"we failed to make the runway at Kennedy Space Center"

[Giles]

Article from AvWeb posted on July 21, 1997 regarding a real world, non scripted, failure of an ADI during a sim of the approach phase that caused the shuttle to CFIT one mile short of the runway.

Memo from NASA MOD (Mission Operations Division)

As most of you have already heard, we failed to make the runway at KSC
at the end of our STS- xx D/O Prep sim earlier this week. There were
several failures throughout the entire sim, including
the glided entry phase. However, by the time we reached the HAC
[Heading Alignment Cone: the big 300-degree turn that the shuttle
makes to do energy management; the crew "plays" the HAC to account for
high or low energy in the phase of the glide just before lining up on
final], we had configured for landing and the systems failures, etc.
were essentially behind us.


We at MCC [Mission Control Center] had basically stopped talking to
the crew, except for the HAC energy calls - things were relatively
quiet the way you like it on the HAC. At some point on the HAC (or,
earlier?) the SMS [Shuttle Mission Simulator] suffered a real hardware
failure of the CDR [Mission Commander's] ADI [Attitude-Direction
Indicator: the "8-ball" instrument installed on both the left and
right sides of the instrument panel, each containing three error
needles that are essentially flight director command bars for pitch,
roll and yaw] pitch error needle - it failed static [the pitch-axis
needle froze with no error flag]. As a result, about 20 seconds after
going CSS [Control Stick Steering: below about Mach 1.3, the mission
commander takes over from the autopilot and flies the vehicle
manually, because the shuttle's autopilot has no real
redundancy...remember it was designed in 1972] the CDR began a
continuous, gradual pitch down. About 20 seconds after that, guidance
commanded a HAC shrink [playing the cone: if you're low on energy, you
fly a smaller cone with a smaller circumference] as a result of the
altitude error low. At some point during this time, the crew called
the MCC and said that they thought they had some kind of guidance or
nav problem.


The MCC confirmed good nav, good guidance, and good sensors. (The MCC
called that the airspeed was much too high and that they should check
the airspeed; the MCC energy call at the 90 was 5 knots low.)


Within 30 seconds from the time that the CDR started the pitch down,
the situation was very serious and essentially out of hand. The MCC
knew that we were getting much too low and that we needed to pull up.
The crew knew that there was a problem but had not identified exactly
what it was, and thus had not started to correct it (still pitching
down). When the CDR realized that his ADI needle must be failed, he
handed over control to the PLT [Pilot: second-in-command to the CDR].
The PLT managed to get theta and EAS [equivalent airspeed] under
control, but the vehicle stalled (Alpha 20 [angle-of-attack, 20
degrees pitch-up], EAS 155) about one mile short of the runway while
the crew was trying to stretch it in.


What happened? We suffered a single, real-world hardware failure, and
we lost the vehicle (and crew?) in this sim. How is this possible,
with all of our tools on the ground and with the many instruments and
built-in crosschecks onboard?


The short answer is not an easy one to come to, but the consensus is
that we essentially had a breakdown in the cockpit - a cockpit
resource management problem. The crew feels like they were able to
determine that there was a problem, but that they did not identify the
problem as quickly as they could have, and thus their response and
corrective action was too little too late. We think also that perhaps
the MCC could have been a bit quicker and more crisp in our
recognition of the problem and in our response. Additionally, we think
that for these kinds of scenarios, the MCC should be emphatic and
forceful with our calls to the crew in order to accurately reflect the
criticality of the situation.


This is a tough case folks, but we need to be able to sustain a single
real-world hardware failure and make it to the runway. Indeed, in such
a case we depend on the crew to be prime for psyching-out instrument
failures onboard. Everyone believes that this crew and any assigned
trained crew can (and will be able to) determine when one of their
primary instruments has failed, and ultimately recover from any
adverse affects. We certainly depend on this for many cases where we
would not be able to react in time from the ground. In a lot of cases,
the crew is on the scene and the actions are super time critical. We
also depend on the MCC to sing out when we see things that we don't
understand or that look bad, whether it's energy or altitude on the
HAC, or some other problem.


I think the message here is for all of us to remember that most likely
in the real world we will not have the second or third IMU [inertial
measurement unit: gives the crew attitude data; there are three on
board] failure, or have to perform a single APU [Auxiliary Power Unit:
the hydrazine-powered turbine that powers the shuttle's hydraulics;
there are three hydraulic systems and three APUs on board] landing, or
suffer two main buss failures. Rather, we will probably see something
like this, something that perhaps we don't understand, or that we
haven't seen before in a sim. When we do, we must be ready to resort
to our discipline and training, and we must separate those things that
we know to be true from those things that we don't understand, and
then communicate that as accurately and as expeditiously as the
situation requires. Be alert, talk to each other, and be aggressive if
it becomes necessary.


Please take time to think about this case, and others like it. I think
we can learn from this, and that we should take some time to think
about other such scenarios that could "look and feel" like this one.


Additionally, we recorded the run on the GPO w/s [Guidance Procedures
Officer's workstation] in the MCC and I would like every GPO and GSO
[Guidance Systems Officer] to see this run at least once or twice on
our GPO displays. For those of you who have not seen it yet, please
make time to do so in the next week. I encourage you to take time to
do this, and to invite other folks to go with you.

(End of NASA Memo)

[Half Bottle]

That's an interesting article but a shocking headline to post today, when Endeavor really was landing at KSC. I did a double-take.

[Giles]

kind of the idea.

[Half Bottle]

kind of the idea.

Yes.

[flyboy2548m]

Interesting scenario. Some of the important factors missing from the article that would be helpful in forming a solid opinion on the matter are:

1. How much of an emphasis is placed during astronaut pilot training on instrument crosscheck not only on-side, but also side-to-side?

2. Is there any kind of a comparator system on-board that might issue a caution message when any redundant instruments disagree? We have such a comparator on the CRJ that, for instance, will issue an EFIS COMP MON caution when the CA and FO HSIs disagree by seven or more degrees.

3. What is the procedure with regards to PF/PNF duties, namely if the CDR is PF and PLT is PNF and the ADIs (or anything else) disagree, what (if any) are the required callouts by the PNF?

4. What is the primary instrument during re-entry? Is it the ASI, ADI, VSI or what? I ask because this is not exactly your average airplane, so their procedures are likely different than normal scan.

In the end this sounds like the very common stalled short of the tarmac crash, so one wonders what the outcome would have been had they concentrated on putting it down short of the field, but under control, rather than try to mush it in, like so many single-engine pilots tend to do.

[Digger]

In the end this sounds like the very common stalled short of the tarmac crash, so one wonders what the outcome would have been had they concentrated on putting it down short of the field, but under control, rather than try to mush it in, like so many single-engine pilots tend to do.

Images from Google Earth, showing a mile from the runway in either direction. Doesn't look very hospitable for an off-runway landing, does it?

[Gabriel]

In the end this sounds like the very common stalled short of the tarmac crash, so one wonders what the outcome would have been had they concentrated on putting it down short of the field, but under control, rather than try to mush it in, like so many single-engine pilots tend to do.

Images from Google Earth, showing a mile from the runway in either direction. Doesn't look very hospitable for an off-runway landing, does it?

Exactly. Tha't why Flyboy is right. Instead of stretching the glide to try to try to reach the runway and end stalling in an unsuitable terrain slightly short of it, concentrate on finding a more suitable place that they can clearly reach well SHORT of the runway, and with enough extra speed toput it down under control.

Imagine Sully trying to reach back to La Guardia and ending 1 mile short of the runway...

[Digger]

Exactly. Tha't why Flyboy is right. Instead of stretching the glide to try to try to reach the runway and end stalling in an unsuitable terrain slightly short of it, concentrate on finding a more suitable place that they can clearly reach well SHORT of the runway, and with enough extra speed toput it down under control.

Imagine Sully trying to reach back to La Guardia and ending 1 mile short of the runway...

I wasn't trying to say Flyboy was wrong. Just that even a controlled landing in that terrain would probably not end well. The runway itself looks to measure about 2.8 miles long and 400 feet wide. No telling how thick the concrete is, but I imagine it's pretty substantial. I doubt there's any alternative nearby that's even close to suitable. And that's probably consistent with the idea of the article--it's kind of important to make the runway...

On edit: Unless of course you're suggesting ditching in a controlled manner. There is plenty of water nearby.

Also on edit: When posting that earlier, I'd been thinking about the C-5 crash at Dover. At that time I'd wondered whether the results would have been better had they landed under control in the same flat field that they stalled into. The Florida terrain seems less hospitable.

[Giles]

4. What is the primary instrument during re-entry? Is it the ASI, ADI, VSI or what? I ask because this is not exactly your average airplane, so their procedures are likely different than normal scan.

After emerging from the blackout period they use TACANs, then when approaching final they use something called the Microwave Scanning Beam Landing System and then when they roll out on final the cues they use are PAPI's and a ball bar system on the inner glide slope. The ball bar system is used during the final flare to obtain a 1.5 degree glideslope. There are two aim points - nominal and close-in. Close-in is used for high headwinds.

some vids;

HUD - no internal coms (second one transitions to external view upon touchdown)
http://www.youtube.com/watch?v=py7E9fIase4
http://www.youtube.com/watch?v=lhP0SvDWyHg

HUD - with internal coms. Landing at Edwards
http://www.youtube.com/watch?v=XxGeo0ec-F4

There is a better hud video with internal coms of an evening / night landing into KSC. Cant seem to find it right now.

CDR is always PF, however the PLT does get 2 - 3 seconds stick time around the HAC.

[PurduePilot]

On edit: Unless of course you're suggesting ditching in a controlled manner. There is plenty of water nearby.

Or they could point it out to sea and bail out, if they realize early enough that they don't have enough energy to make the runway...

[Giles]

Or they could point it out to sea and bail out, if they realize early enough that they don't have enough energy to make the runway...

wouldnt be enough time.

[flyboy2548m]

4. What is the primary instrument during re-entry? Is it the ASI, ADI, VSI or what? I ask because this is not exactly your average airplane, so their procedures are likely different than normal scan.

After emerging from the blackout period they use TACANs, then when approaching final they use something called the Microwave Scanning Beam Landing System and then when they roll out on final the cues they use are PAPI's and a ball bar system on the inner glide slope. The ball bar system is used during the final flare to obtain a 1.5 degree glideslope. There are two aim points - nominal and close-in. Close-in is used for high headwinds.

That's not what I'm asking, Giles. What you're describing is what they use for navigation, I'm more interested in what they use for primary aviating, meaning are they trained to pitch for a certain airspeed, VS, or both? Or neither? Are they to just establish a certain pitch angle and see what that does or what?

[Giles]

FB- I took your questions and re-posted them onto a forum dedicated to all things Shuttle that have members who are NASA employees/ contractors.

Is there any kind of a comparator system on-board that might issue a caution message when any redundant instruments disagree?

No.

What is the primary instrument during re-entry? Is it the ASI, ADI, VSI or what? I ask because this is not exactly your average airplane, so their procedures are likely different than normal scan.

HUD (during MM 305, approach and landing phase only) and following MDU displays: entry PFD (combined ADI/HSI), VERT SIT, and HORIZ SIT.

In the end this sounds like the very common stalled short of the tarmac crash, so one wonders what the outcome would have been had they concentrated on putting it down short of the field, but under control, rather than try to mush it in, like so many single-engine pilots tend to do.

Probably would have worked at Edwards. At KSC, "Short of the field" means "Sleep with the gators."

FYI, this particular failure mode was eliminated by the MEDS upgrade, which replaced the mechanical ADIs/HSIs with multifunction display units (MDUs).

[Half Bottle]

I always like watching those HUD shuttle landing videos. They are endlessly facinating. For starters, not many aircraft line up with the runway while still at 10,000 feet. Then, after it gets below 2,000-3,000 feet, you would swear they are aiming at digging the shuttle into the ground about a half mile short of the runway. The visual picture just looks so unfamiliar. I can only imagine it's even stranger for people who are actually used to looking at 3-degree glideslopes for a living.

[OldSowBreath]

I would expect the ghost of Don Repo to be there to help them make it in.

[flyboy2548m]

FB- I took your questions and re-posted them onto a forum dedicated to all things Shuttle that have members who are NASA employees/ contractors.


-snip-....some stuff from a NASA forum...-snip

Thanks for that, Giles, but still not quite what I'm looking for. What I was interested in was, after missing the ADI disagreement (admittedly, a pretty big SNAFU), what would/should their next cue be that something is going downhill (pun fully intended). Are they trained to expected a certain VS and/or airspeed at a given pitch angle? If yes, then their cue should have been that said VS/airspeed wouldn't have been jiving with the pitch angle.

[Giles]

Thanks for that, Giles, but still not quite what I'm looking for. What I was interested in was, after missing the ADI disagreement (admittedly, a pretty big SNAFU), what would/should their next cue be that something is going downhill (pun fully intended). Are they trained to expected a certain VS and/or airspeed at a given pitch angle? If yes, then their cue should have been that said VS/airspeed wouldn't have been jiving with the pitch angle.

alright... how about this;

A little more info about flying the space shuttle during TAEM:

To really understand the case I would want to know what failures were simulated prior to this (even though the memo says they were behind them at this point) because this would give me insight into what the crew’s thought processes might have been and what they may or may not have been predisposed to expect.

Another note: a HAC of 300 degrees is considered to be large and has some unique features such as the possibility of large bank angles at HAC intercept. However, the mention of this in the article seems to be the reporter’s input and not necessarily what was flown that day.

Crew’s are trained to “Fly the needles” during TAEM (terminal area energy management) which is the phase of flight we are talking about here. TAEM officially starts at MACH 2.5 & 82,000 feet.

In fact, being the smart asses we instructors were/are, we would literally show a slide at the beginning of the Ascan (astronaut candidate) Training Class for TAEM that looked like this:


HOW TO FLY TAEM – THE EASY WAY

I. Fly the needles
a. Fly the needles
i. Fly the needles
ii. Fly the needles
1. Fly the needles
2. Fly the needles
II. Fly the needles
a. Fly the needles
b. Fly the needles
III. Crosscheck other instruments


Staying with THE NEEDLES is going to ensure you are doing what Guidance & Nav want you to do in an area of flight where energy management is crucial. Of course this assumes you can believe the needles – problems with Guidance & Nav, failed AAs (accelerometer assemblies), and no Air Data (which comes from the pitot probes which are deployed below MACH 5) are examples of situations where you don’t want to trust the needles. Failure of the ADI/ADI needles certainly falls into this category as well – with the key issue here being how to recognize the failure quickly. My answer is that the cross check & good CRM should get you there.

A good crosscheck during this time would include a combination of both the ADI & HUD as well as Airspeed, H-dot (which is our word for V/S), Alpha, G, Vertical Situation Display, the Horizontal Sit Display (which would give you an indication of ground track & HAC shrink), and the SPI (surface position indicator). Obviously much of this info is on the HUD but you still want to come inside and scan the instruments.

You have standard callouts coming from the PLT (pnf) and MS2 along with Energy calls from MCC as you approach the HAC and Altitude Error calls as you go around the HAC. An example Energy Call would be “Endeavour, Houston you are ON at the 90”. This tells the crew they are within 1000 feet of the expected altitude with 90 degrees of turn remaining until they roll out on final. Other options for this call would be “Slightly High/Low” which is defined as an error of 1,000 to 2000 feet, and “High/Low” which is defined as an error of more than 2000 feet. All of these crew and MCC callouts help provide the CDR with SA (situational awareness) – which is all part of the CRM (crew resource management) that they discussed in that memo.

As the runway comes into view and the orbiter rolls out on final (generally at ~ 10 to 12,000 feet at ~7 miles from the end of the runway) the CDR & PLT will rely heavily on visual cues from the PAPIs and Ball Bar as well as the overall site picture of the runway.

All of this is practiced extensively in the SMS and STA (shuttle training aircraft) with Commanders and Pilots being exposed to all sorts of data and instrument failures that could get you killed if not properly assessed.

Another point: Don’t forget that all the “front seaters” are very experienced pilots and with one exception all have been Test Pilots. They already know how to crosscheck.

Mark Kirkman

[The Notorious STG]

Great article, Giles. Fascinating read.