanes (military, airlines, and large corporate airplanes) can be expected to have TCAS-II. TCAS-I–equipped airplanes require that a ground station interrogate non-TCAS airplanes. And if, as Helms says, TCAS is not dependent on ground equipment, why construct a series of ground stations to provide a data link between TCAS airplanes and the ground?
WHAT THE FAA TURNED DOWN
Honeywell's ACAS has none of TCAS's specific weaknesses. Its apparent drawback is that, despite its much lower cost, it would have to be installed in all airplanes that are to be protected, whereas TCAS provides at least minimal warning of non-TCAS airplanes that have a transponder (see table on p. 39).
ACAS would send and receive signals to and from other ACAS-equipped airplanes in the vicinity. A built-in computer analyzes each signal in terms of altitude, range, and rate of closure. If a potential collision is determined, the system coordinates evasive climb/descent maneuvers that are commanded on an instrument in each airplane. Internal FAA documents acknowledge that no additional FAA ground systems would be required for ACAS to function.
The system was flight-tested and evaluated by the Naval Air Development Center and analyzed by the Mitre Corporation, an FAA think tank contractor, between 1972 and 1975 at a cost of $11 million. A former FAA collision avoidance expert, Thomas S. Amlie, summed up the field tests this way in testimony before a congressional subcommittee on April 3, 1981: "The key point to be made is that the Honeywell system worked very well." Calculations by the Mitre Corporation showed that ACAS would be far more effective than the FAA's BCAS (the earlier version of its present system). And the FAA estimated that ACAS could be fully operational by 1983–84. Yet the FAA scrapped it for TCAS/DABS/ATARS. Why?
James Pope, a former high-level (GS-15) FAA employee who delights in a well-turned phrase, thinks he has the answer. He calls it NIH—Not Invented Here. It is Pope's contention that the FAA has deliberately stifled the adoption of ACAS for two reasons: so that DABS/ATARS might be preserved, and so that an FAA-developed, not privately developed, collision avoidance system would be adopted.
There can be no doubt that the FAA was aware of ACAS's superiority. On December 16, 1975, an FAA Executive Committee held a meeting to formulate policy preparatory to reporting on collision avoidance to Congress. The "FOR OFFICIAL USE ONLY" notes from this meeting make clear the bias of James Dow, then administrator of the FAA: "He [Dow] feels FAA must be prepared to give a full accounting to Senator Cannon, who instigated the report, and that a large part of the discussion will deal with the elimination of ACAS, in view of the fact that three ACAS systems have been tested and one of them [Honeywell's ACAS] meets all the objectives of the agency."
In 1976 the Mitre Corporation formally reported to the FAA on a study that compared ACAS head-to-head with BCAS and DABS/ATARS. In the study, Mitre evaluated 494 actual midair collisions to determine the potential of each system. The existing ATC system itself could have prevented 118 of the midairs. Adding BCAS would have increased this total to 120 (a net gain of only 2); adding DABS/ATARS would have prevented 190 (a gain of 72). Adding ACAS to the ATC system, however, would have prevented 228 midairs, a gain of 110 avoided collisions compared to 2 for BCAS alone.
Another Mitre report on September 30, 1975, concluded that, for purposes of collision avoidance, the FAA's ATARS "would not be needed in an ACAS environment." And this, according to Pope, is the crux of the issue. He attended many of the high-level policy meetings during this period and says that the FAA feared that ACAS, if introduced, would cut the ground from under DABS/ATARS. The FAA could see hundreds of employees and a billions-of-dollars project slipping through its fingers. Disgusted with the situation, Pope started to take the facts public.
DRUMMING UP A REASON
In answering critics such as Pope, the FAA relies on three main criticisms of ACAS: it gives an unacceptable number of false alarms; all airplanes must be equipped for the system to be effective; and it is "incompatible" with the present ATC system. A careful look at these FAA objections gives credence to Pope's assertion that the FAA scuttled ACAS so that DABS/ATARS might be preserved.
False Alarms. ACAS did give some false alarms during prototype testing—about one per hour. Airline cockpits are equipped to give 20 or more aural or visual warnings, and scarcely a flight is conducted without at least one spurious warning. The purpose of warnings is to call the pilot's attention, not to certify that a problem indeed exists.
Air traffic controllers frequently notify pilots of uncontrolled traffic for which they have no altitude information. The majority of this traffic is never seen, and the controllers' advisories are in every sense "false alarms," yet there is no tendency for pilots to ignore them. The consequences of a midair collision are just too great to do so.
In the mid-1970s a Ground Proximity Warning System (GPWS) was introduced. Within eight months of the date GPWS hardware became available, all air carriers were equipped with it. The GPWS, too, gives a fair number of false alarms, yet the number of incidents involving air carriers colliding with the ground has been dramatically reduced since their introduction. The fact that they give some false alarms has not detracted from their usefulness.
Even so, it is desirable that any warning system give only a minimum of false alarms so that the pilot's attention is not distracted from more important tasks. Honeywell made some changes in 1975 that would reduce the number of ACAS false alarms to one every 1,000 hours. That's one false alarm for every four months of normal airline operation.
When ACAS gives a false alarm, only one or two airplanes are affected—the airplane or airplanes receiving the false alarm. Since TCAS alarms are coordinated with ATC via the data link, one false alarm could affect all other airplanes in the area.
The FAA claims to have solved the TCAS false alarm problem, but demonstration of its solution is still in the future. In the first 150 hours of TCAS testing on board a Piedmont Airlines 727 this January, two out of four threat warnings were false alarms. Compared to TCAS, at least as demonstrated so far, ACAS is virtually free of false alarms.
Equipping all airplanes. For two airplanes to be warned of an impending collision, each must be equipped with something that can communicate with the other. For ACAS to operate, each airplane must have an ACAS computer on board. How many airplanes would or would not adopt ACAS is a legitimate question.
There are several ways the problem could be solved. First, all airlines and the military are committed to installing whatever collision avoidance system is designated as the national standard, so within a year or so after hardware became available, all air carriers and military craft could be protected from one another. Corporate airplanes could be expected to follow suit for liability and insurance reasons.
It is easy to understand that many owners of small airplanes, especially those who fly only infrequently or in isolated areas, may be reluctant to invest $1,200 for ACAS. The solution is simple. The FAA presently reserves great chunks of airspace and most major airports for specially instrumented aircraft. For example, aircraft flying above 18,000 feet are required to have a transponder and distance measuring equipment. A transponder is also required to enter the vicinity of most major airports. In a similar fashion, the FAA could prohibit planes not having ACAS from routes and airports used by ACAS-equipped airplanes. Those flying in areas where ACAS was not required would be accepting the risk of collision voluntarily.
The need to impose operational restrictions on non-ACAS planes to make the system work effectively is probably the most important political reason for the FAA's opposition. Private fliers, through their organization—the Aircraft Owners and Pilots Association (AOPA)—are intensely opposed to any restrictions on their freedom to operate. In the past they have lobbied against many equipment requirements (for example, transponders) and restrictions of access. Since the FAA is highly sensitive to political pressures from Congress, and since AOPA has vocal members in every congressional district, the FAA is loathe to accept any system that requires further restrictions on the general aviation (private flier) community—even when that system is inherently simpler and costs only one-fifth as much.
That cost comparison is made in the table on page 40. The reasonable assumption is made that every airplane currently equipped with a transponder becomes equipped with collision avoidance hardware. In the case of TCAS, we assume that general aviation planes with altitude-encoding transponders choose the deluxe TCAS-I, while those with non-altitude-encoding transponders choose the basic TCAS-I. For ACAS, all transponder-equipped general aviation planes are assumed to install the low-performance model of ACAS. Using FAA estimates for the price of each type of unit, we can see that nationwide implementation of TCAS, together with the required ATAS ground stations and equipment, would cost $2.8 billion. Implementing ACAS on the same scale would cost only $530 million.
A good collision avoidance system should also protect US airliners while flying in foreign countries. There are few light planes flown in and out of international airports overseas. The problem of protection in foreign countries, then, is largely a matter of their airlines being equipped.
For several reasons, foreign airlines could be expected to install ACAS if it became the national standard. Most international routes for most airlines eventually come to the United States. Since ACAS would be required in all major US airports, the foreign airlines would have to equip their international planes with ACAS. There would also be insurance and liability pressures on foreign countries' domestic routes. Insurers will not sell liability insurance when liability has been predetermined. In a collision between an ACAS-equipped airplane and a non-ACAS airplane, the latter would almost certainly be found liable. No company could afford to accept such a risk.
Aircraft manufacturers design a "standard model" of a particular plane. The manufacturer charges to remove equipment that is part of the standard package. According to sources at Boeing, the net cost of an airplane having equipment deleted can in many cases be more than the cost of the standard airplane.
ACAS could have been installed in new airplanes starting in 1976, and it is highly unlikely that any customer would pay to have ACAS removed. Since the useful life of a large airplane is 12–15 years, virtually every large airplane in the free world would have been equipped with ACAS by 1990 if the FAA had adopted it.
Incompatibility with ATC. ACAS is completely independent of ATC. Commands are generated on board, and there is no need for a data link with the ground. The FAA finds this independence unacceptable because pilots may make ACAS-directed maneuvers contrary to instructions given by air traffic controllers.
The fact that ACAS is completely independent of ATC is actually a virtue. If a potential midair collision situation has developed, it is because ATC has failed. Because of its independence, ACAS can function despite controller error or inattention and despite power failure, computer failure, or communication failure.
ACAS gives a 40-second warning of impending collision and gives an evasion command at 20 seconds if the pilots haven't resolved the situation. Twenty seconds allows enough time for radio communication between pilot and controller, so that evasive maneuvers can still be coordinated with ATC under most conditions.
At present, collisions are avoided in two ways. ATC provides separation between airplanes flying under its direct control (called instrument flight rules—IFR). Pilots who are not under ATC control (visual flight rules—VFR) are expected to avoid other airplanes by "seeing and being seen." IFR airplanes are responsible for avoiding VFR airplanes. If an IFR airplane sees another airplane, either VFR or IFR, that is a collision threat, the pilot will make an evasive maneuver whether or not it is coordinated with ATC. There has never been a midair collision caused by one airplane deviating from ATC instructions to avoid another airplane. The likelihood of such a problem using ACAS is remote.
A BUREAUCRACY AT STAKE
ACAS works well; TCAS doesn't. ACAS is inexpensive and obviates the need for TCAS/Mode S/ATAS, which will cost billions. If it weren't for the whistle blowing of James Pope, this controversy would never have come to the public. The FAA would have quietly lined up its political ducks, used its regulatory powers to quash any private efforts toward collision avoidance, and added whole new divisions to its empire unimpeded.
The FAA power structure is furious at Pope for going public with the facts. Although he has an outstanding record of service to the aviation community spanning 17 years both in and out of the FAA, he became known within the FAA for his tendency to support individuals in conflict with the agency. This, and his outspoken criticism of several FAA programs, including collision avoidance, resulted in his job being eliminated in 1978.
Pope was reassigned to a position with no duties that was created expressly for him in Seattle—presumably as far from Washington, D.C., as the FAA could get him. While there, the FAA made life as difficult for him as possible, hoping to make him quit or to catch him in some error that could give them justification for firing him.
Pope lodged complaints with the FAA and the Department of Transportation regarding his treatment. In October 1981 the FAA, in a case of the fox guarding the hen house, announced that it had investigated Pope's allegations and was dismissing them for lack of evidence.
Rep. Patricia Schroeder (D–Colo.), chairwoman of the House Subcommittee on Civil Service, asked Secretary of Transportation Drew Lewis to monitor FAA Administrator Helms's treatment of Pope. Schroeder claims that "Helms has been quoted by others as saying that he will not tolerate whistle-blowers in his agency."
On March 31 and April 3, 1981, Pope testified during House hearings prompted by his charges that FAA is pushing an inferior and costly system. So far Congress has taken no action to stop the implementation of TCAS. Federal employees are politically powerful, and there is no organized opposition. Others with a political interest either are not going to have to pay for the FAA's system (airline pilots), are seeking to avoid paying for collision avoidance (small airplane owners and operators), or have made previous collision avoidance initiatives that have been stifled by the FAA (airlines and the avionics industry).
On December 18, 1981, Pope was fired by the FAA for a string of alleged misdeeds including insubordination and dereliction of duty. Not mentioned in the termination notice were the years Pope spent making the FAA more responsive to aviation users and the many awards he has received for outstanding service to the aviation community. Nor was there mention of Pope's campaign to keep the FAA from wasting billions of dollars on ineffective collision avoidance systems.
Meanwhile, the FAA's self-serving grip on aviation becomes firmer, taxpayers and airspace users foot the bill, and millions of lives are needlessly at risk.
John Doherty is a commercial pilot with an 18-year background in both military and civilian aviation.