GPS and Aviation Safety

October 1, 2001  - By
Image: GPS World


U.S. federal agencies, aircraft and avionics manufacturers, airlines, and research centers are brainstorming ways to prevent a repeat of the tragic events of September 11, in which highjacked aircraft were used as missiles. Under these new circumstances, options previously dismissed out of hand suddenly are attracting renewed attention.

One recurring proposal is to automate the landing of hijacked aircraft. In this scenario, a “dead-man switch” would allow the pilot to turn over navigational control to an on-board GPS-based autolanding system. The system would broadcast a mayday to air traffic control (ATC), search an on-board database for the nearest suitable airport, alert that airport, receive landing authorization, and land the aircraft there. During these operations, no one on board would be able to regain control of the aircraft. The pilot would be like an employee who, when confronted by a robber, does not have the combination to the company’s safe. No amount of violence on board would allow hijackers to use an aircraft as a missile against a target.

Technologically feasible. The strong consensus of airline, industry, and academic experts interviewed for this article is that the above scenario is technologically feasible. In fact, the autolanding technique has been amply demonstrated and at least one major avionics manufacturer is actively working on producing an emergency landing system.

The Federal Aviation Administration (FAA) is working on two GPS-based systems that could enable this sort of antihijacking capability: the Wide Area Augmentation System (WAAS) that will enable aircraft to reach the so-called Category 1 decision point in an approach to an airport, and the Local Area Augmentation System (LAAS) that would enable aircraft to reach the ground in zero visibility, known as a Category 3B landing. The agency plans for many airports to be equipped with LAAS transmitters eventually and will require WAAS/LAAS systems on commercial airliners.

Although both systems still await final certification, testing, and installation at U.S. airports, commercial airliners and military aircraft have already demonstrated fully automatic instrument approach and landing under Category 3B conditions.


Although technologically feasible, operational considerations pose obstacles for implementing an automated emergency landing system. The following scenarios address some of these issues as well as technical features of such a system:

  1. A “multiple key” arrangement could restore manual control with codes from the pilot, the co-pilot, and the ground-based ATC operators. Ground control would con- tribute its code only when absolute sure that the aircraft could not be used to attack a population center.
  2. To protect it from being disabled, the system would require a hardened compartment not accessible from the cabin and an autonomous power source not controlled from the cockpit circuit breaker panel.
  3. Prior to landing, the onboard system would notify ATC, which, in turn, would alert and re-route other aircraft as needed.
  4. If the highjackers jammed the GPS signal, the system would put the plane in a holding pattern until it reacquired a clear signal. By refusing to turn off the jammer, terrorists could force the aircraft to run out of fuel and crash – but could not guide it to a target.
  5. According to an industry source, the system should first put the aircraft in a holding pattern in any case, to give a chase plane time to reach it and visually monitor it. In the very unlikely case that the highjackers were able to regain control of the aircraft and aim it toward a target, the chase plane could challenge the aircraft, order it to land, and shoot it down if it did not comply.
  6. The airport database would need to include data on possible flight path obstructions – terrain or tall buildings – so that the system could select a clear approach path. Avionics systems coming onto the market that are designed to prevent controlled flight into terrain essentially have this capability now.
  7. The autolanding system would require permission from the ground to land on a particular runway. If permission were denied for any reason, the system would search its database for the next-best runway.

Cockpit philosophy. An airline pilot who is now an aide for the operations chief of a major airline reacted very negatively to the idea of an emergency autolanding system that could not be disengaged by the pilot. Any system that restricts the crew’s options, he said, clashes with a key tenet of “cockpit philosophy”: to keep the pilot in charge and never relinquish control of an aircraft completely to automation.

An emergency autoland system also conflicts with a basic principle of aeronautical engineering – namely, that an aircraft should have multiple, redundant ways to control it.

However, in extreme emergencies, the alternative may warrant overriding such concerns, according to Bradford Parkinson, a professor emeritus at Stanford University’s School of Engineering who first proposed fully automated cargo planes years ago. He points out that, although an antihijacking system used routinely would have to be extremely reliable, when the alternative is a 100 percent probability of death for all aboard, “Boy, that sure changes the equation in a flash.”

Further reading: “Soft Landings: Navy Proves Hands-Off Touchdown,” by Matteo Luccio and Glenn Colby, GPS World, August 2001.

This article is tagged with , , and posted in Transportation