problems as result of typo
By Simon Hradecky, created Tuesday, Mar 10th 2015 18:10Z, last updated Wednesday, Sep 7th 2016 15:33Z
An Air Asia X Airbus A330-300, registration 9M-XXM performing flight D7-223 from Sydney,NS (Australia) to Kuala Lumpur (Malaysia), was climbing out of Sydney when the crew decided to abort the flight due to a problem with the navigation display. Considering the weather conditions the crew decided not to return to Sydney but divert to Melbourne,VI (Australia), climbed the aircraft to FL310 and landed in Melbourne about 85 minutes after departure.
Following repairs the aircraft departed Melbourne after about 4 hours on the ground and reached Kuala Lumpur with a delay of 5 hours.
Malaysia's Civil Aviation Authority reported the aircraft suffered a problem with the navigation display.
Air Services Australia reported the aircraft suffered a technical problems and diverted to Melbourne because weather conditions were better.
The airline confirmed the aircraft diverted as a precaution due to a technical problem.
On Sep 7th 2016 the ATSB released their final report concluding the probable causes of the occurrence rated an incident were:
Contributing factors
- When manually entering the coordinates of the aircraft’s position using a data entry technique that was not recommended by the aircraft manufacturer, the longitude was incorrectly entered as 01519.8 east (15° 19.8’ east) instead of 15109.8 east (151° 9.8’ east). This resulted in a positional error in excess of 11,000 km, which adversely affected the aircraft’s navigation systems and some alerting systems.
- The aircraft was not fitted with an upgraded flight management system that would have negated the positional data entry error via either automated initialisation of the air data and inertial reference system, or the automatic correction of manual errors.
- The aircraft’s navigation system probably detected the data entry error and displayed an associated message. However, due to the combination of that message being similar to one displayed during routine alignment of the inertial reference system, and the captain’s understanding that the same alignment-related message may be displayed twice, the error was not identified.
- The first officer did not notice the error in the initialisation coordinates when crosschecking the flight management and guidance system entries after completing the pre-flight external inspection of the aircraft.
- It is likely that data integrity checks detailed in the pre-flight and taxi checklists were either omitted or conducted with the navigation display selected to an inappropriate mode and/or range that concealed the aircraft’s positional error.
- The instrument panels cockpit check was not carried out in accordance with the flight crew operations manual and resulted in the crew not detecting the offset error in the displayed heading.
- Due to the large data entry error remaining undetected, the navigation system did not initialise relative to the aircraft’s actual position prior to take-off. This resulted in an offset error in the displayed heading and a spurious enhanced ground proximity warning system alert shortly after take-off and again on arrival in Melbourne.
- Activation of the enhanced ground proximity warning system probably distracted the crew and prevented them noticing the turn towards the active parallel runway.
Other factors that increased risk
- The crew were presented with an abnormal situation that did not have associated electronic centralised aircraft monitoring or checklist guidance, and was not covered in any training or supplemental information. This increased the risk of misidentification of the situation and further degradation of the aircraft’s systems through incorrect cockpit switch selections.
Other findings
- Effective monitoring and assistance provided by air traffic control reduced the risk to both the occurrence aircraft and other aircraft in the area.
The ATSB reported that during flight preparation the captain (ATPL, 22,580 total hours) manually copied the gate coordinates of S33°56.77' E151°09.8', visible on a sign at the gate, into the flight management and guidance system (FMGS), however mistype as S33°56.77' E015°19.8' effective putting the aircraft's systems 161nm west of Cape Town (South Africa) into the Atlantic Ocean more than 11,000km from the actual position at the gate in Sydney.
The captain subsequently aligned all three Inertial Reference Systems (IRS), parts of the Air Data and Inertial Reference Units (ADIRU), to this position without detecting the typo and confirmed the ALIGN IRS message. The captain subsequently checked the FMGS' progress page showing the GPS as primary source for navigation and position accuracy being high. The captain completed the route programming.
When the first officer (ATPL, 2,200 hours total) returned from the walk around, he checked the flight plan and the progress page and too was satisfied, that the FMGS had been programmed correctly without detecting the typo.
During engine start both crew heard a single chime, however no related ECAM or STATUS message was displayed. Neither crew looked at the overhead panel or MCDU and continued with the departure preparations.
Two more chimes were heard when the aircraft was about to line up runway 16R, again there was no ECAM or STATUS message, hence the crew continued line up. The first officer assumed controls for the departure. Immediately after the aircraft rotated, the EGWS sounded "TERRAIN! TERRAIN!" alerts, the crew anticipated a "PULL UP!" alert, however, this did not occur and the crew believed the EGPWS alert had been spurious. The aircraft was in visual meteorological conditions, it was clearly visible there was no conflict with terrain, hence the captain instructed the first officer to disregard the terrain warning.
When the aircraft climbed through 410 feet AGL the autopilot was engaged, the aircraft turned on a heading of 132 degrees with a heading display of 170 degrees in the cockpit. A few seconds later ATC observed the aircraft turning into the departure path of the parallel runway 16L and held a departure ready on runway 16L.
After the captain had identified the EGPWS warning as spurious the pilots noticed the Navigation Displays did not show any of the expected waypoints, a GPS PRIMARY LOST message appeared. The captain checked with ATC their track, which was about 130 degrees, ATC instructed the crew to turn onto a heading of 220 degrees on their primary display and once the aircraft was on that heading instructed the crew to report their heading displayed on the stand by instruments, which was 180 degrees at that point. The controller verified that the 180 degrees matched his radar display.
The crew attempted to restore their navigation intending to continue the flight to Kuala Lumpur. The captain assumed the role as pilot flying while the first officer attempted to identify the related checklists and work them. In the absence of any STATUS or ECAM message the first officer initially referenced the unreliable airspeed indication checklist, similiar to a training he had recently received, and developed a mindset of the Air Data Reference (ADR) being unreliable.
While working through the various possible checklists the first officer advised the captain that he would switch each of the ADIRUs from NAV to OFF and back in sequence, which would likely disconnect the autopilot, the captain responded "yes". Being interrupted by an ATC communication the first officer subsequently switched off ADIRU1 and ADIRU3 which caused the FBW to drop to alternate law, the autopilot disconnected and several navigation systems degraded. The captain instructed the first officer to stop actioning switches, ADIRU2 remained in the NAV position.
The captain's primary flight display had lost all information except accurate airspeed and vertical speed, the first officer's primary flight display showed airspeed, vertical speed, attitude and an erroneous heading information (the erroneous heading was also shown on the first officer's ND). No map display was available, neither autopilot nor autothrust could be engaged.
The integrated standby instrument system continued to provide attitude and air data from its own independent accelerometers, gyrometers and air data sources (pitot systems).
In view of the degraded navigational performance the captain advised ATC that they would discontinue the flight and return to Sydney, with both captain's and first officer's ND being unusable the captain advised they could only perform a visual approach. Weather conditions in Sydney had deteriorated with a cloud base at 1700 feet and rain showers not permitting a visual approach. ATC established that the weather conditions at Melbourne permitted a visual approach and coordinated with all controllers that they would provide continuous radar vectors to the aircraft to reach Melbourne.
During the first visual approach to Melbourne the crew noticed they were becoming too high and too fast and went around, almost at the same time the EGPWS again issued a spurious warning. The aircraft positioned for a second approach and landed without further incident.
The ATSB reported that following landing extensive tests of the aircraft systems were conducted including swapping around ADIRUs and powering down the entire FMGS, however, no faults were found.
After almost 3 hours on the ground the same flight and cabin crew departed Melbourne and performed an uneventful flight to Kuala Lumpur.
The ATSB analysed:
Airbus service bulletin SB 34-3287 Enhanced ADIRU [air data inertial reference unit] alignment on GPS position was released in 2013. Embodiment of this service bulletin into affected aircraft removed the need for data entry during the initialisation of the air data and inertial reference system (ADIRS). Furthermore, in the event that flight crew did elect to enter the aircraft’s position manually, any errors resulting from that action would be automatically corrected. As such, the enhancement provided by the service bulletin removed the possibility of the ADIRS being initialised to the wrong coordinates through a data entry error.
While compliance with the service bulletin was recommended by Airbus, it was not mandatory and the occurrence aircraft had not received this upgrade. Consequently, this important defence against data entry error was not available at the time of the occurrence.
The ATSB analysed with respect system error detection:
Manual entry of the aircraft’s position during ADIRS initialisation routinely results in the message prompt to ALIGN IRS. As this process is carried out on virtually every flight, it becomes an automatic action for flight crew. Automatic actions are not monitored closely and as such, any errors or incorrect actions will often be missed until it's too late to change them, or an unforeseen consequence has occurred (Reason, 1990).
In addition to the ALIGN IRS prompt, the magnitude of the positional change on this occasion would normally result in the prompt to also REALIGN IRS. The captain reported that some of the A330 fleet required ALIGN IRS to be selected twice, and that he could not remember if he carried out the alignment twice on the occurrence flight. That understanding was incorrect as, in the absence of a system fault, the prompt to ALIGN IRS only occurs once.
Examination of the aircraft’s navigation system following this occurrence did not identify any system fault that would have affected normal operation. It was therefore likely that, following entry of the incorrect aircraft position, ALIGN IRS was displayed, followed by the prompt to also REALIGN IRS. Differentiation between these two prompts would be made more difficult as they were displayed in a similar colour and in close proximity.
In summary, the aircraft’s navigation system probably displayed messages that would have enabled identification of the data entry error. However, due to a combination of the captain’s understanding that the same alignment-related message may be displayed twice, and the similarity between the messages, the error remained undetected.
The ATSB analysed that less than half of the errors committed by flight crew were actually detected, and if detected were detected too late for effective intervention and recovery.
With respect to the data cross check the ATSB analysed therefore:
The combination of expectancy associated with a high frequency routine check with low suspicion of error, and a low chance of error detection during pre-flight, reduced the effectiveness of the FMGS check as a control in detecting the initialisation error. That probably led to the FO not noticing the incorrect initialisation coordinates during the crosscheck of the flight management and guidance system (FMGS) entries after completing the aircraft exterior inspection.
With respect to the GPS accuracy check the ATSB analysed:
The GPS PRIMARY message is typically displayed when the GPS is capable of passing the integrity and accuracy checks by receiving an adequate number of satellites in the correct positions relative to the aircraft and horizon. When this message is active, the two GPSs interface with the respective inertial reference system (IRS) and output a combined position to the FMC. If GPS PRIMARY is active for more than 10 minutes, and the GPS integrity or accuracy check then fail because of an anomaly with the satellite array, the GPS signal is invalidated. The IRS output then reverts to a mixed IRS only position (IRMIX) and eventually GPS PRIMARY LOST is displayed on the ND. There can be a delay of a few minutes between the invalidation of the GPS signal and display of GPS PRIMARY LOST.
During the occurrence the GPS PRIMARY and accuracy HIGH displays were observed prior to pushback and provided a false confirmation that the FMGS was set up correctly. It is probable that at this time the ADIRS initialisation was either incomplete or had not had enough time to invalidate the GPS signal. Eventually the aircraft used the erroneous position from the initialisation error to compare the satellite array, and invalidated the GPS signal. That would have removed the display of GPS PRIMARY and accuracy HIGH on the MCDU progress page. However, this did not occur until the aircraft was taxiing for departure, a time when the crew would not normally be observing that page. As a result, there was limited potential to identify the error.
The aircraft-generated post-flight report indicated that faults associated with failure of GPS integrity checks occurred 14 and 9 minutes prior to take-off. These failures were the result of the positional error and occurred while the aircraft was being taxied for take-off. Both of these faults are designed to have an associated single chime master caution aural alert, and the respective GPS NAV (1, 2) FAULT should appear on the engine/warning display. There were no associated ECAM messages indicating faults to either GPS.
The crew reported hearing two individual chimes during the taxi but, as there was no associated ECAM message, they continued with normal procedures and prepared for take-off. It is likely that a message associated with failure of the GPS integrity check did appear on the engine warning display but the crew did not recall seeing one.
Activation of the GPS NAV (1,2) FAULT alert would normally indicate a loss of GPS PRIMARY and result in the display of GPS PRIMARY LOST on the ND. However, due to complexity of the system there is variation in the time required to display this message. It was therefore not possible to determine if this message was displayed on the ND prior to take-off and remained unnoticed by the crew. Alternatively, GPS PRIMARY LOST may not have been displayed until the aircraft was airborne.
A review of the message display logic identified that the ECAM warning FMS/GPS POSITION DISAGREE also normally activates when an erroneous position is entered during IRS alignment. However, there was no evidence from the flight crew, flight data or post-flight report that this occurred. Advice from Airbus was that, similar to the above discussion regarding display of the GPS PRIMARY LOST message, there may not have been sufficient time for the message to be displayed.
The ATSB analysed that the captain attributed the lack of ECAM messages during the departure preparation as an indicator the systems were working correctly despite the chime sounds. He had never experienced any chime without associated ECAM messages. The ATSB wrote: "The operating philosophy and views of the flight crew indicate a high expectancy that ECAM guidance would be available to resolve most abnormal situations, including that being experienced out of Sydney. In those rare situations where this guidance is not available, it could reasonably be expected that the risk of misidentification and/or inappropriate attempts to resolve the situation would increase."
With respect to ATC the ATSB offered praise in their analysis:
A review of the ATC response to this occurrence identified that the controllers carried out several tasks that reduced the risk to both the occurrence aircraft and other aircraft in the area. They were the first to notice and alert the crew to the tracking problem, and provided assistance to identify that the aircraft’s main heading indicators were erroneous. Additionally, ATC quickly resolved a possible conflict with another aircraft lined-up and ready to depart on the parallel runway.
Subsequently, coordination with several ATC units and the availability of continuous radar coverage provided the crew with a safe diversion alternate and vectoring from Sydney all the way to final approach in Melbourne. The captain reported that ATC had prevented the situation becoming a ‘dire emergency’ and that in many ways they had ‘saved the day’.
ky: