On the morning of 18 July 2014, a Boeing 777, registered A6-ECO, was on descent into Melbourne, Victoria via an ARBEY 4U Standard Arrival Route (STAR) for the Area Navigation U (RNAV-U) Required Navigation Performance (RNP) runway 16 approach. There was some cloud and showers in the area at the time, with the wind from the south-west.
The ARBEY 4U STAR required that the aircraft track from ARBEY to BUNKY, then to the Bolinda (BOL) non-directional (radio) beacon. The STAR chart depicted a minimum en route altitude of 3,400 ft and a minimum terrain clearance altitude of 3,700 ft, between BUNKY and BOL. The RNAV-U (RNP) runway 16 approach chart included an ‘at or above’ 4,000 ft altitude restriction at BOL when joining the approach from the ARBEY STAR.
As the aircraft approached BUNKY, air traffic control (ATC) cleared the crew to descend to 4,000 ft, and cleared the crew for the RNAV-U (RNP) runway 16 approach. ATC radar data shows that the aircraft overflew BUNKY at 5,000 ft, then continued descent, passing through 4,000 ft about 5 NM prior to BOL. Descent then continued, leading to an ATC Minimum Safe Altitude Warning alert as the aircraft descended through about 3,400 ft, about 4 NM prior to BOL. ATC questioned the crew about their altitude, and advised them that the relevant radar lowest safe altitude was 3,200 ft. Moments later the aircraft passed over BOL at about 3,000 ft and maintained that altitude until intercepting the vertical profile of the RNAV-U (RNP) runway 16 approach. The approach continued for an uneventful landing.
The operator’s investigation found that descent below the 4,000 ft altitude restriction at BOL occurred because the crew programmed the Flight Management Computer (FMC) to overfly BOL at a ‘hard altitude’ of 3,000 ft. The operator’s investigation found that the potential for deviation below the 4,000 ft minimum altitude restriction at BOL was increased by factors related to aeronautical charts and the FMC navigation database.
For operators, this incident highlights the need for careful attention to FMC navigation data management, particularly any procedures that relate to crew modification of navigation data. Operators should remain mindful that any manipulation of FMC navigation data by flight crew has the potential to introduce errors. Additionally, operators are encouraged to work closely with aeronautical information service providers to ensure that aeronautical charts (and any other operational information) are presented in a manner that minimises ambiguity and reduces the potential for misinterpretation. For flight crew, this incident highlights the need for careful attention to approach procedure documentation and FMC navigation data management.
On the morning of 18 July 2014, a Boeing 777 operated by Emirates Airlines, registered A6-ECO, was on descent into Melbourne, Victoria via an ARBEY 4U Standard Arrival Route (STAR) for the Area Navigation U (RNAV-U) Required Navigation Performance (RNP) runway 16 approach. There was some cloud and showers in the area at the time, with the wind from the south-west.
The ARBEY 4U STAR required that the aircraft track from ARBEY to BUNKY, then to the Bolinda (BOL) non-directional (radio) beacon (NDB). The arrival procedure included speed and altitude restrictions at BUNKY, and a speed restriction at BOL, but there was no altitude restriction at BOL depicted on the STAR chart. Even though there was no altitude restriction depicted at BOL, the STAR chart depicted a minimum en route altitude (MEA) of 3,400 ft and a minimum terrain clearance altitude (MTCA) of 3,700 ft, between BUNKY and BOL (Figure 1).
Source: Aircraft operator – image cropped by the ATSB
The ARBEY 4U STAR linked to the RNAV-U (RNP) runway 16 approach at BOL, which was identified as the initial approach fix for the RNAV-U (RNP) runway 16 approach. While no altitude was specified at BOL on the STAR chart, the RNAV-U (RNP) runway 16 approach chart depicted two altitudes at BOL (Figure 2). These were:
- an ‘at or above’ 4,000 ft altitude restriction at BOL when joining the approach from the ARBEY STAR
- an ‘at or above’ 3,000 ft altitude restriction at BOL applicable when the approach was linked with STAR procedures other than the ARBEY STAR.
Source: Aircraft operator – image cropped by the ATSB
As the aircraft approached BUNKY, air traffic control (ATC) cleared the crew to descend to 4,000 ft, and to conduct the RNAV-U (RNP) runway 16 approach. ATC radar data shows that the aircraft overflew BUNKY at 5,000 ft, then continued descent, passing through 4,000 ft about 5 NM prior to BOL. During the approach setup, the Flight Management Computer (FMC) indicated an altitude constraint for BOL of ‘at or above 3,000 ft’. The crew then selected this to an ‘at 3,000 ft’ constraint, which programmed the aircraft to overfly BOL at a ‘hard altitude’ of 3,000 ft.
Descent then continued, and ATC received a Minimum Safe Altitude Warning (MSAW) alert, as the aircraft descended through 3,400 ft about 4 NM prior to BOL (Figure 3). ATC questioned the crew about their altitude, and advised them that the relevant radar lowest safe altitude was 3,200 ft. Moments later, the aircraft passed over BOL at about 3,000 ft and maintained that altitude until intercepting the vertical profile of the RNAV-U (RNP) runway 16 approach. ATC then transferred the crew to the next frequency, and the crew confirmed they had the correct QNH setting. The approach continued for an uneventful landing.
A subsequent review of the ATC radar data showed that the aircraft left controlled airspace as it descended through 3,500 ft. The aircraft was briefly outside controlled airspace until it reached the 15 NM airspace boundary step, where the lower limit of controlled airspace became 2,500 ft. There was no report of conflict with other traffic outside of controlled airspace. Throughout the incident, the crew maintained visual contact with the terrain, and could see the airport environment from some distance out. No aircraft ground proximity warning system alerts were triggered during the incident.
Source: Airservices Australia (modified by the ATSB)
Review of the factors identified in the investigation
The operator’s investigation found that descent below the 4,000 ft altitude restriction at BOL occurred because the crew selected the ‘hard altitude’ of 3,000 ft for BOL. The potential for deviation below the 4,000 ft minimum altitude restriction at BOL was increased by factors related to aeronautical charts and the FMC navigation database. Some of these factors are discussed in the following paragraphs.
The ATSB obtained comments and responses from involved parties including:
- the United Arab Emirates General Civil Aviation Authority on behalf of Emirates Airlines
- Airservices Australia
- the Civil Aviation Safety Authority (CASA).
The RNP approach had been designed by GE Naverus (Naverus), based on information in the Airservices Australia Aeronautical Information Package (AIP). The charts and FMC data used by Emirates were supplied by LIDO. LIDO developed the charts and database based on information in the Airservices AIP.
Procedure design – level depiction on the ARBEY STAR
No minimum altitude was specified at BOL on the ARBEY FOUR STAR.
Within the STAR, BOL had a coded speed restriction of a maximum 185 kt for approaches to runway 16, but did not specify a minimum crossing altitude. This allowed arrivals from other directions to cross BOL at a minimum altitude of 3,000 ft, instead of 4,000 ft as required via ARBEY. This conditional altitude restriction was specified in the approach charts only and not on the STAR chart. This procedure design did not protect the MEA of 3,400 ft on the arrival segment from position BUNKY to position BOL by a 'hard procedural altitude'. BOL is located at a distance of 11.6 NM from runway 16 and a crossing altitude of 4,000 ft would permit a constant approach angle crossing BOL on a 3.0° vertical descent path. Based on this, a lower crossing altitude (3,000 ft) for other arrival directions does not seem necessary.
The operator suggested that Airservices Australia consider procedural amendments to specify a minimum crossing altitude over BOL (of 4,000 ft or above) for all approaches and within the STAR design. This would protect against descents below MEA (and outside controlled airspace) within the arrival segment from BUNKY to BOL. It would also satisfy the requirement of Airservices Australia to be able to specify higher crossing altitudes (above 4,000 ft) for traffic separation. If Airservices Australia, as the State AIP, changed the procedure design, the various chart providers would then amend their corresponding FMC/FMS databases as well as the STAR and instrument approach charts.
CASA suggested a possible solution would be to include the altitude restriction in the STAR chart. This would then make the altitude obvious on the text and plan view, and the altitude restriction would be coded in the FMS. They also found that the overall complexity of the STAR chart did not aid pilots’ awareness.
In controlled airspace, the approach procedures are designed to keep aircraft 500 ft above the control area steps. The 4,000 ft minimum altitude was designed to keep aircraft in controlled airspace prior to BOL, rather than for terrain clearance.
Airservices further commented that a minimum altitude of 4,000 ft was not depicted on the STAR chart at BOL, as BOL was also applicable to the runway 27 arrival. This allows ATC to assign a higher altitude at that point for a runway 27 arrival due to potential runway 34 departures. No altitudes are depicted because two (or more) levels would be required to cater for the different runways. Only one level is permitted to be depicted against a waypoint (for a STAR) to avoid potential confusion as per Section 1-1-22 of Airservices 'Departure, Arrival and Air Route Management Design Rules' manual (ATS-MAN-0010).
Altitude requirements are not always specified on a STAR chart, and ATC is generally responsible for deciding whether altitudes are to be included or not. This occurs in the procedure design phase. When they are not included on the chart, ATC assigns individual altitudes to aircraft in order to facilitate vertical separation between them and assure terrain clearance.
RNAV-(U) RNP runway 16 approach chart design
Approaches with multiple altitudes at a common fix
Airservices withdrew the RNAV-U (RNP) runway 16 approach early in 2015. Its withdrawal was not related to this incident. The ATSB reviewed all Australian approach charts published in the AIP Departure and Approach Procedures (DAP) current at the time of writing. The approach charts with a discrepancy between the STAR minimum segment altitude and the approach start altitude were Melbourne approach charts ILS – X, Y and Z runway 16, RNAV Z (GNSS) runways 16 and 27. No other Australian approach charts existed with that condition.
Chart depiction of the altitude restriction at BOL – operator comments
The operator reported that the absence of altitude restriction information on the STAR chart reduced the level of protection against deviation below the BOL minimum altitude restriction. The 4,000 ft altitude restriction at BOL when tracking from ARBEY STAR was physically depicted below the 3,000 ft altitude restriction applicable to other STAR procedures (see Figure 4a). This may also have influenced the crew’s interpretation of the FMC altitude.
The following two figures show a comparison of two presentation options for multiple arrival altitudes. These altitudes are boxed in red.
Figure 4a: RNAV (RNP) approach chart used by the crew
Source: GCAA for chart provider (LIDO) modified by the ATSB
Figure 4b: RNAV (GNSS) Z approach chart
Source: GCAA for chart provider (LIDO) modified by the ATSB
Chart provider comments
The chart provider (LIDO) commented that presentation of information on a chart is normally at the discretion of the chart editor and based on:
- the amount of information which needs to be charted
- the amount of information already on the chart
- the space available for the information, based on standard font sizes.
If the information can be charted clearly using a leader line, this is used (see Figure 4a). As soon as the information exceeds two lines, the preference is usually for the information framed together in a box with a ball note at the point in question (see Figure 4b).
The chart provider advised that on the RNAV (RNP) chart the higher value (4000) should have been depicted above the lower value (3000). They reiterated that the approach chart (Figure 4a) used in this incident is no longer valid.
RNAV-U (RNP) runway 16 approach chart profile view
The approach chart provided a vertical profile view of the approach, but the view began immediately prior to intermediate fix (IF), waypoint UGARU, which is 4.4 NM beyond BOL (Figure 5a). As such, there was no profile view information on the approach chart for the approach from the initial approach fix (IAF) BOL, to UGARU. Had this information been present in a vertical profile, it may have alerted the crew to the different altitude requirements at BOL, associated with the different STAR procedures.
Source: Aircraft operator
Vertical profile view – operator comments
The operator noted that the profile view of Naverus charts was inconsistent with similar Airservices Australia charts. For example, the RNAV-Z (GNSS) runway 16 approach chart, which was designed by Airservices Australia, provided the important hazard information of the different minimum crossing altitudes over BOL in the profile view (Figure 5b). However the RNAV-U (RNP) runway 16 approach chart, which was designed by Naverus, depicted these altitudes in the plan view only. The operator considered that extension of the profile view, as published on similar Airservices Australia charts, would assist flight crews to select the correct altitude for the IAF.
Source: Airservices Australia
The operator suggested that the profile view of the Naverus charts should be amended to conform to that of the Airservices Australia charts.
Airservices advised that the standard for the approach profile view was to commence at the final approach fix (FAF), and not to include the initial approach fix (IAF). Airservices opted to trial the inclusion of the IAF, in this case BOL, in the profile view of other similar charts. While its inclusion made the approach altitude clearer, Airservices stated that it was not likely to be adopted as the convention, either generally by Airservices or internationally. Naverus charts conform to the ICAO standard, and therefore the profile view did not commence at the IAF.
FMC navigation data
Consistent with the STAR chart, the ARBEY 4U STAR FMC navigation data did not include an altitude restriction at BOL (Figure 6). FMC navigation data for the RNAV-U (RNP) runway 16 approach included an altitude restriction at BOL, but that altitude restriction was ‘3000A’ (meaning ‘at or above’ 3,000 ft) (Figure 7). The 3,000 ft restriction was applicable to a number of STARs that linked with the RNAV-U (RNP) runway 16 approach. But it was not applicable to the ARBEY STAR which had a 4,000 ft restriction.
Source: Aircraft operator modified by the ATSB
Source: Aircraft operator modified by the ATSB
Compliance with the published procedure on this occasion required the crew to modify the FMC vertical profile at BOL by increasing the ‘at or above’ altitude restriction from 3,000 ft to 4,000 ft. Any requirement to modify the vertical profile brings about the potential to introduce errors, the consequences of which may be more significant when the FMC default altitude needs to be increased. If an error is introduced when the FMC vertical profile is modified, vertical path indications displayed to the crew during the approach may be misleading.
At the time of the incident, the FCOM stated that crews could change an FMC IAF ‘at or above’ altitude constraint, to an ‘at’ altitude constraint, using the same altitude. Technically therefore, the crew were unable to change the coded 3000A to the correct 4000A. This ambiguity within the FCOM procedure was raised with the aircraft manufacturer via the fleet technical pilots. At the time of publication, a response from the manufacturer was still pending.
FMC approach altitude
As depicted in Figure 6, there was no altitude on the STAR coded in the FMC, so when the crew selected approach mode, the 3000A appeared as the relevant altitude restriction for BOL. Only one altitude can be selected by the FMC. The ATSB was unable to clarify what coding logic was applied to determine which altitude is selected when two are provided.
The aircraft operator commented that they did not raise this issue with the FMC database provider, as the database coding reflects the AIP procedure design. The aircraft operator considered the conditional altitude over the waypoint BOL to be a procedure design weakness and raised that with Airservices Australia accordingly. The approach is no longer valid, but the operator intends to closely monitor for this issue in any new approaches.
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Crew awareness of restrictions on STAR
Soon after the occurrence, the aircraft operator published a company Notice to Airmen (NOTAM) for crew awareness. The NOTAM pointed out that approaches into Melbourne may include altitude restrictions that depend on the particular STAR being flown. The NOTAM also pointed out that some altitude restrictions may be depicted on the approach chart plan view only, and not necessarily on the relevant STAR chart, or the approach chart profile view. The NOTAM advised crews to exercise caution when reviewing STAR and approach procedures to ensure that all applicable altitude restrictions were observed.
Flight crew operations manual
The operator intends to reconsider Flight Crew Operations Manual guidance dealing with the benefits of changing initial approach fix ‘at or above’ altitude restrictions to hard altitudes, and discuss the depiction of altitude restrictions on the relevant charts with the chart provider.
Flight management computer coding
The operator has identified the FMC coding issue as a threat in their Hazard Identification and Risk Assessment statements. All new destinations and also, within the review cycle, existing destinations, will be checked against this threat and corrective action will be taken if applicable.
Airservices and CASA
CASA and Airservices intend to discuss the coding of the FMC at the next international instrument procedures panel, where an ‘integration’ subgroup includes FMC coding specialists. The aim of the discussion is to ensure the charts are used in the cockpit the way they are intended.
For operators, this incident highlights the need for careful attention to FMC navigation data management, particularly any procedures that relate to crew modification of navigation data. Operators should remain mindful that any manipulation of FMC navigation data by flight crew has the potential to introduce errors. Additionally, operators are encouraged to work closely with aeronautical information service providers to ensure that aeronautical charts (and any other operational information) are presented in a manner that minimises ambiguity and reduces the potential for misinterpretation.
For flight crew, this incident highlights the need for careful attention to approach procedure documentation and FMC navigation data management.
For producers and providers of aeronautical information products, a guiding principle specified in Procedures for Air Navigation Services, Aircraft Operations is to keep all charts as simple as possible. This may assist in reducing flight crew workload and the risk of error, and coding issues when entering data into flight management systems.
- A STAR is a published instrument flight rules arrival route that links the en route airways system to a fix at or near the destination airport.
- An NDB is a radio transmitter at a known location, used as a navigational aid. The signal transmitted does not include inherent directional information.
- The minimum en route altitude (MEA) and the minimum terrain clearance altitude (MTCA) are calculated differently, and both are depicted on the STAR chart used by the operator. Only the minimum en route altitude is depicted on the corresponding Airservices Australia STAR chart.
- The FMC provides aircraft navigation, lateral and vertical guidance, and aircraft performance functions.
- MSAW is a ground-based system intended to alert ATC to an increased risk of an aircraft collision with terrain.
- QNH is an altimeter barometric pressure subscale setting. With QNH set, an altimeter provides an indication of the height of the aircraft above mean sea level.
- The ball note, as depicted in Figure 3b, includes the black circle with reference number 1 at BOL, with the explanation in the box using the same black dot (or ‘ball’) and matching reference number (or letter).